Unsolved
This post is more than 5 years old
1 Rookie
•
9 Posts
0
3247
October 26th, 2015 08:00
ViPR Controller and User Group Attributes
I am attempting to setup Active Directory groups to administer ViPR Controller. I have been successful in creating the authentication provider and adding my AD ID under VDC role assignments. I can then successfully login with my AD account and be an administrator. I then remove my user AD ID then try and add the AD group I am in. When I attempt to do this with an AD group it does not work. I have tried creating a user group with my AD group, but I cannot find any documentation on what it is looking for in the User Groups > Add> Attribute list, Name and Values. I assume this maybe my problem but I don't know what name and value it is looking for and cannot find anything online or in documentation.
I have also just tried adding the AD group under VDC Role Assignment as an administrator but that does not work.
bakitup
1 Rookie
•
9 Posts
0
October 27th, 2015 05:00
I finally got it working yesterday and I am still not sure why it is working now. It is pretty much setup as I had it before. I did delete the authentication provider and add it back.
I pretty much have all the defaults from an AD authentication provider except search scope is subtree as opposed to one level and search base is at domain level. After I did that I was able to create a new role for VDC with group@domain.com and grant it administrator. I can now login with AD credentials that reside in that AD group successfully.
I still don't know under Use Groups (even though it is not used with AD) where you determine the attribute options to use. The same thing for Tenant, User Mapping Rules. Where do you find the attribute options you can use in those values?
Thanks
Jeff
bakitup
1 Rookie
•
9 Posts
0
October 28th, 2015 05:00
Davidson,
That makes much more sense now on the User groups. I have read and reread the docs but it did not click until you wrote that.
Thanks again.
Jeff
supersandwhich
26 Posts
0
April 27th, 2016 13:00
Hi Davidson, et al:
I'm having an issue with mapping users into tenants and making them see the correct projects. Specifically, Service Catalog / End Users are able to see a Project A created under the Provider Tenant created at deployment, and only then when I add AD userID to the Project List. I don't want them to user the Provider Tenant/Project A.
I have created other Tenants and Projects, but the End Users do not see those at all even if I add them to the Project ACL using VIPR User Groups, AD userID, or AD AdminsID. If I add AD AdminsID to VDC roles, then they can see all the projects, but these are supposed to be service catalog end users
There is an authentication provider for this domain that is allowing us to login with our NW PINS, so AD authentication is working. The AD group "Admins*" is added to the Authentication whitelist, but even when it's "*" it still doesn't find the members. The AD group is Admins at Domain, but in the whitelist I input Admins*.
Would also like to know the difference between ViPR User Group and AD User Groups, seems like I shouldn't *have* to user the VIPR User Group if the AD group is implemented correctly in VIPR, right? It seems like the VIPR User Group is not picking up the AD attribute and value.
My VDC roles are System Admin, Security Admin, System Monitor, and System Auditor.
I am the owner of Projects I created.
I have gone through your checklist above, authentication user has read all inet and search permissions in the search base.
supersandwhich
26 Posts
0
April 28th, 2016 09:00
While logged w my AD pin, when adding the AD adminsgroup.domain to a Tenant B (not Provider) -
Error: 1013 (http: 400): Bad request body. Invalid User-Mapping change, which will cause SecurityAdmin myADpin@ get mapped out of Provider Tenant, and lose its SecurityAdmin roles.
Logged out and logged on as Root, edit Tenant B, add ADadminsgroup to Tenant B - so the good news is that everyone in ADadminsgroup can now see Tenant B, the bad news is that I am also a member of that group so now I too can only see the Service Catalog
Now I can only see *everything* when I am logged on as Root... will see if I can get myPIN back to correct VDC roles, maybe w/ VIPR user groups and attributes...or another AD group for VIPRadmins@ domain.
Is anyone creating separate AD groups for Service Catalog End Users and another AD group for VIPR admins?