{"id":16495,"date":"2018-10-09T08:47:57","date_gmt":"2018-10-09T08:47:57","guid":{"rendered":"https:\/\/ephesoft.com\/docs\/?p=16495"},"modified":"2021-10-18T11:19:11","modified_gmt":"2021-10-18T18:19:11","slug":"integrating-ephesoft-with-ldap","status":"publish","type":"docs","link":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/","title":{"rendered":"Integrating Ephesoft Transact with LDAP"},"content":{"rendered":"<p>This article provides the configuration steps to integrate Transact with LDAP.<\/p>\n<p>In Ephesoft Transact, there are three properties files that you will need to configure:<\/p>\n<ol>\n<li>server.xml<\/li>\n<li>user-connectivity.properties<\/li>\n<li>application.properties<\/li>\n<\/ol>\n<h2>What is required to configure Ephesoft Transact with LDAP?<\/h2>\n<p>In order to successfully integrate Ephesoft Transact with LDAP, it becomes essential to understand the directory structure first. If you do not have any knowledge on how your LDAP looks you will not able to configure the Transact configuration files.<\/p>\n<p>We expect that users are having at least below knowledge of their LDAP:<\/p>\n<ul>\n<li>A user which exist in the directory.<\/li>\n<li>Password of the user as mentioned above.<\/li>\n<li>Difference between domain controllers, Organizational Units, Groups and Users.<\/li>\n<li>Information on where does Users exist in LDAP.<\/li>\n<li>Information on where does Groups exist in LDAP.<\/li>\n<li>Users are mapped with respective groups.<\/li>\n<\/ul>\n<h2>Sample Directory Structure Example to be used to Configure LDAP<\/h2>\n<p>In this section, we will go through an example of a directory structure that will help us to configure Transact to integrate with LDAP.<\/p>\n<p>After looking at the below LDAP structure we will understand the information required in order to configure Transact with LDAP.<\/p>\n<ul>\n<li>We have a domain controller with a name <strong>com.ephesoft<\/strong> where <em>root domain<\/em> name is &#8220;com&#8221; and it is having a <em>sub-domain<\/em> called &#8220;ephesoft&#8221;. These domains are denoted with abbreviation &#8220;dc&#8221;.<\/li>\n<li>There can be more than 1 sub-domain as well like com.ephesoft.support or similar as per your organization structure.<\/li>\n<li>In the below Directory Structure we have two OU called groups AND people.<\/li>\n<li><strong>groups<\/strong> OU consist of Groups \/ Roles in LDAP. We have 5 groups with the name admin, role1, role2, role3 and role4.<\/li>\n<li><strong>people<\/strong> OU consist of Users in the LDAP. We have 5 users with the name aj,ephesoft,user1,user2 and user4.<\/li>\n<li>We know that user &#8220;ephesoft&#8221; is added to the group admin.<\/li>\n<\/ul>\n<p><a href=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/LDAP.png\"><img decoding=\"async\" class=\"alignnone size-full wp-image-16497\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/LDAP.png\" alt=\"\" width=\"1920\" height=\"1039\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/LDAP.png 1920w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/LDAP-300x162.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/LDAP-768x416.png 768w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/LDAP-1024x554.png 1024w\" sizes=\"(max-width: 1920px) 100vw, 1920px\" \/><\/a><\/p>\n<p>We now have all the required information in order to configure Transact with LDAP.<\/p>\n<h2><strong>Understanding Roles in Transact<\/strong><\/h2>\n<p>In Transact, we distinguish roles on the basis of below:<\/p>\n<ul>\n<li>Super Administrator: A super Administrator has complete access to the Transact User Interface.<\/li>\n<li>Administrator: An Administrator doesn&#8217;t have access to System Configuration User Interface<\/li>\n<li>Operator: An Operator usually has access to Non-Admin User Interfaces like Batch List, Review Validate, and so on.<\/li>\n<\/ul>\n<h2>Configuring the Transact Server.xml File<\/h2>\n<p>In the server.xml file, we define information about LDAP. The configuration in this file helps to authenticate the users and fetch users and groups from LDAP. Below is a sample screenshot of Realm Setting in server.xml which is used to connect to LDAP and tries to authenticate users.