LDAP Configuration

# 
#Mon Jun 22 20:22:38 UTC 2020 
ldc.web.pam.property.attributeToExtract=distinguishedName 
ldc.web.pam.property.ldapGroupClass=(&(objectClass\=groupOfNames)) 
ldc.web.pam.property.searchBase=dc\=waterlinedata,dc\=com 
ldc.web.pam.property.searchPassword=<Encrypted Password> 
ldc.web.pam.property.referral=follow 
ldc.web.pam.property.providerUrl=ldaps\://ldap.jumpcloud.com\:636 
ldc.web.pam.property.authMode=bind-only 
ldc.web.pam.fqcn=com.hitachivantara.datacatalog.web.jaas.LdapLoginModule
ldc.web.pam.property.searchUser=cn\=administrator,cn\=Users,dc\=waterlinedata,dc\=com 
ldc.web.pam.property.doExtractAttribute=true 
ldc.web.pam.property.authIdentityPattern=uid\={USERNAME},ou\=Users,o\=5834bd20ba309ed9201c418a,dc\=jumpcloud,dc\=com 
ldc.web.pam.userDetailsRetrieverStrategy=com.hitachivantara.datacatalog.web.jaas.LdapUserDetailsRetrieverStrategy
ldc.web.pam.property.searchFilterPattern=(&(sAMAccountName\={USERNAME})(memberOf\=CN\=EngineeringManagers,OU\=Engineering,dc\=waterlinedata,dc\=com)) 
ldc.web.pam.property.debug=true 
ldc.web.pam.property.operationalAttributesToFetch=

Parent Topic

• LDAP Configuration

In this section, the LDAP authentication modes are explained in detail. To set up the LDAP authentication, select the authentication mode of LDAP that best meets your needs.

• bind-only

  The bind-only mode uses the user-supplied credentials to substitute the authIdentityPattern property with the {USERNAME} token, then binds to the LDAP server. If the bind is successful, authentication succeeds. View the following sample configurations:

  • Using Distinguished Name

    Required property for all LDAP configurations.

    ldc.web.pam.fqcn=com.hitachivantara.datacatalog.web.jaas.LdapLoginModule
    ldc.web.pam.property.providerUrl=ldaps://ldap.jumpcloud.com:636 
    ldc.web.pam.property.authMode=bind-only 
    ldc.web.pam.property.authIdentityPattern=uid={USERNAME},ou=Users,o=5834bd20ba309ed9201c418a,dc=jumpcloud,dc=com 
    ldc.web.pam.property.referral=follow  
    ldc.web.pam.property.debug=true

  • {USERNAME}@domain.com format

    Works for Active Directory with a single domain only. Required property for all LDAP configurations.

    ldc.web.pam.fqcn=com.hitachivantara.datacatalog.web.jaas.LdapLoginModule
    ldc.web.pam.property.providerUrl=ldaps://abc.com:636 
    ldc.web.pam.property.authMode=bind-only 
    ldc.web.pam.property.authIdentityPattern={USERNAME}@domain.com 
    ldc.web.pam.property.referral=follow  
    ldc.web.pam.property.debug=true

• bind-search

  The bind-search mode works in two steps:

  • The user-supplied credentials are used to substitute the authIdentityPattern property with the {USERNAME} token and then binds to the LDAP server.
  • If the bind is successful, a search is performed using the filter specified by searchFilterPattern property. If the search returns exactly one result, the authentication succeeds.
  Required properties for all LDAP configurations.

  ldc.web.pam.fqcn=com.hitachivantara.datacatalog.web.jaas.LdapLoginModule
  ldc.web.pam.property.providerUrl=ldaps://abc.com:636 
  ldc.web.pam.property.authMode=bind-search  
  ldc.web.pam.property.authIdentityPattern={USERNAME}@domain.com 
  ldc.web.pam.property.searchBase=OU=DataAnalytics,dc=waterlinedata,dc=com 
  ldc.web.pam.property.searchFilterPattern=(&(sAMAccountName={USERNAME})(memberOf=CN=DataScientists,OU=DataAnalytics,dc=waterlinedata,dc=com))   
  ldc.web.pam.property.referral=follow  
  ldc.web.pam.property.debug=true

• search-bind

  The search-bind mode works in four steps:

  1. The module binds to the server using system user credentials (searchUser and searchPassword).
  2. A search is performed using the filter specified by the searchFilterPattern property.
  3. The system validates that the search returns exactly one result. Otherwise, authentication fails.
  4. A second bind is performed using the password provided during login and either the substituted authIdentityPattern or another specified attribute (attributeToExtract) to be extracted from the search result as the principal. If the bind is successful, authentication succeeds.
  View the sample configurations:

