Configure phixflow-domains.xml
Connection details to the domain servers are configured in the file phixflow-domains.xml, under [tomcat root]/webapps/phixflow/WEB-INF/classes. When you first install PhixFlow, you probably created a copy of this file by simply copying the example file phixflow-domains.xml.example (see PhixFlow Server Installation).
Create domain reference
To create a reference to a domain, update the section in the example file:
| Code Block | ||
|---|---|---|
| ||
<!-- Template of a authentication-provider -->
<!--
<security:authentication-provider ref="exampleActiveDirectoryAuthProvider" />
--> |
For example, if this domain will be referred to as corporate, update this to (remembering to remove the surrounding comment):
| Code Block | ||
|---|---|---|
| ||
<!-- Template of a authentication-provider -->
<security:authentication-provider ref="corporate" /> |
Add connection details
Simple connection
The simplest type of connection is illustrated below, referencing a single AD server.
Update the section in the example file:
| Code Block | ||
|---|---|---|
| ||
<!-- Template of a bean providing domain and url to authentication-provider -->
<!--
<bean id="exampleActiveDirectoryAuthProvider" parent="activeDirectoryAuthProvider">
<constructor-arg index="0" value="narnia.local" />
<constructor-arg index="1" value="ldap://192.168.150.81" />
</bean>
--> |
to include connection details to the domain. For example, if the domain is called corporate.local and this is manged by the domain controller at 10.23.109.45, update this to (remembering to remove the surrounding comment):
| Code Block | ||
|---|---|---|
| ||
<!-- Template of a bean providing domain and url to authentication-provider -->
<bean id="corporate" parent="activeDirectoryAuthProvider">
<constructor-arg index="0" value="corporate.local" />
<constructor-arg index="1" value="ldap://10.23.109.45" />
</bean> |
Advanced options
For the connection you can also specify:
| Option | Purpose | Example |
|---|---|---|
| Multiple servers | Some domains are served by multiple servers, to provide resilience and load balancing. These can be specified in a list. PhixFlow will try each of these in turn. | <constructor-arg index="1" value="ldap://ad1.example.com ldap://ad2.example.com" /> |
| Root DN | If you have a large AD tree, searches may take some time, and this could lead to slow authentication for users. Therefore it is possible to specify a root DN (Distinguished name) at which PhixFlow will begin searching for the user. The Distinguished Name format is standard and further details can be found on the web. | <constructor-arg index="2" value="ou=User Accounts,ou=Operations,dc=emea,dc=example,dc=com" /> |
| Timeout | You can specify a timeout. For each server specified, if the server does not respond within the limit specified by the timeout, it will try the next server. If the last server in the list times out, then the authentication will fail. The timeout is specified in milliseconds. | <property name="timeout" value="5000"/> |
The following example, in phixflow-domains.xml.example, illustrates the application of all advanced options:
| Code Block |
|---|
<!-- Template of a bean providing domain, multiple servers, connection timeout and separate rootDn -->
<!--
<bean id="exampleActiveDirectoryAuthProvider" parent="activeDirectoryAuthProvider">
<constructor-arg index="0" value="example.com" />
<constructor-arg index="1" value="ldap://ad1.example.com ldap://ad2.example.com" />
<constructor-arg index="2" value="ou=User Accounts,ou=Operations,dc=emea,dc=example,dc=com" />
<property name="timeout" value="5000"/>
</bean>
--> |
...