LDAP settings

Use the LDAP Settings tab to establish a connection between your project and the LDAP server.

To configure the connection settings:

1. In the LDAP Server Settings dialog box, go to the LDAP Settings tab.

   

2. Do one of the following:

   • Select Use operating system domain/user automatically to use the credentials of the current user.

     You will see the Domain, User, and Password boxes are automatically filled with the credentials that you used to run AVEVA Edge on your local computer, and these are the credentials that will be used while you continue to develop your project.

     When the project is opened on another computer or downloaded to a target station, it will use the credentials of the user who ran the software there, and that user can vary from computer to computer. The user who runs the software can be different from the user signs in to the computer, especially if you configure the software to run in the background as a service.

   • In the Domain box, enter either the domain name itself or the host name of the LDAP server, and then under LDAP Server Credentials, in the User and Password boxes, enter your credentials for that server.

     The format of your user name is determined by the server configuration (for example, username, domain\username, username@domain). If you're not sure, ask your LDAP server administrator.

     You can also enter string expressions for these settings (for example, {MyUser}, {MyPassword}). When the values of the expressions change during project run time, the credentials are changed to match and will be used the next time your project tries to get the list of groups and users from the LDAP server.

   Each user needs to have sufficient privileges to get the list of groups and users from the LDAP server, because your project will use that list to validate other users' attempts to log on.

3. Under Connection Settings, review the following settings:

   Connection timeout

   The duration (in seconds) after which the project runtime will stop trying to connect to the LDAP server. The default is 10 seconds. A connection can time out if the server is slow to respond or not available at the specified address.

   Retry interval

   The interval (in seconds) between attempts to connect to the LDAP server, after the connection has timed out or failed. The default is 120 seconds. The project runtime will keep trying to connect until either the connection is established or the project is stopped.

   Status tag

   If you want to monitor the status of the security system during project run time, enter the name of a project tag (Integer type) in this box. The specified tag will receive continuously updated values that indicate the status of the client's connection to the LDAP server. The possible values are:

   Value	Description
   0	Connection timeout
   1	Bind timeout
   2	Query timeout
   3	Disconnected
   4	Connected
   5	No users or groups returned by query
   6	Invalid user or group
   7	Data corrupted
   8	Auto import disabled

   For more information, see GetSecuritySystemStatus.

4. Click Check Connection to confirm that your project can connect to the LDAP server using the specified settings. If it cannot, review and correct the settings.

5. Under Offline Cache Settings, review the settings for the offline cache of recent users. Users are cached when they successfully log on to the project, and cached users can log on even when the LDAP server is not available.

   The cache is a "first in, first out" (FIFO) list, which means old users are removed when new users are added. There are two exceptions to this rule: the project's default user (for example, "Guest") and the user that you specified under LDAP Server Credentials are always kept in the cache.

   Cache size

   The number of most recent users that are kept in the offline cache. The default is 3 users. To keep an unlimited number of users in the cache, enter 0 for this setting.

   Cache expiration

   The number of days after which the offline cache will expire, starting from the most recent user logon. The default is 60 days. To make the cache never expire, enter 0 for this setting, but we do not recommended this.

   Hours until cache expiration

   If you want to monitor the offline cache during project run time, enter the name of a project tag in this box. The specified tag will receive a value equal to the number of hours remaining until the cache expires.

6. Click OK.

If you want the project security system to generate a log message each time it updates the offline cache, use a text editor to open your project file (<project name>.APP) and then add the following property:

[Options]

EnableSecuritySystemTraceLdapOfflineCache=1