How to Integrate LDAP with Liferay DXP 7.4

Overview

This guide provides a detailed, beginner-friendly approach to integrating Liferay DXP 7.4 with an LDAP server for authentication and user management. It explains each step, highlights common pitfalls, and compares LDAP filters to help you optimize your configuration.

---

Table of Contents

1. Overview
2. Prerequisites
3. Step-by-Step Configuration
   • Connect Liferay to LDAP
   • User Mapping
   • Group Mapping
   • Testing the Connection
4. Understanding LDAP Filters
   • Import All Users
   • Import Specific User by sAMAccountName
   • Optimize User Import for Active Directory
   • Import All Groups
   • Import Specific Group Named Employees
5. Troubleshooting
   • Connection Fails
   • Users or Groups Not Syncing
   • Authentication Issues
6. Example Use Cases
   • Sync All Users
   • Sync Users in a Specific Group

---

Prerequisites

Before you begin, ensure you have the following:

• Access to the Liferay Control Panel as an administrator.
• LDAP server details:
  • Base Provider URL: Address of your LDAP server (e.g., ldap://your-ldap-server:389).
  • Base DN: The distinguished name to use as the base (e.g., dc=example,dc=com).
  • Principal: A user with access to query LDAP (e.g., cn=admin,dc=example,dc=com).
  • Credentials: The password for the principal user.
• Knowledge of LDAP object classes and attributes (e.g., sAMAccountName, userPrincipalName, etc.).

---

Step-by-Step Configuration

Connect Liferay to LDAP

1. Log in to Liferay as an administrator.

2. Navigate to Control Panel > Instance Settings > LDAP.

3. Enable the LDAP configuration.

4. Add a new LDAP server and fill in the following details:

   • Base Provider URL:

     ldap://your-ldap-server:389
     

   • Base DN:

     dc=example,dc=com
     

   • Principal:

     cn=admin,dc=example,dc=com
     

   • Credentials: The password for the principal.

5. Save the configuration and proceed to testing.

---

User Mapping

Configure how Liferay maps its users to LDAP attributes:

1. Go to User Mapping.

2. Map the following attributes:

   • Screen Name: sAMAccountName (or another unique identifier).
   • Email Address: userPrincipalName or mail.
   • Password: unicodePwd (ensure your LDAP supports this).
   • Full Name: cn.
   • First Name: givenName.
   • Last Name: sn.

3. Save the configuration.

---

Group Mapping

Configure group synchronization if required:

1. Go to Group Mapping.

2. Map the following attributes:

   • Group Name: cn.
   • Description: description (optional).
   • Users: member.

3. Add an Import Search Filter to filter specific groups:

   (objectClass=group)
   

---

Testing the Connection

Test LDAP Connection

To verify the connection between Liferay and your LDAP server:

1. Click the Test LDAP Connection button in the Liferay LDAP settings.
2. If the connection fails:
   • Check the LDAP server address, credentials, and Base DN for accuracy.
   • Ensure the LDAP server is reachable from the Liferay server (e.g., no firewalls blocking the connection).

Test LDAP Users

1. Use the Test LDAP Users button to verify that user synchronization settings are correct.
2. If users are not being imported, adjust the User Import Filter. A basic filter example is:

   (objectClass=person)
   

Test LDAP Groups

1. Use the Test LDAP Groups button to verify that group synchronization settings are correct.
2. If groups are not being imported, adjust the Group Import Filter. A common filter example is:

   (objectClass=group)
   

---

Understanding LDAP Filters

LDAP filters allow you to control which users and groups are imported into Liferay. Here are some common filter examples:

To Import All Users:

(objectClass=person)

To Import a Specific User by Their sAMAccountName:

(&(objectClass=person)(sAMAccountName=username))

To Optimize User Import for Active Directory:

(objectCategory=person)

To Import All Groups:

(objectClass=group)

To Import a Specific Group Named Employees:

(&(objectClass=group)(cn=employees))

---

Troubleshooting

Connection Fails

• Verify the Base Provider URL, Base DN, and credentials.
• Ensure there are no firewall rules blocking the connection.
• Check the Liferay logs for specific error messages.

Users or Groups Not Syncing

• Double-check your filters to ensure they are not too restrictive.
• Ensure that attributes like sAMAccountName or cn exist in your LDAP schema.

Authentication Issues

• Confirm that the Authentication Search Filter is correctly configured. A common example:

  (&(objectClass=person)(sAMAccountName=@user_id@))
  

---

Example Use Cases

Scenario 1: Sync All Users

User Filter:

(objectClass=person)

Scenario 2: Sync Users in a Specific Group

User Filter:

(&(objectClass=person)(memberOf=cn=employees,dc=example,dc=com))

Group Filter:

(objectClass=group)