Configuring LDAP or Active directory for certificate-based authentication

Log in to the system as npadmin using the system's IP address or FQDN. For example:

$ ssh npadmin@10.1.0.1

Or,

$ ssh npadmin@exampleFQDN

Enter privileged mode:

npadmin@hostname > enable

Enter the admin password.

[sudo] password for npadmin: <password>

Enter configuration mode:

npadmin@hostname# configure system

Open the authentication configuration:

npadmin@hostname(config)# authentication
1: Authentication Method = pam
2: Configure Current Authentication Method
----------------------------------------
        
Q: Save changes and exit
C: Cancel changes and exit
        
Select which option you would like to change
using the index number:

Type 1 to open the authentication mechanism menu.

When you have selected PKI or PKI w/ LDAP or PKI w/ Active Directory as the authentication method, the following options appear in the CLI:

1: Authentication Method = pki or pki-ldap or pki-ad
2: Configure Current Authentication Method
3: Flush AD/LDAP passwd and group cache
----------------------------------------

Q: Save changes and exit
C: Cancel changes and exit

Select which option you would like to change
using the index number:

Press 2 to select Configure Current Authentication Method.

The PKI configuration menu is displayed on the CLI:

PKI Configuration:
1. Status = disabled
2. OCSP Verification URL = <none>
3. Certificate Revocation List = <none>
4. Appliance Certificate = <none>
5. Client CA Certificate = <provided>
6. Delete Client CA Certificate
----------------------------------------
Q: Save changes and go to the next menu
C: Cancel changes and go to the next menu

Enter your choice:

Make changes to the following fields, as required:

1. Status: Type 1 CAC / PKI authentication status which can be set to disabled (selected by default), enabled, and optional. Check how to enable or disable CAC/PIV for certificate authentication and logging in to the Web UI with certificate authentication for details.

   Important

   You must upload a CA certificate to the appliance under the transfer folder before enabling Status.

2. OCSP Verification URL: Type 2 to set the URL of the OCSP server used to verify the revocation status of certificates in real time. If the certificate is part of the revocation list, it will be blocked. See how to add OCSP Verification URL for details.

3. Certificate Revocation List: A Certificate Revocation List (CRL) is a file maintained locally that lists revoked digital certificates to allow for their offline validation.

   To work on the CRL, type 3 and press Enter. Configure the fields in the following order. Enter Q to save the changes and exit the CRL configuration menu and return to PKI authentication configuration menu, or C to cancel.

   1. Upload CRL file: Type 3 to upload a local CRL file.

   2. CRL Retrieval URL: Type 1 to enter the URL of the direct path to the certificate file for file updates.

   3. CRL Retrieval interval: Type 2 to configure a CRL retrieval interval (in hours).

   4. View CRL contents / Delete CRL file: Type 4 to review the configured CRL contents or type 5 if you want to delete a CRL file.

4. Appliance Certificate: On the PKI authentication configuration menu, type 4 to set the SSL/TLS certificate used by the appliance for secure communication.

5. Client CA Certificate: To define the trusted CA for client certificate validation, type 5 in the PKI authentication menu and provide the certificate's filename, such as ca-chain.pem.

6. Delete Client CA Certificate: On the PKI authentication configuration menu, type 6 if you want to remove the stored client CA certificate from the appliance. Type Y to confirm.

7. Enter Q to save the configuration changes. 

   You will be redirected to the LDAP authentication configuration menu. Configure the following fields-

   1. LDAP or AD Server(s): Type 1 to enter hostname (FQDN) or IP address of the Active Directory/LDAP server(s) to connect to. For IP address, you can provide space-separated list of servers in <IP address><port> format.

   2. Base DN: Type 2 to set the Root Distinguished Name (DN) in the LDAP directory tree under which user and group searches begin. You can mention nodes within the directory as required, such as CN=common name, OU=organization unit, DC=domain controller, C=country, and O=organization. Press Enter.

   3. Bind DN: Type 3 to set the Distinguished Name of the service account used to bind to the server and authenticate LDAP queries (for example, CN=common name, OU=organization unit, DC=domain name). Press Enter.

   4. Bind Password: Type 4 to enter the password for the Bind DN account used in LDAP authentication. Press Enter.

   5. Base Password: Type 5 to enter the default password applied to the base DN account.

   6. Base Group: Type 6 to specify the default or root LDAP/ AD group which it tells the system where in the directory tree to search for group objects (for example, [DC=testad, DC=eng, DC=trellix, DC=com]). Press Enter.

   7. LDAP/AD UIAPI Group: Type 7 to specify the LDAP or AD group granting access to application UI or API interfaces. Press Enter.

   8. LDAP/AD Sudo Group: Type 8 to specify LDAP or AD group whose members are granted sudo/root privileges.

   9. LDAP/AD SSH Group: Type 9 to specify the LDAP or AD group authorized for SSH login access.

   10. LDAP Domain SID: Type 10 to enter Security Identifier (SID) of the LDAP or AD domain used for identity mapping.

   11. LDAP USE SSL: Type 11 to enable LDAPS (LDAP over SSL/TLS) for secure connections on port 636. It is set to false (0) by default. Type 1 to enable it and press Enter.

   12. LDAP USE STARTTLS: Type 12 if you want to upgrade a plain LDAP connection to a secure TLS session to communicate with the server. It is set to false (0) by default. Type 1 to enable it and press Enter.

   13. Ignore Constraints: Enabling this instructs the device to not check that certificates have the appropriate ExtKeyUsage attributes for TLS auth. Type 13 and enter true to enable it. Press Enter.

   14. Enable LDAP Group Traversal: Type 14 if you want to Enable LDAP queries to search through the nested LDAP groups to find users/groups. It is set to false (0) by default. Type 1 to enable it and press Enter.

   15. Certificate Identity Field: Type 15 to specify which field from the X.509 certificate is used to identify the user (such as x509-cert-subject, x509-cert-san-email, 509-cert-subject-cn etc.) See Configuring the user attributes for certificate authentication for more details.

   16. Certificate-to-LDAP Mapping Attribute: Type 16 to define the LDAP attribute (for example, CN) that the Certificate Identity Field is matched against for user lookup.

   17. LDAP Username Attribute: Type 17 to specify the LDAP attribute (that is, sAMAccountName) used as the user’s login name during authentication.

   After the configuration, it might look like the following:

   1: LDAP Server(s) = 10.x.x.x:3xx
   2: Base DN = CN=Users,DC=piblr,DC=quality
   3: Bind DN = CN=administrator,CN=Users,DC=piblr,DC=quality
   4: Bind Password = **********
   5: Base Password = **********
   6: Base Group = CN=Users,DC=piblr,DC=qa
   7: LDAP/AD UIAPI Group = uiapigrp
   8: LDAP/AD Sudo Group = sudogrp
   9: LDAP/AD SSH Group = sshgrp
   10: LDAP Domain SID = None
   11: LDAP USE SSL = False
   12: LDAP USE STARTTLS = False
   13: Ignore Constraints = false
   14: Enable LDAP Group Traversal = True
   15: Certificate Identity Field = x509-cert-subject-cn
   16: Certificate-to-LDAP Mapping Attribute = cn
   17: LDAP Username Attribute = sAMAccountName

8. When done, enter Q to save the configuration changes.