Use case: Connect ForgeRock Identity Cloud with an LDAP user store

Setup
, , , , ,
#1

Use case overview

ForgeRock provides a wide range of identity connectors that allow you to synchronize identity data to and from external data stores.

Connectors can access data in your ForgeRock Identity Cloud tenant as well as from an app or service that operates on a server external to your tenant. They can convert identity profiles and user accounts into a compatible format that can be used by both data stores.

In this simple use case, we’ll demonstrate how to configure a connector for an LDAP data store. With the LDAP connector, you can connect to any LDAPv3-compliant directory server, such as ForgeRock Directory Services (DS), Active Directory, SunDS, Oracle Directory Server Enterprise Edition, IBM Security Directory Server, and OpenLDAP.

Steps to achieve this use case

This use case has two stages:

  1. Configure the Remote Server Connector (RCS)

  2. Configure the LDAP connector

The use case assumes that you already have an LDAP directory data store.

Configure the Remote Server Connector (RCS)

Identity Cloud includes a Remote Server Connector (RCS) component that allows you to access data across a security boundary, for example on an LDAP or other on-premises target system that requires a connection to Identity Cloud.

Before you can configure the LDAP connector you must configure the RCS.

Install and configure the RCS by following steps 1 through 3 in the Synchronization > Before you begin section of the documentation:

  1. Register a remote server
  2. Download a remote server
  3. Configure a remote server to connect to Identity Cloud

Once the RCS server is installed and configured, check the status of the RCS server:

  1. Sign in to the Identity Cloud admin UI using your admin tenant URL, in the format https://<tenant-name>/am/XUI/?realm=/#/.

  2. Go to Identities > Connect. The Connector Server should be Connected.

    uc_rcs_connected
    uc_rcs_connected2040×746 107 KB

Configure the LDAP Connector

  1. Sign in to the Identity Cloud admin UI using your admin tenant URL, in the format https://<tenant-name>/am/XUI/?realm=/#/.

  2. Go to Native Consoles > Identity Management > Configure > Connectors.

  3. Click New Connector.

  4. Complete the following connector details:

    • Connector Name: Enter a name to identify this connector. In our example, we’ve named it PreviousCIAM.

    • Remote Host: Enter the name of the RCS you created previously.

    • Connector Type: Select LDAP Connector - <version number>

    • LDAP Type: Select the LDAP Type, for example, Generic LDAP Configuration.

    • Host Name or IP: Enter the host name or IP address of the server on which the LDAP instance is running - this MUST be resolvable and reachable from the RCS.

    • Port: Enter the port on which the LDAP server listens for LDAP requests. Our example configuration specifies a default port of 1389.

    • Account Distinguished Name (DN): Enter the bind user for LDAP. In our example, this is cn=Directory.

    • Password: Enter the bind password for the above account.

    • Base DN: Enter the Base Distinguished Name where users can be found.
      In our example, this is dc=previousCiam, dc=net.

    • Object Classes for users: Enter the list of object classes for the user objects you want to see. For example, top, person organizationalPerson, inetOrgPerson

    • Object Classes for groups: Enter the list of object classes for the group objects you want to see. For example, top, groupOfUniqueNames.

    uc_ldap_connector_config
    uc_ldap_connector_config1034×1426 132 KB

  5. Click Save.

  6. Click the Data tab and check that users are being populated. If they are, the connector is successfully set up.

    uc_ldap_connector_data
    uc_ldap_connector_data1202×833 147 KB

Examine the object types

To view the object types for the connector:

  1. Click the Object Types tab.

    uc_ldap_connector_object_types
    uc_ldap_connector_object_types1010×338 65.7 KB

  2. Click Edit (pencil) icon next to an object to view the object properties.

In our example, we have an Object Type called account.

Note that the userPassword property of the account object type is a string. This allows us to do credential synchronization for bulk or trickle migration.

uc_ldap_connector_account
uc_ldap_connector_account1165×1010 98 KB

Additional resources

Documentation:

Training videos:

Other resources:

1 Like
ForgeRock Identity Cloud: Centrally managing all identity data
Use case: Map existing AD groups to roles in ForgeRock Identity Cloud
ForgeRock Identity Cloud: Providing user information to applications
Use case: Map attributes from an external user store to ForgeRock Identity Cloud
I am getting as 'Forbidden error' along with 'This Ops is not available in ForgeRock Identity Cloud