This article explains user authentication with LDAP on Datto Drive Local.
- Datto Drive Local
Datto Drive includes an LDAP application to allow LDAP users (including Active Directory) to appear in your Datto Drive user listings. These users will authenticate to Datto Drive with their LDAP credentials, so you don’t have to create separate Datto Drive user accounts for them. You will manage their Datto Drive group memberships, quotas, and sharing permissions just like any other Datto Drive user.
The LDAP application supports:
- LDAP group support
- File sharing with Datto Drive users and groups
- Access via WebDAV and Datto Drive Desktop Client
- Versioning, external Storage and all other Datto Drive features
- Seamless connectivity to Active Directory, with no extra configuration required
- Support for primary groups in Active Directory
- Auto-detection of LDAP attributes such as base DN, email, and the LDAP server port number
- Only read access to your LDAP (edit or delete of users on your LDAP is not supported)
First, enable the LDAP user and group backend app on the Apps page in Datto Drive. Then, go to your Admin page to configure it.
The LDAP configuration panel has four tabs. A correctly completed server tab is needed to access the other tabs. A green indicator lights when the configuration is correct. Hover your cursor over the fields to see some pop-up tooltips.
Start with the Server tab. You may configure multiple servers.At a minimum, you must supply the LDAP server’s hostname. If your server requires authentication, enter your credentials on this tab. Datto Drive will then attempt to auto-detect the server’s port and base DN. The base DN and port are mandatory, so if Datto Drive cannot detect them you must enter them manually.
Figure 1: The LDAP server tab (click to enlarge)
Server configuration tab
Configure one or more LDAP servers. Click the Delete Configuration button to remove the active configuration.
Host: The hostname or IP address of the LDAP server. It can also be a ldaps:// URI. If you enter the port number, it speeds up server detection.
Port: The port on which to connect to the LDAP server. The field is disabled when beginning a new configuration. If the LDAP server is running on a standard port, it will detect the port automatically. If you are using a non-standard port, Datto Drive will attempt to detect it. If this fails you must enter the port number manually.
User DN: The name as DN of a user who has permissions to do searches in the LDAP directory. Leave it empty for anonymous access. We recommend that you have a special LDAP system user for this. This may also be referred to as the Bind DN.
To confirm the correct user DN, Open Windows PowerShell on the network's primary domain controller and run:
Get-ADUser. More on Get-ADUser can be found here: https://technet.microsoft.com/en-us/library/ee617241.aspx (external link)
Password: The password for the user given above. Empty for anonymous access.
Base DN: The base DN of LDAP, from where all users and groups can be reached. You may enter multiple base DNs, one per line. (Base DNs for users and groups can be set in the Advanced tab.) This field is mandatory. Datto Drive attempts to determine the Base DN according to the provided User DN or the provided Host, and you must enter it manually if Datto Drive does not detect it.
User Filter tab
Use the Login filter to control which LDAP users can log into your Datto Drive server. Those LDAP users who have access but are not listed as users (if there are any) will be hidden users. You may bypass the form fields and enter a raw LDAP filter if you prefer.
Figure 2: The LDAP Users tab (click to enlarge)
If there are matching user and group names, you will need to manually modify the LDAP query to successfully retrieve the list of users within a group.
Only those object classes: Datto Drive will determine the object classes that are typically available for user objects in your LDAP. Datto Drive will automatically select the object class that returns the highest amount of users. You may select multiple object classes. only from those groups.
- If your LDAP server supports the member-of-overlay in LDAP filters, you can define that only users from one or more certain groups are allowed to appear in user listings in Datto Drive. By default, no value will be selected. You may select multiple groups.
- If your LDAP server does not support the member-of-overlay in LDAP filters, the input field is disabled. Please contact your LDAP administrator.
Edit raw filter instead: Clicking on this text toggles the filter mode and you can enter the raw LDAP filter directly.
(&(objectClass=inetOrgPerson)(memberOf=cn=Datto Driveusers,ou=groups, dc=example,dc=com))
x users found: This shows approximately how many users will be listed in Datto Drive. The number updates automatically after any changes.
The settings in the Login Filter tab determine which LDAP users can log in to your Datto Drive system and which attribute or attributes the provided login name is matched against (e.g. LDAP/AD username, email address). You may select multiple user details. (You may bypass the form fields and enter a raw LDAP filter if you prefer.)
You may override your User Filter settings on the User Filter tab by using a raw LDAP filter.
Figure 3: The Login Attributes tab (click to enlarge)
LDAP Username: If this value is checked, the login value will be compared to the username in the LDAP directory. Datto Drive will automatically detect the corresponding attribute, usually uid or samaccountname.
LDAP Email Address: If this value is checked, the login value will be compared to an email address in the LDAP directory; specifically, the mailPrimaryAddress and mail attributes.
Other Attributes: This multi-select box allows you to select other attributes for the comparison. The list is generated automatically from the user object attributes in your LDAP server.
Edit raw filter instead:
Clicking on this text toggles the filter mode and you can enter the raw LDAP filter directly.
The %uid placeholder is replaced with the login name entered by the user upon login.
