| 52.3. LDAP use cases | ||
|---|---|---|
 | Chapter 52. LDAP - Lightweight Directory Access Protocol |  |
| 52.3. LDAP use cases | ||
|---|---|---|
| | Chapter 52. LDAP - Lightweight Directory Access Protocol | |
This section instructs you to access the system address book of the Abilis LDAP server and keep synchronized the VoIP users.
Add and active the LDAP resource as explained in the chapter: "activating the LDAP resource".
Create a LDAP account.
[21:44:12] ABILIS_CPX:a user:test act:yes pwd:test ldap:yes
COMMAND EXECUTEDIf anonymous authentication is required, the guest user must be active and its LDAP parameter enabled.
[21:44:12] ABILIS_CPX:s user:guest act:yes ldap:yes
COMMAND EXECUTED![[Note]](../images/note.png) | Note |
|---|---|
By default the anonymous user has access just to the "published" address book, so use the command s ldap rights id:3 user:anonymous grants:r to allow anonymous to access the system address book. You may also want to limit the access of LDAP client to the LAN then use the command s p res:ldap ip-src:192.168.0.0/16 and execute the initialization command init res:ldap. |
Check the users to be kept synchronized, in this example let's created a few users.
[00:18:51] ABILIS_CPX:a user:frank iax:yes iax-number:2222COMMAND EXECUTED [00:18:56] ABILIS_CPX:a user:anne sip:yes sip-number:3333COMMAND EXECUTED [00:19:29] ABILIS_CPX:aCOMMAND EXECUTED [00:23:56] ABILIS_CPX:user:george ctip:101a cticl clus:myclusCOMMAND EXECUTED [00:24:05] ABILIS_CPX:s cticl clus:myclus num:7777COMMAND EXECUTED [00:24:08] ABILIS_CPX:a user:jack clus:myclusCOMMAND EXECUTED
Enable LDAP-USER-SYNC in each user you want to keep synchronized in the system address book and specify the phone interface via the LDAP-NUMBER user parameter.
[00:18:51] ABILIS_CPX:s user:frank addrbook-sync:ldap addrbook-number:ctiiaxCOMMAND EXECUTED [00:18:56] ABILIS_CPX:s user:anne addrbook-sync:yes addrbook-number:ctisipCOMMAND EXECUTED [00:19:29] ABILIS_CPX:s user:george addrbook-sync:yes addrbook-number:ctipCOMMAND EXECUTED [00:24:08] ABILIS_CPX:s user:jack addrbook-sync:yes addrbook-number:clusCOMMAND EXECUTED
You may set USER-SYNC:YES in LDAP resource port but you should not use this way in most cases. You may erroneously synchronize users you want to keep hidden. Moreover, if this parameter is switched from YES to NO you risk to lose part of saved data (non synchronized attributes of synchronized contacts).
You may also modify, via macros, the number provided to LDAP via LDAP-NUM parameter in CTIIAX/CTISIP/CTIP/CLUSTER interfaces.
[21:47:12] ABILIS_CPX:s user:frank iax-addrbook-num:02'IAX-NUMBER'COMMAND EXECUTED [21:47:33] ABILIS_CPX:s user:anne sip-addrbook-num:'SIP-NUMBER.s2'COMMAND EXECUTED [21:48:44] ABILIS_CPX:s ctip:101 addrbook-num:02'NUM'COMMAND EXECUTED [21:48:55] ABILIS_CPX:s cticl clus:myclus addrbook-num:'NUM'123COMMAND EXECUTED [21:49:00] ABILIS_CPX:init ctisysINIT CTI SYSTEM IN PROGRESS, THIS MAY TAKE FEW MINUTES... COMMAND EXECUTE
| Note |
|---|---|
Any modification to CTI ports or Clusters needs the CTI system initialization via the command init ctisys. |
Hide the address books you aren't interested in via the LDAP rights table. The following commands allow just the system address book will be visible to the user named "test".
[21:49:08] ABILIS_CPX:a ldap rights id:1 user:test grants:-rCOMMAND EXECUTED [21:49:28] ABILIS_CPX:a ldap rights id:2 user:test grants:-rCOMMAND EXECUTED
The user may now access LDAP server via LDAP client or via Abilis web interface. To access web pages provide the LDAP account with additional HTTP rights.
