9.1.2. Authenticating EKM Logins to Windows Active Directory

Engineering Knowledge Manager

Installation Guide | Chapter 9: Configuring Login Authentication and Access Settings | 9.1. Configuring Login Authentication |

9.1.1. Authenticating EKM Logins to an LDAP Server |  | 9.1.3. Authenticating EKM Logins to the Windows Operating System
Prev |  | Next

### 9.1.2. Authenticating EKM Logins to Windows Active Directory

To authenticate EKM logins to Active Directory, follow the steps below to enable and configure `LdapLoginModule`.

1. Stop the EKM server.

2. Edit the JBoss domain configuration.

   1. Find the security subsystem configuration element:

          <subsystem xmlns="urn:jboss:domain:security:1.2">

      In the `security-domains` child element, find the `security-domain` child element named `other`.

      In the `authentication` child element, disable the current login module (either `WindowsLoginModule` or `LinuxLoginModule`) by commenting out the appropriate line.

      Windows:

          <login-module code="waffle.jaas.WindowsLoginModule" flag="requisite" />

      Linux:

          <login-module code="com.ansys.ingress.core.security.LinuxLoginModule" flag="requisite" />

   2. In the `authentication` child element, add a `login-module` child element for `LdapLoginModule` (shown below in bold).

          <subsystem xmlns="urn:jboss:domain:security:1.2">
            <security-domains>
              <security-domain name="other" cache-type="default">
                <authentication>
                  ...
                  ...
                  <login-module code="com.sun.security.auth.module.LdapLoginModule" flag="requisite">
                    <module-option name="userProvider"
                      value="ldap://domaincontroller.yourdomain.com/DC=yourdomain,DC=com" />
                    <module-option name="authIdentity" value="{USERNAME}@yourdomain.com" />
                    <module-option name="userFilter" value="(& (|(samAccountName={USERNAME})
                      (userPrincipalName={USERNAME}@yourdomain.com)(cn={USERNAME}))(objectClass=user))" />
                    <module-option name="useSSL" value="false" />
                    <module-option name="storePass" value="true" />
                    <module-option name="tryFirstPass" value="true" />
                  </login-module>
                  <!--
                  <login-module code="com.ansys.ingress.core.security.LinuxLoginModule" flag="requisite" />
                  -->

3. Edit the configuration of the `LdapLoginModule` to configure it for your Active Directory server. Set the following `module-option` values:

   `userProvider`: Set the value to the LDAP URL of a domain controller in the Active Directory domain.

   `authIdentity`: This specifies the identity to use when authenticating to Active Directory. `{USERNAME}` is a special token that is replaced with the EKM user name that is attempting to log in — do not alter it. This string should be constructed such that it maps EKM user names to user accounts in Active Directory. The example here maps EKM user names to Active Directory user accounts.

   `storePass`: This value must be set to `true`.

   `tryFirstPass`: This value must be set to `true`.

4. Start the EKM server.

Contains proprietary and confidential information of ANSYS, Inc. and its subsidiaries and affiliates.

Prev | Up / Contents | Next

Release 18.2 - © ANSYS, Inc. All rights reserved.