Configuring Active Directory as a directory service for Ops Center

You can add a directory service and configure authentication for the Ops Center portal so that AD groups can access portal functions and products with a single sign-in.

1. Log in to the Ops Center portal as sysadmin or a user with opscenter-administrators membership.
2. From the navigation bar, click Manage users and select User directories from the Asset type list.
3. Click the + (plus) icon.
   The Add user directory service window opens.
4. Enter a name for the service.
5. Select Active directory for the Directory service type.
6. Select the Authentication protocol.
   LDAP is the default protocol. If you choose Kerberos, select the Realm name from the displayed list.
7. Enter the Connection URL (for example: ldaps://ldaps.example.com) and then click Test connection.
   Note: Specify the same host name as the CN or SANs in the Active Directory server certificate.
8. Enter the BIND user DN (for example: CN=bind-user,OU=foo,OU=bar,DC=example,DC=com) and the password and then click Test authentication.
   Note: The BIND User DN only requires read permissions (not admin or modify).
9. Enter the Base DN (for example: OU=foo,OU=bar,DC=example,DC=com).
   Note: To have portal access, users must be included in the subtree of the DN specified in the Base DN.
10. You can import a maximum of 100 AD users. Click Pre-check the number of imported users. If you exceed this limit, you can decrease the number of users to be imported by using a Custom user LDAP filter. For best results, use a filter to specify a user or group. Here are some examples:
    Note: The following search conditions are set automatically and cannot be changed:

    objectclass="person,organizationalPerson,user"
    scope=2(subtree)

    To select the sAMAccountName t_brady:

    (sAMAccountName=t_brady)

    To select multiple sAMAccountName instances:

    (|(sAMAccountName=t_brady)(sAMAccountName=p_manning)(sAMAccountName=a_rodgers))

    To select users belonging to group1:

    (memberOf=cn=group1,ou=example)

    To select users belonging to group1 or group2:

    (|(memberOf=cn=group1,ou=example)(memberOf=cn=group2,ou=example))

    For information on how to query a user or group DN from Active Directory, see Using dsquery to obtain user or group DN.
11. By default, the Add all users under Base DN to opscenter-users group option is not available. This means that only members of groups (next step) are permitted to log in to the portal. If you enable this option, all users under the Base DN are assigned to the opscenter-users group and can also log in.
12. Provide entries for the Group entry list. For example, if you created AD groups named sanadmin and sanoperator, you can eventually assign roles and permissions appropriate to each group, as in this example:

    "CN=sanadmin,CN=Users,DC=home,DC=us"
    "CN=sanoperator,CN=Users,DC=home,DC=us"

    Click +Add Group DN to add entries.

    Note: The group DN must be included in the subtree of the DN specified in the Base DN.
13. Click Submit when the settings are complete. If the "Number of users outside of range" error is still displayed, change the Custom user LDAP filter to reduce the number of users to be added. You can use the Pre-check the number of users (filter) to confirm the results before resubmitting.