This page is for PhixFlow administrators who want to integrate PhixFlow authentication with Active Directory via LDAP.

Overview

By using the Active Directory integration users will login to PhixFlow using the same username and password as their Microsoft Windows domain login.

Configuring PhixFlow with Active Directory has a number of steps.

1. Configure an authentication provider. This defines how to connect to an Active Directory domain.
2. Add the authentication provider to the authentication manager.
3. To manage user access to the items and data in PhixFlow:
   1. Define the external login group. This defines the external group needed to login.
   2. Map external groups to PhixFlow's User Groups. When the user logs in, PhixFlow maps the user's external groups to its own user groups. This determines what the user is allowed to do in the particular PhixFlow instance.

Configure phixflow-login.xml

Connection details to the domain servers are configured in the file phixflow-login.xml, under [tomcat root]/webapps/phixflow/WEB-INF/classes. When you first install PhixFlow, you probably created a copy of this file by simply copying the example file phixflow-login.xml.example (see Install the PhixFlow Webapp).

To configure this file for Active Directory login:

1. Configure an Active Directory authentication provider.
2. Add it to the authentication manager.
3. To manage access to items and data, configure external groups.
4. Configure one or more login forms to make the option to login using Active Directory visible to users.

Configure an Authentication Provider

Find this part of the file:

	<!-- Active Directory AuthProvider-->
	
	<!--
		You must provide one AuthProvider bean for each domain to which you want to connect, 
		each based on one of the examples below, and add it to the authenticationManager above
	-->

	<!-- Example bean providing domain and url to authentication-provider -->
	<!-- 
	<bean id="exampleActiveDirectoryAuthProvider" parent="activeDirectoryAuthProvider">
		<constructor-arg index="0" value="narnia.local" />
		<constructor-arg index="1" value="ldap://192.168.150.81" />
	</bean>
	-->

Then uncomment and edit one of the example activeDirectoryAuthProvider beans to reflect your active directory configuration.

Simple Connection

The simplest configuration, for the domain mydomain.com and the domain controller at a specific IP address, is illustrated below:

    <!-- authentication-provider for mydomain.com -->
    <bean id="mydomainAuthProvider" parent="activeDirectoryAuthProvider">
        <constructor-arg index="0" value="mydomain.com" />
        <constructor-arg index="1" value="ldaps://192.168.1.1" />
    </bean>

Advanced Options

For the connection you can also specify:

<constructor-arg index="1" value="ldaps://ad1.example.com ldap://ad2.example.com" />

<constructor-arg index="2" value="ou=User Accounts,ou=Operations,dc=emea,dc=example,dc=com" />

<property name="timeout" value="5000"/>

The following example, in phixflow-login.xml.example, illustrates the application of all advanced options:

    <!-- Template of a bean providing domain, multiple servers, connection timeout and separate rootDn -->
	<bean id="exampleActiveDirectoryAuthProvider" parent="activeDirectoryAuthProvider">
        <constructor-arg index="0" value="example.com" />
        <constructor-arg index="1" value="ldap://ad1.example.com ldap://ad2.example.com" />
        <constructor-arg index="2" value="ou=User Accounts,ou=Operations,dc=emea,dc=example,dc=com" />
        <property name="timeout" value="5000"/>
		<property name="authenticationOnly" value="false" />
	</bean>

Configure the Authentication Manager

Now add the authentication provider you have just defined to the authentication manager.

Find this section of the file:

	<security:authentication-manager alias="authenticationManager">
		<!-- test authentication provider, leave commented out -->
		<!-- <security:authentication-provider ref="testAuthProvider" /> -->

		<!-- local authentication provider - provide access for CenterView database users. Don't change it -->
		<security:authentication-provider ref="localAuthProvider" />

		<!-- Add an Active Directory Authentication Provider below this line; uncomment if using active directory integration -->
		<!-- <security:authentication-provider ref="exampleActiveDirectoryAuthProvider" /> -->

		<!-- Add SAML Authentication Provider; uncomment if using saml / single sign-on -->
		<!-- <security:authentication-provider ref="samlAuthProvider"/> -->
	</security:authentication-manager>

Edit it to include the new AuthProvider.

The authenticationManager should now look something like this (comments omitted):

	<security:authentication-manager alias="authenticationManager">
		<security:authentication-provider ref="localAuthProvider" />
		<security:authentication-provider ref="exampleActiveDirectoryAuthProvider" />
	</security:authentication-manager>

We recommend that you do not remove the localAuthProvider, and that you retain a local administrator user so that you can still login in the event of a problem with the active directory integration.

Configure Login Forms

Login forms define the login options (local, single sign-on, active directory) to be presented on the login screen when a user opens the PhixFlow URL. This mechanism allows you to define a default form tailored to regular users and one or more forms for advanced users.

Configure External Groups

System Configuration defines an external login group, which grants the right to login to that PhixFlow instance.

Each PhixFlow User Group can optionally have an external group. When a user successfully logs into PhixFlow via the AD LDAP integration, if any of the user's assigned AD groups match to external user group names defined in PhixFlow, they will be authorised as if they were in the PhixFlow users groups to which the external user groups have been added.

See Configure Groups for External Login for how to configure External Login groups.