Enterprise Knowledge Platform

Transcription

1 Enterprise Knowledge Platform Active Directory Authentication Integration Configuration Guide 1

2 Document Information Document ID: EN143 Document title: EKP Active Directory Authentication Integration Configuration Guide Version: 1.2 Document date: 17 August 2009 This document may be revised from time to time. Please check NetDimensions Support site at for updates to this and other documents or send an to to request the most recent version. Please report any errors or feedback with this document by sending an to Copyright Information Copyright by NetDimensions Ltd. All Rights Reserved. Information in this document is subject to change without notice. The software described herein is furnished under a license agreement, and it may be copied only in accordance with the terms of that agreement. No part of this publication may be reproduced, transmitted, or translated in any form or by any means without the prior written permission of NetDimensions Ltd. All company and product names used herein may be trademarks or registered trademarks of their respective companies unless stated otherwise. How to Contact NetDimensions Support US toll-free number [email protected] General Enquiries [email protected] 2

3 Table of Contents INTRODUCTION...1 CONFIGURE ACTIVE DIRECTORY...1 CONFIGURE EKP...3 TROUBLESHOOTING LDAP AUTHENTICATION...5 ADDITIONAL RESOURCES LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL VERSION OPEN GROUP AND THE DIRECTORY INTEROPERABILITY FORUM MISCELLANEOUS

4 Introduction This document describes the steps required in configuring EKP to use Active Directory (AD) to perform user authentication. The AD service in the Windows 2000 and 2003 server provides native LDAP support and it enables other application to use this service through the LDAP interface. EKP has a built-in login adapter that integrates with the AD to perform user login authentication. Note: The following example is based on the Windows 2003 environment. Configure Active Directory A new user has to be created for EKP to do the initial binding to the directory service so that it is authorized to search the directory. 1. Go to Administrative Tools > Active Directory Users and Computers, Create a new user ekp by selecting Action > New > User and enter the name of the user. 1

5 2. Enter password for the user and set the options as the following diagram and click Next. 3. If the user is created successfully, click Finish to continue. 2

6 Configure EKP 1. Enable the LDAP interface in EKP by editing the ekp.properties which is located in the <webapps>/ekp/web-inf/conf folder. See the following example, default.ldap_dir=dc=netdimensions,dc=local default.ldap_host1=win2003-svr default.ldap_post1=389 default.ldap_host2=win2003-svr default.ldap_post2=389 default.ldap_host3=win2003-svr default.ldap_post3=389 default.ldap_timeout=300 The above example defines the AD (LDAPserver) win2003-svr with the domain name Netdimensions.local. LDAP_Dir defines the distinguished name of the node it is connected to the AD. LDAP_HOST2 and LDAP_HOST3 are used to define backup AD servers. EKP is able to use multiple authentication servers in a daisy-chain fashion. If the first server does not respond to an authentication request, the second is tried, and so on. If your environment does not use backup AD server(s), use the same host as the primary, as in the above example. LDAP_TIMEOUT specifies the timeout period in seconds before switching to use the next backup AD server. 2. Specifies the initial binding user information for the AD. Edit the ekp.properties and add the following. ldap.activedirectorydn=cn=ekp,cn=users,dc=netdimensions,dc=local ldap.activedirectorypassword=ekp_password ldap.activedirectorydn specifies the name of the user for initial EKP binding to the AD, so that directory searches can be done later. ldap.activedirectorypassword specifies the password of the user Note: ekp is the name of the user created in the previous section and ekp_password is the password of user ekp. 3. Configure the users to use external authentication Logon EKP as administrator, go to Manage > User Manager > User Editor. Set External Authentication to Yes for users who want to use AD authentication. 3

7 Note: In order to do the above, the users have to be loaded into EKP beforehand and the User ID has to match with the user name in the AD. Users with External Authentication set to No will be using default internal authentication, which means that their password is stored in EKP and at login their userid/password is checked against this entry instead of authenticated against the AD. 4

