A security realm defines the mechanism for user authentication and authorization. FlexDeploy provides a default internal realm for users, which is based on FlexDeploy database tables for users and groups. FlexDeploy also supports LDAP based realms for authentication and authorization using an external directory server. You can define multiple security realms. To configure and view the realms, navigate to Realms from the menu or global search. FlexDeploy’s out-of-the-box realm can be utilized alongside external directory servers.

Drag and drop ordering of realms is supported to ensure that authentication checks are done in a particular order. If you define multiple realms, users are authenticated against each realm in the specified order until the first successful authentication occurs. Authentication will stop with the first successful authentication against any realm in the list.

FlexDeploy’s internal realm (fdRealm) can be adjusted in the list of realms. FlexDeploy allows customers to adjust the internal realm order (possibly first), which would allow logging in with local users when external directory servers are having issues. For example, if directory servers are having performance issues, logging in with a local user may take a long time. However, if you adjust the internal realm to be first in the list, then you will notice faster login for local users.

If group mapping is enabled for a realm, an external user’s groups are derived from mapping configured for that realm. Groups assigned in the FlexDeploy internal realm are always used as well, so you can provide additional groups to users defined in an external realm from the groups screen or from individual user profiles. If you choose not to enable group mapping, you must assign groups to users manually in FlexDeploy.

External realm users will have their passwords managed in the external realm, not in FlexDeploy.

New User Process

A user account must exist in FlexDeploy even for external realm users. This is necessary so that users can control notification settings and administrators can provide additional security, if necessary. Administrators can create external realm users from the Users page, or external realm users can login and create their own account.

When users defined in an external realm login successfully for the first time, they will be redirected to a new user page. There, the user is asked to verify various information like first name, last name, and email for their account. The password for such users is always managed by the external server. Once the user provides the necessary details, their account will be created, an automatic logout will occur, and the user will have to login one more time. At this point, the user will be granted access based on realm group mapping configured by an administrator, which is explained later in this document. If the new user isn’t mapped to any FlexDeploy groups at this point, they will be assigned the new user role configured on the System Settings page, if one exists.

Create / Edit Realm

To create a new realm, click the Create button. To edit an existing realm, click the realm name or select Edit from the options menu. Note that the internal fdRealm cannot be edited. Use the Active button to activate or inactivate a specific realm. You can use the Delete option in each row’s menu to completely remove a specific realm from FlexDeploy configurations.

Any changes to a realm's configuration will require the FlexDeploy application server to be restarted for the changes to take effect. This does not include updating group mappings. You can test realm configuration details by clicking the Test Connection button.

Enter the details for the LDAP realm as described in table of inputs below. Click the Save button to save your changes.

All LDAP realm users must be under a specific branch on the LDAP server, which is searched based on the User Search Base and User Search Filter on the general tab.

FlexDeploy uses the memberOf virtual attribute to derive a user's groups, so group mapping will not work if your LDAP does not support that attribute.

Field	Required	Description

Field	Required	Description
Realm Name	Yes
Description	No
URL	Yes	URL to access LDAP server For example, ldap://localhost:10389
System Username	Yes	Read-only username to access LDAP server. This should be fully qualified username in LDAP. FlexDeploy will use the system username and system password to bind to LDAP for various operations. For example, uid=admin,ou=system
System Password	Yes	Password for specified system user name.
User Search Base	Yes	User base tree in LDAP server For example, ou=users,ou=system.
User Search Filter	Yes	User search filter to find user records in user search base For example, (&(objectClass=)(uid={0})), (&(objectClass=)(sAMAccountName={0}))
Connect Timeout	No	@since 6.5.0.2 A timeout, in seconds, for connecting to the external server. The default timeout is 30 seconds. If no value is provided, there is no timeout.
Read Timeout	No	@since 6.5.0.2 A timeout, in seconds, for LDAP read operations. The default timeout is 120 seconds. If no value is provided, there is no timeout.
Follow Referrals	Yes	@since 6.5.0.2 How to handle referrals (follow/ignore). The default is ignore.
Group Mapping Enabled	Yes	Enable if you want to map LDAP groups to FlexDeploy groups. LDAP server must support memberOf attribute for group mapping in FlexDeploy.
Group Search Base	No*	Group base tree in LDAP server. Required if group mapping is enabled. For example, (ou=groups,ou=myrealm,dc=MyDomain)
Group Search Filter	No*	Search filter to find groups in group search base. Required if group mapping is enabled. For example, (objectClass=groupOfUniqueNames)

Group Mapping with External Directory Server

FlexDeploy provides features to map external directory server groups to FlexDeploy groups, which makes it very easy to manage FlexDeploy users in your environment. Fine-grained access to FlexDeploy features is still controlled by FlexDeploy groups, and by mapping external directory groups to FlexDeploy groups, you essentially control access to FlexDeploy features. You can configure FlexDeploy group permissions using the Permissions page and from the Security section of individual objects supporting object-level permissions (folders/projects, target groups, releases, etc.).

In order to set up group mapping, first make sure to enable group mapping from the realm’s group mapping tab and provide the group search base and filter. If you haven’t already loaded external groups for this realm or they need to be refreshed, click the Fetch External Groups button or the Refresh External Groups button.

Select a specific FlexDeploy group to work with first. Then, search and select external groups to map to the selected FlexDeploy Group. See the figure below, where we have mapped the LDAP group Enterprise Admins to the FlexDeploy FD Administrators group.

Realm configuration changes including the mapping configuration require a recycle of the FlexDeploy server process, but changes to the groups being mapped do not require a recycle.

Examples

Apache Directory Server Realm

Active Directory Realm

Using ldaps

A FlexDeploy realm can be configured to use ldaps protocol, which requires adding a server certificate to Java cacerts or the application server trust store.

You may encounter java.security.cert.CertificateException: No subject alternative names present when using SSL connection and the hostname in connection URL is not valid when compared to the SSL certificate of the server. This error occurs in java 1.8.0_181 or higher is because this update includes security improvements for LDAP support. Endpoint identification has been enabled on LDAPS connections. In this situation, you must regenerate the LDAP server certificate with the certificate’s SAN or CN matching the hostname of the LDAP server configured in connection URL. This is not recommended for production installation, but you can temporarily disable this by adding -Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true to server startup arguments.

Login Flow with an External Realm