Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
font-weight:bold
in-house only and not offered as part of our SaaS packages.

Section
is responsible for runtime authorization and design time querying of user metadata. Use the LDAP Container Security Manager in this situation as that reuses the existing LDAP connector but relies on the container for user authentications.


Image Modified


This section explains how to integrate

Column
width0px

It is possible to create user and groups in

Frevvoproduct
and use them to control access to the system as well as create workflows. It is also common that the list of users and groups is maintained externally in systems such as Active Directory or Open LDAP.
Frevvoproduct
 can leverage your existing users repository.

 There are two configuration scenarios when integrating

Frevvoproduct
with LDAP
Frevvoproduct
can be configured to integrate with your existing LDAP Active Directory server to authenticate users. There are two configuration options. Each one uses a different Security Manager.

The first option is to use the 

Frevvoproduct

integrates with

LDAP Security Manager. Here the authentication is handed off to an external LDAP/AD system

and is in full control of user authentications. Use the LDAP Security Manager in this situation.
Image Removed
 
Frevvoproduct

.

 Image Added
 

The second option is to use the

Frevvoproduct
 LDAP Container Security Manager. Here the 
Frevvoproduct
server
is deployed to an existing servlet container that is already handling user authentications through LDAP. Authentication, in this case, is the responsibility of the container.

However,


Frevvoproduct
Frevvoproduct
with LDAP systems using the LDAP Security Manager. Configuration information for the LDAP Container Security Manager can be found here.

It is assumed that you already went through Live Form's installation instructions and have Live Forms running. LDAP Connectivity is available in the

Frevvoproduct
style
Info

Safari browsers later than v5.1.7 running on Windows is no longer supported. Issues were found when using Safari with LDAP - SSO.


Column
width240px300px

On This Page:

Table of Contents
maxLevel1

...

Retrieving Custom Attributes from the LDAP

...

Frevvoproduct

...

Server

When a user is successfully authenticated by the LDAP security manager,

Frevvoproduct
 retrieves the following basic user information from the LDAP server: 

Last Name
First Name
Email address 

Using a business rule, you can populate controls in your form with this information. 

 Image Added

There are many attributes available in Active Directory. View  this website for  for a partial list.  Multi Single and multi-value attributes are also supported. This feature works if you are using an LDAP or supported. Active Directory custom attributes can be retrieved for users in a 

Frevvoproduct
 tenant using the LDAP Security Manager or the LDAP Container Security Manager configuration.  

...

width50%

...

Configure Retrievable Attributes 

Single-value Attributes

Frevvoproduct
will automatically pull the logged in user's First Name, Last Name, Email from Active Directory. The designer can use built-in methods in a rule to populate controls on a form. For example, the business rule shown fills the respective form fields with the First/Last Names and Email Address of the logged in user.

...

Column
width50%
Code Block
if(form.load)
{
EmployeeEmail.value=_data.getParameter('subject.email');
FirstName.value=_data.getParameter('subject.first.name');
LastName.value=_data.getParameter('subject.last.name');
}

 

You can retrieve additional custom attribute information from the LDAP server using the configuration parameter "com.frevvo.security.ldap.customAttributes" and business rules.   

Configure Retrievable Attributes

Single-value Attributes

If you want to pull additional information from Active Directory into your form, you must add a context parameter to the <frevvo-home>\tomcat\conf\catalina\localhost\frevvo.xml file. The configuration parameter is "com.frevvo.security.Idapldap.customAttributes" and the value is a comma separated list of custom attribute names to be retrieved. Let's use the employee's Middle Initials Initial and Home Phone as an example. The attributes for Middle Initials Initial and Telephone Number are initials and telephoneNumber respectively. 

...

     5. Save the file after all your changes are made. Restart 

Frevvoproduct
 

Add the additional lines to the business Write a rule to populate the Middle Initials and Home Phone fields. 

