10.2. LDAP Configuration Defaults

When a particular LDAP server type is selected, SavaPage applies server type defaults to query the LDAP server. These defaults can be used as a starting point for customizing the LDAP searches or for supporting other server types.

10.2.1. OpenLDAP

If the LDAP server is configured to support OpenLDAP based authentication, the following defaults are used.

OpenLDAP Default Settings

Configuration property	Default value
ldap.schema.user-name-field	uid
ldap.schema.user-full-name-field	cn
ldap.schema.user-email-field	mail
ldap.schema.user-department-field	departmentNumber
ldap.schema.user-office-field	This item is not set.
ldap.schema.user-name-search	(uid={0})
ldap.schema.group-name-field	cn
ldap.schema.group-full-name-field	displayName
ldap.schema.group-member-field	member
ldap.schema.group-search	(&(cn={0})(objectClass=groupOfNames))
ldap.schema.posix-groups	N

10.2.2. FreeIPA

The defaults for FreeIPA based authentication are identical to OpenLDAP.

10.2.3. Apple Open Directory

If the LDAP server is configured to support Apple Open Directory based authentication, the following defaults are used.

Apple Open Directory Default Settings

Configuration property	Default value
ldap.schema.user-name-field	uid
ldap.schema.user-full-name-field	cn
ldap.schema.user-email-field	mail
ldap.schema.user-department-field	departmentNumber
ldap.schema.user-office-field	This item is not set.
ldap.schema.user-name-search	(uid={0})
ldap.schema.group-name-field	cn
ldap.schema.group-full-name-field	displayName
ldap.schema.group-member-field	memberUid
ldap.schema.group-search	(memberUid={0})
ldap.schema.posix-groups	Y

10.2.4. Novell eDirectory Defaults

If the LDAP server is a Novell eDirectory, the following defaults are used [1].

Apple Open Directory Default Settings

Configuration property	Default value
ldap.schema.user-name-field	cn
ldap.schema.user-full-name-field	fullName
ldap.schema.user-email-field	mail
ldap.schema.user-department-field	OU
ldap.schema.user-office-field	l
ldap.schema.user-name-search	(&(cn={0})(objectClass=person))
ldap.schema.group-name-field	cn
ldap.schema.group-full-name-field	fullName
ldap.schema.group-member-field	member
ldap.schema.group-search	(&(member={0})(objectClass=groupOfNames))
ldap.schema.posix-groups	N

[1]

The list of standard Novell eDirectory user fields can be found on NDK: Novell eDirectory Schema Reference.

10.2.5. Microsoft Active Directory Defaults

If the LDAP server is a Microsoft Active Directory, the following defaults are used [2].

Microsoft Active Directory Default Settings

Configuration property	Default value
ldap.schema.user-name-field	sAMAccountName
ldap.schema.user-full-name-field	displayName
ldap.schema.user-email-field	mail
ldap.schema.user-department-field	department
ldap.schema.user-office-field	physicalDeliveryOfficeName
ldap.schema.user-name-search	(&(sAMAccountName={0})(objectCategory=person)(objectClass=user)(sAMAccountType=805306368){1}) The extra {1} in the search is replaced with an optional filter to fetch enabled users only. See “ldap.disabled-users.allow”.
ldap.schema.group-name-field	sAMAccountName
ldap.schema.group-full-name-field	displayName
ldap.schema.group-member-field	member
ldap.schema.group-search	(&(sAMAccountName={0})(objectCategory=group))
ldap.schema.posix-groups	N

Microsoft Active Directory Custom Settings

Configuration property	Default value / Description
ldap.disabled-users.allow	N If Y, then disabled users are accepted in user name searches. If N, they are ignored.
ldap.schema.dn-field	distinguishedName The LDAP field that contains the Distinguished Name (DN).
ldap.schema.user-name-group-search	(&(memberOf={0})(objectCategory=person)(objectClass=user)(sAMAccountType=805306368){1}) This is the LDAP search to retrieve the users from a group. The {0} in the search is replaced with the DN of the user. The {1} in the search is replaced with an optional filter to fetch enabled users only. See “ldap.disabled-users.allow”. IMPORTANT: The search must include the {0} and {1} value.
ldap.schema.nested-group-search	(&(memberOf={0})(objectCategory=group)) This is the LDAP search to retrieve the nested groups from a group. The {0} in the search is replaced with the DN of the group. IMPORTANT: The search must include the {0} value.

Important

Active Directory field names must be in the Ldap-Display-Name format. For example, if you want to use the Employee-Number field, then the field name entered should be employeeNumber as shown on the Employee-Number attribute page.

[2]

The list of standard Active Directory user fields can be found on the Microsoft Active Directory Schema web site.

10.2.6. Google Cloud Directory

The defaults for Google Cloud Directory based authentication are identical to OpenLDAP.

If your organization is allowed to use LDAP for G Suite or Google Cloud Identity services, you can create a certificate that clients like SavaPage can use for user synchronization and authentication. To create the certificate, log in to admin.google.com as Super Admin and add an LDAP Client. Set your Access permissions, download the certificate zip file and save it in a secure location. Finally, switch the LDAP Service status ON in the Client Details. Note that it may take up to 24 hours for the LDAP Client to be active.

The downloaded certificate zip file name contains its expiration date and time: we use Google_2022_10_27_37420.zip as an example. The zip contains the PEM formatted public certificate and private key file.

unzip Google_2022_10_27_37420.zip

# Have a look at the certificate
openssl x509 -in Google_2022_10_27_37420.crt -text -noout

# Certificate:
#    Data:
#        Version: 3 (0x2)
#        Serial Number: 1563872646762 (0x16c1e12d66a)
#    Signature Algorithm: sha256WithRSAEncryption
#        Issuer: O=Google Inc., L=Mountain View, CN=LDAP Client, OU=GSuite, C=US, ...
#        Validity
#            Not Before: Oct 28 10:23:40 2019 GMT
#            Not After : Oct 27 10:23:40 2022 GMT
#        Subject: O=Google Inc., L=Mountain View, CN=LDAP Client, OU=GSuite, C=US, ...
#        Subject Public Key Info:
#   ....

# Check the private key
openssl rsa -in Google_2022_10_27_37420.key -check -noout
# RSA key ok

Use the certificate and private key to create the p12 container needed by SavaPage. In addition store the p12 export password in a separate file. Set strict read permissions on both files.

openssl pkcs12 -inkey Google_2022_10_27_37420.key -in Google_2022_10_27_37420.crt \
               -export -out google-ldap-client-cert.p12

# Enter Export Password:
# Verifying - Enter Export Password:

sudo chown savapage:savapage google-ldap-client-cert.p12
sudo chmod 400 google-ldap-client-cert.p12
sudo mv google-ldap-client-cert.p12 /opt/savapage/server/data
sudo su - savapage
cd server/data

# Create file with Export Password to unlock p12 file
echo "password=export-password" > google-ldap-client-cert.pw
chmod 400 google-ldap-client-cert.pw

If google-ldap-client-cert.p12 and google-ldap-client-cert.pw are present in /opt/savapage/server/data the Google Cloud Directory option will be available at LDAP.