LDAP management | MediaKind Docs

LDAP management

LDAP configuration

By default, accessing the Controller user interface is restricted to people that have a user account defined through the MediaKind system center. You can also configure the user access by retrieving user credentials from an existing LDAP server directory.

  1. Log in as a user with Administrative privileges.

  2. Click '%3e%3cpath%20d='M15.1876%205.73877C15.2529%205.91634%2015.1978%206.11432%2015.057%206.24086L14.1732%207.04502C14.1957%207.21443%2014.2079%207.38791%2014.2079%207.56344C14.2079%207.73897%2014.1957%207.91245%2014.1732%208.08186L15.057%208.88602C15.1978%209.01256%2015.2529%209.21054%2015.1876%209.38811C15.0978%209.63099%2014.9896%209.86366%2014.8651%2010.0882L14.7692%2010.2535C14.6345%2010.478%2014.4835%2010.6903%2014.3181%2010.8903C14.1977%2011.0372%2013.9977%2011.0862%2013.8181%2011.0291L12.6812%2010.6678C12.4078%2010.878%2012.1057%2011.0536%2011.7832%2011.1862L11.5281%2012.3517C11.4873%2012.5374%2011.3444%2012.6843%2011.1566%2012.715C10.875%2012.7619%2010.5851%2012.7864%2010.2892%2012.7864C9.99323%2012.7864%209.70341%2012.7619%209.42175%2012.715C9.23397%2012.6843%209.0911%2012.5374%209.05028%2012.3517L8.79516%2011.1862C8.47267%2011.0536%208.1706%2010.878%207.89711%2010.6678L6.7623%2011.0311C6.58269%2011.0883%206.38267%2011.0372%206.26225%2010.8923C6.09693%2010.6923%205.9459%2010.4801%205.81119%2010.2555L5.71526%2010.0902C5.59076%209.86571%205.48259%209.63303%205.39278%209.39015C5.32747%209.21258%205.38258%209.0146%205.52341%208.88806L6.40717%208.0839C6.38472%207.91245%206.37247%207.73897%206.37247%207.56344C6.37247%207.38791%206.38472%207.21443%206.40717%207.04502L5.52341%206.24086C5.38258%206.11432%205.32747%205.91634%205.39278%205.73877C5.48259%205.49589%205.59076%205.26322%205.71526%205.0387L5.81119%204.87338C5.9459%204.64887%206.09693%204.4366%206.26225%204.23658C6.38267%204.08963%206.58269%204.04065%206.7623%204.0978L7.89915%204.45906C8.17265%204.24883%208.47472%204.0733%208.7972%203.94064L9.05232%202.77522C9.09314%202.58948%209.23601%202.44253%209.42379%202.41192C9.70545%202.36293%209.99527%202.33844%2010.2912%202.33844C10.5872%202.33844%2010.877%202.36293%2011.1587%202.40988C11.3464%202.44049%2011.4893%202.58744%2011.5301%202.77318L11.7852%203.9386C12.1077%204.07126%2012.4098%204.24679%2012.6833%204.45701L13.8201%204.09575C13.9997%204.03861%2014.1998%204.08963%2014.3202%204.23454C14.4855%204.43456%2014.6365%204.64683%2014.7712%204.87134L14.8672%205.03666C14.9917%205.26117%2015.0999%205.49385%2015.1897%205.73673L15.1876%205.73877ZM10.2912%209.19625C10.7243%209.19625%2011.1396%209.02422%2011.4458%208.71801C11.752%208.4118%2011.924%207.99649%2011.924%207.56344C11.924%207.13039%2011.752%206.71508%2011.4458%206.40887C11.1396%206.10266%2010.7243%205.93063%2010.2912%205.93063C9.85817%205.93063%209.44286%206.10266%209.13665%206.40887C8.83044%206.71508%208.65841%207.13039%208.65841%207.56344C8.65841%207.99649%208.83044%208.4118%209.13665%208.71801C9.44286%209.02422%209.85817%209.19625%2010.2912%209.19625Z'%20fill='%23878787'%20fill-opacity='0.9'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_590_373'%3e%3crect%20width='19'%20height='17.5385'%20fill='white'%20transform='translate(0.615479)'/%3e%3c/clipPath%3e%3c/svg%3e) in the upper right corner of the window.

  3. Select Settings. The Settings page displays 5 tabs:

  4. In the LDAP tab, configure the LDAP settings to integrate with the local LDAP server.

After changing the LDAP settings, for changes to take effect, the authentication service must be restarted. Either restart the Controller, or consult MediaKind Services for guidance on restarting the correct services for your deployment.

Loading LDAP certificates

If LDAP certificates are being loaded, configure LDAP on the settings page, then load the certificates.

For HA deployment, the following procedures must be done on both controller servers.

  1. On the controller server, place the LDAPS certificates in /etc/pki/ca-trust/source/anchors/

  2. Run the following command:

    update-ca-trust extract

    This will extract it to the standard OS trust store location (default path used in the controller UI):

    /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

  3. Edit the config file to set the right values:

    /opt/mediakind/utility/bin/controller/ldaps.conf

    The conf file must contain the fully qualified domain name for the LDAP server (same as in the certificate) and the IP address of that server.

    ###############################################################################
#                                                                             #
# Config file used by add-ldaps-certs.sh                                      #
# Needs to be populated by the customer specific parameters                   #
#                                                                             #
###############################################################################

# newLDAPServerName must be fully resolvable
# FQDN that matches the provided root CA
newLDAPServerName=ldaps.sou.new
newLDAPServerIP=10.1.1.1
deployment=unified-ui
LDAP Field Description Example value
server Address of the LDAP server to communicate with. ldap://fr-my.companydomain.com:389
Bind DN Distinguished name to use when binding to the LDAP server; leave empty (default) for an anonymous bind. CN=apache, OU=COM, OU=Sites, DC=companydomain, DC=com
Bind password Password to use for binding with protected binding; leave empty (default) for anonymous binding. Password123
Search base DN DN to use when binding to the server in order to perform searches. Leave empty for anonymous binding. OU=COM, OU=Sites, DC=companydomain, DC=com
Username field Name of the field to use in the LDAP search, for username matching (against LDAP attributes). sAMAccountName
Firstname field Name of the field (from LDAP attributes) holding the user’s first name. givenName
Lastname field Name of the field (from LDAP attributes) holding the user’s last name. sn
CA certificate file Location of the CA certificate file used to verify the LDAP server’s certificate when using TLS or LDAPS. /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
Cipher suite Open SSL-format string defining the list of ciphers to use for TLS communication. kEECDH+aECDSA+AES:kEECDH+AES+aRSA:kEDH+aRSA+AES:-SSLv2:-SSLv3:-TLSv1:-TLSv1.1
Required group The LDAP group required for a user to be able to log in. cn=lcl.cnt.dfw.di.mediakind.allowlogon, ou=Resources,ou=Groups, ou=MediaKind,ou=CP, dc=example,dc=org
Group search The filter used to search for required group. dc=example, dc=org
Default group A Controller group assigned to a user that has logged in via LDAP. Mutually exclusive with ldap_group_mappings section. Monitoring
Group type The type of group used to search through LDAP. NestedActiveDirectoryGroupType
LDAP group mappings A section that can be used to control authorisation through LDAP groups. Configure group_search (and don’t use default group). LDAP group
MK_Admin Admin
MK_Configuration Configuration
MK_Monitoring Monitoring

  1. Run the script:

    /opt/mediakind/utility/bin/controller/add-ldaps-server.sh

    Running the script will restart the required containers.