By default only a few administrative users have write access to the LDAP database. Before your users may change their settings you must allow them to change their LDAP data. Hint: The ACLs below are not required if you decide to run all operations as the LDAP bind user (option "Use for all operations"). This can be done by adding ACLs to your slapd.conf or slapd.d/cn=config/olcDatabase={1}bdb.ldif which look similar to these: access to attrs=userPassword by self write by anonymous auth by * none access to attrs=mail,sn,givenName,telephoneNumber,mobile,facsimileTelephoneNumber,street,postalAddress,postOfficeBox,postalCode,roomNumber,shadowLastChange,passwordSelfResetAnswer,passwordSelfResetQuestion,passwordSelfResetBackupMail by self write by * read If you do not want them to change all attributes then reduce the list to fit your needs. Some modules may require additional LDAP attributes. You can use the tree view to get the technical attribute names e.g. by selecting an user account. Usually, the slapd.conf file is located in /etc/ldap or /etc/openldap.

There exist many LDAP implementations. If you do not use OpenLDAP you need to write your own ACLs. Please check the manual of your LDAP server for instructions.

A self service profile defines what input fields your users see and some other general settings like the login caption. When you go to the LAM configuration page you will see the self service link at the bottom. This will lead you to the self service configuration pages Now we need to create a new self service profile. Click on the link to manage the self service profiles. Specify a name for the new profile and enter your master configuration password (default is "lam") to save the profile. Now go back to the profile login and enter your master configuration password to edit your new profile.

On top of the page you see the link to the user login page. Copy this link address and give it to your users. Below the link you can specify several options. Server address The address of your LDAP server. For LDAP+SSL use "ldaps://myserver" Activate TLS Activates TLS encryption. Please note that this cannot be combined with LDAP+SSL ("ldaps://"). LDAP suffix The part of the LDAP tree where LAM should search for users LDAP search attribute Here you can specify if your users can login with user name + password, email + password or other attributes. Follow referrals By default LAM will not follow LDAP referrals. This is ok for most installations. If you use LDAP referrals please activate the referral option in advanced settings. LDAP user + password The DN and password which is used to search for users in the LDAP database. It is sufficient if this DN has only read rights. If you leave these fields empty LAM will try to connect anonymously. Use for all operations By default LAM will use the credentials of the user that logged in to self service for read/modify operations. If you select this box then the connection user specified before will be used instead. Please note that this can be a security risk because the user requires write access to all users. You need to make sure that your LAM server is well protected. Additional LDAP filter Use this to enter an additional LDAP filter (e.g. "(objectClass=passwordSelfReset)") to reduce the number of accounts who may use self service. HTTP authentication You can enable HTTP authentication for your users. This way the web server is responsible to authenticate your users. LAM will use the given user name + password for the LDAP login. To setup HTTP authentication in Apache please see this link. Default language This language is preselected on login. Enforce language Disables language selection and uses default language. Time zone Please provide your time zone. Base URL Please enter the base URL of your webserver (e.g. https://www.example.com). This is used to generate links in emails for password self reset and user self registration. Login attribute label This is the description for the LDAP search attribute. Set it to something which your users are familiar with. Password field label This text is placed as label for the password field on the login page. LAM will use "Password" if you do not enter any text. Login caption This text is displayed on the login page inside the login mask. Login footer This text is displayed on the login page below the login mask. Main page caption This text is displayed on the self service main page where your users change their data. Main page footer This text is displayed as footer on the self service main page where your users change their data. Page header This HTML code will be placed on top of all self service pages. E.g. you can use this to place your custom logo. Any HTML code is permitted. Base color Here you can change the background color for the user pages. Additional CSS links Here you can specify additional CSS links to change the layout of the self service pages. This is useful to adapt them to your corporate design. Please enter one link per line.

LAM supports 2-factor authentication for your users. This means the user will not only authenticate by user+password but also with e.g. a token generated by a mobile device. This adds more security because the token is generated on a physically separated device (typically mobile phone). The token is validated by a second application. LAM currently supports: privacyIdea YubiKey Duo Webauthn/FIDO2 privacyIDEA Base URL: please enter the URL of your privacyIDEA instance User name attribute: please enter the LDAP attribute name that contains the user ID (e.g. "uid") Optional: By default LAM will enforce to use a token and reject users that did not setup one. You can set this check to optional. But if a user has setup a token then this will always be required. Disable certificate check: This should be used on development instances only. It skips the certificate check when connecting to verification server. YubiKey Base URLs: please enter the URL(s) of your YubiKey verification server(s). If you run a custom verification API such as yubiserver then enter its URL (e.g. http://www.example.com:8000/wsapi/2.0/verify). The URL needs to end with "/wsapi/2.0/verify". For YubiKey cloud these are "https://api.yubico.com/wsapi/2.0/verify", "https://api2.yubico.com/wsapi/2.0/verify", "https://api3.yubico.com/wsapi/2.0/verify", "https://api4.yubico.com/wsapi/2.0/verify" and "https://api5.yubico.com/wsapi/2.0/verify". Enter one URL per line. Client id: this is only required for YubiKey cloud. You can register here: https://upgrade.yubico.com/getapikey/ Secret key: this is only required for YubiKey cloud. You can register here: https://upgrade.yubico.com/getapikey/ Optional: By default LAM will enforce to use a token and reject users that did not setup one. You can set this check to optional. But if a user has setup a token then this will always be required. Disable certificate check: This should be used on development instances only. It skips the certificate check when connecting to verification server. Duo This requires to register a new "Web SDK" application in your Duo admin panel. User name attribute: please enter the LDAP attribute name that contains the user ID (e.g. "uid"). Base URL: please enter the API-URL of your Duo instance (e.g. api-12345.duosecurity.com). Client id: please enter your integration key. Secret key: please enter your secret key. Webauthn/FIDO2 See the Webauthn/FIDO2 appendix for an overview about Webauthn/FIDO2 in LAM. Users will be asked to register a device during login if no device is setup. Domain: Please enter the WebAuthn domain. This is the public domain of the web server (e.g. "example.com"). Do not include protocol or port. Browsers will reject authentication if the domain does not match the web server domain. Optional: By default LAM will enforce to use a 2FA device and reject users that do not setup one. You can set this check to optional. But if a user has setup a device then this will always be required. After logging in with user + password LAM will ask for the 2nd factor. If the user has setup multiple factors then he can choose one of them.

LAM Pro can optionally display a captcha to verify that logins are not from robots. The supported captcha provider is Google reCAPTCHA. You will need the site and secret key for your domain. They can be retrieved from here: https://www.google.com/recaptcha Please note that your web server must be able to access "https://www.google.com/recaptcha/api/siteverify" to verify the captchas. Captchas will be displayed when you tick the chekbox to secure login with a captcha.

Here you can specify what input fields your users can see. It is also possible to group several input fields. Please use the arrow signs to change the order of the fields/groups. You may also set some fields as read-only for your users. This can be done by clicking on the lock symbol. Read-only fields can be used to show your users additional data on the self service page that must not be changed by themselves (e.g. first/last name). Sometimes, you may want to set a custom label for an input field. Click on the edit icon to set your own label text (Personal: Department is relabeled as "Business unit" here). Possible input fields This is a list of input fields you may add to the self service page. Account type Option Description Account locking Password expiration Read only value of password expiration date Asterisk (voicemail) Sync Asterisk password with Unix password This is a hidden field. It will update the Asterisk password each time the Unix password is changed. Group of names Group memberships (read-only) Kerberos Sync Kerberos password with Unix password This is a hidden field. It will update the Kerberos password each time the Unix password is changed. Kolab Delegates Allows to manage delegate permissions Invitation policy Invitation policy management Password policy Last password change read-only Password self reset Question Security question selection Answer Security answer Backup email (External) backup email address that has no relation to user password. Personal Business category Car license Department Description Email address Fax number First name Home telephone number Initials Job title Last name Location Mobile number Office name Organisation Organisational unit Photo Shows the user photo if set. The user may also remove the photo or upload a new one. Postal address Postal code Post office box Registered address Room number State Street Telephone number User certificates Upload of user certificates in PEM or DER format User name Web site Mail routing Local address (read-only) Mail routing address (read-only) Samba 3 Password Input field to set a new NT/LM password. The attribute "sambaPwdLastSet" is updated if it existed before. Sync Samba LM password with Unix password This is a hidden field. It will update the Samba LM password each time the Unix password is changed. Sync Samba NT password with Unix password This is a hidden field. It will update the Samba NT password each time the Unix password is changed. Update attribute "sambaPwdLastSet" on password change Updates the password timestamp when password is synchronized with Unix. Last password change (read-only) Displays the date and time of the user's last password change. Shadow Account expiration date (read-only) Last password change (read-only) Displays the date and time of the user's last password change (Unix). Windows (AD, AD LDS, Samba 4) Password Change the user's password Location Mail alias (read-only) Office name Postal code Post office box Proxy-Addresses (read-only) State Street Telephone number Web site Unix Common name Group memberships (read-only) Login shell Password This is also the source for several password synchronization options. Sync Unix password with Windows password This is a hidden field. It will update the Unix password each time the Windows password is changed. Webauthn Webauthn devices Allows the user to manage his webauthn/FIDO2 security keys. Kopano "Send as" privileges Define user who may send mails as this user Email aliases Email aliases Zarafa "Send as" privileges Define user who may send mails as this user Email aliases Email aliases PyKota Balance (read-only) Current balance for printing Total paid (read-only) Total money paid Payment history History of user payments Job history History of printed jobs

This allows to configure some module specific options (e.g. custom scripts or password hash type).

