LDAP advanced settings

Use the LDAP Advanced Settings tab to customize the connection between your project and the LDAP server.

These settings should be configured only by experienced LDAP server administrators.

To configure the advanced settings:

1. In the LDAP Server Settings dialog box, go to the LDAP Advanced Settings tab.

   

2. If for some reason the LDAP server cannot be accessed using its domain or host name, you can manually configure the server address. Under Server Address Manual Configuration, do the following:

   1. Select Enable.

   2. In the Server IP box, enter the IP address of the computer that hosts the LDAP server.

      You can enter a space-separated list of addresses in the following format:

      <IP address>:<port number> <IP address>:<port number> <IP address>:<port number>

      If you do not specify a port number for an address, the number that is configured in the Port box below will be used by default.

      Your project will try to connect to each address in the specified order, one at a time. If a connection times out (according to the Connection timeout setting in the LDAP Settings tab), then your project will proceed to the next address in the list, and it will continue like this until either a connection is established or all of the addresses have been tried.

   3. In the Port box, enter the port number of the LDAP server.

      The default port number for the LDAP protocol is 389, but it can be changed on the server so you should confirm it before you configure these settings.

3. By default, the group and user rights for your project are saved entirely within the project settings. If you want to save those rights back to the LDAP server, in order to make them available to other projects or for simple redundancy, do the following:

   1. Extend the server's LDAP schema to contain additional information about the project security system.

      For more information, see Extending the LDAP schema to allow saving of security rights.

   2. Under Save Rights to Server, click Modify.

      You are prompted for your LDAP server credentials.

   3. Enter your user name and password, and then click OK.

      You need to have sufficient privileges to save this information to the LDAP server.

   4. Select Enable.

4. Review the remaining options.

   Enable SSL

   To enable a Secure Sockets Layer (SSL) connection between the the project runtime server and the LDAP server, select this option. An SSL connection is required for users to be able to change their passwords on the LDAP server during project run time. Otherwise, changes can be made only outside the project through other LDAP clients.

   If you select this option and you have also manually configured the server address, make sure the address you configured matches the address on the server's certificate.

   The default port for LDAP via SSL is 636, but it can be changed on the server so you should confirm it before you select this option.

   Check server certificate

   If you select Enable SSL, this option will also be selected by default.

   Allow simple bind (ADAM)

   LDAP normally requires secure binding for authentication, but Active Directory Application Mode (ADAM) does not fully support secure binding. To allow simple binding with an ADAM server, select this option.

   Simple binding means that user credentials are sent in clear text, so you should secure the connection by other means such as VPN, TLS/SSL, or proxies.

   Automatically import groups and users from domain

   To automatically import groups and users from the LDAP server and into your project, select this option. If you do not select this option, you will need to create your own groups and users within your project and then save them back to the LDAP server.

   This option is selected by default in older projects that have been upgraded to the current version of AVEVA Edge, in order to maintain backward compatibility.

   Reload LDAP settings upon LogOn

   By default, your project will load the LDAP settings (that is, get the list of groups and users from the LDAP server) once when the project is run, and then it will reload those settings only when the GetSecuritySystemStatus function is executed.

   To reload the LDAP settings every time a user tries to log on to the project, select this option. Doing so can make it easier for the user to select their name and then log on, especially if the list of groups and users changes frequently.

   Reloading the LDAP settings might take some time, however, especially if the list is long or the LDAP server is slow to respond. That can affect your project's runtime performance, so you may choose not to select this option and then have more control over when your project reloads the settings.

   Enable nested groups

   Select this option to grant users the permissions of all groups they belong to, including groups nested inside other groups.

   For example, if User1 is a member of Group3, Group3 is a member of Group1, and Group1 is configured in the project, then User1 gets the permissions of Group1. Without this option, only the groups that the user belongs to directly are used.

   Nested groups are supported on Windows and IoT View, and also work when the group list is limited by an LDAP query filter.