LDAP Authentication

To set up LDAP (Lightweight Directory Authentication Protocol) in AxonOps (on-premises only), update the axon-server.yml configuration at the following location:

/etc/axonops/axon-server.yml

LDAP Fields

host : IP Address or Hostname of the LDAP server (A domain controller for LDAP).

port : The configured LDAP port of the server.

  Standard default ports are either
  - 389 (Unencrypted)
  - 636 (Encrypted LDAPS)
  The ports can be changed by LDAP administrators.

useSSL : true/false - Connects to LDAP using a secure port.
startTLS : true/false - Start SSL/TLS encryption before LDAP authentication takes place, set this to true if your LDAP server uses StartTLS.
base: A base DN is the point from which AxonOps will search for users or groups.
bindDN : The DN of the user who has access to bind to LDAP.
bindPassword : The bindDN user's password.

userFilter : This is the LDAP filter that AxonOps will use to locate users.

  Some examples could be
  - (uid=%s) : Search for users by using the LDAP "uid" field.
  - (cn=%s) : Search for users by using the "cn" (Common Name) field.

rolesAttribute : The LDAP attribute that contains the user's list of groups.
rolesMapping : Mapping of LDAP user/groups to AxonOps security groups.

Role Mapping

The rolesMapping has multiple levels based on the configuration of your AxonOps setup :

Please note

Values in UPPERCASE need to be updated with your configuration specific values.

_global_ : Roles assigned to the global scope apply to all clusters connected to AxonOps
ORGANISATIONNAME/CLUSTER_TYPE: Roles assigned to this scope apply to all clusters of the specified type,
ORGANISATIONNAME/CLUSTER_TYPE/CLUSTER_NAME : Roles assigned to this scope apply to a single cluster.

ORGANISATIONNAME: The name of your organization as shown in the AxonOps UI. It should match the org_name option in axon-server.yml.

CLUSTER_TYPE : cassandra or kafka

CLUSTER_NAME : The name of the cluster as shown in the AxonOps frontend.

For the above levels there are 4 role mappings which are required fields:

superUserRole : The superuser role which has permission to do everything in AxonOps.
adminRole : Similar to superUserRole but cannot configure AxonOps settings or log collectors.
backupAdminRole : The user that has administration privileges to create and manage backups. Has read-only access to the rest of the AxonOps server pages and components.
readOnlyRole : A basic read-only role that cannot modify any configuration in AxonOps.

Distinguished Names that are used in the role mappings can comprise of the following parts which define hierarchical structure in a LDAP directory.

CN = Common Name
OU = Organisational Unit
O = Organisation Name
DC = Domain Component

Example LDAP Role Mappings

Take Note

The default built-in LDAP OU names are case-sensitive.

The following examples can be configured differently based on your LDAP setup.

LDAP Groups or Distribution Groups :
```
cn=cassandra_superusers,ou=Groups,dc=example,dc=com
```
- cn = cassandra_superusers or cassandra__superusers group
- ou = Groups or Distribution Groups
- dc = example.com
LDAP Users :
```
cn=superuser,ou=Users,dc=example,dc=com
```
- cn = The name of the user e.g. superuser
- ou = Users
- dc = example.com

axon-server.yml configuration example

auth:
  enabled: true
  type: "LDAP" # only LDAP is supported for now
  settings:
    host: "myldapserver.example.com"
    port: 636
    useSSL: true
    startTLS: false
    insecureSkipVerify: false # If true then skip SSL/TLS certificate verification

    base: "ou=Users,dc=example,dc=com"
    bindDN: "cn=administrator,ou=Users,dc=example,dc=com"
    bindPassword: "##############"
    userFilter: "(cn=%s)"
    rolesAttribute: "memberOf"
    callAttempts: 3 # how many times to retry a connection to LDAP, in case of network issues.
    rolesMapping:
      _global_:
        superUserRole: "cn=superuser,ou=Groups,dc=example,dc=com"
        readOnlyRole: "cn=readonly,ou=Groups,dc=example,dc=com"
        adminRole: "cn=admin,ou=Groups,dc=example,dc=com"
        backupAdminRole: "cn=backupadmin,ou=Groups,dc=example,dc=com"
      organisationName/cassandra:
        superUserRole: "cn=cassandra_superusers,ou=Groups,dc=example,dc=com"
        readOnlyRole: "cn=cassandra_readonly,ou=Groups,dc=example,dc=com"
        adminRole: "cn=cassandra_admins,ou=Groups,dc=example,dc=com"
        backupAdminRole: "cn=cassandra_backupadmins,ou=Groups,dc=example,dc=com"
      organisationName/cassandra/prod:
        superUserRole: "cn=cassandra_prod_superusers,ou=Groups,dc=example,dc=com"
        readOnlyRole: "cn=cassandra_prod_readonly,ou=Groups,dc=example,dc=com"
        adminRole: "cn=cassandra_prod_admins,ou=Groups,dc=example,dc=com"
        backupAdminRole: "cn=cassandra_prod_backupadmins,ou=Groups,dc=example,dc=com"