Directory providers

Name

This name identifies users and groups that come from this provider.

Description

Description of provider.

URL Discovery

Select the method to retrieve the URL for the Active Directory server. Auto-discovery using DNS automatically discovers Active Directory servers on the given domain. Alternatively, you can specify a custom URL to an Active Directory server.

Domain Name

The domain where Active Directory servers are automatically discovered. For example, example.com

Use SSL

Select this box if you want to use SSL when the CloudBees Software Delivery Automation server contacts your Active Directory server.

Query User Name

The name of a user who has read-only access to user and group directories in Active Directory. This is the user name to use for fetching user and group information. When you provide a domain name, you can provide the simple name, for example, myuser instead of electric-cloud\myuser. When you provide an explicit URL, you need to provide a distinguished name, for example: ` cn=myuser,ou=Users,dc=electric-cloud,dc=com`.

Query User Password

The password for the query user.

Recursively Traverse Group Hierarchy

Select this to enable recursive traversal of the group hierarchy for nested group membership information. If Recursively Traverse Group Hierarchy is selected, select the LDAP_MATCHING_RULE_IN_CHAIN template for both the Membership Filter and Group Member Filter fields in the "Group Options" section to allow Active Directory to return the nested group membership information.

Membership Filter

Active Directory filter to use when searching for groups to which an Active Directory user or group belongs.

Include Nested Group Users in Notifications

Select this to include users in nested Active Directory groups when notifications for a parent Active Directory group are sent and Recursively Traverse Group Hierarchy is selected.

Include Nested Group Users as Approvers

Select this to allow users in nested Active Directory groups to complete or approve a manual task when a parent Active Directory group is assigned as an assignee or an approver for the task and Recursively Traverse Group Hierarchy is selected.

User Options section

When creating an Active Directory provider, the CloudBees Software Delivery Automation server automatically sets default values for any options (fields) that are empty. The default values match the most common Active Directory configurations. After the provider is created, you can view and modify defaults by modifying the provider.

User Base

This string is prepended to the `basedn ` to construct the directory DN containing user records.

User Search Filter

This LDAP query is performed in the context of the user directory to search for a user by account name. The string "{0}" is replaced with the user’s login ID. Typically, the query compares a user record attribute to the substituted user login ID.

User Name Attribute

This is the attribute in a user record that contains the user’s account name.

Full User Name Attribute

(Optional) This is the attribute in a user record that contains the user’s full name (first and last) for display in the UI. If this attribute is not specified or the resulting value is empty, the user’s account name is used instead.

User Email Attribute

(Optional) This is an attribute in a user record that contains the user’s email address. If this attribute is not specified, the account name and domain name are concatenated to form an email address.

Search User Subtree

Select this check box to search the specified directory by the user base and all directories below. If this check box is not selected, the search is limited to the specified directory only.

Group Options section

When creating an Active Directory provider, the CloudBees Software Delivery Automation server automatically sets default values for the options/fields that remain empty. These default values match the most common Active Directory configurations. After the provider is created, you can view and modify the defaults by modifying the provider.

Enable Groups

Select this check box to enable external groups for this directory provider.

Group Base

(Optional) This string is prepended to the `basedn ` to construct the directory DN containing group records.

Group Member Filter

(Optional) This LDAP query is performed in the groups directory context to identify groups that contain a specific user. Two common forms of group records in LDAP directories are: POSIX style groups where members are identified by account name, and groupOfNames or uniqueGroupOfNames records where members are identified by the full user DN. CloudBees Software Delivery Automation supports both forms, so the query is passed two parameters: "{0}" is replaced with the full user record DN, and {1} is replaced with the user’s account name.

Group Member Attributes

(Optional) This is a comma-separated attribute name list that identifies a group member. Most LDAP configurations only specify a single value, but if a mixture of POSIX and LDAP style groups exist in the directory, multiple attributes might be required.

Group Search Filter

(Optional) This LDAP query is performed in the context of the groups directory to enumerate group records. You can choose from common templates that include either security or distribution groups (or both). These templates are based on the most common Active Directory settings.

