Jive Messenger LDAP Guide

Introduction

This document details how to configure your Jive Messenger installation to use an external LDAP store when authenticating users and loading user profile information.

Background

LDAP (Lightweight Directory Access Protocol) has emerged as a dominant standard for user authentication and for storage of user profile data. It serves as a powerful tool for large organizations (or those organizations integrating many applications) to simplify user management issues.

By default, Jive Messenger stores all user data in a database and performs authentication using database lookups. The LDAP module replaces that functionality and allows Jive Messenger to:

Note: Jive Messenger treats the LDAP directory as read-only.

This document will guide you through configuring LDAP support in Jive Messenger. These instructions assume that you're a competent LDAP user, and that you're familiar with Jive Messenger setup issues.

Configuration

In order to configure your server to use LDAP:

  1. Stop Jive Messenger.
  2. Edit conf/jive-messenger.xml in your Jive Messenger installation folder as described below.
  3. Restart Jive Messenger.

Editing the Config File

Open the configuration file conf/jive-messenger.xml from your Jive Messenger installation in your favorite editor and add or change the following settings. Properties flagged with (*) must be set. Properties flagged with (**) must be set in order to enable LDAP group support, all other properties are optional:

Below is a sample config file section:


<jive>
...
    <ldap>
        <host></host>
        <port>389</port>
        <usernameField>uid</usernameField>
        <nameField>cn</nameField>
        <emailField>mail</emailField>
        <baseDN>ou=People;dc=example;dc=com</baseDN>
        <adminDN>cn=Directory Administrator</adminDN>
        <adminPassword></adminPassword>
    </ldap>
    <provider>
        <user>
            <className>org.jivesoftware.messenger.ldap.LdapUserProvider</className>
        </user>
        <auth>
            <className>org.jivesoftware.messenger.ldap.LdapAuthProvider</className>
        </auth>
        <group>
            <className>org.jivesoftware.messenger.ldap.LdapGroupProvider</className>
        </group>
    </provider>
...
</jive>

You'll most likely want to change which usernames are authorized to login to the admin console. By default, only the user with username "admin" is allowed to login. However, you may have different users in your LDAP directory that you'd like to be administrators. The list of authorized usernames is controlled via the adminConsole.authorizedUsernames property. For example, to let the usersnames "joe" and "jane" login to the admin console:


<jive>
...
    <adminConsole>
    ...
        <authorizedUsernames>joe, jane</authorizedUsernames>
    </adminConsole>
...
</jive>

Custom Search Filter

By default, Jive Messenger will load all objects under the baseDN that have the attribute specified by ldap.usernameField. In the case that the username field is set to "uid", the search for all users would be "(uid=*)". However, there are cases when this logic does not work -- for example, when a directory contains other objects besides users but all objects share "uid" as a unique identifier field. In that case, you may need to specify a custom search filter using ldap.searchFilter. As an example, a search filter for all users with a "uid" and a "cn" value of "joe" would be:

(&(uid={0})(cn=joe))

The "{0}" value in the filter above is a token that should be present in all custom search filters. It will be dynamically replaced with "*" when loading the list of all users or a username when loading a single user.

Some custom search filters may include reserved XML entities such as "&". In that case, you must enter the search filter into the jive-messenger.xml file using CDATA:

<searchFilter><![CDATA[(&(sAMAccountName={0})(|(givenName=GEORGE)(givenName=admin)))]]></searchFilter>

Custom Inital Context Factory

Some LDAP servers or application servers may require that a different LDAP initial context factory be used rather than the default (com.sun.jndi.ldap.LdapCtxFactory). You can set a custom initial context factory by adding the following to jive_config.xml:

<ldap>
    ... other ldap settings here 
    <initialContextFactory>com.foo.factoryClass</initialContextFactory>
</ldap>

Connection Pooling

The default LDAP provider (Sun's) support pooling of connections to the LDAP server. Connection pooling can greatly improve performance, especially on systems with high load. Connection pooling is enabled by default, but can be disabled by setting the Jive property ldap.connectionPoolEnabled to false:
<ldap>
    ... other ldap settings here 
    <connectionPoolEnabled>false</connectionPoolEnabled>
</ldap>

You should set several Java system properties to change default pool settings. For more information, see the following pages:

Note that if you turn on LDAP debugging, connection pooling will not be enabled. If SSL LDAP mode is enabled, you must set a system property to enable pooling of SSL LDAP connections.

LDAP FAQ

Can I create new users through Jive Messenger when using LDAP?

Why is the list of usernames not sorted in the admin console when using LDAP? I switched to LDAP and now cannot login to the admin console. What happened?