Integration › Clients

LDAP V2/V3

Add a directory of your choice as a client interface to XPhone Connect Directory and access your contact data via the LDAP protocol. XPhone Connect Directory supports the LDAP protocols in versions 2 and 3.

Configuration

• Open the configuration interface of the XPhone Connect Directory.

• Click on Add client interface.

• Select the client interface type LDAP V2/V3.

• Click on the Next button.

• Carry out the steps in the dialog:

1. Configure the Basic settings

2. Configure IP & Port

3. Configure the Authentification

4. Alternative identity

   XPhone Connect Directory can dynamically change the user context within an LDAP query. This allows specially customized applications to access personal contact data via LDAP. The LDAP client must ensure, together with suitable security settings, that no misuse is possible.

   • Identification feature

     If you want to use the alternative identity, enable the Activate alternative identity via filter condition in the LDAP query option and then select how the users should be authenticated via Identification feature. The authentication of the user takes place via the LDAP filter element :authentication:=<value>. For this purpose, an attempt is made with each search query to find the value <value> in the user data of the Active Directory or in the XPhone Connect Server user administration.

   • Security info

     Be sure to read and confirm the safety instructions.

     The Alternative identity is only required if…

     • …data sources for personal contact data are set up…

     • …and the LDAP clients are not able to authenticate the owner of the personal contact data via the LDAP login. This is usually the case when dealing with server applications or PBXs.

     XPhone Connect Directory therefore offers the possibility that these applications include in the LDAP query the identity of the user for whom the query is executed. The identity is determined by any user-specific feature known to the LDAP client and which is checked against an attribute in the Active-Directory or in the XPhone Connect Server user administration (e.g. phone number, MAC address, user name).

     With the Alternative identity option, the authentication security of the XPhone Connect Directory is disabled for this client interface. Please note the following:

     • The LDAP client must make the authentication.

       The LDAP client (e.g. a telephone system, a terminal device or another server application) that accesses this client interface must ensure that this identification feature is only used correctly for authenticated users. This means that the LDAP client is responsible for authentication.

     • Protecting the LDAP client from unauthorised access.

       If an LDAP client is not able to perform authentication, it must be ensured that no unauthorized intervention can take place in its functionality (in particular the configuration). If it is possible to configure the client without authorization in such a way that a false identification feature can be incorporated into the query, the confidentiality of the contact data in personal contact data directories is no longer guaranteed.

     • Protecting the connection between the LDAP client and XPhone Connect Directory.

       The connection between the LDAP client and Virtual Directory must be secured as follows:

       • Set up a TCP/IP connection only via SSL (LDAPS) (see client interface configuration IP & Port).

       • Activate the login via name/password in the configuration of the client interface under authentication. Always choose a sufficiently long password. We recommend at least 30 characters in random order with the additional use of special characters and numbers. Switch off Anonymous login.

       • Restrict the range of permissible IP addresses by making the corresponding settings in Security in the client interface configuration.

       • Where possible, restrict access to the network connection by using VLANs or via appropriate configuration of switches, gateways and firewalls. Under no circumstances should you operate secure and insecure clients at the same client interface.

     If in doubt, dispense with the Alternative identity” function.

5. Configure Security

6. Configure the Search

7. Configure the Phone number conversion

8. Configure the Restricting the number of hits

9. Configure the Overview