Last updated on May 11, 2017

AD/LDAP authentication

This article provides the instructions to configure Active Directory or LDAP for single, and multiple domains. Note that this configuration is portal-wide and affects all tenants (accounts) within Appspace.


Prerequisites

Important

This feature has been designed to work with a flat Active Directory structure.

  • Appspace user credentials with Portal Administrator role.
  • Active Directory enabled with Administrator-level credentials.

Configuring Active Directory Authentication

Important

You MUST setup the Active Directory in your server with an Administrator-level account BEFORE going through this authentication process.

  1. From the Appspace menu, select System > Configuration.

  2. Click the Authentication tab and choose AD Authentication from the drop-down menu. To add a Domain click on the Add button.


  3. Optionally, you may enable Pass-through Authentication, by checking the Enable option, and entering the e-mail domain.

    Note

    Pass-through authentication enables you to utilize an external IdP so that your users can access channels through the Appspace App without using Premium User IDs.

  4. Complete the relevant details in the AD Authentication Parameters section, including Server Address, Port, Username, Password, Default Account and Base DN. Click on Validate Connection to verify connection is successful to the AD.

    Warning

    Please create an Administrator-level account (in this case, Superuser) in your Active Directory BEFORE proceeding with this step to avoid Appspace system lock-outs. This user will replace the default portal administrator.


    Important

    The credentials shown in the screenshot are provided only as an example. For more information on obtaining Active Directory credentials, please consult your organization’s IT Department or personnel.

    • Requires the full CN name of users
    • Ports: 389 (Non-SSL) / 636 (SSL)
    • Server Address: The AD server’s IP should never be used when deploying with SSL
    • Authentication Type: FastBind (Case sensitive)

  5. To validate the configuration fill in the Text Field box with the username of any user that belongs to the Domain and click Submit. A successful validation will display a property table of the user.

    Note

    If validation fails please ensure that the username belongs to a user that belongs to the Domain in question and also confirm the AD configurations are populated correctly.

  6. Once connection is validated proceed to the Property Mapping section to map the Source Property of the user to the Target Property available from the drop down list. You can also set the Automatic User Creation to Enable or Disable.

    Sample default values:

    • FirstName: givenname
    • LastName: sn
    • Email: mail
    • Username: samaccountname

    The Enable option will allow users who do not have an existing Appspace login to log in and it will automatically create a login for the user. Setting this option however disables the pass-through authentication.

    The Disable option will allow Administrator to manually Import users however Property mapping must be setup prior to this.


  7. Select Yes in the Confirmation dialog box.


  8. The ‘Appspace changes detected. Click Here to apply your settings’ status message will be displayed at the top of the page to notify that changes have been made to the Appspace server. Click the ‘Click Here’ to go to the Apply Configuration page.

  9. In Apply Configuration page, complete the Appspace installation server’s username and password credentials in the relevant sections and click Apply.

    Note

    In the event of an error message, please verify your authentication settings and credentials. Press the OK button to try again.

  10. Click Yes in the Confirmation dialog box.

    If all the details and credentials were entered correctly, allow a few moments of inactivity while the system restarts itself.

  11. Once Appspace has restarted, verify that the AD authentication has been processed by logging out of your Appspace account and logging in again using the AD username (Superuser) and password credentials.

  12. If Automatic Creation is enabled it will automatically create the user and upon successful creation user will be presented with the EULA. Click Accept to proceed.


Rolling Back Active Directory Authentication

In some deployments (such as an On-Premises installation), you may need to roll back AD Authentication and revert back to Appspace Authentication. The following guide explains the necessary steps to perform this task.

  1. On your Windows server computer, locate the Appspace installation folder. Browse to the MediaNetConfig folder (by default it is located at C:/Nexus/MediaNetFTP/FastNetV2/MediaNetConfig).


  2. Open the appspace.config file as a text file. Locate the key=”defaultAuthenticationProvider” line, and change the value to “NCSMySqlAuthenticationService” and save your changes.


  3. Open the command prompt, and key in ‘IISReset’ to reset your settings. You may now log in to Appspace using the default Appspace Authentication credentials.