diff --git a/docs/en-US/LDAP-for-user-authentication.xml b/docs/en-US/LDAP-for-user-authentication.xml
new file mode 100644
index 00000000000..61f204cf8f6
--- /dev/null
+++ b/docs/en-US/LDAP-for-user-authentication.xml
@@ -0,0 +1,42 @@
+
+
+%BOOK_ENTITIES;
+]>
+
+
+
+ Using an LDAP Server for User Authentication
+ You can use an external LDAP server such as Microsoft Active Directory or OpenLDAP to authenticate &PRODUCT; end-users.
+ To set up LDAP authentication in &PRODUCT;, open the global settings page and set:
+
+ ldap.basedn - The base directory you want to search within for uses
+ ldap.bind.password - The password you wish to use to bind, this can be blank if the server supports anonymous binding
+ ldap.bind.principal - The account you wish to use to bind, this can be blank if the server supports anonymous binding
+ ldap.email.attribute - The attribute within your LDAP server that holds a value for users email address
+ ldap.realname.attribute - The attribute within your LDAP server that holds a value users realname
+ ldap.user.object - The object class that identifies a user
+ ldap.username.attribute - The attribute within your LDAP server that has a value that will match the cloudstack accounts username field
+
+ Finally you can add LDAP servers from Global Settings -> Select View -> LDAP Configuration. This requires a hostname and port
+
+
+
+
+
diff --git a/docs/en-US/LDAPserver-for-user-authentication.xml b/docs/en-US/LDAPserver-for-user-authentication.xml
deleted file mode 100644
index 376631cbbc2..00000000000
--- a/docs/en-US/LDAPserver-for-user-authentication.xml
+++ /dev/null
@@ -1,39 +0,0 @@
-
-
-%BOOK_ENTITIES;
-]>
-
-
-
- Using an LDAP Server for User Authentication
- You can use an external LDAP server such as Microsoft Active Directory or ApacheDS to authenticate &PRODUCT; end-users. Just map &PRODUCT; accounts to the corresponding LDAP accounts using a query filter. The query filter is written using the query syntax of the particular LDAP server, and can include special wildcard characters provided by &PRODUCT; for matching common values such as the user’s email address and name. &PRODUCT; will search the external LDAP directory tree starting at a specified base directory and return the distinguished name (DN) and password of the matching user. This information along with the given password is used to authenticate the user..
- To set up LDAP authentication in &PRODUCT;, call the &PRODUCT; API command ldapConfig and provide the following:
-
- Hostname or IP address and listening port of the LDAP server
- Base directory and query filter
- Search user DN credentials, which give &PRODUCT; permission to search on the LDAP server
- SSL keystore and password, if SSL is used
-
-
-
-
-
-
-
diff --git a/docs/en-US/accounts.xml b/docs/en-US/accounts.xml
index aa62f680452..1c4454c6a3f 100644
--- a/docs/en-US/accounts.xml
+++ b/docs/en-US/accounts.xml
@@ -11,9 +11,9 @@
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
-
+
http://www.apache.org/licenses/LICENSE-2.0
-
+
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
@@ -25,5 +25,5 @@
Accounts
-
+
diff --git a/docs/en-US/example-LDAP-configuration-commands.xml b/docs/en-US/example-LDAP-configuration-commands.xml
deleted file mode 100644
index e557386c3ca..00000000000
--- a/docs/en-US/example-LDAP-configuration-commands.xml
+++ /dev/null
@@ -1,47 +0,0 @@
-
-
-%BOOK_ENTITIES;
-]>
-
-
-
-
- Example LDAP Configuration Commands
- To understand the examples in this section, you need to know the basic concepts behind calling the &PRODUCT; API, which are explained in the Developer’s Guide.
- The following shows an example invocation of ldapConfig with an ApacheDS LDAP server
- http://127.0.0.1:8080/client/api?command=ldapConfig&hostname=127.0.0.1&searchbase=ou%3Dtesting%2Co%3Dproject&queryfilter=%28%26%28uid%3D%25u%29%29&binddn=cn%3DJohn+Singh%2Cou%3Dtesting%2Co%project&bindpass=secret&port=10389&ssl=true&truststore=C%3A%2Fcompany%2Finfo%2Ftrusted.ks&truststorepass=secret&response=json&apiKey=YourAPIKey&signature=YourSignatureHash
- The command must be URL-encoded. Here is the same example without the URL encoding:
- http://127.0.0.1:8080/client/api?command=ldapConfig
-&hostname=127.0.0.1
-&searchbase=ou=testing,o=project
-&queryfilter=(&(%uid=%u))
-&binddn=cn=John+Singh,ou=testing,o=project
-&bindpass=secret
-&port=10389
-&ssl=true
-&truststore=C:/company/info/trusted.ks
-&truststorepass=secret
-&response=json
-&apiKey=YourAPIKey&signature=YourSignatureHash
-
- The following shows a similar command for Active Directory. Here, the search base is the testing group within a company, and the users are matched up based on email address.
