Activating the AD / LDAP connector simplifies user management in CDESK. Based on the membership of AD accounts in groups and on attribute settings, you can automate the creation and parameterisation of accounts in CDESK. It then also handles authentication of users’ access to CDESK.
At the moment a user logs in to CDESK, the AD / LDAP connector verifies the validity of the account in Microsoft Active Directory or LDAP. Accounts are created automatically in CDESK on the basis of the AD account’s membership of the selected groups. Using attributes, accounts can be assigned to companies and given a manager and a job position.
The result of connecting CDESK and AD / LDAP through this connector is that users log in with their login details from the AD or LDAP databases. Depending on the configuration, you will be able to choose whether the login screen shows a domain selector, or a domain selector with the login in the form name@domain.
Adding the AD / LDAP connector in CDESK
After clicking, a window for selecting the connector type appears. Select the AD / LDAP (Directory service) option and then click the -> Continue button.
After clicking, a window for configuring the parameters appears. The window is divided into several tabs, which are described in the following sections.
Preparation - loading the AD tree in third-party LDAP software
To simplify the procedure we recommend loading the data from AD into LDAP software. In the following procedure we will use Softera LDAP Browser, which you can download from this link.
Once installation has succeeded you can add a new connection. To add a connection, click the New button on the top bar.
After clicking, a modal window appears. First enter the name under which the structure will be shown and then click the Next button.
Then specify the address and port of the Active Directory server and click the Next button.
The next step is where the authentication method is selected. Choose the Other credential option and enter the password in the Password field. Once the details have been entered, click the Finish button.
Basic settings of the AD / LDAP connector
Connector type – the field is not editable and is filled in automatically.
Name – the name under which the connector will be shown in the list of connectors.
Enabled – setting the switch to the on position 
makes it possible to use the connector.
Server name/IP address – in the first field enter the name or the IP address of the server, and in the second field enter the port number. The standard port designated for AD communication is TCP/UDP 389.
User DN – the user who will read the data from AD for CDESK. It is enough for them to have read-only permissions to the necessary parts of AD. It can be entered in the form domain/user. It is also possible to use the path from AD. To obtain the path, find the given user in the LDAP software, right-click on them and select Properties. After clicking, a modal window with the user’s parameters appears. The path you need is in the very first line on the Entry tab.
In the Password field enter the password the user uses in AD.
Secure connection – if you have the option of a secure connection with the AD server, set the switch to the on position and change the port from 389 to 636.
Automatic account creation
User DN path – the path in which the users for creating and / or pairing accounts in CDESK are located. Next to this field there is a setting for whether all records falling under the given path will be loaded, or only objects falling under a particular objectClass. The objectClass is the attribute by which the registered users are sorted in the LDAP software.
When the Filter by objectClass option is selected, a field with a choice of objectClass appears next to the User DN path field. The +Add User DN path button is used to add a further path from which users will be loaded. Filtering by objectClass can be set for each new path.
Group DN path – specifies the path for loading groups. This setting is important so that the user groups used in CDESK are assigned to the individual groups from LDAP. This field’s detail contains a setting for whether all records falling under the given path will be loaded, or only objects falling under a particular objectClass. The +Add Group DN path button is used to add a further path from which groups will be loaded. Filtering by objectClass can be set for each new path.
Unique identifier – the value that is loaded from LDAP into CDESK and on the basis of which the user will be synchronised. This identifier stays the same even when the user’s login and other personal details change in the LDAP software.
If you use Active Directory, we recommend leaving the GUID attribute option selected. Once accounts have been created successfully, the GUID attribute is transferred to the newly created user in the External ID item on the General settings tab in the CDESK account settings.
If the data in the LDAP software is loaded from another system, select the Custom attribute option. When this option is selected, a field for entering the attribute appears. We recommend using an attribute similar to the objectGUID attribute used in Active Directory. The reason is so that the user is uniquely identified throughout the whole existence of the AD account.
Attribute containing the UID – we recommend using the value sAMAccountName, but if necessary another value can be entered, as long as it does not contain spaces. Once the account has been created in CDESK, this value is pre-filled as the Username. (This value can be found on the General settings tab in Users and groups->Users->the particular user.)
Pairing by e-mail – if the switch is in the on position 
, new accounts will not be created for users who have the same e-mail in CDESK as in Active Directory. If you leave the switch in the off position 
during synchronisation, duplicate accounts will be created even for users who are already registered. Switching it back on during a later synchronisation will not remove the duplicate accounts. We therefore recommend switching it on at the very first synchronisation.
