LDAP (Active Directory) Authentication

Large Iotellect installations are operated by hundreds of people, each of them inheriting one or many roles. Creating and maintaining individual Iotellect Server user accounts for them all is too laborious. In this case, it's possible to authenticate users through an LDAP server (such as Microsoft Active Directory), while authorization (assigning of user permissions) will use role-based Iotellect Server user accounts.

In addition to Microsoft Active Directory, the LDAP authentication feature can be used with RFC-compliant LDAP servers (e.g., FreeIPA-based solutions such as ALD PRO). Keep in mind that Microsoft Active Directory supports binding with UPN (User Principal Name, e.g., user@domain), while many RFC-compliant LDAP servers require binding with a DN (Distinguished Name, e.g., uid=user,cn=...,dc=domain,dc=tld). If you are integrating with a non-AD LDAP server and see “Invalid password” for valid credentials, review the Use UID option.

LDAP authentication is enabled and controlled through Active Directory and LDAP Authentication global server property. It has the following fields:

  • Address. IP address or hostname of an LDAP server.

  • Port. Port to connect on the LDAP server, default is 389.

  • Timeout. Timeout for LDAP authentication process. If this timeout elapses during an authentication, an Iotellect Server user trying to log in via LDAP authentication will be denied.

  • Type. Choose your authentication type: Use RDN Prefix or Use Authentication User.

  • Use UID. Boolean flag (default: false) that switches the plugin to an RFC-style authentication flow for non-Microsoft LDAP servers. When enabled, the plugin uses Distinguished Name (DN) instead of User Principal Name (UPN) during LDAP Bind, and uses uid instead of sAMAccountName in LDAP Search requests. Keep it disabled for typical Microsoft Active Directory setups (backward compatibility), and enable it for RFC-compliant LDAP servers such as FreeIPA/ALD PRO. Key name in the configuration file: useUid.

  • Default Container Mapping. Table used to convert LDAP user's primaryGroupID (found in ID column) to the group name (specified in Name column). Used only when Use RDN Prefix authentication type is used. Note, that primaryGroupID is specific to Microsoft Active Directory; many RFC-compliant LDAP servers (e.g., FreeIPA/ALD PRO) do not provide it, so this table may be ignored in such environments.

  • LDAP User Attribute to Iotellect User Mapping. A table that defines how parameters of LDAP users will be mapped Iotellect Server role-based user accounts. Once an LDAP user is successfully authenticated, the system needs to find an Iotellect Server user that matches the authenticated LDAP user. This is performed as follows:

    • The LDAP User Attribute to Iotellect User Mapping table is processed record-by-record

    • For every record, the Attribute Value Expression is evaluated. Its default context is the context pointed by value in the User column.

    • The Attribute Value Expression result is compared to the value of the LDAP user attribute pointed by the Attribute Name column. If they match, the user pointed by the User column is authorized for the current session.

When a matching LDAP User Attribute to Iotellect User Mapping record is found, processing of the table continues. If any other records will match current LDAP user (i.e. more than one record match), the authentication will fail with an error.

Note that in Use RDN Prefix mode, group-based authorization is typically implemented via the memberOf attribute in the LDAP User Attribute to Iotellect User Mapping table. Other attributes such as distinguishedName / userPrincipalName may exist in the LDAP schema, but they are not intended for group-to-role mapping in this mode.

Note that the LDAP authorization user logins user1 and user1@domain.com are equivalent and recognized as user1, but the variation domain.com/user1 cannot be used in Iotellect.

  • RDN Prefixes. RDN names to use for user lookup, without DC segments. This field is relevant only to the Use RDN Prefix authentication Type.

  • Default Domain. Name of the domain to use if it wasn't specified in the username during login.

  • Username. This field provides the user's name. It's relevant only to the Use Authentication User type.

  • Password. The user's password. This field is relevant only to the Use Authentication User type.

  • Lookup Domain. Domain to seek users in. Either Use domain part of username (e.g. part of login provided for the authentication procedure that follows @ symbol) or Use default domain (e.g. value of the Default Domain parameter).

  • Use SSL. Defines whether secure LDAPs protocol will be used.

  • Certificate. Alias of an SSL/TLS certificate to use for authentication. The certificate with that alias must exist in the server's client certificate storage.

