| Table of Contents | ||
|---|---|---|
|
A security realm defines the mechanism for user authentication and authorization. FlexDeploy provides a default internal realm for users, which is based on FlexDeploy database tables for Users users and Groupsgroups. FlexDeploy also supports Active Directory LDAP and other LDAP SSO based realms for authentication and authorization using an external directory server. You can define multiple LDAP security realms, or one SSO realm. To configure /and view the realms, select Administration -> Security -> navigate to Realms from the menu or global search. FlexDeploy’s out-of-the-box realm can be utilized alongside external directory servers.Realms can be ordered
...
Drag and drop ordering of realms is supported to ensure that authentication checks are done in a particular order. If you define multiple realms, users are authenticated against each realm in the specified order until the first successful authentication occurs. Authentication will stop with the first successful authentication against any realm in the list.
If Group Mapping is enabled for a realm where authentication is successful, Groups are derived from mapping configured for that realm. Groups assigned in the FlexDeploy internal realm are always used as well, so you can provide additional groups to users defined in an external realm from the Administration -> Security -> Users screen. If you choose not to enable group mapping, you must assign Groups to Users from the Users screen.
| Tip |
|---|
FlexDeploy’s internal realm (fdRealm) can be adjusted in the list of realms. FlexDeploy allows customers to adjust the internal realm order (possibly first), which would allow logging in with local users when external directory servers are having issues. For example, if directory servers are having performance issues, logging in with a local user may take a long time. However, if you adjust the internal realm to be first in the list, then you will notice faster login for local users. |
If group mapping is enabled for an external realm, an external user’s groups are derived from mapping configured for that realm. Groups assigned in the FlexDeploy internal realm are always used as well, so you can provide additional groups to users defined in an external realm from the groups screen or from individual user profiles. If you choose not to enable group mapping, you must assign groups to users manually in FlexDeploy.
External realm users will have their passwords managed in the external realm, not in FlexDeploy.
...
New User Process
| Info |
|---|
A user account must exist in FlexDeploy even for External Realm Usersexternal realm users. This is necessary so that users can control Notification notification settings , and it allows administrators to can provide additional security, if necessary. Administrators can create External Realm Users external realm users from the Administration -> Security -> Users screen, or External Realm Users can log in Users page, or external realm users can login and create their own account. When users defined in an External Realm log in external realm login successfully for the first time, they will be redirected to a new user page. There, the user is asked to provide verify various information like first name, last name, and email etcfor their account. The password for such users is always managed by the External Serverexternal server. Once the user provides the necessary details, their account will be created, an automatic logout will occur, and the user will have to log in login one more time. At this point, the user will be granted access based on Realm Group Mapping realm group mapping configured by the an administrator, which is explained later in this document. |
...
Create LDAP Realm
To create an LDAP Realm, click the Create button and Select LDAP Realm.
Any changes to LDAP Realm's Configuration tab will require the FlexDeploy application server to be restarted. You can test realm configuration details by clicking on the Test button.
WebLogic Embedded LDAP Realm Example
...
Apache Directory Server Realm Example
...
Enter the details for the LDAP realm as described in table of inputs below. Click the Save button to save the changes.
Use the Move Up and Move Down buttons to change the order of the Realms.
Use the Active check box to activate or inactivate a specific Realm. You can use the Delete button to completely remove a specific Realm from FlexDeploy configurations.
All LDAP Realm users must be under a specific branch on the LDAP server, which is searched by User Search Base and User Search Filter in configuration details.
| Info |
|---|
FlexDeploy uses memberOf virtual attribute to derive User's groups, so group mapping will not work if your LDAP does not support that attribute. |
...
Field
...
Required
...
Description
...
Realm Name
...
Yes
...
Name of the LDAP Realm.
...
Description
...
No
...
Description of the realm.
...
Active
...
Yes
...
Whether the realm is active or not. Default is Active.
...
User Search Base
...
Yes
...
Provide User base tree in LDAP server. For example, ou=users,ou=system.
...
User Search Filter
...
Yes
Provide User search filter to find user records in User Search Base. For example, (&(objectClass=*)(uid={0}))
| Tip |
|---|
To restrict users which can login to FlexDeploy by membership within a particular LDAP group, you can use a search filter similar to the following. This assumes that your LDAP supports the memberOf virtual attribute. (objectClass=user)(sAMAccountName={0})(memberOf=CN=FDDevelopers,CN=Users,DC=flexagondev,DC=local) Same for more than one groups would look like this. (&(objectClass=user)(sAMAccountName={0})(|(memberOf=CN=FDDevelopers,CN=Users,DC=flexagondev,DC=local)(memberOf=CN=FDAdmins,CN=Users,DC=flexagondev,DC=local)) |
...
URL
...
Yes
...
