Bastionhost integrates with Active Directory (AD) and Lightweight Directory Access Protocol (LDAP) servers to synchronize users from your directory service to Bastionhost. This topic describes how to configure AD and LDAP authentication.
Prerequisites
Before you begin, ensure you have deployed an AD or LDAP environment and that your Bastionhost instance can connect to the AD or LDAP server.
Configure an AD authentication server
Bastionhost supports multiple AD servers, which is useful when you need to synchronize users from different domains or Base DNs. Configure each AD authentication server, import users, and then grant them asset access permissions.
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, click System Settings > Authentication Configuration.
On the AD Authentication tab, click Add Authenticated Server.
In the Add Authenticated Server panel, configure the parameters described in the following table, and then click Test Connection.
Parameter
Description
Example
Server Name
A custom name to distinguish this AD authentication server from others.
AD Server
Set as Default Server
If you select this option, this server becomes the new default server after you create it.
NoteThe API supports modifying only the default server configuration. The Enterprise edition supports up to 10 AD authentication servers, while the Basic edition supports only one.
N/A
Server Address
The connection endpoint of the authentication server.
139.129.X.X
Standby Server Address
Optional. The connection endpoint of the standby server. Leave this parameter empty if you do not have a standby server.
N/A
Port
The port of the server.
389
SSL
Select this option if an SSL certificate is installed on the AD authentication server.
N/A
Base DN
The user directory node on the server.
NoteImporting users may take a long time if the directory is large. We recommend that you limit the total number of users under this Base DN to 100,000 or fewer before importing.
cn=Users,dc=alitest,dc=com
Domain
The domain of the users you want to import into Bastionhost.
alitest.com
Account
The account to connect to the authentication server.
administrator
Password
The password for the account.
N/A
Filter
A condition that refines query results when you search for users on the server.
(&(objectClass=person))
Interval for Automatic Creation of User Snapshots
The interval, in hours, at which Bastionhost automatically synchronizes the user list from the authentication server to a local snapshot. Valid values are 0 or an integer from 4 to 168. A value of 0 disables automatic synchronization.
12
Synchronize Display Name
Specify the attribute on the remote server that represents the display name, such as
fullName. If you leave this empty, Bastionhost uses the default attributecn. Deselect the checkbox to disable synchronization for this attribute.NoteBastionhost authenticates users based on their logon names, not their display names. By default, the
sAMAccountNameattribute from the remote server synchronizes as the logon name.N/A
Email Address to Be Synchronized
Specify the attribute on the remote server that represents the email address, such as
mail. If you leave this empty, Bastionhost uses the default attributemail. Deselect the checkbox to disable synchronization for this attribute.N/A
Mobile Phone Number to Be Synchronized
Specify the attribute on the remote server that represents the mobile phone number, such as
mobile. If you leave this empty, Bastionhost uses the default attributemobile. Deselect the checkbox to disable synchronization for this attribute.N/A
Synchronize User Organization as User Group
If you enable this option, Bastionhost automatically creates the AD user's organization as a user group in Bastionhost during synchronization, and adds the user to that group.
Bastionhost supports a maximum of 500 user groups. Bastionhost does not create user groups beyond this limit during the sync.
After the initial synchronization, Bastionhost does not synchronize subsequent additions, deletions, or modifications to organizations on the AD server.
N/A
After the connectivity test passes, click Save.
To automatically synchronize AD user snapshots, click Create User Snapshots for an immediate sync, or set the Interval for Automatic Creation of User Snapshots to schedule periodic synchronization. Bastionhost reads data from the local snapshot when importing AD users to reduce performance overhead.
Configure an LDAP authentication server
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, click System Settings > Authentication Configuration.
On the LDAP Authentication tab, configure the parameters described in the following table, and then click Test Connection.
Parameter
Description
Example
Server Address
The connection endpoint of the authentication server.
139.129.X.X
Standby Server Address
Optional. The connection endpoint of the standby server. Leave this parameter empty if you do not have a standby server.
N/A
Port
The port of the server.
389
SSL
Select this option if an SSL certificate is installed on the LDAP authentication server.
N/A
Base DN
The user directory node on the server.
NoteImporting users may take a long time if the directory is large. We recommend that you limit the total number of users under this Base DN to 100,000 or fewer before importing.
ou=saasdun,ou=testgroup,dc=alitest,dc=com
Account
The account to connect to the authentication server.
cn=admin,dc=alitest,dc=com
Password
The password for the account.
N/A
Filter
A condition that refines query results when you search for users on the server.
(&(objectClass=person))
Logon Name Attribute
Specifies the attribute on the LDAP server that corresponds to the logon name for authentication. The default value is
uid.N/A
Interval for Automatic Creation of User Snapshots
The interval, in hours, at which Bastionhost automatically synchronizes the user list from the authentication server to a local snapshot. Valid values are 0 or an integer from 4 to 168. A value of 0 disables automatic synchronization.
12
Synchronize Display Name
Specify the attribute on the remote server that represents the display name, such as
fullName. If you leave this empty, Bastionhost uses the default attributecn. Deselect the checkbox to disable synchronization for this attribute.NoteBastionhost authenticates users based on their logon names, not their display names. By default, the
uidattribute from the remote server synchronizes as the logon name.N/A
Email Address to Be Synchronized
Specify the attribute on the remote server that represents the email address, such as
mail. If you leave this empty, Bastionhost uses the default attributemail. Deselect the checkbox to disable synchronization for this attribute.N/A
Mobile Phone Number to Be Synchronized
Specify the attribute on the remote server that represents the mobile phone number, such as
mobile. If you leave this empty, Bastionhost uses the default attributemobile. Deselect the checkbox to disable synchronization for this attribute.N/A
After the connectivity test passes, click Save.
To remove the LDAP authentication configuration, click Clear Settings.
WarningClearing the configuration removes all synchronized LDAP users. Proceed with caution.
To automatically synchronize LDAP user snapshots, click Create User Snapshots for an immediate sync, or set the Interval for Automatic Creation of User Snapshots to schedule periodic synchronization. Bastionhost reads data from the local snapshot when importing LDAP users to reduce performance overhead.