9.1.1. Authenticating EKM Logins to an LDAP Server

Engineering Knowledge Manager

Installation Guide | Chapter 9: Configuring Login Authentication and Access Settings | 9.1. Configuring Login Authentication |

9.1. Configuring Login Authentication |  | 9.1.2. Authenticating EKM Logins to Windows Active Directory
Prev |  | Next

### 9.1.1. Authenticating EKM Logins to an LDAP Server

EKM supports both standard and proxy-based LDAP authentication. To enable and configure LDAP authentication, you must edit the JBoss domain configuration. Additional steps may be required depending on your chosen LDAP authentication method.

Refer to the section below that is pertinent to your setup:

Configuring Standard LDAP Authentication
Configuring Proxy-based LDAP Authentication

#### 9.1.1.1. Configuring Standard LDAP Authentication

To authenticate EKM user logins to an LDAP server, follow the steps below to enable and configure `LdapLoginModule`.

1. Stop the EKM server.

2. Edit the JBoss domain configuration.

   1. Find the security subsystem configuration element:

          <subsystem xmlns="urn:jboss:domain:security:1.2">

      In the `security-domains` child element, find the `security-domain` child element named `other`.

      In the `authentication` child element, disable the current login module (either `WindowsLoginModule` or `LinuxLoginModule`) by commenting out the appropriate line.

      Windows:

          <login-module code="waffle.jaas.WindowsLoginModule" flag="requisite" />

      Linux:

          <login-module code="com.ansys.ingress.core.security.LinuxLoginModule" flag="requisite" />

   2. In the `authentication` child element, add a `login-module` child element for `LdapLoginModule` (shown below in bold).

          <subsystem xmlns="urn:jboss:domain:security:1.2">
            <security-domains>
              <security-domain name="other" cache-type="default">
                <authentication>
                   ...
                   ...
                   <login-module code="com.sun.security.auth.module.LdapLoginModule" flag="requisite">
                    <module-option name="userProvider" value="ldap://ldapserver.yourdomain.com" />
                    <module-option name="authIdentity" value="uid={USERNAME},ou=users,dc=yourdomain,dc=com" />
                    <module-option name="useSSL" value="false" />
                    <module-option name="storePass" value="true" />
                    <module-option name="tryFirstPass" value="true" />
                  </login-module>
                  <!--
                  <login-module code="com.ansys.ingress.core.security.LinuxLoginModule" flag="requisite" />
                  -->

3. Edit the configuration of the `LdapLoginModule` to configure it for your LDAP server. Set the following `module-option` values:

   `userProvider`: Set the value to the LDAP URL of the LDAP server.

   `authIdentity`: This specifies the identity to use when authenticating to the LDAP server. `{USERNAME}` is a special token that is replaced with the EKM user name that is attempting to sign in — do not alter it. This string should be constructed such that it maps EKM user names to identities in your LDAP server. The example here maps EKM user names to LDAP distinguished names (DN).

   Note: Although LDAP may be configured to ignore case, EKM user names are case-sensitive. Also, EKM will only allow one version of a user name in the same workspace. For more information see How User Logins Work.

   For example, based on the above configuration, the `uid` attribute may be configured in LDAP as case-insensitive and allow either `jsmith` or `JSMITH` to be authenticated by your LDAP server:

       dn: uid=jsmith,ou=users,dc=yourdomain,dc=com

       dn: uid=JSMITH,ou=users,dc=yourdomain,dc=com

   However, because EKM user names are always case-sensitive, EKM will accept only one of these versions. The version that EKM accepts is:

   - The first user name to be used to sign in to EKM if the user account does not yet exist in EKM, and automatic account creation is enabled. Or,

   - The user name that exactly matches the user name specified in an existing EKM user account.

   `storePass`: This value must be set to `true`.

   `tryFirstPass`: This value must be set to `true`.

4. Start the EKM server.

#### 9.1.1.2. Configuring Proxy-based LDAP Authentication

For proxy-based LDAP authentication, follow the steps below to enable and configure `LdapLoginModule`.

1. Stop the EKM server.

2. Configure the EKM control scripts and Java Service Wrapper configuration (Windows only) to enable proxy-based LDAP authentication, by uncommenting specific configuration instructions. These instructions are preceded with the remark “Uncomment the next line for Proxy-Based LDAP Authentication” for easy identification.

   Windows:

   1. Uncomment the following instruction in the `ekm_start` control script:

      `EKM_ROOT182/bin/ekm_start.cmd`

          rem set OPTS=%OPTS% -Dorg.jboss.security.simpleprincipal.equals.override=true

   2. Uncomment the following instruction in the Java Service Wrapper configuration on each cluster node:

      `JBOSS_HOME/domain/configuration/wrapper.conf`

          #wrapper.app.parameter.31=-Dorg.jboss.security.simpleprincipal.equals.override=true

   Linux:

   Uncomment the following instruction in the `ekm_start` control script:

   `EKM_ROOT182/bin/ekm_start.sh`

       #OPTS="$OPTS -Dorg.jboss.security.simpleprincipal.equals.override=true"

3. Edit the JBoss domain configuration.

   1. Find the security subsystem configuration element:

          <subsystem xmlns="urn:jboss:domain:security:1.2">

      In the `security-domains` child element, find the `security-domain` child element named `other`.

      In the `authentication` child element, disable the current login module (either `WindowsLoginModule` or `LinuxLoginModule`) by commenting out the appropriate line.

      Windows:

          <login-module code="waffle.jaas.WindowsLoginModule" flag="requisite" />

      Linux:

          <login-module code="com.ansys.ingress.core.security.LinuxLoginModule" flag="requisite" />

   2. In the `authentication` child element, add a `login-module` child element for `LdapLoginModule` (shown below in bold).

          <subsystem xmlns="urn:jboss:domain:security:1.2">
            <security-domains>
              <security-domain name="other" cache-type="default">
                ...
                ...
                <authentication>
                  <login-module code="LdapExtended" flag="requisite">
                    <module-option name="java.naming.provider.url"
                       value="ldaps://ldapserver.yourdomain.com:636"/>
                    <module-option name="java.naming.security.authentication" value="simple"/>
                    <module-option name="bindDN" value="cn=ldap-proxy,ou=systems,ou=yourdomain,o=com"/>
                    <module-option name="bindCredential" value="ldap-proxy-password"/>
                    <module-option name="baseCtxDN" value="ou=yourdomain,o=com"/>
                    <module-option name="baseFilter" value="(uid={0})"/>
                    <module-option name="rolesCtxDN" value="ou=groups,ou=yourdomain,o=com"/>
                    <module-option name="roleFilter" value="(member={1})"/>
                    <module-option name="roleAttributeID" value="cn"/>
                    <module-option name="roleRecursion" value="0"/>
                    <module-option name="password-stacking" value="tryFirstPass"/>
                  </login-module>
                  <!--
                  <login-module code="com.ansys.ingress.core.security.LinuxLoginModule" flag="requisite" />
                  -->

      In this example, the LDAP proxy user through which all requests will be made is defined in the `bindDN` module option.

4. Start the EKM server.

Contains proprietary and confidential information of ANSYS, Inc. and its subsidiaries and affiliates.

Prev | Up / Contents | Next

Release 18.2 - © ANSYS, Inc. All rights reserved.