Active Directory Linkage Overview
On-premise CAMServer Enterprise makes ID authentication very easy by providing Active Directory linkage. The following can be achieved
- Web App VersionActive Directory Authentication ID is initially displayed during login authentication when using
- Passwordless authentication and OS passwords can be used for ID authentication.
- CAMServer uses Active Directory's LDAP protocol to determine if identity authentication is successful.
Active Directory ID Linkage
When Active Directory ID Linkage is enabled, the login ID is automatically set if the user is Active Directory authenticated.
The login ID can be set automatically by Web App Version only.
Authentication method
Before saving this setting, be sure to complete the LDAP settings first and perform "Test LDAP Settings".
After enabling Active Directory ID linkage, you can optionally select "Passwordless Authentication" or "OS Password Authentication".
*If you want to strengthen authentication, select "OS password authentication".
Passwordless Authentication
The information that can be obtained when an AD login is already in place is encrypted and used as an authentication token, enabling service login without a password. AD user settings for proxy authentication are required.
interpoint (interword separation)If this setting is activated, access will only be available in the Web App version.
・Before saving this setting, click "Active Directory user list”, check the UserPrincipalName of the user who will be the administrator, and create a user account on Chat&Messenge first.
is needed. Also, be sure to grant administrator privileges to that user.
interpoint (interword separation)If you do not create the above user, no one will be able to change the settings and will not be able to log in.
If you are in the early stages of installation, you will need to delete the installed CAMServer folder and reinstall.
OS Password Authentication
The OS password is used for user authentication.
LDAP Settings
LDAPUrl
By default, ldap is enabled on the ActiveDirectory server on port 389.
Specify the address and port in LDAPUrl as necessary. If left blank, access will be made via ldap://localhost:389.
LDAPBaseDN
LDAPBaseDN is a value that indicates where on the object tree of the LDAP server the user search will be performed.
If left blank, the domain will be referenced from the user ID and set automatically. If you want to change it, you can enter multiple entries by entering a line break. Also, even if set, the default "CN=Users, DC=yourdomain, DC=com" will be added automatically.
For example, when searching for a user named user1@camtest.com, the LDAPBaseDN is "CN=Users, DC=camtest, DC=com", which is the default search target, so there is no need to specify it. If you have created a folder other than Users and added a user there, specify the LDAPBaseDN if you want to use it as the search target.
Testing LDAP Settings
Please perform "Test LDAP Settings" before saving LDAP settings.
Active Directory synchronization settings
When Active Directory synchronization settings are enabled, information will be retrieved from Active Directory at the specified time and user information in Chat&Messenger will be updated.
The information to be updated is below.
- Username...AD displayName attribute
- Group name...AD department attribute
- Email・・・AD email attribute
FAQ
Can I create a user that does not exist in Active Directory?
If you do not select "Passwordless" as the authentication method, you can create an account on the Chat&Messenger user management screen and log in even if the user does not exist in Active Directory.
Can I synchronize with Active Directory to automate user addition?
Currently, Chat&Messenger does not automatically add or delete users based on Active Directory users. Therefore, even if Active Directory linkage is enabled, the administrator must create Chat&Messenger users using the user registration screen on the management screen or by uploading CSV.
 |  *CSV upload only adds/changes Chat&Messenger users and does not delete them. Please delete one item at a time from the management screen. |
I want to get a list of Active Directory users and create a CSV.
You can obtain a list of Active Directory users using PowerShell's Get-ADUser. of this list UserPrincipalName Please create a CSV file using the User ID (work email address) on Chat&Messenger.
> Get-ADUser -Filter {objectClass -eq "user"} -Properties info
DistinguishedName : CN=user1,CN=Users,DC=***,DC=com
GivenName : ユーザ１
Name : user1
ObjectClass : user
ObjectGUID : bf84cdab-2c21-44cf-aaca-afe493d97f2a
SamAccountName : user1
SID : S-1-5-21-3698402442-2374923176-*****-1104
Surname : ユーザ１
UserPrincipalName : user1@***.com
DistinguishedName : CN=user2,CN=Users,DC=***,DC=com
GivenName : user2
Name : user2
ObjectClass : user
ObjectGUID : 482450a4-482a-40ac-b89b-434605f45571
SamAccountName : user2
SID : S-1-5-21-3698402442-2374923176-*****-1105
Surname : テスト
UserPrincipalName : user2@***.com
DistinguishedName : CN=user3,CN=Users,DC=***,DC=com
GivenName : User3
Name : user3
ObjectClass : user
ObjectGUID : a94c17b7-4e38-4cef-bc1d-c22feb31be75
SamAccountName : User3
SID : S-1-5-21-3698402442-2374923176-*****-1108
Surname :
UserPrincipalName : user3@***.com