8 Troubleshooting LDAP Authentication Configure EKP.PROPERTIES default.ldap_dir Defines the base distinguished name from which it starts the search must match the domain components specified in the DN string. default.ldap_dir=dc=netdimensions,dc=com default.ldap_host# Defines the LDAP server. Can be hostname, IP or DNS name default.ldap_host1=win2003-svr would be win2003-svr with the domain name Netdimensions.com default.ldap_host1= ldap.activedirectorydn specifies the name of the user for initial EKP binding to the AD, so that directory searches can be done later. The DN Distinguished Name string will be determined by how your LDAP is configured. You can use ADSI Edit on your AD servers to view the format of the DN value assigned to this user ekp so you would need to specify the same parameters. ldap.activedirectorydn=cn=ekp,cn=users,dc=netdimensions,dc=com In larger organizations It could be be more complex with multiple OUs for Organizational Units ldap.activedirectorydn=cn=ekp,ou=it,ou=users,ou=hongkong,dc=hongkong,dc=netdimensi on,dc=com ldap.activedirectorypassword specifies the password of the user Note: ekp is the name of the user created in the previous section and ekp_password is the password of user ekp. default.ldap_dir=dc=hongkong,dc=netdimensions,dc=com default.ldap_host1= default.ldap_port1=389 default.ldap_host2= default.ldap_port2=389 default.ldap_host3= default.ldap_port3=389 default.ldap_timeout=300 # Define the active directory DN and password for initial binding. ldap.activedirectorydn=cn=ekp,ou=it,ou=users,ou=hongkong,dc=hongkong,dc=netdimensi ons,dc=com ldap.activedirectorypassword= ekp_password 5

9 Using LDAP Tools To Query Your LDAP Servers Ensure you are able to connect to your LDAP servers on your specified port by telneting to it. telnet should open a connection if it does not then its likley the firewall is preventing you from doing so. Add rule between your server & the LDAP server for that port and try again. You can verify that your LDAP parameters are correct by using LDAP tools to query your LDAP servers with your parameters & password. ldp.exe from Install on your ekp server and use your parameters to check if you can communicate with your listed LDAP servers. LDP.EXE to " ", 389 binding to user ekp with password ekp_password DN=CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=hongkong,DC=netdimension,DC=com Sample Output of Successful Query & Binding of User ekp to " ", 389 ld = ldap_open(" ", 389); Established connection to Retrieving base DSA information... Result <0>: (null) Matched DNs: Getting 1 entries: >> Dn: 1> currenttime: 08/12/ :50:21 Central Standard Time Central Daylight Time; 1> subschemasubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=netdimensions,DC=com; 1> dsservicename: CN=NTDS Settings,CN=NTDCHONGKONG1,CN=Servers,CN=HongKong,CN=Sites,CN=Configuration,DC=netd imensions,dc=com; 3> namingcontexts: CN=Configuration,DC=netdimensions,DC=com; CN=Schema,CN=Configuration,DC=netdimensions,DC=com; DC=hongkong,DC=netdimensions,DC=com; 23> supportedcontrol... 2> supportedldapversion: 3; 2; 12> supportedldappolicies: MaxPoolThreads; MaxDatagramRecv; MaxReceiveBuffer; InitRecvTimeout; MaxConnections; MaxConnIdleTime; MaxPageSize; MaxQueryDuration; MaxTempTableSize; MaxResultSetSize; MaxNotificationPerConn; MaxValRange;. 1> dnshostname: ntdchongkong1.hongkong.netdimensions.com; 6

10 1> ldapservicename: 1> servername: CN=NTDCHONGKONG1,CN=Servers,CN=HongKong,CN=Sites,CN=Configuration,DC=netdimensio ns,dc=com; 3> supportedcapabilities: ; ; ; 1> issynchronized: TRUE; 1> isglobalcatalogready: TRUE; 1> domainfunctionality: 0 = ( DS_BEHAVIOR_WIN2000 ); 1> forestfunctionality: 0 = ( DS_BEHAVIOR_WIN2000 ); 1> domaincontrollerfunctionality: 2 = ( DS_BEHAVIOR_WIN2003 ); res = ldap_bind_s(ld, NULL, &NtAuthIdentity, 1158); // v.3 {NtAuthIdentity: User='ekp'; Pwd= <unavailable>; domain = 'DN=CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=hongkong,DC=netdimensions,DC=com'.} Authenticated as dn:'ekp'. This confirms that the parameters for that particular LDAP server will work and you can do same test for each of your LDAP servers. If the query to the LDAP servers fail, check your parameters and check you have enabled your firewall to communicate on the specified ports. LDP.EXE returns same Error<0x51>: Fail to connect message when I query the wrong server or wrong port. ld = ldap_open(" ", 389); Error <0x51>: Fail to connect to ld = ldap_open(" ", 355); Error <0x51>: Fail to connect to If you get initial LDAP query info but then Error <49>: ldap_bind_s() failed: Invalid Credentials. it means the LDAP Server parameters were successful but the bind to user and/or password failed. res = ldap_simple_bind_s(ld, 'ekp', <unavailable>); // v.3 Authenticated as dn:'ekp'. res = ldap_bind_s(ld, NULL, &NtAuthIdentity, 1158); // v.3 {NtAuthIdentity: User='ekp'; Pwd= <unavailable>; domain = 'DN=CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=HongKong,DC=netdimensions,DC=com'.} Error <49>: ldap_bind_s() failed: Invalid Credentials. Server error: C: LdapErr: DSID-0C09043E, comment: AcceptSecurityContext error, data 0, vece Once you have verified your LDAP connection and parameters with successful authentication using LDAP tools you can proceed to attempt log in on your ekp server. 7

