9.4.1. When to Use LDAP Mapping

Engineering Knowledge Manager

Installation Guide | Chapter 9: Configuring Login Authentication and Access Settings | 9.4. LDAP Mapping |

9.4. LDAP Mapping |  | 9.4.2. Configuring LDAP Mapping
Prev |  | Next

### 9.4.1. When to Use LDAP Mapping

LDAP mapping can be used to improve the integration of EKM with your existing infrastructure.

There are two scenarios where LDAP mapping is useful:

1. Logging in to EKM using an alternate authentication identity, such as an email address.

2. Synchronizing user account information from LDAP to EKM.

#### 9.4.1.1. Logging in to EKM Using an Alternate Authentication Identity

This scenario involves using LDAP mapping for the EKM user name.

When LDAP mapping is enabled for the EKM user name, the following sequence takes place when the user logs in:

1. The user provides an authentication identity to login to EKM.

2. The authentication identity is used to authenticate to either LDAP or the Operating System (OS).

3. If the login is successful, EKM queries the LDAP directory server for the alternate authentication identity using the LDAP mapping that is defined.

4. The user is logged in to EKM using the alternate authentication identity, if defined in LDAP, or using the original authentication identity, if not.

   Recall that the authentication identity is used for both the EKM user name and the Operating System (OS) account name. The OS account name is used to run RSM jobs and must be a valid OS account name. LDAP mapping allows the user to authenticate to an LDAP directory server using an alternate authentication identity such as an email address, and to use another authentication identity as their EKM user name and OS account name.

   Example 9.1: LDAP Mapping shows a user who logs in to EKM using the email address `joe.adams@yourdomain.com`, but whose OS account is `jadams`. The authentication identity used to authenticate to LDAP is the email address. LDAP mapping then maps the authentication identity to a different value, which matches the user’s OS account name. This is the authentication identity that is used as the EKM user name and as the OS account name for running RSM jobs.

   You do not need to use LDAP mapping for the EKM user name if:

   - You are using LDAP to authenticate logins but are using a value such as `uid` that already corresponds to the OS account name.

   - You are using `WindowsLoginModule` or `LinuxLoginModule`, because the authentication identity being used to login will be a valid OS account that can run RSM jobs.

#### 9.4.1.2. Synchronizing User Account Information

This scenario involves using LDAP mapping to synchronize EKM user profile attributes with LDAP. Supported attributes include the EKM user first name, last name, email address, title, and phone.

When LDAP mapping is enabled for any of these attributes, EKM queries the LDAP directory server for the attributes when the user logs in, according to the LDAP mappings that are defined for the attributes. The EKM user profile is synchronized with the data from LDAP for any attributes it successfully queries.

The ability to synchronize user account information from LDAP to EKM allows improved integration with your LDAP directory server, and simplifies user administration.

Contains proprietary and confidential information of ANSYS, Inc. and its subsidiaries and affiliates.

Prev | Up / Contents | Next

Release 18.2 - © ANSYS, Inc. All rights reserved.