|
| 1 | +--- |
| 2 | +title: Configure external identity source for NSX-T |
| 3 | +description: Learn how to use the Azure VMware Solution to configure an external identity source for NSX-T. |
| 4 | +ms.topic: how-to |
| 5 | +ms.service: azure-vmware |
| 6 | +ms.date: 09/20/2022 |
| 7 | + |
| 8 | +--- |
| 9 | +# Configure external identity source for NSX-T |
| 10 | + |
| 11 | +In this article, you'll learn how to configure an external identity source for NSX-T in an Azure VMware Solution. The NSX-T Data Center can be configured with external LDAP directory service to add remote directory users or groups. The users can be assigned an NSX-T Data Center Role-based access control (RBAC) role like you've on-premises. |
| 12 | + |
| 13 | +## Prerequisites |
| 14 | + |
| 15 | +- A working connectivity from your Active Directory network to your Azure VMware Solution private cloud. |
| 16 | +- If you require Active Directory authentication with LDAPS: |
| 17 | + - You'll need access to the Active Directory Domain Controller(s) with Administrator permissions. |
| 18 | + |
| 19 | + - Your Active Directory Domain Controller(s) must have LDAPS enabled with a valid certificate. The certificate could be issued by an [Active Directory Certificate Services Certificate Authority (CA)](https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx) or a [third-party CA](https://docs.microsoft.com/troubleshoot/windows-server/identity/enable-ldap-over-ssl-3rd-certification-authority). |
| 20 | + >[!Note] |
| 21 | + > Self-sign certificates are not recommended for production environments. |
| 22 | + |
| 23 | +- Ensure your Azure VMware Solution has DNS resolution configured to your on-premises AD. Enable DNS Forwarder from Azure portal. For more information, see [Configure NSX-T DNS for resolution to your Active Directory Domain and Configure DNS forwarder for Azure VMware Solution](configure-dns-azure-vmware-solution.md) . |
| 24 | +>[!NOTE] |
| 25 | +> For more information about LDAPS and certificate issuance, see with your security or identity management team. |
| 26 | +
|
| 27 | +## Add Active Directory as LDAPS identity source |
| 28 | + |
| 29 | +1. Sign-in to NSX-T and Navigate to System > Users and Roles > LDAP. |
| 30 | + |
| 31 | +1. Select on the Add Identity Source. |
| 32 | + |
| 33 | +1. Enter a name for the identity source. For example, avslab.local. |
| 34 | + |
| 35 | +1. Enter a domain name. The name must correspond to the domain name of your Active Directory server, if using Active Directory. For example, `avslab.local`. |
| 36 | + |
| 37 | +1. Select the type as Active Directory over LDAP, if using Active Directory. |
| 38 | + |
| 39 | +1. Enter the Base DN. Base DN is the starting point that an LDAP server uses when searching for user authentication within an Active Directory domain. For example: DC=avslab,DC=local. |
| 40 | + >[!NOTE] |
| 41 | + > All of the user and group entries you intend to use to control access to NSX-T Data Center must be contained within the LDAP directory tree rooted at the specified Base DN. If the Base DN is set to something too specific, such as an Organizational Unit deeper in your LDAP tree, NSX may not be able to find the entries it needs to locate users and determine group membership. Selecting a broad Base DN is a best practice if you are unsure. |
| 42 | +
|
| 43 | +1. After filling in the required fields, you can select Set to configure LDAP servers. One LDAP server is supported for each domain. |
| 44 | + |
| 45 | + | **Field** | **Value** | |
| 46 | + | ----- | ----- | |
| 47 | + |Hostname/IP | The hostname or IP address of your LDAP server. For example, `dc.avslab.local.`| |
| 48 | + | LDAP Protocol | Select **LDAPS** (LDAP is unsecured). | |
| 49 | + | Port | The default port is populated based on the selected protocol 636 for LDAPS and 389 for LDAP. If your LDAP server is running on a non-standard port, you can edit this text box to give the port number. | |
| 50 | + | Connection Status | After filling in the mandatory text boxes, including the LDAP server information, select **Connection Status** to test the connection. | |
| 51 | + | Use StartTLS | If selected, the LDAPv3 StartTLS extension is used to upgrade the connection to use encryption. To determine if you should use this option, consult your LDAP server administrator. This option can only be used if LDAP protocol is selected. | |
| 52 | + | Certificate | If you're using LDAPS or LDAP + StartTLS, this text box should contain the PEM-encoded X.509 certificate of the server. If you leave this text box blank and select the **Check Status** link, NSX connects to the LDAP server. NSX will then retrieve the LDAP server's certificate, and prompt you if you want to trust that certificate. If you've verified that the certificate is correct, select **OK**, and the certificate text box will be populated with the retrieved certificate. | |
| 53 | + |Bind Identity | The format is `user@domainName`, or you can specify the distinguished name. For Active Directory, you can use either the userPrincipalName (user@domainName) or the distinguished name. For OpenLDAP, you must supply a distinguished name. This text box is required unless your LDAP server supports anonymous bind, then it's optional. Consult your LDAP server administrator if you aren't sure.| |
| 54 | + |Password |Enter a password for the LDAP server. This text box is required unless your LDAP server supports anonymous bind, then it's optional. Consult your LDAP server administrator.| |
| 55 | +1. Select **Add**. |
| 56 | + :::image type="content" source="./media/nsxt/set-ldap-server.png" alt-text="Screenshot showing how to set an LDAP server." border="true" lightbox="./media/nsxt/set-ldap-server.png"::: |
| 57 | + |
| 58 | + |
| 59 | +1. Select **Save** to complete the changes. |
| 60 | + :::image type="content" source="./media/nsxt/user-roles-ldap-server.png" alt-text="Screenshot showing user roles on an LDAP server." border="true" lightbox="./media/nsxt/user-roles-ldap-server.png"::: |
| 61 | + |
| 62 | +## Assign other NSX-T roles to Active Directory identities |
| 63 | + |
| 64 | +After adding an external identity, you can assign NSX-T Roles to Active Directory security groups based on your organization's security controls. |
| 65 | + |
| 66 | +1. Sign in to NSX-T and navigate to **System** > **Users and Roles**. |
| 67 | + |
| 68 | +1. Select **Add** > **Role Assignment for LDAP**. |
| 69 | + |
| 70 | + 1. Select a domain. |
| 71 | + 1. Enter the first few characters of the user's name, sign in ID, or a group name to search the LDAP directory, then select a user or group from the list that appears. |
| 72 | + 1. Select a role. |
| 73 | + 1. Select **Save**. |
| 74 | + :::image type="content" source="./media/nsxt/user-roles-ldap-review.png" alt-text="Screenshot showing how to review different roles on the LDAP server." border="true" lightbox="./media/nsxt/user-roles-ldap-review.png"::: |
| 75 | + |
| 76 | +1. Verify the permission assignment is displayed under **Users and Roles**. |
| 77 | +:::image type="content" source="./media/nsxt/user-roles-ldap-verify.png" alt-text="Screenshot showing how to verify user roles on an LDAP server." border="true" lightbox="./media/nsxt/user-roles-ldap-verify.png"::: |
| 78 | + |
| 79 | +1. Users should now be able to sign in to NSX-T using their Active Directory credentials. |
| 80 | + |
| 81 | +## Next steps |
| 82 | +Now that you've configured the external source, you can also learn about: |
| 83 | + |
| 84 | +- [Configure external identity source for vCenter Server](configure-identity-source-vcenter.md) |
| 85 | + |
| 86 | + |
0 commit comments