We've implemented simple LDAP membership and role providers. They're read-only, so your users and their role membership are configured elsewhere. It works as kind of a hybrid between our Windows and Forms providers. Only roles can be edited like our Windows auth, but users login through a Form like our forms auth.
Only works in 2.3.1885+
Here is how to configure it:
Code: <membership defaultProvider="Default">
<providers>
<clear />
<add name="Default" type="Elsinore.ScreenConnect.LdapMembershipProvider"
server="ldap.elsitech.local:636"
useSsl="true"
serviceUser="CN=ServiceUser,OU=Users,DC=elsitech,DC=local"
servicePassword="myPassword"
userRootDN="OU=Users,DC=elsitech,DC=local"
userNameAttribute="cn"
roleRootDN="OU=Groups,DC=elsitech,DC=local"
roleNameAttribute="cn"
roleUserDNAttribute="member"
/>
<add name="OldDefault" type="Elsinore.ScreenConnect.XmlMembershipProvider" virtualFilePath="~/App_Data/User.xml" />
</providers>
</membership>
<roleManager enabled="true" defaultProvider="Forms">
<providers>
<clear />
<add name="Forms" type="Elsinore.ScreenConnect.LdapRoleProvider" />
<add name="OldForms" type="Elsinore.ScreenConnect.XmlRoleProvider" />
<add name="Windows" type="Elsinore.ScreenConnect.WindowsRoleProvider" />
</providers>
</roleManager>
Attributes:
Code:
server: fully qualified server name optionally including port. 389 is default port. 636 is standard SSL port, but must be specified even if useSsl is set to true.
useSsl: true or false depending on whether you want to use SSL. Authentication is basic, so it's passed in clear text unless you use SSL.
serviceUser: DN of user account used to search the directory tree
servicePassword: password of user account used to search the directory tree
userRootDN: DN of root of where users are located. this can be used to narrow the search scope for users
userNameAttribute: name of attribute that specifies the user name. "cn" is Common Name and is usually what they consider their "user name". sAMAccountName can be used for Active Directory if you want them to use what they use to login to windows.
userRoleNameAttribute: (optional, mutually exclusive with roleUserDNAttribute) name of multi-valued attribute on user entry that specifies role names for the user. If these are DNs, your roles in ScreenConnect need to be full DNs also.
roleRootDN: (optional, mutually exclusive with userRoleNameAttribute) DN of root of where roles/groups are located. this can be used to narrow the search scope for groups
roleNameAttribute: (optional, mutually exclusive with userRoleNameAttribute) name of attribute that specifies the name of the role. Usually "cn".
roleUserDNAttribute: (optional, mutually exclusive with userRoleNameAttribute) name of multi-valued attribute on role/group that lists membership in the form of user DNs. Typically "member".
Validation process using above settings with username "billy" password "testpass":
- We bind to ldap.elsitech.local:636 (server) with SSL with account "CN=ServiceUser,DC=elsitech,DC=local" (serviceUser) and password "myPassword" (servicePassword)
- We search the tree at root "OU=Users,DC=elsitech,DC=local" (userRootDN) for user entry with "cn" (userNameAttribute) equal to "billy"
- We find an entry at "cn=Billy,OU=Users,DC=elsitech,DC=local"
- We create a new connection and try to bind as "cn=Billy,OU=Users.DC=elsitech,DC=local" with password "testpass"
- We succeed or fail based on whether the bind was successful
Role lookup process using above settings with username "billy":
- We bind to ldap.elsitech.local:636 (server) with SSL with account "CN=ServiceUser,DC=elsitech,DC=local" (serviceUser) and password "myPassword" (servicePassword)
- We search the tree at root "OU=Users,DC=elsitech,DC=local" (userRootDN) for user entry with attribute "cn" (userNameAttribute) equal to "billy"
- We find an entry at "cn=Billy,OU=Users,DC=elsitech,DC=local"
- We search the tree at root "OU=Roles,DC=elsitech,DC=local" (roleRootDN) for group entry with attribute "member" (roleUserDNAttribute) equal to "cn=Billy,OU=Users,DC=elsitech,DC=local"
- We return the value of the "cn" (roleNameAttribute) attribute for each role we find
You define your roles in ScreenConnect the same way you do now. I suppose you should probably define the roles first before you apply these changes, or you'll be locked out.
Please reply on the forum with any issues you encounter. Our support department cannot support the usage of this authentication.
