LDAP authentication

Connect Cloud Management Platform (CMP) to an LDAP or Active Directory server so that users can log in with their directory credentials

5 minute read

Add LDAP utility

Set up a connection to your LDAP utility.

Go to Admin > LDAP Authentication Settings.
Select Add.

Complete the Add LDAP Utility form:

Field	Notes
IP Address	IP address or FQDN of AD/LDAP server.
Port	Port to connect to the AD/LDAP server. Defaults are 389 (LDAP) and 636 (LDAPS).
Protocol	Select ldap or ldaps. To use ldaps, LDAPS must be enabled on the directory server. See the OpenLDAP or Active Directory documentation.
LDAP Version	Select Version 2 or Version 3. Contact your directory admin for guidance.
Account	The service account in AD/LDAP that can search for users and, if applicable, join servers to the domain. For Active Directory, use the form `username@domain`.
Password	The password used to authenticate the service account. If the password vault feature is enabled, this field offers Locally Stored or Vault Managed. Select Vault Managed to read the secret from a configured vault provider. See Use password vaults.

Select Save.

Edit LDAP settings

After saving the LDAP credentials, select Settings from the LDAP utility to edit the LDAP settings. This must be completed before the LDAP utility can be used.

Field	Description
Domain	The domain for the AD/LDAP (for example, `www.domain.com`).
Base DN	Enter a base Distinguished Name (DN) as the starting point for searching for users in the directory.
Search Filter	This can be used to limit the users returned in the first phase of authentication. It uses the LDAP filter syntax.
Disabled User Filter	Users that match this filter are set to inactive in CMP.
Username Field	The AD/LDAP attribute to use for the username when creating a CMP user. For AD, it usually is `sAMAccountName`. For most other directory servers, it should be `uid`.
Firstname Field	The AD/LDAP attribute to use for the first name when creating a CMP user. Defaults to `givenName`.
Lastname Field	The AD/LDAP attribute to use for the last name when creating a CMP user. Defaults to `sn`.
Email Field	The AD/LDAP attribute to use for the email address when creating a CMP user. Defaults to `mail`.
Email format	Not all directories store email information, or an admin may want to override the email settings for each user. In CMP, you can define an email template based on other user attributes, for example `first.last@domain` or `username@your-domain.com`. Possible references: first, last, username, or domain.
Auto create user	Any valid LDAP user can access CMP, even if no matching CMP user existed prior to the first login attempt. See Auto-creation of users below.
Portals	The portals to be listed for this domain at login.

Select Save once completed.

Local credential store

The Local credential store switch on the LDAP Authentication Settings page controls whether local user accounts on this instance can log in with their CMP credentials.

Enabled: Local user accounts created on this instance can use their credentials to log in.
Disabled: Local credentials cannot be used to log in to this instance. Disabling the local credential store does not delete or modify local accounts.

Verify the connection

CMP ships with the OpenLDAP ldapsearch utility. To verify the AD/LDAP connection, log in to the CMP console and run ldapsearch, passing uri, binddn, and search based on the way AD/LDAP is configured in CMP.

ldapsearch -H "PROTOCOL://IP:PORT" -D "ACCOUNT" -b BASEDN -w PASSWORD -s sub -x -v  "FILTER"

Modify the LDAP network connection timeout

By default, the LDAP network connection timeout is set to 5 seconds. This timeout controls how long CMP waits when establishing a connection to the LDAP server. In environments with higher latency or slow directory servers, this value may be too low, leading to connection failures.

To modify the LDAP network connection timeout:

SSH into your CMP server as the root user.
Open /var/opt/cloudbolt/proserv/customer_settings.py for editing.

Add the following line with an appropriate value in seconds, and save the file:

# Example: LDAP_NETWORK_TIMEOUT = 30
LDAP_NETWORK_TIMEOUT = <timeout_in_seconds>

Restart the Apache HTTP Server and the job engine:

systemctl restart httpd
supervisorctl restart jobengine:*

Verify the LDAPS server certificate

Use this setting only if your LDAP utility uses the ldaps protocol.

By default, CMP encrypts LDAPS connections but does not verify the directory server’s certificate. To have CMP verify the certificate, set LDAP_CACERTFILE to the certificate authority (CA) certificate that signed it. CMP then rejects the connection if the server’s certificate was not issued by that CA.

The setting applies to every LDAP utility that uses ldaps. If your directory servers use certificates from different CAs, combine the CA certificates into one file.

To add the LDAPS CA certificate:

Get the CA certificate (not the server certificate) in PEM format from your directory administrator.
SSH into your CMP server as root.
Copy the CA certificate to /var/opt/cloudbolt/proserv/.
Open /var/opt/cloudbolt/proserv/customer_settings.py for editing.

Add the following line with the path to the CA certificate, and save the file:

# Example: LDAP_CACERTFILE = "/var/opt/cloudbolt/proserv/exampleldap_ca.crt"
LDAP_CACERTFILE = "<path_to_ca_certificate>"