skip to main content

LDAP authorization

LDAP authorization
About LDAP authorization
This chapter covers the following topics:
Introduction
Microsoft Active Directory is used to share user list, provide single sign on and other central features in large Microsoft based workstation and server networks.
Active Directory is Microsoft's implementation of existing business standards such as LDAP, Kerberos and DNS.
The purpose of this chapter is to provide a step by step guide on how to integrate op5 Monitor authentication with Microsoft Active Directory.
Before we start
To be able to complete this how-to you will need:
*
*
Do not use space in the admin group name
Please refrain from using spaces in the admin group name, as this can cause problems.
If your admin group and users reside in an OU containing spaces in its name, you will need to manually edit two files after accepting the new configuration.
Preparing your Active Directory
Before configuring op5 Monitor, we need to set up a user op5 Monitor can use to read authentication data from Active Directory, and an Admin group for the op5 Monitor itself.
To prepare your Active Directory
1
2
3
Add an AD-user to the op5admins group.
Let us say that we have an AD structure that looks like this
webinar.op5
|
|-- op5_Operators (OU)
| |
| |-- admins (Group)
| |-- op5admin (User, member of admins)
| |-- viewers (Group)
| `--op5viewer (User, member of viewers)
|
|
‘-- Users (Default AD Container)
|
`-- kalle.kula (User, member of admins)
Now make sure you have your configuration files like this:
/opt/op5sys/etc/ldapserver:
LDAP_BASE=dc=webinar,dc=op5 LDAP_BIND_DN=op5auth@webinar.op5 LDAP_GROUP=ou=op5_Operators,dc=webinar,dc=op5
LDAP_IS_AD=1
LDAP_SERVER=172.27.86.97
LDAP_UPNSUFFIX=webinar.op5
LDAP_USERKEY=uid
LDAP_USERS=ou=op5_Operators,dc=webinar,dc=op5

/opt/op5sys/etc/ldaprights.cfg:
authorized_for_system_information admins,viewers
authorized_for_configuration_information admins,viewers
authorized_for_system_commands admins
authorized_for_all_services admins,viewers
authorized_for_all_hosts admins,viewers
authorized_for_all_service_commands admins
authorized_for_all_host_commands admins

/etc/httpd/conf.d/op5ldapauth.conf:
<Location /monitor.old/>
AuthzLDAPServer 172.27.86.97
AuthzLDAPUserBase ou=op5_Operators,dc=webinar,dc=op5
AuthzLDAPGroupBase ou=op5_Operators,dc=webinar,dc=op5
AuthzLDAPUserKey sAMAccountName
AuthzLDAPBindDN op5auth@webinar.op5
AuthzLDAPBindPassword p4ssw0rd.
require valid-user
AuthzLDAPUserScope subtree
AuthType basic
AuthzLDAPMethod ldap
AuthName "op5 Monitor Access"
</Location>
 
Now, the "LDAP_USERS" variable in /opt/op5sys/etc/ldapserver controls where update-users.php will find users, and the "LDAP_GROUP" controls where the script will find the groups you have defined in /opt/op5sys/etc/ldaprights.cfg.
So, if I have:
LDAP_GROUP=ou=op5_Operators,dc=webinar,dc=op5
LDAP_USERS=ou=op5_Operators,dc=webinar,dc=op5
The script will only sync over users that exist under the op5_Operators OU, belonging to any group defined /opt/op5sys/etc/ldaprights.cfg under that OU, so using the above example structure, the cgi.cfg will be populated like this:
 
authorized_for_system_information=op5admin,op5viewer
authorized_for_configuration_information=op5admin,op5viewer
authorized_for_system_commands=op5admin
authorized_for_all_services=op5admin,op5viewer
authorized_for_all_hosts=op5admin,op5viewer
authorized_for_all_service_commands=op5admin
authorized_for_all_host_commands=op5admin
See that despite the user kalle.kula being a member of admins, he does not get included, because the script doesn't look for users in the Users Container, only in the op5_Operators OU.
Now, say that we want to have all our users in the User Container, and just keep two groups in the op5_Operators OU, we can change the LDAP_USERS variable in /opt/op5sys/etc/ldaprights.cfg to:
LDAP_USERS=cn=Users,dc=webinar,dc=op5
With the above configuration, this results in the following cgi.cfg:
authorized_for_system_information=kalle.kula
authorized_for_configuration_information=kalle.kula
authorized_for_system_commands=kalle.kula
authorized_for_all_services=kalle.kula
authorized_for_all_hosts=kalle.kula
authorized_for_all_service_commands=kalle.kula
authorized_for_all_host_commands=kalle.kula
 
As you see, now the users from the op5_Operators OU don't get included, despite being members of the correct groups, because we told the script to look for users in the Users container instead.
Configuring op5 Monitor
For the next steps, you will need root access to the machine running op5 Monitor, either via console, or ssh.
In this example the DC server has the following ip address:
192.168.1.97
The DC is running a pretty much out-of-the-box Active Directory structure with:
*
*
To configure op5 Monitor
1
2
Now a series of questions will be asked, answer yes to the first question about converting from the old op5 auth system, then chose ad as authentication method.
Below are the rest of the questions and answers provided for our lab environment.
3
4
Make sure the configuration file looks ok.
cat /etc/httpd/conf.d/op5ldapauth.conf

<Location />
AuthzLDAPServer 192.168.1.97
AuthzLDAPUserBase cn=Users,dc=op5,dc=com
AuthzLDAPGroupBase cn=Users,dc=op5,dc=com
AuthzLDAPUserKey sAMAccountName
AuthzLDAPBindDN op5auth@op5.com
AuthzLDAPBindPassword l4bp4SSw0rD
require valid-user
AuthzLDAPUserScope subtree
AuthType basic
AuthzLDAPMethod ldap
AuthName "OP5 Monitor Access"
</Location>
5
 
 
Local authentication fallback
If for some reason the LDAP server is no longer available we can set up a local authentication fallback.
The different authentication methods is:
To set up this you first need to copy the authentication configuration file in witch we add the wanted authentication method with it’s fallback method.
# cp /opt/monitor/op5/ninja/application/config/auth.php /opt/monitor/op5/ninja/application/config/custom
Edit the file auth.php with your favorite editor.
Edit the "$config['driver']" string to use an array in which we specify the wanted authentication methods.
The format of the string look like this when only using two authentication method:
$config['driver'] = array('<authentication method name>' => '<Display name>', '<fallback authentication method name>' => '<Display name>');
The firtst authentication method in the list will be the default method.
For example when setting up a LDAP login with a local fallback the string can look like this:
$config['driver'] = array('LDAP' => 'AD', 'Ninja' => 'Local');
As we only want to change the authentication method we need to remove everything that we do not want to change. This is important as otherwise new updates might not be implemented.
Also keep the firtst row "<?php defined('SYSPATH') OR die('No direct access allowed.');", this is used for security reasons.

Feedback on documentation Feedback on documentation