Versions Compared

Old Version 23

changes.mady.by.user Lou M

Saved on

compared with

New Version 24

changes.mady.by.user MS

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

...

...

...

...

...

...

...

Table of Contents

The LDAP/Active Directory (AD) integration allows delegation of authentication to your organization's LDAP/AD server.

  • When you enable LDAP/AD, Abiquo database authentication can still be used

  • This feature should be enabled and configured immediately after you install Abiquo to ensure security and user coherence.

    • The admin user has a Cloud Admin role that cannot be modified or disabled

    • It is also possible to create additional Cloud Admin type users through LDAP/AD

Configure the LDAP/AD integration

To configure the LDAP/AD integration do these steps:

  1. Configure the Abiquo Properties as described below

  2. Check LDAP/AD users have all information to be passed to Abiquo as described below

  3. Log in to Abiquo as the admin user. Remember to set a secure password

  4. In Abiquo, create the following entities to match your LDAP/AD entities:

    1. Abiquo enterprises with the naming matching the value of the appropriate attribute from LDAP/AD. For details of how to create an enterprise, see Manage enterprises

    2. Abiquo roles with the External roles attribute set to the LDAP/AD groups of the role, see Manage Roles

      1. To use external roles, enter the role name only, for example:

        • External roles:  

          • my_ldap_role_01

          • my_ldap_role_02

After you have completed the configuration, allow your users to log in using LDAP authentication

...

To support LDAP/AD configure the following properties. See also Abiquo configuration properties#ldap

Property

Default value

Explanation _____________________________________________

abiquo.auth.module

abiquo

Whether Abiquo should authenticate only via database or it should also authenticate against LDAP/Active Directory.
Values: abiquo , ldap, openid

abiquo.ldap.authentication.server.url


URL of LDAP/Active Directory server

abiquo.ldap.authentication.server.port

389

Port to connect to on LDAP/Active Directory server.
You must enter this property, even if it is the default value

abiquo.ldap.authentication.server.protocol

ldap

Protocol to be used when authenticating to LDAP/Active Directory. Values: ldap , ldaps

abiquo.ldap.authentication.server.baseDN


Base Distinguished Name of the LDAP/Active Directory.
Usually it is the Domain Controller (or Domain in Windows).
For example, if the domain is office1.mycompany.com, you would enter "DC=office1,DC=mycompany,DC=com".

abiquo.ldap.authentication.custom.userDnPattern

cn={0},CN=Users

Use this property to tell Abiquo to perform an additional custom query against the specified schema in the LDAP/Active Directory.
This value is required. With the default value, Abiquo does not perform an additional query.
For a non-standard schema, enter the userDN pattern to successfully bind to LDAP/AD.

abiquo.ldap.authentication.attribute.enterprise

organizationname

The attribute in LDAP/Active Directory to look up the Enterprise Name which must be an Enterprise in Abiquo.

  • In OpenLDAP this value normally defaults to 'o'.

  • In Active Directory it defaults to 'company' but you could map it to 'department'.

abiquo.ldap.authentication.autoUserCreation

true

Whether Abiquo must create a user in Abiquo based on a successful login to LDAP


Information that Abiquo retrieves to create users

In LDAP/AD mode, at first login, Abiquo will retrieve the following information from LDAP/AD to create the users.

Field

Description

Enterprise

From the attribute defined by the abiquo.ldap.authentication.attribute.enterprise property 
(e.g. organizationname, "o", department, or company)

Full name

The user's given name and surname.

Role

From the groups of the user that match a single Abiquo role by its External roles attributes

Username

The Distinguished Name (DN) of the user

Email

The contact e-mail address of the user for notifications. If this value is not present at user creation, you can enter it in Abiquo later

Phone

The phone number of the user. The platform will not validate this field

Description

The description of the user


Updating users in Abiquo

In LDAP/AD mode:

  • You cannot update the user's enterprise in Abiquo. The platform will overwrite it from LDAP/AD the next time the user logs in. 

    • Administrators can still switch enterprises while they are logged in

  • You cannot update the user's role in Abiquo. The platform will overwrite it from LDAP/AD at next login

  • You can update the user's details, e.g. email address and phone number

Supported username forms

Abiquo currently supports these username forms:

You can use any of these and even switch from one to another and this will not add extra users to the Abiquo database. Each user will only have one database entry.

...

Include Page
LDAP compatibility versions table
LDAP compatibility versions table

Login resource

title
Tip

API Documentation

For the Abiquo API documentation of this feature, see Abiquo API Resources and the page for this resource LoginResource.

...