LDAP Users Synchronization

Create Directory

The first step to allow using the single sign on feature on the TSS is to synchronize LDAP users. LDAP users are TSS users that have not been created manually, but instead synchronized with the LDAP directory.

In order to synchronize one or more LDAP directory, you must configure LDAP directory under System > Directories.

Press the "Add New" button and fill the form.

For more information about directory properties, please refer to LDAP Corporate configuration

The "Search base" field must be set to indicate where the turret users are located inside the LDAP tree.

In the "Synchronization Process", select "Turret User" or "FlexCom user" to choose the user type that have to be created during the synchronization process.

In the "Synchronization Zone", select the zone in which the users will be synchronized. Select Default to use the zone defined in the Default Zone setting.

In the "Shared profiles to link to imported users", select shared profiles to attach to first time imported users.

You can configure as many LDAP directories as you need to synchronize your users in the database, but their SAM Account Name Field must be unique.

Optional settings

Location: TSS Settings
LDAP User	Default Zone Key: user.ldap.zone.default Description: Name of default zone used to synchronize LDAP user in user list. Only LDAP Directories with their sync zone set to default will be affected. Note: This will not override the zone value of existing users. If that is required, then explicitly set the zone in the directory configuration screen

Location: TSS Settings
LDAP User	Activate LDAP Search truefalse Key: user.ldap.activated Description: Define if LDAP search must be done on login. This setting must be set to False if LDAP search result is too long to return. In this case DN of user is not updated on login.

Note that these settings differ from the settings used to configure the turret LDAP directory, and apply only to the LDAP users synchronization.

LDAP Sync

Once the LDAP directory is properly configured, the synchronization process can be performed from the Account Management / Users list, by pressing the LDAP Sync button.

During the first synchronization, the TSS will fetch all LDAP entries matching the configured filter and create LDAP users in its database for each one.

LDAP users can be differentiated from standard IPTrade users with their icon, visible on the left side of the list.

The synchronization will update users with the directory entries using the samAccountName as identifier :

•New LDAP users are added in the TSS database

•Existing users are updated (mainly their DN)

•Users that are not present in LDAP server anymore are deleted

Pressing the LDAP Sync button shows the LDAP user synchronization screen.

The screen allows reviewing what changes will be performed by the synchronization process. Two options are available:

•Merge with existing IPTrade users: any already-existing IPTrade user that is also present in the LDAP directory (based on its user login and its samAccountName) will be converted to an LDAP user, so that all its profile content is preserved.

•Rename existing IPTrade users: any already-existing IPTrade user that is also present in the LDAP directory (based on its user login and its samAccountName) will be renamed, and a new LDAP user will be created.

The summary allows checking exactly which actions will be performed, and placing the mouse over the information icon next to each action gives the list of affected users.

Any change in the LDAP directory (first name, last name, DN) requires a manual synchronization to be performed, except for existing users, if the following setting is set to True: Activate LDAP Search (see above).

Unlink LDAP user

To unlink LDAP user and convert it to a classic IPTrade user, edit the user from the users list and press Unlink from LDAP button.