TeamSite and Active Directory integration -?

Hi,

I have installed TS 7.4.1 version in Linux box. We would like to restrict users that can be added to TeamSite to belong only to specif Active directory.

Please can anybody let me know steps to integrate the TS and AD. Something within TeamSite prevents the TS and AD integration to work properly.

Regards

Gopi

Find more posts tagged with

Comments

Rick Poulin

Post your current configuration, minus security details. I vaguely remember an issue with trying to bind to the AD root -- you have to specify a DC and OU.

Also note that TS can't restrict access to a specific sub-branch of users in AD. You can only bind to the OU as a whole.

gopi123

I am new to Active directory integration. I am not sure what are all configuration files will used for TS integration with AD. I read one of the TS UI Admin guide and in that it mentioned that TeamSite can be configured to use Active Directory for user authorization.

I need steps to configure. Please let me know what configuration files you need and what do you mean by DC and OU.

Appreciate your help!!!

Rick Poulin

If you haven't done it yet, then why are you saying TS doesn't work properly?

Linux can't connect to AD directly. You have to connect to it over LDAP, so you first have to make sure that this capability is enabled on your AD server. Then, you treat the user repository as an LDAP server and go from there. "DC" and "OU" are LDAP terms that should be familiar to your network admins, so ask them for the info.

The file(s) to modify are user_databases.xml and/or iw.cfg. The former is supposed to supersede the latter, but I vaguely remember having to play in both. Look up user_databases.xml in the HP guides and post again if you get stuck.

Reji Varghese

gopi123 wrote:
I am new to Active directory integration. I am not sure what are all configuration files will used for TS integration with AD. I read one of the TS UI Admin guide and in that it mentioned that TeamSite can be configured to use Active Directory for user authorization.

I need steps to configure. Please let me know what configuration files you need and what do you mean by DC and OU.

Appreciate your help!!!

You should find all these details in "TeamSite Administration Guide" and not UI Admin guid.

gopi123

I'm trying to configure TeamSite 7.4.1 on Linux so that the users can authenticate against an Active Directory, so in user_databases.xml if I specify the LDAP/Active directory details is that enough or what else I need to specify. When I start TS how it will authenticate against the LDAP/AD users.

Rick Poulin

gopi123 wrote:
I'm trying to configure TeamSite 7.4.1 on Linux so that the users can authenticate against an Active Directory, so in user_databases.xml if I specify the LDAP/Active directory details is that enough or what else I need to specify. When I start TS how it will authenticate against the LDAP/AD users.

It should be enough, but you'll have to test it to find out. Every infrastructure setup is different.

TS may or may not establish an LDAP connection at startup. It usually only connects when it needs to validate someone's credentials, and then releases the connection after a certain amount of idle time. So when someone gets to the TS login screen and inputs their username/password, TS will establish a connection to LDAP (if it doesn't already have a live one) and ask LDAP whether those credentials are valid or not. Additionally, when you're adding users to TeamSite through the Admin console, TS will connect to LDAP to execute the user search query. That's pretty much the only times that TS will interact with LDAP.

Reji Varghese

I would say, TeamSite authenticates the users based on the [authentication] section inside iw.cfg. In that you would need to mention the mode of authentication. And since you are using LDAP, you would need pam.

[authentication]
authenticate_by=pam
pam_service=sudo
ldap_server=xxxxxxxxxxxxx
ldap_port=389
ldap_dnbase=ou=xxxxxxx,dc=xxxxxx,dc=xxxx
ldap_key=cn
ldap_account=cn=xxxxxxxxx
ldap_pwd=xxxxxxxxxxxxxx

gopi123

Usually our TS 7.4.1 is on Linux and we are planning to maintain users in Active Directory so we are planning to Authenticate TS via AD. so as in this thread it mentioned that "Linux can't connect to AD directly, so we have to connect to it over LDAP, so first we have to make sure that this capability is enabled on your AD server. Then, we treat the user repository as an LDAP server and go from there."

