Skip to content

Import Users from LDAP or AD

Connect MetaMiner to an LDAP directory or Active Directory, import user accounts, and let those users sign in with their directory password.

Before you begin

  • A directory account that can search for user entries (the bind account), and its distinguished name (DN).
  • The directory host name, port and base DN.
  • For LDAPS: the directory certificate must be issued by a CA that the MetaMiner Server trusts, and its name must match the host name you enter.
  • Run the MetaMiner Administrator (MMA) on the MetaMiner Server host.

How it works

  • MetaMiner does not synchronize the directory. You import the users you want, and each becomes a MetaMiner user marked LDAP/Active Directory User.
  • At sign-in, MetaMiner searches the directory for the user name (attribute sAMAccountName or uid) with the bind account, then binds as the user with the password entered. The password is not stored in MetaMiner.
  • Password rules, expiry and lockout for directory users are enforced by the directory. MetaMiner's own failure threshold and Disabled flag still apply.
  • Imported users get No Access in every environment until you assign roles.

Steps

Configure the directory connection

  1. In MMA, click Preferences > Settings... and open the System page.

  2. In Directory Services Configuration, fill in the fields:

    Field What to enter
    Directory Authentication Enabled Tick to let directory users sign in with their directory password
    SSL Tick to use LDAPS. Recommended
    LDAP Server Host name of the directory server. Use the name on its certificate when SSL is on
    LDAP Port 389 for LDAP, 636 for LDAPS
    Authentication Method simple for most directories. Also available: DIGEST-MD5, GSSAPI, none
    Base DN The DN under which users are found, for example dc=example,dc=com
    User DN The DN of the bind account, for example cn=svc-metaminer,ou=Service,dc=example,dc=com
    Password The bind account password. Stored encrypted
    User Search Base Optional. A narrower DN to search for users. Empty uses the Base DN

  3. Click Test Connection. The status shows LDAP Connection Successful.

  4. Click OK and restart the MetaMiner Server when MMA offers it.

Image of Preferences > Settings > System with Directory Services Configuration filled in and SSL ticked

../images/security/mma-settings-directory-services.png

TODO: confirm the Directory Type field is saved

The page shows Directory Type (Standard LDAP or Active Directory). Confirm whether the value is stored and used before documenting it.

Import users

  1. Click Security > Define Users....
  2. Click Import Directory Users. The dialog lists up to 100 users.
  3. Type part of a name in Search users and click Search to find specific users.
  4. Tick the users to import, or click Select All.
  5. Click Import Selected. MetaMiner confirms that the users were imported.
  6. Assign a role to each imported user per environment. See Users and Roles.

Image of the Import Directory Users dialog with a search term, results list and two users ticked

../images/security/mma-import-directory-users.png

The import lists person accounts and leaves out computer accounts and common built-in and service accounts.

Verify

  1. Make sure MetaMiner Security is on. See User-Based Security.
  2. Connect with the MetaMiner Client as an imported user, using the directory password.

Troubleshooting

Test Connection fails with SSL ticked

Check that LDAP Server matches a name on the directory certificate and that the certificate's CA is in the Java trust store used by the MetaMiner Server. Check that port 636 is open from the MetaMiner Server host to the directory.

LDAP Not Configured when clicking Import Directory Users

Fill in and save Directory Services Configuration first.

A directory user cannot sign in

Check that Directory Authentication Enabled is ticked, that the user is ticked as LDAP/Active Directory User in MMA, and that the account is not disabled or locked in the directory. The MetaMiner Server log records the reason.

The search finds a user twice

Sign-in is refused when the user name matches more than one directory entry. Narrow User Search Base.

TODO: document where to add the directory CA for LDAPS

LDAPS uses the Java default trust store of the MetaMiner Server. Confirm the supported location under the install folder and whether it survives upgrades.

Next steps