(&(objectClass=inetOrgPerson)(memberOf=cn=Datto Driveusers,ou=groups, dc=example,dc=com)(uid=%uid)
username or email address:
((&(objectClass=inetOrgPerson)(memberOf=cn=Datto Driveusers,ou=groups, dc=example,dc=com)(|(uid=%uid)(mail=%uid)))
By default, no LDAP groups will be available in Datto Drive. The settings in the group filter tab determine which groups will be available in Datto Drive. You may also elect to enter a raw LDAP filter instead.
Figure 4: The Groups tab (click to enlarge)
Only those object classes: Datto Drive will determine the object classes that are typically available for group objects in your LDAP server. Datto Drive will only list object classes that return at least one group object. You can select multiple object classes. A typical object class is “group”, or “posixGroup”.
Only from those groups: Datto Drive will generate a list of available groups found in your LDAP server. and then you select the group or groups that get access to your Datto Drive server.
Edit raw filter instead: Clicking on this text toggles the filter mode and you can enter the raw LDAP filter directly.
How Many groups found: This tells you approximately how many groups will be available in Datto Drive. The number updates automatically after any change.
The LDAP Advanced Setting section contains options that are not needed for a working connection. This provides controls to disable the current configuration, configure replica hosts, and various performance-enhancing options.
The Advanced Settings are structured into three parts:
- Connection Settings
- Directory Settings
- Special Attributes
Configuration Active: Enables or Disables the current configuration. By default, it is turned off. When Datto Drive makes a successful test connection it is automatically turned on. Backup (Replica) Host:
If you have a backup LDAP server, enter the connection settings here. Datto Drive will then automatically connect to the backup when the main server cannot be reached. The backup server must be a replica of the main server so that the object UUIDs match.
Backup (Replica) Port:
The connection port of the backup LDAP server. If no port is given, but only a host, then the main port (as specified above) will be used.
Disable Main Server: You can manually override the main server and make Datto Drive only connect to the backup server. This is useful for planned downtimes. Turn off SSL certificate validation: Turns off SSL certificate checking. Use it for testing only! Cache Time-To-Live:
A cache is introduced to avoid unnecessary LDAP traffic, for example caching usernames so they don’t have to be looked up for every page, and speeding up loading of the Users page. Saving the configuration empties the cache. The time is given in seconds.
Note that almost every PHP request requires a new connection to the LDAP server. If you require fresh PHP requests we recommend defining a minimum lifetime of 15s or so, rather than completely eliminating the cache.
- ten minutes: 600
- one hour: 3600
See the Caching section below for detailed information on how the cache operates.
>User Display Name Field: The attribute that should be used as display name in Datto Drive.
- Example: displayName
2nd User Display Name Field: An optional second attribute displayed in brackets after the display name, for example using the mailattribute displays as MollyFoo (firstname.lastname@example.org).Base User Tree:
The base DN of LDAP, from where all users can be reached. This must be a complete DN, regardless of what you have entered for your Base DN in the Basic setting. You can specify multiple base trees, one on each line.
Example:cn=programmers,dc=my-company,dc=com cn=designers,dc=my-company,dc=com User Search Attributes:
These attributes are used when searches for users are performed, for example in the share dialogue. The user display name attribute is the default. You may list multiple attributes, one per line.
If an attribute is not available on a user object, the user will not be listed, and will be unable to login. This also affects the display name attribute. If you override the default you must specify the display name attribute here.
The attribute that should be used as Datto Drive group name. Datto Drive allows a limited set of characters (a-zA-Z0-9.-_@). Once a group name is assigned it cannot be changed.
- Example: cn
The base DN of LDAP, from where all groups can be reached. This must be a complete DN, regardless of what you have entered for your Base DN in the Basic setting. You can specify multiple base trees, one in each line.
These attributes are used when a search for groups is done, for example in the share dialogue. By default the group display name attribute as specified above is used. Multiple attributes can be given, one in each line.
If you override the default, the group display name attribute will not be taken into account, unless you specify it as well.
Example:cn descriptionGroup Member association:
The attribute that is used to indicate group memberships, i.e. the attribute used by LDAP groups to refer to their users.
Datto Drive detects the value automatically. You should only change it if you have a very valid reason and know what you are doing.
- Example: uniquemember
Special Attributes>Quota Field:
Datto Drive can read an LDAP attribute and set the user quota according to its value. Specify the attribute here, and it will return human-readable values, e.g. “2 GB”. Any quota set in LDAP overrides quotas set on the Datto Drive user management page.
- Example: DattoDriveQuota
Override Datto Drive default quota for LDAP users who do not have a quota set in the Quota Field.
- Example: 15 GB
Set the user’s email from their LDAP attribute. Leave it empty for default behavior.
- Example: mail
By default, the Datto Drive server creates the user directory in your Datto Drive data directory and gives it the Datto Drive username, .e.g /var/www/Datto Drive/data/alice. You may want to override this setting and name it after an LDAP attribute value. The attribute can also return an absolute path, e.g./mnt/storage43/alice. Leave it empty for default behavior.
