\nThe LDAPDirectoryFactory component provides implementation of the\nDirectory API using an external LDAP server as storage backend,\ntypically to fetch users and groups data check password based\nauthentication.\n
", "extensionPoints": [ { "@type": "NXExtensionPoint", "componentId": "org.nuxeo.ecm.directory.ldap.LDAPDirectoryFactory", "descriptors": [ "org.nuxeo.ecm.directory.ldap.LDAPServerDescriptor" ], "documentation": "\n The servers extension point is used to register network connection\n parameters to a pool of LDAP servers.\n\n Examples:\n\n\n \n ldap://localhost:389 \n ldap://server2:389 \n ldaps://server3:389 \n \n ldap:///dc=example,dc=com \n \n ldap:///dc=example,dc=com \n 10000 \n 5 \n true \n 60000 \n true \n cn=nuxeo5,ou=applications,dc=example,dc=com \n changeme \n \n\n\n\n The ldapUrl tags point to server (IP address or DNS name) and\n ports. If more than one is provided, the Nuxeo EP will use a pool\n of load balanced connections to each server. They are assumed to\n be replicated versions of a master server that should belong to\n the list.\n\n The connectionTimeout element specifies a connection timeout in milliseconds.\n The default is 10000.\n\n The retries element indicates how many times the request will be retried\n if LDAP server returns a ServiceUnavailableException. The default is 5.\n\n The poolingEnabled element specifies whether to use LDAP connection pooling.\n The default is true.\n\n The poolingTimeout element specifies, in milliseconds, how long a connection\n may remain in the pool when LDAP connection pooling is enabled.\n The default is 60000.\n\n The verifyServerCert element specifies whether, in SSL mode, all certificates\n should be checked. This should only be disabled when testing with test server\n having self-signed certificates. The default is true.\n\n The bindDn and bindPassword credentials are used by Nuxeo EP to\n access the content of the LDAP servers. It should have the read\n permission to any entry that is to be used by Nuxeo EP and write\n right to branches were Nuxeo EP is supposed to create or edit\n entries.\n\n For instance, in OpenLDAP you should have ACLs such as:\n\n \n access to attrs=\"userPassword\"\n by dn=\"cn=ldapadmin,dc=example,dc=com\" write\n by dn=\"cn=nuxeo5,ou=applications,dc=example,dc=com\" write\n by anonymous auth\n by self write\n by * none\n\n access to dn.base=\"\" by * read\n\n # nuxeo5 can manage the ou=people branch\n access to dn.subtree=\"ou=people,dc=example,dc=com\"\n by dn=\"cn=nuxeo5,ou=applications,dc=example,dc=com\" write\n by users read\n by self write\n by * none\n\n access to dn.subtree=\"ou=groups,dc=example,dc=com\"\n by dn=\"cn=nuxeo5,ou=applications,dc=example,dc=com\" write\n by users read\n by self write\n by * none\n\n # The admin dn has full write access\n # other\n access to *\n by dn=\"cn=ldapadmin,dc=example,dc=com\" write\n by users read\n by * none\n \n\n\n User authentication is done using a bind method against the user\n provided login and password from the login form and not the bindDn\n / bindPassword credentials.\n \n",
"documentationHtml": "\nThe servers extension point is used to register network connection\nparameters to a pool of LDAP servers.\n
\nExamples:\n
\n
<server name="default">\n <ldapUrl>ldap://localhost:389</ldapUrl>\n <ldapUrl>ldap://server2:389</ldapUrl>\n <ldapUrl>ldaps://server3:389</ldapUrl>\n <!-- LDAP SRV DNS resolution on _ldap._tcp.example.com -->\n <ldapUrl>ldap:///dc=example,dc=com</ldapUrl>\n <!-- LDAP SRV DNS resolution on _gc._tcp.example.com -->\n <ldapUrl srvPrefix="_gc._tcp">ldap:///dc=example,dc=com</ldapUrl>\n <connectionTimeout>10000</connectionTimeout>\n <retries>5</retries>\n <poolingEnabled>true</poolingEnabled>\n <poolingConnectionTimeout>60000</poolingConnectionTimeout>\n <verifyServerCert>true</verifyServerCert>\n <bindDn>cn=nuxeo5,ou=applications,dc=example,dc=com</bindDn>\n <bindPassword>changeme</bindPassword>\n </server>\n\nThe ldapUrl tags point to server (IP address or DNS name) and\nports. If more than one is provided, the Nuxeo EP will use a pool\nof load balanced connections to each server. They are assumed to\nbe replicated versions of a master server that should belong to\nthe list.\n
