Configure LDAP-based SSO

Limitations

LDAP-based SSO is supported only for organization IDs, not for an office network.

Step 1: Create an LDAP-based enterprise identity source

1. Log on to the EDS enterprise console.

2. In the left-side navigation pane, choose Users > Enterprise Identity Source.

3. On the Enterprise Identity Source page, click LDAP.

   If you have configured SSO before, you must first click Add Enterprise Identity Source and then select LDAP.

4. In the Add Enterprise Identity Source panel, configure the following parameters and click OK.

   Parameter	Description	Example
   Name	Enter a name for the enterprise identity source.	LDAP-IdP
   Type	Select the type of the enterprise identity source.	LDAP
   Server Type	The address of the LDAP server. The ldaps:// and ldap:// protocols are supported. If you select ldap://, we recommend that you enable StartTLS to improve the security of data transmission. You can use this feature by configuring a certificate in LDAP. For more information, see certificate verification. Note ldaps:// typically uses port 636. ldap:// with StartTLS typically uses port 389.	ldaps://127.0.0.1:636
   base DN	The base distinguished name (DN) is the path identifier for a node in the LDAP directory. By default, it is the root node. A DN is in the format of ou=your-ou, dc=example, dc=com. The DN of the root node is typically dc=example, dc=com, which is your domain.	dc=example, dc=com
   Administrator DN	Elastic Desktop Service (EDS) uses this LDAP administrator account to read LDAP information for data synchronization or delegated authentication. The account requires at least read permissions and must be in the DN format.	cn=admin, cn=User, dc=example, dc=com
   Administrator Password	The password for the administrator DN.	Ytest001
   Verify Certificate	If the Server Type is ldap:// and StartTLS is enabled, or if the Server Type is ldaps://, we recommend that you validate the LDAP certificate. By entering the LDAP certificate fingerprint, you can establish a trust relationship between Elastic Desktop Service (EDS) and the LDAP server to prevent the LDAP server from being hijacked or spoofed. If the LDAP certificate is not validated, a theoretical security risk exists. To verify the certificate: In the Verify Certificate section, select Certificate Fingerprint. Click Obtain to automatically retrieve the certificate. Note If an error occurs, check your LDAP server configuration.	34fd9df0de731df621e48763fa1b5cd7a3f50e5a2050df1dee059c849e4b****
   (Optional) User Logon Identifier	When a user from an LDAP server logs on to a WUYING Workspace client, you can configure a specific attribute as the user logon identifier. Elastic Desktop Service (EDS) will then use this attribute to query the user identifier in the LDAP server and match the password. If the password is correct, the user is allowed to log on. Note If you separate multiple attributes with commas (,), the attributes have an OR relationship. This means a user can sign on by using any of the specified attributes. Make sure that the specified attributes correspond to the same LDAP user. Otherwise, the logon fails. The default logon attribute is cn.	cn,mail
   (Optional)User ObjectClass	An LDAP ObjectClass is a collection of attributes. You can use an ObjectClass to define which object types are considered users. For example, EDS treats objects with ObjectClass=user in query results as users. The default user ObjectClass is posixAccount,inetOrgPerson,top. Note If you separate multiple ObjectClass values with commas (,), the values have an AND relationship.	posixAccount,inetOrgPerson,top

Step 2: Create users with matching LDAP usernames

After creating an enterprise identity source, you must create users in the EDS console with usernames that match their LDAP accounts. This establishes a trust relationship between the LDAP accounts and EDS.

1. In the left-side navigation pane, choose Users > User Management.

2. On the User Management page, click the User tab, and then click Create User.

3. In the Create User panel, choose a method to create users whose usernames are the same as their LDAP accounts.

   Note

   Make sure that the username you enter is identical to the LDAP account username. The password you enter here is for the cloud computer user and does not need to match the LDAP account password. You can enter any password that meets the requirements.

   Manual creation

   1. Click the Manual Entry tab.

   2. Select a convenience account type as needed.

      You can select User-activated or Administrator-activated.

   3. Enter the username that is identical to the LDAP username, and then click Create User.

      Repeat this step to create multiple users.

   Bulk creation

   1. Click the Batch Entry tab.

   2. Select a convenience account type as needed.

      You can select User-activated or Administrator-activated.

   3. Prepare a user information file in one of the following ways:

      • Click Download to download the template. Open the template, enter the user information, and save the file.

        Note

        • For user-activated accounts, the first column Username and the second column Email are required.

        • For administrator-activated accounts, the first column Username and the fourth column Password are required.

      • Enter user information in an Excel file and save it as a CSV file.

   4. Click Upload Local File, select the template file that contains the user information, and follow the on-screen instructions. The system automatically imports the user information from the file.

      After the import is complete, a Created. message appears in the Create User panel. You can click View Account to view the import status of each user's data. If the import fails, check whether the user information in the file is in the correct format.

4. Click Disabled.

   Note

   The system does not send notifications after you create convenience accounts. Notifications are sent to the specified contact methods only after you assign a cloud computer or computer pool to the accounts.

Next steps

Once LDAP-based SSO is configured for an organization ID, end users must enter the organization ID and pass LDAP authentication to sign on to the WUYING Workspace client.

For information about how end users can sign on to a WUYING Workspace client, see Quick start for end users.