Skip to content
  • There are no suggestions because the search field is empty.

Working with LDAP and SSO

Map LDAP/AD to CourseMill, understand the login flow, and build single sign-on with userlogin.jsp.

CourseMill provides the connections to integrate with an LDAP/AD (Lightweight Directory Access Protocol/Active Directory) configuration to achieve single sign-on (SSO) and generate user accounts. This article describes how to map LDAP/AD to CourseMill, what happens when a user logs in, and how to create a single sign-on solution.

Before you begin

  • Configuration of LDAP/AD typically requires the client's Information Technology personnel to work directly with the ELB Learning CourseMill programming staff, because LDAP/AD configuration can vary based on your corporate policy.

Map LDAP/AD to CourseMill

To begin the development of a data map between LDAP/AD and CourseMill, configure the LDAP-related properties described below. For details about configuring properties, see System properties reference.

LDAP properties

  • LDAPAutoAddUsers – Specifies whether to allow newly authenticated users to be automatically added to the CourseMill database. Values:
    • 0 or No = Prevent new users from being added (default)
    • 1 or Yes = Allow new users to be added
  • LDAPBase – Specifies the base directory lookup string. Examples: OU=User Accounts, DC=US, DC=server, DC=net
  • LDAPConnectionsSSO – Specifies whether you are using LDAP solely for SSO (checking user name and password), but not for importing data. Value is Yes or No.
  • LDAPDisplayAsStudentID – Specifies which entry in the active directory is displayed in CourseMill as the student ID. Default: Field in ldapLDAPLookup.
  • LDAPDN – Specifies the Directory Name entry needed to log on to the active directory. Examples: CN=Administrator, CN=Users, DC=elblearningdevtest, DC=local
  • LDAPIgnorePassword – Only used in LDAP; you only need this when using LDAP with SSO. Value is Yes or No.
  • LDAPLookup – Specifies the field in the active directory entry to which the user login synchronizes. Default: uid.
  • LDAPOrgID – Specifies which entry in the active directory maps to the user's Org ID, or the default value to use for a new student's Org ID. Default: Field in the LDAP directory; if this is blank, see the notes below.

    Note:

    • If the OrgID property is left blank, CourseMill assumes there is only one Org ID in the database and loads users into that Org ID automatically.
    • If the property is left blank and there are multiple Org IDs in the database, CourseMill does not know what organization to put the user in and gives you an error.
    • If the property is left blank and a user who is already in the database under one of multiple organizations tries to authenticate, the user is still granted access, but CourseMill is not able to update any information in the user profile.
  • LDAPPassword – The password for the Directory Name.
  • LDAPPort – Specifies the port to access the Active Directory. Default: 389.
  • LDAPServer – Specifies the Active Directory server (either the IP address or domain name).
  • LDAPSubOrg0 – 15 – Specifies which entry in the Active Directory maps to the user's SubOrg values (optional).
  • LDAPUseActiveUser – Yes = only active LDAP users are used. No = all users are used. Value is Yes or No.
  • LDAPUseJNDI – Internal setting that tells CourseMill to use the Java Naming and Directory Interface when performing Active Directory validations instead of more traditional lookup methods. Default: Yes.

Example configurations

Example 1

LDAPServer = ldap-mi.server.com
LDAPPort = 389
LDAPDN = CN=COURSEMILL-QA,OU=Service Accounts,DC=US,DC=server,DC=net
LDAPConnectionsSSO = no
LDAPPassword = <password>
LDAPIgnorePassword = no
LDAPBase = OU=User Accounts,DC=US,DC=server,DC=net
LDAPLookup = sAMAccountName
LDAPDisplayAsStudentID = employeeID
LDAPOrgID = company
LDAPAutoAddUsers = true
LDAPUseActiveUser = yes

Example 2

LDAPServer = 192.168.0.21
LDAPPort = 389
LDAPDN = CN=Administrator,CN=Users,DC=elblearningdevtest,DC=local
LDAPConnectionsSSO = no
LDAPPassword = <password>
LDAPIgnorePassword = no
LDAPBase = CN=Users,DC=elblearningdevtest,DC=local
LDAPLookup = sAMAccountName
LDAPDisplayAsStudentID = userPrincipalName
LDAPOrgID = (blank)
LDAPAutoAddUsers = (blank)
LDAPUseActiveUser = yes

