LDAP is an open standard for querying and modifying directory services that is commonly used for authentication, authorization and accounting (AAA). OMERO.server supports the use of an LDAP server to query (but not modify) AAA information for the purposes of automatic user creation.
This allows OMERO users to be automatically created and placed in groups according to your existing institution policies. This can significantly simplify your user administration burden. Note that OMERO has its own concept of “groups” that is quite distinct from LDAP groups.
The OMERO.server LDAP implementation can handle a number of use cases. For example:
omero.ldap.user_filter=(memberOf=cn=someGoup,ou=Lab,o=College)
omero.ldap.new_user_group=:query:(member=@{dn})
On login, the username provided is searched for in OMERO. If the name does not exist, then the LDAP plugin is queried for a username matching the system-wide user filter. If such an LDAP entry exists and the password matches, a new user with the given username is created, and the user is added to any groups which match the new_user_group setting.
On subsequent logins, the user filter and the password are again checked against the LDAP server, and if there is no longer a match, login is refused. If you would prefer to only have the user_filter applied during user creation and not on every login, see Legacy password providers.
The LDAP plugin is configured via several configuration properties, all starting with omero.ldap (see LDAP).
Some of the property values are passed directly to the underlying LDAP library (Spring LDAP), which in turn makes use of the Java API. OMERO does not modify the error messages thrown by the library or by Java, so please consult the appropriate documentation to diagnose any low-level problems.
Note
Please remember that once a change has been made, a server restart will be needed.
The following properties are the minimum requirements for logging in to OMERO using LDAP.
omero.ldap.config=true
omero.ldap.urls=ldap://localhost:389
omero.ldap.username=
omero.ldap.password=
omero.ldap.base=ou=example,o=com
After having configured your connection, you can turn LDAP on and off between restarts by setting omero.ldap.config to false. The base property determines where in the LDAP tree searches will begin. No users or groups will be found if they are not under the base provided.
Two user properties are used to look up users by login name and, if necessary, create new users based on the information in LDAP.
omero.ldap.user_filter=(objectClass=person)
omero.ldap.user_mapping=omeName=cn,firstName=givenName,lastName=sn,email=mail
omero.ldap.user_filter will be AND’ed to the username query, and can contain any valid LDAP filter string. The username query is taken from the LDAP attribute which gets mapped to “omeName” by omero.ldap.user_mapping. Here, the “cn” is mapped to “omeName”, so the username query is (cn=[login name]). The final query is (&(objectClass=person)(cn=[login name])), which must return a single result to be considered valid.
Three group properties are all concerned with what groups a user will be placed in on creation.
omero.ldap.group_filter=(objectClass=groupOfNames)
omero.ldap.group_mapping=name=cn
omero.ldap.new_user_group=default
The group filter and group mapping work just as the user filter and mapping do, in that the group name query will be AND’d with the group_filter. In this case, the final query would be (&(objectClass=groupOfNames)(cn=[group name])). However, these properties may not be used depending on the value of new_user_group, which can have several different values:
Both the user_filter and the group_filter can contain any valid LDAP filter string. These must be a valid filter in themselves. e.g.
omero.ldap.user_filter=(|(ou=Queensland Brain Institute)(ou=Ageing Dementia Research))
The “|” operator (read: “OR”) above allows members of two organizational units to login to OMERO. Expanding the list allows concentric “rings” of more and more OU’s granular access to OMERO.
omero.ldap.group_filter=(&(objectClass=groupOfNames)(mail=omero.flag))
The “&” operator (read: “AND”) produces a filter that will only match groups that have the mail attribute set to the value omero.flag. When combined with the group_mapping, the final query would be (&(&(objectClass=groupOfNames)(mail=omero.flag))(cn=[group name]))
This is the same as the query (&(objectClass=groupOfNames)(mail=omero.flag)(cn=[group name])) but setting group_filter to (objectClass=groupOfNames)(mail=omero.flag) is not valid as that is not a valid filter on its own.
To restrict the list of groups to just the ones returned by the above query, the following setting is also required to remove unmatched groups:
omero.ldap.new_user_group=:filtered_dn_attribute:memberOf
If you are connecting to your server over SSL, that is, if your URL is of the form ldaps://ldap.example.com:636 you may need to configure a key and trust store for Java. See the Server security and firewalls page for more information.
This feature allows for LDAP to be considered the authority on user/group membership. With the following settings enabled each time a user logs in to OMERO their LDAP groups will be read from the LDAP server and reflected in OMERO. Enabling this will result in any bespoke OMERO groups that have been created being removed from the user’s profile. The groups will still exist on the server but the association between user and group will not be reflected unless such a link is made in LDAP.
bin/omero config set omero.ldap.sync_on_login true
The primary component of the LDAP plugin is the LdapPasswordProvider, which is responsible for creating users, checking their passwords, and adding them to or removing them from groups. The default password provider is the chainedPasswordProvider which first checks LDAP if LDAP is enabled, and then checks JDBC. This can explicitly be enabled by executing the system admin command:
bin/omero config set omero.security.password_provider chainedPasswordProvider
When the LDAP password provider implementation changes, previous versions can be configured as necessary.
chainedPasswordProviderNoSalt
The chainedPasswordProviderNoSalt uses the version of the JDBC password provider without password salting support as available in the OMERO 4.4.x series. To enable it, use:
bin/omero config set omero.security.password_provider chainedPasswordProviderNoSalt
chainedPasswordProvider431
With the 431 password provider, the user filter is only checked on first login and not kept on subsequent logins. This allows for an OMERO admin to change the username of a user in omero to be different than the one kept in LDAP. To enable it, use:
bin/omero config set omero.security.password_provider chainedPasswordProvider431
See also
Active Directory (AD) supports a form of LDAP and can be used by OMERO like most other directory services.
In AD, the Domain Services (DS) ‘forest’ is a complete instance of an Active Directory which contains one or more domains. Querying a particular Domain Service will yield results which are local to that domain only. In an environment with just one domain it is possible to use the default configuration instructions for OMERO LDAP. If there are multiple domains in the forest then it is necessary to query the Global Catalogue to enable querying across all of them.
In an AD DS forest, a Global Catalogue provides a central repository of all the domain information from all of the domains. This can be queried in the same way as a specific Domain Service using LDAP, but it runs on different ports; 3268 and 3269 (SSL).
LDAP AD Global Catalogue server URL string
bin/omero config set omero.ldap.urls ldap://ldap.example.com:3268
Note
A SSL URL above should look like this: ldaps://ldap.example.com:3269