Nav
You are viewing an older version of this section. Click here to navigate to the latest version.

LDAP Connector

The Lightweight Directory Access Protocol (LDAP) is a public standard that facilitates maintenance and access to distributed directories (such as network user privilege information) over an Internet Protocol (IP) network.

Many LDAP servers are included in free-use open source projects and packages. The particulars of installing, running and configuring LDAP servers fall outside the scope of this document.

This document provides an example of a simple LDAP connector configuration, including basic instructions for installing and connecting to an LDAP server using the LDAP connector. MuleSoft has designated the LDAP connector as a Select connector.

Prerequisites

To use the LDAP connector, you must have the following:

  • Access to either an OpenLDAP, Apache Directory or MicroSoft Active Directory Instance.

  • Anypoint Studio - Enterprise Edition.

This document assumes you are familiar with Mule, Anypoint Connectors, and Anypoint Studio Essentials. To increase your familiarity with Studio, consider completing one or more Anypoint Studio Tutorials. Further, this page assumes that you have a basic understanding of Elements in a Mule Flow and Global Elements.

Compatibility

The LDAP connector is compatible with:

Application/Service Version

Mule Runtime

3.7.0 or higher

Java

1.7.0_x or higher

Anypoint Studio

5.2 or higher

Installing and Configuring

To use the LDAP connector in a production environment, you must have either:

  • An Enterprise license to use Mule.

  • A CloudHub Starter, Professional, or Enterprise account.

Contact the MuleSoft Sales Team to obtain either of these. Read more about Installing an Enterprise License.

Installing

To install LDAP connector in Anypoint Studio, follow the steps below:

  • Open Anypoint Studio and go to Help > Install New Software.

  • Select Anypoint Connectors Update Site or http://repository.mulesoft.org/connectors/releases/3.5.0.

  • Locate and select the LDAP connector. Anypoint Studio Install Window

  • Click Next and accept the License Agreement.

  • Restart Studio when prompted.

  • Now, the LDAP connector should appear in your Studio Palette:

    Anypoint Studio palette - LDAP connector

Read more about Installing Connectors.

Configuring

To use the LDAP connector in a Mule application, you must configure a global LDAP configuration element that can be used by as many LDAP connectors as you require for your application.

Setting up the Global Configuration

Studio Visual Editor

  1. Click the Global Elements tab at the base of the canvas.

  2. On the Global Mule Configuration Elements screen, click Create.

  3. In the Choose Global Type wizard, expand Connector Configuration and select LDAP: Configuration and click Ok.

    Global Element Configuration Wizard

  4. Configure the parameters according to instructions below.

    Global Element Configuration

    Parameter Description

    Name

    Enter a name for the configuration to reference it.

    Principal DN

    The DN (distinguished name) of the user

    Password

    The password of the user

    URL

    The connection URL to the LDAP server

    Authentication

    Specifies the authentication mechanism to use. Default: Simple

  5. In the image above, the placeholder values refer to a configuration file placed in the src folder of your project. See Learn how to configure properties.

  6. You can either enter your credentials into the global configuration properties, or reference a configuration file that contains these values. For simpler maintenance and better re-usability of your project, Mule recommends that you use a configuration file. Keeping these values in a separate file is useful if you need to deploy to different environments, such as production, development, and QA, where your access credentials differ. See Deploying to Multiple Environments for instructions on how to manage this.

  7. Keep the Pooling Profile and the Reconnection tabs with their default entries.

  8. Click Test Connection to confirm that the parameters of your global configuration are accurate, and that Mule is able to successfully connect to your instance of Amazon S3. Read more about this in Testing Connections.

  9. Click OK to save the global connector configurations.

XML Editor

Ensure that you have included the LDAP namespaces in your configuration file.

+


          
       
1
2
3
4
5
6
7
8
9
10
11
<mule xmlns:http="http://www.mulesoft.org/schema/mule/http" xmlns="http://www.mulesoft.org/schema/mule/core" xmlns:doc="http://www.mulesoft.org/schema/mule/documentation"
        xmlns:spring="http://www.springframework.org/schema/beans"
  xmlns:ldap="http://www.mulesoft.org/schema/mule/ldap"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-current.xsd
http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd
http://www.mulesoft.org/schema/mule/http http://www.mulesoft.org/schema/mule/http/current/mule-http.xsd
http://www.mulesoft.org/schema/mule/ldap http://www.mulesoft.org/schema/mule/ldap/current/mule-ldap.xsd">

<!-- Put your flows and configuration elements here -->
</mule>

+ . Create a global element for LDAP configuration using the following global configuration code:

+


          
       
1
2
3
4
5
<ldap:config name="LDAP_Configuration" authDn="${config.principal.dn}" authPassword="${config.password}" url="${config.url}" doc:name="LDAP: Configuration">
    <ldap:extended-configuration>
        <ldap:extended-configuration key="java.naming.ldap.factory.socket">org.mule.module.ldap.security.BypassTrustSSLSocketFactory</ldap:extended-configuration>
    </ldap:extended-configuration>
</ldap:config>

+ . Save the changes made to the XML file.

