Configure LDAP user authentication
Applies to: Pearl-2, Pearl Mini, Pearl Nexus, Pearl Nano
You can use the Lightweight Directory Access Protocol (LDAP) to authenticate users. Specify user roles by using group DNs for users who log in as an Administrator, Operator, or as a Viewer.
The system has only one admin user and one operator. LDAP users must log in as either an admin or an operator and do not have their own private profiles. Any LDAP users with the name admin, operator, or viewer are ignored and the local accounts are used instead.
When enabled, LDAP authentication is an alternative to the regular system user names and passwords. You may still log in as admin, operator or viewer using the passwords for those accounts.
LDAP replaces the local viewer account instead of working side-by-side with it when LDAP is enabled and the viewer account has no password (either there is no global viewer password configured or the channel overrides the global password with a blank password). In this case, the viewer must authenticate with LDAP and cannot use the default viewer account with a blank password to log in.
For security reasons, you should configure passwords for the local accounts.
These instructions assume you have a pre-configured LDAP server. The server must support anonymous binding or have a special bind account with search access privileges. Note that Active Directory does not support anonymous binding. LDAP referrals, restrictions and failovers are not supported.
Configure LDAP authentication using the Admin panel
- Log in to the Admin panel as admin.
- From the Configuration menu, select Security. The Security configuration page opens.
- In the LDAP authentication section, check Enable LDAP authentication. Uncheck the check box to disable LDAP authentication.
- In the Server address[:port] field, enter the server IP address and (optional) port for your LDAP server. For example, 192.168.1.101:389.
- In the Connection encryption drop-down, choose the type of encryption used by your LDAP server (if any is used).
| Connection encryption | Description/Default port used |
|---|---|
| No Encryption | No encryption is used to connect to the LDAP server. The default port is 389. |
| SSL | SSL encryption is used to connect to the LDAP server. The default port is 636. |
| TLS/STARTTLS | The connection is initially unencrypted then upgraded to TLS encryption is used. The default port is 389. |
- In the Bind DN and Bind password fields, specify the fully qualified DN and password for LDAP bind. These fields are only needed if your LDAP server does not support anonymous binding.
- In the Base DN field, specify the baseObject to search for entries. The system will search this object and the whole subtree starting at the base DN.
- (Optional) By default the Authentication attribute is uid, which is suitable for a unix environment. You can specify a different value in the Authentication attribute field, if needed. For Active Directory environments, specify userPrincipalName. The value of this attribute must be unique in the Base DN.
- In the Administrators (group DN) field, specify the distinguished name of the group users must be part of to be logged in as the administrator. Users must have the member or uniquemember attribute for the specified group to be granted Administrator access. If left blank, LDAP is not supported for Administrators (but can still be used for Operators and Viewers).
- In the Operators (group DN) field, specify the distinguished name of the group users must be part of to be logged in as the operator. Users must have the member or uniquemember attribute for the specified group to be granted Operator access. If left blank, LDAP is not supported for Operators (but can still be used for Administrators and Viewers).
- In the Viewers (group DN) field, specify the distinguished name of the group users must be part of to be logged in as a viewer. Users must have the member or uniquemember attribute for the specified group to be granted Viewer access. If left blank, LDAP is not supported for Viewers (but can still be used for Administrators and Operators).
- Click Apply.
When a user of the LDAP server next visits the admin or viewer page for the system, the system prompts for the username and password. For Active Directory servers, the user needs to enter their fully qualified username (i.e. username@domainname) in addition to their LDAP password.
To use \, \ or " characters as part of user name or password, escape them using \5C, 5C and 22 respectively. The # character does not require to be escaped.
Users are required to authenticate once to the system and one time per channel they view. Therefore users see a prompt to log in to the system (the system name is shown) and a second time to log in to the channel (the channel name is shown).