Connecting over LDAP

LDAP connections are created and managed under Settings → LDAP in the KUMA web interface. The LDAP table shows the tenants for which LDAP connections were created. The connections are displayed when a tenant is selected.

To add a tenant to the LDAP section:

1. In the KUMA web interface, under Settings → LDAP, click Add.
2. In the LDAP connections window, in the Tenant drop-down list, select the relevant tenant and click Save.

The tenant will be added and displayed in the LDAP table.

If you select a tenant, the LDAP connections window opens to show a table containing existing LDAP connections. Connections can be created or selected for editing.

After integration is enabled, information about Active Directory accounts becomes available in the alert window, the correlation events detailed view window, and the incidents window. If you click an account name in the Related users section of the window, the Account details window opens with the data imported from Active Directory.

Data from LDAP can also be used when enriching events in collectors and in analytics.

Imported Active Directory attributes

In the Data storage time field, you can specify how many days KUMA will store information received from LDAP after such information stops being received from the Active Directory server.

Enabling and disabling LDAP integration

You can enable or disable all LDAP connections of the tenant at the same time, or enable and disable an LDAP connection individually.

To enable or disable all LDAP connections of a tenant:

1. Open Settings → LDAP in the KUMA web interface and select the tenant for which you want to enable or disable all LDAP connections.

   The LDAP connections window opens.

2. Select or clear the Disabled check box.
3. Click Save.

To enable or disable a specific LDAP connection:

1. Open Settings → LDAP in the KUMA web interface and select the tenant for which you want to enable or disable an LDAP connection.

   The LDAP connections window opens.

2. Select the relevant connection and either select or clear the Disabled check box in the opened window.

Creating a connection

To create a new LDAP connection to Active Directory:

1. Open the Settings → LDAP section in the KUMA web interface.
2. Select the tenant for which you want to create a connection to LDAP.

   The LDAP connections window opens.

3. Click the Add LDAP connection button.

   The LDAP connection window opens.

4. Add a secret containing the account credentials for connecting to the Active Directory server. To do so:
   1. If you previously added a secret, use the Secret drop-down list to select the existing secret resource (with the credentials type).

      The selected secret can be changed by clicking on the button.

   2. If you want to create a new secret, click the button.

      The Secret window opens.

   3. In the Name (required) field, enter the name of the resource. This name can contain from 1 to 128 Unicode characters.
   4. In the User and Password (required) fields, enter the account credentials for connecting to the Active Directory server.

      You can enter the user name in one of the following formats: <user name>@<domain> or <domain><user name>.

   5. In the Description field, you can enter up to 256 Unicode characters to describe the resource.
   6. Click the Save button.
5. In the Name (required) field, enter the unique name of the LDAP connection.

   Must contain from 1 to 128 Unicode characters.

6. In the URL (required) field, enter the address of the domain controller in the format <hostname or IP address of server>:<port>.

   In case of server availability issues, you can specify multiple servers with domain controllers by separating them with commas. All of the specified servers must reside in the same domain.

7. In the TLS mode select whether you want to use TLS encryption for domain controllers connection. When using an encrypted connection, it is impossible to specify an IP address as a URL.
8. If you enabled TLS encryption at the previous step, add a TLS certificate. To do so:
   1. If you previously uploaded a certificate, select it from the Certificate drop-down list.
   2. If you want to upload a new certificate, click the button on the right of the Certificate list.

      The Secret window opens.

   3. In the Name field, enter the name that will be displayed in the list of certificates after the certificate is added.
   4. Click the Upload certificate file button to add the file containing the Active Directory certificate. X.509 certificate public keys in Base64 are supported.
   5. If necessary, provide any relevant information about the certificate in the Description field.
   6. Click the Save button.

   The certificate will be uploaded and displayed in the Certificate list.

9. In the Timeout in seconds field, indicate the amount of time to wait for a response from the domain controller server.

   If multiple addresses are indicated in the URL field, KUMA will wait the specified amount of seconds for a response from the first server. If no response is received during that time, the program will contact the next server, and so on. If none of the indicated servers responds during the specified amount of time, the connection will be terminated with an error.

10. If necessary in the RPS field, enter the number of requests per second in cron format. By default, the information is requested once per day.
11. If necessary in the Filter field, specify an LDAP filter. For example, “(&(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))”.

    sAMAccountType = 805306368 filter is required. If it is missing in the user filter expression, it will be added to the Active Directory request automatically.

12. In the Base DN field, enter the base distinguished name of the directory where the search request should be performed.
13. If necessary in the Size limit per request field, enter the maximum size of the request.
14. Select the Disabled check box if you do not want to use this LDAP connection.

    This check box is cleared by default.

15. Click the Save button.

The LDAP connection to Active Directory will be created and displayed in the LDAP connection window.

Account information from Active Directory will be requested in 12 hours. To make the data available right away, restart the KUMA Core server. Account information is updated every 12 hours.

If you want to use multiple LDAP connections simultaneously for one tenant, you need to make sure that the domain controller address indicated in each of these connections is unique. Otherwise KUMA lets you enable only one of these connections. When checking the domain controller address, the program does not check whether the port is unique.

Removing a connection

To delete LDAP connection to Active Directory:

1. Open Settings → LDAP in the KUMA web interface and select the tenant that owns the relevant LDAP connection.

   The LDAP connections window opens.

2. Click the LDAP connection you want to delete and click the Delete button.

The LDAP connection to Active Directory will be deleted.