Using the Connector

The LDAP connector is an operation-based connector, which means that when you add the connector to your flow, you need to configure a specific operation for the connector to execute. The connector currently supports the following operations:

Operation Description

Add multi-valued attribute

Adds a specific multi-valued attribute to an existing LDAP entry.

Add single-valued attribute

Adds a specific single-valued attribute to an existing LDAP entry.

Add

Creates a new LDAP entry.

Bind

Authenticates against the LDAP server. This occurs automatically before each operation but can also be performed on request.

Delete multi-valued attribute

Deletes specific multi-valued attribute to an existing LDAP entry.

Delete single-valued attribute

Deletes specific single-valued attribute to an existing LDAP entry.

Delete

Deletes an existing LDAP entry.

Exists

Checks whether an LDAP entry exists in the LDAP server or not.

Lookup

Retrieves a unique LDAP entry.

Modify multi-valued attribute

Updates specific multi-valued attribute of an existing LDAP entry.

Modify single-valued attribute

Updates specific single-valued attribute of an existing LDAP entry.

Modify

Updates an existing LDAP entry.

Paged result search

Performs an LDAP search and streams result to the rest of the flow.

Search one

Performs an LDAP search that is supposed to return a unique result.

Search

Performs an LDAP search in a base DN with a given filter.

Use Cases and Demos

Listed below are the most common use cases for the LDAP connector:

Adding User Accounts to Active Directory

Business user accounts can be added to Active Directory groups defined on the base DN.

Retrieve User attributes

Basic attributes of the business user can be retrieved for one or more purposes, like e-mail or phone.

Adding to a Flow

  1. Create a new Mule Project in Anypoint Studio.

  2. Add a suitable Mule Inbound Endpoint, such as the HTTP listener or File endpoint at the beginning of the flow.

  3. Drag and drop the LDAP connector onto the canvas.

  4. Click on the connector to open the Properties Editor.

    Flow Settings

  5. Configure the following parameters:

    Field Description

    Basic Settings

    Display Name

    Enter a unique label for the connector in your application.

    Connector Configuration

    Connect to a global element linked to this connector. Global elements encapsulate reusable data about the connection to the target resource or service. Select the global LDAP connector element that you just created.

    Operation

    Select Add entry from the drop-down menu.

    General

    Topic Name

    Enter a unique name for the topic.

  6. Click the blank space on the canvas for the connector to fetch the metadata based on the Structural Object Class, which traverses the directory information tree to retrieve the hierarchy and all the properties it inherits.

Example Use Case

Add and delete an organizational person from an organizational unit.

Add User Entry Flow

Studio Visual Editor

  1. Create a new Mule Project in Anypoint Studio.

  2. Add the below properties to mule-app.properties file to hold your LDAP credentials and place it in the project’s src/main/app directory.

    
                 
              
    1
    2
    3
    
    config.principal.dn=<DN>
    config.password=<Password>
    config.url=<URL>
  3. Drag an HTTP endpoint onto the canvas and configure the following parameters:

    Parameter Value

    Display Name

    HTTP

    Connector Configuration

    If no HTTP element has been created yet, click the plus sign to add a new HTTP Listener Configuration and click OK (leave the values to its defaults).

    Path

    /

  4. Set the flow variable to hold the group distinguished name (dn), for example: DevOpsGroup.

  5. Drag the Variable Transformer next to the HTTP endpoint component. Configure according to the table below:

    Parameter Description Value

    Operation

    Select the transformer operation.

    Set Variable

    Name

    The variable name.

    dn

    Value

    The variable value.

    ou=DevOpsGroup,#[message.inboundProperties.'http.query.params'.dn]

  6. Now let’s create the organizational unit entry using a Groovy component. Drag the Groovy component next to the Variable Transformer and use the script below.

