|
1 | 1 | --- |
2 | 2 | title: "Authentication" |
3 | 3 | linkTitle: "Authentication" |
4 | | -description: "Setup authentication for accessing {{% ctx %}} Gateway." |
| 4 | +description: "Setup authentication providers used to control access to {{% ctx %}} Gateway." |
5 | 5 | weight: 20 |
6 | 6 | --- |
7 | 7 |
|
8 | 8 | # {{% param title %}} |
9 | 9 |
|
10 | 10 | ## Summary |
11 | 11 |
|
12 | | -The Authentication page is used to setup authentication for accessing {{% ctx %}} Gateway. |
| 12 | +The Authentication page is used to setup one or more authentication providers used to control access to {{% ctx %}} Gateway. |
13 | 13 |
|
14 | 14 | ## Anatomy |
15 | 15 |
|
16 | | -Authentication can be configured using [LDAP Authentication][] against a Microsoft Active Directory, and [OpenID Connect (OIDC) Authentication][OIDC Authentication] with one or more providers. |
| 16 | +Authentication can be configured using [LDAP][] against a Microsoft Active Directory, and [OpenID Connect (OIDC)][OIDC] with one or more providers. |
17 | 17 |
|
18 | | -### LDAP Authentication |
| 18 | +### LDAP |
19 | 19 |
|
20 | 20 | {{< figure src="/images/Authentication - LDAP.png" title="LDAP Authentication Configuration" >}} |
21 | 21 |
|
22 | 22 | LDAP authentication defines the connection to a Microsoft Active Directory server to authorise Active Directory users with different roles and permissions within {{% ctx %}} Gateway. |
23 | 23 |
|
24 | | -The LDAP form provides for the connection details to the LDAP server (URL or domain), port and protocol, plus the credentials of an AD User (typically a Service Account) that can read the Active Directory. |
| 24 | +It requires connection details to the Active Directory server (URL or domain), port and protocol, plus the credentials of an Active Directory account (typically a service account) that can read the Active Directory. |
25 | 25 |
|
26 | | -For additional security, and to avoid the clutter of irrelevant information, it is possible to filter the Active Directory information available for use in {{% ctx %}} Gateway to that defined by a set of Base DNs. |
| 26 | +For additional security, and to avoid the clutter of irrelevant information, it is possible to filter the Active Directory information available for use in {{% ctx %}} Gateway to that defined by a set of [Base DNs (Distinguished Names)][DNs]. |
27 | 27 |
|
28 | | -The fields available in the LDAP form are: |
| 28 | +{{% ctx %}} Roles and Flow Editor permissions can be assigned to groups set up in Active Directory. |
| 29 | + |
| 30 | +The fields available are: |
29 | 31 |
|
30 | 32 | * `Server` – specifies either URL or IPv4 address of the Active Directory server, or the domain name for the Active Directory domain. |
31 | | -* `Port` – specifies the IPv4 port used to access Active Directory, typically either 389 or 636. |
32 | | -* `Use SSL` – a checkbox to select the LDAPS protocol rather than LDAP. |
33 | | -* `Username` – the name of a user with read permissions in Active Directory. A Service Account is used. |
34 | | -* `Password` – the password associated with the username entered in the Username field. |
35 | | -* `Base DNs` – the Active Directory objects that can be accessed by {{% ctx %}} Gateway. The identity of the objects is expressed using their Distinguished Names. More than one Distinguished Name can be set to refer to multiple objects within Active Directory. If no Distinguished Names are set, the whole of Active Directory is accessible. |
| 33 | +* `Port` – specifies the port used to access Active Directory, typically either 389 for LDAP or 636 for LDAPS. |
| 34 | +* `Use SSL` – a checkbox to connect via the LDAPS protocol rather than LDAP. |
