ApsaraDB RDS:Connect RDS for PostgreSQL to an AD domain

Prerequisites

• Your RDS instance meets the following requirements:

  • The RDS instance runs PostgreSQL 10 or later.

  • The RDS instance runs a minor engine version of 20210228 or later. For more information about how to update the minor engine version of your RDS instance, see Update the minor engine version of an ApsaraDB RDS for PostgreSQL instance.

  • The RDS instance uses cloud disks.

• An ECS instance is created. For more information, see Create an ECS instance. Your RDS instance must access the self-managed AD domain by using a private IP address. Therefore, the ECS instance must meet the following conditions:

  • The ECS instance and your RDS instance reside in the same virtual private cloud (VPC).

  • The security group to which the ECS instance belongs is configured to allow access from the private IP address of your RDS instance. For more information, see Add a security group rule.

  • The firewall of the ECS instance is disabled by default. If the firewall is enabled for the ECS instance, you must configure the firewall to allow access from the private IP address of your RDS instance.

  • The image of the ECS instance runs Windows Server 2016 or later.

• The domain account belongs to the Domain Admins group.

• Your Alibaba Cloud account is used to log on to the ApsaraDB RDS console.

Procedure

1. Configure an AD domain controller for the ECS instance.

   1. Log on to the ECS instance.

      Note

      The AD domain controller must run a Windows Server system. We recommend that you use Windows Server 2016 or later. In this example, the AD domain controller runs Windows Server 2016.

   2. Search for and open Server Manager.

   3. On the Dashboard, click Add roles and features.

   4. In the Add Roles and Features Wizard, configure the following settings.

      Tab	Description
      Before You Begin	Use the default settings.
      Installation type	Use the default settings.
      Server selection	Use the default settings.
      Server roles	Select Active Directory Domain Services. In the dialog box that appears, click Add Features. Select DNS Server. In the dialog box that appears, click Add Features. Note Make sure that your computer uses a fixed IP address. If the IP address dynamically changes, the DNS server becomes unavailable.
      Feature	Use the default settings.
      AD DS	Use the default settings.
      DNS Server	Use the default settings.
      OK	Click Install to start the installation.

   5. After the installation is complete, click Close.

   6. In the left navigation pane of Server Manager, click AD DS, and then click More in the upper-right corner.

   7. In the All Servers Task Details and Notifications window, click Promote this server to a domain controller.

   8. In the Active Directory Domain Services Configuration Wizard, configure the following settings.

      Tab	Description
      Deployment configuration	Select Add a new forest and set the Root domain name. Note In this example, the Root domain name ispgsqldomain.net, wherepgsqldomain is the domain prefix andnet is the domain suffix. You can customize both values. Make sure to use your custom values consistently in the subsequent steps.
      Domain controller options	Set both the Forest functional level and Domain functional level to Windows Server 2016. Select the Domain Name System (DNS) server and Global Catalog (GC) checkboxes. In the Type the Directory Services Restore Mode (DSRM) password section, set and confirm the password, and then click Next.
      DNS options	On the DNS Options page, clear the Create DNS delegation checkbox.
      Additional options	Use the default settings.
      Paths	Use the default settings.
      Review options	Use the default settings.
      Prerequisites check	Click Install to begin the service installation.

      Note

      After the ECS instance is promoted to an AD domain controller, you must restart the ECS instance. Then, you can perform the subsequent steps.

2. Add an administrator user to the AD domain controller.

   1. Remotely log in to the ECS instance, then search for and open Server Manager.

   2. In the left navigation pane of Server Manager, click AD DS. Then, right-click the target domain controller on the right, and select Active Directory Users and Computers.

   3. Right-click pgsqldomain.net > Users and choose New > User.

      Note

      pgsqldomain.net is the root domain name you set in the Active Directory Domain Services Configuration Wizard. Select the name based on your actual configuration.

   4. Set the logon name for the user and click Next. For Full name and User logon name, enter dbadmin and select @pgsqldomain.net from the drop-down list.

