What's on this page

☰
Navigation :

Configuring External LDAP Connections

Telco Network Cloud Orchestration (TNC-O) makes use of LDAP as its user store for secure access. It is configured by default to connect to the OpenLDAP service which is part of the installation. It is possible to disable this installation of this OpenLDAP service, and to connect to an external LDAP implementation using different mechanisms including support for Active Directory.

Configuring an External LDAP Server

To use an LDAP Server other than the pre-configured OpenLDAP instance which comes as part of the TNC-O installation, follow these steps.

Modify LDAP connection configuration

TNC-O comes with configuration based on the directory structure which exists in the pre-configured install of OpenLDAP.

When using an existing LDAP server which uses a different directory structure, the LDAP directory queries can be configured as below.

TNC-O supports 2 distinct LDAP authentication strategies which are as follows:

Once the most appropriate strategy is selected, follow the relevant configuration section below.

LDAP Bind (default)

The ldapBind authentication strategy is the default during an installation of TNC-O. It can be customised with the following configuration, which can be set in Vault:

alm:
  ishtar:
    security:
      authenticationProvider: ldapBind
      ldap:
        url: ldap://ldap-server:389
        base: null        
        managerDn: cn=admin,,dc=lm,dc=com
        managerPassword: adminpassword  
        userSearchBase: ou=people
        userSearchFilter: uid={0}
        groupSearchBase: ou=groups
        groupSearchFilter: member={0}

The purpose of each configuration item is as follows:

LDAP Simple

The ldapSimple authentication strategy relies on TNC-O using a manager password to bind to LDAP, upon which it queries the user’s DN record and compares the password. The following configuration is required, which can be set in Vault:

alm:
  ishtar:
    security:
      ldap:
        url: ldap://ldap-server:389
        base: dc=lm,dc=com
        managerDn: cn=admin,dc=lm,dc=com
        managerPassword: adminpassword
        userSearchBase: ou=people
        userSearchFilter: (&(uid={0})(!(isSuspended=true)))
        groupSearchBase: ou=groups
        groupSearchFilter: member={0}
        passwordAttribute: userPassword
        passwordEncoding: BCRYPT

The purpose of each configuration item is as follows:

If using passwordEncoding of BCRYPT, the user’s password must be provided as a BCrypt encoded value. The BCrypt hashing library used in TNC-O currently only supports hashed passwords with the $2a prefix. It should be ensured that any LDAP passwords generated make use of a BCrypt hashing algorithm which only generates password hashes with the $2a prefix, otherwise login attempts will fail. An example tool that may be used to convert plain-text passwords to BCrypt is the bcrypt-cli.

Revoke user access

An existing user may be suspended in order to disable their access

Suspension using groups

Suspension can be performed by making a user a members of a group called Suspended:

dn: cn=Suspended,ou=groups,dc=lm,dc=com
objectclass: groupOfNames
cn: Suspended
member: uid=TestUserA,ou=people,dc=lm,dc=com

Suspension using Password Policy

The default installation of TNC-O, which comes with an instance of OpenLDAP, will have a password policy installed and enforced. This meachanism can be used to lockout users. The easiest way to lockout a user is to set a value within the pwdAccountLockedTime attribute under the user’s DN record. An example of this is shown below:

Lock User

Execute the following command on the OpenLDAP pod to lockout the user ‘jack’:

ldapmodify -D cn=admin,dc=lm,dc=com -W

dn: uid=Jack,ou=people,dc=lm,dc=com
changetype: modify
delete: pwdAccountLockedTime

Unlock User

Execute the following command on the OpenLDAP pod to unlock the user ‘jack’:

ldapmodify -D cn=admin,dc=lm,dc=com -W

dn: uid=Jack,ou=people,dc=lm,dc=com
changetype: modify
add: pwdAccountLockedTime
pwdAccountLockedTime: 22000101000000Z

Active Directory

To connect to active directory as an LDAP source, the ldapBind mechanism should be used. The following is an example of a configuration that might typically work with Active Directory.

alm:
  ishtar:
    security:
      authenticationProvider: ldapBind
      ldap:
        url: ldap://active-directory-server:389
        base: null        
        managerDn: cn=Administrator,cn=Users,dc=lm,dc=local
        managerPassword: adminpassword  
        userSearchBase: cn=Users,dc=lm,dc=local
        userSearchFilter: cn={0}
        groupSearchBase: dc=lm,dc=local
        groupSearchFilter: member={0}