| 35 | +* `Username` – the username of an account with read permissions in Active Directory; typically a service account is used. |
| 36 | +* `Password` – the password associated with the username entered in the `Username` field. |
| 37 | +* `Base DNs` – the Active Directory objects that can be accessed by {{% ctx %}} Gateway. The identity of the objects is expressed using their Distinguished Names. More than one Distinguished Name can be set to refer to multiple objects within the Active Directory. If no Distinguished Names are set, the whole of the Active Directory is accessible. |
36 | 38 |
|
37 | | -### OpenID Connect Authentication |
| 39 | +### OpenID Connect |
38 | 40 |
|
39 | 41 | {{< figure src="/images/Authentication - OIDC.png" title="Open ID Connect Provider Configuration" >}} |
40 | 42 |
|
41 | | -OpenID Connect provides connections to third-party authentication services, e.g. Microsoft Entra. The OpenID Connect tab allows for one or more providers to be configured for users to authenticate with {{% ctx %}} Gateway, using Multi-Factor Authentication (MFA) if required. |
| 43 | +OpenID Connect provides connections to third-party authentication services to authenticate users in {{% ctx %}} Gateway, using Multi-Factor Authentication (MFA) if the provider supports it. |
| 44 | + |
| 45 | +The OpenID Connect tab currently only supports the Microsoft Entra provider but allows for one or more instances to be configured. |
42 | 46 |
|
43 | | -Groups set up in Microsoft Entra, provide for {{% ctx %}} Role assignment and {{% ctx %}} Flow Editor permissions. |
| 47 | +{{% ctx %}} Roles and Flow Editor permissions can be assigned to groups set up in Microsoft Entra. |
44 | 48 |
|
45 | | -The fields available in the OIDC form are: |
| 49 | +The fields available are: |
46 | 50 |
|
47 | 51 | * `Provider Type` – the OIDC provider type. Currently, only Microsoft is the OIDC provider supported. |
48 | 52 | * `Identifier` – free-format, friendly unique name for this provider. |
49 | 53 | * `Display Name` – the text displayed in the {{% ctx %}} Gateway sign-in button. |
50 | | -* `Authority` – the URL for authentication to which to send authentication requests. |
| 54 | +* `Authority` – the URL to send authentication requests to. |
51 | 55 | * `Tenant Identifier` – the Microsoft Entra Tenant ID for the organisation managing authentication. |
52 | 56 | * `Client Identifier` – the unique identifier to identify the {{% ctx %}} Gateway application to the authentication provider. |
53 | | -* `Client Secret` – the client secret that validate the Client Identifier to the authentication provider. |
| 57 | +* `Client Secret` – the client secret that validates the {{% ctx %}} Gateway application with the authentication provider. |
54 | 58 |
|
55 | 59 | ## Actions |
56 | 60 |
|
|
87 | 91 | * [Configure LDAP Authentication][Configure LDAP Authentication tutorial] |
88 | 92 | * [Add New OpenID Connect Authentication Provider][Add New OpenID Connect Authentication Provider tutorial] |
89 | 93 |
|
90 | | -[OIDC Authentication]: {{< ref "#openid-connect-authentication" >}} |
91 | | -[LDAP Authentication]: {{< ref "#ldap-authentication" >}} |
| 94 | +[OIDC]: {{< ref "#openid-connect" >}} |
| 95 | +[LDAP]: {{< ref "#ldap" >}} |
92 | 96 |
|
93 | 97 | [Add New OpenID Connect Authentication Provider tutorial]: {{< url path="Cortex.Tutorials.Administration.Authentication.OpenID" >}} |
94 | 98 | [Configure LDAP Authentication tutorial]: {{< url path="Cortex.Tutorials.Administration.Authentication.LDAP" >}} |
95 | 99 |
|
96 | 100 | [configure OIDC provider]: {{< url path="Cortex.Faqs.ConfigureOidcAuthentication.MainDoc" >}} |
| 101 | +[DNs]: {{< url path="MSDocs.Windows.Ldap.DNs" >}} |
0 commit comments