With Ivy 10, our LDAP setup does no longer work?!

Peter Hochstrasser

We're constantly improving Axon Ivy in all areas. When we went on the journey from Ivy 8 to Ivy 10, we found that our LDAP connector has accepted setups that defined a (narrow) LDAP Context, containing some groups and lots of other objects. It may have contained users, but if a group in the context has been defined as the "source of all users", then even users in that group that had been outside the context had been synchronized.

Puzzled?
Sometimes, a picture is worth a thousand words:

That is, in effect, not what we had in mind.
Therefore, we corrected the behaviour and now, all users that have access to Ivy need to be inside the base LDAP Context:

Therefore, if you find that your LDAP user import which worked flawlessly with Ivy 8 does not work in Ivy 10, please check your LDAP Context setting.

Christian Strebel

This is only a problem with the Active Directory Security System and Axon Ivy 10. But also with Axon Ivy 8.0, it is better to configure the Default Context correctly.

Here is an example

If the Active Directory has the following configuration:
Import Users Of Group: CN=Ivy-Users,OU=Roles,OU=Department,DC=company,DC=ch
And this should import the following user:
user1, External Name: CN=user1,OU=Users,OU=Department,DC=company,DC=ch

Then the correct Default Context value would be one of:

DC=company,DC=ch or
OU=Department,DC=company,DC=ch

But we see often OU=Roles,OU=Department,DC=company,DC=ch which is NOT correct because the imported User is not inside of this Context because the users are here: OU=Users,OU=Department,DC=company,DC=ch

Outcome

If you migrate to Axon Ivy 10 and your Default Context configuration is not correct (Default Context does not contain (all) the users), your users will get disabled and they cannot log in anymore.

Advice

Please check your Default Context configuration in existing Active Directory Security systems and correct it even if you are running an Axon Ivy Version below 10.0. It may cause trouble even there.