# Jive Messenger LDAP Guide

## Introduction

This document details how to configure your Jive Messenger installation to use an external LDAP store when authenticating users.

## Background

LDAP (Lightweight Directory Access Protocol) has emerged as a dominant standard for user authentication and for storage of user profile data. It serves as a powerful tool for large organizations (or those organizations integrating many applications) to simplify user management issues.

By default, Jive Messenger stores all user data in a database and performs authentication using database lookups. The LDAP module replaces that functionality and allows Jive Messenger to:

- Use a LDAP server to authenticate a user's identity.
- Load user profile information from a LDAP directory. Note that Jive Messenger treats the LDAP directory as read-only.

This document will guide you through configuring LDAP support in Jive Messenger. These instructions assume that you're a competent LDAP user, and that you're familiar with Jive Messenger setup issues.

## Configuration

In order to configure your server to use LDAP:

1. Stop Jive Messenger.
2. Edit `conf/jive-messenger.xml` in your Jive Messenger installation folder as described below.
3. Restart Jive Messenger.

### Editing the Config File

Open the configuration file `conf/jive-messenger.xml` from your Jive Messenger installation in your favorite editor and add or change the following settings:

- provider.user.className -- set the value to "org.jivesoftware.messenger.ldap.LdapUserProvider".
- provider.auth.className -- set the value to "org.jivesoftware.messenger.ldap.LdapAuthProvider".
- ldap.host -- LDAP server host; e.g. localhost or machine.example.com, etc.
- ldap.port -- LDAP server port number
- ldap.usernameField -- the field name that the username lookups will be performed on. If this property is not set, the default value is `uid`
- ldap.baseDN -- the starting DN that searches for users will performed with. The entire subtree under the base DN will be searched for user accounts.
- ldap.nameField -- the field name that holds the user's name. If this property is not set, the default value is `cn`
- ldap.emailField -- the field name that holds the user's email address. If this property is not set, the default value is `mail`.
- ldap.adminDN -- a directory administrator's DN. All directory operations will be performed with this account. The admin must be able to perform searches and load user records. The user does not need to be able to make changes to the directory, as Jive Messenger treats the directory as read-only.
- ldap.adminPassword -- the password for the directory administrator.
- ldap.debugEnabled -- a value of "true" if debugging should be turned on. When on, trace information about buffers sent and received by the LDAP provider is written to System.out
- ldap.sslEnabled -- a value of "true" to enable SSL connections to your LDAP server. If you enable SSL connections, the LDAP server port number most likely should be changed to 636.

Below is a sample config file section:

    <jive>
    ...
        <ldap>
            <host></host>
            <port>389</port>
            <<usernameField>uid</usernameField>
            <nameField>cn</nameField>
            <emailField>mail</emailField>
            <baseDN>ou=People;dc=example;dc=com</baseDN>
            <adminDN>cn=Directory Administrator</adminDN>
            <adminPassword></adminPassword>
        </ldap>
        <provider>
            <user>
                <className>org.jivesoftware.messenger.ldap.LdapUserProvider</className>
            </user>
            <auth>
                <className>org.jivesoftware.messenger.ldap.LdapAuthProvider</className>
            </auth>
        </provider>
    ...
    </jive>

Finally, you'll most likely want to change which usernames are authorized to login to the admin console. By default, only the user with username "admin" is allowed to login. However, you may have different users in your LDAP directory that you'd like to be administrators. The list of authorized usernames is controlled via the `adminConsole.authorizedUsernames` property. For example, to let the usersnames "joe" and "jane" login to the admin console:

    <jive>
    ...
        <adminConsole>
        ...
            <authorizedUsernames>joe, jane</authorizedUsernames>
        </adminConsole>
    ...
    </jive>