Authentication and Authorization Using LDAP

Authentication

Figure 1 shows authentication flow in Itential Platform using LDAP.

Figure 1: Authentication Flow Using LDAP

1. User provides username and password.

2. LDAP server in AAA platform authenticates users and returns one of the following:

   • Reject: Itential Platform displays "Invalid credentials".
   • Access-Accept: Itential Platform allows user to login.
   • Challenge: Itential Platform displays "Generate token and retry".

3. AAA Platform also returns a vendor specific attribute ( Type 2 per RFC 2865, 5.6). For example:

   • Vendor ID = 47688 (Itential)
   • Name = Itential-user-Group
   • Number = 1
   • Value = User group of the user obtained from LDAP.

Authorization

Figure 2 illustrates both authorization and authentication between Itential Platform and NSO using LDAP.

Figure 2: Authentication and Authorization

1. User groups will be defined manually in Itential Platform. Matching user groups will be added in the LDAP server in the AAA Platform. Customer must have user groups configured on the LDAP server.
2. LDAP server will authenticate the user.
3. LDAP server will authorize the user.
4. Return the groups associated with the user.
5. User receives the authentication token.
6. Itential Platform sends a request to NSO with user and token.

Multi-Tenancy

The following applies when using multi-tenancy:

1. NSO sends a whoami API request to Itential Platform.
2. Itential Platform returns the group to NSO.
3. NSO checks the NACM rules for the user/group to determine what the user can access.
4. NSO will either accept or reject access.