External Authentication
A Model Manager server uses the pluggable authentication framework Java authentication and authorization service (JAAS) to integrate with external authentication protocols. A login configuration is specified by listing vendor-supplied login modules that should be applied (in the order they are listed) when the user tries to log in.
Support for Windows® authentication and LDAP authentication as login modules is included with a Model Manager server installation. You may also specify a custom login module using a module class obtained from a third-party vendor.
A user that has authenticated via a login module can be automatically assigned membership to one or more groups in a Model Manager server database for the duration of their login session. This is useful if an administrator has already set up group memberships in the external credentials storage and wants to use the same groups for controlling access to items in a Model Manager server database.
See Database Administration and the Model Manager Reference Manual for more information on user management and access control.
The External Authentication page, opened by clicking External Authentication in the System navigation sidebar, shows all currently configured login modules in the Login Modules field and all group membership mappings in the Group mappings field. Both lists are empty for a new installation of a Model Manager server.
Click Edit to edit the login modules and group membership mappings. Click Clear to clear all login modules and group membership mappings.
You can test the validity of the configuration by clicking the Test button — see Testing an External Authentication Configuration.
Adding a Login Module
When editing the configuration for external authentication, click Add Login Module to add a new login module to the overall list of login modules.
1
Select the type of login module in the Type list. The available options are Windows Login, LDAP, and Custom — see below for their specific configuration settings.
2
Select how a successful or unsuccessful authentication attempt by the login module should be handled in relation to other login modules in the Control flag list. The available options are:
a
Requisite. The login module is required to succeed for the overall authentication to succeed. If it succeeds, the next login module in the list of modules will be applied. If it fails, no other login module is applied.
b
Optional. The login module is not required to succeed for the overall authentication to succeed. Regardless if it succeeds or fails, the next login module in the list of modules will be applied.
c
Required. The login module is required to succeed for the overall authentication to succeed. Regardless if it succeeds or fails, the next login module in the list of modules will be applied.
d
Sufficient. If the login module succeeds, no other login module is applied. If it fails, the next login module in the list of modules will be applied.
3
Click the Add Option button under Options to add custom options in the Option and Value fields. The supported options are vendor specific to each login module.
The overall external authentication is successful only if all applied login modules with Required and Requisite succeeded. Note that applied is important here — if a login module with Sufficient succeeds, only login modules with Required and Requisite specified before that login module need to succeed. At least one login module with Sufficient or Optional must succeed if there are no login modules with Required or Requisite.
The value set for the Control flag is irrelevant when only a single login module has been added. The overall authentication succeeds if, and only if, the login module is successful.
Windows Login
If you have installed the Model Manager server on the Windows® operating system, users can log in using Windows® authentication by adding a Windows login module.
1
Write the format to identify the user being authenticated in the Principal format list. Select Fully qualified names for usernames of the form <domain>\<user>. Select SID to use security identifiers to identify users. Select Both to allow both fully qualified names and security identifiers.
2
Write the format for the returned principal role names of the authenticated user in the Role format list. Select Fully qualified names to return names of the form <domain>\<group>. Select SID to return security identifiers. Select Both to return both fully qualified names and security identifiers. Select None if no principal role names should be returned.
LDAP
You can configure a login module to use LDAP to communicate with a credentials storage supporting that protocol — for example, Windows® Active Directory® (AD) or OpenLDAP.
See the Java documentation for com.sun.security.auth.module.
LdapLoginModule to learn more about the configuration settings for the LDAP login module.
1
Write the URL connection string used to connect to the LDAP server and directory containing the user to authenticate in the User Provider field. You can write several URL connection strings separated by spaces; each URL connection string will be attempted until a successful connection to the LDAP server is established.
2
Write an optional LDAP filter string in the User filter field. This specifies a search filter used to locate the user in the LDAP directory by the user's distinguished name in LDAP. Use the special token {USERNAME} as a placeholder for the username provided on the Log In page.
3
Write an LDAP distinguished name or some other string name in the Authentication identity field. The name is used to locate the user in the LDAP directory. The name must contain the token {USERNAME}, which acts as a placeholder for the username provided on the Log In page. The User filter field must be specified if the Authentication identity field does not contain a distinguished name.
4
Write a string name in the Authorization identity field that will be used to associate a principal name with a successfully authenticated user. You can write a single token of the form {<attribute-name>} as a placeholder for a user attribute value in LDAP that holds a principal name.
5
Select whether or not the connection to the LDAP server should use secure sockets layer (SSL) in the Use SSL list.
You are strongly recommended to enable SSL to avoid sending credentials in cleartext to the LDAP server.
A sample configuration for Windows® Active Directory® may look like:
1
User Provider: ldap://ldap.example.com:3268/DC=example,DC=com
2
User filter: (&(sAMAccountName={USERNAME})(objectclass=user))
3
Authentication identity: {USERNAME}@example.com
4
Authorization identity: {MEMBEROF}
5
Use SSL: Enabled
A sample configuration for OpenLDAP may look like:
1
User Provider: ldap://ldap.example.com/ou=People,dc=example
2
User filter: (&(uid={USERNAME})(objectClass=inetOrgPerson))
3
Authentication identity:
4
Authorization identity: {MAIL}
5
Use SSL: Enabled
with Authentication identity intentionally left blank.
Custom
You can configure a custom login module provided by a third-party vendor. Write the fully qualified Java class name of the login module in the Module class field. Consult the documentation of the login module for the custom options that need to be provided.
Adding Group Mappings
You can map principal names returned by login modules to corresponding group names in a Model Manager server database. A successfully authenticated user will be considered a member of mapped groups for the duration of their login session.
A principal is an umbrella term for a user, role, or group.
When editing the configuration for external authentication, click Add Group Mapping to add a new mapping.
1
Write the name of a principal returned by a login module in the Principal name field. This can be a username, role name, group name, or some other string name specific to the type of login module.
2
Under Mapped groups, click Add Group and write the name of a group in a Model Manager server database that the authenticated user should become a member of. The group will be automatically created in the database if it did not already exist when the user logged in. Repeat to map the principal to more groups.
Successfully mapped group names are visible in the External Group Memberships field on the The My Account Page for the logged in account.
Testing an External Authentication Configuration
You can test the current configuration for external authentication. Click the Test button and write a username and password in the opened dialog box.
If the authentication succeeds, you will see the principal names returned by the login modules, including the name used to authenticate with, as well as the names of any groups these principal names would be mapped to. If the authentication fails, you will see the error messages returned by the login modules.