You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-vmware/configure-external-identity-source-nsx-t.md
+81-49Lines changed: 81 additions & 49 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,86 +3,118 @@ title: Configure external identity source for NSX-T Data Center
3
3
description: Learn how to use the Azure VMware Solution to configure an external identity source for NSX-T Data Center.
4
4
ms.topic: how-to
5
5
ms.service: azure-vmware
6
-
ms.date: 12/05/2023
6
+
ms.date: 11/06/2023
7
7
ms.custom: engagement-fy23
8
8
9
+
9
10
---
10
-
# Configure external identity source for NSX-T Data Center
11
+
# Configure an external identity source for NSX-T Data Center
12
+
13
+
In this article, you will learn how to configure an external identity source for the NSX-T Data Center in an Azure VMware Solution. The NSX-T Data Center can be configured to use an external LDAP directory service to authenticate users, enabling a user to log in using their Active Directory account credentials, or those from a 3rd party LDAP server. The account can then be assigned an NSX-T Data Center Role, like you have with on-premises environments, to provide RBAC for each NSX-T user.
14
+
15
+
11
16
12
-
In this article, learn how to configure an external identity source for NSX-T Data Center in an Azure VMware Solution. The NSX-T Data Center can be configured with external LDAP directory service to add remote directory users or groups. The users can be assigned an NSX-T Data Center Role-based access control (RBAC) role like you have on-premises.
13
17
14
18
## Prerequisites
15
19
16
-
- A working connectivity from your Active Directory network to your Azure VMware Solution private cloud.
17
-
- If you require Active Directory authentication with LDAPS:
18
-
- You need access to the Active Directory Domain Controller(s) with Administrator permissions.
20
+
- A working connection from your Active Directory network to your Azure VMware Solution private cloud. </br>
21
+
- A network path from your Active Directory server to the management network of Azure VMware solution where NSX-T is deployed. </br>
22
+
- Best practice: Two domain controllers located in Azure in the same region as the Azure VMware Solution SDDC. </br>
23
+
- Active Directory Domain Controller(s) with a valid certificate. The certificate could be issued by an [Active Directory Certificate Services Certificate Authority (CA)](https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx) or a [third-party CA](/troubleshoot/windows-server/identity/enable-ldap-over-ssl-3rd-certification-authority).
24
+
25
+
26
+
>[!Note]
27
+
> Self-sign certificates are not recommended for production environments.
19
28
20
-
- Your Active Directory Domain Controller(s) must have LDAPS enabled with a valid certificate. The certificate is issued from [Active Directory Certificate Services Certificate Authority (CA)](https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx) or a [third-party CA](/troubleshoot/windows-server/identity/enable-ldap-over-ssl-3rd-certification-authority).
21
-
>[!Note]
22
-
> Self-sign certificates are not recommended for production environments.
23
29
24
-
- Ensure your Azure VMware Solution has DNS resolution configured to your on-premises AD. Enable DNS Forwarder from Azure portal. For more information, see [Configure NSX-T Data Center DNS for resolution to your Active Directory Domain and Configure DNS forwarder for Azure VMware Solution](configure-dns-azure-vmware-solution.md) .
30
+
- An account with Administrator permissions</br>
31
+
- The Azure VMware Solution DNS zones and the DNS servers have been correctly deployed. See: [Configure NSX-T Data Center DNS for resolution to your Active Directory Domain and Configure DNS forwarder for Azure VMware Solution](configure-dns-azure-vmware-solution.md)</br>
32
+
33
+
25
34
>[!NOTE]
26
35
> For more information about LDAPS and certificate issuance, see with your security or identity management team.
