Dualog Connection Suite LDAP Server. User Manual and Configuration Guide

Transcription

1 Dualog Connection Suite LDAP Server User Manual and Configuration Guide Author Vidar Berg Date 10.Nov 2010 Description Revision Number User manual for setting up and maintaining the Dualog Connection Suite DHCP Server. 1.0 Initial document 2.0 Changed doc template Dualog AS (Head Office) Alkeveien 14 N-9015 Tromsø Norway

2 1 Table of Contents 2 Introduction The protocol Features Known limitations Configuration Configuring basics TCP Server Port Access rights to the address books Configuring the client(s) Basics The hostname and port Base DN Bind DN Secure tunnel Configuring maximum time and size Connecting to the LDAP server Searching the directory Performing the search Entries to use for search The % wildcard... 8 Page 2 of 8

3 2 Introduction Dualog LDAP Server allows 3 rd party clients access to the Dualog Connection Suite address book and user accounts. The protocol enabling this is LDAP. In Connection Suite, LDAP is used to let WebMail access the Address Book and list of Connection Suite Users when adding recipients to an . Similarly, Outlook and other clients can be configured for the same purpose. 2.1 The protocol LDAP (Lightweight Directory Access Protocol) is a protocol supported by most major clients out there. It is a directory service that supplies a common interface for looking up names and addresses. 2.2 Features Read access to the Dualog Connection Suite user accounts. Read access to the personal-, ship-, and company global address book stored in Dualog Connection Suite. Searching the Dualog Connection Suite user accounts and address book. 2.3 Known limitations The Dualog LDAP server does not let the user write, modify or add new users to the Dualog Connection Suite address book. Only English letters are supported. addresses can be up to 256 characters long. Page 3 of 8

4 3 Configuration 3.1 Configuring basics TCP Server Port IANA (Internet Assigned Numbers Authority) has specified LDAP to run on TCP port 389. This is the default and will be satisfactory in most cases. In cases where the Dualog LDAP server must run together with other LDAP servers or if something else speaks for running the Dualog LDAP on a different port it can be configured in the Connection Suite user interface. The configuration interface can be found under Config -> System -> Current system in the vessel configuration. On the shore side interface ( it can be found under Remote Config > System -> Current system Access rights to the address books For a user to gain access to the Dualog LDAP server the user must provide his/her Dualog Connection Suite credentials. The Dualog LDAP server then enforces the access restrictions applied by Dualog Connection Suite. These restrictions can be applied either to a user group or to a single user. In addition to the address books, every user in Dualog Connection Suite will have access to the addresses of the other crew members in the same company Functions that affect the Dualog LDAP server Webmail Address book (personal address book) Page 4 of 8

5 Webmail Ship address book Webmail Company address book Note: To configure access rights for user groups you must use the shore side interface ( 3.2 Configuring the client(s) Basics Most clients have an option for adding an LDAP address book. The general settings that must be configured for using LDAP are: Hostname and port Base DN Bind DN Secure TSL/SPA (often a checker) In addition most clients can configure maximum number of responses and maximum number of seconds a search can go on for The hostname and port To be able to connect to the LDAP server the client needs the IP address, port and connection method. The hostname is the IP address of the computer running Dualog Connection Suite; it will always be the same as the address of the mail server. The port is by default 389, but it can be configured differently - consult your IT manager if 389 doesn t work. The Dualog LDAP server always uses clear text passwords and does not understand secure tunnel mechanisms Base DN The Base DN is the starting point for the client in the LDAP address book. If it is empty, the Dualog LDAP server starts at the root but beware, some clients insert their own small tag if the base DN field is empty. (I.e. Microsoft Outlook Express inserts Country=<your country> ) The Dualog LDAP Hierarchy Root of Dualog LDAP Server User accounts Personal address book Ship address book Global address book If the root entry is selected the Dualog LDAP will return results from all the four subcategories Base DNs in Dualog LDAP Server Part of Directory Root User accounts Personal address book Ship address book Global address book Base DN dc=dualog,dc=net ou=staff ou=personaladdressbook ou=shipaddressbook ou=globaladdressbook Page 5 of 8

6 3.2.4 Bind DN In LDAP terminology Bind DN is the same as username. Bind DN must be the username ( address) of the user accessing the LDAP. This will be the same username that you would use when configuring the account. Some clients also let you configure the password while other clients ask for the password when you first send a request to the LDAP server. Please note: The Dualog LDAP server will reject any requests from unauthorized clients Secure tunnel The Dualog LDAP server uses clear text for password authentication. Any attempt at authenticating using TLS, SSL or SPA will result in failure to log on Configuring maximum time and size Maximum time and size of search results are two optional parameters that can be configured. It is recommended to configure some values here to avoid too wide searches to consume unnecessary resources from the Dualog Connection Suite server. Page 6 of 8

7 4 Connecting to the LDAP server When the 3 rd party client attempts to connect to the Dualog LDAP Server the Bind DN (username) will already be ready. The password will always be the same password as for the Dualog Connection Suite account. Note: Only stationary users and users with a valid hire on the vessel can access the Dualog LDAP Server. Page 7 of 8

8 5 Searching the directory 5.1 Performing the search When the client has been authorized the Dualog LDAP Server will start handling search requests. Please note: All search requests are handled case insensitive. 5.2 Entries to use for search The Dualog LDAP Server uses Dualog Connection Suite as base for all the search results created. In this database only and full name are stored. Searches performed on other attributes will end up with no search result. Supported attributes: cn (short for Common Name and represents the full name) displayname (same as cn included for compatibility) mail ( address) 5.3 The % wildcard The Dualog LDAP Server only has one wildcard when searching. % can be used to list every entry in the address book. The % can also be used inside a search. (I.e. master%@vessel.dualog.net to list all address book entries starting with master for the domain vessel.dualog.net) Page 8 of 8