Enterprise Sign On

Hammerspace can be configured to use Active Directory to control management access.

This functionality is specific to the management of the Hammerspace infrastructure and does not impact the customer’s regular data authentication for SMB, NFS, or S3 protocols.

Limitations

All configuration is done using the Admin CLI or REST API. There is no GUI support.
If you configure multiple IDP sources and use a group that exists in both IDP domains, then users from that group from both IDP domains will be able to log in.
AD users must have their UserPrincipalName populated with their <username>@<domain>.

Active Directory users are subject to the login rules and password expiration of their Active Directory environment. Local Product rules, such as the number of failed logins, are only enforced for local users and are not applied to Active Directory users.

Setting Up Enterprise Sign On

Configuring the system to accept authentication against external identity providers involves a two-step process. The first step is to add the identity provider, and the second step is to configure which group of that identity provider should be used.

Example scenario

If you want to configure Hammerspace to use the group "Hammerspace Admins" from your Active Directory server. Members of the group should be assigned the admin role when they log in using the GUI or CLI.

Example-scenario workflow

This procedure provides instructions for how to add Active Directory as an identity provider in Hammerspace. Once Active Directory is added, users can log in to the GUI using their Active Directory credentials.

Add Active Directory as an identity provider.

Admin CLI

Command:

idp-add --name PM_DOM_A --domain a.pm.test --type AD --servers ad0.a.pm.test

Expected output:

ID:                           8590b98a-acaf-4f35-baed-024f0fa217c2
Name:                         PM_DOM_A
Type:                         Active Directory
Domain:                       a.pm.test
Servers:                      ad0.a.pm.test
Connection security:          None
Validate server certificates: Disabled

Identity providers can be viewed, updated, and removed with the idp-list, idp-update, and idp-remove commands.

Configure group-to-role mapping. Add an identity-group mapping for members of the Hammerspace Admins group to be recognized with the admin-level group.

Admin CLI

Command:

identity-group-mapping-create --name Hammerspace_admins --group "Hammerspace Admins" --role-name admin

Expected output:

ID:                      aa2d6e74-d0c2-478c-b57b-14be93c7f395
Name:                    Hammerspace_admins
Group:                   Hammerspace Admins
Management role:         admin

Log in to the GUI. Members of the Hammerspace Admins group can now log in to the Management GUI with their credentials.

Figure 1. Example login screen with domain address

The username must include the domain to ensure it is not authenticated against local users.

Securing the Connection to the Identity Provider

Starting with Hammerspace 5.3, the connection that Hammerspace uses to check management sign-ins against an Active Directory identity provider can be encrypted. Set the encryption with the --connection-security option of idp-add, or change it later with idp-update:

TLS: LDAPS, encrypted from the start of the connection (port 636). SSL is accepted as a synonym.
STARTTLS: the connection starts on port 389 and is then upgraded to TLS.
NONE: not encrypted.

Hammerspace does not validate the server’s certificate unless you turn validation on with --validate-server-certs-enable.

To encrypt the connection and validate the server’s certificate:

Add the CA certificate that signed the Active Directory server’s certificate to the cluster’s trusted certificates, in the Management GUI under Administration TLS Trusted Certificates or with the cert-add command. See Add a Trusted CA Certificate Using the Management GUI.
Set the connection security and turn on certificate validation for the identity provider. For example:
```
idp-update --name <idp-name> --connection-security TLS --validate-server-certs-enable
```

After an upgrade to 5.3, existing identity providers use connection security NONE, with certificate validation not set. Configure each one explicitly.
To turn validation off for an existing identity provider, use idp-update --validate-server-certs-disable. idp-add has no option to turn it off.
Hammerspace does not watch the Active Directory server for later changes to its TLS configuration. If that configuration changes, update the identity provider to match.