LDAP integration allows System Administrators to link an already existing User Data Base to their Nx Witness System for access and rights management.
Instructions on how to integrate and configure an LDAP Server can be found here.
Question: Why an IP address cannot be used when configuring LDAP in the Desktop Client?
Answer: Nx Witness supports the FQDN* standard.
Question: Can a System be set to periodically poll LDAP for changes/updates?
Answer: The Media Server attempts to synchronize with LDAP/AD server once every 10 minutes by default.
Question: Why are LDAP users unable to login to the Web Client until they have successfully logged into the Desktop Client one time?
Answer: This is currently the way the solution works but we have plans to modify it an upcoming release to make it simpler to use.
Question: When configuring LDAP integration, I cannot specify the domain's base DN as a search base, but can specify OU's underneath the base DN. Why?
Answer: You cannot filter on OU membership, but you can filter on group membership. To retrieve all users that are members of a specified group, filter on the memberOf attribute.
Question: Does VMS keep LDAP passwords?
Answer: No, for security reasons.
Question: Does an LDAP Server have to be a part of a Local Network together with the Media Server?
Answer: No. An LDAP Server must be available for the Media Server rather on LAN or via WAN.
Question: Why cannot I see the LDAP "button" in the Desktop Client?
Answer: LDAP users with any role assigned are not allowed to modify LDAP Server settings. Basic concept is that if they accidentally modify these setting they will lose permission to connect.
Question: Why does LDAPS (LDAP over SSL) not work?
Answer: Most likely you'll be required to change certificates or to install certificates to both machines: LDAP Server and the Media Server.
Troubleshooting an LDAP Connection
Step 1: Test your LDAP Server with a 3rd Party LDAP Browser / Client
First, let's understand if an issue is related to Nx Witness. For that we recommend you to use an alternative LDAP Browser/Client to connect to your LDAP Server from the list below:
To install LDAP Utilities (Ubuntu):
sudo apt-get update && sudo apt-get install ldap-utils
A test query can look like the one below:
ldapsearch -LLL -x -H ldap://ad.my.domain.com:389 -s sub -D Administrator@my.domain.com -b CN=Users,DC=my,DC=domain,DC=com -w PaSsWoRd123 -o ldif-wrap=150
- URL: ldap://ad.my.domain.com
- port: 389
- DN of an admin: Administrator@my.domain.com or CN=Administrator,CN=Users,DC=my,DC=domain,DC=com
- Search Base: CN=Users,DC=my,DC=domain,DC=com
- password: PaSsWoRd123
A valid output would look something like this:
description: Default container for upgraded user accounts
If you manage to fetch / browse the information from your LDAP Server using the 3rd party Browser / Client please proceed to Step II.
Otherwise, we strongly encourage you to talk to your LDAP system administrator for further assistance before proceeding the Step 2 below.
Step 2: Gather Server Logs
*** If Step I was successful ***
- Elevate the main logging level of the media server to DEBUG2 (VERBOSE)
- Try to perform / re-create the same LDAP related operation you were unsuccessful with.
- Gather Server Logs and create a ticket via our Support Portal with the files attached.