ApsaraDB RDS:Connect RDS for PostgreSQL to a self-managed domain

How it works

When a user connects to the RDS instance, the instance forwards the authentication request to the AD domain controller over Lightweight Directory Access Protocol (LDAP). The domain controller verifies the user's credentials and returns the result. If AD authentication is enabled for the connection, the AD domain controller manages password verification. If AD is not in use for a given connection, ApsaraDB RDS falls back to its own password verification.

The RDS instance and the AD domain controller communicate exclusively over the private network. Both must reside in the same virtual private cloud (VPC).

Prerequisites

Before you begin, ensure that you have:

• An ApsaraDB RDS for PostgreSQL instance running PostgreSQL 10 or later, minor engine version 20210228 or later, and using cloud disks. To update the minor engine version, see Update the minor engine version of an ApsaraDB RDS for PostgreSQL instance

• An ECS instance in the same VPC as the RDS instance, running Windows Server 2016 or later

• The ECS security group configured to allow inbound traffic from the private IP address of the RDS instance. See Add a security group rule. If the ECS firewall is enabled, configure it to allow the same traffic (the firewall is disabled by default)

• A domain account that belongs to the Domain Admins group

• Access to the ApsaraDB RDS console

Step 1: Set up the AD domain controller on ECS

The AD domain controller must run Windows Server. This guide uses Windows Server 2016 as an example.

1. Log in to the ECS instance and open Server Manager.

2. In the left-side navigation pane, click Dashboard, then click Add roles and features.

   

3. In the Add Roles and Features Wizard, configure each tab as follows:

   The ECS instance must have a static IP address. A dynamic IP address causes the DNS server to become unavailable.

   Tab	Setting
   Before You Begin	Use the default settings.
   Installation Type	Use the default settings.
   Server Selection	Use the default settings.
   Server Roles	Select Active Directory Domain Services, then click Add Features in the dialog box. Select DNS Server, then click Add Features.
   Features	Use the default settings.
   AD DS	Use the default settings.
   DNS Server	Use the default settings.
   Install	Click Install.

4. After installation completes, click Close.

5. In the left-side navigation pane, click AD DS. In the upper-right corner, click More.

   

6. In the All Servers Task Details and Notifications panel, click Promote this server to a domain controller.

   

7. In the Active Directory Domain Services Configuration Wizard, configure the following:

   Tab	Setting
   Deployment Configuration	Select Add a new forest and set the Root domain name. This example uses pgsqldomain.net (pgsqldomain is the prefix, net is the suffix). Use the same root domain name throughout the configuration.
   Domain Controller Options	Set a Directory Services Restore Mode (DSRM) password.
   Server Selection	Clear Create DNS delegation.
   Additional Options, Paths, Review Options	Use the default settings.
   Prerequisites Check	Click Install.

8. After the ECS instance restarts as an AD domain controller, log back in before proceeding to the next step.

Step 2: Add users to the AD domain controller

You need two types of AD users: an administrator user (used by LDAP to bind to the directory) and a standard user (used to log in to the RDS instance).

Step 3: Configure security group rules for ECS

The AD domain controller requires several ports to be open. Use a dedicated security group for the domain controller rather than sharing it with other ECS instances.

1. Log in to the ECS console and go to Instances & Images > Instances.

2. In the top navigation bar, select the region of the ECS instance.

3. Click the ECS instance ID, then click Security Groups in the left-side navigation pane.

4. Click Add Rules in the Actions column.

5. On the Inbound tab, click Add Rule to allow the RDS instance to reach the ECS instance on the following ports:

   Protocol	Port	Service
   TCP	88	Kerberos authentication
   TCP	135	RPC
   TCP/UDP	389	LDAP
   TCP	445	CIFS
   TCP	3268	Global Catalog
   TCP/UDP	53	DNS
   TCP	49152–65535	Default dynamic port range (enter as 49152/65535)

Step 4: Configure the RDS instance

Step 5: Test the connection

Connect to the RDS instance using the psql command-line tool. Use the AD standard user's credentials, not the RDS account password.

psql -h <RDS instance endpoint> -U ldapuser -p 5432 -d postgres

When prompted for a password, enter the AD password for ldapuser (not the RDS account password).

Install the PostgreSQL client before using psql. For other connection methods, see Connect to an ApsaraDB RDS for PostgreSQL instance.

Import AD domain service records in bulk (optional)

To configure multiple AD domain service records at once, use the bulk import feature.

Import modes:

• Overwrite existing service information — replaces all current records.

• Additional service information (highest priority) — inserts the new records at the beginning, giving them higher priority than existing records.

• Additional service information (lowest priority) — appends the new records at the end, giving them lower priority than existing records.

Required format:

TYPE|DATABASE|USER1|ADDRESS|MASK|METHOD|OPTION

Sample record:

host|all|ldapuser|0.0.0.0/0||ldap|ldapserver=<ECS private IP> ldapbasedn="CN=Users,DC=pgsqldomain,DC=net" ldapbinddn="CN=<AD administrator username>,CN=Users,DC=pgsqldomain,DC=net" ldapbindpasswd="<AD administrator password>" ldapsearchattribute="sAMAccountName"

Enter the records in the Edit AD domain text box, then select an import mode and submit.

View AD domain service edit history

1. In the RDS console, click the instance ID, then go to Accounts > AD Domain Services Edit History.

2. Click changedetails in the Actions column to view the change details. If a modification failed, the status shows Not Taking Effect. Click Change log to see the error message.

   

What's next

• Configure SSL encryption for an ApsaraDB RDS for PostgreSQL instance

• Introduction to the pg_hba.conf file