Skip to main content
Version Pentaho
Hitachi Vantara Lumada and Pentaho Documentation

Manual MSAD Configuration

  1. Last updated
  2. Save as PDF

Before you can manually make changes to the Microsoft Active Directory (MSAD) configuration; you must configure Pentaho to authenticate against Active Directory as described here.

Binding

MSAD allows you to uniquely specify users in two ways (Kerberos notation or Windows domain notation), in addition to the standard Distinguished Name (DN) method. If the standard DN is not working, try one of the following methods. Each of the following examples is shown in the context of the userDn property of the Spring Security DefaultSpringSecurityContextSource bean.

The examples in this section use DefaultSpringSecurityContextSource. You may need to use the same notation (Kerberos or Windows domain) in all your DN patterns.

The following code block is an example of the Kerberos notation for pentahoadmin@mycompany.com:

File: applicationContext-security-ldap.properties

contextSource.providerUrl=ldap\://mycompany\:389
contextSource.userDn=pentahoadmin@mycompany.com
contextSource.password=omitted

The following code block is an example of the Windows domain notation for MYCOMPANY\pentahoadmin:

File: applicationContext-security-ldap.properties

contextSource.providerUrl=ldap\://mycompany\:389
contextSource.userDn=MYCOMPANY\pentahoadmin
contextSource.password=omitted

Referrals

If more than one Active Directory instance is serving folder information, it may be necessary to enable referral, shown in the following code block. This is accomplished by modifying the DefaultSpringSecurityContextSource bean:

<bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
    <constructor-arg value="${contextSource.providerUrl}"/>
    <property name="userDn" value="${contextSource.userDn}"/>
    <property name="password" value="${contextSource.password}"/>
    <property name="referral" value="follow" />
</bean>

Nested Groups

You can pull nested groups for Pentaho within Microsoft Active Directory.

In the populator group search filter, enter the following filter for MSAD nested groups:

populator.groupSearchFilter=(member:1.2.840.113556.1.4.1941:={0})

This filter will search down the entire tree of nested groups. Please note that this attribute only works for Microsoft Active Directory configurations.

See Also 

The LDAP Properties reference article contains supplemental information for LDAP values. 

Learn more

Manage users and roles in the Pentaho User Console (PUC).

Learn more