Code Block
if(form.load)
{
FirstName.value=_data.getParameter('subject.givenName');
MiddleInitials.value=_data.getParameter('subject.initials');
LastName.value=_data.getParameter('subject.sn');
HomePhone.value=_data.getParameter('subject.telephoneNumber');
EmployeeEmail.value=_data.getParameter('subject.mail');
}

The image shows a simple form using the rule above to pull the Employee's First Name, Middle Initial, Last Name, Home Phone and Email Address from Active Directory on controls in your form with the firstname, lastname, email address plus the additional attributes specified in the configuration parameter. Notice the initials and the telephone number controls in the image are filled with the user information from the LDAP server.

Multi-

...

value Attributes

Attributes with more than one value are also supported. For example, The carLicense attribute can return multiple licenses. You can write a rule to populate dropdown options with those options. First of all, make the specified car license values. Make sure the carLicense attribute is configured in the frevvo.xml file and of course, there are multiple values carLicense attributes, each one containing a different value for the carLicense attribute dropdown options, set up for appropriate users on the LDAP server.  

Code Block
 <Parameter name="com.frevvo.security.ldap.customAttributes" value="initials,telephoneNumber,carLicense" override="false"/> 

A JSON array string listing multiple car licenses is returned and this rule will populate the options of a dropdown control named carLicense.

Code Block
carLicense.options=JSON.parse(_data.getParameter('subject.carLicense'));

...

Frevvoproduct

...

it

...

Frevvoproduct

...

can

...

Frevvoproduct

...

Code Block
languagejavascript
<context-param>     
    <param-name>frevvo.login.userid.case</param-name>     
    <param-value>lower</param-value>     
    <description>Force all login user ids to upper or lower case</description> 
</context-param>

The second problem is in directing tasks to frevvo users if your LDAP user names are mixed case. One solution is to use hidden controls on your forms with rules to convert the case of user names to lower case. The example below shows two text controls on a form, one visible, EmployeeMixedCase, and the other hidden, Employee.

Image Removed

A user types a name (regardless of case) into the EmployeeMixedCase control. The hidden Employee control has a business rule that takes the value of the visible control and converts it to lowercase.

Code Block
Employee.value = EmployeeMixedCase.value.toLowerCase(); 

The form or workflow routing can then use {Employee} rather than the control that may be mixed case. 

Warning

 Changing the case of LDAP userids in Active Directory can cause undesired results. Use caution.

 

Configure frevvo.internal.baseurl in frevvo.xml for LDAP SSO

This parameter is needed in frevvo.xml for various activities like accessing ACL page , publishing templates , resetting tasks etc. Let's say you have a browser signed in via SSO to machine m1 (port 80).  IIS is running on m1 (port 80) redirecting /frevvo/web to frevvo running on m2:8082.   Browser submits form to m1, IIS redirects to m2:8082.  The doc action is a frevvo:// URI which gets resolved to http://m1/frevvo/... 

Frevvoproduct
POSTs to this URI  but m1 rejects the POST since it is not authenticated.

To avoid situations such as these,  set frevvo.internal.baseurl to the actual host:port of the 

Frevvoproduct
server. Follow these steps:

  1. edit <frevvo-home>/tomcat/conf/cstalina/localhost/frevvo.xml
  2. Add the parameter shown below with your information: Save the changes to the file.
Code Block
Parameter name="frevvo.internal.baseurl" value="http://<ip of the m/c where frevvo server is hosted>:<port>" override="false"/>
Warning

If your system is configured for LDAP SSO and the upload and video controls may exhibit the following behaviors:

  1. Uploading an image to an upload control in a form that is accessed via a Space on an iPad will not work. The "uploading...." snake image is seen continuously. This issue will be addressed in a future version of
    Frevvoproduct
    .
  2. The video control will ask for credentials again when the form is loaded, if you are using the FireFox browser. In IE9, you will see the message "This web-page wants to run the following add-on: 'Windows Media Player' from 'Microsoft Corporation'. What's the risk?" Enter your credentials or run the add-on to proceed. A potential solution is to setup IIS so that it does not require re-authentication for every single request.

