Chapter 23. LDAP authentication

Procedure

1. Create a user in LDAP that has access to read the entire LDAP structure.

2. Use the ldapsearch command to test if you can make successful queries to the LDAP server. You can install this tool from automation controller’s system command line, and by using other Linux and OSX systems.

   Example

   ldapsearch -x  -H ldap://win -D "CN=josie,CN=Users,DC=website,DC=com" -b "dc=website,dc=com" -w Josie4Cloud

   In this example, CN=josie,CN=users,DC=website,DC=com is the distinguished name of the connecting user.

   Note

   The ldapsearch utility is not automatically pre-installed with automation controller. However, you can install it from the openldap-clients package.

3. From the navigation panel, select Settings in the automation controller UI.

4. Select LDAP settings in the list of Authentication options.

   You do not need multiple LDAP configurations per LDAP server, but you can configure many LDAP servers from this page, otherwise, leave the server at Default.

   The equivalent API endpoints show AUTH_LDAP_* repeated: AUTH_LDAP_1_*, AUTH_LDAP_2_*, AUTH_LDAP_5_* to denote server designations.

5. To enter or change the LDAP server address, click Edit and enter in the LDAP Server URI field by using the same format as the one pre-populated in the text field.

   Note

   You can specify multiple LDAP servers by separating each with spaces or commas. Click the icon to comply with the correct syntax and rules.

6. Enter the password to use for the binding user in the LDAP Bind Password text field. For more information about LDAP variables, see Ansible automation hub variables.

7. Click to select a group type from the LDAP Group Type list.

   The LDAP group types that are supported by automation controller use the underlying django-auth-ldap library. To specify the parameters for the selected group type, see Step 15.

8. The LDAP Start TLS is disabled by default. To enable TLS when the LDAP connection is not using SSL/TLS, set the toggle to On.

9. Enter the distinguished name in the LDAP Bind DN text field to specify the user that automation controller uses to connect (Bind) to the LDAP server.

   • If that name is stored in key sAMAccountName, the LDAP User DN Template is populated from (sAMAccountName=%(user)s). Active Directory stores the username to sAMAccountName. For OpenLDAP, the key is uid and the line becomes (uid=%(user)s).
10. Enter the distinguished group name to enable users within that group to access automation controller in the LDAP Require Group field, using the same format as the one shown in the text field, CN=controller Users,OU=Users,DC=website,DC=com.
11. Enter the distinguished group name to prevent users within that group from accessing automation controller in the LDAP Deny Group field, using the same format as the one shown in the text field.

12. Enter where to search for users while authenticating in the LDAP User Search field by using the same format as the one shown in the text field. In this example, use:

    [
    "OU=Users,DC=website,DC=com",
    "SCOPE_SUBTREE",
    "(cn=%(user)s)"
    ]

    The first line specifies where to search for users in the LDAP tree. In the earlier example, the users are searched recursively starting from DC=website,DC=com.

    The second line specifies the scope where the users should be searched:

    • SCOPE_BASE: Use this value to indicate searching only the entry at the base DN, resulting in only that entry being returned.
    • SCOPE_ONELEVEL: Use this value to indicate searching all entries one level under the base DN, but not including the base DN and not including any entries under that one level under the base DN.

    • SCOPE_SUBTREE: Use this value to indicate searching of all entries at all levels under and including the specified base DN.

      The third line specifies the key name where the user name is stored.

      For many search queries, use the following correct syntax:

      [
        [
        "OU=Users,DC=northamerica,DC=acme,DC=com",
        "SCOPE_SUBTREE",
        "(sAMAccountName=%(user)s)"
        ],
        [
        "OU=Users,DC=apac,DC=corp,DC=com",
        "SCOPE_SUBTREE",
        "(sAMAccountName=%(user)s)"
        ],
        [
        "OU=Users,DC=emea,DC=corp,DC=com",
        "SCOPE_SUBTREE",
        "(sAMAccountName=%(user)s)"
        ]
      ]

13. In the LDAP Group Search text field, specify which groups to search and how to search them. In this example, use:

    [
    "dc=example,dc=com",
    "SCOPE_SUBTREE",
    "(objectClass=group)"
     ]

    • The first line specifies the BASE DN where the groups should be searched.
    • The second line specifies the scope and is the same as that for the user directive.
    • The third line specifies what the objectClass of a group object is in the LDAP that you are using.

14. Enter the user attributes in the LDAP User Attribute Map the text field. In this example, use:

    {
    "first_name": "givenName",
    "last_name": "sn",
    "email": "mail"
    }

    The earlier example retrieves users by surname from the key sn. You can use the same LDAP query for the user to decide what keys they are stored under.

    Depending on the selected LDAP Group Type, different parameters are available in the LDAP Group Type Parameters field to account for this. LDAP_GROUP_TYPE_PARAMS is a dictionary that is converted by automation controller to kwargs and passed to the LDAP Group Type class selected. There are two common parameters used by any of the LDAP Group Type; name_attr and member_attr. Where name_attr defaults to cn and member_attr defaults to member:

    {"name_attr": "cn", "member_attr": "member"}

    To find what parameters a specific LDAP Group Type expects, see the django_auth_ldap documentation around the classes init parameters.

15. Enter the user profile flags in the LDAP User Flags by Group text field. The following example uses the syntax to set LDAP users as "Superusers" and "Auditors":

    {
    "is_superuser": "cn=superusers,ou=groups,dc=website,dc=com",
    "is_system_auditor": "cn=auditors,ou=groups,dc=website,dc=com"
    }

16. For more information about completing the mapping fields, LDAP Organization Map and LDAP Team Map, see the LDAP Organization and team mapping section.
17. Click Save.