When your business uses Microsoft Active Directory (AD), you can integrate with your existing AD server to manage your users in this domain. This allows the administrators to control access to clusters and projects based on users and groups managed externally in the Active Directory, while allowing end users to authenticate with their AD credentials when signing in to EonKube.

Prerequisites

1. Set up an AD server.
2. Create or obtain from your AD administrator a new AD user to use as a service account for EonKube. This user must have sufficient permissions to perform searches and read attributes of users and groups under your AD domain. Usually a (non-admin) Domain User account can be used for this purpose. By default, such a user has read-only privileges for most objects in the domain.

Procedure

1. Go to EonKube > Admin > Management > Users & Authentication.
2. On the left navigation panel, click Auth Provider.
3. Click ActiveDirectory.
4. To configure an Active Directory server, specify the following settings:
   • Hostname/IP: Specify the hostname or IP address of your AD server.
   • Port: Specify the port at which the AD server is listening for connections. Unencrypted LDAP normally uses the standard port of 389, while LDAPS uses port 636.
   • (Optional) TLS: To use AD over SSL/TLS, click to enable this option.
   • Server Connection Timeout: The duration in number of milliseconds that EonKube waits before considering the AD server unreachable. The default is 5000 milliseconds.
5. To configure a service account, specify the following settings:
   • Service Account Distinguished Name: Specify an AD account with read-only access to your domain. Enter the username of an AD account with read-only access to your domain. The username can be entered in NetBIOS format (e.g. "DOMAIN\serviceaccount") or UPN format (e.g. "serviceaccount@domain.com").
   • Service Account Password: Enter the password.
   • Default Login Domain: Configure this field with a NetBIOS name. If the service account username does not contain a domain name, it will be automatically converted.
   • User Search Base: Specify the distinguished name of the node in your directory tree from which to start searching for user objects. All users must be descendants of this base DN. For example: "ou=user,dc=mycompany,dc=com".
   • (Optional) Group Search Base: If your groups live under a different node than the one configured under User Search Base, specify the Distinguished Name here. For example: "ou=groups,dc=acme,dc=com". Otherwise, leave it empty.
6. Go to the Customize Schema section. Specify a correct mapping of user and group attributes corresponding to the schema used in your directory. The attribute mappings are used to build search filters and resolve group membership.
7. Go to the Test and Enable Authentication section. Specify the username and password for the AD account that is mapped to the local principal account.
8. Click Authenticate with Active Directory.
9. Click Enable.
10. After the service is successfully enabled, configure the access control:
    • Allow any valid user: Any user that can be recognized in the authentication service can log in to EonKube.
    • Allow members of clusters and projects, plus authorized users & groups: Any user in the authentication service, or any group added as a Cluster Member or Project Member, can log in to EonKube. In addition, the users and groups that are added to the list of "Authorized Users and Groups" also have access.
    • Restrict access to only the authorized users & groups: Only the users and groups that are added to the list of "Authorized Users and Groups" in the authentication service can log in to EonKube.
11. Click Save.