 

Active Directory Sample Configuration

 

Code Block
languagejavascript
<Parameter name="com.frevvo.security.ldap.connection.url" value="ldap://[your server]:[port, typically the default is 389 ]" override="false"/>   
<Parameter name="com.frevvo.security.ldap.connection.name" value="[user name]" override="false"/>  
<Parameter name="com.frevvo.security.ldap.connection.password" value="[user password]" override="false"/>  
<Parameter name="com.frevvo.security.ldap.usersBase" value="CN=Users,DC=test,DC=windows,DC=frevvo,DC=com" override="false"/>   
<Parameter name="com.frevvo.security.ldap.groupsBase" value="CN=Users,DC=test,DC=windows,DC=frevvo,DC=com" override="false"/>  
<Parameter name="com.frevvo.security.ldap.userIdDisplayAttribute" value="sAMAccountName" override="false"/>  
<Parameter name="com.frevvo.security.ldap.groupIdDisplayAttribute" value="sAMAccountName" override="false"/>   
<Parameter name="com.frevvo.security.ldap.notifications" value="true" override="false"/>     
<Parameter name="com.frevvo.security.ldap.allGroupsFilter" value="(objectClass=group)" override="false"/>  
<Parameter name="com.frevvo.security.ldap.allUsersFilter" value="(objectClass=user)" override="false"/>         
<Parameter name="com.frevvo.security.ldap.distinguishedNameAttribute" value="distinguishedName" override="false"/>  
<Parameter name="com.frevvo.security.ldap.userMemberOfAttribute" value="memberOf" override="false"/>    
<Parameter name="com.frevvo.security.ldap.groupMemberAttribute" value="member" override="false"/>   
<Parameter name="com.frevvo.security.ldap.firstNameAttribute" value="givenName" override="false"/>  
<Parameter name="com.frevvo.security.ldap.lastNameAttribute" value="sn" override="false"/>  
<Parameter name="com.frevvo.security.ldap.emailAttribute" value="mail" override="false"/>   

OpenLDAP Sample Configuration

Code Block
languagejavascript
<Parameter name="com.frevvo.security.ldap.connection.url" value="ldap://[your server]:[port, typically the default is 389 ]" override="false"/>  
<Parameter name="com.frevvo.security.ldap.connection.name" value="cn=admin,dc=test,dc=frevvo,dc=com" override="false"/> 
<Parameter name="com.frevvo.security.ldap.connection.password" value="[user password]" override="false"/> 
<Parameter name="com.frevvo.security.ldap.usersBase" value="DC=test,DC=frevvo,DC=com" override="false"/>  
<Parameter name="com.frevvo.security.ldap.groupsBase" value="DC=test,DC=frevvo,DC=com" override="false"/> 
<Parameter name="com.frevvo.security.ldap.userIdDisplayAttribute" value="uid" override="false"/> 
<Parameter name="com.frevvo.security.ldap.groupIdDislayAttribute" value="entryDN" override="false"/> 
<Parameter name="com.frevvo.security.ldap.notifications" value="true" override="false"/>  
<Parameter name="com.frevvo.security.ldap.allGroupsFilter" value="(|(objectClass=groupOfUniqueNames)(objectClass=organizationalRole))" override="false"/> 
<Parameter name="com.frevvo.security.ldap.allUsersFilter" value="(objectClass=person)" override="false"/>        
<Parameter name="com.frevvo.security.ldap.distinguishedNameAttribute" value="entryDN" override="false"/>    
<Parameter name="com.frevvo.security.ldap.groupMemberAttribute" value="uniqueMember" override="false"/> 
<Parameter name="com.frevvo.security.ldap.userMemberOfAttribute" value="" override="false"/>    
<Parameter name="com.frevvo.security.ldap.firstNameAttribute" value="cn" override="false"/> 
<Parameter name="com.frevvo.security.ldap.lastNameAttribute" value="sn" override="false"/> 
<Parameter name="com.frevvo.security.ldap.emailAttribute" value="mail" override="false"/>  

LDAP Configuration Properties

These are the properties used to configure the LDAP connector. The properties in bold are required.

