使用Artifactory 6.x ?
JFrog Artifactory 6.x User Guide
Have a question? Want to report an issue?Contact JFrog support
Skip to end of metadata
Go to start of metadata
Introduction
Artifactory supports integration with an Active Directory server to authenticate users and synchronize groups.
When authentication using Active Directory is configured and active, Artifactory first attempts to authenticate the user against the Active Directory server. If the authentication fails, Artifactory tries to authenticate via its internal database.
For every externally authenticated user configured in your Active Directory server, Artifactory creates a new user in the internal database (provided the user does not already exist), and automatically assigns that user to the default groups.
Working With Active Directory
We will describe how to configure Artifactory to work with Active Directory using an example.
考虑一个Active Directory服务器必须增刊ort the following conditions:
- Users are located in two geographically separated sites. Some are in the US (designated as "us"), while others are in Israel (designated as "il").
- Each site defines users and groups in different places in the Active Directory tree as displayed below.
To configure Active Directory authentication, in theAdminmodule, go toSecurity | LDAPand clickNew.
The configuration parameters are as follows:
Settings Name |
The unique ID of the Active Directory setting. |
Enabled |
When set, these settings are enabled. |
Active Directory URL |
Location of the Active Directory server LDAP access point in the following format: The URL may include the base DN used to search for and/or authenticate users. If not specified, theSearch Basefield is required. |
User DN Pattern |
A DN pattern used to log users directlyin tothe LDAP database. For Active Directory,we recommendleaving this field blanksincethisonly works if anonymous binding is allowed and a direct user DN can be used, which is not the default case in Active Directory. |
Auto Create Artifactory Users |
When set, Artifactory will automatically create new users for those who have logged in using Active Directory. Any newly created users will be associated to the default groups. |
Email Attribute |
An attribute that can be used to map a user's email to a user created automatically by Artifactory. This corresponds to themailfield in Active Directory. |
Search Filter |
A filter expression used to search for the user DN that is used in Active Directory authentication. For Active Directorythe corresponding field should be |
Search Base |
The Context name in which to search relative to the base DN in the Active Directory URL. This parameter is optional, but if possible, we highly recommend that you set it to prevent long searches on the Active Directory tree. Leaving this field blank will significantly slow down the Active Directory integration. The configuration in the example below indicates that search should only be performed under "frogs/il" or "frogs/us". This improves search performance since Artifactory will not search outside the scope of the "frogs" entry. |
Manager DN |
The full DN of a user with permissions that allow querying the Active Directory server. When working with LDAP Groups, the user should have permissions for any extra group attributes such asmemberOf. |
Manager Password |
The password of the user binding to the Active Directory server when using "search" authentication. |
Search Sub Tree |
When set, enables deep search through the sub-tree of the Active Directory URL + Search Base. True by default. |
Importing Active Directory Groups
Active Directory groups can be imported using either aStatic映射策略或Dynamicone (Active Directory works for both).
The only difference is in the attribute defined on the corresponding Active Directory entry:
- The Static mapping strategy defines a "member" multi-value attribute on thegroupentry containing user DNs of the group members
- The "Dynamic" configuration defines a "memberOf" multi-valueattribute on theuserentry containing group DNs ofthe groups the user is a member of.
Active Directory supports both configurations, so you can choose the one which fits your organization's structure.
Support for Nested Groups
Artifactory supports synchronization with Active Directory "Nested Groups".
Microsoft provides a unique OID for rule chain matching as part of thesearch filter syntax, so when executing an LDAP Query to Active Directory using this OID, Active Directory returns a list of all the groups that a user's main group membership inherits from.
The screenshot below shows the following example:
Mapping Strategy: Static
Group Membership Attribute: member:1.2.840.113556.1.4.1941:
Group Name Attribute: cn
Filter(objectClass =集团)
使用Secure Active Directory
To use Secure Active Directory with a valid certificate from a CA trusted by Java, all you need to do us use a secure Active Directory URL in your settings, e.g.ldaps://secure_ldap_host:636/dc=sampledomain,dc=com.
If you want to use Secure Active Directory with a non-trusted (self-signed) certificate, please follow the steps described in使用a Self-Signed Certificate.
Manager DN
To construct the Manager DN string according to your Active Directory server, navigate to a user with administrator privileges (e.g. Administrator (1)), and then construct the Manager DN in reverse order (2,3) from the User, up the folder hierarchy. Notice that the domain (3) is split in reverse order to |
|
Overview
Content Tools