Cloud and in-house customers can configure frevvo to integrate with an LDAP Active Directory server to authenticate users.
frevvo only supports/certifies the LDAP and LDAP Container Security Managers when frevvo is running in the tomcat container. Refer to our Supported Platforms for the list of Application Servers supported/certified by frevvo.
On This Page:
Configuring the LDAP Security Manager
There are two configuration scenarios when integrating frevvo with LDAP. Each one uses a different Security Manager
The first option is
frevvo integrates with an external LDAP/AD system and is in full control of user authentications. Use the LDAP Security Manager in this situation.
Refer to Configuring the LDAP Security Manager for In-house if your frevvo and LDAP server are both located behind your firewall. (on-premise)
Refer to Configuring LDAP(s) for Cloud tenants if you want to connect your frevvo cloud tenant to your on-premise LDAP server.
frevvo only supports/certifies the LDAP Security Manager when frevvo is running in the tomcat container. Refer to our Supported Platforms for the list of Application Servers supported/certified by frevvo.
- The second option is to use frevvo deployed to an existing servlet container that is already handling user authentications through LDAP. Authentication, in this case, is the responsibility of the container. However, frevvo is responsible for runtime authorization and design time querying of user metadata. Use the LDAP Container Security Manager in this situation. This security manager relies on the container for user authentications and also connects to the LDAP server design time and runtime information for users, roles and user metadata.
frevvo only supports/certifies the LDAP Container Security Manager when frevvo is running in the tomcat container. Refer to our Supported Platforms for the list of Application Servers supported/certified by frevvo.
Retrieving Custom Attributes from the LDAP Server
When a user is successfully authenticated by the LDAP security manager, frevvo retrieves the following basic user information from the LDAP server:
Using a business rule, you can populate controls in your form with this information.
There are many attributes available in Active Directory. View this website for a partial list. Single and multi-value attributes are supported. Active Directory custom attributes can be retrieved for users in a frevvo tenant using the LDAP Security Manager or the LDAP Container Security Manager.
Additional custom attributes can be retrieved from the LDAP server by typing the attribute names in the Custom field on the LDAP Configuration screen and writing a business rule to pull that information into your form.
Configure Retrievable Attributes
If you want to pull additional information from Active Directory into your form, enter a comma separated list of custom attribute names to be retrieved in the Custom field on the LDAP Configuration screen. Let's use the employee's Middle Initial and Home Phone as an example. The attributes for Middle Initial and Telephone Number are initials and telephoneNumber respectively.
Follow these steps to modify the configuration:
- Login to frevvo as the tenantadmin.
- Click the Edit Tenant link.
- Type the custom attribute names (telephoneNumber and initials) in the Custom field on the LDAP Configuration screen separated by a comma. Make sure there are no spaces between the attributes.
- Click submit to save the changes.
Write a rule to populate controls in your form with the firstname, lastname, email address plus the additional attributes specified in the configuration parameter. Notice the initials and the telephone number controls in the image are filled with the user information from the LDAP server.
The manager attribute maps to the frevvo built-in data - subject.reports. to. This means you can retrieve this value in a rule or use subject.reports.to to specify flow navigation if you configure the manager attribute in your LDAP tenant.
Attributes with more than one value are also supported. For example, The carLicense attribute can return multiple licenses. You can write a rule to populate dropdown options with the specified car license values. Make sure the carLicense attribute is configured in the Custom field of the LDAP Configuration screen and of course, there are multiple carLicense attributes, each one containing a different value for the dropdown options, set up for appropriate users on the LDAP server.
A JSON array string listing multiple car licenses is returned and it can be used in a frevvo rule to populate the options of a dropdown control named carLicense.