Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Active directory login is making entry of username in webapi.sec_role #1373

Closed
ambuj369 opened this issue Nov 25, 2019 · 4 comments
Closed
Assignees
Labels
Projects
Milestone

Comments

@ambuj369
Copy link

Hello,

I have integrated Active Directory with Atlas which is working as expected except few issues which I would like to bring to your notice to see if any alternative solution or build is available to fix.

Issue 1: An Active Directory user have to login as "mydomain\username ". How can we stop adding domain name everytime we login?

Issue 2: Once logged in, can we have a default role that will be applied to the users logging in for the first time?

Issue 3: Why the login information is getting stored in webapi.sec_role table (attached screenshot), this looks like a security breach.

Atlas_AD
WebAPI version - 2.7.4
Atlas - 2.7.4
DB - PostgreSQL

Thank You

@konstjar
Copy link
Contributor

Hello

  1. Yes, you can remove domain name by setting correct values depending on your AD configuration
security.ad.principalSuffix=@domain.com
security.ad.userMapping.displaynameAttr={AD property for username without domain}
  1. This is more interesting topic. I see 2 options here:
  • Add needed permissions to 'public' role. This role is granted by default.
  • More correct way is to use AD import/synchronization option and map Atlas role to AD group. This can be done my configuring ATLAS to use AD global catalogue.
  1. Each user gets the same name role. It's not visible in UI but used by WebAPI to track user permissions for created content. This is per design and is not an issue.

@ambuj369
Copy link
Author

@konstjar
Thank you for clearing the things out. Based upon the answers provided, I have few questions to address:

  1. Yes, you can remove domain name by setting correct values depending on your AD configuration
    security.ad.principalSuffix=@domain.com
    security.ad.userMapping.displaynameAttr={AD property for username without domain}
    Q: Assuming the domain name is @gmail.com which will be put under security.ad.principalSuffix. What should I add to security.ad.userMapping,displaynameAttr? Should it be the "domain" which I have to enter along with username. For example: domainname\username? So, by putting security.ad.userMapping.displaynameAttr =domainname will work or should I user security.ad.userMapping.displaynameAttr ={AD property for username without domain}.

  2. End user do not want to have all the users imported from AD to Atlas which is why only few users from AD will login and they will get the public role. Is that correct?

  3. Storing usernames in webapi.sec_role; wouldn't it be a security breach however it is meant not to reflect on the Atlas screen but any user with webapi access can read out the usernames in it. Is there a way not to populate it in the table?

Thank You

@konstjar
Copy link
Contributor

@ambuj369

  1. security.ad.userMapping.displaynameAttr - you need to check your AD, for example use ldapsearch tool to get record for your own user and identify what is the best field to use. Each organization has own rules/AD structure. It should be field with user name without domain name.

  2. If you need only few users to be authenticated, you can assign roles manually in ATLAS when they log in. Or you can create AD group with these users to map with ATLAS roles.

  3. It's more question to developers/community. I think there is no option to prevent adding records in webapi.sec_role table. These user roles are not listed in ATLAS UI 100%.

@anthonysena anthonysena added this to the V2.8.0 - Backlog milestone Dec 10, 2019
@anthonysena anthonysena self-assigned this Dec 10, 2019
@anthonysena anthonysena added this to TO DO in Atlas v2.8 via automation Apr 21, 2020
@anthonysena anthonysena moved this from TO DO to Documentation in Atlas v2.8 Apr 21, 2020
@anthonysena
Copy link
Collaborator

Wiki updated to reflect this information.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
No open projects
Atlas v2.8
  
Documentation
Development

No branches or pull requests

3 participants