Provide URL to access LDAP server. For example, ldap://localhost:10389
...
System User Name
...
Yes
...
Provide read-only user name to access LDAP server. For example, uid=admin,ou=system
This should be fully qualified user name in LDAP. FlexDeploy will use System User Name and System Password to bind to LDAP for various operations.
...
System Password
...
Yes
...
Provide password for specified system user name.
...
Group Mapping Enabled
...
No
...
Check if you want to map LDAP groups to FlexDeploy groups. LDAP server must support memberOf attribute for group mapping in FlexDeploy.
...
Group Search Base
...
No
...
Provide Group base tree in LDAP server. For example, ou=groups,ou=system.
...
Group Search Filter
...
No
...
Provide search filter to find groups in Group Search Base. For example, (objectClass=groupOfUniqueNames)
Create Active Directory Realm
To create an Active Directory Realm, click on the Create button and Select Active Directory Realm.
Any changes to Active Directory Realm's Configuration tab will require the FlexDeploy application server to be restarted. You can test your realm configuration details by clicking on the Test button.
...
Enter the details for the Active Directory realm using the details in the table below. Click the Save button to save the changes.
Use the Move Up and Move Down buttons to change the order of the Realms.
Use the Active check box to activate or inactivate a specific Realm. You can use the Delete button to completely remove a specific Realm from FlexDeploy configurations.
All Active Directory Realm users must be under a specific branch on Active Directory server, which is searched by User Search Base and User Search Filter in configuration details.
An Active Directory Realm can be used for authentication as well as authorization using the Group mapping feature.
...
Field
...
Required
...
Description
...
Realm Name
...
Yes
...
Name of the Active Directory realm.
...
Description
...
No
...
Description of the realm.
...
Active
...
No
...
Whether the realm is active or not. Default is Active.
...
User Search Base
...
Yes
...
Provide the user base dn in the Active Directory server. For example, CN=Users,DC=flexagondev,DC=local.
...
User Search Filter
...
Yes
...
Provide the user search filter. For example, (&(objectClass=*)(sAMAccountName={0}))
...
URL
...
Yes
...
Provide URL to access active directory server. For example, ldap://localhost:10389
...
System User Name
...
Yes
...
Provide read-only user name to access active directory server. For example, CN=flexservice,CN=Users,DC=flexagondev,DC=local
This should be fully qualified user name in LDAP. FlexDeploy will use System User Name and System Password to bind to LDAP for various operations.
...
System Password
...
Yes
...
Provide password for specified system user name.
...
Group Mapping Enabled
...
No
...
Check if you want to map active directory groups to FlexDeploy groups.
...
Group Search Base
...
No
...
Provide Group base tree in active directory server. For example, CN=Groups,DC=flexagondev,DC=local .
...
Group Search Filter
...
No
...
Provide search filter to find groups in Group Search Base. For example, (objectClass=group)
...
FlexDeploy provides features to map external directory server groups to FlexDeploy groups, which makes it very easy to manage FlexDeploy users in your environment. Fine-grained access to FlexDeploy features is still controlled by FlexDeploy groups, and by mapping external directory groups to FlexDeploy groups, you essentially control access to FlexDeploy features. You can configure FlexDeploy group permissions using the Groups screen and Security tab on each Folder/Project tab on the project tree structure.
In order to setup Group mapping, check the Group Mapping Enabled checkbox on the Configuration tab. Then select the Group Mapping tab. Select a specific FlexDeploy group to work with first. Then, shuttle desired External groups to map to the selected FlexDeploy Group. See the figure below, where we have mapped the Active Directory Groups Administrators and Enterprise Admins to the FD Administrators group.
Realm configuration changes including the mapping configuration require a recycle of the FlexDeploy server process, but changes on the Group Mapping tab do not require a recycle.
...
Using ldaps
A FlexDeploy realm can be configured to use ldaps protocol, which requires adding a server certificate to Java cacerts or application server trust store.
You may encounter java.security.cert.CertificateException: No subject alternative names present when using SSL connection and the hostname in connection URL is not valid when compared to the SSL certificate of the server. This error occurs in java 1.8.0_181 or higher is because this update includes security improvements for LDAP support. Endpoint identification has been enabled on LDAPS connections. In this situation, you must regenerate LDAP server certificate with the certificate’s SAN or CN matching the hostname of LDAP server configured in connection URL. This is not recommended for production installation, but you can temporarily disable this by adding -Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true to server startup arguments.
Login Flow when using an External Realm
...
If the new user isn’t mapped to any FlexDeploy groups at this point, they will be assigned the new user role configured on the System Settings page, if one exists. |
Login Flow with an External Realm
| Drawio | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
More information about realms in FlexDeploy
| Child pages (Children Display) | ||
|---|---|---|
|