Force Synchronization from LDAP

To force the synchronization of changes made in the LDAP server with ARTESCA, follow the steps for the Users and for the Groups:

Note

Synchronization from LDAP to ARTESCA is triggered automatically in some cases:

  • On the Identity Management Page, the user listing synchronize the user list (including the deletion of a user from a LDAP instance),

  • the group listing synchronizes the group list,

  • and a user trying to authenticate against ARTESCA will synchronize the users.

You can also trigger synchronization actions manually on Users and Groups. This ensures that Users and Groups entries in ARTESCA remain up-to-date with the LDAP directory.

Important

The integration is a one-way connection which means that syncing updates ARTESCA from LDAP values but no information from ARTESCA are synced back to LDAP.

Synchronize Users

  1. Click Identity on the top menu and go to Identity providers on the sidebar menu.

  2. Select your LDAP-based IdP from the list.

  3. Click the Users tab and choose between the following buttons on the top right corner:

Synch Changed Button

This action only synchronizes entries that have been modified since the last synchronization. It is ideal for environments with frequent incremental changes, to minimize the impact on network resources.

Note

This action will not delete the Users or Groups that have been deleted on the LDAP side as it only updates existing entries.

Synch All Button

This action forces a complete synchronization of all user entries from the LDAP server to ARTESCA. Every user matching filters in the LDAP directory is synchronized with ARTESCA database. This includes creating new entries in ARTESCA for new LDAP users, updating existing ones, and possibly deleting ARTESCA entries if they no longer exist in LDAP.

Drop Synced Button

This action removes all user data in ARTESCA that has been previously synchronized from the LDAP server. ARTESCA will delete user information that was imported from LDAP. This action ensures that there are no remnants of old synchronized user data that might conflict with new settings or data source.

Synchronize Groups

  1. Click Identity on the top menu and go to Identity providers on the sidebar menu.

  2. Select your LDAP-based IdP from the list.

  3. Click the Groups tab.

Synch Groups Button

This action forces a complete synchronization of all group entries from the LDAP server to ARTESCA. Deleted Groups from LDAP will not be automatically removed. This has to be done manually in the Group management tab.

Group Membership Strategy Configuration

The ‘Group membership strategy’ configuration affects how the group membership of users is updated once a synchronization is triggered. There are two possibilities:

  • The mapping is done via the memberof attribute (using GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE): the synchronization action performed at the user level updates the group membership.

  • The mapping is done via the member attribute (using LOAD_GROUPS_BY_MEMBER_ATTRIBUTE): the synchronization action at the user level does not update any modified group memberships for that user. Instead, the update occurs during the group synchronization.

Note

Listing the group or the user login will trigger a synchronization of the membership. Even if the force sync does not display a result, the change in membership will be taken into account in both cases.

Refer to the Group membership strategy in the Build the LDAP Group Mapping dropdown menu for more information.