Introduction

You can set up access to PhixFlow either through PhixFlow Users, by integrating with your Active Directory infrastructure, or both. If you integrate with Active Directory, Access Control is maintained by mapping Active Directory Groups to PhixFlow User Groups, as described below. By using the Active Directory integration users will login to PhixFlow using the same username and password as their Microsoft Windows domain login.This page describes how to integrate PhixFlow with Active Directory:

Configuring PhixFlow with Active Directory has a number of steps

1. Configure an authentication provider - this defines how to connect to an Active Directory domain
2. Add the authentication provider to the authentication manager
3. Define the external login group - this defines the external group needed to login
4. Map external groups to PhixFlow's User Groups - on login PhixFlow maps the user's external groups to PhixFlow's user groups to determine what the user is allowed to do in the particular PhixFlow instance

Contents

Configure

Authentication Provider

Connection details to the domain servers are configured in the file phixflow-login.xml, under [tomcat root]/webapps/phixflow/WEB-INF/classes. When you first install PhixFlow, you probably created a copy of this file by simply copying the example file phixflow-login.xml.example (see Install PhixFlow Webapp).

First you must define one or more authentication providers, then add them to the authentication manager.

Create

an AuthProvider

Find this part of the file:

        	<!-- TemplateActive of a authentication-provider Directory AuthProvider-->
        	
	<!--
		You must provided one AuthProvider bean for each domain <security:authentication-provider ref="exampleActiveDirectoryAuthProvider" /> 
        -->

For example, if this domain will be referred to as corporate, update this to (remembering to remove the surrounding comment):

        <!-- Template of a authentication-provider -->
        <security:authentication-provider ref="corporate" /> 

Add connection details

Simple connection

The simplest type of connection is illustrated below, referencing a single AD server.

Update the section in the example file:

    <!-- Template of ato which you want to connect, 
		each based on one of the examples below, and add it to the authenticationManager above
	-->

	<!-- Example bean providing domain and url to authentication-provider -->
    	<!-- 
   	<bean id="exampleActiveDirectoryAuthProvider" parent="activeDirectoryAuthProvider">
        		<constructor-arg index="0" value="narnia.local" />
        		<constructor-arg index="1" value="ldap://192.168.150.81" />
    	</bean>
    	-->

to include connection details to the domain. For example, if the domain is called corporate.local and this is manged by the domain controller at 10.23.109.45, update this to (remembering to remove the surrounding comment)Then uncomment and edit one of the example activeDirectoryAuthProvider beans to reflect your active directory configuration.

Simple connection

The simplest configuration, for the domain mydomain.com and the domain controller at a specific IP address, is illustrated below:

    <!-- Template of a bean providing domain and url to authentication-provider for mydomain.com -->
    <bean id="corporatemydomainAuthProvider" parent="activeDirectoryAuthProvider">
        <constructor-arg index="0" value="corporatemydomain.localcom" />
        <constructor-arg index="1" value="ldapldaps://10192.23168.1091.451" />
    </bean>

Advanced options

For the connection you can also specify:

<constructor-arg index="1" value="ldapldaps://ad1.example.com ldap://ad2.example.com" />

<constructor-arg index="2" value="ou=User Accounts,ou=Operations,dc=emea,dc=example,dc=com" />

<property name="timeout" value="5000"/>

The following example, in phixflow-login.xml.example, illustrates the application of all advanced options:

    <!-- Template of a bean providing domain, multiple servers, connection timeout and separate rootDn -->
    <!--
		<bean id="exampleActiveDirectoryAuthProvider" parent="activeDirectoryAuthProvider">
            <constructor-arg index="0" value="example.com" />
            <constructor-arg index="1" value="ldap://ad1.example.com ldap://ad2.example.com" />
            <constructor-arg index="2" value="ou=User Accounts,ou=Operations,dc=emea,dc=example,dc=com" />
            <property name="timeout" value="5000"/>
		</bean>
    -->

Configure the authentication manager

Now add the auth provider you have just defined to the authenticationProvider.

The authenticationProvider should look something like this (omitting comments):

	<security:authentication-manager alias="authenticationManager">
		<security:authentication-provider ref="localAuthProvider" />
		<security:authentication-provider ref="exampleActiveDirectoryAuthProvider" />
	</security:authentication-manager>

We recommend that you do not remove the localAuthProvider, and that you retain a local administrator user so that you can still login in the event of a problem with the active directory integration.

Configure Group mappings