56
Using the LDAP Security Model
89
LDAP.SEARCH.LEVEL
(Optional) An integer value that indicates the search level. You can choose
from:
• 1 - User type objects
• 2 - Group type objects
• 3 - Any objects
The default is one (1), user type objects.
LDAP.DN.IDENTIFIER
(Optional) The value for this option is used these ways:
• Where LDAP.SEARCH.LEVEL is equal to 1 (USER) and there is no
LDAP.OBJECTS.SEARCH.STRING value specified, the system
generates a default search filter of the format identifier=UserID, where
identifier is the value of this option and UserID is the user ID passed in
to this function.
• Where LDAP.SEARCH.LEVEL is equal to 2 (GROUPS) and there is no
LDAP.OBJECTS.SEARCH.STRING value specified, the system
generates a default search filter from LDAP.OBJECTS and
LDAP.OBJECT.ATTRIBUTES, where each attribute value in the search
filter is an asterisk (*), which tells the system to match any value for the
attributes specified. If the LDAP.RDNDS option is also provided, the
asterisk (*) is replaced with identifer=UserID, followed by a comma and
the LDAP.RDNS value to fine tune the search, where identifier is the
value for this option and UserID is the user ID passed in to this function.
Here is an example of a default search filter:
(&((objectClass=groupOfNames)(member=*)))
If a value of
CN=Users,DC=PDDC,DC=DOCUCORP,DC=COM
is specified for LDAP.RDNS and this option contains a value of cn, the
search filter generated would look like this:
(&((objectClass=groupOfNames)(member=CN=Admi
nistrator,
CN=Users,DC=PDDC,DC=DOCUCORP,DC=COM))).
The default is cn.
LDAP.RDNS
(Optional) This option is only used when LDAP.SEARCH.LEVEL is equal
to 2 (GROUPS) and when LDAP.OBJECTS.SEARCH.STRING is not
specified. In this situation, the system builds a default search filter from
LDAP.OBJECTS and LDAP.OBJECT.ATTRIBUTES.
Attribute values specified in the default search filter contain an asterisk (*),
which tells the system to match any value for the attributes specified.
When you specify this option, the system uses the value along with the
value for LDAP.DN.IDENTIFIER to replace the asterisk and fine tune the
search, thereby speeding the process. Here is an example of a default
search filter:
(&((objectClass=groupOfNames)(member=*)))
In a case were a value of
CN=Users,DC=PDDC,DC=DOCUCORP,DC=COM
is specified for this option and LDAP.DN.IDENTIFIER contains a value of
CN, the search filter generated would look like this:
(&((objectClass=groupOfNames)(member=CN=Admi
nistrator,
CN=Users,DC=PDDC,DC=DOCUCORP,DC=COM)))
Option
Description
VB.NET PDF: Basic SDK Concept of XDoc.PDF features can be integrated into your VB.NET project, such as annotation creating, deleting, modifying This class describes bookmarks in a PDF document.
export pdf bookmarks to text file; how to bookmark a pdf document
53
Chapter 2 – Working with Settings, Users, and Security
90
You can specify the LDAP options in a properties file named openldap.msg or in the
LDAP control group in the INI file for the configuration being used. If you have
defined these options in both, the options defined in the LDAP control group
override the ones defined in the properties file.
Here is an example of a properties file:
ldap.host=10.1.10.101
ldap.port=389
ldap.timeout=10000
ldap.uid=jroberts
ldap.pwd=ElCamino
ldap.authentication.mode=simple
ldap.domain=PDDC.pd.com
ldap.objects.search.string=cn=?
ldap.object.attributes=memberOf
ldap.match.attributes=cn*
ldap.debug=yes
ldap.dn.identifier=cn
In this example, the ldap.objects.search.string is used to query an object in Active
directory that corresponds to the user ID supplied by Documaker Studio. The
question mark (?) is replaced at run time by the user ID supplied. Once the object is
found, all values for the memberOf attribute are retrieved and returned as a list of the
groups to which the user belongs.
Keep in mind:
• The ldap.uid or ldap.user and ldap.pwd options should correspond to an account
that has permission to connect to the Active Directory and to query the objects
in the Active Directory Tree. This account could be the same as that of the user
ID that will be queried for group membership. If this is the case, that account
must have access rights to the Active Directory and permission to query its own
object.
• If the same Studio workstation is used by more than one person, the ldap.uid or
ldap.user account should be one that has permission to query all objects
corresponding to all users who will use Studio on that workstation. This is also
true for other LDAP servers besides Active Directory, which do not support the
memberOf attribute. In this situation, use the ldap.user option instead of ldap.uid
and the account used must have permission to query all the objects that define
group information (see the OpenLDAP example).
