Filtering LDAP accounts

The LDAP protocol is an effective tool for centralized management of account data in a corporate infrastructure.

You can learn more about the LDAP protocol and Microsoft Active Directory in our article.

LDAP-compatible directory services (such as Active Directory, FreeIPA, or 389 Directory Server) support Single Sign-On: users receive a single account which enables them to access all corporate applications. This strategy reduces administrative overhead and improves user experiences.

Such solutions as TrueConf Server and its more advanced version TrueConf Enterprise are frequently used in corporate settings. They provide team messaging and video conferencing capabilities. In this case integration with LDAP directories can also be used. Detailed configuration of the TrueConf messenger is described in the documentation.

One should take into account that sometimes directories may contain service accounts (machine objects) and regular users who do not need access to certain services. TrueConf Server enables administrators to exclude such entries from synchronization. To do it, you should configure various filters to define the group of users who will be synchronized from Active Directory.

To successfully find users, we can use two tools available in LDAP integration settings of TrueConf Server:

• Path (distinguishedName) — the full unique name of an entry in the directory. With DN, you can select a group of users to be added to TrueConf Server (if LDAP integration is already configured on your server, you may skip this step).
• Filter Disabled — this parameter specifies the accounts that are disabled and will not be displayed on your TrueConf Server.

Filtering configuration with the help of DN

To make sure that only certain users can access the features of TrueConf Server, we recommend creating a separate group of objects in the directory service.

You can specify the group to be synchronized in the section Users → LDAP / Active Directory → LDAP Settings.

On the opened page, find the Path (distinguishedName) field and enter the parameters based on the data from the table:

Based on this DN table, the trueconf_users group in the example.com domain will have the following entry:

cn=trueconf_users,ou=Groups,dc=example,dc=com – AD, FreeIPA / ALD Pro, 389 Directory Server, OpenLDAP

If you are unable to determine the DN of your group, or if your directory tree differs significantly from the one shown here, use the terminal (console) on the machine where the directory service is installed. Run the following commands and you will see a detailed description of the DN for your group:

• Get-ADGroup group_name | Select-Object DistinguishedName — AD (run in Windows Powershell)
• ipa group-show group_name --raw – FreeIPA/ALD Pro (in the Linux console)
• ldapsearch -x -H ldap://your-ldap-server \ -D "bind_dn" -W \ -b "dc=example,dc=com" \ "(cn=group_name)" dn — for any LDAP server on Windows and Linux

For more details, please refer to the relevant documentation on directory services.

Once you have successfully connected to a directory service via LDAP, you can select a group by clicking on the Browse button.

Use of a custom filter

Sometimes, a group, whose users need to be synchronized with TrueConf Server, has service accounts that cannot be disabled or moved. In this case you can configure the use of filters on the side of TrueConf Server.

You can also use the table constructor below to create a filter. In particular, you can take required parameters from this table and insert your data.

LDAP filter builder

For example, here is a filter that will find all active users from the Developers group in Active Directory if their names include the test substring:

(the filter can also be written in a single line without line breaks)

After the filter has been created, go to Users → LDAP / Active Directory → LDAP Settings, open the Advanced tab, and enter the filter you created earlier, in the Filter Disabled field.

After you apply new settings, only users, who match the specified filter, will be added to the server.

For a better understanding of the topic, we recommend reviewing the documentation provided by your directory service provider.