JetBrains Space Help

Open LDAP Auth Module

Open LDAP authentication module lets users log in to Space with credentials that are stored in an external directory service. This authentication module is pre-configured for Open LDAP. You can configure a module to use the standard LDAP scheme or LDAPS over SSL.

The Open LDAP authentication module does not import all of the user accounts from the directory service. Space only creates a user account when an unregistered user first logs in to Space.

When LDAP authentication is enabled, Space checks the directory service for each login attempt. Users who have been removed from the directory service cannot log in to Space.

Prerequisites

If you want to connect to the directory service over SSL, import the trusted SSL certificate for your Open LDAP service before you enable the authentication module. If there are any intermediate certificates that sit between the SSL certificate and the root CA certificate, you need to upload a file that contains the full certificate chain.

The option to import a trusted SSL certificate is not supported in the settings for the Open LDAP authentication module. Instead, you need to access the Trusted SSL Certificates page and import it there.

For more information, see Trusted SSL Certificates.

Enable Open LDAP Authentication

  1. On the navigation bar, click administration.png Administration and choose Auth Modules.

  2. Click New auth module. The New Auth Module dialog opens.

  3. From the Type drop-down list, select Open LDAP.

  4. In the New Auth Module dialog, enter values for the following settings:

    SettingDescription
    StatusChoose Active to enable the module.
    KeyGive this authentication module a unique identifier.
    NameGive this authentication module a human-readable name to distinguish this module from other authentication modules in the Auth Modules list.
    Server URL

    Stores the LDAP URL of the directory service used to authenticate a login request in Space.

    The LDAP URL uses the format ldap://host:port/DN. Enter the full distinguished name (DN) of the directory where user accounts are stored.

    SSL keystoreChoose a custom SSL keystore for LDAPS connections.
    Bind DNStores the value that is used to bind with the directory service.
    Bind passwordThe password of the Bind account.
    FilterStores an expression that locates the record for a specific user in the LDAP service. The substitution variable in the expression is replaced with the value entered as the username or email on the login page.
    Connection timeoutSets the period of time to wait to establish a connection to the authorization service. The default setting is 5000 milliseconds (5 seconds).
    Read timeoutSets the period of time to wait to read and retrieve user profile data from the authorization service. The default setting is 5000 milliseconds (5 seconds).
    LDAP referralChoose Follow to allow the authentication module to follow requests from the service to locate additional information in the LDAP directory.
    User registration

    On— Accounts in the Space organization will be created automatically for unregistered users who log in using Open LDAP authentication module.

    Off— Open LDAP logins will be only available to users who already have an account in the Space organization.

  5. Configure the Attribute Mapping.

    When Space finds a record in the LDAP service that matches a filter, it fetches values from the LDAP attributes that are specified for each field and copies them to the user profile in Space. Use the following settings to define the filter criteria and map attributes that are stored in your directory service to user accounts in Space.

    FieldDescription
    Login

    Required. Maps to the LDAP attribute that stores the value to copy to the Login field in the Space profile. For Open LDAP, the default value is uid.

    Full nameMaps to the LDAP attribute that stores the value to copy to the Full name field in the Space profile.
    EmailMaps to the LDAP attribute that stores the value to copy to the Email field in the Space profile.
    GroupsmemberOf

Test the connection to your directory service

To verify that the Open LDAP authentication module is connected to your directory service, test the connection.

To test the connection:

  1. Click the Test Login button.

  2. In the Test Settings dialog, enter the credentials of a user who is stored in your Open LDAP service:

    • In the Login field, enter the domainusername.

    • In the Password field, enter the password.

  3. Click the Test Login button.

    • Space searches for the specified user account in the Open LDAP service. If the user is found, a success notification is displayed. If you get an error, check your user credentials and server URL.

Last modified: 12 May 2020