[21:49:08] ABILIS_CPX:s user:test http:yesCOMMAND EXECUTED [21:49:35] ABILIS_CPX:a http rights id:2 user:test file:r dir:lCOMMAND EXECUTED
To know how to read/modify/create/remove contacts via the web interface or via a LDAP client check the chapter "handling contacts".
Advanced VoIP phones include a LDAP client able to translate the number of an incoming call to the corresponding contact name. The task of this section is to configure the Abilis LDAP server to provide its contacts to VoIP phones.
Add and active the LDAP resource as explained in the chapter: "activating the LDAP resource".
You may also want to limit the access of LDAP client to the LAN (i.e. 192.168.X.X) via the ipsrc and ipsrclist parameters.
[20:09:28] ABILIS_CPX:s p ldap ipsrc:192.168.0.0COMMAND EXECUTED [20:11:12] ABILIS_CPX:list create ldap_allow irCOMMAND EXECUTED [20:11:20] ABILIS_CPX:a list:ldap_allow 192.168.0.0:192.168.0.254COMMAND EXECUTED [20:14:26] ABILIS_CPX:s p ldap ipsrclist:ldap_allowCOMMAND EXECUTED [20:15:01] ABILIS_CPX:d p ldapRES:Ldap ---------------------------------------------------------------------- Run DESCR:Lightweight_Directory_Access_protocol LOG:NO mxps:2048 TOS:0-N - LDAP Server ---------------------------------------------------------- SRV-ACT:YES srv-sesnum:10 tcp-locport:389 IPSRC:192.168.000.000 IPSRCLIST:ldap_allow SRV-SIZE-LIMIT:NO SRV-TIME-LIMIT:NO SRV-DT:60 max-entries:1000 DN-FIRST-ATTR:cn root:dc=abilis,dc=net wdir:C:\APP\LDAP\ - LDAP Client ---------------------------------------------------------- CLI-ACT:YES cli-sesnum:5 MAX-REFERRALS:10 CLI-SIZE-LIMIT:NO CLI-TIME-LIMIT:NO CLI-DT:60 CLI-REM-ACCOUNT-PERMANENT:YES CLI-MAX-TOUT:60 CLI-PERMANENT-RETRY-DELAY:60
![[Caution]](../images/caution.png) | Caution |
|---|---|
To activate the changes made on the upper case parameters, execute the initialization command init res:ldap; while to activate the changes made on the lowercase parameters a save conf and an Abilis restart are required (i.e. With warm start command). |
Create a LDAP account.
[21:44:12] ABILIS_CPX:a user:test act:yes pwd:test ldap:yes
COMMAND EXECUTEDThe user automatically gains the reading right over all the main address books.
If the anonymous authentication is required, the guest user must be active and its LDAP parameter enabled.
[21:44:12] ABILIS_CPX:s user:guest act:yes ldap:yes
COMMAND EXECUTEDThe guest by default has not the right to access the system address book and the contacts address book so let's grant it.
[13:15:27] ABILIS_CPX:s ldap rights id:1 user:guest grants:rCOMMAND EXECUTED [13:15:27] ABILIS_CPX:s ldap rights id:3 user:guest grants:rCOMMAND EXECUTED
Let's configure a Snom 300 VoIP phone to display the LDAP attribute "common name" instead of displaying just the calling number.
Via the web interface of the SNOM opens the Advanced section page and set the following parameters:
| Parameter | Value |
| LDAP name filter | (&(telephoneNumber=*)(sn=%)) |
| LDAP number filter | (&(telephoneNumber=%)(sn=*)) |
| Server Address | <IP address or FQDN of Abilis> |
| Port | 389 |
| Base | dc=addressBooks,dc=abilis,dc=net |
| Username | <The name of an Abilis user allowed to LDAP (LDAP:YES)> |
| Password | <The password of an Abilis user allowed to LDAP (LDAP:YES)> |
| LDAP name attributes | cn sn displayName |
| LDAP number attributes | mobile telephoneNumber ipPhone |
| LDAP display name | %cn |
| Note |
|---|---|
Changing the "Base" parameter you may change the scope of contacts, i.e. to access only the contacts address book set "Base" as addressBook=contacts, dc=addressBooks, dc=abilis, dc=net. |
The SNOM web interface should look in this way:
Now the phone will display the Common Name provided by the Abilis LDAP server instead of any known calling number.
To know how to read/modify/create/remove contacts via the web interface or via a LDAP client check the chapter "handling contacts".
The goal of this section is to configure a mail client (Thunderbird) to enable autocompletion when editing the recipient of a message.
