Authentication setup

1. Overview

The IoT application supports two authentication methods:

  1. Database Authentication – local users stored in the application’s internal database

  2. LDAP Authentication – external user management via LDAP-compatible directory services (e.g., Active Directory, OpenLDAP)

Note: All LDAP configuration is done via dist/bin/app.env environment variables.

2. Configuring LDAP in app.env

Set the following variables in bin/app.env:

# LDAP server connection
LDAP_URL=ldap://ftl.local:389
LDAP_BASE_DN=dc=ftl,dc=local
LDAP_USER_DN=cn=user,dc=ftl,dc=local
LDAP_PASSWORD=DaBu45689

# User search
LDAP_USER_SEARCH_BASE=ou=users
LDAP_USER_SEARCH_FILTER=(uid={0})

# Group search
LDAP_GROUP_SEARCH_BASE=ou=groups
LDAP_GROUP_SEARCH_FILTER=(member={0})

# Role mappings
LDAP_ROLE_ADMIN=admin
LDAP_ROLE_ADMIN33=Admin 33 group
LDAP_ROLE_USER=user
LDAP_ROLE_LIMITED=limited
LDAP_ROLE_CSR=csr

# Domain mappings
LDAP_DOMAIN_SUPER=Super domain

3. LDAP Variable Descriptions

Variable Description

LDAP_URL

LDAP server address and port (e.g., ldap://ftl.local:389)

LDAP_BASE_DN

Base distinguished name for all LDAP queries (e.g., dc=ftl,dc=local)

LDAP_USER_DN

Service account DN used to bind to LDAP (e.g., cn=user,dc=ftl,dc=local)

LDAP_PASSWORD

Password for the service account used to connect to LDAP

LDAP_USER_SEARCH_BASE

Subtree relative to base DN where user accounts are searched (e.g., ou=users)

LDAP_USER_SEARCH_FILTER

Filter to locate users (e.g., (uid={0}))

LDAP_GROUP_SEARCH_BASE

Subtree relative to base DN where groups are searched (e.g., ou=groups)

LDAP_GROUP_SEARCH_FILTER

Filter to locate groups (e.g., (member={0}))

LDAP_ROLE_ADMIN

Maps LDAP group to application role admin

LDAP_ROLE_ADMIN33

Maps LDAP group to application role Admin 33 group

LDAP_ROLE_USER

Maps LDAP group to application role user

LDAP_ROLE_LIMITED

Maps LDAP group to application role limited

LDAP_ROLE_CSR

Maps LDAP group to application role csr

LDAP_DOMAIN_SUPER

Maps LDAP domain/group to application domain Super domain

4. Startup Instructions

  1. Open bin/app.env and set all LDAP variables correctly.

  2. Make sure APP_HOME points to your dist folder.

  3. Start the application:

# Unix/Mac
./start.sh

# Windows
start.cmd

5. Verification

  • Log in with a test LDAP user.

  • Check $APP_HOME/logs/ for LDAP connection success messages:

INFO  com.friendly.ldap.LdapAuthentication - Connected to LDAP server ldap://ftl.local:389
INFO  com.friendly.ldap.LdapAuthentication - User 'testuser' authenticated successfully

  • Errors will appear in the same log if credentials or search filters are incorrect.

← Back | Home