Page Comparison

*)

## Configure Active Directory User Federation

- Go to the Authority Service Admin Console, consult *Configuring the Authority Service* in the [Install Guide](#https://ayfie-dev.atlassian.net/wiki/spaces/SAGA/pages/2400714758/Ayfie+Locator+Installation+Guide).
- Up in the left corner, make sure it is the Saga realm that is being displayed.
- Go to User Federation menu option
- On the right side, there is a list box labeled Add Provider. Select the LDAP provider type and you will be sent to the provider's settings page.
- Adjusts settings:
  - In Console Display Name, enter the display name *Active Directory*.
  - In Vendor, choose *Active Directory*.
  - In Import Users, set to *On*. Authority Service will import users into the internal database.
  - In Edit Mode, set to *Read Only*. You will be unable to modify the username, email address, first and last names, or any other mapped attributes. Updates to passwords are not supported.
  - In Sync registrations, set to *Off*. Users created in Authority Service will not be synced back to Active Directory.
  - In Username LDAP attribute, set to *sAMAccountName*. This will set username of imported user to it’s Active Directory user name.
  - In Custom User LDAP Filter, set to *(&(objectCategory=Person)(sAMAccountName=\*))

* This will only import users with sAMAccountName attribute set.
    - If one want to filter users to be imported by a specific Active Directory Group, extend filter with memberOf clause. For example, given that you want to import users in *SagaUsers* group only and distinguished name of that group is *CN=SagaUsers,OU=Groups,DC=company,DC=internal*, use following filter *(&(objectCategory=Person)(sAMAccountName=\*)(memberOf=CN=SagaUsers,OU=Groups,DC=company,DC=internal))

* .
  - In Connection URL, set the LDAP connection URL.
  - In Search Scope, set to *Subtree*.
  - In Bind DN and Bind Credential, set with the Active Directory service user created in prerequisites.
- Click *Test connection* and *Test authentication* and validate success.
- Click *Save*
- Go to User Federation menu option and choose *Active Directory*.
- Go to Mappers tab:
  - Click *username* mapper to edit.
    - In LDAP Attribute, set to *sAMAccountName*.
    - Click Save.
  - Click Create.
    - In Name, set *user*.
    - In Mapper Type, set *user-attribute-ldap-mapper*.
    - In User Model Attribute, set *user*.
    - In LDAP Attribute, set *sAMAccountName*.
    - Click Save.
  - Click Create.
    - In Name, set *source*.
    - In Mapper Type, set *hardcoded-attribute-mapper*.
    - In User Model Attribute Name*, set *source*.
    - In Attribute Value, set *ad*.
    - Click Save.
  - Click Create.
    - In Name, set *upn*.
    - In Mapper Type, set *user-attribute-ldap-mapper*.
    - In User Model Attribute, set *upn*.
    - In LDAP Attribute, set *sAMAccountName*.
    - Click Save.
- Go to Settings tab.
  - Click *Syncronize all users*.
  - Go to Sync Settings section
  - Configure Syncronization method. The recommended method is *Periodic Changed User Sync*.
  - Click Save.
- Go to Users menu option.
  - Click *View all users* and validate that users are imported to the internal database.

## Configuring Active Directory With LDAPS

Active Directory user federation through LDAPS requires that the domain controller has a valid SSL certificate issued by a well-known authority. Otherwise the Certificate Authority has to be manually imported into the Authority Service.

To import the certificate, copy the certificate file to *D:\Program Files\ayfie\saga\volumes\authority\docker-entrypoint.d* (the path assumes recommended install directory) and then restart the Authority Service.

### Exporting Certificate Authority From The Domain Controller

To export Certificate Authority from the domain controller, do the following:
 - Open control panel.
 - Open *Manage Computer Certificates*.
 - Go to *Trusted Root Certification* and find the Root CA.
 - Open the certificate, go to details.
 - Select *Copy To File...* and then the *DER encoded binary X.509 (.CER)* option in the export wizard.

## Configuring Single Sign-On

**_NOTE:_** This configuration is optional. Perform following steps only if you want to enable Kerberos Single Sign-On.

- Run the following command on domain controller to assign a SPN to the user and generate a keytab file:

  ```
  ktpass -out keycloak.keytab -princ HTTP/

GatewayHostName@COMPANY.

INTERNAL -mapUser 

svcSagaKeycloak@COMPANY.INTERNAL -pass password! -kvno 0 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT

  ```
    - Replace *GatewayHostname*, with the Gateway Hostname set in Saga, see [Install Guide](#https://ayfie-dev.atlassian.net/wiki/spaces/SAGA/pages/2400714758/Ayfie+Locator+Installation+Guide).
    - Replace *COMPANY.INTERNAL* with the Active Directory domain name.
    - Replace *svcSagaKeycloak@COMPANY.INTERNAL* with the service user created in [Prerequisites](#prerequisites).
- Copy keycloak.ktab file to *D:\Program Files\ayfie\saga\volumes\authority\docker-entrypoint.d

\* (the path assumes recommended install directory).
- Go to User Federation menu option and choose *Active Directory*.
- Go to Kerberos Integration section and adjust settings:
    - In Allow Kerberos Authentication, set to *On*.
    - In Kerberos Realm, set  domain name ie. *COMPANY.INTERNAL*
    - In Server Principal, set according to SPN set on domain user (ie. HTTP/locator.internal@COMPANY.INTERNAL)

    - In Keytab, set *c:\docker-entrypoint.d\keycloak.ktab

*.
    - In Use Kerberos For Password Authentication, set to *On*.
    - Click Save.

An additional requirement is that the FQDN used to access Saga applications, has to be added to the Local Intranet Zone on the client machines (unless this already happens automatically for all domain users).