LDAP and Active Directory Integration

The LDAP/Active Directory (AD) integration allows delegation of authentication to your organization's LDAP/AD server.

The main steps to configure LDAP/AD integration are:

1. Configure the Abiquo Properties.
2. Create LDAP/AD users and enter all information to be passed to Abiquo including the fields for the Abiquo Enterprise and Role.
3. Create matching Enterprise and Role in Abiquo (see Manage Enterprises and Manage Roles and Manage Privileges).

Configuring Abiquo to Log In Against LDAP/Active Directory

To support LDAP/AD, new properties have been added to the Abiquo configuration file (abiquo.properties). The most important of these properties is abiquo.auth.module, which actually sets the authentication mode. This property must have one of the following values:

• abiquo: to log in against Abiquo database. Default mode.
• ldap: to log in against a configured LDAP/AD server.

Turn LDAP mode on by modifying the abiquo.auth.module property to 'ldap'. Users created in the Abiquo database will still be able to log in to Abiquo. To prevent those users from logging in to Abiquo you must manually disable them.

When operating in 'ldap' mode:

• Abiquo user creation is disabled.
• Abiquo user edition is enabled with two restrictions:
  • Roles cannot be changed for LDAP users. Roles will be synchronized with LDAP every time the user performs a successful login.
  • Enterprise can be modified but it will be overwritten the next time the user performs a successful login. This allows users with the administer all enterprises privilege to use the impersonate feature to administer any enterprise.

Abiquo Cloud Admin User

The Abiquo admin user has a Cloud Administrator role and it cannot be modified or disabled. The Cloud Admin should log in with this admin user, set a very secure password, and configure the enterprises and roles for LDAP. The Cloud Admin may also configure an LDAP Cloud Administrator user.

LDAP/AD Abiquo Configuration Properties

The following properties are used for configuring LDAP/AD integration. All of these properties are explained in the Abiquo Configuration Properties section.

Notes about the properties:

• abiquo.auth.module: When authenticating with the 'abiquo' module, there is no LDAP integration at all. To enable LDAP integration change the value to 'ldap'.
• abiquo.ldap.authentication.server.baseDN: Base Distinguished Name. This is one of the most important properties and the most difficult to set up. Usually it is the Domain Controller, or using Windows naming, the Domain. So if your domain is office1.mycompany.com the value of this property would be DC=office1,DC=mycompany,DC=com.
• abiquo.ldap.authentication.custom.userDnPattern: If your company is using a non-standard schema, include this value with the userDN pattern to successfully bind to LDAP/AD.
• abiquo.ldap.authentication.attribute.enterprise: In OpenLDAP this value normally defaults to 'o'. In Active Directory it defaults to 'company' but you could map it to 'department'. Remember that the value must match an active enterprise name in the Abiquo database.

Automatic User Creation

When working in LDAP mode the manual user creation in Abiquo is disabled. When the user successfully logs in against LDAP/AD, Abiquo will perform a look-up in the local database to check if the user already exists. If the user does not exist (first login), it will be automatically created. The information will be retrieved from LDAP/AD server. After the user has been created, the user's details can be modified, except for the Role.

LDAP/AD Enterprises

Abiquo must be able to link the user entry in LDAP/AD to an active Enterprise in the Abiquo database. The property that Abiquo will look up is configurable in the abiquo.properties file (abiquo.ldap.authentication.attribute.enterprise). If there is no matching enterprise, or the property is blank in LDAP/AD, the automatic user creation will fail, as will the login, and a 401 (Bad Credentials) error will be returned. Debugging output will be written to the logs. The Enterprise can be modified but it will be overwritten at each new login.

LDAP/AD Emails

Users created automatically with no email information in LDAP/AD will not receive system notifications. We recommend that you complete the 'email' field in LDAP/AD before first login or modify the Abiquo user details afterwards.

LDAP/AD Roles

After a user logs in, the platform grants them the role that is mapped to their LDAP/AD groups in the platform, first in their tenant or else at a global level. Abiquo allows only one role per user, so we recommend that you map each set of user groups to a single Abiquo role at the enterprise and/or global level. The user's role is synchronized between LDAP/AD and the Abiquo database.

LDAP/AD User Uniqueness

Users that were automatically created are labeled with 'LDAP' in the authType column in the Abiquo database. And the username will be the Distinguished Name (DN) of the user in LDAP/AD. The user is unique because it is a combination of the username and authtype. Toggling between authentication modes is not supported, but it is possible to swap to LDAP mode after installation by changing the appropriate properties. So if you install Abiquo and later decide to change to LDAP mode, users will still be unique.

Supported UserName Forms

Abiquo currently supports these username forms:

• username
• username@full.dn
• domain\username
• displayname

You can use any of these and even switch from one to another and this will not add extra users to the Abiquo database. Each user will only have one database entry.

Login Resource

To perform a login, and retrieve the currently logged in user, a new resource has been published in the API. Please see the API Documentation for further information. This is a secure resource that can only be accessed after a successful login.

Switching Authentication Modes

Switching from Abiquo to LDAP/AD Authentication

Abiquo no longer guarantees the uniqueness of users based on their username. Starting from version 1.8 Abiquo users are made unique by username + authType. AuthType is what the user is logged in against. So it is possible to have more than one user with the same username as long as their 'AuthType' is different. This means that you will not have problems with LDAP/AD users not being able to log in because of another user with the same username. But it also means that if you are delegating authentication to a centralized server in your company and you want this server to be the only authorities provider, you must either delete or disable any previously created users or else those users are also able to log in.

Switching from LDAP/AD to Abiquo Database Authentication

This should not cause problems. LDAP/AD users will not be able to log in because the password field is blank.

Tested Implementations

• Windows 2012
• Windows 2003
• Windows 2008
• Windows 2008R2
• ApacheDS
• OpenLDAP 2.4