Evaluation of the user’s disabled state – the attribute on the basis of which the user’s state (active / inactive) is evaluated. In AD the userAccountControl attribute is normally used for this. So if you do not use custom settings, select this option. No further settings are made when this option is selected, because CDESK recognises the code for an active and an inactive user automatically. If you use your own parameter for evaluating the user’s state, select the Custom attribute option. In that case a field appears for entering the attribute that will be used to evaluate the state.
Attribute containing the group name – enter the attribute on the basis of which the group name will be shown. We recommend choosing the value name, or sAMAccountName. This name will also be shown below in the section Condition for assignment to a group.
Condition for assignment to a group – This setting appears only after the connector has been saved. You save the settings by clicking the save icon, which is on the bar on the right and also at the end of the form. Once the settings have been saved, synchronisation with the LDAP software then needs to be carried out. The Synchronize icon, which is on the bar on the right and also at the end of the form, is used for that.
Once synchronisation has succeeded, this section shows the groups belonging under the path entered in the Group DN path field, and next to each of them a field for setting the user group in CDESK. In CDESK, accounts are created only for users belonging under the LDAP groups shown in this list. Any user group registered in CDESK can be selected for an LDAP group, and several CDESK groups can be assigned to one LDAP group. In that case the users receive the permissions belonging to all the selected CDESK groups.
For the Condition for assignment to a group setting, the following options can be selected: Without restriction and Only when the user is created.
- Without restriction – when this option is selected, the chosen groups will be synchronised with every synchronisation of the AD/LDAP connector. For example, a user belonging under a particular group in LDAP has the Operators group set in CDESK. They are then removed from that CDESK group. At the next synchronisation of the AD/LDAP connector they will automatically be assigned to the Operators group again, because users from that LDAP group are assigned to the Operators group. If a different CDESK group is set for that LDAP group, at the next synchronisation the user will be assigned to that group together with the corresponding permissions in CDESK.
- Only when the user is created – when this option is selected, the user is assigned to the CDESK group only when created and their group membership will not be updated any further.
You can add a further LDAP group to the list of groups shown using the +Add monitored group button. After clicking, a list of the available groups appears. Clicking the group name and then the Add button places the LDAP group in the list of groups to which CDESK groups can be assigned. You can remove a group from the list using the 
icon at the end of each row.
If you do not register groups in the LDAP software, or you want to add all users regardless of their group membership, click the +Add monitored group button and select the No group specified option.
Assigning a customer to a user by attribute – use this setting if you want a customer to be assigned automatically to newly created users in CDESK. This allows the users to enter requests, for example. After clicking the +Add rule button, a row with the following fields appears:
- CDESK company – after clicking, a selector with the list of companies registered in CDESK appears. Select the customer that will be assigned to the selected users. The list of companies registered in CDESK can be found in Address book -> Companies.
- LDAP attribute – any attribute in the LDAP software on the basis of which CDESK will evaluate whether the selected company is assigned to the users. If you want to assign the company to all newly created users and those users have no LDAP attribute in common, we recommend entering the value userAccountControl.
- Value obtained – the value of the selected LDAP attribute which, if met, means that the company that has been set is assigned automatically to users with that value. When choosing the LDAP attribute userAccountControl we recommend using the value 66048 and / or 512. These are the standard values in AD. 66048 denotes users whose password does not expire, and 512 users whose password expires.
So that a company can be assigned on the basis of two or more values of an LDAP attribute, a new rule has to be defined for each value. You again define it using the +Add rule button. In this way you can also define the assignment of users to a different company in CDESK on the basis of any LDAP attribute and its values. If you need to remove a rule, click the icon at the end of that rule’s row.
Assigning a manager by attribute – use this setting if you want a manager to be assigned automatically to newly created users in CDESK. This might be the company manager, for example. After clicking the +Add rule button, a field appears for entering the LDAP attribute which, if the user / users in the LDAP software meet it, means they are assigned as managers to the newly created accounts. It can be any attribute. It is also possible to add several rules for adding a manager. If you need to remove a rule, click the icon at the end of that rule’s row.
You will find the list of managers for a particular account in Users and groups -> Users -> the particular user -> the Managers and subordinates tab -> the Managers section.
Assigning a job position by attribute – use this setting if you want job positions to be assigned automatically to newly created users in CDESK. After clicking the +Add rule button, a row with the following fields appears:
- Job position – after clicking, a selector of the job positions registered in CDESK appears. Job positions can be created in Global settings -> Job positions -> Defining job positions.
- LDAP attribute – any attribute in the LDAP software on the basis of which CDESK will evaluate whether the selected job position is assigned to the users. If you want to assign the job position to all newly created users and those users have no LDAP attribute in common, we recommend entering the value userAccountControl.