\nThe connectionTimeout element specifies a connection timeout in milliseconds.\nThe default is 10000.\n
\nThe retries element indicates how many times the request will be retried\nif LDAP server returns a ServiceUnavailableException. The default is 5.\n
\nThe poolingEnabled element specifies whether to use LDAP connection pooling.\nThe default is true.\n
\nThe poolingTimeout element specifies, in milliseconds, how long a connection\nmay remain in the pool when LDAP connection pooling is enabled.\nThe default is 60000.\n
\nThe verifyServerCert element specifies whether, in SSL mode, all certificates\nshould be checked. This should only be disabled when testing with test server\nhaving self-signed certificates. The default is true.\n
\nThe bindDn and bindPassword credentials are used by Nuxeo EP to\naccess the content of the LDAP servers. It should have the read\npermission to any entry that is to be used by Nuxeo EP and write\nright to branches were Nuxeo EP is supposed to create or edit\nentries.\n
\nFor instance, in OpenLDAP you should have ACLs such as:\n
\n
access to attrs="userPassword"\n by dn="cn=ldapadmin,dc=example,dc=com" write\n by dn="cn=nuxeo5,ou=applications,dc=example,dc=com" write\n by anonymous auth\n by self write\n by * none\n\n access to dn.base="" by * read\n\n # nuxeo5 can manage the ou=people branch\n access to dn.subtree="ou=people,dc=example,dc=com"\n by dn="cn=nuxeo5,ou=applications,dc=example,dc=com" write\n by users read\n by self write\n by * none\n\n access to dn.subtree="ou=groups,dc=example,dc=com"\n by dn="cn=nuxeo5,ou=applications,dc=example,dc=com" write\n by users read\n by self write\n by * none\n\n # The admin dn has full write access\n # other\n access to *\n by dn="cn=ldapadmin,dc=example,dc=com" write\n by users read\n by * none\n\nUser authentication is done using a bind method against the user\nprovided login and password from the login form and not the bindDn\n/ bindPassword credentials.\n
", "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.directory/org.nuxeo.ecm.directory.ldap/org.nuxeo.ecm.directory.ldap.LDAPDirectoryFactory/ExtensionPoints/org.nuxeo.ecm.directory.ldap.LDAPDirectoryFactory--servers", "id": "org.nuxeo.ecm.directory.ldap.LDAPDirectoryFactory--servers", "label": "servers (org.nuxeo.ecm.directory.ldap.LDAPDirectoryFactory)", "name": "servers", "version": "2025.27.34" }, { "@type": "NXExtensionPoint", "componentId": "org.nuxeo.ecm.directory.ldap.LDAPDirectoryFactory", "descriptors": [ "org.nuxeo.ecm.directory.ldap.LDAPDirectoryDescriptor" ], "documentation": "\n The directories extension point is used to register LDAP filtering\n parameters to identify which part of the LDAP branches are actually\n used by Nuxeo EP to fetch its entries.\n\n Examples:\n\n\n \n default \n user \n \n system \n \n username \n unchanged \n password \n SSHA \n ou=people,dc=example,dc=com \n person \n (&(sn=toto*)(myCustomAttribute=somevalue)) \n onelevel \n false \n 3600 \n 1000 \n ou=people,dc=example,dc=com \n top \n person \n organizationalPerson \n inetOrgPerson \n uid \n 200 \n 0 \n uid \n userPassword \n givenName \n sn \n o \n mail \n \n \n \n \n \n default \n group \n groupname \n ou=groups,dc=example,dc=com \n (|(objectClass=groupOfUniqueNames)(objectClass=groupOfURLs)) \n subtree \n \n \n dn \n .