Add and active the LDAP resource as explained in the chapter: "activating the LDAP resource".
You may also want to limit the access of LDAP clients to the LAN (i.e. 192.168.X.X) via the ipsrc and ipsrclist parameters.
[20:09:28] ABILIS_CPX:s p ldap ipsrc:192.168.0.0COMMAND EXECUTED [20:11:12] ABILIS_CPX:list create ldap_allow irCOMMAND EXECUTED [20:11:20] ABILIS_CPX:a list:ldap_allow 192.168.0.0:192.168.0.254COMMAND EXECUTED [20:14:26] ABILIS_CPX:s p res:ldap ipsrclist:ldap_allowCOMMAND EXECUTED [20:15:01] ABILIS_CPX:d p res:ldapRES:Ldap ---------------------------------------------------------------------- Run DESCR:Lightweight_Directory_Access_protocol LOG:NO mxps:2048 TOS:0-N - LDAP Server ---------------------------------------------------------- SRV-ACT:YES srv-sesnum:10 tcp-locport:389 IPSRC:192.168.000.000 IPSRCLIST:ldap_allow SRV-SIZE-LIMIT:NO SRV-TIME-LIMIT:NO SRV-DT:60 max-entries:1000 DN-FIRST-ATTR:cn root:dc=abilis,dc=net wdir:C:\APP\LDAP\ - LDAP Client ---------------------------------------------------------- CLI-ACT:YES cli-sesnum:5 MAX-REFERRALS:10 CLI-SIZE-LIMIT:NO CLI-TIME-LIMIT:NO CLI-DT:60 CLI-REM-ACCOUNT-PERMANENT:YES CLI-MAX-TOUT:60 CLI-PERMANENT-RETRY-DELAY:60
| Caution |
|---|---|
To activate the changes made on the upper case parameters, execute the initialization command init res:ldap; while to activate the changes made on the lowercase parameters a save conf and an Abilis restart are required (i.e. With warm start command). |
Thunderbird doesn't support LDAP user authentication so let's enable the anonymous user in Abilis (guest) and set its LDAP right to allow him to access the contacts address book.
[17:50:23] ABILIS:s user:guest act:yes ldap:yesCOMMAND EXECUTED [17:51:16] ABILIS_CPX:d user------------------------+-------------+---------------------------------------- USER PWD ACT|CTIP CLUS |CHAT LDAP PPP FTP HTTP MAIL IAX SIP VO ------------------------+-------------+---------------------------------------- admin *** YES # # YES YES YES YES YES NO NO NO NO guest YES # # NO YES NO NO NO NO NO NO NO [17:51:24] ABILIS:s ldap rights id:1 user:anonymous grants:rCOMMAND EXECUTED [17:52:07] ABILIS:d ldap rights- Not Saved (SAVE CONF) ------------------------------------------------------- ------------------------------------------------------------------------------- ID: ADDRESSBOOK: USER: GRANTS: ------------------------------------------------------------------------------- 1 contacts admin rwcd anonymous r--- ------------------------------------------------------------------------------- 2 published admin rwcd anonymous r--- ------------------------------------------------------------------------------- 3 system admin rw-- anonymous ---- -------------------------------------------------------------------------------
In Thunderbird open the Account Settings dialog (select Tools ->Account Settings) then select your account and click the Composition & Addressing tab, finally add a new LDAP directory.
Click the Add button and use the following parameters.
| Parameter | Value |
| Name | <doesn't matter> |
| Hostname | <IP address or FQDN of Abilis> |
| Base DN | addressBook=Contacts,dc=addressBooks,dc=abilis,dc=net |
| Port number | 389 |
| Note |
|---|---|
Changing the "Base DN" parameter you may change the scope of contacts, i.e. to access all main address books set base as dc=addressBooks, dc=abilis, dc=net and execute the command s ldap rights id:3 user:anonymous grants:r |
The dialog should appear in this way:
Set the Abilis LDAP server as the current LDAP for this account.
Then you may try to write a mail using the "common name" of a person and Thunderbird will autocomplete the mail address for you. In the example the "Contacts" address book includes the contact of "Clark Kent", the tooltip will appear as soon as you write a few chars.
To know how to read/modify/create/remove contacts via the web interface or via a LDAP client check the chapter "handling contacts".
| |  | |
| 52.2. LDAP tables |  | 52.4. Handling contacts |