11 On the ekp site logging in with user ekp and check the ekp.log for any errors. You should have ekp set up in debug mode. Sample EKP.LOG - user ekp logs in after successful authentication with LDAP server Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connecting to LDAP server at :389 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connected OK Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Authenticating to LDAP server as: 'CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=HongKong,DC=netdimensions,DC=com'; password: '*********' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Authenticated OK Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): about to search Active Directory server for user: 'ekp' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): base: 'dc=hongkong,dc=netdimensions,dc=com' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): filter: '(&( (objectclass=user)(objectclass=person))( (cn=ekp)(samaccountname=ekp)))' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Search returned normally with 2 results Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): results.hasmoreelement s: true Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticateEntry): LDAP DN(basic): CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=HongKong,DC=netdimensions,DC=com Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connecting to LDAP server at :389 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connected OK 2009/Aug/12 23:04:42 Severity(DEBUG) Source(com.netdimen.jdbc.core.JdbcTemplate.logSql): executing sql [SELECT * FROM userstats WHERE userid =?] for arguments ('ekp') 2009/Aug/12 23:04:42 Severity(DEBUG) Source(com.netdimen.jdbc.core.JdbcTemplate.logSql): executing sql [SELECT COUNT(*) FROM messages WHERE readindicator = 'N' AND userid =?] for arguments ('ekp') 8

12 EKP.LOG showing LDAP Authentication Failed Use LDAP tools to verify your parameters. 2009/Aug/12 09:23:16 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connecting to LDAP server at : /Aug/12 09:23:16 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connected OK 2009/Aug/12 09:23:16 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Authenticating to LDAP server as: 'CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=HongKong,DC=netdimensions,DC=com'; password: '*********' 2009/Aug/12 09:23:17 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Authenticated OK 2009/Aug/12 09:23:17 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): about to search Active Directory server for user: 'ekp' 2009/Aug/12 09:23:17 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): base: 'dc=hongkong.netdimensions.com' 2009/Aug/12 09:23:17 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): filter: '(&( (objectclass=user)(objectclass=person))( (cn=ekp)(samaccountname=ekp)))' 2009/Aug/12 09:23:17 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Search returned normally with 1 results 2009/Aug/12 09:23:17 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): results.hasmoreelement s: true 2009/Aug/12 09:23:17 Severity(DEBUG) Source(com.netdimen.auth.login.LDAPLoginAdapter.authenticate): LDAP server 1 authentication failed com.netdimen.auth.login.generalauthenticationexception at com.netdimen.ldap.ldapserver.authenticate(ldapserver.java:255) at com.netdimen.auth.login.ldaploginadapter.authenticate(ldaploginadapter.java:50) 9

13 Additional Resources See the following resources for further information: Lightweight Directory Access Protocol Version 3 The IETF LDAPv3 Working Group: The LDAPv3 Working Group archived newsgroup: RFC 3377, the current definition of LDAPv3: ftp://ftp.rfc-editor.org/in-notes/rfc3377.txt Open Group and the Directory Interoperability Forum The Open Group s VSLDAP compliance testing suite overview: The Directory Interoperability Forum (DIF): Miscellaneous The Microsoft Active Directory Web site: Active Directory Application Mode (ADAM): Directory Services Markup Language (DSML): Microsoft Identity Integration Server 2003, Enterprise Edition: px The Microsoft Windows 2000 inetorgperson Kit: LDAP reference for developers on MSDN: LDAP API reference for developers on MSDN:

14 For the latest information about Windows Server 2003, see the Windows Server 2003 Web site at 11