AD/LDAP Configuration for authentication and authorization
To configure AD/LDAP for user authentication as well as authorization, Portal Administrator must create at least one User Group in portal which is also present in AD/LDAP as a UserGroup.
- Login to Portal as a SuperUser, navigate to Admin > User Groups.
- Create a new user group with the same group name present in AD/LDAP. Only members of this user group can access the portal when LDAP Authroization is enabled on the Portal.
- Assign appropriate privileges to the newly created user group. See Setting user group privileges section in the User Guide.
- Record the domain name where new users will be created.
To find domain name, navigate to Admin > Domains > Domain Name.
You are required to specify this in the LDAP Domain Name field when you enable LDAP authentication.
- Go to Admin > Authentication > LDAP.
- Enable authentication, authorization, and enter the configuration as suggested in the table below:
Field name
Description
Enabled
Select to enable AD/LDAP authentication
Authorisation
Select to enable AD/LDAP authorisation
When selected, Portal authorizes the user against AD groups. At least one AD group of which the new user is a member must be configured as a User Group in the Portal.
Note:
If the AD group is not mapped with the User Group in the Portal, then authentication fails during login with the error: "No user group mapping present for external LDAP user."
LDAP Domain Name
Enter the Portal domain name where the new user gets created. It is used provided ldap.authorization is set to true.
To find domain name in portal, go to Admin > Domains > Domain Name.
Example:
example.company.com
LDAP URL
Set to the host and port of your AD. Note that this URL value has a prefix ldap:. If using SSL, change the prefix to ldaps.
If you are using Active Directory for your external LDAP configuration, you may want to use the global catalog port of 3268 instead of port 389.
If using SSL, you may want to use the secure global catalog port of 3269 or 636 for standard LDAPs.
Example:
ldap://example.company.com:389
or
ldaps://example.company.com:636
Search Base
Set the location from where the search will be performed to locate users in the authentication directory.
Often referred to as the Active Directory (AD) Search Base, this is the starting point in the Active Directory tree for searching for LD AP users. This search base, in LDAP distinguished name format, contains a fully qualified domain name. IT Analytics supports only one Search Base.
Example:
example, company, com
DN
Set to the ID of a user who has permission to search the SEARCHBASE. This user must be able to search all LDAP directory servers.
IT Analytics requires a user that has privileges to search under the Base DN (Distinguished Name) within the Active Directory structure. This must be an account that has administrative privileges, typically an Administrator. It can be the Administrator account that was created when Active Directory was installed, or it can be an account that was created, and either was given administrative privileges or was placed into a group with administrative privileges.
If you use Active Directory, specify this setting because Active Directory services do not allow anonymous binds. Microsoft Active Directory requires the username and password of a user that has enough privileges to search the LDAP directory.
Example:
CN=Admin,CN=Users,DC=example,DC=company,DC=com
Note:
Special characters #, >, <, ;, (, ), and = are supported, but / and \ are not supported in DN and CN.
DN Password
Set to the password of the user who is used in the DN field.
Certificate
Navigate to the keystore path location and select the AD certificate.
Login Attribute
Enter the login attribute used for authentication. This is the attribute name in Active Directory that specifies the username, such as uid or sAMAccountName.
Example:
sAMAccountName
New User Domain
Enter the Portal domain name where new user gets created. It is used only if Authorisation is enabled. To find domain name in portal, navigate to Admin > Domains > Domain Name.
Example:
example.company.com
Disable User Attribute Name
Enter the value of the AD attribute that indicates whether the user is active or inactive. During Portal authentication via AD, the REST API uses the AD attribute assigned to this property to check whether the user is still an active AD user.
For example, if
ad.user.activeis the AD attribute that indicates whether a user is active or disabled, then ad.user.active must be assigned as the value of this field.Note:
If a user account is disabled in LDAP, subsequent API calls for that user will result in the user being disabled in IT Analytics.
Disable User Attribute Value
Enter the same value as that of the AD attribute (specified in Disable User Attribute Name, which indicates the AD user is disabled.
For example: If
ad.user.activeis the attribute for user status in AD, it may have several values such as live, inactive, joined, and so on. If the value inactive indicates the user is disabled in AD, then inactive must be set as value for this field.REST API matches this value with the value of the AD attribute specified in this field. If the values match, the user is disabled on the IT Analytics Portal.
Note:
A Portal super user must explicitly activate the user that was deactivated in both AD and Portal in the past but is again activated only in AD. A Portal administrator with adequate privileges can also activate such a user. Without user activation, Portal access will be restricted.
- Click Test Connection. Make the required changes if the test fails.
- Click Save.
Enabling LDAP authentication and authorization is complete.
Note:
If you are unable to save the configuration, check if the JDK truststore password was changed before the last upgrade and ensure the updated password is assigned to the
portal.jdk.trustStore.passwordparameter from Admin > System Configuration > Custom page of the Portal. The JDK truststore locations for Windows and Linux are<portal_installation_path>\jdk\lib\security\cacertsand/usr/java/lib/security/cacertsrespectively. - To change the existing superuser LDAP_ID to map to the AD username, update the existing record on the Oracle database server.
For example: If the login attribute is user_name and actual value is Admin, update the existing record as below:
# sqlplus portal/<portal_password>@scdb # UPDATE ptl_user SET ldap_id = 'Admin' WHERE user_id = 100000; # commit;
Use this updated username to login to the external directory, instead of aptare. Since the user account aptare (user_id=100), is an internal bootstrap user, it is required to maintain referential integrity among database tables and therefore you must avoid using aptare for external LDAP integration.
Note:
The user_id = 100000 is always the default user_id for the super user account.
- Login to the portal using any user present in the Active Directory and part of the group created in step 2.
If the Portal was upgraded from a lower version, you may have to clear the browser cache for the authentication type and SSO options to appear on the login screen.
Note that to automatically create a user in the portal, these attributes must be set for each user in AD/LDAP:
givenName: Mandatory. It is used as the first name of the user.
telephoneNumber: Optional
mobile: Optional
mail: Mandatory
Note:
If for any reason the LDAP configuration is disabled from the portal, the portal administrator must set the password for all the AD/LDAP users in portal.