NASLORD™ 3.0 LDAP Configuration Guide (Super-Users)

1.Configure DNS on the NASLORD instance

Skip this section if a DNS IP address is already configured.

1. Open a web console on the NASLORD instance through your hypervisor, log in and enter configure to execute the configuration script.
2. Type Y on the change network configuration prompt and hit Enter.
3. Type N on enable DHCP and hit Enter.
4. Enter the FQDN, IPs and DNS IPs.
5. Once the configure script is done, reboot the instance.

2.Create required groups and users on the Domain Controller

1. Create an allowed-users security group in the DC Organizational Unit.
2. Create a denied-users security group in the DC Organizational Unit.
3. Create a super-users security group in the DC Organizational Unit.
4. Create a user used as service account to link the NASLORD instance to the DC LDAPS server.
5. Gather the previously created groups’/user’s distinguished names and save them for the NASLORD instance LDAPS configuration (Active Directory Users and Computers → object properties → Attribute Editor → distinguishedName).

Example distinguished name:

CN=allowed-users,OU=NASLORD,DC=AD2016,DC=lab

3.Configure Certificate CA services on the Domain Controller

Skip to section 4 if you already have a Certificate CA on your Domain Controller.

1. In Server Manager, choose Manage → Add Roles and Features.
2. Under server roles, select Active Directory Certificate Services.
3. Hit Add Features when prompted.
4. Follow the wizard steps and hit Install to install the services on the Domain Controller.
5. Under Roles and Features, select AD CS Configuration and use the wizard to configure the CA.
6. Select the Certification Authority role service and hit Next.
7. Select Enterprise CA and hit Next.
8. Select Root CA and hit Next.
9. Select Create a new private key and hit Next.
10. Select the SHA256 algorithm (RSA, key length 2048) and hit Next.
11. Type the name of your CA (e.g. AD2016-DC2-CA) and hit Next.
12. Select the validity period of the CA (e.g. 5 years) and hit Next.
13. Specify the database locations (use the defaults) and hit Next.
14. Validate the configuration summary and hit Configure.
15. Reboot the Windows Server to generate a certificate.

4.Validate certificate and LDAP connection

1. Open the Certification Authority manager (Server Manager → Tools).
2. Open the Issued Certificates folder. There should be one issued certificate to the Domain Controller (template “Domain Controller”).
3. Open the ldp console to test the LDAP connection.
4. Hit Connection → Connect…
5. Type the server FQDN (e.g. dc1.ad2016.lab), type port 636 and hit OK.
6. Confirm the connection is established: the RootDSE information is displayed (naming contexts, supported capabilities, and so on).

5.Get the certificate using CMD (Command Prompt) — method 1

1. Open CMD and run certutil with the certificate name:

   certutil -ca.cert AD2016-DC1-CA.cer

2. Copy and save the certificate plain text (-----BEGIN CERTIFICATE----- … -----END CERTIFICATE-----) for the NASLORD LDAP authentication services configuration.

6.Get the certificate using AD CS and Certificate Export — method 2

1. Go to the Certification Authority manager.
2. Pull down the CA instance, hit Issued Certificates, right-click on the first issued certificate and hit Open.
3. Hit Details.
4. Hit Copy to File…
5. Choose Base-64 encoded X.509 (.CER).
6. Hit Browse, name and save the certificate.
7. Hit Next until the end of the wizard and hit Finish (“The export was successful”).
8. Go to the certificate location, right-click on the previously saved certificate and choose Open with → Notepad.
9. Copy and save the certificate plain text for the NASLORD LDAP authentication services configuration.

7.NASLORD LDAP configuration

1. Go to the Admin page.
2. Hit LDAP Provider Management.
3. Hit Edit.
4. Enter the LDAP information using the distinguished-name form (under AD user/group attributes) saved previously:

   Example values for the “Configure LDAP Provider” form (domain AD2016.lab).

   Field	Example value
   LDAP Authentication	On
   Bind DN (DN or user@example.com)	CN=naslord,OU=NASLORD,DC=AD2016,DC=lab
   Bind Password	Service-account password
   LDAP Server URI (space-separated list)	ldaps://DC1.AD2016.LAB
   Require TLS Certificate	ALLOW
   User Search — Base / Scope	DC=AD2016,DC=lab / SUBTREE
   Group Search — Base / Scope	DC=AD2016,DC=lab / SUBTREE
   Group Type	Nested Active Directory Groups
   Denied Users — Group DN	CN=denied-users,OU=NASLORD,DC=AD2016,DC=lab
   Allowed Users — Group DN	CN=allowed-users,OU=NASLORD,DC=AD2016,DC=lab
   Super Users — Group DN	CN=super-users,OU=NASLORD,DC=AD2016,DC=lab

5. Check the Show advanced options box. Leave Start TLS set to False (do not enable Start TLS when connecting to your servers via LDAPS) and Network Timeout at 10, then scroll further down.
6. Paste the CA certificate plain text previously saved from the AD into the CA Certificate field.
7. We recommend leaving the remaining options at their defaults unless you need to customize them:
   • User Search — Filter: (sAMAccountName=%(user)s)
   • Group Search — Filter: (objectClass=group)
   • Automatic user attribute mapping: first name givenName, last name sn, username sAMAccountName, email mail
   Hit Save once the configuration is completed.
8. Confirm the connection and bind are successful: the LDAP Provider Management page shows LDAP Authentication: enabled and the server URI with status connected — “Connection and bind successful.”