Globalyzer Server LDAP Installation - Revision history

MaryH at 15:43, 27 September 2022

2022-09-27T15:43:40Z

← Older revision		Revision as of 15:43, 27 September 2022
Line 160:		Line 160:
	This can put strain on a company's LDAP system, as all calls between a Globalyzer Client and Server require authentication.		This can put strain on a company's LDAP system, as all calls between a Globalyzer Client and Server require authentication.
	Also, a company might not want everyone with access to this service account to be able to log into the Globalyzer Server.		Also, a company might not want everyone with access to this service account to be able to log into the Globalyzer Server.
	~~They~~ want the service user to strictly be a consumer of rule sets.		Instead, they want the service user to strictly be a consumer of rule sets.

	To facilitate this, you can define one continuous integration email and password in the GzserverConfig.groovy file.		To facilitate this, you can define one continuous integration email and password in the GzserverConfig.groovy file.
Line 170:		Line 170:
	gzserver.ldap.ci_password="ENC(password encoded with globalyzer-encrypt-password.jar)"		gzserver.ldap.ci_password="ENC(password encoded with globalyzer-encrypt-password.jar)"

	When the server is launched, if ~~The~~ GzserverConfig.groovy file has a ci user defined, Globalyzer will create an acount for that user if it doesn't already exist.		When the server is launched, if the GzserverConfig.groovy file has a ci user defined, Globalyzer will create an acount for that user if it doesn't already exist.
	If the user does already exist, Globalyzer will update the password to what is currently specified.		If the user does already exist, Globalyzer will update the password to what is currently specified.

			A Manager Globalyzer account can log into the Server and assign the ci user to a team to access shared rule sets.

	At runtime, when client calls come into the LDAP-configured server, the server first checks for this ci user. If so, the user/password is verified locally in		At runtime, when client calls come into the LDAP-configured server, the server first checks for this ci user. If so, the user/password is verified locally in

MaryH at 17:41, 26 September 2022

2022-09-26T17:41:12Z

← Older revision		Revision as of 17:41, 26 September 2022
Line 165:		Line 165:
	It would look like this:		It would look like this:

	gzserver.ldap.ci_user="ci@company.com"		gzserver.ldap.ci_user="ci@company.com"
	gzserver.ldap.ci_password="plain text password"		gzserver.ldap.ci_password="plain text password"
	OR		OR
	gzserver.ldap.ci_password="ENC(password encoded with globalyzer-encrypt-password.jar)"		gzserver.ldap.ci_password="ENC(password encoded with globalyzer-encrypt-password.jar)"

	When the server is launched, if The GzserverConfig.groovy file has a ci user defined, Globalyzer will create an acount for that user if it doesn't already exist.		When the server is launched, if The GzserverConfig.groovy file has a ci user defined, Globalyzer will create an acount for that user if it doesn't already exist.

MaryH at 17:39, 26 September 2022

2022-09-26T17:39:45Z

← Older revision		Revision as of 17:39, 26 September 2022
Line 157:		Line 157:

	=== Configuring a Continuous Integegration User ===		=== Configuring a Continuous Integegration User ===
	Some companies ~~would like~~ one service account to run Lite scans continuously and automatically.		Some companies use one service account to run Lite scans continuously and automatically.
	This can put strain on a company's LDAP system. Also, a company might not want ~~anyone~~ with access to this service account to log into the Globalyzer Server.		This can put strain on a company's LDAP system, as all calls between a Globalyzer Client and Server require authentication.
	They want ~~this~~ user to strictly be a consumer of rule sets.		Also, a company might not want everyone with access to this service account to be able to log into the Globalyzer Server.
			They want the service user to strictly be a consumer of rule sets.

	To facilitate this, you can define one continuous integration email and password in the GzserverConfig.groovy file.		To facilitate this, you can define one continuous integration email and password in the GzserverConfig.groovy file.
Line 169:		Line 170:
	gzserver.ldap.ci_password="ENC(password encoded with globalyzer-encrypt-password.jar)"		gzserver.ldap.ci_password="ENC(password encoded with globalyzer-encrypt-password.jar)"

	When the server is launched,		When the server is launched, if The GzserverConfig.groovy file has a ci user defined, Globalyzer will create an acount for that user if it doesn't already exist.
			If the user does already exist, Globalyzer will update the password to what is currently specified.

			At runtime, when client calls come into the LDAP-configured server, the server first checks for this ci user. If so, the user/password is verified locally in
			the Globalyzer database. If it's not the ci user, then an LDAP lookup is performed to authenticate the user.

			Note that the ci user can only be used in Lite. To log into the Server or the Globalyzer Workbench requires an LDAP username and password.


	== Example LDAP Configuration ==		== Example LDAP Configuration ==

MaryH at 14:58, 26 September 2022

2022-09-26T14:58:06Z

@@ Line 154: / Line 154: @@
 Plain passwords are still supported and are configured like this:
   grails.plugin.springsecurity.ldap.context.managerPassword = 'my plain password'
 == Example LDAP Configuration ==

MaryH at 21:58, 7 August 2019

2019-08-07T21:58:51Z

← Older revision		Revision as of 21:58, 7 August 2019
Line 140:		Line 140:
	// ********************** END OF LDAP CONFIGURATION ***********************		// ********************** END OF LDAP CONFIGURATION ***********************

	== Encrypting the LDAP Password ==		=== Encrypting the LDAP Password ===
	To support LDAP logins, the Globalyzer Server requires an LDAP account that can connect to your LDAP server and perform reads.		To support LDAP logins, the Globalyzer Server requires an LDAP account that can connect to your LDAP server and perform reads.
	As of 6.3, this password may be encrypted, rather that appear in plain text.		As of 6.3, this password may be encrypted, rather that appear in plain text.

MaryH at 21:58, 7 August 2019

2019-08-07T21:58:05Z

← Older revision		Revision as of 21:58, 7 August 2019
Line 140:		Line 140:
	// ********************** END OF LDAP CONFIGURATION ***********************		// ********************** END OF LDAP CONFIGURATION ***********************

	=== Encrypting the LDAP Password ===		== Encrypting the LDAP Password ==
	To support LDAP logins, the Globalyzer Server requires an LDAP account that can connect to your LDAP server and perform reads.		To support LDAP logins, the Globalyzer Server requires an LDAP account that can connect to your LDAP server and perform reads.
	As of 6.3, this password may be encrypted, rather that appear in plain text.		As of 6.3, this password may be encrypted, rather that appear in plain text.

MaryH: /* Encrypting your LDAP Manager Password */

2019-07-18T23:23:15Z

Encrypting your LDAP Manager Password

← Older revision		Revision as of 23:23, 18 July 2019
Line 140:		Line 140:
	// ********************** END OF LDAP CONFIGURATION ***********************		// ********************** END OF LDAP CONFIGURATION ***********************

	=== Encrypting ~~your~~ LDAP ~~Manager~~ Password ===		=== Encrypting the LDAP Password ===
	To support LDAP logins, the Globalyzer Server requires an LDAP account that can connect to your LDAP server and perform reads.		To support LDAP logins, the Globalyzer Server requires an LDAP account that can connect to your LDAP server and perform reads.
	As of 6.3, this password may be encrypted, rather that appear in plain text.		As of 6.3, this password may be encrypted, rather that appear in plain text.

MaryH at 23:22, 18 July 2019

2019-07-18T23:22:09Z

@@ Line 102: / Line 102: @@
   // ** Uncomment the following two grails lines and set to the DN to authenticate with
   // ** Globalyzer; will connect the LDAP server and log in via this account
   // **
   //grails.plugin.springsecurity.ldap.context.managerDn = 'cn=read-only-admin,dc=example,dc=com'
@@ Line 138: / Line 139: @@
   //grails.plugin.springsecurity.ldap.search.filter = '(uid={0})'
   // ************************    END OF LDAP CONFIGURATION    *************************
 == Example LDAP Configuration ==

MaryH: /* Setting GZSERVER_LDAP_MODE */

2019-05-28T23:39:20Z

Setting GZSERVER_LDAP_MODE

← Older revision		Revision as of 23:39, 28 May 2019
Line 15:		Line 15:

	export GZSERVER_ENTERPRISE_MODE=true		export GZSERVER_ENTERPRISE_MODE=true
	export GZSERVER_LDAP_MODE=true		<b>export GZSERVER_LDAP_MODE=true</b>
	export CATALINA_HOME=/usr/local/tomcat		export CATALINA_HOME=/usr/local/tomcat
	...		...
Line 25:		Line 25:

	set "GZSERVER_ENTERPRISE_MODE=true"		set "GZSERVER_ENTERPRISE_MODE=true"
	set "GZSERVER_LDAP_MODE=true"		<b>set "GZSERVER_LDAP_MODE=true"</b>
	set "CATALINA_HOME=C:\apache-tomcat-8.5.23"		set "CATALINA_HOME=C:\apache-tomcat-8.5.23"
	...		...

MaryH: /* How to Configure LDAP */

2019-05-28T23:33:24Z

How to Configure LDAP

← Older revision		Revision as of 23:33, 28 May 2019
Line 18:		Line 18:
	export CATALINA_HOME=/usr/local/tomcat		export CATALINA_HOME=/usr/local/tomcat
	...		...

	If your server runs on Windows, and you are using the enterprise.bat file to start/stop your server, set GZSERVER_LDAP_MODE to true:		If your server runs on Windows, and you are using the enterprise.bat file to start/stop your server, set GZSERVER_LDAP_MODE to true: