Default LDAP User Store Configuration

LDAP is one of many standards supported by the WSO2 Governance Registry. Read more on Supported APIs & Standards for a complete list of standards supported by WSO2 Governance Registry.

Following is the default configuration for the internal LDAP user store which is embedded ApacheDS LDAP. If ApacheDSUserStoreManager is enabled in user-mgt.xml with following configuration, user manager reads/writes into the default LDAP user store of carbon. It is also possible to configure user manager to work with an External LDAP User Store.

<UserStoreManager class="org.wso2.carbon.user.core.ldap.ApacheDSUserStoreManager">
<Property name="ReadOnly">false</Property>
<Property name="ConnectionURL">ldap://localhost:${Ports.EmbeddedLDAP.LDAPServerPort}</Property>
<Property name="ConnectionName">uid=admin,ou=system</Property>
<Property name="ConnectionPassword">admin</Property>
<Property name="passwordHashMethod">SHA</Property>
<Property name="UserNameListFilter">(objectClass=person)</Property>
<Property name="UserEntryObjectClass">wso2Person</Property>
<Property name="UserSearchBase">ou=Users,dc=wso2,dc=org</Property>
<Property name="UserNameSearchFilter">(&amp;(objectClass=person)(uid=?))</Property>
<Property name="UserNameAttribute">uid</Property>
<Property name="PasswordJavaScriptRegEx">[\\S]{5,30}</Property>
<Property name="ReadLDAPGroups">true</Property>
<Property name="WriteLDAPGroups">true</Property>
<Property name="EmptyRolesAllowed">true</Property>
<Property name="GroupSearchBase">ou=Groups,dc=wso2,dc=org</Property>
<Property name="GroupNameListFilter">(objectClass=groupOfNames)</Property>
<Property name="GroupEntryObjectClass">groupOfNames</Property>
<Property name="GroupNameSearchFilter">(&amp;(objectClass=groupOfNames)(cn=?))</Property>
<Property name="GroupNameAttribute">cn</Property>
<Property name="MembershipAttribute">member</Property>
</UserStoreManager>

The Main Properties of the User Store Configuration

Property Name	Description
`ReadOnly`	Indicates whether the user store of this realm operates in the user read only mode or not.
`ConnectionURL`	Connection URL to the LDAP server. In the case of default LDAP in carbon, port is mentioned in `carbon.xml` and a reference to that port is mentioned in the above configuration.
`ConnectionName`	This should be the DN (Distinguish Name) of the admin user in LDAP.
`ConnectionPassword`	Password of the admin user.
`passwordHashMethod`	Password Hash method when storing user entries in LDAP.
`UserNameListFilter`	Filtering criteria for listing all the user entries in LDAP.
`UserEntryObjectClass`	Object Class used to construct user entries. In the case of default LDAP in carbon, it is a custom object class defined with the name `wso2Person`.
`UserSearchBasev`	DN of the context under which user entries are stored in LDAP.
`UserNameSearchFilter`	Filtering criteria for searching a particular user entry.
`UserNameAttribute`	Attribute used for uniquely identifying a user entry. Users can be authenticated using their email address, UID and etc.
`PasswordJavaScriptRegEx`	Policy that defines the password format.
`ReadLDAPGroups`	Specifies whether groups should be read from LDAP.
`WriteLDAPGroups`	Specifies whether groups should be written to LDAP.
`EmptyRolesAllowed`	Specifies whether underlying LDAP user store allows empty groups to be created. In the case of LDAP in carbon, the schema is modified such that empty groups are allowed to be created. Usually LDAP servers do not allow to create empty groups.
`GroupSearchBase`	DN of the context under which user entries are stored in LDAP.
`GroupNameListFilter`	Filtering criteria for listing all the group entries in LDAP.
`GroupEntryObjectClass`	Object Class used to construct user entries.
`GroupNameSearchFilter`	Filtering criteria for searching a particular group entry.
`GroupNameAttribute`	Attribute used for uniquely identifying a user entry.
`MembershipAttribute`	Attribute used to define members of LDAP groups.