LDAP

Axidian CertiFlow supports the following LDAP catalogs: Active Directory, Samba AD DC, FreeIPA and OpenLDAP.

An LDAP catalog can be compound. It can pull user information from different containers within a single domain or from multiple domains.

Configure a catalog

Active Directory and Samba AD DC

About Samba AD DC

Samba AD DC can be configured as an Active Directory domain controller or as the primary domain controller.

If Axidian CertiFlow was previously configured to work with a user catalog in Active Directory and the domain controller is reconfigured to Samba AD DC, do not change the existing user catalog configuration parameters.

When you first configure a connection to a Samba AD DC user catalog, select this catalog type in the Axidian CertiFlow Configuration Wizard.

Create a service account

Create a service account for reading and writing user attributes.

Active Directory

1. Launch the Active Directory Users and Computers (ADUC) snap-in.
2. Expand the domain tree and select the container or organizational unit that you want to host the user account.
3. On the Action menu, select Create → User.
4. Enter the name of the service account.
5. Fill in the required fields and click Finish to create the account.

Samba AD DC

Create a service account in Active Directory Users and Computers (ADUC) snap-in or using the samba-tool command line:

1. Create a user:

   samba-tool user add <user name>
   Example

   samba-tool user add servicecertiflow

2. If you plan to use the service account as role administrator in Axidian CertiFlow Management Console, add the UPN (User Principal Name) attribute:

   sudo samba-tool user rename <user name> --upn=<UPN>
   Example

   sudo samba-tool user rename servicecertiflow --upn=servicecertiflow@domain.name

Configure permissions

1. Launch the Active Directory Users and Computers snap-in.
2. Go to the Security tab of the object that contains the Axidian CertiFlow users.
3. Click Advanced → Add → Select a principal.
4. In the Enter the object names to select text box, type the service account name and click OK.
5. In the Apply to dropdown list, select Descendant User objects.
6. In the Permissions list, select:
   • List contents.
   • Read all properties
   • Reset password
7. In the Properties list, select:
   • Write pwdLastSet
   • Write thumbnailPhoto or Write jpegPhoto
   • Write userAccountControl
   • Write userCertificate
8. Click OK and Apply.

info

Grant the service account the same set of permissions for each object that contains the Axidian CertiFlow users.

Configure granular permissions in ADSI Edit

If domain security policies prohibit reading all user properties, use the ADSI Edit snap-in to grant the service account explicit read and write permissions on the user attributes and on the object that contains the Axidian CertiFlow users:

1. In the ADSI edit snap-in, right-click the relevant object and go to Properties → Security.
2. In the Apply onto list, select This object and all descendant objects and configure the following settings:
   1. In the Permissions list, check List contents box.
   2. In the Properties list, check the following boxes:
      • Read canonicalName
      • Read Distinguished Name
      • Read objectClass
      • Read objectGuid
      • Read showInAdvancedViewOnly
3. In the Apply onto list, select Descendant user objects:
   1. In the Permissions list, check List contents.
   2. In the Properties list, select read/write for the following properties and attributes:
      • Read personal Information
      • Read general Information
      • Read account restrictions
      • Read public Information
      • Write pwdLastSet
      • Write thumbnailPhoto or Write jpegPhoto
      • Write userAccountControl
      • Write userCertificate

Supported user attributes

The table below lists the user attributes that Axidian CertiFlow works with in Active Directory or Samba AD DC catalogs.

info

It is recommended to grant access to property sets. For more information about property sets, see Microsoft's documentation.

Attribute (LDAP Display Name)	Common Name	Info
c	Country/Region or Country/Region Abbreviation	Personal Information property set
canonicalName	Canonical Name	Public Information property set
cn	Common Name	Public Information property set
company	Company	Public Information property set
department	Department	Public Information property set
distinguishedName	Distinguished Name	Public Information property set
givenName	Given Name	Public Information property set
l	Locality Name	Personal Information property set
mail	E-mail Addresses	Public Information property set
manager	Manager	Public Information property set
objectClass	Object Class	Public Information property set
objectGUID	Object GUID	Public Information property set
objectSid	Object Sid	General Information property set
otherMailbox	Other Mailbox	Public Information property set
proxyAddresses	Proxy Addresses	Public Information property set
pwdLastSet	Pwd Last Set	Account Restrictions property set
sAMAccountName	SAM Account Name	General Information property set
sn	Surname	Public Information property set
st	State or Province Name	Personal Information property set
streetAddress	Address (or Street)	Personal Information property set
telephoneNumber	Telephone Number	Personal Information property set
thumbnailPhoto or jpegPhoto	Picture	Personal Information property set
userAccountControl	User Account Control	Account Restrictions property set
userCertificate	User Certificate	Personal Information property set
userPrincipalName	User Principal Name	Public Information property set

FreeIPA

To configure a user catalog in FreeIPA:

