# LDAP proxy

> Install and configure the Ironchip LDAP proxy on Windows, synchronize users and groups from LDAP, and protect directory groups with Ironchip.

URL: https://docs.ironchip.com/en/identidad/administracion/sincronizacion/proxy-ldap/

The Ironchip LDAP proxy sits in front of your LDAP domain controller to protect the authentication of the users of a specific group with Ironchip, and it can synchronize users between LDAP and Ironchip. This page is for administrators who integrate their LDAP directory with the platform.

## Requirements

- An administrator account in the Ironchip admin console.
- The company created in Ironchip. For the data to prepare, see [Before you start](https://docs.ironchip.com/en/identidad/protocolos/#before-you-start) in Integration protocols.
- An LDAP domain controller and a Windows computer to install the proxy on.

## Create the application in Ironchip

The proxy connects to Ironchip with the API key of an application of type API KEY.

1. Go to **Applications** and click **New Application**.
2. Enter the application name in **Name** and choose **API KEY** in **Application integration type**.
3. Follow the steps in the window until you finish. The application appears in the **Applications** list.

:::caution[Save the API key]
Save the API key returned when you create the application. It is shown only this once, and you need it when you configure the proxy (`ironchip_api_key`).
:::

For more information, see [Applications](https://docs.ironchip.com/en/identidad/administracion/aplicaciones/).

## Give users access

1. Go to **Applications** and, in the **Add access** column of the application, click **Add**. The **Add a new access** window opens.
2. In **Select a group**, select the users or groups that authenticate through the proxy and click **Next**.
3. In **Select usernames**, define the username. It must be the same as the one the user authenticates with. Click **Next**.
4. In **Select authentication policies**, choose the authentication method and click **Next**.
5. In **Review**, check the summary and click **Add**.

The access is created with the selected configuration, and you can change it at any time. For more information, see [Grant access to users and groups](https://docs.ironchip.com/en/identidad/administracion/aplicaciones/#grant-access-to-users-and-groups).

## Download

You can find the LDAP proxy service in the **Plugins** section of the Ironchip admin console.

## Installation

1. Move the downloaded executable to a system folder suitable for running services.
2. Run the executable with the `configuration` flag to generate the default configuration file:

   ```powershell
   ldap-windows.exe configuration
   ```

3. Edit the configuration file (see the next section) and install the service:

   ```powershell
   ldap-windows.exe service install
   ```

4. Start the service:

   ```powershell
   ldap-windows.exe service start
   ```

## Configuration

You can modify the configuration file at any time. Restart the service to apply the changes:

```powershell
ldap-windows.exe service restart
```

The configuration file has these properties:

- **Path**: the path of the configuration file.
- **`ldap`**:
  - `server_address`: the FQDN of the LDAP domain controller.
  - `server_port`: the port of the LDAP domain controller.
  - `network`: the communication scheme the client uses. Only `tcp` is currently supported.
  - `base_dn`: the base DN the proxy attaches to.
- **`proxy`**:
  - `server_address`: the address the proxy serves on.
  - `server_port`: the port the proxy serves on.
  - `protected_group`: the name of the group protected with Ironchip.
  - `network`: the communication scheme the proxy uses. Only `tcp` is currently supported.
- **`ironchip`**:
  - `ironchip_api_key`: the API key generated for the associated Ironchip service.
  - `ironchip_host`: the address of your Ironchip environment. Usually `https://api.ironchip.com`.

An example configuration file:

```json
{
  "ldap": {
    "server_address": "localhost",
    "server_port": 389,
    "tls_enable": false,
    "key_file": "",
    "cert_file": "",
    "time_out_seconds": 5,
    "network": "tcp",
    "base_dn": ""
  },
  "proxy": {
    "server_address": "0.0.0.0",
    "server_port": 4389,
    "tls_enable": false,
    "key_file": "",
    "cert_file": "",
    "protected_group": "",
    "time_out_seconds": 5,
    "network": "tcp"
  },
  "ironchip": {
    "ironchip_api_key": "<API_KEY>",
    "ironchip_host": "https://api.ironchip.com"
  }
}
```

## Protected groups

Users who belong to the protected group are protected with Ironchip.

1. On the domain controller, right-click and select **New > Group**.

   [Image: New > Group menu on the domain controller]

2. Create the group with a specific name.

   [Image: Group creation window]

   :::note
   The group name must match the `protected_group` property in the LDAP proxy configuration exactly.
   :::

3. To add a user to the group, right-click the user and select **Add to a group...**

   [Image: Add to a group option in the user menu]

4. Select the group and click **OK**.

   [Image: Selecting the group to add the user to]

The user is now protected with Ironchip.

## Verify the authentication with LDAP Admin

With the service running and the user in the protected group, test the authentication in the LDAP Admin application:

1. Start a connection: click **Start** and then **Connect**.
2. Right-click **Custom** and select **Properties**.
3. Set these properties and click **OK**:
   - **Host**: the name or address of the computer where the proxy runs.
   - **Port**: the port the proxy serves on (`server_port` under `proxy`).
   - **Username**: the username you used in the service configuration.
4. Click **OK** again to start the authentication.

The user receives a notification for the service and authorizes the access. The authentication takes a few seconds. When it finishes, you see that the user has been authorized successfully.

## User synchronization

To synchronize users between LDAP and Ironchip, the proxy includes a tool:

```powershell
ldap-windows.exe sync-users -ldap-user <user-used-for-bind> -ironchip-user <ironchip admin with access to the dashboard> -export-path <path for the exported users file creation>
```

These are the parameters:

- `-ldap-user`: the user used to bind to LDAP.
- `-ironchip-user`: an Ironchip administrator with access to the console.
- `-export-path`: the path where the file with the exported users is created.

When the import finishes, all the users are created in Ironchip.

### Group synchronization

To synchronize only the users of a group, use `sync-users` with a search filter:

```powershell
ldap-windows.exe sync-users -ldap-user <user-used-for-bind> -ironchip-user <ironchip admin with access to the dashboard> --ldap-search-filter "(&(objectClass=person)(memberOf=<group full DN>))"
```

For example, if the users belong to the `VPNAuthorized` group with the DN `CN=VPNAuthorized,DC=ironchip,DC=com`, the command is:

```powershell
ldap-windows.exe sync-users -ldap-user <user-used-for-bind> -ironchip-user <ironchip admin with access to the dashboard> --ldap-search-filter "(&(objectClass=person)(memberOf=CN=VPNAuthorized,DC=ironchip,DC=com))"
```

`sync-users` also accepts the `--ldap-search-dn` flag. It defaults to the DN set in the configuration file, but you can use it to override the base DN of the search for that run.

## Monitoring

The proxy logs its events in the Windows Event Viewer under the name `Ironchip LDAP Proxy`.

## Uninstallation

To uninstall the service, run:

```powershell
ldap-windows.exe service uninstall
```

## Console plugins

Ironchip plugins are additional tools that integrate with other systems to improve security and authentication. The **Plugins** section of the admin console lists all the plugins available for the different integrations, with their downloads:

- **Windows NPS**: integrates Ironchip with Windows Network Policy Server (NPS), so you can use Ironchip authentication for NPS-protected resources. See [NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/).

  [Image: Windows NPS plugin in the console]

- **ADFS**: integrates Ironchip with Active Directory Federation Services (ADFS), so users can sign in to ADFS-based applications and services with their Ironchip credentials. See [ADFS](https://docs.ironchip.com/en/identidad/integraciones/saas/adfs/).

  [Image: ADFS plugin in the console]

- **LDAP**: integrates Ironchip with LDAP servers for automatic user synchronization and authentication with Ironchip credentials. This is the LDAP proxy described on this page.

  [Image: LDAP plugin in the console]

- **Logon** (**Windows Logon**, **Linux Logon**, and **MacOS Logon**): agents that protect access to Windows, Linux, and Mac computers. See [Windows logon](https://docs.ironchip.com/en/identidad/integraciones/puestos/windows-logon/), [Linux](https://docs.ironchip.com/en/identidad/integraciones/puestos/linux-logon/), and [macOS](https://docs.ironchip.com/en/identidad/integraciones/puestos/macos-logon/).

  [Image: Windows Logon, Linux Logon, and MacOS Logon plugins in the console]

- **Passwordless RADIUS**: generates a RADIUS server to integrate Ironchip with that protocol. See [RADIUS server](https://docs.ironchip.com/en/identidad/integraciones/red/radius-server/).

  [Image: Passwordless RADIUS plugin in the console]

- **AD Connect**: synchronizes users so you can manage identities directly from AD. See [AD Connect](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/ad-connect/).

  [Image: AD Connect plugin in the console]

For the documentation of each integration, see the [integrations index](https://docs.ironchip.com/en/identidad/integraciones/).