Introduction
This tutorial will guide you through the configuration of custo diagnostic for using LDAP / Active Directory for user synchronization and Kerberos for Single Sign On.
Active Directory is the LDAP implementation and Kerberos is a protocol that let you identify to other services with your windows logon. Having configured both you can achieve Single Sign On which means, that custo diagnostic will automatically use the user that is logged on to Windows for authentication and the user does not need to enter any passwords.
Prerequisites
- custo diagnostic 5.1 or up
- Windows Domain with Windows Server 2008 R2 or up
- You must be Windows Domain Administrator
- Basic understanding of LDAP
- Basic understanding on Kerberos configuration
Configuring custo diagnostic for LDAP
Open custo service center and navigate to Login→LDAP. This will open up a page that contains all configuration entries regarding the connection and mapping to the LDAP server.
...
Also check the imported users on the Administration → User page.
Mapping of users
As users are automatically imported into custo diagnostic from LDAP, mapping provides you a way to configure the users automatically with the correct settings, correct tenant and correct doctor information.
The first and most important mapping is the profile mapping. This will let you provide map profiles to LDAP user groups. In custo diagnostic, this includes user permissions that are configured for the profiles.
We recommend to use the Mapping Option "PROFILE".
To add a mapping, click "Add Entry" (1) and some dialogs will open that will let you choouse the LDAP Group, Profile and mapping behaviour. Note that you cannot edit such a configured mapping but you can delete it (2) and add it again.
After you finished the mapping click on 3 to save the mapping.
...
After this your configuration is nearly complete. Hit the button "Synchronize Users" and check in Administration → User if the users are correctly imported and have the correct profile, doctor and tenant mapping.
Login Options
The last step in this process is to activate LDAP login. Go to the Login page (1) and change Login Method to LDAP (2):
...