Connect an LDAP directory
Connect OpenLDAP, 389 Directory Server and relatives through the directory agent. Credentials stay on the machine, Conbool defines only the scope.
The same agent reads LDAP directories that are not Active Directory. Which directory that is, is decided solely by the machine it runs on.
Store the credentials
Next to the state of the agent there is one file:
C:\ProgramData\Conbool\DirectoryAgent\directory.json
{
"kind": "ldap",
"url": "ldaps://directory.example.com:636",
"baseDn": "dc=example,dc=com",
"bindDn": "cn=conbool,ou=services,dc=example,dc=com",
"bindPassword": "…"
}
After that the steps are the same as for Active Directory: preflight, enroll, install.
Why the password lives here and not in Conbool
The agent exists so that nobody has to open a path from outside into the directory. Avoiding that path means not handing out the key to it either. Conbool therefore defines who the agent reads, meaning scopes, filters and attribute mapping, but never where it reads and what it authenticates with.
What differs from Active Directory
| Active Directory | Other LDAP directory | |
|---|---|---|
| Authentication | service account, Kerberos | bind DN and password |
| Changes | DirSync, including deletions | timestamps, without deletions |
| Deletions | in the incremental sync | at the daily full reconciliation |
| People | objectCategory=person | objectClass=inetOrgPerson |
| Groups | resolved by the server | resolved by the agent level by level |
| Identifier | objectGUID | entryUUID |
If people carry a different object class, the matching filter belongs in the scope in Conbool.
Encryption
ldap:// transmits the password in the clear and is rejected. In production ldaps:// belongs there. For a trial on an internal network the certificate check can be lifted through an environment variable, which has no place in production.
The direct connection without an agent
Conbool can also read an LDAP directory itself, under Settings, Directory, LDAP. That requires Conbool to reach the directory, which fits an installation in a company data centre. For a directory behind the corporate firewall the agent is the route.
Pointing both routes at the same directory is not intended, they would overwrite each other.