<\/p>\n<p><a href=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/ServerxmlLDAP.png\"><img decoding=\"async\" class=\"alignnone size-full wp-image-16498\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/ServerxmlLDAP.png\" alt=\"\" width=\"713\" height=\"270\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/ServerxmlLDAP.png 713w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/ServerxmlLDAP-300x114.png 300w\" sizes=\"(max-width: 713px) 100vw, 713px\" \/><\/a><\/p>\n<ul>\n<li><strong>className<\/strong>: This needs to be set to\u00a0org.apache.catalina.realm.JNDIRealm. This refers to JNDIRealm class which in tomcat.<\/li>\n<li><strong>connectionURL<\/strong>: We need to define the URL of the LDAP Server. It is of the form of ldap:\/\/&lt;IP,DNS,FQDN&gt;:&lt;PORT&gt; where port in case of LDAP needs to be 389 or 636 (If we have LDAPS i.e. Secure LDAP).<\/li>\n<li><strong>connectionName<\/strong>: We need to define the Distinguished Name of any user who exist in the LDAP. In the screenshot above cn=Manager,dc=ephesoft,dc=com means that user with the name &#8220;Manager&#8221; exists under &#8220;ephesoft&#8221; sub-domain and &#8220;com&#8221; root-domain.<\/li>\n<li><strong>connectionPassword<\/strong>: We need to provide the password for the user defined in connectionName.<\/li>\n<li><strong>userBase<\/strong>: The relative path under which all the users\u2019 information will be located. This attribute defines where to look for a user. In our example above we are looking for users directly under our sub-domain. Therefore it will look for user under the sub-domain as well as in all the Organizational Units as well.<\/li>\n<li><strong>userSearch<\/strong>: This is the pattern specifying the LDAP search filter to use after substitution of the username. Possible values is &#8220;cn={0}&#8221;.<\/li>\n<li><strong>roleBase:<\/strong>\u00a0The relative path under which all the roles information will be located. This attribute defines where to look for a role corresponding to a user. In this example we are searching for all Roles \/ Groups under sub-domain &#8220;ephesoft&#8221;\u00a0as well as in all the Organizational Units.<\/li>\n<li><strong>roleName:<\/strong>\u00a0the attribute in a role entry containing the name of that role. In above example value of cn attribute in LDAP will be checked.<\/li>\n<li><strong>roleSearch:<\/strong>\u00a0the LDAP search filter for selecting role entries. It optionally includes pattern replacements &#8220;{0}&#8221; for the distinguished name. In above example uniqueMember property of user in LDAP will be looked up.<\/li>\n<li><strong>userSubtree<\/strong>: the search scope. Set to true\u00a0if you wish to search the entire sub tree rooted at the\u00a0<strong>userBase<\/strong>\u00a0entry.<\/li>\n<li><strong>roleSubtree<\/strong>:\u00a0the search scope. Set to true\u00a0if you wish to search the entire sub tree rooted at the\u00a0<strong>roleBase<\/strong>\u00a0entry.<\/li>\n<\/ul>\n<h2><strong>Configuring Ephesoft user-connectivity.properties<\/strong><\/h2>\n<ul>\n<li>user-connectivity.properties file is configured to take care of the Authorization part and group filtering. We can apply limitations on what groups \/ roles needs to be fetched from the LDAP.<\/li>\n<li>Below is an example for configuring user-connectivity.properties file<\/li>\n<\/ul>\n<p><a href=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/userconldap.png\"><img decoding=\"async\" class=\"alignnone wp-image-16499\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/userconldap-e1634573876212-1024x303.png\" alt=\"\" width=\"1000\" height=\"296\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/userconldap-e1634573876212-1024x303.png 1024w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/userconldap-e1634573876212-300x89.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/userconldap-e1634573876212-768x228.png 768w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/userconldap-e1634573876212.png 1380w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/><\/a><\/p>\n<ul>\n<li><strong>user.connectivity_url<\/strong>:\u00a0We need to define the URL of the LDAP Server. It is of the form of ldap:\/\/&lt;IP,DNS,FQDN&gt;:&lt;PORT&gt; where port in case of LDAP port needs to be 389 or 636 (LDAPS).<\/li>\n<li><strong>user.connectivity_domain_component_name<\/strong>: We need to put in the sub-domain information. If we have more than one sub-domain like com.ephesoft.support then we need to define convention for user.connectivity_domain_component_name=support,dc=ephesoft<\/li>\n<li><strong>user.connectivity_domain_component_organization<\/strong>: We need to give the root level domain name.<\/li>\n<li><strong>user.connection<\/strong>: This property needs to be set to 0 if we need to use AD.<\/li>\n<li><strong>user.ldap_user_base<\/strong>: This is ldap related property and we can define specific OU if we only want to pick users from specific context path. Example:\u00a0user.ldap_user_base=ou=groups.<\/li>\n<li><strong>user.ldap_group_base<\/strong>: This is ldap related property and we can define specific OU if we only want to pick groups from specific context path or organizational unit.\u00a0Example:\u00a0user.ldap_group_base=ou=people.<\/li>\n<\/ul>\n<h2>Configuring the Transact application.properties File<\/h2>\n<ul>\n<li>This file is used to set the super admin group details.<\/li>\n<li>Two properties that require change is\u00a0 user.super_admin where we define super admin groups and\u00a0update_super_admin_group where we will need to change the flag to true.<\/li>\n<\/ul>\n<h2>Access Management on Ephesoft User Interface<\/h2>\n<p>The Access Manager UI is where access control can be assigned to other groups. From this UI, the Super Admin can set security access for other roles such as which roles can access various Transact User Interfaces. Only the Super Admin can provide access to other groups and assign roles. The Super Admin assigns access by selecting one or more boxes.<\/p>\n<p><a href=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/accessmanagerroles.png\"><img decoding=\"async\" class=\"alignnone wp-image-16500 size-full\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/accessmanagerroles-e1634573787870.png\" alt=\"\" width=\"1920\" height=\"364\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/accessmanagerroles-e1634573787870.png 1920w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/accessmanagerroles-e1634573787870-300x57.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/accessmanagerroles-e1634573787870-768x146.png 768w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/accessmanagerroles-e1634573787870-1024x194.png 1024w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/accessmanagerroles-e1634573787870-1536x291.png 1536w\" sizes=\"(max-width: 1920px) 100vw, 1920px\" \/><\/a><\/p>\n<p>The Super Admin can also assign access to batch classes and batch instances from the Batch Class Management screen <strong>Roles<\/strong> column. In the example below, role1 can access the batch class BC3A and any batch instances associated with BC3A.<a href=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/batchclassrole.png\"><img decoding=\"async\" class=\"alignnone wp-image-16501 size-full\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/batchclassrole-e1634573653924.png\" alt=\"\" width=\"1555\" height=\"652\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/batchclassrole-e1634573653924.png 1555w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/batchclassrole-e1634573653924-300x126.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/batchclassrole-e1634573653924-768x322.png 768w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/batchclassrole-e1634573653924-1024x429.png 1024w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/batchclassrole-e1634573653924-1536x644.png 1536w\" sizes=\"(max-width: 1555px) 100vw, 1555px\" \/><\/a><\/p>\n","protected":false},"featured_media":0,"parent":47680,"menu_order":4,"comment_status":"closed","ping_status":"closed","template":"","doc_tag":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v19.0 (Yoast SEO v22.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Integrating Ephesoft Transact with LDAP | Ephesoft Docs<\/title>\n<meta name=\"robots\" content=\"noindex, follow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Integrating Ephesoft Transact with LDAP\" \/>\n<meta property=\"og:description\" content=\"This article provides the configuration steps to integrate Transact with LDAP. In Ephesoft Transact, there are three properties files that [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/\" \/>\n<meta property=\"og:site_name\" content=\"Ephesoft Docs\" \/>\n<meta property=\"article:modified_time\" content=\"2021-10-18T18:19:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/LDAP.