User Authentication
The inspectIT Ocelot Configuration Server provides multiple options to do a user authentication. By default, the local user authentication is used.
Local User Authentication
By default, the configuration server uses an internal user management. When using this authentication mode, users and their credentials will be managed by the configuration server itself.
Administrators can add and modify users via the provided web UI.
In order to use the local user authentication the inspectit-config-server.security.ldap-authentication
property must be set to false
.
inspectit-config-server:
security:
ldap-authentication: false
LDAP User Authentication
The configuration server also supports user authentication via LDAP.
When using LDAP, users which are added using the local user authentication mode will not be available.
Furthermore, the HTTP APIs which are related to the user management (/api/v1/users
, /api/v1/account/password
) cannot be used.
In order to use LDAP for user authentication the inspectit-config-server.security.ldap-authentication
property must be set to true
.
The LDAP related configuration properties have to be specified using the property inspectit-config-server.security.ldap
.
The following configuration snippet shows an example LDAP configuration (this configuration was created for this LDAP server).
inspectit-config-server:
security:
ldap-authentication: true
ldap:
admin-group: "SHIP_CREW"
url: "ldap://localhost:389/"
base-dn: ""
manager-dn: "cn=admin,dc=planetexpress,dc=com"
manager-password: "GoodNewsEveryone"
user-search-base: "ou=people,dc=planetexpress,dc=com"
user-search-filter: "(uid={0})"
group-search-base: "ou=people,dc=planetexpress,dc=com"
group-search-filter: "(member={0})"
LDAP Configuration Properties
The following tables contains the required LDAP configuration properties including a description for each property.
Each property is located below the property inspectit-config-server.security.ldap
.
Property | Note |
---|---|
admin-group | The group to which a user must be assigned to gain administrator access. |
url | Url of the LDAP server. |
base-dn | Set the base suffix from which all operations should origin. |
manager-dn | Set the user distinguished name (principal) to use for getting authenticated contexts. |
manager-password | Set the password (credentials) to use for getting authenticated contexts. |
user-search-base | Search base for user searches. |
user-search-filter | The LDAP filter used to search for users. For example (uid={0}) . |
group-search-base | The search base for group membership searches. |
group-search-filter | The LDAP filter to search for groups. |
Access Log
By default, the server will log all authorized and unauthorized access attempts to secured endpoints. Access logging can be disabled using the following property:
inspectit-config-server:
security:
access-log: false