Product line
Standard
|Expert
Operating mode
CLOUD ABO
|ON-PREMISES
Modules
Services & CRM
Budget & Phases
Purchases
Resource Planning
Business Intelligence
Starting with version 6.1 it is possible to pair users in Vertec with users in an LDAP server (e.g. Active Directory). The prerequisite for this is a correctly configured LDAP server. The customer is responsible for this. When logging in to Vertec, the user can then log in with his username and password from LDAP. For this purpose, there are a number of properties in the system settings Authentication:
LDAP Administrator |
Here a Vertec user has to be defined as LDAP administrator. All Vertec Administration can be selected. This user is always authenticated directly via his Vertec login. An access to Vertec is therefore possible for the admin even without an available LDAP server. |
LDAP Authentication via Domain |
The domain name that users can use to authenticate themselves. |
LDAP Server Address |
The server address of the LDAP server without port. |
LDAP Server Port |
The port on which the LDAP server can be reached. If empty, the default port 636 is taken. |
LDAPS certificate fingerprint |
The fingerprint of the LDAP server certificate. If the LDAP server has a trusted certificate, as of Vertec 6.5.0.16, the fingerprint check is dispensed with if the operating system accepts the certificate as valid. In this case, as of Vertec 6.5.0.16, some symbol must be inserted in this field (the field must not be blank). As of Vertec 6.7.0.1, the field can also be left blank. If the LDAP server does not have a trusted certificate and if the fingerprint entered here does not match the fingerprint entered when connecting to the LDAP server, the connection will be denied. Please note: Even if the certificate is automatically renewed by the LDAP server, the fingerprint will change and must be entered again. Otherwise, the login to Vertec will fail. To enter the fingerprint of the certificate in Vertec, double click on the certificate (.cer File), tab Details, field Fingerprint. If you select the entry, the value to be copied will be displayed in the lower area. Note: If you select the entire string in the lower area, invisible Unicode characters will be included – see https://support.microsoft.com/en-us/help/2023835. If this string is copied into Vertec, a question mark will appear at the beginning of the string. This must be deleted, otherwise the fingerprint comparison will fail. It is a pure sequence of hexadecimal numbers. There must be no special characters or colons between the symbols. Only spaces are allowed as separators. |
The following guidelines apply:
If one of these settings is not set, the authentication takes place via the Vertec logins.
Changes to the system settings will only take effect in the Cloud app and Web app after restarting the Cloud Server. The Desktop App must also be restarted (logging out is not enough). Cloud Suite customers can use the Restart via Customer Portal trigger.
If the host or LDAP server goes down while the Cloud Server is running, the authentication server will be shown to the users when they attempt to authenticate. If the LDAP server becomes available again, the Cloud Server will reconnect transparently. In this case, there is no need to restart the Cloud Server.
There are cases where the connection to the LDAP server is lost after a prolonged period of inactivity. For example, when using Azure Active Directory, this is the case after 4 minutes (see https://azure.microsoft.com/de-de/blog/new-configurable-idle-timeout-for-azure-load-balancer/). In such cases, it is advisable to ensure at the network level that this does not happen, for example by configuring a TCP keep alive timeout that is less than 4 minutes.
With Vertec version 6.1.0.11 the static connection of the Cloud Server to the LDAP server has been removed. The Cloud Server then establishes a new connection to the LDAP server (similar to the Desktop App) for each authentication attempt.
The log entries regarding LDAP are located in Vertec.Cloudserver.log. when using a Cloud Client or in Vertec.Deskop.log. when using the Desktop App.
The connection to the LDAP server at the start of the Cloud Server or the Desktop App is shown by Info Messages (Connecting to the LDAP authentication server, Connect to the LDAP authentication server). These always appear in the log when LDAP is configured.
Log entries for LDAP configuration and bind call errors will appear as Debug Messages in the log file if the appropriate Debugcategory named Verteclib.LdappasswordAuthenticationProvider is specified. Contact your Vertec adviser.
If you already use LDAP and want to use the usual two-factor authentication of an external tool for Vertec logins, this is possible if the tool allows it with LDAP.
Up to now, an application has been made, for example, with Duo whose authentication proxy shows a push message on the Duo app when a user attempts to log in to Vertec via LDAP, where the user can confirm his login attempt.
The application takes place purely in the external tool, which is compatible with LDAP, and has nothing to do with Vertec itself. Therefore, only the push notifications for logging in to Vertec work, no direct input of codes etc.