Page History

Chariot UI - LDAP Users and Groups/Roles

The Chariot Security Service can be configured to add an LDAP Realm to use when authenticating and authorizing access via the Chariot UI. Each LDAP Realm uses a simple bind authentication to connect to the LDAP server to search for users and groups. A user that is logging in to the Chariot UI will have their username mapped to the distinguished name (DN) of an LDAP entry using a configure template (see below).  Chariot will use simple bind authentication to authenticate the user and will search for group membership to determine the corresponding Chariot Role membership using the configured mapping.

The following file must be manually edited to add an LDAP Realm configuration:

conf/com.cirruslink.chariot.security.config

Example configuration:

tokenTimeout="5400000"
ticketTimeout="3000"
defaultRealmEnabled=B"false"
ldap.1.enabled=B"true"
ldap.1.url="ldap://localhost:389"
ldap.1.sysUserDn="cn=chariot"
ldap.1.sysPassword="123456"
ldap.1.userDnTemplate="uid={0},ou=users,dc=cirruslink,dc=com"
ldap.1.groupBaseDn="ou=groups,dc=cirruslink,dc=com"
ldap.1.groupNameAttribute="cn"
ldap.1.groupToRoleMapping="group1=admin,group2=guest"

LDAP Realm configuration properties:

Adding a Microsoft Active Directory source

To add a Microsoft Active Directory source, complete the following steps:

1. Navigate to the following page:
   
   CONFIGURATION → Accounts → Sources
   Image Added
2. Click on the Add Source button and select the "Active Directory" Source Type to bring up the Source configuration form.
   Image Added
   
3. Enter the Active Directory configuration (see the table below for information on the configuration fields and click the Add button in the bottom right of the form when finished entering the configuration.Image Added
4. Click on the newly created Source entry to inspect the Configuration, Users, and RolesImage AddedImage Added

Configuration Fields:

Chariot MQTT - LDAP Authentication and ACLs

Chariot can be configured to use an LDAP server for MQTT client authentication and authorization instead of Chariot's MQTT Credentials.

LDAP Server

• LDAP Server schema and sample data can be found in the following directory:
  

  • samples/ldap/ldif/

• Entries in the LDAP Server used for authentication must support simple bind requests
• Entries in the LDAP Server used for authorization must extend the cls-mqttCredential Object Class and use the cls-subTopicFilter and cls-pubTopicFilter attributes to declare their ACLs (see description below)

LDAP Schema Object Classes

...

cls-mqttCredential

...

1.3.6.1.4.1.60051.2.2.1

...

Adding an LDAP directory server source

To add a generic LDAP directory server source, complete the following steps:

1. Navigate to the following page:
   
   CONFIGURATION → Accounts → Sources
   Image Added
2. Click on the Add Source button and select the "LDAP" Source Type to bring up the Source configuration form
   Image Added
   
3. Enter the LDAP directory configuration (see the table below for information on the configuration fields and click the Add button in the bottom right of the form when finished entering the configuration.
   Image Added
4. Click on the newly created Source entry to inspect the Configuration, Users, and Roles.
   Image Added
   Image Added
   

Configuration Fields:

LDAP Schema Attributes

...

cls-subTopicFilter

...

1.3.6.1.4.1.60051.2.1.1

...

An MQTT topic filter to subscribe on

...

cls-pubTopicFilter

...

1.3.6.1.4.1.60051.2.1.2

...

An MQTT topic filter to publish on

Chariot Configuration

The following configuration file must be manually added to configure LDAP authentication and authorization in the MQTT server:

conf/com.cirruslink.chariot.server.auth.ldap.config

Example ldap configuration:

idAttribute="uid"
baseDn="dc=cirruslink,dc=com"
url="ldap://localhost:389"
sysUserDn="cn=chariot"
sysPassword="123456"

LDAP auth configuration properties:

...

Additionally the Chariot MQTT server must be configured to use the LDAP authentication instead of the internal MQTT Credentials.  This can be done by manually editing the following configuration file:

conf/com.cirruslink.chariot.server.auth.ldap.config

Example configuration:

messageThreads=I"2"
port=I"1883"
securePort=I"8883"
webSocketPort=I"8090"
webSocketSecurePort=I"8091"
bindAddress="0.0.0.0"
enableNonSecure=B"true"
enableSecure=B"false"
webSocketEnable=B"false"
webSocketEnableSecure=B"false"
allowAnonymous=B"false"
subscriptionManager.target="(type=default)"
authenticationService.target="(type=ldap)"
authorizationService.target="(type=ldap)"
maxMessageSize=I"268435455"
maxConnectSize=I"268435455"
maxClientIdLength=I"100"
maxTopicLength=I"1024"
maxTopicLevels=I"10"
connectTimout=I"10000"
clientAuthPolicy="none"

LDAP Realm configuration properties: