Changing and Testing LDAP Authentication Options

(Available in EFT Server Enterprise)

The LDAP Authentication Options dialog box is used to edit and test EFT Server's connection to the LDAP server after you have configured LDAP Authentication.

To edit or test LDAP authentication settings

1. In the Administrator, connect to EFT Server and click the Server tab.

2. In the left pane, click the Site you want to configure.

3. In the right pane, click the General tab.

4. Next to the User auth manager box, click Configure. The LDAP Authentication Options dialog box appears.
   
   

5. To specify that the user list is to be updated automatically, select the Enable Automatic Refresh every check box, then specify how often you want EFT Server to check the authentication database for new users. Clear the check box if you do not want the Site's user list to refresh automatically. (This setting is inherited from the Server's General Settings on the Server's General tab. Never refresh user list automatically is specified by default.)

6. In the Server box, type the Server name or IP address.

7. In the Port box, keep the default port 389 or specify a different port.

8. In the Base DN box, type the base domain name for the LDAP user database, in the format option=value. For example, type:
   dc=forest,dc=tree,dc=branch

9. In the User Filter box, type the search filter information. Refer to Advanced LDAP Filtering for a detailed explanation of LDAP filtering.

10. In the Attribute box, type a comma-separated list of attributes to retrieve. For example, type:
    
    userPrincipalName,mail,e-mail,name,cn

(Add userprincipalname to the attributes so that the userprincipalname is used for the account name in queries.)

11. In the User Information area, click one of the following binding methods to define how the client is authenticated:

• Anonymous

• Simple requires a username and password. Note that the username must follow the syntax for the LDAP server that includes the Common Name and the Domain Components of your LDAP server’s distinguished name. For example, the username might be the following:

cn=Manager,dc=forest,dc=tree,dc=branch

For details of creating complex LDAP filters, refer to Advanced LDAP Filtering.

12. If you are using SSL, select the Use SSL check box.

You need to have a certificate that includes Server Authentication on the LDAP server you are connecting to. If you install Certificate Services on the domain on which EFT Server is installed, you can request the certificate on the LDAP server. For more information, refer to the Microsoft Support article "How to enable LDAP over SSL with a third-party certification authority."

The LDAP bind password is encrypted in the FTP.cfg file.

13. To change the advanced options (SSL, timeout, scope, etc.), click Advanced and specify advanced options based on your requirements.



• Set timeout - Specify the connection/query timeout (in seconds). This option coupled with paging can help you avoid timeouts when querying against large directories.

• Set search scope - This specifies the depth of the level to search for under BaseDN.

• BASE - Only the requested object specified in BaseDN is searched.

• OneLevel - All of the objects just below this object are searched.

• Subtree - Searches for all the objects within the specified BaseDN object recursively.

• Turn on referral chasing - If you have referral chasing on, the query returns information for objects that exist in the LDAP structure, but do not actually exist on EFT Server to which you are connected. The query displays bookmarks to entries that exist elsewhere in the network that EFT Server knows about.

• Set LDAP Version - LDAP 2 is widely supported and adds anonymous binding and some filtering. LDAP 3 extends the features of LDAP 2 by adding paging (server side) and more complex filtering.

• Use Server Page Control - Asks EFT Server to limit result sets (or pages) to 1000 at a time or the value specified under Override search page size, if checked. If Use server page control is not selected, client-side paging is used to mitigate timeouts when retrieving large directory listings.

• Override search page size - Overrides the default page size (1000) for client or server-side page limits. Making the value too large can cause timeouts. Setting the page size too small reduces the overall efficiency.

• Select attributes - Returns only the specified attributes for the user objects found as part of the search query. Specifying only necessary attributes will greatly increase the efficiency of your query (since the filtering occurs on EFT Server side). Add userprincipalname to the LDAP query so that the userprincipalname is used for the account name in queries.

14. To test your settings, click Test. The LDAP Query dialog box appears. The Authentication Manager Test Results appear.



The query returns the following information:

• LDAP settings used, which is helpful for troubleshooting

• Success or failure of the connections, and failure reason

• Success or failure of attempt to BIND using the credentials provided, and failure reason

• Record set ("Query results") in comma delimited order

"No Referrals: TRUE" indicates that Turn on referrals chasing is NOT selected.

15. To close the dialog box, click the X in the upper right corner or press ESC.

If you need troubleshooting assistance, copy the text to the clipboard and provide this information to GlobalSCAPE technical support.

16. Click OK to close the LDAP Authentication Options dialog box.

17. Click Apply to save the changes on EFT Server.