Adding a User Authentication Module

An authentication module lets staff users log in to Ubersmith with an account from an external service. Ubersmith has three authentication modules: Active Directory, LDAP, and SAML.

Open the Add Authentication Module window

1. Click Settings.
2. Click User Authentication. For more information, refer to the article "Configuring User Authentication".
3. In the Authentication Modules section, click Add New Authentication Module. The Add Authentication Module window opens.

Complete the Details tab

1. In the Enabled field, select YES to use the module.
2. In the Module field, select Active Directory, LDAP, or SAML. The Config tab changes for the module.
3. In the Priority field, type a number. Ubersmith uses the modules in order of priority. Ubersmith uses the lowest number first.
4. Select Create User on Login if Ubersmith must add a user the first time that a person logs in with this module. If you do not select it, the user must already exist in Ubersmith.

Complete the Config tab for Active Directory or LDAP

Active Directory and LDAP use the same fields. For Active Directory, Ubersmith uses different default values.

1. Click the Config tab.
2. In the Server field, type the IP address or the host name of the directory server.
3. In the Port field, type the port of the directory server. The default is 389.
4. In the SSL/TLS field, select the encryption:

• For LDAP, select SSL Off, SSL On, or StartTLS. Use StartTLS if your server supports it. SSL On is deprecated by OpenLDAP.
• For Active Directory, set SSL/TLS to YES to use SSL.

1. In the Base DN field, type the distinguished name (DN) that Ubersmith searches in, for example dc=example,dc=com.
2. In the Group DN field, type the DN of the groups. Ubersmith adds the Base DN to the end of it. For example, if Group DN is ou=groups and Base DN is dc=example,dc=com, Ubersmith searches ou=groups,dc=example,dc=com.
3. In the Group Class field, type the objectClass of a group. If you leave it empty, Ubersmith uses groups for LDAP and group for Active Directory.
4. In the Group Filter field, type a filter for group searches, for example (cn=ubersmith*).
5. In the Group Member Attribute field, type the attribute of a group that holds its members. If you leave it empty, Ubersmith uses member.
6. In the User DN field, type the DN of the users. Ubersmith adds the Base DN to the end of it.
7. In the User Class field, type the objectClass of a user. If you leave it empty, Ubersmith uses person.
8. In the User Identifier field, type the attribute of a user that holds the login name. This value must be the same as the Login of the user in Ubersmith. If you leave it empty, Ubersmith uses uid for LDAP and sAMAccountName for Active Directory.
9. In the User Membership field, type the attribute of a user that holds the groups of the user. If you complete this field, Ubersmith does not use Group Member Attribute.
10. In the User and Password fields, type the account that Ubersmith uses to connect to the directory. Complete these fields if the directory does not allow anonymous connections.
11. In the Network Timeout field, type the number of seconds that Ubersmith waits for the directory server. The default is 10.
12. In the Version field, select the LDAP protocol version. The default is 3.
13. In the Allow password caching field, select YES to save a hash of the password of each user after a successful login. Ubersmith uses the hash for existing users when the directory server is not available.

Then complete the Password Reset Configuration section. See Complete the Password Reset Configuration section.

Complete the Config tab for SAML

You must have an account with a SAML identity provider (IdP), for example Google Workspace or Microsoft Entra ID.

1. Click the Config tab.
2. In the IdP Display Name field, type the name of the link on the Ubersmith login page.
3. Optional: In the IdP Icon field, type the URL of an icon for the link.
4. In the SP Entity ID field, type the URL of your Ubersmith, without a / at the end. For example, https://ubersmith.example.com.
5. In the IdP Entity ID field, type the entity ID from your IdP.
6. In the IdP Login URL field, type the single sign-on (SSO) URL from your IdP.
7. Optional: In the IdP Logout URL field, type the single logout URL from your IdP. If you leave it empty, users log out of Ubersmith only.
8. In the IdP x509 Certificate field, paste the certificate from your IdP.
9. In the Ubersmith "Login Name" Attribute Name field, type the name of the IdP attribute that holds the login name of the user.
10. In the First Name Attribute Name, Last Name Attribute Name, and Email Address Attribute Name fields, type the names of the IdP attributes. Ubersmith uses them when it adds a new user.
11. Optional: In the Permission Group Attribute Name field, type the name of the IdP attribute that holds the groups of the user.
12. Keep the default values in Advanced Security Settings, unless your IdP needs different values. The SP x509 Certificate and SP x509 Private Key fields are necessary only if you sign or encrypt SAML messages.

Then complete the Password Reset Configuration section. For a complete example with Google Workspace, refer to the article "Configuring Google Workspace SAML Login". For Microsoft Entra ID, refer to the article "Configuring Microsoft Entra ID SAML".

Complete the Password Reset Configuration section

When a user of this module asks to reset the password, Ubersmith sends this email. The password of the user is in the external service, so the email usually tells the user who to contact.

1. In the From Name field, type the name that the email comes from.
2. In the From Email field, type the email address that the email comes from. If you leave it empty, Ubersmith uses the Default Email Address of the company identity.
3. In the Subject field, type the subject of the email.
4. In the Body field, type the text of the email.

Complete the Brand Access tab

1. Click the Brand Access tab.
2. To let the users of this module access all brands, set Full Brand Access? to YES.
3. Or, set Full Brand Access? to NO, then select each brand that the users of this module can access.
4. Click Save. To add one more module, click Save & New.

To give roles to the groups from the module, click edit access in the row of the module. For more information, refer to the article "Managing Authentication Modules".

Set up the users

Existing users

If a user has the same login name in Ubersmith and in the external service:

1. Go to Settings > Users.
2. Click the name of the user.
3. In the User Info box, click edit. The User Info & Brand Access window opens.
4. In the Authentication field, select the module. The list shows Ubersmith Authentication and each module.
5. Click Save.

New users

If you selected Create User on Login, a person who does not have an Ubersmith user can log in with the login name and password from the external service. Ubersmith adds the user automatically. For more information about how to add users manually, refer to the article "Adding Users".