Search…
LDAP Integration
OmniSci supports LDAP authentication using an IPA Server or Microsoft Active Directory.
You can configure OmniSci Enterprise edition to map LDAP roles 1-to-1 to OmniSci roles. When you enable this mapping, LDAP becomes the main authority controlling user roles in OmniSci.
LDAP mapping is available only in OmniSci Enterprise edition.
OmniSci supports five configuration settings that allow you to integrate with your LDAP server.
Parameter
Description
Example
ldap-uri
LDAP server host or server URI.
ldap://myLdapServer.myCompany.com
ldap-dn
LDAP distinguished name (DN).
uid=$USERNAME,cn=users,cn=accounts, dc=myCompany,dc=com
ldap-role-query-url
Returns the role names a user belongs to in the LDAP.
ldap://myServer.myCompany.com/uid=$USERNAME, cn=users, cn=accounts,dc=myCompany,dc=com?memberOf
ldap-role-query-regex
Applies a regex filter to find matching roles from the roles in the LDAP server.
(MyCompany_.*?),
ldap-superuser-role
Identifies one of the filtered roles as a superuser role. If a user has this filtered ldap role, the user is marked as a superuser.
MyCompany_SuperUser

Obtaining Credential Information

To find the ldap-role-query-url and ldap-role-query-regex to use, query your user roles. For example, if there is a user named kiran on the IPA LDAP server ldap://myldapserver.mycompany.com, you could use the following curl command to get the role information:
1
$ curl --user "uid=kiran,cn=users,cn=accounts,dc=mycompany,dc=com"
2
"ldap://myldapserver.mycompany.com/uid=kiran,cn=users,cn=accounts,dc=mycompany,dc=com?memberOf"
Copied!
When successful, it returns information similar to the following:
1
DN: uid=kiran,cn=users,cn=accounts,dc=mycompany,dc=com
2
memberOf: cn=ipausers,cn=groups,cn=accounts,dc=mycompany,dc=com
3
memberOf: cn=MyCompany_SuperUser,cn=roles,cn=accounts,dc=mycompany,dc=com
4
memberOf: cn=test,cn=groups,cn=accounts,dc=mycompany,dc=com
Copied!
    ldap-dn matches the DN, which is uid=kiran,cn=users,cn=accounts,dc=mycompany,dc=com.
    ldap-role-query-url includes the LDAP URI + the DN + the LDAP attribute that represents the role/group the member belongs to, such as memberOf.
    ldap-role-query-regex is a regular expression that matches the role names. The matching role names are used to grant and revoke privileges in OmniSci. For example, if we created some roles on an IPA LDAP server where the role names begin with MyCompany_ (for example, MyCompany_Engineering, MyCompany_Sales, MyCompany_SuperUser), the regular expression can filter the role names using MyCompany_.
    ldap-superuser-role is the role/group name for OmniSci users who are superusers once they log on to the OmniSci database. In this example, the superuser role name is MyCompany_SuperUser.
Make sure that LDAP configuration appears before the [web] section of omnisci.conf.
Double quotes are not required for LDAP properties in omnisci.conf. For example, both of the following are valid:
ldap-uri = "ldap://myldapserver.mycompany.com" ldap-uri = ldap://myldapserver.mycompany.com

Setting Up LDAP with OmniSci

To integrate LDAP with OmniSci, you need the following:
    A functional LDAP server, with all users/roles/groups created (ldap-uri, ldap-dn, ldap-role-query-url, ldap-role-query-regex, and ldap-superuser-role) to be used by OmniSci. You can use the curl command to test and find the filters.
    A functional OmniSci server, version 4.1 or higher.
Once you have your server information, you can configure OmniSci to use LDAP authentication.
    1.
    Locate the omnisci.conf file and edit it to include the LDAP parameter. For example:
    1
    ldap-uri = "ldap://myldapserver.mycompany.com"
    2
    ldap-dn = "uid=$USERNAME,cn=users,cn=accounts,dc=mycompany,dc=com"
    3
    ldap-role-query-url = "ldap://myldapserver.mycompany.com/uid=$USERNAME,cn=users,cn=accounts,dc=mycompany,dc=com?memberOf"
    4
    ldap-role-query-regex = "(MyCompany_.*?),"
    5
    ldap-superuser-role = "MyCompany_SuperUser"
    Copied!
    2.
    Restart the OmniSci server:
    1
    sudo systemctl restart omnisci_server
    2
    sudo systemctl restart omnisci_web_server
    Copied!
    3.
    Log on to omnisql as MyCompany user, or any user who belongs to one of the roles/groups that match the filter.
When you use LDAP authentication, the default admin user and password HyperInteractive do not work unless you create the admin user with the same password on the LDAP server.
If your login fails, inspect $OMNISCI_STORAGE/mapd_log/omnisci_server.INFO to check for any obvious errors about LDAP authentication.
Once you log in, you can create a new role name in omnisql, and then apply GRANT/REVOKE privileges to the role. Log in as another user with that role and confirm that GRANT/REVOKE works.
If you refresh the browser window, you are required to log in and reauthenticate.