LAM Pro can check the password history and minimum age for Samba 3 password changes. In this case please provide the LDAP suffix where your Samba 3 domain(s) are stored. If you leave the field empty then no history and age checks will be done. Password history: depending on your LDAP server you might need ascending or descending order. Just switch the setting if the password history is not correctly updated.

Schema installation Please install the LDAP schema as described here. Settings You can allow your users to reset their passwords themselves. This will reduce your administrative costs for cases where users forget their passwords. To enable this feature please activate the checkbox "Enable password self reset link". Hint: Plese note that LAM Pro uses security questions by default. Activate confirmation mails and then deactivate security questions if you want to use only email validation. You can now configure the minimum answer length for password reset answers. This is checked when you allow you users to specify their answers via the self service. Additionally, you can specify the text of the password reset link (default: "Forgot password?"). The link is displayed below the password field on the self service login page. Next, please enter the DN and password of an LDAP entry that is allowed to reset the passwords. This entry needs write access to the attributes shadowLastChange, pwdAccountLockedTime and userPassword. It also needs read access to uid, mail, passwordSelfResetQuestion and passwordSelfResetAnswer. Please note that LAM Pro saves the password on your server file system. Therefore, it is required to protect your server against unauthorised access. Please also specify the list of password reset questions that the user can choose. Please note that self service and LAM admin interface are separated functionalities. You need to specify the list of possible security questions in both self service profile(s) and server profile(s). You can inform your users via mail about their password change. The mail can include the new password by using the special wildcard "@@newPassword@@". Additionally, you may want to insert other wildcards that are replaced by the corresponding LDAP attributes. E.g. "@@uid@@" will be replaced by the user name. See here for setting up your SMTP server. LAM Pro can send your users an email with a confirmation link to validate their email address. Of course, this should only be used if the email account is independent from the user password (e.g. at external provider) or you use the backup email address feature. The mail body must include the confirmation link by using the special wildcard "@@resetLink@@". Additionally, you may want to insert other wildcards that are replaced by the corresponding LDAP attributes. E.g. "@@uid@@" will be replaced by the user name. There is also an option to skip the security question at all if email verification is enabled. In this case the password can be reset directly after clicking on the confirmation link. Please handle with care since anybody with access to the user's mail account can reset the password. Captcha support LAM Pro can optionally display a captcha to verify that password resets are not from robots. The supported captcha provider is Google reCAPTCHA. You will need the site and secret key for your domain. This is setup on tab "General settings". They can be retrieved from here: https://www.google.com/recaptcha Please note that your web server must be able to access "https://www.google.com/recaptcha/api/siteverify" to verify the captchas. Captchas will be displayed when you tick the chekbox to use a captcha. Troubleshooting: 1. You get messages like "Unable to find user account." This can have multiple reasons: security questions enabled but no security question and/or answer set for this user user name + email combination does not exist no connection to LDAP server Turn on logging in LAM's main configuration settings. The exact reason is logged on notice level. 2. You do not see security question and answer fields when logged into self service. Probably, the user does not have the object class "passwordSelfReset" set. You can do this in admin interface. If you have multiple users to change then use the Multi Edit Tool to add the object class. New fields for self service page There are special fields that you may put on the self service page for your users. These fields allow them to change the reset questions and its answers. It is also possible to set a backup email address to reset passwords with an external email address. This is an example how can be presented to your users on the self service page: Password reset link After activating the password self reset feature there will be a new link on the self service login page. The text can be configured as described above (default: "Forgot password?"). When a user clicks on the link then he will be asked for identification with his user name and email address. LAM Pro will use this information to find the correct LDAP entry of this user. It then displays the user's security questions and input fields for his new password. If the answer is correct then the new password will be set. Additionally, pwdAccountLockedTime will be removed and shadowLastChange updated to the current time if existing.

With LAM Pro your users can create their own accounts if you like. LAM Pro will display an additional link on the self service login page that allows you users to create a new account including email validation (see here for setting up your SMTP server). You enable this feature in your self service profile. Just activate the checkbox "Enable self registration link". Options: Link text: This is the label for the link to the self registration. If empty "Register new account" will be used. Admin DN and password: Please enter the LDAP DN and its password that should be used to create new users. This DN also needs to be able to do LDAP searches by uid in the self service part of your LDAP tree. Object classes: This is a list of object classes that are used to build the new user accounts. Please enter one object class in each line. If you use LAM Pro password self reset feature then do not forget to add "passwordSelfReset" here. Attributes: This is a list of additional attributes that the user can enter. Please note that user name, password and email address (attribute "mail") are mandatory anyway and need not be specified. Just in case you use the legacy attribute "email" for account it needs to be specified (attribute "mail" will then not be shown). Each line represents one LDAP attribute. The settings are separated by "::". The first setting specifies the field type. The second setting is the LDAP attribute name. Depending on the field type you can enter additional options: This module allows you to manage LDAP attributes that are not covered by the other LAM modules (e.g. if you use custom LDAP schemas). You can fully define how your input fields look like: Label LDAP attribute name Unique name for field Help text Read-only display Field type: text, password, text area, checkbox, radio buttons, select list, file upload Validation via regular expression Error message if validation fails To create custom fields for the Self Service please edit your Self Service profile and switch to tab "Module settings". Here you can add a new field. Simply fill the fields and press on "Add".Please note that the field name cannot be changed later. It is the unique ID for this field.After you created your fields please press on "Sync fields with page layout". Now you can switch to tab "Page layout" and add your new fields like any other standard field. Examples for fields and their representation in Self Service:Text field:Text fields allow to specify a validation expression and error message.You can also enable auto-completion. In this case LAM will search all accounts for the given attribute and provide auto-completion hints when the user edits this field. This should only be used if there is a limited number of different values for this attribute.In case your field is a date value you can show a calendar for easy editing.Example calendar formats: dd.mm.yy: 31.12.2016 yy-mm-dd: 2016-12-31 d M, y: 31 Dec, 16 d MM, y: 31 December, 2016 Presentation in Self Service: Password field:You can also manage custom password fields. LAM Pro will display two fields where the user must enter the same password. You can hash the password if needed. Presentation in Self Service: Text area:This adds a multi-line field. The options are similar to text fields. Additionally, you can set the size with the number of columns and rows.Please note that the validation expression should be set to multi-line. This is done by adding "m" at the end. Presentation in Self Service: Checkbox:Sometimes you may want to allow only yes/no values for your LDAP attributes. This can be represented by a checkbox. You can specify the values for checked and unchecked. The default value is set if the LDAP attribute has no value. Presentation in Self Service: Radio buttons:This displays a list of radio buttons where the user can select one value.You can specify a mapping of LDAP attribute values and their display (label) on the Self Service page. To add more mapping fields please press "Add more mapping fields". Presentation in Self Service: Select list:Select lists allow the user to select a value in a large list of options. The definition of the possible values and their display is similar to radio buttons.You can also allow multiple values. Presentation in Self Service: LDAP search select listThis is similar to "Select list" but the option are read from LDAP. You can use this to define e.g. a DN selection list. Multiple values are supported. LDAP suffix: The LDAP DN that is used as starting point to search for LDAP entries.LDAP filter: Only LDAP entries that match this filter will be used. If all entries should be used then use "(objectclass=*)".Attribute name: The values of this attribute will be used to build the selection list.Display attributes: List of attributes to show as label for the options in select box. Attribute wildcards are surrounded by "$", e.g. "$cn$" will be replaced by "cn" attribute. Default is "$dn$".Presentation: Constant valueThis will set the attribute to a constant value. You can also specify wildcards to inject other attribute's values. Wildcards: %attribute%: attribute value @attribute@: first character of attribute ?attribute?: first character of attribute in lower case !attribute!: first character of attribute in upper case ??attribute??: attribute in lower case !!attribute!!: attribute in upper case ((attribute)): space if attribute is set §attribute|;§; attribute values separated by ";" (you can set other separators if you want) Examples for attributes gn="Steve", sn="Miller" and memberUid=("user1", "user2") (specified value -> resulting LDAP value):

Constant value	Resulting LDAP value
my constant	my constant
%gn%	Steve
%gn%((gn))%sn%	Steve Miller (would be "Miller" if gn is empty)
§memberUid|, §	user1, user2

Presentation: The LDAP value will be shown as text. File upload: This is used for binary data. You can restrict uploaded data to a given file extension and set the maximum file size. Presentation: The uploaded data may also be downloaded via LAM. Validation expressions: The validation expressions follow the standard of Perl regular expressions. They start and end with a "/". The beginning of a line is specified by "^" and the end by "$". Examples: /^[a-z0-9]+$/ allows small letters and numbers. The value must not be empty ("+"). /^[a-z0-9]+$/i allows small and capital letters ("i" at the end means ignore case) and numbers. The value must not be empty ("+"). Special characters that must be escaped with "\": "\", ".", "(", ")" E.g. /^[a-z0-9\.]$/i

LAM Pro allows you to integrate customs CSS style definitions and design the header of all self service pages. This way you can integrate you own logo and use your company's colors.

The default LAM Pro header includes a logo and a horizontal line. You can enter any HTML code here. It will be included in the self services pages after the body tag.

Usually, companies have regulations about their corporate design and use common CSS files. This assures a common appearance of all intranet pages (e.g. colors and fonts). To include additional CSS files just use the following setting for this task. The additional CSS links will be added after LAM Pro's default CSS link. This way you can overwrite LAM Pro's style.