Directory Service (LDAP/AD) Provider

Add an LDAP provider to a security profile to authenticate administrator logins (on the Admin security profile) or device user logins (any custom security profile for that purpose).

The Directory Service (LDAP/AD) module provides authentication services. You can also implement some LDAP providers with providers of other types. If you are stacking multiple LDAP providers, be aware of and understand the configuration implications.

• Configuration Best Practices for Multiple LDAP Trees
  Use the SAP Mobile Platform administration perspective to configure LDAP authentication providers, which are used to locate LDAP user information when organizational user groups exist within multiple LDAP trees.
• LDAP Role Computation
  Role checks are the primary means of performing access control when using LDAP authentication. Authentication utilizes role computation techniques to enumerate roles that authenticated users have.
• Gathering Provider Group Information
  Production environments rely on a production-grade security provider (commonly an LDAP directory) to authenticate administrators. To map the SAP Mobile Platform default logical roles to the corresponding physical roles in the security provider, you must understand how the provider organizes users.
• Nested Groups and Roles in LDAP
  The LDAP provider computes the roles granted to an authenticated user using the role and group membership information from the LDAP repository. To support nested roles and groups, LDAP servers allow roles and groups to be members of other roles and groups respectively.
• Skipping LDAP Role Lookups (SkipRoleLookup)
  When configuring an LDAP provider, use the SkipRoleLookup configuration option to grant the user all the roles retrieved using the UserRoleMembershipAttributes property from the LDAP user entry without looking up all the roles defined in the role search base.
• Configuring an LDAP Provider to Use SSL
  If your LDAP server uses a secure connection, and its SSL certificate is signed by a nonstandard certificate authority, for example it is self-signed, import the certificate into the key store, then use Management Cockpit to configure an LDAP security profile.
• Directory Service (LDAP/AD) Configuration Properties
  Use these properties to configure the LDAP provider used to authenticate Management Cockpit administration logins or to configure the LDAP provider used to authenticate device application logins.