    
                 
              
    1
    2
    3
    4
    5
    6
    7
    
    import org.mule.module.ldap.api.LDAPEntry;
    
    LDAPEntry entryToAdd = new LDAPEntry(flowVars.dn);
    entryToAdd.addAttribute("ou", "DevOpsGroup");
    entryToAdd.addAttribute("objectclass", ["top", "organizationalUnit"]);
    
    return entryToAdd
  7. Drag the LDAP connector next to the Groovy component to add the LDAP Entry.

  8. Configure the LDAP connector by adding a new LDAP Global Element. Click the plus sign next to the Connector Configuration field.

    1. Configure the global element according to the table below:

      Parameter Description Value

      Name

      Enter a name for the configuration to reference it.

      <Configuration_Name>

      Principal DN

      The DN (distinguished name) of the user.

      ${config.principal.dn}

      Password

      The password of the user.

      ${config.password}

      URL

      The connection URL to the LDAP server.

      ${config.url}

    2. The corresponding XML configuration should be as follows:

      
                      
                   
      1
      
      <ldap:config name="LDAP_Configuration" authDn="${config.principal.dn}" authPassword="${config.password}" url="${config.url}" doc:name="LDAP: Config"/>
  9. Click Test Connection to confirm that Mule can connect with the LDAP instance. If the connection is successful, click OK to save the configurations. Otherwise, review or correct any incorrect parameters, then test again.

  10. Back in the properties editor of the LDAP connector, configure the remaining parameters:

    Parameter Value

    Basic Settings

    Display Name

    Add Group Entry

    Operation

    Add entry

    General

    Entry Reference

    #[payload]

  11. Now let’s create the organizational person entry using a Groovy component. Drag the Groovy component next to the LDAP connector and add the below script to the Script text.

    
                 
              
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    
    import org.mule.module.ldap.api.LDAPEntry;
    
    LDAPEntry entryToAdd = new LDAPEntry("cn=Test User,"+ flowVars.dn);
    entryToAdd.addAttribute("uid", "testUser");
    entryToAdd.addAttribute("cn", "Test User");
    entryToAdd.addAttribute("sn", "User");
    entryToAdd.addAttribute("userPassword", "test1234");
    entryToAdd.addAttribute("objectclass", ["top", "person", "organizationalPerson", "inetOrgPerson"]);
    
    return entryToAdd
  12. Drag the LDAP connector next to the Groovy component. The connector adds the LDAP Entry created in the previous step.

  13. In the properties editor of the LDAP connector, configure the parameters as below:

    Parameter Value

    Basic Settings

    Display Name

    Add User Entry

    Connector Configuration

    LDAP_Configuration

    Operation

    Add entry

    General

    Entry Reference

    #[payload]

  14. Now that we have successfully added the entries, let’s try to delete them using the LDAP connector.

  15. Drag the LDAP connector besides the existing flow and configure the parameters as below:

    Parameter Value

    Basic Settings

    Display Name

    Delete User Entry

    Connector Configuration

    LDAP_Configuration

    Operation

    Delete entry

    General

    DN

    cn=Test User,#[flowVars.dn]

  16. Drag another LDAP connector to the right of the first LDAP connector and configure the parameters as below:

    Parameter Value

    Basic Settings

    Display Name

    Delete Group Entry

    Connector Configuration

    LDAP_Configuration

    Operation

    Delete entry

    General

    DN

    #[flowVars.dn]

  17. Finally drag Set Payload transformer to set the value to "Flow Successfully Completed".

Retrieve a Group in Active Directory With More Than 1500 Members

The range parameter is mandatory in Windows Active Directory to retrieve an object with more than 1500 items.

For the LDAP connector, specify this range and the other attributes you want to retrieve.

To handle this task:

  • In the From Expression input, use: #[['objectCategory','objectClass','distinguishedName','name','member;range=0-999']] - This retrieves the listed attributes and the first 1000 values of the member attribute.

  • Using the option Create Object Manually, you should add each attribute as an entry in the collection. For the range attribute, you should specify the range in this way: member;range=0-999

    Or in the Configuration XML:

    
                
             
    1
    2
    3
    4
    5
    6
    7
    8
    9
    
    <ldap:lookup config-ref="LDAP" dn="DN=CN=testgroup1,OU=groups,DC=MULESUPPORT,DC=NET" doc:name="Search for users in LDAP">
            <ldap:attributes>
                    <ldap:attribute>objectCategory</ldap:attribute>
                    <ldap:attribute>objectClass</ldap:attribute>
                    <ldap:attribute>distinguishedName</ldap:attribute>
                    <ldap:attribute>name</ldap:attribute>
                    <ldap:attribute>member;range=0-999</ldap:attribute>
            </ldap:attributes>
    </ldap:lookup>

XML Editor and Use Case Code

Paste this code into your XML Editor to quickly load the flow for this example use case into your Mule application.