27
36
28
-
## Add Active Directory as LDAPS identity source
37
+
</br>
38
+
39
+
## Configure NSX-T to use Active Directory as LDAPS identity source
40
+
41
+
1. Sign-in to NSX-T Manager and navigate to System, User Management, LDAP and click on “ADD IDENTITY SOURCE”
42
+
43
+
44
+
45
+
46
+
2. Enter the Name, Domain Name (FQDN), the Type and base DN. Optionally add a description.
47
+
The base DN is the container where your user accounts are kept, it is the starting point that an LDAP server uses when searching for users for an authentication request. For example CN=users,dc=azfta,dc=com.
48
+
>[!NOTE]
49
+
> You can use more than one directory as an LDAP provider, i.e. with multiple AD domains when using AVS as a way to consolidate workloads.
50
+
</br>
51
+
52
+
53
+
29
54
30
-
1. Sign-in to NSX-T Manager and Navigate to System > Users and Roles > LDAP.
55
+
3. Next, click Set (!) as shown on the screenshot above, then click on "ADD LDAP SERVER" and fill in the following fields
31
56
32
-
1. Select on the Add Identity Source.
57
+
58
+
| Field | Explanation|
59
+
|----------------------|------------|
60
+
| Hostname/IP | This is the LDAP server’s FQDN or IP address. For example either azfta-dc01.azfta.com or 10.5.4.4|
61
+
| LDAP Protocol | Select LDAPS|
62
+
| Port Choose 636 | This is the default secure LDAP port.|
63
+
| Enabled | Leave as ‘Yes’|
64
+
| Use StartTLS | Only required if non-secured LDAP is being used.|
65
+
| Bind Identity | Use your account with domain administrator permissions. For example [email protected]|
66
+
| Password | Enter the password for the LDAP server, this is the password for the example [email protected] account.|
67
+
| Certificate | Leave empty (see step 6)|
33
68
34
-
1. Enter a name for the identity source. For example, avslab.local.
35
69
36
-
1. Enter a domain name. The name must correspond to the domain name of your Active Directory server, if using Active Directory. For example, `avslab.local`.
37
70
38
-
1. Select the type as Active Directory over LDAP, if using Active Directory.
71
+
39
72
40
-
1. Enter the Base DN. Base DN is the starting point that an LDAP server uses when searching for user authentication within an Active Directory domain. For example: DC=avslab,DC=local.
41
-
>[!NOTE]
42
-
> All of the user and group entries you intend to use to control access to NSX-T Data Center must be contained within the LDAP directory tree rooted at the specified Base DN. If the Base DN is set to something too specific, such as an Organizational Unit deeper in your LDAP tree, NSX may not be able to find the entries it needs to locate users and determine group membership. Selecting a broad Base DN is a best practice if you are unsure.
43
73
44
-
1. After filling in the required fields, you can select Set to configure LDAP servers. One LDAP server is supported for each domain.
74
+
4. The screen will update, click Click ADD, then APPLY
75
+
76
+
77
+
78
+
5. Back on the User Management screen, click "SAVE" to complete the changes.
79
+
80
+
6. To add a second domain controller, or another external identity provider, go back to step 1.
81
+
82
+
>[!NOTE]
83
+
> Best practice is to have two domain controllers to act as LDAP servers. You can also put the LDAP servers behind a load balancer.