  • {USERNAME}@domain.com format

    Required property for all LDAP configurations.

    ldc.web.pam.fqcn=com.hitachivantara.datacatalog.web.jaas.LdapLoginModule
    ldc.web.pam.property.providerUrl=ldaps://abc.com:636 
    ldc.web.pam.property.authMode=search-bind  
    ldc.web.pam.property.authIdentityPattern={USERNAME}@domain.com 
    ldc.web.pam.property.searchBase=OU=DataAnalytics,dc=waterlinedata,dc=com 
    ldc.web.pam.property.searchFilterPattern=(&(sAMAccountName={USERNAME})(memberOf=CN=DataScientists,OU=DataAnalytics,dc=waterlinedata,dc=com)) 
    ldc.web.pam.property.searchUser=administrator@waterlinedata.com 
    ldc.web.pam.property.searchPassword=enc(s3cr3t) 
    ldc.web.pam.property.referral=follow  
    ldc.web.pam.property.debug=true

  • DN format and DN extraction for end-user

    Required property for all LDAP configurations.

    ldc.web.pam.fqcn=com.hitachivantara.datacatalog.web.jaas.LdapLoginModule
    ldc.web.pam.property.providerUrl=ldaps://abc.com:636 
    ldc.web.pam.property.authMode=search-bind  
    ldc.web.pam.property.searchBase=OU=DataAnalytics,dc=waterlinedata,dc=com 
    ldc.web.pam.property.searchFilterPattern=(&(sAMAccountName={USERNAME})(memberOf=CN=DataScientists,OU=DataAnalytics,dc=waterlinedata,dc=com)) 
    ldc.web.pam.property.searchUser=CN=administrator,OU=Users,DC=waterlinedata,DC=com 
    ldc.web.pam.property.searchPassword=enc(s3cr3t) 
    ldc.web.pam.property.doExtractAttribute=true  
    ldc.web.pam.property.attributeToExtract=distinguishedName 
    ldc.web.pam.property.referral=follow  
    ldc.web.pam.property.debug=true

Parent Topic

• LDAP Configuration

In Lumada Data Catalog you can retrieve group information from a user's LDAP and dynamically assign the user roles based on group name to role name mapping.

There are mostly two kinds of LDAP systems:

• Microsoft Active Directory (AD): The most commonly used service provided by Microsoft.
• OpenLDAP (JumpCloud)

Data Catalog supports both directory services with LDAP and provides configuration properties to support both systems. However, the systems differ in their handling of user attributes and groups, which requires unique approaches to support each service.

• Microsoft LDAP/AD:

  A Microsoft AD-based LDAP system has the following structure for user attributes and group information. A user can belong to multiple groups, but one of these groups is marked as the primary group for the user in the AD tool. Microsoft AD's design mandates a two step process for retrieving groups information for a user.

  • You can retrieve normal user groups from the attribute memberOf, which returns a list of group domain names (DN). The DN’s can be used to search for this group or entity within AD. The name of a group in AD is accessed through the sAMAccountName property.
  • You can retrieve the primary user group from the attribute primaryGroupId. This attribute returns a unique number from which the linked group and its name should be retrieved. The name of the group can be accessed through the sAMAccountName property.
  • Combining both normal groups and the primary group would lead to all of the groups that the user is linked to.

• OpenLDAP:

  With OpenLDAP, the access attributes are simple and straightforward.

  • The user has an attribute called ‘memberOf’ which returns a list of group DN’s.
  • Resolving these group DN’s to their actual group entities and then accessing the group name from an attribute like ‘ou’ provides the group name.

Parent Topic

• LDAP Configuration

Child Topics

• Retrieving group information from LDAP

{
  "firstName": "givenName",
  "lastName": "sn",
  "email": "mail",
  "userGroupAttributes": [
    {"attributeName": "memberOf", "subAttributeName": "sAMAccountName"},
    {"attributeName": "primaryGroupId", "subAttributeName": "sAMAccountName"}
  ],
  "groupToRoleMap": {
    "QATESTGROUP": ["Administrator", "Guest", "Role1"],
    "AUTOMATIONQA": ["Guest"],
    "DUMMY_GROUPNAME": ["non-existing-role", "Role2"]
  }
}

{
  "firstName": "givenName",
  "lastName": "sn",
  "email": "mail",
  "userGroupAttributes": [
    {"attributeName": "memberOf", "subAttributeName": "ou"}
  ],
  "groupToRoleMap": {
    "All Users - LDAP": ["Guest"],
    "DUMMY_GROUPNAME": ["non-existing-role", "Steward"]
  }
}