You can connect only to one Active Directory domain. To do so, you must configure a connection to the domain controller.
To configure a connection to an Active Directory domain controller:
<hostname or IP address of server>:<port>
.In case of server availability issues, you can specify multiple servers with domain controllers by separating them with commas. All of the specified servers must reside in the same domain.
When the startTLS method is used, first it establishes an unencrypted connection over port 389, then it sends an encryption request. If the STARTTLS command ends with an error, the connection is terminated.
Make sure that port 389 is open. Otherwise, a connection with the domain controller will be impossible.
When using LDAPS, an encrypted connection is immediately established over port 636.
When using an encrypted connection, it is impossible to specify an IP address as a URL.
If no certificate was previously added, the drop-down list shows No data.
The certificate will be uploaded and displayed in the Secret list.
If multiple addresses are indicated in the URL field, KUMA waits for the specified number of seconds for a response from the first server. If no response is received during that time, the application contacts the next server. If none of the indicated servers responds during the specified amount of time, the connection will be terminated with an error.
In the case when multiple groups are specified for a user in the same tenant, the role with the highest-level permissions is used, with additional roles, if additional roles are assigned.
Filter input example: CN=KUMA team,OU=Groups,OU=Clients,DC=test,DC=domain
.
A connection with the Active Directory domain controller is now configured.
You can also check the connection for the previously entered domain controller connection settings.
To check the connection to the domain controller:
If necessary, you can create a new secret by clicking the button or change the settings of an existing secret by clicking the
button.
The following formats for specifying a user are available in the User field: UserPrincipalName and domain\user.
After clicking the Test button, the system tests the connection with the domain and returns a notification with the test results. The system does not check if the users can log in or if the user group is configured correctly.
For domain authentication, add the groups for the KUMA user roles.
You can specify the groups only for the roles that require the configuration of domain authentication. You can leave the rest of the fields empty.
To add groups of user roles:
After you select the roles, a group filter field is displayed for each role. In the fields for each role, specify the DistinguishedName of the domain group. The users of this domain group must have the capability to perform authentication with their domain accounts. Group input example: CN=KUMA team,OU=Groups,OU=Clients,DC=test,DC=domain
.
You can define a separate set of role filters for each tenant.
If no filter is specified for a role, this means that conditions for creating an account through domain authentication are not specified for that role. Authentication with that role is impossible.
After the first authentication under a domain account, domain user cards are created for users in the Settings → Users section. For a domain user, the ability to change the main role (General administrator, Tenant administrator, Tier 2 analyst, Tier 1 analyst, Junior analyst) is blocked in the user card, while additional roles can be added or removed (Access to CII, Interaction with NCIRCC, Access to shared resources), including management of additional role assignment to tenants. Roles assigned in the Domain authorization section and roles assigned in the user card supplement each other. For the General administrator, additional roles in KUMA are automatically activated, therefore you do not need to add them separately. If the General administrator role was assigned to a domain user, and the General administrator role was subsequently revoked, additional roles must be reassigned in the user card in the Settings → Users section.
You can specify only one domain group for each role. If you want to specify multiple groups, you must repeat steps 2 to 4 for each group while specifying the same tenant.
The groups of user roles will be added. The defined settings will be applied the next time the user logs in to the KUMA web interface.
After the first authentication of the user, information about this user is displayed under Settings → Users. The Login and Password fields received from the domain cannot be edited. The user role will also be unavailable for editing. To edit a role, you will have to change the user role groups. Changes to a role are applied after the next authentication of the user. The user continues working under the current role until the current session expires.
If the user name or email address is changed in the domain account properties, these changes must be manually made in the KUMA account.
Page top