AD/LDAP configuration for authentication
To configure AD/LDAP only for user authentication, the portal administrator must create users in the IT Analytics Portal similar to those present in AD/LDAP database.
- Login to the IT Analytics Portal as a super user and go to Admin > Users.
- Create a new user with the same user name present in AD/LDAP.
- Assign appropriate privileges to the new user.
- If the portal server fails to resolve the AD/LDAP hostname, add the hostname entry in the
/etc/hostsfile on the portal server.<AD_IP_Address> <AD_Domain_Name>
For example:
192.168.2.90 ad.gold
- Go to Admin > Authentication > LDAP.
- Enable authentication, authorization, and enter the configuration as suggested in the table below:
Field name
Description
Enabled
Select to enable AD/LDAP authentication
Authorisation
You can skip enabling this as you are only enabling authentication.
When selected, Portal authorizes the user against AD groups. At least one AD group of which the new user is a member must be configured as a User Group in the Portal.
Note:
If the AD group is not mapped with the User Group in the Portal, then authentication fails during login with the error: "No user group mapping present for external LDAP user."
LDAP Domain Name
This field is deprecated. If this field appears in your Portal, enter LDAP as its value.
Example:
LDAP Domain Name: LDAP
LDAP URL
Set to the host and port of your AD. Note that this URL value has a prefix ldap:. If using SSL, change the prefix to ldaps:.
If you are using Active Directory for your external LDAP configuration, you may want to use the global catalog port of 3268 instead of port 389.
If using SSL, you may want to use the secure global catalog port of 3269 or 636 for standard LDAPs.
Example:
ldap://example.company.com:389
or
ldaps://example.company.com:636
Search Base
Set the location from where the search will be performed to locate users in the authentication directory.
Often referred to as the Active Directory (AD) Search Base, this is the starting point in the Active Directory tree for searching for LD AP users. This search base, in LDAP distinguished name format, contains a fully qualified domain name. IT Analytics supports only one Search Base.
Example:
dc=example,dc=company,dc=com
DN
Set to the ID of a user or a service account that has permission to search the search base. This user or service account must be able to search all LDAP directory servers.
IT Analytics requires a user or a service account name that has privileges to search under the Base DN (Distinguished Name) within the Active Directory structure. This must be an account that has administrative privileges, typically an Administrator. It can be the Administrator account that was created when Active Directory was installed, or it can be an account that was created and either was given administrative privileges or was placed into a group with administrative privileges.
If you use Active Directory, specify this setting because Active Directory services do not allow anonymous binds. Microsoft Active Directory requires the username and password of a user that has enough privileges to search the LDAP directory.
CN=Admin,CN=Users,DC=example,DC=company,DC=com
In this case the Admin user in the common name Users has permissions to search the search bases: DC=example,DC=company,DC=com.
Note:
Special characters #, >, <, ;, (, ), and = are supported, but / and \ are not supported in DN and CN.
DN Password
Set to the password of the user who is used in the DN field.
Certificate
If LDAP is configured with SSL, you need an LDAP server certificate for a secure connection with the LDAP server. You can get this certificate from the LDAP administrator or an Active Directory administrator for upload.
Note:
If you have a certificate chain, you must isolate the LDAP server certificate from the chain and upload it separately as a single certificate. Also, the certificate is expected to contain plain text anchor lines like BEGIN CERTIFICATE and END CERTIFICATE.
Login Attribute
Enter the login attribute used for authentication. This is the attribute name in Active Directory that specifies the username, such as uid or sAMAccountName.
Example:
sAMAccountName
New User Domain
Enter the domain name on which the user needs to be authorized. Get the domain name from Admin > Domains > Domain Name.
Example:
example.company.com
Disable User Attribute Name
Enter the value of the AD attribute that indicates whether the user is active or inactive. During Portal authentication via AD, the REST API uses the AD attribute assigned to this property to check whether the user is still an active AD user.
For example, if
ad.user.activeis the AD attribute that indicates whether a user is active or disabled, thenad.user.activemust be assigned as the value of this field.Disable User Attribute Value
Enter the same value as that of the AD attribute (specified in Disable User Attribute Name, which indicates the AD user is disabled.
For example: If
ad.user.activeis the attribute for user status in AD, it may have several values such aslive, inactive, joined, and so on. If the valueinactiveindicates the user is disabled in AD, then inactive must be set as value for this property (inactive).REST API matches this value with the value of the AD attribute specified in this field. If the values match, the user is disabled on the IT Analytics Portal.
Note:
A Portal super user must explicitly activate the user that was deactivated in both AD and Portal in the past but is again activated only in AD. A Portal administrator with adequate privileges can also activate such a user. Without user activation, Portal access will be restricted.
- Click Test Connection. Make the required changes if the test fails.
- Click Save.
Enabling LDAP authentication is complete.
Note:
If you are unable to save the configuration, check if the JDK truststore password was changed before the last upgrade and ensure the updated password is assigned to the
portal.jdk.trustStore.passwordparameter from Admin > System Configuration > Custom page of the Portal. The JDK truststore locations for Windows and Linux are<portal_installation_path>\jdk\lib\security\cacertsand/usr/java/lib/security/cacertsrespectively. - To change the existing superuser LDAP_ID to map to the AD username, update the existing record on the Oracle database server.
For example: If the login attribute is user_name and actual value is Admin, update the existing record as below:
# sqlplus portal/<portal_password>@scdb # UPDATE ptl_user SET ldap_id = 'Admin' WHERE user_id = 100000; # commit;
Use this updated username to login to the external directory, instead of aptare. Since the user account aptare (user_id=100), is an internal bootstrap user, it is required to maintain referential integrity among database tables and therefore you must avoid using aptare for external LDAP integration.
Note:
The user_id = 100000 is always the default user_id for the super user account.
- Login to the portal using any user name common across AD/LDAP and the IT Analytics Portal.
If the Portal was upgraded from a lower version, you may have to clear the browser cache for the authentication type and SSO options to appear on the login screen.