Example 3

LDAPServer = ldap-us.server.net
LDAPPort = 389
LDAPDN = CN=COURSEMILL-QA,OU=Service Accounts,DC=US,DC=server,DC=net
LDAPConnectionsSSO = no
LDAPPassword = <password>
LDAPIgnorePassword = no
LDAPBase = OU=User Accounts,DC=US,DC=server,DC=net
LDAPLookup = sAMAccountName
LDAPDisplayAsStudentID = employeeID
LDAPOrgID = bob
LDAPAutoAddUsers = true
LDAPUseActiveUser = yes

What happens when a user logs in

  1. When a user specifies his or her user ID, CourseMill first attempts to find that user ID in Active Directory. If it is not there, the user cannot sign in.
  2. If the user ID is correct, CourseMill checks the password that was entered to see if it matches the password in Active Directory. If not, the user cannot sign in.
  3. If the user ID and password authenticate in Active Directory, CourseMill checks to see if the user is active in Active Directory. If the user is not active, the user cannot sign in.
  4. If all attempts to authenticate pass without failure, and the user is not already in the database, CourseMill adds the user along with the email address and all SubOrg values, if passed by Active Directory.
  5. If all attempts to authenticate pass without failure, and the user is in the database, CourseMill updates the user information with the email address and all SubOrg values, if passed by Active Directory. It does not update any other fields that might have been manually added to that user (permissions, personal info, and so on).

Troubleshooting and testing

A good tool for testing and troubleshooting the connection strings for LDAP is http://jxplorer.org/. Use the Help provided with the tool for details about using it.

Create a single sign-on solution with CourseMill

You can create a single sign-on with CourseMill in one of two ways:

  • Pass the user's credentials to userlogin.jsp. Creating a single sign-on solution with CourseMill is as simple as passing a user's username and password to the CourseMill system. These variables, among many others, can be sent to the userlogin.jsp page on the CourseMill server.

    If a user is logged into the company intranet or portal, a link to CourseMill can be created that, once clicked, pulls the user's login information from the intranet or portal and passes it to CourseMill using either a GET or POST method. An example of passing a user's credentials using a GET method:

    http://yourcmserver.com/coursemill/userlogin.jsp?user=coursemilluser&password=mypassword &firstname=John&lastname=Smith

    This link logs John Smith into the CourseMill instance on http://yourcmserver.com.

    The parameters that can be passed to CourseMill through userlogin.jsp are listed below.

  • Use LDAP or SAML. When configured properly, the user gets authenticated against the Active Directory either through the web browser or through the company's infrastructure. CourseMill then pulls the attributes of the authenticated user out of the browser session. In all cases, the work to pull the user's credentials is actually accomplished in the userlogin.jsp file by using either SAML Authentication or Windows Active Directory Authentication. (When SAML – Security Authentication Markup Language – is used, the authentication method inserts a SAMLResponse token into the browser session.)

Required parameters

  • user – User ID of the person to log in.
  • password – Password of the person to log in.

Optional check for user in launched content parameter

  • checkIfUserInContent – If this parameter is passed, a check is made to see if CourseMill can detect whether the user already has launched content open. This parameter overrides all the following optional parameters.

Optional enrollment/launch parameters

  • courseCurrID – ID of the course or curriculum to be accessed (if not supplied, no enrollment/launch occurs).
  • currFlag – Flag that indicates whether the above field is a curriculum. Default: n.
  • enrollFlag – Flag that determines if the student should be auto-enrolled into this curriculum/course. Default: n.
  • enrollPwd – Access code for enrollment (if needed).
  • sessionID – Session ID (use to specify a particular session of the course for enrollment). This field is ignored if currFlag is set to y.

Optional registration parameters

If enrollment is desired, you need to pass firstName, lastName, and orgId.

  • orgId – Organization to enroll in (if your database has more than one).
  • firstName – First name of the user.
  • lastName – Last name of the user.
  • middleInitial – Middle initial (if one).
  • email – Email (if email is required).
  • regPwd – Registration password (if required for the organization).
  • newPwd – New password if the password is to be changed from the current password.
  • SubOrg0-15 – The SubOrg values.

Optional user profile parameters

  • fromSC – Flag that indicates where to go after login (checkout versus home screen).
  • address – The address of the user.
  • city – The city of the user.
  • state – The state of the user.
  • zip – The zip code of the user.
  • country – The country of the user.
  • phone – Phone number for the user.
  • SubOrg0-15 – Each of the SubOrg values (for example, SubOrg0, SubOrg1, SubOrg2, and so on).

Related articles