LDAP Settings Overview
If your organization runs a Lightweight Directory Access Protocol (LDAP) server and stores user data in it, QMetry can integrate with LDAP to import those users into the QMetry application.
QMetry authenticates users against both an LDAP or Active Directory server and the QMetry database, so an organization can maintain both kinds of users at the same time.
For example, an organization can have many users who are authenticated through Active Directory and, at the same time, many users who do not have Active Directory accounts.
Authenticate and Import LDAP Users
The LDAP feature lets LDAP users import themselves into the QMetry database. An administrator first configures the settings on the LDAP page, and LDAP must be active before you can set the authentication type to LDAP.
Note
You can integrate only one LDAP or Active Directory server with QMetry for authentication.
Administrator credentials are optional. If your LDAP server allows anonymous queries, you can enable an anonymous search for users to import and set up LDAP without entering an administrator user name and password on the Settings page.
Individual LDAP users are added to the QMetry database when they log in to QMetry. You cannot import users in bulk.
Because administrator credentials are not mandatory, an administrator who does not want to store an administrator user name and password in the system can leave those fields blank when the LDAP server allows anonymous queries.
How the Functionality Works
When a user logs in to QMetry for the first time with LDAP credentials, the system first checks whether the user exists in the QMetry database:
If the user exists in the database, the system authenticates the user against the QMetry database.
If the user does not exist in the QMetry database, the system sends the user credentials to the LDAP or Active Directory server.
If the LDAP or Active Directory server responds positively, the system adds the user to the QMetry database and assigns the default project and default user role to the user.
The next time the LDAP user logs in to QMetry with LDAP credentials, the system sends the credentials to the LDAP or Active Directory server for authentication. The user can access QMetry after successful LDAP authentication.
The functionality behaves differently in different scenarios, as described in the following table.
Scenario | The user has an account in - | Authentication Type is set to | Result when the user tries to log into QMetry |
1 | QMetry database | QMetry | QMetry authenticates the user against the QMetry database. If the system finds a match, the login is successful. |
2 | QMetry database | LDAP | QMetry authenticates that user against the LDAP/AD. If the system finds a match, login is successful. This scenario is only valid when LDAP is active. |
3 | LDAP | LDAP | QMetry authenticates that user against the LDAP/AD. If the user is authenticated successfully, the user’s account gets created in QMetry having the Authentication Type set as LDAP. Once the user is created in QMetry, the default project and default role are assigned to that user to let them log in to QMetry. Access is auto-assigned to the default Projects with the default assigned role. |
The LDAP or Active Directory server manages LDAP and Active Directory passwords. LDAP and Active Directory users must contact their network administrator for any password issue, such as resetting, recovering, or updating a password. Other users can reset their passwords as usual through QMetry.