Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry UEM 12.20
  3. UEM Configuration Guide
  4. Connecting to your company directories
  5. Connect to an LDAP directory

Connect to an LDAP directory

The task below applies to a
UEM
 on-premises environment. In a
UEM Cloud
 environment, install and configure the BlackBerry Connectivity Node to connect to your company directory.
  • Create an LDAP account for
    UEM
     that is located in the relevant LDAP directory. The account must meet the following requirements:
    • The account must have permission to read all users in the directory.
    • The password must be configured not to expire and does not need to be changed at the next login.
  • If the LDAP connection is SSL encrypted, verify that you have the server certificate for the LDAP connection and that the LDAP server supports TLS 1.2. If SSL is enabled, the LDAP connection to
    UEM
     must use TLS 1.2.
  • Verify the LDAP attribute values that your organization uses (the steps below give examples for typical attribute values), you will use them in the steps below.
  1. In the
    UEM
     management console, on the menu bar, click
    Settings > External integration > Company directory
    .
  2. Click The add icon
    > LDAP connection
    .
  3. In the
    Directory connection name
     field, type a name for the directory connection.
  4. In the
    LDAP server discovery
     drop-down list, do one of the following:
    • To automatically discover the LDAP server, click
      Automatic
      . In the
      DNS domain name
       field, type the domain name for the server that hosts the company directory.
    • To specify a list of LDAP servers, click
      Select server from list below
      . In the
      LDAP server
       field, type the name of the LDAP server. To add more LDAP servers, click The add icon.
  5. In the
    Enable SSL
     drop-down list, perform one of the following actions:
    • If the LDAP connection is SSL encrypted, click
      Yes
      . Beside the
      LDAP server SSL certificate
       field, click
      Browse
       and select the LDAP server certificate.
    • If the LDAP connection is not SSL encrypted, click
      No
      .
  6. In the
    LDAP port
     field, type the TCP port number for communication. The default values are 636 for SSL enabled or 389 for SSL disabled.
  7. In the
    Authorization required
     drop-down list, do one of the following:
    • If authorization is required for the connection, click
      Yes
      . In the
      Login
       field, type the DN of the user that is authorized to log in to LDAP (for example, an=admin,o=Org1). In the
      Password
       field, type the password.
    • If authorization is not required for the connection, click
      No
      .
  8. In the
    User search base
     field, type the value to use as the base DN for user information searches.
  9. In the
    LDAP user search filter
     field, type the LDAP search filter that is required to find user objects in your organization's directory server. For example, for an
    IBM Domino Directory
    , type
    (objectClass=Person)
    .
  10. In the
    LDAP user search scope
     drop-down list, do one of the following:
    • To search all objects following the base object, click
      All levels
      . This is the default setting.
    • To search objects that are one level directly following the base DN, click
      One level
      .
  11. In the
    Unique identifier
     field, type the name of the attribute that uniquely identifies each user in your organization's LDAP directory (must be a string that is immutable and globally unique). For example,
    dominoUNID
    .
  12. In the
    First name
     field, type the attribute for each user’s first name (for example,
    givenName
    ).
  13. In the
    Last name
     field, type the attribute for each user’s last name (for example,
    sn
    ).
  14. In the
    Login attribute
     field, type the login attribute to use for authentication (for example,
    uid
    ).
  15. In the
    Email address
     field, type the attribute for each user's email address (for example,
    mail
    ). If you do not set the value, a default value is used.
  16. In the
    Display name
     field, type the attribute for each user's display name (for example,
    displayName
    ). If you do not set the value, a default value is used.
  17. In the
    User Principal Name
     field, type the user principal name for SCEP (for example,
    mail
    ).
  18. In the
    Department
     field, type the attribute for each user's department.
  19. In the
    Job Title
     field, type the attribute for each user's job title.
  20. If you want to synchronize additional fields from the LDAP directory, select the
    Synchronize additional user details
     check box. Type the attributes for the additional fields as necessary.
  21. To enable directory-linked groups for the directory connection, select the
    Enable directory-linked groups
     check box.
    1. In the
      Group search base
       field, type the value to use as the base DN for group information searches.
    2. In the
      LDAP group search filter
       field, type the LDAP search filter that is required to find group objects in your company directory. For example, for
      IBM Domino Directory
      , type
      (objectClass=dominoGroup)
      .
    3. In the
      Group Unique Identifier
       field, type the attribute for each group's unique identifier. This attribute must be immutable and globally unique (for example, type
      cn
      ).
    4. In the
      Group Display name
       field, type the attribute for each group's display name (for example, type
      cn
      ).
    5. In the
      Group Membership attribute
       field, type the name of the attribute for group membership. The attribute values must be in DN format (for example,
      CN=jsmith,CN=Users,DC=example,DC=com
      ).
    6. In the
      Test Group Name
       field, type an existing group name for validating the group attributes specified.
    7. If you want to enable paged searching for group members, select the
      Enable paged group search
       check box.
  22. Click
    Save
    .
  23. Click
    Close
    .
  • If you remove a directory connection, all users that were added to
    UEM
     from that directory will be converted to local users. Once users are converted to local users they can't be converted back to directory linked users, even if you later re-add the company directory connection. Users will continue to function as local users but
    UEM
     will not be able to synchronize updates from the company directory.