   5. Set the password, select the Password never expires checkbox, and then click Next and Done.

   6. Double-click the newly created user to add the user to the Domain Admins group. In the user properties dialog box, select the Member Of tab, click Add, enter Domain Admins in the object names field, click Check Names to confirm, and then click OK.

3. Add a standard user to the AD domain controller for logon.

   Note

   The steps to add a standard user are the same as those for adding an administrator user. However, a standard user does not need to be added to the Domain Admins group.

   This topic uses a standard user named ldapuser as an example. This user is used to log on to the ApsaraDB RDS for PostgreSQL instance.

4. Configure security group rules for the ECS instance.

   1. Log on to the ECS console.

   2. In the left-side navigation pane, choose Instances & Images > Instance.

   3. In the top navigation bar, select the region in which the ECS instance resides.

   4. On the Instances page, click the ID of the target instance.

   5. On the Security Groups tab, click the Actions column of the target security group, click Manage Rules.

      Note

      A number of ports need to be enabled for the AD domain controller. We recommend that you configure a separate security group for the AD domain controller rather than configuring the AD domain controller in the same security group as other ECS instances.

   6. On the Inbound tab, click Add Rule to allow access to the ECS instance on the following ports.

      Protocol type	Port range	Description
      TCP	88	The port for the Kerberos authentication protocol.
      TCP	135	The port for the Remote Procedure Call (RPC) protocol.
      TCP/UDP	389	The port for the Lightweight Directory Access Protocol (LDAP).
      TCP	445	The port for the Common Internet File System (CIFS) protocol.
      TCP	3268	The port for Global Catalog.
      TCP/UDP	53	The port for the DNS service.
      TCP	49152 to 65535	The default dynamic port range for connections. Enter a value in the following format: 49152/65535.

5. Configure the RDS instance

   1. Log on to the ApsaraDB RDS console and go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

   2. Create a user account named ldapuser. For more information, see Create an account. After the account is created, you can confirm in the account list that the account type for ldapuser is standard account.

      Note

      The account name created in the ApsaraDB RDS console must match the standard account name created in the AD domain. The passwords can be different. When AD domain authentication is enabled, the system verifies the password of the corresponding account in the AD domain controller. When AD domain authentication is disabled, the system verifies the user password set on the Accounts page in the ApsaraDB RDS console.

   3. In the left-side navigation pane, click Accounts and select the AD Domain Services tab.

      When you open the AD Domain Services tab for the first time, the system has created the following two default records:

      host    all            all    0.0.0.0/0    md5
      host    replication    all    0.0.0.0/0    md5

      You can delete or modify the records.

   4. Click Edit next to the first default record and fill in the following parameter values.

      Note

      The following table describes only the parameters that are used in the provided example. For more information, see Official documentation of PostgreSQL.

      Parameter	Example	Description
      Priority	0	The priority of the record. If you set this parameter to 0, the record has the highest priority and is automatically generated. Modify the first record and set this parameter to 0. The value 0 specifies the highest priority for the AD domain service.
      Type	host	Valid values: host: The record matches TCP/IP connections, including SSL connections and non-SSL connections. hostssl: The record matches only TCP/IP connections that are established over SSL. Note This parameter takes effect only when SSL encryption is enabled for your RDS instance. For more information, see Configure SSL encryption for an ApsaraDB RDS for PostgreSQL instance. hostnossl: The AD domain verifies only TCP/IP connections that are established over non-SSL connections.
      Database	all	The database that the specified users are allowed to access. If the value of this parameter is all, the specified users are allowed to access all databases of your RDS instance. If you specify multiple entries, separate the entries with commas (,).
      User	ldapuser	The user that is allowed to access your RDS instance. Valid values: the created usernames of the AD domain controller. If you specify multiple entries, separate the entries with commas (,). Note This parameter can be set only to the usernames of standard users that are created in the AD domain.
      Address	0.0.0.0/0	The IP addresses from which the specified users can access the specified databases. If you set this parameter to 0.0.0.0/0, the specified users are allowed to access the specified databases from all IP addresses.
      Mask	None	The mask for the IP address in the record. If the value of the ADDRESS parameter is an IP address, you can use this parameter to specify the mask of the IP address.
      Method	ldap Note LDAP is a protocol that is used to access the directories of databases. In this topic, LDAP is used as an example.	This parameter specifies the authentication method of LDAP. Valid values: trust reject scram-sha-256 md5 password gss sspi ldap radius cert pam Note The valid values of this parameter must be in lowercase letters.
      Option	ldapserver=<Private IP address of the ECS instance> ldapbasedn="CN=Users,DC=Prefix of the root domain name, pgsqldomain in this example,DC=Suffix of the root domain name, net in this example" ldapbinddn="CN=<Username of the administrator user of the AD domain>,CN=Users,DC=Prefix of the root domain name, pgsqldomain in this example,DC=Suffix of the root domain name, net in this example" ldapbindpasswd="<Password of the administrator user of the AD domain>" ldapsearchattribute="sAMAccountName"	The options of the authentication method. In this topic, LDAP is used as an example. You must specify this parameter. For more information, see Authentication Methods.

