Contents

• Configure LDAP to work with AD

• Examples

  • Example LDAP/AD configuration enabling sign-in to users with their designated user name

  • Example LDAP/AD configuration enabling sign-in to groups and users within a specified organizational unit (ou)

  • Example LDAP/AD configuration enabling sign-in to groups and users within a specified nested organizational unit (ou)

  • Example LDAP/AD configuration enabling sign-in to groups and users within a specified nested organizational unit (ou) and Active Directory (AD) users

  • Example ldapsearch query to retrieve directory entries in an LDAP/AD configuration

Configure LDAP to work with AD

You can set up LDAP authentication to work with AD (Active Directory).

• As with LDAP, ensure you represent Intelligence Center roles and groups as AD groups.

• AD role and group names, that is, the values of the LDAP_ROLE_NAME_ATTR and LDAP_GROUP_NAME_ATTR attributes, should exactly match the corresponding role and group name values in the Intelligence Center.

EclecticIQ Intelligence Center provides a generic AD implementation.

You can use it as a template to fine-tune attributes and parameters to suit the specific AD setup in your environment.

The following table sums up the main differences between a vanilla LDAP configuration, and an LDAP setup that enables interoperability with AD.

• memberOf:1.2.840.113556.1.4.1941: this string enables recursive filtering and match search.

  The magic number is an OID that identifies the LDAP_MATCHING_RULE_IN_CHAIN matching rule.

  Include this string to enable recursive pattern search inside a hierarchical data structure.

• objectClass=group: the group name that identifies AD groups, as opposed to objectClass=posixGroup, which represents Unix groups.

• member={user_dn}: {user_dn} takes the returned user object value.

  This is the full user DN that is filled after the first user-search operation.

• cn, sAMAccountName, givenName: naming attributes that can vary, depending on the specific AD setup in your environment.

Examples

• Append the parameters in the following examples to /etc/eclecticiq/platform_settings.py

• Restart systemd services, so that systemd can reload all configurations, and it can apply any changes to make them effective.

  To restart systemd-managed Intelligence Center services through the command line:

  systemctl restart eclecticiq-platform-backend-services