Profile Settings

The Profiles tab is used to define profiles for the LDAP Synchronization Tool. For more information about profiles, see Profiles.

The list at the top of the tab shows all the profiles, which have been defined, and allows you to enable or disable each profile by selecting or clearing their corresponding checkboxes, respectively.

For more information about how to perform a test run or validate a profile, see Use LDAP Synchronization Tool.

Profiles > Options (tab)

The Profiles > Options tab defines the profile description and other main settings for each profile.

When the Update users option is used, keep in mind that the LDAP Synchronization Tool does not support password synchronization for existing users. Any attempts to do so will fail. For more information, see Password mapping.

Profiles > LDAP (tab)

The Profiles > LDAP tab allows you to define the location and logon details of the source LDAP data source used to synchronize the OneSpan Authentication Server data store with.

Profiles > OAS (tab)

Use the Profiles > OAS tab to define the location and login details of the OneSpan Authentication Server data store that is synchronized with the LDAP data source.

Profiles > Filters and mapping (tab)

Use the Filters section to restrict the source LDAP user information that is synchronized with the destination OneSpan Authentication Server data store. Click Add to define an LDAP attribute and specify a value.

The LDAP attribute can either be entered manually or selected from a drop-down list. This drop-down list is populated with the LDAP attributes previously specified for all filters in all profiles.

For example, you may select the user ID LDAP attribute from the drop down menu. If you enter 12345* in the value, every user ID that starts with the numbers 12345 will be selected for synchronization.

If you add more than one filter element for a single profile, the filters run in AND mode (i.e. both attributes must comply).

Use the Mappings process to map the fields to be synchronized from the different data sources. Click Add to define an LDAP attribute and match it with a OneSpan Authentication Server attribute.

The LDAP attribute can either be entered manually or selected from a drop-down list. The drop-down list is populated with the LDAP attributes previously specified for all mappings in all profiles.

You can define actual values instead of selecting an LDAP attribute. The value supplied must be defined in double quotes. For example, “12345”, or “abc”.

The OneSpan Authentication Server attribute can be selected from a drop-down list.

You cannot map multiple LDAP attributes to one OneSpan Authentication Server attribute.

The User ID field in the destination data store must always have an LDAP attribute mapped to it. Fixed values cannot be used. The following fields must have either fixed valid values assigned to them, or an LDAP attribute which contains valid values for the field:

• Offline Authentication Enabled (valid values are Default, No, Yes)

• back-end authentication (valid values Default, None, If Needed, Always)

• Local Authentication (valid values Default, None, Digipass/Password, Digipass Only, Digipass or Password)

Unsupported characters for the User ID and User Name fields are automatically replaced with the underscore character (_).

Failure to provide a valid value for these fields will result in them being defined with the value Default, regardless of the mapped value.

Users can be linked to other users by supplying the Linked user's domain and the Linked user ID fields. Both fields must have values supplied, either by having an LDAP attribute mapped to them, or by supplying a fixed value.

If the  field Disabled  is mapped, then this will control whether the associated User is created in enabled or disabled state. If this field is not mapped, then the Enable created users option takes precedence, and whatever is set on that option is applied.

For boolean fields, the following values are treated as FALSE:

• "no"

• "off"

• "false"

• "disabled"

Anything empty or consisting only of zeros and spaces is treated as FALSE, anything else is treated as TRUE. Refer to the following table for available fields and associated data types and values.

For both the Filters and Mappings sections, highlight an existing definition and click Edit to edit the details for that process.

Similarly, highlight an existing definition and click Delete to delete a definition.

LDAP Synchronization Tool searches the entire directory (if a filter is not used, all objects of the selected organization structure will be considered for synchronization). OneSpan does not recommend mirroring the entire directory to the one database. Synchronization should be restricted to users only (it will not affect the structure of the domains). This can be done by filtering the LDAP field ObjectCategory and the value Person.