LDAP User Profile Backend

OpenOffice.org 2.0

Document - ID	Specification Owner	Last Change	Status
	Sarah Smith	29/04/2004	Final
Conforms to	
Applies to	OpenOffice.org backend configuration
Task ID(s)	115692. i33383
Category	Feature

Abstract

This specification details the realization of the OpenOffice.org LDAP User Profile Backend feature. The LDAP user profile backend retrieves OpenOffice.org user profile configuration settings from a configured LDAP repository.

i-Team Members (The specification owner is part of the i-Team)

	Name	E-mail Address
User Experience	Christian Jansen	christian.jansen@sun.com
Development	Sarah Smith	sarah.smith@sun.com
Quality Assurance	Ralf Unger	ralf.unger@sun.com
Documentation	Yvonne Jacoby	yvonne.jacoby@sun.com

Approved for Implementation

	Approved by	Date
User Experience	Christian Jansen	formal approval missing
Development	Jörg Barfurth	formal approval missing
Quality Assurance	Ralf Unger	formal approval missing
Documentation	Yvonne Jacoby	formal approval missing
String Review		

Document Change History

Rev. Level	Change	Initials	Date
0.1	Initial Draft	SS	23/03/2003
0.2	Version includes updates made by Christian Jansen, Joerg Barfurth and Cyrille Moreaux. Main changes Updated Motivation section. Removed User/ObjectClass and User/Naming Attribute from mapping file to org.openoffice.LDAP component. Changed Structure of org.openoffice.LDAP component schema file. Added support for CFG_LdapMappingUrl in configmgr(rc/.ini) Updated Migration section.	SS	26/04/2004
0.3	Added change suggestions	JB	28/04/04
1.1	#i33383# Deliver example LDAP.xcu as LDAP.xcu.sample minor cleanup, added missing default port value in schema	JB	2004-08-26

Contents

Glossary	1

1	Motivation	1

2	User Scenarios	1

3	Goals	1

4	Requirements and Dependencies	2

4.1	Requirements	2

4.2	Technical Dependencies	2

5	Competitive Analyses	2

6	Detailed Specification	2

6.1	LDAP User Profile Proposed Solution	2

6.2	G11n	6

6.3	Error Conditions	6

6.4	Migration	6

7	Future Tasks	6

8	Notes	6

9	References	6

Glossary

Term	Description
SCM	StarOffice Configuration Manager
GUI	Graphical User Interface
LDAP	Lightweight Directory Access Protocol

Motivation

A new LDAP user profile configuration backend will be implemented to retrieve the OpenOffice.org user profile settings from a configured LDAP repository.

StarOffice 7 includes a central configuration backend for integration with the StarOffice Configuration Manager (SCM) management application. This backend uses LDAP for data retrieval. In addition to its primary function, it also mapped user data from the LDAP directory into the StarOffice configuration.

In StarOffice 8 the old central configuration will be replaced by a different management architecture, in which StarOffice no longer directly accesses an LDAP directory. Due to this change the collateral function of integrating LDAP user data would be lost.

To prevent a loss of functionality for StarOffice 7 users, this feature is now reimplemented as a separate component. As there now is no more tie-in with the StarOffice-only Configuration Manager application, the separated feature can be offered for OpenOffice.org as well.

The feature itself provides better automatic integration of user information, if such information is available anyhow in an enterprise directory. This eases deployment by obviating the need to manually enter this data for each user.

This works particularly well with the changed handling of initial user data entry in OpenOffice.org 2.0. If LDAP data access is configured, user data will be available instantly, although there is no more interactive 'user' installation, which was used to solicit user data entry in OpenOffice.org 1.1 and before.

User Scenarios

With suitable LDAP backend configuration, OpenOffice.org user profile settings can be retrieved from an LDAP repository.

User can override user profile settings retrieved from LDAP via OpenOffice.org UI which will be written to OpenOffice.org user layer.

Goals

Make relevant user data from an enterprise directory available as OpenOffice.org configuration data seamlessly and with minimal deployment effort.

Requirements and Dependencies

Requirements

Retrieval of OpenOffice.org user profile settings from standard user data that exists in an LDAP repository

Preserve users' ability to change user profile settings that are used by the OpenOffice.org application. This must be possible without requiring or allowing the user to change data in the LDAP repository. Changes should be treated like ordinary changes of user preferences.

Various LDAP repositories, including Sun Java™ System Directory Server and Microsoft Active Directory must be supported.

The OpenOffice.org application must continue to operate transparently in event of any LDAP failures

Offline capabilities are not required.

Technical Dependencies

In the OpenOffice.org configuration manager code stack there currently exists a mechanism, 'desktop Integration', that allows additional backends rendered as UNO components be dynamically plugged into the stack that access configuration settings form external sources. The LDAP user profile backend will be provided as an additional backend. This mechanism is detailed in http://specs.openoffice.org/installation/system_integration/desktopIntegration.sxw.