So how we can intergarte with AD over LDAP what is the relation ship with each and other. I am not clear on this.

Rick Poulin

reji_kv wrote:
[...] And since you are using LDAP, you would need pam.

False. Authentication against LDAP does not strictly require PAM. The key (assuming you want OS users) is to match the authentication configuration of the underlying system.

gopi123 wrote:
So how we can intergarte with AD over LDAP what is the relation ship with each and other. I am not clear on this.

You should probably hand off this configuration task to someone in your organization who knows a bit more on the subject, or at least have a networking guy sit with you as you go through it. The answer to this question can easily be found on Google/Wikipedia.

In a nutshell, Active Directory is an implementation of a User Directory Service. Other such products include OpenDJ and Oracle Identity Manager. Applications interact with these Directory Services using a defined protocol. For Active Directory, the default protocol (for talking with Windows machines) is Kerberos or NTLM. Linux does not natively understand these protocols, so you have to use the more "standard" LDAP instead.

Now, I am not an administrator of a domain controller in any way, but I would assume that AD would, by default, not respond to LDAP to close an unnecessary security risk UNLESS someone in your organization comes along and says they need it turned on. This is where you come in and talk to your network admins about it.

shameem

Hello. My Teamsite is on windows 2008 R2 and integrated with organization's Active directory. I could see only a single relevant line under [iwserver] section

domain_list=<<DOMAIN>>,<<ServerName>>

and [authentication] section blank, user database xml file is also having no entry.

Where do I find which LDAP integrated with teamsite. If I have to integrate with another LDAP where do I add that information. Help pls.

nipper

Normal AD is picked up when the server TS runs on sees more domains.

THe DOMAIN_LIST variable you see tells TS to stop looking after it connects to those domain servers. TS will spend its time looking for domain controllers and never complete the startup in a entitiy with many AD domains.

If you are talking about LDAP, use TeamSite/conf/roles/user_databases.xml

There are instructions in the manual as well as an example file.

shameem

Thank you Nipper.

Little confused, how TS know which AD it is going to connect. Does it take by default the domain it is connected to or is there something my low ntk knowledge is unable to preceive.

This thread some body says "For Active Directory, the default protocol (for talking with Windows machines) is Kerberos or NTLM. Linux does not natively understand these protocols, so you have to use the more "standard" LDAP instead."

Does it mean I need not have LDAP in between to talk to AD.

I have a requirement to connect to multiple ADs. One AD already my TS is connected to and getting users information. ANother AD needs to be added. For that do I have to connect through LDAP. Sorry if I confused explaining the issue.

nipper

There are 2 entries in iw.cfg for valid_domains, one in [teamsite_servlet_ui] and one in [iwserver]

Put the valid domains in there (both). Or remove the entries and use all.

You use the pulldown to decide which domain to validate the login with.

As to Linux, there are products out there that integrate AD with LDAP. You can use one of those and then connect to an LDAP server by editing the file I told you about

Adam Stoller

nipper wrote:
There are 2 entries in iw.cfg for valid_domains, one in [teamsite_servlet_ui] and one in [iwserver]

[...]

I believe the first is under [iwcgi] not [teamsite_servlet_ui] (unless something changed recently).

The first ([iwcgi]) controls what you see in the dropdown list on the login page and can (perhaps "should") contain the local server name; the second ([iwserver]) controls what the server attempts to connect to when starting up so that it can initiate authentication againsts those domains and should not contain the local server name (the local server should not be a domain controller)

Both of the above are generally associated with a TeamSite server running on Windows and authenticating against Windows Active Directory.

If you're using a Unix TeamSite server - then you either need to use PAM/LDAP settings (and configure the [authentication] section of iw.cfg appropropriately) or configure the user_databases.xml file to connect to the LDAP server(s) you want to authenticate against.

shameem

Thank you Ghoti and Nipper. Soon I will be configuring my environment and hoping for luck...