{"action":"created","issue":{"url":"https://api.github.com/repos/rundeck/rundeck/issues/1397","repository_url":"https://api.github.com/repos/rundeck/rundeck","labels_url":"https://api.github.com/repos/rundeck/rundeck/issues/1397/labels{/name}","comments_url":"https://api.github.com/repos/rundeck/rundeck/issues/1397/comments","events_url":"https://api.github.com/repos/rundeck/rundeck/issues/1397/events","html_url":"https://github.com/rundeck/rundeck/issues/1397","id":101075315,"number":1397,"title":"Properly document Active Directory configuration","user":{"login":"ssbarnea","id":102495,"avatar_url":"https://avatars.githubusercontent.com/u/102495?v=3","gravatar_id":"","url":"https://api.github.com/users/ssbarnea","html_url":"https://github.com/ssbarnea","followers_url":"https://api.github.com/users/ssbarnea/followers","following_url":"https://api.github.com/users/ssbarnea/following{/other_user}","gists_url":"https://api.github.com/users/ssbarnea/gists{/gist_id}","starred_url":"https://api.github.com/users/ssbarnea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ssbarnea/subscriptions","organizations_url":"https://api.github.com/users/ssbarnea/orgs","repos_url":"https://api.github.com/users/ssbarnea/repos","events_url":"https://api.github.com/users/ssbarnea/events{/privacy}","received_events_url":"https://api.github.com/users/ssbarnea/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":20,"created_at":"2015-08-14T18:35:54Z","updated_at":"2016-07-05T17:38:31Z","closed_at":null,"body":"As someone that discovered RunDeck recently my first try was to configure it to use Active Directory but I soon discovered that this use-case is [not properly documented](http://rundeck.org/docs/administration/authenticating-users.html#ldap) and in fact the support seems to be limited to password authentication only.\r\n\r\nActive Directory is a specific type of LDAP with a much more consistent structure and for this reason it should be properly documented. After spending many hours trying different configurations I am starting to believe that is not really supported, more than authentication.\r\n\r\nAuthentication part worked well but it seems impossible to map the groups by their name.\r\n```\r\nldap {\r\n    com.dtolabs.rundeck.jetty.jaas.JettyCachingLdapLoginModule required\r\n      debug=\"true\"\r\n      contextFactory=\"com.sun.jndi.ldap.LdapCtxFactory\"\r\n      providerUrl=\"ldap://example.com:3268\"\r\n      bindDn=\"CN=svcacct_rundeck,OU=Example,OU=Service Accounts,DC=example,DC=com\"\r\n      bindPassword=\"rundeck123\"\r\n      authenticationMethod=\"simple\"\r\n      forceBindingLogin=\"true\"\r\n      userBaseDn=\"dc=example,dc=com\"\r\n      userRdnAttribute=\"sAMAccountName\"\r\n      userIdAttribute=\"sAMAccountName\"\r\n      userPasswordAttribute=\"unicodePwd\"\r\n      userObjectClass=\"user\"\r\n      roleBaseDn=\"dc=example,dc=com\"\r\n      roleNameAttribute=\"sAMAccountName\"\r\n      roleUsernameMemberAttribute=\"cn\"\r\n      roleMemberAttribute=\"member\"\r\n      roleObjectClass=\"group\"\r\n      cacheDurationMillis=\"300000\"\r\n      supplementalRoles=\"user\"\r\n      reportStatistics=\"true\"\r\n      timeoutRead=\"10000\"\r\n      timeoutConnect=\"20000\"\r\n      nestedGroups=\"false\";\r\n};\r\n```\r\n\r\nI will try to explain few important concept related to AD:\r\n* `sAMAccountName` is the username (or the group name) and while it can change in time but almost never does. You can call it your login, because that's what you type when you have to login.\r\n* `cn` does uniquely identify a resource but you cannot expect users to type it in order to login.\r\n* for security reasons most AD configurations do not allow anonymous bind, which means that you need to login before making any queries. Remember that the LDAP login (bindDn) is supposed to be a cn and you may have to specify the full distinguished name there instead of the `sAMAccountName` or `DOMAIN\\sAMAccountName`. The last two can work but depends on your configuration, \"DN\" approach always work.