For OpenOffice.org 2.0 installation of the product is done using Native Installers:

Redhat Package Manager (RPM) for Linux

Solaris Packages for the Solaris operating systems

Windows Installer for the Windows OS

Previously OpenOffice.org used a custom installer that was part of the OpenOffice.org product, the move away form the old installer application means that user data cannot be entered during the installation process, please refer to the following specification for further details:

http://specs.openoffice.org/installation/native_installer/networker2_spec.sxw

http://specs.openoffice.org/installation/native_installer/NativeInstallerPackagingSpec.sxw

Competitive Analyses

Detailed Specification

The LDAP user profile backend will be provided as an UNO component that plugs into the extended backend architecture of OpenOffice.org, please refer to the Technical Dependencies section.

LDAP User Profile Proposed Solution

The LDAP user profile backend will be provided as a plug-in backend that retrieves OpenOffice.org user profile settings from an LDAP repository. The LDAP user profile backend will implement the com.sun.star.configuration.backend.PlatformBackend service which realizes the com.sun.star.configuration.backend.XSingleLayerStratum interface. The XSingleLayerStratum interface is used to retrieve the single layer of user profile configuration data.

Configuring LDAP Settings

A new OpenOffice.org org.openoffice.LDAP component is needed to store the LDAP settings which consist of -

Server – host name of the LDAP Directory Server

Port – port number of the LDAP Directory Server, default 389

BaseDN – root entry of the enterprise directory.

SearchUser – DN of existing user with read-only access to the repository, only required if anonymous access is not supported.

SearchPassword – password of SearchUser, only required if anonymous access is not supported.

UserObjectClass – object class used to identify user entities. For e.g. if the LDAP repository is a SunOne Directory server the entry could be inetorgperson. This entry is required in conjunction with the UserUniqueAttribute to find the DN of the user.

UserUniqueAttribute – unique attribute used to identify user entities. For e.g. if the LDAP repository is a Sun Java System Directory server the entry could be uid. This entry is required in conjunction with the UserObjectClass to find the DN of the User. The value of this attribute will be matched against the operating system (login) user-name.

Mapping – string indicating a named mapping file. The mapping entry is used to derive the name of the mapping file, the format is $(Mapping)-attr.map. For e.g. If the LDAP repository is a Sun Java™ System Directory Server, then the Mapping entry must be oo-ldap indicating to use oo-ldap-attr.map as the mapping file, alternatively if the LDAP repository is an Active Directory the Mapping entry must be oo-ad-ldap indicating to use oo-ad-ldap-attr.map as the mapping file.

The configuration schema for org.openoffice.LDAP component looks like -

<?xml version='1.0' encoding='UTF-8'?>

<oor:component-schema oor:name="LDAP" oor:package="org.openoffice" xml:lang="en-US" xmlns:oor="http://openoffice.org/2001/registry" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<templates>

<group oor:name="ServerDefinition">

<prop oor:name="Server" oor:type="xs:string"/>

<prop oor:name="Port" oor:type="xs:int">

<value>389</value>

</prop>

<prop oor:name="BaseDN" oor:type="xs:string"/>

</group>

</templates>

<component>

<group oor:name="UserDirectory">

<prop oor:name="SearchUser" oor:type="xs:string"/>

<prop oor:name="SearchPassword" oor:type="xs:string"/>

<prop oor:name="UserObjectClass" oor:type="xs:string"/>

<prop oor:name="UserUniqueAttribute" oor:type="xs:string"/>

<prop oor:name="Mapping" oor:type="xs:string"/>

<node-ref oor:name="ServerDefinition" oor:node-type="ServerDefinition"/>

</group>

</component>

</oor:component-schema>

Users (administrators) can set up this data by providing a manually edited LDAP.xcu file and installing it via pkgchk or copying it to $Installation/share/registry/data/org/openoffice/LDAP.xcu . The installation will contain an LDAP.xcu.sample file containing dummy data, that can be used as a template. The example file can be found at $Installation/share/registry/data/org/openoffice/LDAP.xcu.sample, in the directory where the customized LDAP.xcu should be stored.

In an enterprise deployment of StarOffice, an administrator can set up the LDAP settings using the new StarOffice enterprise configuration solution ('APOC'). A new template covering the org.openoffice.LDAP/UserDirectory settings will be provided for the management application.

LDAP User Profile Initialization

The LDAP User Profile backend needs the following LDAP settings to make an LDAP connection; server name, port number, Base DN, UserObjectClass and UserUniqueAttribute. The backend will use SearchUser and SearchPassword if they are present, if anonymous access is not supported these settings are required for a successful LDAP connection. The backend retrieves the settings by reading the org.openoffice.LDAP component from the OpenOffice.org configuration. As the backend itself will only be registered for the org.openoffice.UserProfile component, this does not cause a circular dependency.

The LDAP user profile backend accesses the org.openoffice.LDAP component through a com.sun.star.configuration.ConfigurationProvider object, please refer to Developers Guide, chapter 15 Configuration Management for detailed description on how OpenOffice.org accesses configuration components.

The LDAP user profile backend only connects to the LDAP server if the mandatory LDAP settings are present.

LDAP User Profile Mapping

There will be two default meta-configuration mapping files provided with the OpenOffice.org installation, oo-ldap-attr.map deployed when connecting to a SunOne Directory Server and oo-ad-ldap-attr.map for Active Directory. The Mapping entry of the org.openoffice.LDAP component indicates which mapping file to use. The meta-configuration files contains the mapping of OpenOffice.org user profile attributes to LDAP attributes.

The default meta-configuration mapping files are stored under the $Installation/share/registry/ldap directory by default. Users can edit the CFG_LdapMappingUrl entry in the configmgr(rc/.ini) file found in the program directory of the installation to change the location of mapping file.

Users are free to add their own mapping files for alternative LDAP servers, they must also configure OpenOffice.org to use the custom mapping file by configuring the Mapping entry of the org.openoffice.LDAP component, please refer to section Configuring LDAP settings.

Defining User Profile Mapping

A user profile mapping file is a simple text file. Users can start defining their own mapping by editing a copy of one of the preinstalled mapping files.

Each line of the file is in the format

<User Profile Attribute>=<LDAP Attribute 1>,<LDAP Attribute 2>,...,<LDAP Attribute N>

The user profile attributes are prescribed by the OpenOffice.org configuration schema and must not be altered. The list of corresponding LDAP attributes can be edited to reflect which attributes are used inside the user entries to hold the personal data. The LDAP attributes will be queried using the order in the list as a preference indication. For instance <LDAP Attribute N> contents will be used for <User Profile Attribute> if all the previous LDAP attributes specified held no data.

By placing the mapping in the $Installation/share/ldap directory, a System Administrator can define the mapping for the whole organization in one edit of the file. Stand alone users will require file write permissions to edit the meta-configuration file.

The following is a commented version of oo-ldap-attr.map file

# inetOrgPerson.givenName org.openoffice.UserProfile/Data/givenname = givenName # person.sn (surname) org.openoffice.UserProfile/Data/sn = sn # inetOrgPerson.initials org.openoffice.UserProfile/Data/initials = initials # organizationalPerson.street org.openoffice.UserProfile/Data/street = street,postalAddress,streetAddress # organizationalPerson.l (city) org.openoffice.UserProfile/Data/l = l # organizationalPerson.st (state) org.openoffice.UserProfile/Data/st = # organizationalPerson.postalCode (zip code) org.openoffice.UserProfile/Data/postalcode = postalCode # country.c (country) org.openoffice.UserProfile/Data/c =c # organizationalPerson.o (company/organization) org.openoffice.UserProfile/Data/o = o,ou # deprecated -- no LDAP corollary org.openoffice.UserProfile/Data/position = # organizationalPerson.title org.openoffice.UserProfile/Data/title = title # inetOrgPerson.homePhone org.openoffice.UserProfile/Data/homephone = homePhone # organizationalPerson.telephoneNumber (business phone) org.openoffice.UserProfile/Data/telephonenumber = telephoneNumber # organizationalPerson.facsimileTelephoneNumber org.openoffice.UserProfile/Data/facsimiletelephonenumber = facsimileTelephoneNumber,otherFacsimileTelephoneNumber # inetOrgPerson.mail (e-mail address) org.openoffice.UserProfile/Data/mail = mail

G11n

Error Conditions

The LDAP user profile backend will throw an exception if it cannot connect to the LDAP server due to invalid or incomplete LDAP settings or if the server is down. The Platform backend manager will prevent this from impacting application startup.

Migration

The LDAP server settings for a centrally configured StarOffice 7 are stored in the configmgr(rc/ini) file located in the program directory of the StarOffice 7 installation.

These settings are not migrated to provide initial org.openoffice.LDAP settings. It is assumed that customers that have deployed SCM will migrate to the new central configuration solution ('APOC') and will use APOC to set up the LDAP configuration. For other users of prior versions, there is no data to migrate.

Future Tasks

Consideration in the future should be given to the provision of a user interface for configuring the LDAP settings.

Such a feature might also be provided as a standalone CLI or GUI tool, as it requires administrative access to the OpenOffice.org installation.

Notes

References

http://specs.openoffice.org/installation/system_integration/desktopIntegration.sxw

http://api.openoffice.org/DevelopersGuide/DevelopersGuide.html

http://specs.openoffice.org/installation/native_installer/networker2_spec.sxw

http://specs.openoffice.org/installation/native_installer/NativeInstallerPackagingSpec.sxw

This differs from the behavior of StarOffice 7 Central Configuration. The new behavior is preferable, because it preserves directory integrity and does not require write access permission for the LDAP repository.

LDAP User Profile

Page 7

http://specs.openoffice.org/installation/system_integration/ldap_userprofile.sxw

Christian Jansen

2003-11-04T09:09:03

Jörg Barfurth