- Value obtained – the value of the selected LDAP attribute which, if met, means that the job position that has been set is assigned automatically to users with that value. When choosing the LDAP attribute userAccountControl we recommend using the value 66048 and / or 512. These are the standard values in AD. 66048 denotes users whose password does not expire, and 512 users whose password expires.
So that a job position can be assigned on the basis of two or more values of an LDAP attribute, a new rule has to be defined for each value. You again define it using the +Add rule button. In this way you can also define the assignment of users to a different job position in CDESK on the basis of any LDAP attribute and its values. If you need to remove a rule, click the icon at the end of that rule’s row.
Automatic attribute pairing
The settings on this tab only become available after the connector has been saved. The tab makes it possible to define rules for filling in further user parameters automatically.
By default the list contains the properties that are mandatory.
Full name – enter the LDAP attribute on the basis of which the user form fills in the field Full name. Any attribute can be entered. We recommend, however, using the attribute displayName.
Abbreviation for listings – enter the LDAP attribute on the basis of which the user form fills in the field Abbreviation for listings. For CDESK it is recommended that the Abbreviation for listings is the same as the user’s login. Any attribute can be entered. We recommend, however, using the attribute sAMAccountName
Contact e-mail – enter the LDAP attribute on the basis of which the user form fills in the field Contact e-mail. Any attribute can be entered. We recommend, however, using the attribute mail.
If necessary, automatic pre-filling can be set up for the fields Phone and Mobile. If you have further additional properties set for users in your CDESK environment, it will be possible to add those as well. They must, however, be properties set globally for all users, which you can add in Global settings -> Users -> the section Additional properties.
To add one of these properties, click the +Add rule button for the property, which is below the current list of properties.
After clicking, a field for selecting the property appears. You select the property you want by clicking it and then click the button Add. The property is then placed in the list and a field appears next to it for entering the corresponding LDAP attribute. If you want to remove a property added in this way from the list, click the icon , which is at the end of that property’s row. Only those attributes that are not mandatory can be removed.
Authentication to CDESK
The tab makes it possible to set how newly created users will authenticate when logging in to CDESK. More information about configuring login to CDESK can be found below in the section Setting the login method for CDESK.
State – the selector offers the following options:
- Off – the option filled in by default. In that case the fields for further settings are not shown. Use the Off state if you register several domains in the AD connector, as a result of which the login details of newly created users will also contain several domains.
- Microsoft AD – use this if you register all users in AD under a single domain. When this option is selected, further fields for configuring that domain’s server become available.
Server name/IP address – in the first field enter the name or the IP address of the server, and in the second field enter the port number.
Secure connection – so that the connection is secure, set the switch to the on position and, if necessary, upload the certificate using the Upload file button.
Account suffix – the domain name in the form @domain.domain. It will be possible to select this name on the CDESK login screen if you have the manual connector selection method set.
Secondary server – if you use several AD servers, in this section you can configure logging in via a secondary server, which will be used if the primary one fails. By default the Off option is set in the state field. To configure a secondary server, select the Microsoft AD option and configure the data in the fields shown in the same way as for the primary server, but with the secondary server’s details.
Transferring the organisational structure from the company into CDESK
On the Organisational structure tab it is possible to configure the details of the server from which the company’s organisational structure is loaded. According to an account’s placement in the organisational structure, records can be filtered in lists and included in exports.
Once the users have been created, this organisational structure will be shown graphically on the Organisational structure tab in the user form. (Groups and users -> Users -> the particular user -> the Organisational structure tab). The path with a particular user’s placement in the organisational structure is also shown in the list of requests, fulfilments and work orders.
Enabled – the switch is in the off position by default . Set the switch to the on position if your company’s organisational structure is registered on a different server from the one you entered on the Basic settings tab. Setting the switch to the on position makes the fields for configuring the server parameters available. Entering the parameters works in the same way as on the Basic settings tab.
Setting the login method for CDESK
Users with automatically created accounts can log in to CDESK in two ways. Either with their login details from AD or with their CDESK login details.
The login method can be set in Global settings -> Logos, domain, files -> in the AD connector selection method section.
The selector offers the following options:
- Automatically – use this if you register several domains (account suffixes) in AD. In that case the user will log in with a login in the form: user@domain.local. The connector is selected automatically according to the domain suffix in the login name, so there is no need to select the AD connector type when logging in.
- Manually – use this if you selected the Microsoft AD state on the Authentication to CDESK tab when configuring the AD / LDAP connector. In that case the user selects the connector type when logging in.