-http://10.147.29.101:8080/client/api?command=ldapConfig&hostname=10.147.28.250&searchbase=OU%3Dtesting%2CDC%3Dcompany&queryfilter=%28%26%28mail%3D%25e%29%29 &binddn=CN%3DAdministrator%2COU%3Dtesting%2CDC%3Dcompany&bindpass=1111_aaaa&port=389&response=json&apiKey=YourAPIKey&signature=YourSignatureHash
- The next few sections explain some of the concepts you will need to know when filling out the ldapConfig parameters.
-
diff --git a/docs/en-US/example-activedirectory-configuration.xml b/docs/en-US/example-activedirectory-configuration.xml
new file mode 100644
index 00000000000..98ab5dae681
--- /dev/null
+++ b/docs/en-US/example-activedirectory-configuration.xml
@@ -0,0 +1,43 @@
+
+
+%BOOK_ENTITIES;
+]>
+
+
+
+
+ Example LDAP Configuration for Active Directory
+ This shows the configuration settings required for using ActiveDirectory
+
+ samAccountName - Logon name
+ mail - Email Address
+ cn - Real name
+
+ Along with this the ldap.user.object name needs to be modified, by default ActiveDirectory uses the value "user" for this.
+ Map the following attributes accordingly as shown below within the cloudstack ldap configuration:
+
+
+
+
+
+ add-ldap-configuration-ad.png: example configuration for active directory.
+
+
+
diff --git a/docs/en-US/example-openldap-configuration.xml b/docs/en-US/example-openldap-configuration.xml
new file mode 100644
index 00000000000..2b28032dfe4
--- /dev/null
+++ b/docs/en-US/example-openldap-configuration.xml
@@ -0,0 +1,44 @@
+
+
+%BOOK_ENTITIES;
+]>
+
+
+
+
+ Example LDAP Configuration for OpenLdap
+ This shows the configuration settings required for using OpenLDAP
+ The default values supplied are suited for OpenLDAP
+
+ uid - Logon name
+ mail - Email Address
+ cn - Real name
+
+ Along with this the ldap.user.object name needs to be modified, by default OpenLDAP uses the value "inetOrgPerson" for this.
+ Map the following attributes accordingly as shown below within the cloudstack ldap configuration:
+
+
+
+
+
+ add-ldap-configuration-openldap.png: example configuration for OpenLdap.
+
+
+
diff --git a/docs/en-US/images/add-ldap-configuration-ad.png b/docs/en-US/images/add-ldap-configuration-ad.png
new file mode 100644
index 00000000000..7d0aa0f44f9
Binary files /dev/null and b/docs/en-US/images/add-ldap-configuration-ad.png differ
diff --git a/docs/en-US/images/add-ldap-configuration-openldap.png b/docs/en-US/images/add-ldap-configuration-openldap.png
new file mode 100644
index 00000000000..c801275dbc9
Binary files /dev/null and b/docs/en-US/images/add-ldap-configuration-openldap.png differ
diff --git a/docs/en-US/query-filter.xml b/docs/en-US/query-filter.xml
deleted file mode 100644
index 1c0e493972d..00000000000
--- a/docs/en-US/query-filter.xml
+++ /dev/null
@@ -1,60 +0,0 @@
-
-
-%BOOK_ENTITIES;
-]>
-
-
-
-
-Query Filter
-The query filter is used to find a mapped user in the external LDAP server. The query filter should uniquely map the &PRODUCT; user to LDAP user for a meaningful authentication. For more information about query filter syntax, consult the documentation for your LDAP server.
-The &PRODUCT; query filter wildcards are:
-
-
-
-
- Query Filter Wildcard
- Description
-
-
-
-
- %u
- User name
-
-
- %e
- Email address
-
-
- %n
- First and last name
-
-
-
-
-The following examples assume you are using Active Directory, and refer to user attributes from the Active Directory schema.
-If the &PRODUCT; user name is the same as the LDAP user ID:
-(uid=%u)
-If the &PRODUCT; user name is the LDAP display name:
-(displayName=%u)
-To find a user by email address:
-(mail=%e)
-
diff --git a/docs/en-US/search-user-bind-dn.xml b/docs/en-US/search-user-bind-dn.xml
deleted file mode 100644
index a2d8b6a339c..00000000000
--- a/docs/en-US/search-user-bind-dn.xml
+++ /dev/null
@@ -1,47 +0,0 @@
-
-
-%BOOK_ENTITIES;
-]>
-
-
-
-
- Search User Bind DN
- The bind DN is the user on the external LDAP server permitted to search the LDAP directory within the defined search base. When the DN is returned, the DN and passed password are used to authenticate the &PRODUCT; user with an LDAP bind. A full discussion of bind DNs is outside the scope of our documentation. The following table shows some examples of bind DNs.
-
-
-
-
- LDAP Server
- Example Bind DN
-
-
-
-
- ApacheDS
- cn=Administrator,dc=testing,ou=project,ou=org
-
-
- Active Directory
- CN=Administrator, OU=testing, DC=company, DC=com
-
-
-
-