Property Description
com.frevvo.security.ldap.connection.urlldap server url
com.frevvo.security.ldap.connection.nameUser to connect to LDAP. This user must have the proper permissions to read and run queries in the ldap server. If using Active Directory, it is common to specify the domain. For instance, TEST\Administrator refers to the user Administrator in the TEST domain.
com.frevvo.security.ldap.connection.passwordPassword for the user defined in com.frevvo.security.ldap.connection.name.
com.frevvo.security.ldap.usersBaseSearches for users will start from the ldap node specified by this property.If the value is empty the searches will start from the root domain.
com.frevvo.security.ldap.groupsBaseSearches for the groups will start from the ldap node specified by this property. If the value is empty, searches will start from the root domain
com.frevvo.security.ldap.userIdDisplayAttributeUser attribute that will be visible in frevvo. This is what will be displayed in the list of users a tenant admin sees and has to be unique in the server. Another restriction is that the values for the attribute configured here cannot have spaces. For instance, don't configure CN as the value since it can contain spaces in most systems.
 com.frevvo.security.ldap.groupIdDisplayAttributeGroup attribute that will be visible in frevvo. This is, for instance, what will be displayed in the list of groups a tenant admin sees or the groups used in workflows. This attribute has to be unique in the server.
com.frevvo.security.ldap.notificationsNotifications are emails sent by frevvo to workflows participants. If ''true'', notifications will be sent. (default=true)
com.frevvo.security.ldap.allGroupsFilterThe expected value is an LDAP filter expression. The expression should return the groups that will be available to be used in frevvo workflows. com.frevvo.security.ldap.groupIdDisplayAttribute
com.frevvo.security.ldap.allUsersFilterThe expected value is an LDAP filter expression. The expression should return the users that will be available to be used in frevvo work flows and authentication. com.frevvo.security.ldap.groupIdDisplayAttribute

com.frevvo.security.ldap.frevvoDesignersFilter Deprecated in 4.5

The expected value is an LDAP filter expression. This expression needs to return a list of users (not groups) that will be considered frevvo designers. Microsoft Active directory Default groups (Domain Users etc.) are not supported.

com.frevvo.security.ldap.frevvoTenantAdminFilter Deprecated in 4.5The expected value is an LDAP filter expression. This expression needs to return a list of users (not groups) that will be considered frevvo tenant admins. Microsoft Active directory Default groups (Domain Users etc.) are not supported.

com.frevvo.security.ldap.distinguishedNameAttribute Deprecated in 4.1.3

Deprecated in 4.1.3. Name of the ''distinguished name'' attribute.
 com.frevvo.security.ldap.userMemberOfAttribute 
 com.frevvo.security.ldap.groupMemberAttribute 
 com.frevvo.security.ldap.firstNameAttribute

Name of the user ''first name'' attribute

 com.frevvo.security.ldap.lastNameAttributeName of the user ''last name'' attribute.
 com.frevvo.security.ldap.emailAttributeName of the user ''email'' attribute in the LDAP server. This is used in email notifications
 com.frevvo.security.ldap.managerAttribute 
 com.frevvo.security.ldap.cacheEnable or disable the caching of users and groups. The default value is 'true'. This property is no longer needed and can be removed. It has been deprecated.
 com.frevvo.security.ldap.ignoreCaseThis makes frevvo ignore the case stored in LDAP systems, primarily for the purpose of determining roles.
com.frevvo.security.ldap.customAttributesThis is a a comma separated list of attribute names to be retrieved from the LDAP Server.
  

 

 

 

 be used in a 

Frevvoproduct
 rule to populate the options of a dropdown control named carLicense.

Image Added