GITBOOK-374: change request with no subject merged in GitBook

Author: defguard-community

.gitbook/assets/image (94).png

@@ -4,21 +4,21 @@ description: List with description of settings for LDAP found in settings page.
 
 # Settings table
 
-| Field                          | Description                                               | Default                                  |
-| ------------------------------ | --------------------------------------------------------- | ---------------------------------------- |
-| URL                            | URL that points to your LDAP server.                      | empty                                    |
-| Bind Username                  | Bind DN used for authentication.                          | cn=admin,dc=example,dc=org               |
-| Bind Password                  | Password used for authentication.                         | empty                                    |
-| Member Attribute               | Naming attribute for group membership.                    | memberOf                                 |
-| Username Attribute             | Naming attribute for users.                               | cn                                       |
-| User Search Base               | Relative Distinguished Name (RDN) of your user entries.   | ou=users,dc=example,dc=org               |
-| User Object Class              | Object class used for user entries.                       | inetOrgPerson                            |
-| Additional User Object Classes | Auxiliary classes for user entries                        | simpleSecurityObject, sambaSamAccount    |
-| Groupname Attribute            | Naming attribute for groups.                              | cn                                       |
-| Group Object Class             | Object class used for group entries.                      | groupOfUniqueNames                       |
-| Group Member Attribute         | Naming attribute for group membership.                    | uniqueMember                             |
-| Group Search Base              | Relative Distinguished Name (RDN) of your group entries.  | ou=groups,dc=example,dc=org              |
-| User RDN attribute             | The attribute used in the user's DN to identify the user. | None, defaults to the username attribute |
+| Field                          | Description                                                                        | Default                                  |
+| ------------------------------ | ---------------------------------------------------------------------------------- | ---------------------------------------- |
+| URL                            | URL that points to your LDAP server.                                               | empty                                    |
+| Bind Username                  | Bind DN used for authentication.                                                   | cn=admin,dc=example,dc=org               |
+| Bind Password                  | Password used for authentication.                                                  | empty                                    |
+| Member Attribute               | Naming attribute for group membership.                                             | memberOf                                 |
+| Username Attribute             | Naming attribute for users.                                                        | cn                                       |
+| User Search Base               | Relative Distinguished Name (RDN) of your user entries.                            | ou=users,dc=example,dc=org               |
+| User Object Class              | Object class used for user entries.                                                | inetOrgPerson                            |
+| Additional User Object Classes | Auxiliary classes for user entries                                                 | simpleSecurityObject, sambaSamAccount    |
+| Groupname Attribute            | Naming attribute for groups.                                                       | cn                                       |
+| Group Object Class             | Object class used for group entries.                                               | groupOfUniqueNames                       |
+| Group Member Attribute         | Naming attribute for group membership.                                             | uniqueMember                             |
+| Group Search Base              | Relative Distinguished Name (RDN) of your group entries.                           | ou=groups,dc=example,dc=org              |
+| User RDN attribute             | The attribute which is a part of the user's DN (the leftmost component of the DN). | None, defaults to the username attribute |
 
 ## Settings in depth
 
@@ -31,7 +31,8 @@ There are a few settings that may be not so obvious:
 Changing the RDN attribute may cause your users to be re-added to Defguard, causing potential loss of Defguard-specific user data, e.g. their device information.
 {% endhint %}
 
-* `User RDN attribute`: The attribute used in your user's DN. It will be used to link users between LDAP and Defguard. Depending on your setup, it may be different than the attribute used for usernames. 
+* `User RDN attribute`: The attribute used in your user's DN. It will be used to link users between LDAP and Defguard. Depending on your setup, it may be different than the attribute used for usernames. If left empty, your username attribute will be used instead. For example:\
+  Given a user DN of `cn=user1,cn=users,dc=ad,dc=example,dc=com` you would set the RDN attribute to `cn`.
 * `Username attribute`: The username attribute which will be used to set the username of a Defguard user. The following restrictions apply:
   * Only alphanumeric characters except for  <kbd>.</kbd>, <kbd>-</kbd> or <kbd>\_</kbd>
   * At least 1 and at most 64 characters

enterprise/all-enteprise-features/ldap-and-active-directory-integration/settings-table.md

@@ -9,6 +9,20 @@ icon: chevrons-up
 Before doing any updates please remember to **backup your database.**
 {% endhint %}
 
+## 1.3.0 any previous alpha -> alpha 4
+
+### Core
+
+LDAP integration received a major overhaul of how users are mapped to Defguard users when the two way synchronization is enabled. Now users are always identified by their leftmost DN value. 
+
+A new synchronization may cause some of your users to be re-added, which in turn may cause the loss of some of their Defguard specific data (e.g. their devices). This will happen if your leftmost DN component's attribute (referred to as RDN) is not the same as your current username attribute. This issue is only related to the two way synchronization mechanism and occurs only if you used one of the previous alphas of 1.3.0. Upgrading from any previous release to alpha 4 (skipping the alphas before) should not result in this happening.
+
+Before an upgrade, turn off the two way synchronization. After upgrading you will have access to a new option, the RDN user attribute:
+
+<figure><img src="../../.gitbook/assets/image (94).png" alt=""><figcaption></figcaption></figure>
+
+Set it according to your LDAP server setup. This should be the DN's leftmost component attribute, e.g. in the case of `cn=user1,cn=users,dc=ad,dc=example,dc=com` this would be "cn". This attribute is needed to properly identify users in your LDAP server. The username attribute will be mapped to Defguard usernames. Read [settings-table.md](../../enterprise/all-enteprise-features/ldap-and-active-directory-integration/settings-table.md "mention") for a description of those settings options. After you configured this value, you can re-enable the two way synchronization.
+
 ## 1.3.0 (alpha)
 
 *   If you used the LDAP integration previously, it will be off by default after upgrading. You will have to manually enable it in the settings in the LDAP tab:\