The authentication process for validating a user using an external AD or LDAP provider is as follows.

Transcription

1 IntelligenceBank - External Authentication Active Directory Integration Overview The authentication process for validating a user using an external AD or LDAP provider is as follows. 1. The user accesses the login page for IntelligenceBank (IB) either via web or via ipad app. 2. The IB server checks to see if that user is to be authenticated via an external Active Directory or LDAP provider. 3. If so then the user's credentials are sent to the external AD or LDAP server and the response received. The response data must include the user's address as stored in the ib server as part of the returned information. 4. The IB server verifies the user's address as provided by the AD or LDAP server and if successful then the user receives the home page. 5. If the user is not validated by the AD or LDAP server, or is not verified by the IB server, then the user receives an 'Incorrect login credentials' message and remains on the login page. Requirements and Additional Information 1. In order to be verified by the IB system the user needs to have been created in the system. This is usually done by the users' IB administrator. 2. Currently there is no auto registration of users by means of an API from an AD or LDAP server. Currently there is no synchronization between the AD or LDAP server and the IB server. 3. Users in the IB system can be set to use either the external authenticator configured for their company, or to use the IB local login. This allows companies to have a mix of AD or LDAP authenticated users (e.g. for their internal users) and IB local login users (for their external partners).

2 Configuration To use an external AD or LDAP server as an authentication source for accessing IntelligenceBank, the following configuration screen is provided in the administration section of IntelligenceBank. The above fields contain default data that needs to be changed according to the requirements of the AD or LDAP server. The important fields that need to be set correctly are Host: either the URL or IP address of the AD or LDAP server Port: if the server uses a different port to 389, or if TLS or SSL is configured. These usually use a different port TLS and SSL: whether either of these is required (make sure the port is correct) Base DN: the base Distinguished Name. This is appended to the user's login name Domain Name: the relevant domain name. Short Domain Name: an internal abbreviation for the domain name Canonical Form: this is usually set to 3 for AD and 2 for LDAP

3 SAML Integration Overview IntelligenceBank currently provides two methods for authentication using the SAML protocol : two legged, where the user accesses the IB server and is redirected to a SAML server for autheinctation, and one-legged, where the user is already validated on a SAML server and is automatically logged into IntelligenceBank. The two processes are outlined below. Two Legged Authentication 1. In this process the user first accesses the Intelligencebank server. 2. If the user is to be authenticated remotely then the user is re-directed to the SAML server configured for the company. 3. Once the user has successfully validated on the SAML server she is redirected back to the IntelligenceBank server with a SAML assertion and user information. 4. The IntelligenceBank server verifies the SAML assertion and user information and if successful logs the user in and directs the user to the home page.

4 One Legged Authentication 1. In this process the user first logs in and accesses a server on her intranet. This process may differ according to the requirements of each company. 2. Upon clicking on a specific link she is redirected to the IntelligenceBank server along with a SAML assertion and relevant user information. 3. The IntelligenceBank server verifies the SAML assertion and user information and if successful logs the user in and directs the user to the home page.

5 Configuration To use an external SAML server as an authentication source for accessing IntelligenceBank, the following configuration screen is provided in the administration section of IntelligenceBank. The above fields contain default data that needs to be changed according to the requirements of the SAML server. The important fields that need to be set correctly are Host: the specific URL of the page to access for the SAML authentication Base64 Encoded: whether the certificate or certificate data is base64 encoded Certificate Data: the certificate data for the SAML assertion Organization Name: the name of the company or organization