Caching Principal Resolution Service

Installation and Configuration

Caching Principal Resolution Service: General Settings

Cache Settings

Cache Update Settings

Health Check Settings

A health check automatically checks the connection to the cache and restarts the service if connection problems are detected.

This is done by sending a Health Check network request to the cache. If there is no response from the cache within the timeout period that is specified, this is considered to be a failure. This process is repeated until the maximum number of failures is exceeded or a response is received within the timeout.

If the maximum number of failures is exceeded, the cache service is automatically restarted.

Service Settings

Parent Cache Settings

Consumer Services (Advanced Setting)

See Producer Consumer Configuration.

Caching Principal Resolution Service (Active Directory LDAP)

1. Add a “CachingLdapPrincipalResolution” service under “Services” in the “Indices” tab.

1. “LDAP Server Hostname“ should only be configured to overwrite the configuration of “Preferred LDAP Server” under “LDAP Settings” (in the “Network”  tab). The required login information “LDAP Credential” can be selected either directly here or in the “Network” tab under “Endpoints.”

If “LDAP Connection Encryption” is selected the “Connection Encryption” under “LDAP Settings” in the “Network” tab is overwritten. The SSL protocol (LDAPS) on port 636 or the TLS protocol (StartTLS) on port 389 can be selected. If Unencrypted is selected, no encryption is performed.

1. In order to cache user and groups of different domains from the same Active Directory Forest or other Active Directory Forests (Trusted Domain Foreign Security Principals) their domain names should be configured in Domain Name field of LDAP Settings. The corresponding Credentials and Endpoints should be provided accordingly.

1. The Location can be configured as dns://<domain> (e.g. dns://mycompany.com) to use these credentials for multiple LDAP servers at the same time in one DNS domain. It is also possible to assign a credential directly to an LDAP server: ldap://<ldapserver hostname> (e.g. ldap://ldapserver.mycompany.com).

1. If no login information is configured, Kerberos is used. To do this, a valid keytab must first be uploaded under Linux and selected for this service under “Setup Kerberos Authentication.”

1. In the Kerberos authentication case, the UPN (User Principal Name) attribute of the user from the LDAP directory is used as a key for cache search. If another authentication method is used, which would send the user’s e-mail address for instance, the corresponding LDAP attributes, in this case mail, should be configured as “Alias Name LDAP Attribute”.  In addition, the “Identity Alias Name Property” field should contain the property name provided by authentication. The attributes “msDS-principalName” und “userPrincipalName” are automatically saved for all users because they are used by the client service during Kerberos authentication. Therefore, they should not be configured as user aliases. If only one domain is configured, the attribute “sameaccountname” is also automatically added.

1. If the ACLs are not normalized during indexing, i.e. they are not converted to DN format and they correspond, for example, to the “msDS-principalName“ attribute of a group in the active directory, then the “Group Alias Name LDAP Attribute“ should also be configured.

1. If users have different alias names in multiple domains, aliases from certain domains can be deprioritized using “Deprioritize Alias Names From Domain.” As a result, the principals in these domains are not added to the list of user principals.
2. Using “Suppress ‘Everyone’ Principal For Domain“ and “Suppress ‘Authenticated Users‘ Principal For Domain“ prevents users from being treated as members of these groups.

If only certain groups or users are to be stored in the cache, the "Group Filters" or "User Filters" can be configured and used for this purpose. The filters must correspond to the LDAP filter syntax. The cache structure can be restricted to certain ActiveDirectory organizational units. Therefore it is necessary to configure the "Exclude Base DN" and "Include Base DN" options accordingly. The "Distinguished Name" of all users and groups is compared with the individual lines of the configured "Include Base DN" and "Exclude Base DN" to include or exclude the user or group. The "Exclude Base DN" option is applied first.

1. By selecting the “Include Identity Principals” option, you can also search the cache for identity principals that are sent with the identity itself and find their group memberships. However,
2. “Identity Alias Name Property” allows you to use properties located in the identity in order to use their value to search the cache for group memberships.
3. Further settings can be found under General Settings.
   
4. 
5. 
   
   
   
6. “Preserve Case for Principals Matching Pattern“ allows you to keep certain principals (defined by Regex pattern) in the original format (not lower case).
7. “Exclude Principals Pattern“ allows you to remove certain principals for all users from their principals list.
8. Configuring “Foreign Security Principal Domains“ enables optimized  resolution of foreign security principals (users or groups from trusted domains). Foreign security principals are resolved for the entire domain at startup and cached until next update. For example: If the users or groups of domain1.com are added in some groups of the domain2.com then only domain1.com should be configured in this field. If this field is empty then foreign security principals will be resolved individually which, in extreme cases, may cause performance issues (timeouts) if there is a very high number of foreign security principals. All involved domains should be already configured in LDAP Setting section of Network tab.
9. “Suppress Anonymous Users Principals“ makes it possible, for example, to suppress the “Everyone” principal for anonymous users, meaning anonymous users cannot even find public documents.
10. “Resolve non anonymous principal to all registered users“ determines whether "normal" (non-anonymous) users belong to the group that contains all users.

"Include Principals Rule" allows you to add new principals for all users (if these users match a configured Regex pattern). It can also be used to create "pseudogroups", i.e. groups that implicitly contain all users. For example, with the "Pattern" .* (matches all) and the "Principal" myportal-users a pseudogroup myportal-users can be created. Each user is thus a member of the pseudogroup myportal-users.

1. “Suppress LDAP Queries“ prevents LDAP queries from being made to find these groups.
2. „Case Insensitive Member Resolution“ determines if principals are checked in a case-insensitive manner. (Default: active)
3. The “Use Parent Principal Cache Service“ and “Parent Principal Cache Service Port” options enable the group membership resolution of the user in another cache (parent cache). This means that the groups resolved by the parent cache are also returned as group membership.

1. Finally, select this service in the crawler configuration under “Caching Principal Resolution Service”. See chapter 5.

Caching Principal Resolution Service (Novell LDAP)

1. Add a “CachingNovellLdapPrincipalResolution” service under “Services” in the “Indices” tab.

1. “LDAP Server Hostname” should only be configured to overwrite the configuration “Preferred LDAP Server” in the “LDAP Settings” in the “Network” tab. The required login information “LDAP Credential” can either be selected directly here or in the “Network” tab under “Endpoints.”
2. 

1. The location for an LDAP server has this format: ldap://<ldapserver hostname> (e.g. ldap://ldapserver.mycompany.com).

1. The “Username” must be specified in DN format and the “Domain” field must be left blank.

1. For further configuration parameters see: Caching Principal Resolution (Active Directory LDAP).

Configuring the data sources for the Caching Principal Resolution Service.

Select one of the configured caching principal resolution services in “Data Source”. For example, Caching LDAP Principal Resolution can be selected for a file system data source (in the screenshot “FS Data Source”).

Producer Consumer Configuration

Producer Cache

On the producer node, click on "Add Property" in the "Consumer Services" section and configure the following fields:

Consumer Cache

On InSpire environments with producer and consumer nodes local cache updates are disabled on consumers if “Readonly on Consumer” option is selected on producer nodes. On other environments activate the "Readonly" checkbox manually. No further configuration is necessary. After each cache update on producer all of the consumer caches are automatically synchronized.

Principal Resolution Service REST API