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/\",\"url\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/\",\"name\":\"Integrating Ephesoft Transact with LDAP | Ephesoft Docs\",\"isPartOf\":{\"@id\":\"https:\/\/ephesoft.com\/docs\/#website\"},\"datePublished\":\"2018-10-09T08:47:57+00:00\",\"dateModified\":\"2021-10-18T18:19:11+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/ephesoft.com\/docs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Transact\",\"item\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"System Configuration\",\"item\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"User Connectivity\",\"item\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/\"},{\"@type\":\"ListItem\",\"position\":5,\"name\":\"LDAP and OpenLDAP Resources\",\"item\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/\"},{\"@type\":\"ListItem\",\"position\":6,\"name\":\"Integrating Ephesoft Transact with LDAP\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/ephesoft.com\/docs\/#website\",\"url\":\"https:\/\/ephesoft.com\/docs\/\",\"name\":\"Ephesoft Docs\",\"description\":\"Intelligent Document Processing Made Easy\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/ephesoft.com\/docs\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Integrating Ephesoft Transact with LDAP | Ephesoft Docs","robots":{"index":"noindex","follow":"follow"},"og_locale":"en_US","og_type":"article","og_title":"Integrating Ephesoft Transact with LDAP","og_description":"This article provides the configuration steps to integrate Transact with LDAP. In Ephesoft Transact, there are three properties files that [&hellip;]","og_url":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/","og_site_name":"Ephesoft Docs","article_modified_time":"2021-10-18T18:19:11+00:00","og_image":[{"url":"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/09\/LDAP.png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/","url":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/","name":"Integrating Ephesoft Transact with LDAP | Ephesoft Docs","isPartOf":{"@id":"https:\/\/ephesoft.com\/docs\/#website"},"datePublished":"2018-10-09T08:47:57+00:00","dateModified":"2021-10-18T18:19:11+00:00","breadcrumb":{"@id":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/integrating-ephesoft-with-ldap\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ephesoft.com\/docs\/"},{"@type":"ListItem","position":2,"name":"Transact","item":"https:\/\/ephesoft.com\/docs\/products\/transact\/"},{"@type":"ListItem","position":3,"name":"System Configuration","item":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/"},{"@type":"ListItem","position":4,"name":"User Connectivity","item":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/"},{"@type":"ListItem","position":5,"name":"LDAP and OpenLDAP Resources","item":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/"},{"@type":"ListItem","position":6,"name":"Integrating Ephesoft Transact with LDAP"}]},{"@type":"WebSite","@id":"https:\/\/ephesoft.com\/docs\/#website","url":"https:\/\/ephesoft.com\/docs\/","name":"Ephesoft Docs","description":"Intelligent Document Processing Made Easy","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ephesoft.com\/docs\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}},"comment_count":0,"_links":{"self":[{"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs\/16495"}],"collection":[{"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/comments?post=16495"}],"version-history":[{"count":4,"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs\/16495\/revisions"}],"predecessor-version":[{"id":49444,"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs\/16495\/revisions\/49444"}],"up":[{"embeddable":true,"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs\/47680"}],"prev":[{"title":"How To Configure OpenLDAP","link":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/ldap-and-openldap-resources\/how-to-configure-openldap\/","href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs\/2513"}],"wp:attachment":[{"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/media?parent=16495"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/doc_tag?post=16495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}