When using LDAP, Studio does not keep records of individual users in the user
database. Instead, you must store specific group identities in the user database.
Studio queries LDAP for a list of groups the user belongs too. It then looks up each
group name in the user database.
LDAP.USE.SSL
(Optional) Enter Yes to enable encrypted communication through an SSL
channel.
For SSL connections to work, the LDAP server must be configured for SSL
with a certificate from a trusted certification authority.
This configuration is vendor specific — please consult your vendor
documentation.
LDAP.DEBUG
(Optional) Enter Yes to log debugging information to a trace file.
Option
Description
How to C#: Basic SDK Concept of XDoc.PDF for .NET annotation features can be integrated into your C# project, such as annotation creating, deleting, modifying This class describes bookmarks in a PDF document
creating bookmarks in a pdf document; add bookmark to pdf reader How to C#: Basic SDK Concept of XDoc.Word Conversely, conversion from PDF to Word (.docx) is C# project, such as annotation creating, deleting, modifying This class describes bookmarks in a Word document
copy pdf bookmarks to another pdf; create bookmarks pdf files
61
Using the LDAP Security Model
91
If the group name returned does not exist in the database, Studio does nothing for the
user. If the group name does exist in the database, then the security rights from that
group (user) are merged into the current user. If a user belongs to multiple groups
defined in the database, the user ends up with combined security options.
On the other hand, if the user does not have any groups in common with the user
database, the user is not allowed to log onto the system.
Unlike the normal (non-LDAP) user situation, Studio does not support a guest or
default log on when LDAP is enabled.
Here is an example of how to search a user object in an Active Directory server
schema that supports the memberOf attribute:
Here is the Distinguished Name of the user Administrator in an Active Directory
Schema:
CN=Administrator,CN=Users,DC=PDDC,DC=pd,DC=com
Here are the INI options:
< LDAP >
ldap.host
= localhost
ldap.port
= 389
ldap.timeout
= 10000
ldap.uid
= userID@PDDC.pd.com
ldap.pwd
= 123456xxx
ldap.objects.search.string = cn=?
ldap.authentication.mode
= simple
ldap.domain
= PDDC.pd.com
ldap.dn.identifier
= cn
ldap.debug
= Yes
In this example a search is conducted for a user named Administrator and all the
memberOf attribute values are retrieved for it, composing a list of the groups
Administrator belongs to.
Here is an example of how to search group objects in an OpenLDAP server schema
that does not support the memberOf attribute:
Here is the schema for the OpenLDAP server:
dn: dc=mycompany,dc=com
objectClass: top
objectClass: dcObject
objectClass: domain
dc: mycompany
dn: ou=roles,dc=mycompany,dc=com
objectClass: top
objectClass: organizationalUnit
ou: roles
dn: ou=people,dc=mycompany,dc=com
objectClass: top
objectClass: organizationalUnit
ou: people
dn: cn=Test Users,ou=roles,dc=mycompany,dc=com
objectClass: groupOfUniqueNames
cn: Test Users
uniqueMember: uid=sspecial,ou=people,dc=mycompany,dc=com
uniqueMember: uid=jbloggs,ou=people,dc=mycompany,dc=com
dn: cn=Special Users,ou=roles,dc=mycompany,dc=com
How to C#: Basic SDK Concept of XDoc.PowerPoint Conversely, conversion from PDF to PowerPoint (.PPTX C# project, such as annotation creating, deleting, modifying This class describes bookmarks in a PowerPoint
split pdf by bookmark; adding bookmarks to a pdf PDF Image Viewer| What is PDF such as text extraction, hyperlinks, bookmarks and metadata as to develop specifications for creating, viewing, and convert word document without need for PDF.
