Status tab

The Status tab contains only information about the last synchronization with the LDAP server (date, duration and result) and the count of added/updated/deleted users, cost centers and roles. If there is an error, the error will display here.

Settings tab

The Connection section is used to set up these essential settings for LDAP integration:

• LDAP server type (AD, NDS, OpenLDAP) – Use AD for Active Directory.

• URL of LDAP server – use a URL starting with LDAPS to use an encrypted connection (or LDAP for a plain connection).
  

• Mode of LDAP server certificate check – Defines how the LDAP server certificate is validated (applies to LDAPS protocol only).

• LDAP bind method – A method used for authentication and data security on the LDAP level.

• Searched LDAP subtree

java\bin\keytool.exe -server -import -alias YourCompanyCA -file YourCertificate.cer -keystore conf\ssl-truststore

The On-demand mode section allows you to enable Load users on demand. This type of replication mode is sometimes referred to as semi-online. When enabled, users are created only during job reception or when logging into the terminal.

• Full and differential replication update only the users already registered within Dispatcher Paragon.

• Replication of Roles and Cost centers is unaffected.

In the Service account section, the LDAP user credentials can be specified if needed:

• Anonymous – Anonymous access is used, no credentials are needed.

• Authorized – The username and password for LDAP access need to be specified. The selected account has to have at least read access to reach the users and their attributes.

The Scheduling section gives you the possibility to schedule the run of replication. All settings are revealed after you check the Enable regular synchronizations checkbox. The options are:

• Start full replication – You can select the days and times for full replication by clicking checkboxes.

• Start differential replication – You can specify the hours or time interval from the last replication to starting differential replication. This type of replication will be started every day.

Test settings tab

The Test tab enables you to test the connection to the LDAP server. Please note that the settings have to be saved before the test can start. If the settings are correct, the test will return the first five users, cost centers, and roles matching the entered settings and filters.

There is a summary table at the top if more than one LDAP connection (domain) is set. You can see if the domain settings are correct (all icons are green) or if something is set up wrongly (red icons). If the test returned fewer than five results, the icon is orange. This does not necessarily mean that the setting is wrong (there could be only three objects of that type in the LDAP) but a warning is raised so the administrator can check if, for example, the filter settings are correct.

You can list the returned items for each domain by clicking the domain name in the summary table.

Log tab

On the last tab called Log, you can see the information that was logged by the running LDAP replicator. This is a good place for troubleshooting if there is an issue with the replication process.

Domains tab

If the integration with Dispatcher Phoenix is disabled (configuration option konicaMinoltaDispatcherPhoenixEnabled is set to disabled) then it is possible to configure replication for more LDAP domains, see separate Domains documentation.

Connection tab

Timeout – The number of milliseconds after which the connection to the LDAP server times out if there was no response. If several reconnection attempts are configured in the Replicator tab, LDAP replication will retry the connection after a delay specified by the ldapReconnectionDelay System settings configuration property.

The On demand mode has two expert options available on the System > Configuration page:

• Number of threads (property ldap-replicator-online-mode-threads) – The number of concurrently running threads. The number of threads should not exceed the number of LDAP connections. The database should have a sufficient number of open connections.

• Maximum response time (property ldap-replicator-online-mode-timeout) – The maximum response time in seconds. Requests that take longer than the given time are prematurely canceled.

Expert settings tab

The Expert mode adds the Expert settings tab, which contains a few more configuration sections.

The User unique mapping section allows you to configure options and conversion for user unique mapping, an option for extracting external ID and several options for the user's organizational unit mapping.

• Options for unique mapping of users – Options for user unique mapping:

  • ID-GUID – for mapping a user to the GUID

  • ID-[attribute-name] – for mapping a user to an attribute

  • [name-of-numeric-attribute] – for ID equivalency mapping

• Conversion for unique mapping of users – Turn on the conversion of user unique mapping Options for user unique mapping, e.g., for ”GUID” (=value ”ID-GUID”) is converted to ”objectGUID” (used for Active Directory). Usually, for the existing installations, the value Enable should be set for backward configuration compatibility.

For new installations, it is recommended that you use Disable and the specified item Options for user unique mapping properly, e.g., ” Options for user unique mapping = ID-objectGUID” for Active Directory. Typically, Disable is used for non-AD servers.

The External ID extraction section contains only Option for extracting external ID – An option for extracting ext-id from the attribute Options for user unique mapping. Matching parts are used for the output. An unmatching input is not processed. For example: regex (d+)-adm-(d+)|adm-(d+) for inputs 12345-adm-6789, 123-adm-456789, adm-123456789, 123456789 will have same output 12345678.

