LDAP Server Advanced Domain Settings
Users can log into the Transfer Client and Gateway Administrator using just a user ID (for example joe) or using a domain name and user ID (acme\joe). By default, when a user logs in using just a user ID, FileXpress searches all available LDAP servers for a matching user and authenticates the first matching user it finds; it does not search additional LDAP servers if that fails. When no domain name is included, a UserID for a different domain could match and allow login if the passwords for both accounts are the same.
You can use Advanced domain settings on the New/Edit LDAP Server page to customize how FileXpress manages user authentication to your LDAP server(s). The examples below show how login is handled for some possible configurations.
Note: Advanced domain settings apply to password authentication only; X.509 certificate authentication always requires user mapping that specifies both a domain and username.
These examples use acme as a sample Active Directory domain. For these examples, this acme is a domain that requires a valid authentication domain name. It can accept both acme and acme.com as the authentication domain name.
Domain Name = anyName; Domain Mapping = anyAlias; Remove User Domain= No, Default Authentication Domain = none.
Domain Name = anyName; Domain Mapping = anyAlias; Remove User Domain = No, Default Authentication Domain = acme.
Domain Name = anyName; Domain Mapping = anyAlias; Remove User Domain= Yes, Default Authentication Domain = none.
The following results are based on the sample acme domain, which requires a valid domain name for authentication:
If your Active Directory domain does not require an authentication domain, the login attempts above will succeed because each of them presents a valid user ID to the domain. In this case, using anyAlias\validUser improves performance because the Domain Mapping directs FileXpress to authentication to this specific LDAP server. Although anyAlias is not the actual domain authentication name, authentication succeeds because the domain name is removed before FileXpress attempts authentication.
This example shows a configuration for handling a merger that brings users from the summit domain into the acme domain. It enables summit users to log in without modifying their familiar credentials.
Domain Name = acme; Domain Mapping = summit; Remove User Domain= Yes, Default Authentication Domain = acme.