*,ou=editable,ou=groups,dc=example,dc=com \n \n false \n 3600 \n 1000 \n ou=editable,ou=groups,dc=example,dc=com \n top \n groupOfUniqueNames \n cn \n 200 \n 0 \n cn \n \n \n \n \n \n \n \n \n \n\n\n\n In the previous examples we configured two directories one for the\n users and one for the groups of users. Each directory uses a\n single schema which is to be registered as any core document\n schema and that will be used to build a DocumentModel for each\n matching entry of the directory.\n\n\n Nuxeo EP provides group resolution for statically dn-referenced\n entries (in read and write mode) and for dynamically ldapUrl\n matched entries (readonly). You may also need to statically\n reference entries without a dn using the 'staticAttributeIdIsDn'\n attribute.\n\n The references tags are used to dynamically build nxs:stringList\n fields of that schema that are to compute membership relationships\n between users and groups or between parent groups and sub groups.\n It can also resole children and parents following the ldap tree\n structure.\n\n You have two ways for declaring a dynamic reference in a 'references' tag.\n You can use 'dynamicAttributeId' to point to an ldap attribute that\n contains an ldap url.\n\n \n \n \n\n\n Or, you can use a subtag 'dynamicReference' to declare attributes that\n contain a DN, a filter and a type. This values will be used to selected\n the references.\n\n \n \n \n \n\n\n When using dynamic references, caching is advised since dynamic group\n resolution can be expensive.\n\n The element \"idCase\" makes it possible to control the case of the\n identifier on Nuxeo side. It accepts values \"upper\", \"lower\" or\n \"unchanged\". It is useful when changing case on the LDAP without affecting\n Nuxeo (for rights management for instance which is case sensitive for\n instance).\n\n\n Dependening on your LDAP Backend implementation, if you have some specific restriction\n (for example on password, or logins ...), you may want Nuxeo to handle the validation\n errors of your server on the Nuxeo side.\n\n Since there error code and message may vary depending on the LDAP server provider, you\n may need to provide a custom class that knows how to handle the Exceptions returned by it.\n\n For this you can specify a class that will be in charge of this task.\n \n org.nuxeo.ecm.directory.ldap.DefaultLdapExceptionProcessor \n\n\n This class should implement org.nuxeo.ecm.directory.ldap.LdapExceptionProcessor and return\n a RecoverableClientException for any exception that should be displayed to the user.\n\n\n By default, referrals will be automatically resolved, if you don't want that behavior (since 5.9.4) you can use the followReferrals tag\n\n \n \n ....\n false \n ...\n \n\n",
"documentationHtml": "\nThe directories extension point is used to register LDAP filtering\nparameters to identify which part of the LDAP branches are actually\nused by Nuxeo EP to fetch its entries.\n
\nExamples:\n
\n
<directory name="userDirectory">\n <server>default</server>\n <schema>user</schema>\n <types>\n <type>system</type>\n </types>\n <idField>username</idField>\n <idCase>unchanged</idCase>\n <passwordField>password</passwordField>\n <passwordHashAlgorithm>SSHA</passwordHashAlgorithm>\n <searchBaseDn>ou=people,dc=example,dc=com</searchBaseDn>\n <searchClass>person</searchClass>\n <searchFilter>(&(sn=toto*)(myCustomAttribute=somevalue))</searchFilter>\n <searchScope>onelevel</searchScope>\n <readOnly>false</readOnly>\n <cacheTimeout>3600</cacheTimeout>\n <cacheMaxSize>1000</cacheMaxSize>\n <creationBaseDn>ou=people,dc=example,dc=com</creationBaseDn>\n <creationClass>top</creationClass>\n <creationClass>person</creationClass>\n <creationClass>organizationalPerson</creationClass>\n <creationClass>inetOrgPerson</creationClass>\n <rdnAttribute>uid</rdnAttribute>\n <querySizeLimit>200</querySizeLimit>\n <queryTimeLimit>0</queryTimeLimit>\n <fieldMapping name="username">uid</fieldMapping>\n <fieldMapping name="password">userPassword</fieldMapping>\n <fieldMapping name="firstName">givenName</fieldMapping>\n <fieldMapping name="lastName">sn</fieldMapping>\n <fieldMapping name="company">o</fieldMapping>\n <fieldMapping name="email">mail</fieldMapping>\n <references>\n <inverseReference directory="groupDirectory"\n dualReferenceField="members" field="groups"/>\n </references>\n </directory>\n <directory name="groupDirectory">\n <server>default</server>\n <schema>group</schema>\n <idField>groupname</idField>\n <searchBaseDn>ou=groups,dc=example,dc=com</searchBaseDn>\n <searchFilter>(|(objectClass=groupOfUniqueNames)(objectClass=groupOfURLs))</searchFilter>\n <searchScope>subtree</searchScope>\n <!-- Special entry adaptor that makes entries in the ou=editable branch editable\n other entries have the readonly flag. This require adding a "dn" xs:string field\n to the group schema.\n -->\n <entryAdaptor class="org.nuxeo.ecm.directory.impl.WritePolicyEntryAdaptor">\n <parameter name="fieldName">dn</parameter>\n <parameter name="regexp">.*,ou=editable,ou=groups,dc=example,dc=com</parameter>\n </entryAdaptor>\n <readOnly>false</readOnly>\n <cacheTimeout>3600</cacheTimeout>\n <cacheMaxSize>1000</cacheMaxSize>\n <creationBaseDn>ou=editable,ou=groups,dc=example,dc=com</creationBaseDn>\n <creationClass>top</creationClass>\n <creationClass>groupOfUniqueNames</creationClass>\n <rdnAttribute>cn</rdnAttribute>\n <querySizeLimit>200</querySizeLimit>\n <queryTimeLimit>0</queryTimeLimit>\n <fieldMapping name="groupname">cn</fieldMapping>\n <references>\n <!-- LDAP reference resolve DNs embedded in uniqueMember attributes\n\n If the target directory has no specific filtering policy, it is most\n of the time not necessary to enable the 'forceDnConsistencyCheck' policy.\n\n Enabling this option will fetch each reference entry to ensure its\n existence in the target directory.\n -->\n <ldapReference directory="userDirectory"\n dynamicAttributeId="memberURL" field="members"\n forceDnConsistencyCheck="false"\n staticAttributeId="uniqueMember" staticAttributeIdIsDn="true"/>\n <ldapReference directory="groupDirectory"\n dynamicAttributeId="memberURL" field="subGroups"\n forceDnConsistencyCheck="false" staticAttributeId="uniqueMember"/>\n <inverseReference directory="groupDirectory"\n dualReferenceField="subGroups" field="parentGroups"/>\n <ldapTreeReference directory="groupDirectory"\n field="children" scope="onelevel"/>\n <inverseReference directory="groupDirectory"\n dualReferenceField="children" field="parents"/>\n </references>\n </directory>\n\nIn the previous examples we configured two directories one for the\nusers and one for the groups of users. Each directory uses a\nsingle schema which is to be registered as any core document\nschema and that will be used to build a DocumentModel for each\nmatching entry of the directory.\n
\nNuxeo EP provides group resolution for statically dn-referenced\nentries (in read and write mode) and for dynamically ldapUrl\nmatched entries (readonly). You may also need to statically\nreference entries without a dn using the 'staticAttributeIdIsDn'\nattribute.\n
\nThe references tags are used to dynamically build nxs:stringList\nfields of that schema that are to compute membership relationships\nbetween users and groups or between parent groups and sub groups.\nIt can also resole children and parents following the ldap tree\nstructure.\n
\nYou have two ways for declaring a dynamic reference in a 'references' tag.\nYou can use 'dynamicAttributeId' to point to an ldap attribute that\ncontains an ldap url.\n
\n