Unique Group Name Attribute

(Optional) This is the group record attribute that contains the group name. To prevent group name overlap between multiple directory providers (or within the same provider in a multi-forested Active Directory server), we recommend setting this attribute to the distinguishedName.

Common Group Name Attribute

The Unique Group Name Attribute may not be searchable if using the distinguishedName. In this case, the Common Group Name Attribute can be used to search for groups, depending on the filter used.

Name

This name identifies users and groups that come from this provider.

Description

Description of the provider.

URL

The LDAP server URL is in the form protocol://host:port/basedn . Protocol is either ldap or ldaps (for secure LDAP). The port is implied by the protocol, but you can override the port if you cannot use the default (default port is 389 for ldap and 636 for ldaps ). The basedn is the path to the top-level directory that contains users and groups at this site. Typically, this is the domain name where each part is listed with a dc= and separated by commas.

Realm

This is the realm of the LDAP directory provider, which is used to create unique user names when you have multiple providers. For example, if the realm is example.com, users are saved as myuser@example.com.

Query User Name

This is the name of a user who has read-only access to the user and group directories in LDAP. This is the user name to use for fetching user and group information. When providing a domain name, you can provide the simple name, for example, myuser. When providing an explicit URL, you need to provide a distinguished name, for example: cn=myuser,ou=Users,dc=electric-cloud,dc=com.

Query User Password

This is the password for the query user.

Recursively Traverse Group Hierarchy

Select this to enable recursive traversal of the group hierarchy for nested group membership information.

Membership Attribute

Attribute defined on an LDAP user or group entry that is used by the LDAP provider for specifying the group membership. memberOf is the membership attribute used by most LDAP servers.

Nested Groups Depth Limit

Maximum number of group hierarchy levels that will be traversed for retrieving nested group membership information.

Include Nested Group Users in Notifications

Select this to include users in nested LDAP groups when notifications for a parent LDAP group are sent and Recursively Traverse Group Hierarchy is selected.

Include Nested Group Users as Approvers

Select this to allow users in nested LDAP groups to complete or approve a manual task when a parent LDAP group is assigned as an assignee or an approver for the task and Recursively Traverse Group Hierarchy is selected.

User Options section

User Base

This string is prepended to the basedn to construct the directory DN containing user records.

User Search Filter

This LDAP query is performed in the context of the user directory to search for a user by account name. The string {0} is replaced with the user’s login ID. Typically, the query compares a user record attribute to the substituted user login ID.

User Name Attribute

This is the attribute in a user record that contains the user’s account name.

Full User Name Attribute

(Optional) This is the attribute in a user record that contains the user’s full name (first and last) for display in the UI. If this attribute is not specified or the resulting value is empty, the user’s account name is used.

User Email Attribute

(Optional) This is the attribute in a user record that contains the user’s email address. If the attribute is not specified, the account name and domain name are concatenated to form an email address.

Search User Subtree

Select this check box to search the specified directory by the user base and all directories below. If this check box is not selected, the search is limited to the specified directory only.

Groups Options section

Enable Groups

Select this checkbox to enable groups.

Group Base

(Optional) This string is prepended to the `basedn ` to construct the directory DN containing group records.

Group Member Filter

(Optional) This LDAP query is performed in the groups directory context to identify groups containing a specific user. Two common forms of group records in LDAP directories are: POSIX style groups where members are identified by account name, and groupOfNames or uniqueGroupOfNames records where members are identified by the full user DN. CloudBees Software Delivery Automation supports both forms, so the query is passed with two parameters: "{0}" is replaced with the full user record DN, and "{1}" is replaced with the user’s account name.

Group Member Attributes

(Optional) This is a comma-separated attribute name list identifying a group member. Most LDAP configurations only specify a single value, but if you have a mixture of POSIX and LDAP style groups in the directory, multiple attributes might be required.

Group Search Filter

(Optional) This LDAP query is performed in the context of the groups directory to enumerate group records.

Unique Group Name Attribute

(Optional) This is the group record attribute containing the group name.

Common Group Name Attribute

The Unique Group Name Attribute may not be searchable if using distinguishedName. In this case, the Common Group Name Attribute is used if searching for groups, depending on the filter.