   5. Click Add next to the newly configured AD domain service record to add the following record.

      host    all            all    0.0.0.0/0    md5

   6. After you enter the information, click OK, and then click Submit.

      Note

      After you submit the changes, the instance status changes to Maintaining Instance for about one minute. The new configuration applies only to new connections. Existing connections must be re-established for the changes to take effect.

6. (Optional) In addition to manually adding AD domain service configurations, ApsaraDB RDS for PostgreSQL supports importing configurations in bulk. In the Import AD Domain Service Information dialog box, select an import mode: Overwrite existing service information, Append service information (highest priority), or Append service information (lowest priority). In the Edit AD domain text area, enter the AD domain service information in the format TYPE|DATABASE|USER|ADDRESS|MASK|METHOD|OPTION, separate multiple usernames with commas (,), and then click OK.

   The following import methods are supported:

   • Overwrite existing service information.

   • Additional service information (highest priority): If you select this option, the service information of the AD domain is appended to the beginning of the existing service information. The priority of the appended information is higher than the priority of the existing service information.

   • Additional service information (lowest priority): If you select this option, the service information of the AD domain is appended to the end of the existing service information. The priority of the appended information is lower than the priority of the existing service information.

   Valid format:

   TYPE|DATABASE|USER1|ADDRESS|MASK|METHOD|OPTION

   In the Edit AD domain text box, enter the service information that you want to import in the specified order. For parameter descriptions, see the table in the previous step.

   Sample configuration:

   host|all|<standard_username_in_ad_domain>|0.0.0.0/0||ldap|ldapserver=<private_ip_address_of_ecs_instance> ldapbasedn="CN=Users,DC=<root_domain_prefix, e.g., pgsqldomain>,DC=<root_domain_suffix, e.g., net>" ldapbinddn="CN=<admin_username_in_ad_domain>,CN=Users,DC=<root_domain_prefix, e.g., pgsqldomain>,DC=<root_domain_suffix, e.g., net>" ldapbindpasswd="<admin_user_password_in_ad_domain>" ldapsearchattribute="sAMAccountName"

7. Test the connectivity.

   Use a PostgreSQL command-line tool to connect to your RDS instance.

   Note

   You can connect to your RDS instance by using multiple methods. In this topic, a PostgreSQL command-line tool is used. You must install the PostgreSQL client before you use the PostgreSQL command-line tool. For more information, see Connect to an ApsaraDB RDS for PostgreSQL instance.

   Run the following command and use the username and password of the standard account of the AD domain controller to connect to your RDS instance:

   psql -h <instance_endpoint> -U <standard_username_in_ad_domain> -p 5432 -d postgres

View the modification history of AD domain service information

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Accounts and select the AD Domain Services Edit History tab.

3. In the Actions column, you can view the changedetails. If a modification fails, the status is displayed as failed. You can click Change log to view the error message. The Actions column also provides a Restore option to roll back the AD domain configuration to the state before the change was made.