Using LDAP Server's Security Information

Using by importing

Using via the LDAP implementation of the Security API

LDAP (Lightweight Directory Access Protocol) is a lightweight client-server protocol for accessing directory services. With LDAP support, JReport Server enables you to import users/groups from directory servers. JReport Server can also access an LDAP server directly using the LDAP Security API implementation.

Using by importing

Importing LDAP users automatically

If the Enable Auto-Import of Users from LDAP Server option in the Configuration > LDAP > Server tab has been checked while configuring the LDAP server, LDAP users will automatically be imported into JReport Server when they log in for the first time. The Enable LDAP Support and Enable Auto-Import of Users from LDAP Server options in the Configuration > LDAP > Server tab work together. The former determines whether an imported LDAP user can be used in JReport Server, and the latter determines whether LDAP users can be imported automatically, as shown in the following table:

Checked =Checked; =Unchecked

	Enable LDAP Support	Enable Auto-Import of Users from LDAP Server	Can be used
Local User			YES
			YES
			YES
			YES
Imported LDAP User			YES
			YES
			NO
			NO
None-Imported LDAP User			YES
			NO
			NO
			NO

Importing LDAP users and groups manually

You can also import LDAP users and groups into the JReport Server's security system manually.

On the JReport Administration page, click Configuration on the system toolbar and then select LDAP from the drop-down menu to open the Configuration - LDAP page. Click the Import tab.
Specify whether LDAP users will overwrite local users or be replaced by local users after LDAP users are imported into JReport Server.
If you have imported users/groups from the LDAP server to JReport Server before and you want to import them again, in order to prevent the information of the users/groups on JReport Server from being overwritten by the newly imported users/groups, you should check Local users overwrite LDAP users and then import the users/groups.
To view the LDAP users and groups that have the same names as the users and groups in JReport Server, click the List Users and List Groups buttons.
Import the LDAP users and groups to JReport Server.
- To import LDAP users click Import Users, the users on the LDAP server are then listed. To import some of them, select them and then click Import; to import all of them, click Import All.
- To import LDAP groups click Import Groups, the groups on the LDAP server are then listed. To import some of them, select them and then click Import; to import all of them, click Import All.
- To import all LDAP users and groups, click the Import All button.
The selected or all LDAP users/groups will then be imported based on the specified overwriting rule. Any LDAP group that has the same name as a group on JReport Server will be merged into the local group.

Notes:

There is an admin group named Administrators on the LDAP Server. If you perform an import operation, all groups will then be imported except for the Administrators group.
In the case of a non-admin group on the LDAP Server having the same name as a non-admin group on JReport Server, if you perform an import operation, all users from the non-admin group on the LDAP Server will be merged into the non-admin group of JReport Server.
When the system built-in admin user logs in JReport Server, JReport always tries the system built-in password first (admin by default). This is to provide a backdoor password for admin in case the LDAP server is down.

Synchronizing local security information with that of LDAP server

In order to have the most current security information, you can schedule a task to synchronize the security information of JReport Server with that of the LDAP server. The synchronization process first compares the security information on both JReport Server and the LDAP server. Then if necessary, it updates the information on JReport Server so that both sides are consistent. However, for security reasons this process does not automatically import the newly-added users or groups from the LDAP server.

To schedule a synchronization task, take the following steps:

On the JReport Administration > Configuration > LDAP page, go to the Synchronize tab.
Click the Edit link in the LDAP Synchronization Schedule Settings table.
From the Select time type to synchronize drop-down list, specify the time for when the task is to be performed.
- To run the task at a specified time, select Run this task at, then define the date and time according to your requirement.
- If you want to run the task repeatedly, select Run this task periodically, then specify the duration, date and time accordingly.
Click Save to apply the schedule settings.

Information about the synchronization task is then displayed in LDAP Synchronization Schedule Settings table and the synchronization task is enabled by default. You can perform the following operations on the task:

To edit the task, click the Edit link and then modify the schedule settings.
To disable the task, click Disable; to enable the task again, click Enable.
To view information about the last run of the synchronization task, click the Detail link.

You can also manually start the synchronization by clicking the Synchronize Now button. Then when the synchronization is completed, the Synchronization Information table will be displayed showing which users and roles/groups have been modified and removed. Click Back to return to the Synchronize tab.

Defining role maps

You can predefine role maps for the imported LDAP users, then when an LDAP user account is automatically imported, JReport Server can automatically assign it to specific roles according to the predefined role map. A role map consists of two parts: Search Filter String and Corresponding Role Name. When an imported LDAP user account matches the filter condition (specified by Search Filter String), it will automatically be added to a specific role (specified by Corresponding Role Name).

To create a role map, follow the steps below:

On the JReport Administration > Configuration > LDAP page, go to the Role Map tab.
Click the Create New Role Map link.
In the Search Filter String text box, input the search filter criteria.
From the Corresponding Role drop-down list, select a role to which you want to assign the matching users.
Click Test to test the contents of the filter. The result of the test does not affect the creation of the new role map.
Click Save to create the role map.

You can create more role maps following the above steps. The role maps are listed in the role map table. You can perform the following tasks on the role maps if required:

To edit a role map, click the Edit link in the role map row and then modify the settings.
To test the contents of the filter of a role map, click Test in the role map row.
To remove unwanted role maps, select the checkboxes ahead of them and click Delete.

Using via the LDAP implementation of the Security API

To access an LDAP server directly using the LDAP Security API implementation, you will need to turn on the LDAP security providers. There are three approaches to achieve this:

Configuring on the JReport Administration page
In the Server tab of the JReport Administration > Configuration > LDAP page, check Enable Direct Authentication to LDAP Server.
Editing the LDAP configuration file
Specify the following property in the LDAPProperties.xml configuration file located in <install_root>\properties:
<env-enableNoneImportedLDAPSupport>true</env-enableNoneImportedLDAPSupport>.

If the value is true, JReport Server security system will then use the LDAP providers. The default value of this property is false.

Configuring by API method
Invoke the following two methods in the interface ConfigurationLDAPServer:

/** 
* Specifies whether or not the Server security system uses the LDAP providers.
* @return Returns true if using none imported LDAP support, otherwise returns false.
*/
public boolean isEnableNoneImportedLDAPSupport();
/**
* Specifies whether or not the Server security system uses none imported LDAP support.
* @param isEnableNoneImportedLDAPSupport Set this parameter to true if the Server 
security system uses none imported LDAP support, otherwise set it to false.
*/
public void setEnableNoneImportedLDAPSupport (boolean isEnableNoneImportedLDAPSupport);

In order to use LDAP security providers, a valid admin user is required to manage the JReport Server. The following are rules for checking whether or not a user is an admin user:

Whether or not the user is a member of the LDAP admin group. The LDAP admin group is a configuration option in the LDAP configuration XML file.
Whether or not the user is a member of the administrators role. The user can be granted the role by a role map.

A user that meets one of these two rules is regarded as an admin user, and is thus allowed to access the JReport Administration page.

Previous Page Next Page