Active Directory Authentication¶

PCoIP Management Console Active Directory (AD) authentication uses Lightweight Directory Access Protocol (LDAP) or Secure Lightweight Directory Access Protocol (LDAPS) with Active Directory servers for user authentication. LDAPS is recommended to give you a more secure environment, through the use of an Active Directory Certificate, which should be available before activating the Active Directory configuration.

Important Notes¶

This release of AD in PCoIP Management Console has important limitations which need to be considered before using this feature in your deployment.

• The MC's AD authentication only works for the same domain as the Domain Controller you have configured in the Management Console's SETTINGS > AUTHENTICATION > ACTIVE DIRECTORY CONFIGURATION tab

• Only supports on-premises Active Directory

• Only supports one active domain at a time

• Only supports UPN/AD and local user login

• Only supports uploading one AD certificate to the certificate store

  Upload the Root Certificate

  Upload the Root Certificate from the CA that issued the Domain Controller's certificate

• Configurations for parent groups do not transfer to child groups. Ensure the child group is configured as required.

• Does not support domain trust relationships

• A user must be member of at least one group created in the Active Directory Server that exists in the Management Console Active Directory Groups configuration.

• The Management Console Root DN field must include the users Active Directory Servers parent or child container's distinguished name (i.e. OU=Users,OU=Accounting,DC=domain,DC=local)

  

Installing an Active Directory Certificate¶

LDAPS requires a Base64 encoded certificate in .pem or .cer format to be uploaded to the certificate store. The LDAPS certificate should be downloaded from the same Active Directory that will be used for authentication. This can be done before or after enabling Active Directory.

To install your Active Directory Certificate:

1. Browse to SETTINGS > SECURITY and select the ADD CERTIFICATES tab.

2. Select the UPLOAD CERTIFICATE button.

3. Use the SELECT CERTIFICATE button and browse to where your Active Directory Certificate is located, highlight it and select the Open button.

4. Select the UPLOAD button and then OK in the Active Directory Certificate Details dialog.

5. Access the PCoIP Management Console virtual machine console, (see Accessing the PCoIP Management Console Virtual Machine Console) and run the import script located in /opt/teradici/scripts directory.

To run the script ensure you include the full path to the script and that you type the name of the correct AD uploaded certificate.

sudo /opt/teradici/scripts/import_ldaps_certificate.sh /opt/teradici/console/certs/adcerts/< certificate_name >

Viewing your Active Directory Certificate¶

You can view the Active Directory Certificate by viewing the ACTIVE DIRECTORY CERTIFICATES tab located on the SECURITY settings page.

Active Directory Certificates tab

Removing your Active Directory Certificate¶

Removing your Active Directory Certificate requires you to login to the PCoIP Management Console virtual machine console, see Accessing the PCoIP Management Console Virtual Machine Console to run the removal script located in the /opt/teradici/scripts directory.

Once logged in to the virtual machine console, browse to the opt/teradici/scripts directory and enter ./remove_ldaps_certificate.sh.

Creating and Enabling Active Directory Configuration¶

The optional Root DN field, allows you to limit where the Management Console search begins in Active Directory. The entries must be in the correct format and order. For example the format would be OU=Users,OU=Accounting,DC=domain,DC=local or DC=domain,DC=local or similar.

To create and enable an Active Directory configuration:

1. Log in to PCoIP Management Console

2. Browse to SETTINGS > AUTHENTICATION and select the ACTIVE DIRECTORY CONFIGURATION tab.

3. Select the NEW button.

4. Select your preferred protocol LDAP or LDAPS.

5. Enter the Host Name / IP Address of your Active Directory Server and any specific port that you want to use.

6. Enter the Domain Name that the Active Directory Server manages.

7. Enter the Root DN (optional).
   The Root DN or root distinguished name will tell Management Console which container in AD to start searching for approved Management Console users instead of searching the full list of domain users. Perform a group query (e.g. OU=Users,OU=Accounting,DC=domain,DC=local). Error messages for incorrect query strings will be presented that help guide the user using this method. Valid attributes are DC, CN, OU, O, STREET, L, ST, C, UID.
   

8. Save your configuration.

9. Return to the ACTIVE DIRECTORY CONFIGURATION tab and click Enable to enable the connection.
   The PCoIP Management Console will reboot.

10. Login to Management Console with your Active Directory UPN and domain password.

Adding Active Directory Groups¶

Adding Active Directory groups require that you have already enabled and configured Active Directory on the PCoIP Management Console. When adding Active Directory groups to PCoIP Management Console, ensure the added group has the identical name as the group in Active Directory and the Managing Users have been assigned to the group for PCoIP Management Console use. You can use just the group name or the group UPN name in this field.

To add or edit an active directory group:

1. Browse to SETTINGS > AUTHENTICATION and select the ACTIVE DIRECTORY GROUPS tab.

2. Select the ADD button.

3. Enter the required information.

   • Group: Enter the group name.

     Multiple Groups

     • The Active Directory Group cannot be nested under any other group.
     • If the name of the user is in multiple groups, the user in the first matching group is used.
     • If a user is removed from that Active Directory group, then the next listed group will be used.

   • Domain: Select the domain from the drop down where the Active Directory group resides.

   • Role: This will be the PCoIP Management Console role given to the user for use when logging into the PCoIP Management Console. User roles can be changed at any time from the Authentication page. See Managing Users for further information on Users and User Roles.

4. Select the SAVE button.

Added AD Group