45
84
46
-
|**Field**|**Value**|
47
-
| ----- | ----- |
48
-
|Hostname/IP | The hostname or IP address of your LDAP server. For example, `dc.avslab.local.`|
49
-
| LDAP Protocol | Select **LDAPS** (LDAP is unsecured). |
50
-
| Port | The default port is populated based on the selected protocol 636 for LDAPS and 389 for LDAP. If your LDAP server is running on a nonstandard port, you can edit this text box to give the port number. |
51
-
| Connection Status | After filling in the mandatory text boxes, including the LDAP server information, select **Connection Status** to test the connection. |
52
-
| Use StartTLS | If selected, the LDAPv3 StartTLS extension is used to upgrade the connection to use encryption. To determine if you should use this option, consult your LDAP server administrator. This option can only be used if LDAP protocol is selected. |
53
-
| Certificate | If you're using LDAPS or LDAP + StartTLS, this text box should contain the PEM-encoded X.509 certificate of the server. If you leave this text box blank and select the **Check Status** link, NSX connects to the LDAP server. NSX retrieves the LDAP server's certificate, and prompts you if you want to trust that certificate. If you verified that the certificate is correct, select **OK**, and the certificate text box is populated with the retrieved certificate. |
54
-
|Bind Identity | The format is `user@domainName`, or you can specify the distinguished name. For Active Directory, you can use either the userPrincipalName (user@domainName) or the distinguished name. For OpenLDAP, you must supply a distinguished name. This text box is required unless your LDAP server supports anonymous bind, then it's optional. Consult your LDAP server administrator if you aren't sure.|
55
-
|Password |Enter a password for the LDAP server. This text box is required unless your LDAP server supports anonymous bind, then it's optional. Consult your LDAP server administrator.|
56
-
1. Select **Add**.
57
-
:::image type="content" source="./media/nsxt/set-ldap-server.png" alt-text="Screenshot showing how to set an LDAP server." border="true" lightbox="./media/nsxt/set-ldap-server.png":::
58
-
59
-
60
-
1. Select **Save** to complete the changes.
61
-
:::image type="content" source="./media/nsxt/user-roles-ldap-server.png" alt-text="Screenshot showing user roles on an LDAP server." border="true" lightbox="./media/nsxt/user-roles-ldap-server.png":::
62
85
63
86
## Assign other NSX-T Data Center roles to Active Directory identities
64
87
65
88
After adding an external identity, you can assign NSX-T Data Center Roles to Active Directory security groups based on your organization's security controls.
66
89
67
-
1. Sign in to NSX-T Manager and navigate to **System** > **Users and Roles**.
68
-
69
-
1. Select **Add** > **Role Assignment for LDAP**.
90
+
1. Sign in to NSX-T Manager and navigate to System > Users Management > User Role Assignment and click Add
91
+
92
+
70
93
71
-
1. Select a domain.
72
-
1. Enter the first few characters of the user's name, sign in ID, or a group name to search the LDAP directory, then select a user or group from the list that appears.
73
-
1. Select a role.
74
-
1. Select **Save**.
75
-
:::image type="content" source="./media/nsxt/user-roles-ldap-review.png" alt-text="Screenshot showing how to review different roles on the LDAP server." border="true" lightbox="./media/nsxt/user-roles-ldap-review.png":::
94
+
2. Select **Add** > **Role Assignment for LDAP**.
76
95
77
-
1. Verify the permission assignment is displayed under **Users and Roles**.
78
-
:::image type="content" source="./media/nsxt/user-roles-ldap-verify.png" alt-text="Screenshot showing how to verify user roles on an LDAP server." border="true" lightbox="./media/nsxt/user-roles-ldap-verify.png":::
96
+
a. Select the external identity provider-this will be the Identity provider selected in Step 3 in the previous section. “NSX-T External Identity Provider”
79
97
80
-
1. Users should now be able to sign in to NSX-T Manager using their Active Directory credentials.
98
+
b. Enter the first few characters of the user's name, sign in ID, or a group name to search the LDAP directory, then select a user or group from the list that appears.
99
+
100
+
c. Select a role, in this case we are assigning FTAdmin the role of CloudAdmin
101
+
102
+
d. Select Save.
103
+
104
+
105
+
106
+
107
+
108
+
3. Verify the permission assignment is displayed under **User Role Assignment**.
109
+
110
+
111
+
112
+
113
+
4. Users should now be able to sign in to NSX-T Manager using their Active Directory credentials.
81
114
82
115
## Next steps
83
116
Now that you configured the external source, you can also learn about:
84
117
85
118
-[Configure external identity source for vCenter Server](configure-identity-source-vcenter.md)
0 commit comments