Connect Forms to LDAP

To connect Forms with an LDAP you must use the configOverrideFiles parameter. A sample snippet has been provided, which will need to be updated with your specific details.

Below is an example snippet of configuring Forms to use an LDAP server as part of a federated repository. The baseDN, bindDN and bindPassword will need to be replaced with the proper values. The searchBase for the ldap entity types will also need to be updated. The participatingBaseEntry will need to match the baseDN defined in the LDAP server snippet.

Forms uses Domino as the LDAP.

It is recommended to specify a "realmName" as it makes it easier to reference entries from this LDAP configuration, specifically in the Forms role assignments.

For more specific details on what is supported by OpenLiberty, refer to their ldap registry documentation.

Note

The userSecurityNameMapping and groupSecurityNameMapping are required. These properties control how users and groups are displayed while using Forms.

Note

For Forms to be able to send mail the loginProperty must be set to mail.

Example Connecting to Domino LDAP

configuration: 
  leap:
    . . . 
    configOverrideFiles: 
      . . .
      ldapOverride: | 
        <server description="leapServer"> 
           <federatedRepository id="leapRepo"> 
             <primaryRealm name="defaultWIMFileBasedRealm"> 
               <participatingBaseEntry name="o=Acme"/> 
               <userSecurityNameMapping outputProperty="mail" /> 
               <groupSecurityNameMapping outputProperty="cn" /> 
             </primaryRealm> 
           </federatedRepository>
           <ldapRegistry id="DominoLdap" 
              name="o=Acme" 
              ldapType="IBM Lotus Domino" 
              host="ldaphost.acme.com"
              port="636" 
              baseDN="o=Acme" 
              searchTimeout="8m" 
              ignoreCase="true" 
              bindDN="${ldap-credentials/LDAP_BIND_DN}"
              bindPassword="${ldap-credentials/LDAP_BIND_PASSWORD}"
              realmName="acmeRealm" 
              sslEnabled="true" 
              sslRef="defaultSSLConfig"
              derefAliases="never">
                <loginProperty name="mail"></loginProperty> 
                <ldapEntityType name="PersonAccount"> 
                  <objectClass>dominoPerson</objectClass>
                </ldapEntityType> 
                <ldapEntityType name="Group"> 
                  <objectClass>dominoGroup</objectClass> 
                </ldapEntityType> 
                <customFilters userIdMap="*:mail" groupIdMap="*:cn" groupMemberIdMap="dominoGroup:member" userFilter="(&amp;(objectclass=dominoPerson)(mail=%v))" groupFilter="(&amp;(objectclass=dominoGroup)(cn=%v))"/> 
           </ldapRegistry> 
        </server>

Parent topic: Open Liberty server customizations