Windows Active Directory#

The Windows Active Directory strategy signs in users with their Windows Active Directory account. The Security Portal validates the user name and password against Active Directory over LDAP or LDAPS. Users sign in as DOMAIN\user, and the strategy matches them to the MES User with that account. For other LDAP directories, use the LDAP Server strategy.

Before configuring the strategy, collect the address of the Active Directory server, the base distinguished name where the user search starts, and a user with permission to search Active Directory.

Configuration#

Available out of the box with the ID ActiveDirectory. Enable and configure it in DevOps Center during the installation, with the domain, address, base DN, user name, password, port, SSL, and certificate validation settings. Disabled by default. For more than one domain, see Multiple Domains.

Parameters#

Strategy type	Plugin
`local-ActiveDirectory`	`@criticalmanufacturing/auth-plugin-local`

Table: Windows Active Directory strategy type and plugin

Each strategy entry also accepts the common strategy properties.

Parameter	Required	Description
`defaultDomain`	No	Domain added to the user name when the user signs in without a `DOMAIN\` prefix.
`ldap.url`	Yes	Address of the Active Directory server, for example `ldap://example.com`. Use an `ldaps://` address to connect over LDAPS.
`ldap.base`	Yes	Base distinguished name where the search starts, for example `DC=example,DC=com`.
`ldap.user`	Yes	User with permission to search Active Directory.
`ldap.password`	Yes	Password of `ldap.user`.
`ldap.disableCertificateValidation`	No	Set to `true` to skip the validation of the LDAPS server certificate. Default: `false`.
`ldap.caCertificatePath`	No	Path of the CA certificate that validates the LDAPS server certificate. If omitted, the system certificate store is used.

Table: Windows Active Directory strategy parameters

Example#

{
  "id": "ActiveDirectory",
  "type": "local-ActiveDirectory",
  "config": {
    "defaultDomain": "<DefaultDomain>",
    "ldap": {
      "url": "ldap://<example.com>",
      "base": "DC=<example>,DC=<com>",
      "user": "<User>",
      "password": "<Password>"
    }
  }
}

Multiple Domains#

To sign in users from more than one Active Directory domain, configure one local-ActiveDirectory strategy per domain. See Multiple Active Directory Domains Configuration.