Open the LDAP integration wizard through the Welcome to YSoft SafeQ Widget at the main screen.

NOTE: The settings for LDAP replication can be also found on the web interface: Users -> Actions... -> Connect to LDAP

Open the Connection section.

On the Connection tab, you can setup the integration setting with LDAP.

Available settings are:

• LDAP server type (AD, NDS, OpenLDAP)

• Load users on demand - This type of replication mode is sometimes referred as semi-online. When enabled, users are created only during job reception or when logging into the terminal. 

  • Full and differential replication updates only users already registered within YSoft SafeQ. 

  • Replication of Roles and Cost centers is unaffected. 

  •  Note: User's card when is removed from LDAP is not synchronized to the database with configuration option removeCardsInDiffLdapReplication .

  Having semi-online mode enabled (ldap-replicator-online-mode = true) can result in issuing multiple identical LDAP requests to remote AD server. This can clash with configured user-locking policy.
  Possible workaround would be:
  a) do not use semi-online mode, when there is strict user-locking policy on AD,
  b) increment number of attempts after which user gets locked to at least 5.

• URL of LDAP server

• LDAP bind method - method used for authentication and data security on the LDAP level
  
  The correct setting of LDAP bind method needs to be selected so that YSoft SafeQ can authenticate to the LDAP server configured, supported options are:

  • Simple bind – This is universal password-based authentication method simply passing the username and password in plain. From a security perspective, this is acceptable if an LDAPS connection is used since the entire communication is protected on the TLS level. LDAP servers might refuse to accept an unsecured LDAP connection using simple bind (e.g. based on registry settings of an Active Directory server). Select this method if an anonymous connection is to be used.

  • LDAPv3 SASL DIGEST-MD5 – An advanced authentication mechanism added in LDAP version 3 is used which does not expose plain-text passwords. In addition, if an unsecured LDAP connection is used, the data transferred will be integrity-protected and also encrypted if the LDAP server supports it. However, using LDAPS is still recommended for better security. This method can also be used together with LDAPS, when only the initial authentication might be affected (LDAP servers might refuse to accept connections with a doubled data protection mechanism). Note there are limitations when using this method, e.g. the IP address in the URL of LDAP server setting is not supported.

  Please see Client authentication below for more information and the full list of limitations.
  
  

• Searched LDAP subtree

• Service account

  There is a possibility to use either an anonymous account or authorized account to log into the LDAP server to search for users. The selected account has to have at least read access to reach the users and their attributes.
  Please ask your domain administrator for LDAP credentials. Specific username (principal) format might be required based on LDAP bind method selected. For LDAPv3 SASL DIGEST-MD5 setting, use only the username string with no prefix or suffix. Simple bind setting supports more formats, e.g. user@domain or distinguished name.

Open the Scheduling section.

The Scheduling tab gives you the possibility to schedule the run of replication. All settings are revealed after you check the Enable regular synchronizations checkbox. The options are:

• Start full replication - Here you can select the days and times for full replication, by clicking checkboxes.
  

• Start differential replication - Here you can specify the hours or time interval from the last replication to start differential replication. This type of replication will be started every day.

NOTE: You have to restart YSoft SafeQ CML services to apply these changes.

Run the synchronization using the "Sync now" button.
 

Check the result.

The Status tab contains only information about the last synchronization with the LDAP server (date, duration and result) and the count of added/updated/deleted users, cost centers and roles.

In case of an error, this error will be displayed here.