\r\n* Instead of using ports 389/636 to connect to AD, you should probably want to use 3268/3269 which are pointing to the Global Catalog. If you do not you may be surprised that your queries do not return all users from the forests or that you client is not able to get the referrals (responses from other AD servers in the forest).\r\n* most AD users believe that their access to AD via LDAP is read-only, but they are wrong, AD can easily be modified by any user if they have the right ownership on the resource they are trying to modify. For example any Exchange mailing list is also a group in AD and if you own it or if you are listed as one of its managers, you will be able to add or remove other members.\r\n\r\nGroups can be identified using two methods, the easiest and fastest one is to get the `memberOf` attribute of the user accounts. \r\n\r\nIf you try to retrieve all the groups in or order to get their members you will probably his serious scalability issues because is is something common for an AD with 15.000 users to have 10.000 groups! Better to sticks to the first method.\r\n\r\nWhen you retried groups, the members are stored in the member attribute as DNs (distinguished names) and not as account names (what you probably use in your app to identify users). You have to convert them, which makes the operation longer.\r\n\r\nExample group record:\r\n```\r\ndistinguishedName: CN=\\#DevOps,OU=Groups,OU=EMEA,DC=example,DC=com\r\nsAMAccountName: #DevOps\r\nname: Development Operation long description\r\nmember: CN=John Doe,OU=User Accounts,OU=Bangalore,OU=APAC,DC=example,DC=com\r\nmember: CN=John Smith,OU=User Accounts,OU=UK,OU=EMEA,DC=example,DC=com\r\nobjectGUID: <binary data>\r\n```\r\nExample user record:\r\n```\r\ndistinguishedName: CN=John Doe,OU=User Accounts,OU=EMEA,DC=example,DC=com\r\nname: John Doe\r\nsAMAccountName: johnd\r\nmemberOf: CN=...,DC=example,DC=com\r\nmemberOf: CN=...,DC=example,DC=com\r\nEmail: john.doe@example.com\r\nManager: CN=...\r\n```\r\n\r\nAs you can observe while the simple and intuitive way is to use sAMAccountName to identify users and groups, when it comes to identifying membership you will only get the `CN` which has to be translated later.\r\n\r\nWhile in practice sAMAccountName can have duplicates, I would say that this is an extreme case that would be easier not to support as 99% of the applications are not able to deal with this and this can easily be handled by the IT support by renaming the duplicated accounts.\r\n\r\nAnd now the big questions, these being said, how are we supposed to complete the   `roleNameAttribute`, `roleUsernameMemberAttribute` and `roleMemberAttribute` in order to make rundeck to recognize the groups from AD?"},"comment":{"url":"https://api.github.com/repos/rundeck/rundeck/issues/comments/230548179","html_url":"https://github.com/rundeck/rundeck/issues/1397#issuecomment-230548179","issue_url":"https://api.github.com/repos/rundeck/rundeck/issues/1397","id":230548179,"user":{"login":"gschueler","id":55603,"avatar_url":"https://avatars.githubusercontent.com/u/55603?v=3","gravatar_id":"","url":"https://api.github.com/users/gschueler","html_url":"https://github.com/gschueler","followers_url":"https://api.github.com/users/gschueler/followers","following_url":"https://api.github.com/users/gschueler/following{/other_user}","gists_url":"https://api.github.com/users/gschueler/gists{/gist_id}","starred_url":"https://api.github.com/users/gschueler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gschueler/subscriptions","organizations_url":"https://api.github.com/users/gschueler/orgs","repos_url":"https://api.github.com/users/gschueler/repos","events_url":"https://api.github.com/users/gschueler/events{/privacy}","received_events_url":"https://api.github.com/users/gschueler/received_events","type":"User","site_admin":false},"created_at":"2016-07-05T17:38:30Z","updated_at":"2016-07-05T17:38:30Z","body":"@dwaynekuan then your role query via ldap is not correct.  You can try enabling DEBUG logging for JAAS to see if there is any more info. Add this to your `/etc/rundeck/profile`, or your launch string:\r\n`-Dcom.dtolabs.rundeck.jetty.jaas.LEVEL=DEBUG`"}}
{"actor":{"display_login":"gschueler"}}