          
       
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
<?xml version="1.0" encoding="UTF-8"?>

<mule xmlns:scripting="http://www.mulesoft.org/schema/mule/scripting" xmlns:tracking="http://www.mulesoft.org/schema/mule/ee/tracking" xmlns:http="http://www.mulesoft.org/schema/mule/http" xmlns:ldap="http://www.mulesoft.org/schema/mule/ldap" xmlns="http://www.mulesoft.org/schema/mule/core" xmlns:doc="http://www.mulesoft.org/schema/mule/documentation"
        xmlns:spring="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-current.xsd
http://www.mulesoft.org/schema/mule/http http://www.mulesoft.org/schema/mule/http/current/mule-http.xsd
http://www.mulesoft.org/schema/mule/ldap http://www.mulesoft.org/schema/mule/ldap/current/mule-ldap.xsd
http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd
http://www.mulesoft.org/schema/mule/scripting http://www.mulesoft.org/schema/mule/scripting/current/mule-scripting.xsd
http://www.mulesoft.org/schema/mule/ee/tracking http://www.mulesoft.org/schema/mule/ee/tracking/current/mule-tracking-ee.xsd">
    <http:listener-config name="HTTP_Listener_Configuration" host="0.0.0.0" port="8081" doc:name="HTTP Listener Configuration"/>
    <ldap:config name="LDAP_Configuration" authDn="${config.principal.dn}" authPassword="${config.password}" url="${config.url}" doc:name="LDAP: Config">
        <ldap:extended-configuration>
            <ldap:extended-configuration key="java.naming.ldap.factory.socket">org.mule.module.ldap.security.BypassTrustSSLSocketFactory</ldap:extended-configuration>
        </ldap:extended-configuration>
    </ldap:config>
    <flow name="ldap-add-entry-flow">
        <http:listener config-ref="HTTP_Listener_Configuration" path="/" doc:name="HTTP"/>
        <set-variable variableName="dn" value="ou=DevOpsGroup,#[message.inboundProperties.'http.query.params'.dn]" doc:name="Set DN as Flow Variable"/>
        <scripting:component doc:name="Groovy Script to Create DevOps Group Object">
            <scripting:script engine="Groovy"><![CDATA[import org.mule.module.ldap.api.LDAPEntry;

LDAPEntry entryToAdd = new LDAPEntry(flowVars.dn);
entryToAdd.addAttribute("ou", "DevOpsGroup");
entryToAdd.addAttribute("objectclass", ["top", "organizationalUnit"]);

return entryToAdd]]></scripting:script> </scripting:component>
        <ldap:add config-ref="LDAP_Configuration" doc:name="Add Group Entry to LDAP Directory"/>
        <scripting:component doc:name="Groovy Script to Create User Object">
            <scripting:script engine="Groovy"><![CDATA[import org.mule.module.ldap.api.LDAPEntry;

LDAPEntry entryToAdd = new LDAPEntry("cn=Test User,"+ flowVars.dn);
entryToAdd.addAttribute("uid", "testUser");
entryToAdd.addAttribute("cn", "Test User");
entryToAdd.addAttribute("sn", "User");
entryToAdd.addAttribute("userPassword", "test1234");
entryToAdd.addAttribute("objectclass", ["top", "person", "organizationalPerson", "inetOrgPerson"]);

return entryToAdd]]></scripting:script> </scripting:component>
        <ldap:add config-ref="LDAP_Configuration"  doc:name="Add User Entry to LDAP Directory"/>
        <ldap:delete config-ref="LDAP_Configuration" dn="cn=Test User,#[flowVars.dn]" doc:name="Delete User Entry from LDAP Directory"/>
        <ldap:delete config-ref="LDAP_Configuration" dn="#[flowVars.dn]" doc:name="Delete Group Entry from LDAP Directory"/>
        <set-payload value="Flow Successfully Completed" doc:name="Set Payload: Flow Completed"/>
    </flow> </mule>

Run Time

  1. Save and run the project as a Mule Application.

  2. Open a web browser and check the response after entering the URL http://localhost:8081/?dn=dc=mulesoft,dc=org.

Demo

You can download a fully functional example from this link.

See Also