- Example: cn
The home folder rule is enforced. This means that once you set a home folder naming rule (get a home folder from an LDAP attribute), it must be available for all users. If it isn’t available for a user, then that user will not be able to login. Also, the filesystem will not be set up for that user, so their file shares will not be available to other users.
In the Expert Settings, fundamental behavior can be adjusted to your needs. The configuration should be well-tested before starting production use.Internal Username:
The internal username is the identifier in Datto Drive for LDAP users. By default it will be created from the UUID attribute. The UUID attribute ensures that the username is unique, and that characters do not need to be converted. Only these characters are allowed: [a-zA-Z0-9_.@-]. Other characters are replaced with their ASCII equivalents, or are simply omitted.
The LDAP backend ensures that there are no duplicate internal usernames in Datto Drive, i.e. that it is checking all other activated user backends (including local Datto Drive users). On collisions a random number (between 1000 and 9999) will be attached to the retrieved value. For example, if “alice” exists, the next username may be “alice_1337”.
The internal username is the default name for the user home folder in Datto Drive. It is also a part of remote URLs, for instance for all *DAV services.
You can override all of this with the Internal Username setting. Leave it empty for default behaviour. Changes will affect only newly mapped LDAP users.
- Example: uid
By default, Datto Drive auto-detects the UUID attribute. The UUID attribute is used to uniquely identify LDAP users and groups. The internal username will be created based on the UUID, if not specified otherwise.
You can override the setting and pass an attribute of your choice. You must make sure that the attribute of your choice can be fetched for both users and groups and it is unique. Leave it empty for default behaviour. Changes will have effect only on newly mapped LDAP users and groups. It also will have effect when a user’s or group’s DN changes and an old UUID was cached, which will result in a new user. Because of this, the setting should be applied before putting Datto Drive in production use and clearing the bindings (see the User and Group Mapping section below).
- Example: cn
Datto Drive uses usernames as keys to store and assign data. In order to precisely identify and recognize users, each LDAP user will have a internal username in Datto Drive. This requires a mapping from Datto Drive username to LDAP user. The created username is mapped to the UUID of the LDAP user. Additionally the DN is cached as well to reduce LDAP interaction, but it is not used for identification. If the DN changes, the change will be detected by Datto Drive by checking the UUID value.
The same is valid for groups.
The internal Datto Drive name is used all over in Datto Drive. Clearing the Mappings will have leftovers everywhere. Never clear the mappings in a production environment, but only in a testing or experimental server.
Clearing the Mappings is not configuration sensitive, it affects all LDAP configurations!
Testing the configuration
The Test Configuration button checks the values as currently given in the input fields. You do not need to save before testing. By clicking on the button, Datto Drive will try to bind to the Datto Drive cloud server using the settings currently given in the input fields. If the binding fails you’ll see a yellow banner with the error message “The configuration is invalid. Please have a look at the logs for further details.”
When the configuration test reports success, save your settings and check if the users and groups are fetched correctly on the Users page.
Datto Drive Avatar integration
Datto Drive supports user profile pictures, which are also called avatars. If a user has a photo stored in the jpegPhoto orthumbnailPhoto attribute on your LDAP server, it will be used as their avatar. In this case the user cannot alter their avatar (on their Personal page) as it must be changed in LDAP.jpegPhoto is preferred over thumbnailPhoto.
If the jpegPhoto or thumbnailPhoto attribute is not set or empty, then users can upload and manage their avatars on their Datto Drive Personal pages. Avatars managed in Datto Drive are not stored in LDAP.
The jpegPhoto or thumbnailPhoto attribute is fetched once a day to make sure the current photo from LDAP is used in Datto Drive. LDAP avatars override Datto Drive avatars, and when an LDAP avatar is deleted then the most recent Datto Drive avatar replaces it.
Photos served from LDAP are automatically cropped and resized in Datto Drive. This affects only the presentation, and the original image is not changed.
Microsoft Active Directory
No further tweaks need to be done to make Datto Drive work with Active Directory. Datto Drive will automatically find the correct configuration in the set-up process.
memberOf / Read MemberOf permissions
If you want to use memberOf within your filter you might need to give your querying user the permissions to use it. For Microsoft Active Directory this is described here.
Duplicating Server Configurations
In case you have a working configuration and want to create a similar one or “snapshot” configurations before modifying them you can do the following:
- Go to the Server tab
- On Server Configuration choose Add Server Configuration
- Answer the question Take over settings from recent server configuration? with yes.
- (optional) Switch to Advanced tab and uncheck Configuration Active in the Connection Settings, so the new configuration is not used on Save
- Click on Save
Now you can modify and enable the configuration.
Users being shown as objectGUIDs rather than email addresses
This can easily be changed to match the behavior typical DattoDrive users are shown on the Users page.
Above is what users will appear as with the default configuration.
To Show these user's email addresses rather than their objectGUIDs, we can simply modify the Internal Username Attribute on the Expert tab of the LDAP app located on the Admin page to use the "mail" property for all users.
After setting a value for this option, we'll need to select Clear Username-LDAP User Mapping in order for this to take effect.