* * * New or Improved for 2014.1 * * *  LDAP Settings

Field	Description
Setting Name	A unique name for this LDAP server connection.
Server	A valid LDAP server name or IP address (such as 10.34.25.21). When connecting to a specific port, add it to this entry, separated by a semicolon; for example, servername:portnumber.
Base DN	Optional. Enter the distinguished name for the LDAP object in the LDAP server. This value is not case sensitive.
User	If the server requires authentication, enter a user name.
Password	If the server supports anonymous authentication, enter a unique password.
Connection timeout	Specify the timeout period (in seconds) for the LDAP server connection. The system continues attempts to connect until the timeout period is reached. If a connection is not made after the timeout period expires, an exception message appears.
Create records of type	Choose from the drop-down list to create records of the customer type (employee or external contact).
Connect to eDirectory Open LDAP Server	Select to connect to eDirectory and the Open LDAP server,
Use NTLM authentication	If you selected Connect to eDirectory/Open LDAP server, you must also select this option. Open LDAP requires NTLM authentication.
Enable Incremental Updates	Optional. If you did not select Connect to eDirectory/Open LDAP server, you can enable incremental updates through Active DirectoryMicrosoft's Active Directory is a service that stores and manages network-based entities such as applications, files, printers, and people. by selecting this option.
Enable synchronous replication	Optional. Select to enable synchronous replication.
SSL Connection	Select to provide a secure socket layer connection if you are using LDAPS.

Preset	Define the LDAP object filter by selecting a default search filter from the drop-down list. The default is users.
Filter	Optional. To add a filter string, enter a valid string and click Save New Preset. The system adds the value to the Preset drop-down list. Click Remove Preset to delete the current value.
Root LDAP node(s)	To restrict LDAP searches, enter one or more valid root nodes. --or-- Use the LDAP directory browser to locate a directory, then click Add selected node as root.
Sample LDAP Entry to extract fields from	Each LDAP entry belongs to an LDAP class and contains a set of fields. Use this option to add a sample LDAP entry containing fields to be retrieved in a fetch operation. --or-- Use the LDAP directory browser to locate a sample entry, then click Select sample entry. The entry shows the LDAP entry syntax, such as: CN=Class Name,OU=Organizational Unit,DC=domaincomponent1 (derived from company DNS domain components),DC=domaincomponent segment2 For example: CN=Barnard Jeffries,OU=Users,OU=Pleasanton,DC=companyX,DC=com

You can use expressions for field mapping. Select an attribute, map it on the object field, and use an expression with all functions supported by HEAT functionality to transform the resulting value or run some complex logic.

Examples:

1.

Directory emails end in @domain.com. It must be transformed in HEAT to end with @tenant.com.

The mapping expression is:

PrimayEmail = $(iif(Find('@domain.com', mail) > -1, samaccountname + '@tenant.com', mail))

2.

Map the Department field based on the distinguished name component.

If DN() is called without parameters, the whole distinguished name is returned.

For CN=John Doe, OU=Developers, OU=Personnel, DC=Company LDAP entry, the mapping expression is:

Department = $(iif(DN(1) == 'Developers', 'Research & Development', 'IT')

Expressions for Field Mapping

To enable expressions for field mapping, select [Use expression] in the LDAP field name control:

LDAP Field Name Control

This invokes the Expression Editor. See Expressions.

Edit your expression using LDAP entry fields and other functions from the properties and functions tree.

If an LDAP field name already contains an expression, the expression editor automatically appears. Selecting [Use Text Value] from the properties tree removes expression from the mapping. The expression is also disabled if $( symbols are not used in the beginning of the expression text.

Expressions for Relationship Mapping

This expression functionality is also enabled for relationship mapping.

LDAP synchronization can create an organizational unit if the required organizational unit does not exist. All new organizational units are created with a parent organizational unit selected in the parent organizational unit name control.

LDAP Parent Org Unit Name - Organizational Unit

The parent organizational unit name control is a tree list selector where you can select organizational units in a user friendly form.

Parent Org Unit Name Control

Example

The mapping expression $(iif(DN(1) == 'Developers', 'Research & Development', 'IT')) says that two organizational units are required for the import: Research & Development, and IT.

These organizational units are created (if they did not exist before the import) and placed under the organizational unit in the tree which is selected as parent.

If the organizational unit already exists, it is used for import.

The system uses the default organizational unit by default.

1.

Click the HEAT Contact Field Name field and choose the field to use as the primary contact field. The default is PrimaryEmail.

2.

Under HEAT Contact Field Mapping, from the Preset drop-down list, choose a mapping file. The default list is Active Directory. HEAT supports Active Directory, eDirectory, Lotus, OpenLDAP, generic, and many others. When selected, the tables on this page are populated with default values. You can retain the defaults or add custom values.

You must map the LoginID field to the LDAP user ID, or LDAP external authorization will not perform correctly.

3.

Enter information into the field mapping table. You can use an expression for the LDAP field name.

Creating new records using the LDAP import process works only for simple validation lists; for example, pick lists that are not constrained (such as department).

Field mapping expressions using comparison with iif are case sensitive. For example, use the following expression for organizational unit:

$(iif((DN(2) == 'California'),'California','Colorado'))

If you used "california" (lower case "C"), then the return data is Colorado. To receive the correct data, in this case, use "California."

To map the Manager field, you can use the ParseDn() function (See ParseDn).

Example Using the ParseDn() Function

4.

Click Add to add a new entry (a table row).

5.

Under HEAT Contact Relationships, choose the parent organizational unit name, or choose Default. Select fields from the LDAP-compliant directory which will be used to create relationships in your HEAT solution for each contact record. This relationship must match exactly.

For example, if you attempt to use the Manager field in Active DirectoryMicrosoft's Active Directory is a service that stores and manages network-based entities such as applications, files, printers, and people., the import will fail because this field includes an LDAP distinguished name instead of a simple user name or email address.

6.

Click Add to add a new entry (a table row).

7.

Under HEAT Contact Roles, add roles that can be imported using this connection. The default role is Self Service. Click Self Service to show the role list, then check the roles you want to include.

LDAP - HEAT Contact Roles

To retain the existing roles, check Keep existing roles. If checked, the import process will keep all assigned roles for existing contacts AND then create roles defined in the current record settings. If unchecked, the existing roles are deleted and the selected roles are added.

By default, HEAT contacts that already exist before the import process runs will keep their current roles and add the roles you have defined as part of the current record settings.

8.

Under Advanced Settings, select any of the following:

Option	Description
Allow HEAT to access LDAP directory when certificate is non-trusted.	Check to be able to connect through SSL to the LDAP-compliant server even if the certificate is not trusted.
Override Employee Login	Check to override the employee login settings.
Add LDAP Login and Server to imported accounts.	Check to automatically add the LDAP settings into the user profile record.
Disable HEAT users who have been disabled in the LDAP-compliant directory using the value of the fields:	Check to disable existing HEAT contacts during the import process when they have been disabled in your LDAP-compliant directory. Enter the field values to check for disabled users.
Disable HEAT users who have been expired in the LDAP-compliant directory	Check to disable existing HEAT contacts during the import process when they have expired in your LDAP-compliant directory.

9.

Click Preview to see your data.

10.

Click Next.