create bookmarks pdf; create bookmarks in pdf from excel
71
Chapter 2 – Working with Settings, Users, and Security
92
objectClass: groupOfUniqueNames
cn: Special Users
uniqueMember: uid=sspecial,ou=people,dc=mycompany,dc=com
dn: cn=Admin Users,ou=roles,dc=mycompany,dc=com
objectClass: groupOfUniqueNames
cn: Admin Users
uniqueMember: uid=admin,ou=people,dc=mycompany,dc=com
dn: uid=admin,ou=people,dc=mycompany,dc=com
objectClass: person
objectClass: inetOrgPerson
cn: State App
displayName: App Admin
givenName: App
mail: admin@fake.org
sn: Admin
uid: admin
userPassword: adminpassword
dn: uid=jbloggs,ou=people,dc=mycompany,dc=com
objectClass: person
objectClass: inetOrgPerson
cn: Joe Bloggs
displayName: Joe Bloggs
givenName: Joe
mail: jbloggs@fake.org
sn: Bloggs
uid: jbloggs
userPassword: password
dn: uid=sspecial,ou=people,dc=mycompany,dc=com
objectClass: person
objectClass: inetOrgPerson
cn: Super Special
displayName: Super Special
givenName: Super
mail: sspecial@fake.org
sn: Special
uid: sspecial
userPassword: password
Here are the INI options:
< LDAP >
ldap.host
= localhost
ldap.port
= 389
ldap.timeout
= 5000
ldap.user
= uid=admin,ou=people,dc=mycompany,dc=com
ldap.pwd
= adminpassword
ldap.authentication.mode = simple
ldap.objects
= groupOfUniqueNames
ldap.search.base
= ou=roles,dc=mycompany,dc=com
ldap.object.attributes = uniqueMember
ldap.match.attributes
= uid
ldap.search.scope
= sub
ldap.search.level
= 2
ldap.dereference.link
= Yes
ldap.version
= 3
ldap.debug
= Yes
UserID
= admin
How to C#: Basic SDK Concept of XDoc.Excel Conversely, conversion from PDF to Excel (.XLSX) is also C# project, such as annotation creating, deleting, modifying This class describes bookmarks in a Excel
convert word to pdf with bookmarks; bookmarks in pdf reader
54
Using the LDAP Security Model
93
In this example a search is conducted for all objects of type groupOfUniqueNames
which contain attributes of name uniqueMember. All attribute values returned are
then filtered matching the uid Distinguished Name part to the user ID supplied in the
search. For example if the user ID searched was admin, then the list of groups
returned would be Admin Users.
Using Documanage
If you are using DMILIB and Documanage, you must set up these INI options in the
DMILIB:LDAP control group. Also make sure Documanage is set up to support
LDAP authentication.
< DMILIB:LDAP >
Server
= 10.1.10.102
Domain
= bulldog1jr
Protocol
= ncacn_ip_tcp
Endpoint
= 4000
UserID
= demo
Password
= demo
Debug
= Yes
Here are descriptions of these options:
If you set the following option to Yes, Studio tries to retrieve group information from
Documanage. If Studio cannot retrieve this information from Documanage, it tries
to retrieve the group information directly from LDAP.
< Environment >
LDAP_Enabled =
Option
Description
Server
The IP address or the DNS name of the Documanage server.
Domain
The domain of the Documanage server.
Protocol
The RPC protocol. The default is ncacn_ip_tcp.
Endpoint
The RPC end point. The default is 4000.
UserID
The user ID needed to create a profile and session in Documanage.
Password
The password needed to create a profile and session in Documanage.
Debug
Enter Yes to enable placing debug information into the trace log in the current working
directory. The default is No.
Note
Use the LDAP.HOST and either the LDAP.UID or LDAP.USER options in the LDAP
control group as the default fall back connection information if DMILIB is not present.
The LDAP.UID option is normally used with LDAP.DOMAIN to talk to the active
directory. The LDAP.USER option is normally used to talk to other LDAP servers
2
Chapter 2 – Working with Settings, Users, and Security
94
17
95
Chapter 3
Working with Application Definition Files
Choose Manage, Application, Definition to maintain your lines of business. For
example, suppose you are creating forms for an insurance company which
underwrites automobile and homeowner's insurance. Each different type of
insurance could be considered a separate line of business.
This chapter discusses the following topics:
• Overview on page 96
• Defining an Application Definition on page 97
• Defining Form Lists on page 99
• Defining Recipients on page 102
• Defining Categories on page 104
• Defining Transaction Types on page 106
• Using Regional Date Processing on page 108
• Generating an Application Definition Report on page 117
• Example: Add the BDF information for the Medical History form on page 120
19
Chapter 3 – Working with Application Definition Files
96
O
VERVIEW
The application definition (BDF) file defines the key combinations used to locate a
specific form set. These key combinations are comprised of a Key1 and Key2
(sometimes referred to as Unit1 and Unit2; or Group1 and Group2). In the insurance
world, these keys are typically called: company and line of business (LOB).
Other information stored in the BDF file includes the following:
• List of recipients
• Form List Options
• Form categories (if used)
• Transaction codes (if used)
• Primary extract dictionary (XDD) file (if used)
• Default font cross-reference (FXR) file
• Default style (STY) file
Note
You should always let Studio create and maintain BDF files. Do not manually edit this
file.
Documents you may be interested
Documents you may be interested
