Active Directory mixed configuration with LDAP synced

The objective of this kind of configuration is to authenticate against Active Directory and, at the same time, obtain roles, usernames, and email addresses from the database. When this configuration is enabled, a cron job named “Sync LDAP users” periodically synchronizes the Active Directory users’ data (username, email addresses) in the OpenKM database and removes any database user that is not present in the Active Directory user list.

LDAP structure

dc=com
    dc=company
        cn=users
            sAMAccountName=okmAdmin
                cn=users,dc=company,dc=com
                userPrincipalName=okmAdmin@mail.com
                cn=OpenKM Administrator
            sAMAccountName=user1
                cn=users,dc=company,dc=com
                userPrincipalName=user1@mail.com
                cn=User Name 1
            sAMAccountName=user2
                cn=users,dc=company,dc=com
                userPrincipalName=user2@mail.com
                cn=User Name 3

Caution

The OpenKM integration with LDAP has two steps. In the first step, the “Sync LDAP users” cron job creates the users in the OpenKM database from the LDAP directory. In the second step, authentication against the LDAP directory is configured in the openkm.properties file; this configuration always works in real time.

Step 1 - configuration parameters

Caution

We suggest logging into OpenKM with the admin URL (for example, http://localhost:8080/openkm/management/) because the next steps will require restarting the OpenKM service, and you do not want to lose administrative access.

• Users who are members of ROLE_ADMIN or ROLE_USER are created in the database.

Go to Administration > Configuration parameters:

Field / Property	Type	Description
system.login.lowercase	String	true
principal.ldap.server	String	ldap://192.168.0.6:389
principal.ldap.security.principal	String	CN=Administrator,cn=users,dc=company,dc=local
principal.ldap.security.credentials	String	password
principal.ldap.referral	String
principal.ldap.users.from.roles	Boolean	false
principal.ldap.user.attribute	String	sAMAccountName
principal.ldap.user.search.base	List	dc=company,dc=local
principal.ldap.user.search.filter	String	(objectclass=person)
principal.ldap.username.attribute	String	cn
principal.ldap.username.search.base	String	dc=company,dc=local
principal.ldap.username.search.filter	String	(&(objectClass=person)(sAMAccountName={0}))
principal.ldap.mail.attribute	String	mail
principal.ldap.mail.search.base	String	dc=company,dc=local
principal.ldap.mail.search.filter	String	(&(objectClass=person)(sAMAccountName={0}))

Step 2 - Login

#Authentication
okm.authentication.database=false
okm.authentication.ldap=true

#LDAP
ldap.server=ldap://192.168.0.13
ldap.manager.distinguished.name=CN=Administrator,CN=Users,DC=openkm,DC=local
ldap.manager.password=*secret*
ldap.base=DC=openkm,DC=local
ldap.user.search.filter=(sAMAccountName={0})