1. Sign in to the FreeIPA Web UI as an administrator.
2. On the Identity tab go to Users, click Add and create a user. By default, the created user is a member of the ipausers service domain group.
3. Create a permission to read and search data in the catalog:
   1. On the IPA Server tab, in the Role-Based Access Control list, select Permissions and click Add.
   2. Enter the permission name.
   3. In the Bind rule type string, select permission.
   4. In the Granted Rights string, select read, search.
   5. In the Subtree string, enter the Distinguished name of domain.
   6. Select Effective attributes: entryUUID.
4. Create a permission to write data to the catalog:
   1. On the IPA Server tab, in the Role-Based Access Control list, select Permissions and click Add.
   2. Enter the permission name.
   3. In the Bind rule type string, select permission.
   4. In the Granted Rights string, select write.
   5. In the Type list, select User.
   6. Select Effective attributes:
   • userPassword
   • krbPasswordExpiration
   • userCertificate
   • jpegPhoto
5. In the Role-Based Access Control list, select Privileges and click Add.
6. Create a privilege and add the created permissions to it.
7. In the Role-Based Access Control list, select Roles, click Add and create a role.
8. In the Roles section, go to the Privileges tab and add the created privilege to the role.
9. Assign the role to the service account:
   1. In the Roles section, select the created role.
   2. In the user list, click Add and select the created user.

Supported user attributes

The table below lists the user attributes that Axidian CertiFlow works with in the FreeIPA catalog.

User attribute	Description
entryUUID	Universally unique identifier assigned to the entry
entryDN	Entry's distinguished name
uid	User identifier
mail	Email address
telephoneNumber	Phone number
givenName	First name
sn	Last name
cn	Common name
krbPrincipalName	Kerberos user principal name (UPN)
jpegPhoto	Photo
userPassword	Password
krbPasswordExpiration	A given user's password expiration date
userCertificate	Certificate

OpenLDAP

Prepare a service account for Axidian CertiFlow to work with the user catalog.

The commands below use the following accounts:

• cn=servicecertiflow,ou=users,dc=domain,dc=loc — the service account that Axidian CertiFlow uses to connect to the user catalog.
• cn=admin,dc=domain,dc=loc — the administrator account of the main directory database (OpenLDAP rootDN). The ldapadd and ldappasswd commands are executed on its behalf.
• cn=admin,cn=config — the administrator account of the OpenLDAP configuration database (cn=config). Database ACL changes are applied on its behalf through ldapmodify.

All examples of files and commands include template values. Replace them with your actual values.

Create a service account

In the example below, the service account is created using an LDIF file.

1. Create an LDIF file with the user attributes.

   LDIF file example for creating a service account

   cat > create_service_user.ldif <<EOF
   dn: cn=servicecertiflow,ou=users,dc=domain,dc=loc
   objectClass: inetOrgPerson
   objectClass: posixAccount
   objectClass: top
   uid: servicecertiflow
   cn: Service Account
   sn: Certiflow
   userPassword: {SSHA}XiU3Tq7V8fQzJm5nLoP9rStYw12AbCdE
   uidNumber: 900
   gidNumber: 900
   homeDirectory: /home/servicecertiflow
   EOF

2. Add the created user to the catalog.

   ldapadd -x -D "cn=admin,dc=domain,dc=loc" -W -f create_service_user.ldif

3. Set the service account password. You will be prompted to enter the new password for the target entry twice. Then, enter the password for the cn=admin,dc=domain,dc=loc entry to confirm the operation.

   ldappasswd -xWD cn=admin,dc=domain,dc=loc -S cn=servicecertiflow,ou=users,dc=domain,dc=loc

Configure permissions

Grant the service account read, search, and write permissions in the catalog.

1. Create an LDIF file for the ACL of the database with users and groups. For example, servicecertiflow.acl.ldif.

   LDIF file example for ACL configuration

   cat > servicecertiflow.acl.ldif <<EOF
   dn: olcDatabase={1}mdb,cn=config
   changetype: modify
   replace: olcAccess
   olcAccess: {0}to *
     by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
     by * break
   olcAccess: {1}to attrs=userPassword
     by self write
     by anonymous auth
     by dn.base="cn=servicecertiflow,ou=users,dc=domain,dc=loc" write
     by * none
   olcAccess: {2}to attrs=jpegPhoto
     by self write
     by dn.base="cn=servicecertiflow,ou=users,dc=domain,dc=loc" write
     by * read
   olcAccess: {3}to *
     by self read
     by dn.base="cn=servicecertiflow,ou=users,dc=domain,dc=loc" read
   EOF

2. Load the ACL into the OpenLDAP configuration database.

   ldapmodify

   ldapmodify -x -D "cn=admin,cn=config" -W -f servicecertiflow.acl.ldif

Supported user attributes

The table below lists the user attributes that Axidian CertiFlow works with in the OpenLDAP catalog.

User attribute	Description
entryUUID	Universally unique identifier assigned to the entry
entryDN	Entry's distinguished name
uid	User identifier
mail	Email address
telephoneNumber	Phone number
givenName	First name
sn	Last name
cn	Common name
jpegPhoto	Photo
userPassword	Password