56
Configuring Contribute and Contribute Publishing Server to work with your website
User branch with baseDN:ou=Central,o=MyCompany, Search Scope:SUBTREE_LEVEL,
filter:(objectClass=organizationalPerson)
User branch with baseDN:ou=West,o=MyCompany, Search Scope:SUBTREE_LEVEL,
filter:(objectClass=organizationalPerson)
Group branch with baseDN:ou=Central,o=MyCompany, Search Scope:SUBTREE_LEVEL,
filter:(objectClass=groupOfNames)
Group branch with baseDN:ou=West,o=MyCompany, Search Scope:SUBTREE_LEVEL,
filter:(objectClass=groupOfNames)
LDAP permissions and Contribute permissions
Integrating your company LDAP directory
with CPS adds another layer of permissions. When connecting to an LDAP or Active Directory
server, CPS respects any file/folder permissions set by the LDAP or Active Directory service.
Contribute permissions are layered on top of the directory service or the network/server
permissions and are applied globally.
Contribute permissions, which are settings stored in an XML file at the root of your website, are
specific controls for the Contribute editing environment. These permissions are not assigned on a
per-user basis; they are simply groups of settings that Contribute reads when first connecting to a
website. Contribute then conforms to these settings during the editing process. Contribute
administrators can specify access to certain folders for different user roles.
LDAP authentication types
CPS authenticates users against the LDAP directory. For CPS to
authenticate a user, the LDAP server must verify the user’s display name. This is usually a unique
name in the LDAP tree that is associated with the user. CPS receives only a user name, so it must
retrieve the user’s display name, based on the user name, to authenticate the user.
In your User Directory service configuration, you can select one of four types of LDAP
authentication:
•
LDAP bind authenticates users by pre-pending a specified prefix and appending a specified
suffix to the user ID. With this method, you can specify only a single prefix and a single suffix.
Use this method if all the DNs in your LDAP directory are stored as
<username> +
suffix
If all DNs are not stored according to this pattern, then this method does not enable you to
construct a path to all the users in your system.
•
LDAP bind (auto-find user DN) authenticates users in a two-step process: CPS looks up the
user ID of the user who’s trying to log in to determine that user’s DN, and then uses the DN to
authenticate the user.
Use this method if all your DNs are
not
stored according to the same
<username> +
suffix
pattern. For example, if you have set up CPS to search multiple branches (OUs) of
your LDAP tree, and those branches store DNs in different ways, then you should use this
authentication method.
Although this method requires and extra LDAP search (compared to the LDAP bind method),
it gives you more flexibility.
•
Password in file authenticates users using passwords that you specify when you add users to the
file-based User Directory.
Note:
If you use the file-based authentication with an LDAP Directory, you must have a file entry
for each user in your LDAP directory.