Using LDAPS

To use LDAPS, OmniSci must trust the LDAP server's SSL certificate. To achieve this, you must have the CA for the server's certificate, or the server certificate itself. Install the certificate as a trusted certificate.

IPA on CentOS

To use IPA as your LDAP server with OmniSci running on CentOS 7:
    1.
    Copy the IPA server CA certificate to your local machine.
    1
    scp [email protected]:/etc/ipa/ca.crt /etc/pki/ca-trust/source/anchors/ipa-ca.pem
    Copied!
    2.
    Update the PKI certificates.
    1
    update-ca-trust
    Copied!
    3.
    Edit /etc/openldap/ldap.conf to add the following line.
    1
    TLS_CACERT /etc/pki/tls/certs/ca-bundle.crt
    Copied!
    4.
    Locate the omnisci.conf file and edit it to include the LDAP parameter. For example:
    1
    ldap-uri = "ldaps://myldapserver.mycompany.com"
    2
    ldap-dn = "uid=$USERNAME,cn=users,cn=accounts,dc=mycompany,dc=com"
    3
    ldap-role-query-url = "ldaps://myldapserver.mycompany.com/uid=$USERNAME,cn=users,cn=accounts,dc=mycompany,dc=com?memberOf"
    4
    ldap-role-query-regex = "(MyCompany_.*?),"
    5
    ldap-superuser-role = "MyCompany_SuperUser"
    Copied!
    5.
    Restart the OmniSci server:
    1
    sudo systemctl restart omnisci_server
    2
    sudo systemctl restart omnisci_web_server
    Copied!

IPA on Ubuntu

To use IPA as your LDAP server with OmniSci running on Ubuntu:
    1.
    Copy the IPA server CA certificate to your local machine.
    1
    mkdir /usr/local/share/ca-certificates/ipa
    2
    scp [email protected]:/etc/ipa/ca.crt /usr/local/share/ca-certificates/ipa/ipa-ca.pem
    Copied!
    2.
    Rename ipa-ca.crm to ipa-ca.crt so that the certificates bundle update script can find it:
    1
    mv /usr/local/share/ca-certificates/ipa/ipa-ca.pem /usr/local/share/ca-certificates/ipa/ipa-ca.crt
    Copied!
    3.
    Update the PKI certificates:
    1
    update-ca-certificates
    Copied!
    4.
    Edit /etc/openldap/ldap.conf to add the following line:
    1
    TLS_CACERT /etc/ssl/certs/ca-certificates.crt
    Copied!
    5.
    Locate the omnisci.conf file and edit it to include the LDAP parameter. For example:
    1
    ldap-uri = "ldaps://myldapserver.mycompany.com"
    2
    ldap-dn = "uid=$USERNAME,cn=users,cn=accounts,dc=mycompany,dc=com"
    3
    ldap-role-query-url = "ldaps://myldapserver.mycompany.com/uid=$USERNAME,cn=users,cn=accounts,dc=mycompany,dc=com?memberOf"
    4
    ldap-role-query-regex = "(MyCompany_.*?),"
    5
    ldap-superuser-role = "MyCompany_SuperUser"
    Copied!
    6.
    Restart the OmniSci server:
    1
    sudo systemctl restart omnisci_server
    2
    sudo systemctl restart omnisci_web_server
    Copied!

Active Directory

1. Locate the omnisci.conf file and edit it to include the LDAP parameter.
Example 1:
1
ldap-uri = "ldap://myldapserver.mycompany.com"
2
ldap-dn = "cn=$USERNAME,cn=users,dc=qa-mycompany,dc=com"
3
ldap-role-query-url = "ldap:///myldapserver.mycompany.com/cn=$USERNAME,cn=users,dc=qa-mycompany,dc=com?memberOf"
4
ldap-role-query-regex = "(OMNISCI_.*?),"
5
ldap-superuser-role = "OMNISCI_SuperUser"
Copied!
Example 2:
1
ldap-uri = "ldap://myldapserver.mycompany.com"
2
ldap-dn = "[email protected]"
3
ldap-role-query-url = "ldap:///myldapserver.mycompany.com/OU=MyCompany Users,dc=MyCompany,DC=com?memberOf?sub?(sAMAccountName=$USERNAME)"
4
ldap-role-query-regex = "(OMNISCI_.*?),"
5
ldap-superuser-role = "OMNISCI_SuperUser"
Copied!
2. Restart the OmniSci server:
1
sudo systemctl restart omnisci_server
2
sudo systemctl restart omnisci_web_server
Copied!
Other LDAP user authentication attributes, such as userPrincipalName, are not currently supported.
Last modified 3mo ago