Active Directory

When using Microsoft Active Directory, you need to provide the following additional configuration:

Custom

FORMS_LDAP_AUTH_ACTIVE_DIRECTORY_DOMAIN=<domain>

Plain text
Copy

Make sure that the domain's value is the DNS name and not the NetBIOS domain name. For example, the NetBIOS name could be HSCORP while the DNS name is hscorp.hyperscience.com.

The bind to the AD server will be done using @, where is taken from what is typed into the username box during login.

Open LDAP

When using OpenLDAP or OpenLDAP-based solution you need to provide the following additional settings:

• Example: %username%@example.com

Custom

FORMS_LDAP_AUTH_USERNAME_FORMAT=bind dn pattern

Plain text
Copy

The value must be a string with a placeholder called “ %username%”.

When you log in to Hyperscience, this string is used to create a personalized bind DN by replacing “ %username%” with the username you type into the login box.

Optional Configurations

LDAP over TLS or LDAP over SSL

Hyperscience also allows you to configure LDAP over TLS (STARTTLS) or LDAP over SSL (LDAPS).

To configure STARTTLS, you need to set the following variables:

Custom

FORMS_LDAP_AUTH_USE_TLS=true
FORMS_LDAP_AUTH_URL=ldap://:389

Plain text
Copy

To configure LDAPS, you need to set the following variables:

Custom

FORMS_LDAP_AUTH_USE_TLS=false
FORMS_LDAP_AUTH_URL=ldaps://:636

Plain text
Copy

Advanced user filtering

By default, any users within FORMS_LDAP_AUTH_SEARCH_BASE and of the correct FORMS_LDAP_AUTH_OBJECT_CLASS will be considered valid users. You can apply further filtering by setting custom groups and user filters.

• Note that you can supply only one group when setting up. The filter appends ( memberOf=):

  • Example: cn=SpecialGroup,OU=hs_users,dc=example,dc=com
    Custom

  FORMS_LDAP_AUTH_GROUP_FILTER=<group>
  

  Plain text
  Copy

• When set up, the filter appends the value as an additional search filter. Example: ( sn=Smith):

Custom

FORMS_LDAP_AUTH_USER_FILTER=<additional user filter>

Plain text
Copy

• Hyperscience supports Complex Expressions as well if they are represented as valid RFC2254 filters. For example:

Custom

(|(sn=specialuser)(uid=34))

Plain text
Copy

Complex expressions are intricate search conditions in LDAP queries, incorporating logical operators and grouping. RFC2254 filters define how search criteria are structured in LDAP queries. Learn more at Datatracker (opens in new tab).

Search User

Hyperscience performs searches using the user who is currently logging in. However, there are situations where certain users have restrictions and cannot perform searches. In such cases, you have the option to designate an alternative user who will perform the searches instead.

• Example: cn=searchuser,ou=hs_users,dc=example,dc=com

Custom

FORMS_LDAP_AUTH_CONNECTION_USERNAME=
FORMS_LDAP_AUTH_CONNECTION_PASSWORD=

Plain text
Copy

Advanced user mapping

Hyperscience does not provide custom mappings for names, it always uses 'givenName' for the first name and 'sn' for the last name. Learn how to map authentication groups from your identity provider to Hyperscience permission groups in the “Managing Authentication Groups” article for your version of the product.

The following options should not be changed from their defaults unless there is an explicit environment requirement.

• Specifying the object class for users:

• Custom

  FORMS_LDAP_AUTH_OBJECT_CLASS= # defaults to 'user'
  

  Plain text
  Copy

• Specifying username attribute:

• Custom

  FORMS_LDAP_USERNAME_ATTRIBUTE_NAME= # defaults to 'sAMAccountName'
  

  Plain text
  Copy