<ldapReference directory="userDirectory"\n dynamicAttributeId="memberURL" field="members"/>\n\nOr, you can use a subtag 'dynamicReference' to declare attributes that\ncontain a DN, a filter and a type. This values will be used to selected\nthe references.\n
\n
<ldapReference directory="userDirectory" field="members"/>\n <dynamicReference baseDN="ldapAttribute" filter="ldapAttribute" type="subtree/onelevel"/>\n <ldapReference/>\n\nWhen using dynamic references, caching is advised since dynamic group\nresolution can be expensive.\n
\nThe element "idCase" makes it possible to control the case of the\nidentifier on Nuxeo side. It accepts values "upper", "lower" or\n"unchanged". It is useful when changing case on the LDAP without affecting\nNuxeo (for rights management for instance which is case sensitive for\ninstance).\n
\nDependening on your LDAP Backend implementation, if you have some specific restriction\n(for example on password, or logins ...), you may want Nuxeo to handle the validation\nerrors of your server on the Nuxeo side.\n
\nSince there error code and message may vary depending on the LDAP server provider, you\nmay need to provide a custom class that knows how to handle the Exceptions returned by it.\n
\nFor this you can specify a class that will be in charge of this task.\n
<ldapExceptionHandler>org.nuxeo.ecm.directory.ldap.DefaultLdapExceptionProcessor</ldapExceptionHandler>\n\nThis class should implement org.nuxeo.ecm.directory.ldap.LdapExceptionProcessor and return\na RecoverableClientException for any exception that should be displayed to the user.\n
\nBy default, referrals will be automatically resolved, if you don't want that behavior (since 5.9.4) you can use the followReferrals tag\n
\n
<directory name="groupDirectory">\n ....\n <followReferrals>false</followReferrals>\n ...\n </directory>\n\n \n ldap://localhost:389 \n ldap://server2:389 \n ldaps://server3:389 \n\n \n ldap:///dc=example,dc=com \n\n \n ldap:///dc=example,dc=com \n\n 10000 \n 5 \n\n true \n 60000 \n true \n\n cn=nuxeo5,ou=applications,dc=example,dc=com \n ******** \n \n \n\n The ldapUrl tags point to server (IP address or DNS name) and\n ports. If more than one is provided, the Nuxeo EP will use a pool\n of load balanced connections to each server. They are assumed to\n be replicated versions of a master server that should belong to\n the list.\n\n The connectionTimeout element specifies a connection timeout in milliseconds.\n The default is 10000.\n\n The retries element indicates how many times the request will be retried\n if LDAP server returns a ServiceUnavailableException. The default is 5.\n\n The poolingEnabled element specifies whether to use LDAP connection pooling.\n The default is true.\n\n The poolingTimeout element specifies, in milliseconds, how long a connection\n may remain in the pool when LDAP connection pooling is enabled.\n The default is 60000.\n\n The verifyServerCert element specifies whether, in SSL mode, all certificates\n should be checked. This should only be disabled when testing with test server\n having self-signed certificates. The default is true.\n\n The bindDn and bindPassword credentials are used by Nuxeo EP to\n access the content of the LDAP servers. It should have the read\n permission to any entry that is to be used by Nuxeo EP and write\n right to branches were Nuxeo EP is supposed to create or edit\n entries.\n\n For instance, in OpenLDAP you should have ACLs such as:\n\n \n access to attrs=\"userPassword\"\n by dn=\"cn=ldapadmin,dc=example,dc=com\" write\n by dn=\"cn=nuxeo5,ou=applications,dc=example,dc=com\" write\n by anonymous auth\n by self write\n by * none\n\n access to dn.base=\"\" by * read\n\n # nuxeo5 can manage the ou=people branch\n access to dn.subtree=\"ou=people,dc=example,dc=com\"\n by dn=\"cn=nuxeo5,ou=applications,dc=example,dc=com\" write\n by users read\n by self write\n by * none\n\n access to dn.subtree=\"ou=groups,dc=example,dc=com\"\n by dn=\"cn=nuxeo5,ou=applications,dc=example,dc=com\" write\n by users read\n by self write\n by * none\n\n # The admin dn has full write access\n # other\n access to *\n by dn=\"cn=ldapadmin,dc=example,dc=com\" write\n by users read\n by * none\n \n\n User authentication is done using a bind method against the user\n provided login and password from the login form and not the bindDn\n / bindPassword credentials.