VMware NSX Network

Detection and Response

LDAP Integration

VMware NSX Network Detection and Response LDAP Integration

Contents

LDAP Integration......................................................................................................................1

About LDAP Integration..................................................................................................... 1

Requirements..................................................................................................................... 1

LDAP Configuration........................................................................................................... 2

Integration with an external LDAP server provides authentication and authorization services for the

User Portal running on On-Premises appliances.

About LDAP Integration

To provide additional authentication and authorization security services, VMware supports the

integration of the Analyst, Manager and/or All-In-One with an external LDAP server.

Requirements

The following are required for LDAP integration:

•

VMware NSX Network Detection and Response On-Premises 9.0 or higher

•

•

Either all user and group entries must be readable via anonymous bind or an integration user must

be configured with sufficient access to read all user and group entries (for Active Directory with

default integration options, this means the integration user needs a minimum of read permission

for the userPrincipalName attribute of user entries and the member attribute of group entries). It is

recommended that you create an integration user with read-only access to the LDAP server, as the

credentials for the integration user are stored on the VMware appliance.

•

In order to use LDAPS, the certificate for each LDAP server must be signed by a CA trusted by the

VMware appliance (the CA listed in /etc/ssl/certs/ca-certificates.crt). It is possible to use

the Analyst, Manager and/or All-In-One appliance. This script is part of the NSX PAPI client

implementation, the papi-client (https://user.lastline.com/papi-doc/api/html/api/client.html). The script

requires:

•

python 2.7

• requests (https://2.python-requests.org/en/master/) module (version 2 or above)

Basic usage of the lastline_configure_ldap_integration.py script is:

lastline_configure_ldap_integration.py [option ...] subcommand [...]

The script accepts the following command line options:

Command Line Purpose

is strongly discouraged, as the LDAP bind operation is vulnerable to network

snooping.

--user-search-base FDN of the directory entry under which to search for users, for example

DC=example,DC=com.

--user-search-filter Filter expression used to search for users, with {} in place of username.

--strategy Provisioning strategy for assigning users to groups.

--integration-user User to bind to read users/groups. For Active Directory, the integration user must

be in the format username@domain (UPN format).

Password for user to bind to read users/groups.

group.

Attribute of the group entry which stores the group's name.

The script supports the following sub-commands:

Sub-Command Purpose

list List basic information about all LDAP directory configurations.

info uuid List detailed information about the specified LDAP directory configuration.

add [...] Add an LDAP directory configuration.

update uuid [...] Update the specified LDAP directory configuration.

add-group uuid group

Add a mapping from the specified LDAP group to an account role.

client/papi_client.tar.gz). Decompress the papi_client.tar.gz file and install it.

Step 2: Create a configuration file

Create a configuration file structured similar to the following:

username = [email protected]

password = portal_password

timeout = seconds

•

•

• verify_ssl — Defines whether to perform SSL certificate validation. Set this to "false" if you

• timeout — HTTP request timeout in seconds. "20" is recommended.

Step 3: Add a new configuration

Use the add sub-command of the lastline_configure_ldap_integration.py script to add a new

directory configuration for an Active Directory server, example.com:

Populate the map from LDAP groups to VMware account roles through multiple uses of the add-

group sub-command:

In the above example:

• The values of d41d8cd98f00b204e9800998ecf8427e and d41d8cd98f00b204e9800998ecf8427e

• The values of Reviewers and Analysts refer to the LDAP group name.

Portal is displayed:

To login using LDAP:

Procedure

Step 1: Enable LDAP sign on

Select the LDAP Sign On by clicking the [ ] (it is selected by default).

Step 2: Select the appropriate LDAP directory

Select the appropriate LDAP directory from the drop-down menu. The directories are listed in

alphabetical order. The first directory is selected by default.

Step 3: Enter your LDAP credentials

Use the Username and Password fields to enter your LDAP credentials. Click [SIGN IN] to login to

the User Portal.