LDAP Authentication

To setup  Starting in 3.6, ProVision supports LDAP authentication. To an LDAP server for authentication, you must perform the following three procedures:

...

• Configure the LDAP Server

...

...

• Test the LDAP Server
• Configure ProVision for LDAP Authentication

LDAP Schema - Example

attributetype (1.3.6.1.4.1.5023215.2.3.21 NAME 'sixConnGroup'
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 

objectclass ( 1.3.6.1.4.1.5023215.2.4.2 NAME 'sixConnectPermissionsV2'
        DESC '6Connect Permissions Object v2'
        SUP top AUXILIARY
        MUST ( sixConnGroup ) )

...

LDAP User

...

Example

SSH into your openLDAP server and create a new 'ldif' file.  Example:

dn: cn=JoeSmith,ou=people,dc=6connect,dc=com
cn: JoeSmith
sn: JoeSmith
objectclass: top
objectclass: person
objectclass: sixConnectPermissionsV2
sixConnGroup: "Global Admins"
sixConnGroup: "IT Engineering"
sixConnGroup: "Sales"
sixConnGroup: "Customer Admin"
userPassword: testpass

 To  To create a new user, make a new ldif file and change all instances of "JoeSmith" to whatever username you wish to create and update the password.  Keep all of the object class definitions as listed above.  Add a sixConnGroup declaration for each ProVision user group a user is in.

 After  After the file is created, run the following command to add the new user to LDAP server:

 ldapadd -h [SERVER] -x -f [LDIF FILE] -D [ROOTDN] -w [ROOT PW] -v

 Example Example:

 ldapadd -h localhost -x -f 6connect.ldif -D "cn=Manager,dc=6connect,dc=com" -w secret -v

The user will now be active in openLDAP and can be used to login to ProVision. 

Test the LDAP Server

To query the LDAP server, run the following command on any server which has openLDAP enabled:

ldapsearch -b [BASE] -h [IPADDRESS] -D [DOMAIN] -w [PASSWORD] [USER]

Note:  We have not been able to use a v6 address at with this tool, even though multiple sources say it should work.

At the end of the command where [USER] is specified, user or groups can be used (in LDAP format) to query.

Example: 

ldapsearch -b "dc=6connect,dc=com" -h 50.240.195.129 -D "cn=MayorJoeSmith,ou=people,dc=6connect,dc=com" -w testpass "cn=MajorMinerJoeSmith" 

Configure ProVision for LDAP Authentication 

To configure the use of LDAP authentication with ProVision, follow the steps below.

• Log into 6connect ProVision
• Go to Admin -> General Settings -> Authentication
• Click the LDAP Enable checkbox.
• Fill in the hostname or ip address, authentication port, LDAP Security, Auth DN, and Fetch DN.  
  

Image Removed

Example values in this case would be: 

...

•  An example is below:

LDAP Server Address:   52 52.240.195.12

LDAP Port:   389  389 ( or SSL/TLS port is 636)

LDAP Security:   None None

LDAP Auth DN:   cn cn=%LOGIN%,ou=people,dc=6connect,dc=com

LDAP Fetch DN:   cn cn=%LOGIN%