\n \n \n default \n user \n \n system \n \n username \n unchanged \n password \n SSHA \n ou=people,dc=example,dc=com \n person \n (&(sn=toto*)(myCustomAttribute=somevalue)) \n onelevel \n\n false \n\n 3600 \n 1000 \n\n ou=people,dc=example,dc=com \n top \n person \n organizationalPerson \n inetOrgPerson \n uid \n\n 200 \n 0 \n\n uid \n ******** \n givenName \n sn \n o \n mail \n\n \n \n \n \n\n \n default \n group \n groupname \n ou=groups,dc=example,dc=com \n (|(objectClass=groupOfUniqueNames)(objectClass=groupOfURLs)) \n subtree \n\n \n \n dn \n .*,ou=editable,ou=groups,dc=example,dc=com \n \n\n false \n\n 3600 \n 1000 \n\n ou=editable,ou=groups,dc=example,dc=com \n top \n groupOfUniqueNames \n cn \n\n 200 \n 0 \n\n cn \n\n \n \n \n\n \n\n \n\n \n \n\n \n\n \n \n\n In the previous examples we configured two directories one for the\n users and one for the groups of users. Each directory uses a\n single schema which is to be registered as any core document\n schema and that will be used to build a DocumentModel for each\n matching entry of the directory.\n\n\n Nuxeo EP provides group resolution for statically dn-referenced\n entries (in read and write mode) and for dynamically ldapUrl\n matched entries (readonly). You may also need to statically\n reference entries without a dn using the 'staticAttributeIdIsDn'\n attribute.\n\n The references tags are used to dynamically build nxs:stringList\n fields of that schema that are to compute membership relationships\n between users and groups or between parent groups and sub groups.\n It can also resole children and parents following the ldap tree\n structure.\n\n You have two ways for declaring a dynamic reference in a 'references' tag.\n You can use 'dynamicAttributeId' to point to an ldap attribute that\n contains an ldap url.\n\n \n \n \n\n Or, you can use a subtag 'dynamicReference' to declare attributes that\n contain a DN, a filter and a type. This values will be used to selected\n the references.\n\n \n \n \n \n\n When using dynamic references, caching is advised since dynamic group\n resolution can be expensive.\n\n The element \"idCase\" makes it possible to control the case of the\n identifier on Nuxeo side. It accepts values \"upper\", \"lower\" or\n \"unchanged\". It is useful when changing case on the LDAP without affecting\n Nuxeo (for rights management for instance which is case sensitive for\n instance).\n\n\n Dependening on your LDAP Backend implementation, if you have some specific restriction\n (for example on password, or logins ...), you may want Nuxeo to handle the validation\n errors of your server on the Nuxeo side.\n\n Since there error code and message may vary depending on the LDAP server provider, you\n may need to provide a custom class that knows how to handle the Exceptions returned by it.\n\n For this you can specify a class that will be in charge of this task.\n \n org.nuxeo.ecm.directory.ldap.DefaultLdapExceptionProcessor \n \n This class should implement org.nuxeo.ecm.directory.ldap.LdapExceptionProcessor and return\n a RecoverableClientException for any exception that should be displayed to the user.\n\n\n By default, referrals will be automatically resolved, if you don't want that behavior (since 5.9.4) you can use the followReferrals tag\n\n \n \n ....\n false \n ...\n \n \n\n