  • Certificate Trust Policy. Defines how LDAP server certificates are verified when an SSL/TLS connection is used. Supported values:

    • Trust all certificates

    • Trust self-signed certificates

    • Trust certificates verified via default certification authorities

    • Trust certificates verified via locally defined certification authorities

    • Trust certificates verified via default and locally defined certification authorities.

Authentication By Using RDN Prefix

The following steps describe how authentication is performed if Type is set to Use RDN Prefix:

  • LDAP queries are made to list users in the Lookup Domain, one query for every record in the RDN Prefixes table. The domain part of the query is formed by concatenating the current RDN Prefix and ,DC=Lookup Domain. LDAP search scope is set to Subtree Scope. Users are searched by the userPrincipalName LDAP attribute when Use UID is disabled. If Use UID is enabled, users are searched by the uid attribute instead, and the plugin performs Bind using a DN built from uid + RDN Prefixes + domain DC segments.

  • All above queries must return strictly one result in total, otherwise, the authentication will fail.

  • If found LDAP user has primaryGroupID attribute, the user's group name is evaluated by screening the Default Container Mapping table. Group Name found in a record with ID equal to primaryGroupID is used.

  • Finally, Iotellect Server user is looked up in LDAP User Attribute to Iotellect User Mapping.

Authentication By Using Authentication User

The following steps describe how authentication is performed if Type is set to Use Authentication User:

  • An LDAP query is made to find a user by login attribute:

    • sAMAccountName is used when Use UID is disabled (typical Microsoft Active Directory case)

    • uid is used when Use UID is enabled (RFC-compliant LDAP servers)

    • Username and Password settings are used to execute the query.

  • Iotellect Server user is looked up in LDAP User Attribute to Iotellect User Mapping according to attributes of user found by the above query.

  • After the user entry is found, Iotellect Server validates the user's credentials by performing an LDAP Bind:

    • with UPN when Use UID is disabled (if applicable for the LDAP server),

    • with DN when Use UID is enabled.

ALD PRO Configuration Examples

The examples below show working configurations for ALD PRO.

Enable Use UID in all cases — this switches the plugin to RFC-compliant DN-based binding.

Before configuring either mode, complete the following steps:

  1. In server settings (Security → Authentication), set External Authentication to LDAP and set User Connection Mode to Allow Parallel Connections.

  2. For each Iotellect user referenced in the LDAP User Attribute to Iotellect User Mapping table, open the user's properties and enable external authentication.

  3. Mapping to the built-in admin user is not available — the option is disabled for security reasons.

Use RDN Prefix Mode

Field

Value

Address

ALD PRO domain controller hostname, e.g. dc01.example.lan

Port

389

Type

Use RDN prefix

RDN Prefixes

cn=users,cn=accounts

Default Domain

example.lan

Use UID

Yes

In the LDAP User Attribute to Iotellect User Mapping table, set Attribute Name to memberOf and Attribute Value Expression to the name of the ALD PRO group, e.g. 'ldap_admins'.

memberOf is a standard LDAP attribute that lists the groups a user belongs to.

Users log in with their short username, e.g. jdoe — without the domain part.

Use Authentication User Mode

Field

Value

Address

ALD PRO domain controller hostname, e.g. dc01.example.lan

Port

389

Type

Use authentication user

Username

Full DN of the service account, e.g. uid=svc_ldap,cn=users,cn=accounts,dc=example,dc=lan

Password

Service account password

Default Domain

example.lan

Use UID

Yes

In the LDAP User Attribute to Iotellect User Mapping table, set Attribute Name to memberOf.

Users log in with their short username, e.g. jdoe — without the domain part.

Known Limitations

The following attribute mapping combinations do not work and cannot be configured to work, regardless of the LDAP server type.

Mode

Mapping Attribute

Works with MS AD

Works with ALD PRO

Use RDN prefix

memberOf

Yes

Yes

Use RDN prefix

distinguishedName

No

No

Use RDN prefix

userPrincipalName

No

No

Use authentication user

memberOf

Yes

Yes

Use authentication user

userPrincipalName

Yes

No

Use authentication user

distinguishedName

No

No

Login with username in user@domain format does not work with ALD PRO in either mode. Users must enter their short username only (e.g. jdoe). Microsoft Active Directory accepts both formats.

Was this page helpful?