In the User's organizational unit mapping section, these settings can be configured:

• Options for user cost center mapping

  • DN:[attribute-name] – Cost centers are searched by a query in the LDAP, the cost center is assigned according to the LDAP setting (by DN prefix). [attribute-name] determines the user ext-id. Example: DN:GUID

  • NUMBER:[attribute-name] – Cost center creation during user replication. The number is stored in the user’s [attribute-name]. The name is created as ”OU-”[attribute-name], example: NUMBER:department

  • NAME:[attribute-name] – Cost center creation during user replication. The name is stored in the user’s [attribute-name]. The number is identical to the ID (initialized by sequence). Example: NAME:department

  • NN1:[attribute-name-with-number]:[attribute-name-with-name] Cost center creation during user replication. [attribute-name-with-number] contains the cost center number and [attribute-name-with-name] contains its name. Example: NN1: department:company

  • NN2:[attribute-name]:[groups-order]:[pattern] – Cost center creation during user replication. The user’s [attribute-name] must include content that matches reg-ex [pattern]. The value must contain at least two reg-ex groups: the first for the OU name, the second for the OU number. [groups-order] is string ”name,number”, or ”number,name” depending on the mapping order of regex-groups to the OU number and the OU name in [pattern]. Example: NN2: department:number,name:([^:]*):(.*)

• Conversion of user cost center mapping - Turn on the conversion of the user’s cost center unit mapping (Options for user’s cost center mapping). For example, ”GUID” (=value ”DN:GUID”) is converted to ”objectGUID” (used for Active Directory). Usually for existing installations, set this value to Enable for backward configuration compatibility. For new installations, it is recommended that you use Disable and the specified item Options for user’s cost center mapping, for example, ”Options for user’s cost center mapping = DN:objectGUID” for Active Directory. Typically, Disable is used for non-AD servers.

• Map cost center only when value exists – When enabled, the user’s cost center information is updated only if the cost center exists. If disabled, the user is saved without cost center information.

The User's groups mapping section contains these settings:

• Attribute containing unique identifier for groups – The name of the LDAP attribute containing the unique identifier for groups.

• Bind user to ancestor groups – The option that specifies to map the user not just to its superior roles but also to roles superior to these roles.

In the Filters section, you can specify additional filters for users, groups, or cost center searching and some other filters according to your needs:

• Additional filter for user searches – You can use this filter if the standard built-in filter includes unwanted objects in the search result. For example, a filter for users that have not been disabled (&(objectCategory=Person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

• Additional filter for group searches – Use this filter if the standard built-in filter includes unwanted objects in the search result.

• Additional filter for cost center searches – You can use this filter if the standard built-in filter includes unwanted objects in the search result. This setting is, in effect, only when Mapping -> Options for user’s cost center mapping is set to DN:keyword (for example, DN:GUID). With other options (like NAME, NUMBER,...), this option is not used.

• Ignore distinguished name when searching for groups – Domain name branches to ignore during searches of users. Separate multiple values with a pipe.

• Ignore distinguished name when searching for cost centers – Domain name branches to ignore during searches of users. Separate multiple values with a pipe.

• Overwrite user if already exists in database – Enable this option if you have created internal users prior to synchronization from the LDAP. If both this option and the option Check username uniqueness from Users schema tab in Advanced mode are enabled, then the original user created in the Dispatcher Paragon management interface is deleted and the user from the Active Directory is created. Otherwise, user data received from the remote LDAP server is merged with the existing user created in the Dispatcher Paragon management interface.

• Merge automatically generated accounts in Dispatcher Paragon database – If multiple user accounts are automatically generated in the Dispatcher Paragon database, they can be automatically merged once accounts are created in the LDAP with aliases that are the same as the generated accounts. This should be enabled only when using the anonymous print feature.

Manual synchronization of LDAP configuration

On the System > LDAP integration > Settings page, there is a button LOAD FROM DISPATCHER PHOENIX available that loads the LDAP configuration from Dispatcher Phoenix and fills those values into the LDAP settings form. An administrator should check the loaded values and must save changes in order for them to be applied.

Automatic synchronization of LDAP configuration

To minimize the need for manual configuration, the LDAP configuration is automatically loaded from Dispatcher Phoenix only if it has not been filled in Dispatcher Paragon yet (i.e., the URL of the LDAP server is empty). An attempt to load the configuration from Dispatcher Phoenix is run at regular intervals till the configuration is successfully loaded. The CRON rule 'konicaMinoltaDispatcherPhoenixLdapSettingSynchronizationJobRule' system configuration property determines the interval.