Schemus LDAP Synchronization Tool using Secure LDAP

Products

• Email Security.cloud

Issue/Introduction

You are using the Schemus LDAP Synchronization Tool and you have enforced strong authentication on your Active Directory which is preventing Schemus from being able to connect. 

Environment

Email Security.cloud

 

Resolution

For Schemus to work with the default configuration, it needs to connect using simple authentication. If you can change your Active Directory to allow simple authentication, this will immediately resolve the issue.

If you cannot make this change, you should be able to connect using simple/SSL. This protects the connection using SSL before initiating the simple authentication. Simple/SSL is the most flexible option - it should work across subdomains. If the Active Directory's certificate is signed by a well-known CA, you should be able to connect using SSL with no further changes.

The Active Directory's CA uses its own self-signed root CA certificate, you would see an error related to an invalid certification path. You will need to add Active Directory's root CA certificate to the Java certificate store. Typically this is saved in the Active Directory server in C:\server-name.crt. Copy this to the Schemus machine then import it into the java key store:

cd c:\Program Files\Schemus\jre\bin
keytool.exe -import -trustcacerts -alias ad-server-ca -file Z:\Certificates\CA\ad-server.crt -keystore ..\lib\security\cacerts

 

Assuming:

• the certificate has been copied to Z:\Certificates\CA\ad-server.crt
• you are using the version of Schemus which included a JRE
• you want to add the certificate to the JRE's cacerts file

The default keystore password is changeit

If you don't want to modify the JRE's copy of the certificate store, you can copy the cacerts file to C:\Program Files\Schemus\application\lib\security directory and rename it to 'schemus-cacerts'. Then, give this file as the keystore in the above command.