Summary
This article walks you through implementing LDAP Authentication in your Yellowfin instance using Active Directory. Before starting, please review the LDAP Connection Settings article to familiarise yourself with the requirements.
Links to related LDAP tasks can be found at the bottom of this article.
Active Directory
To begin, here is a quick overview of the Active Directory instance we will be authenticating against.
In this example, a domain called yellowfin.support has been created on the domain controller, along with an Organisation Unit (OU) called Yellowfin Folder. This folder will store the users and groups that you want to grant Yellowfin access to.
Configuring Yellowfin
Navigate to Administration > Configuration > Authentication (padlock icon) and set the Authentication Method to LDAP.
This will reveal the LDAP Configuration section. Expand it and configure each setting as described below.
LDAP Host
Enter the hostname or IP address of your Active Directory server.
LDAP Port
Unless you have made custom changes to your LDAP configuration, use port 389 for standard LDAP connections, or 636 for encrypted connections.
Encryption
Set this to match whether your LDAP connection needs to be encrypted. If you are unsure, consult your IT Administrator.
LDAP Base DN
The Base DN tells Yellowfin where to begin its recursive search of the LDAP directory. If your Yellowfin users are not all in a single group, set this to your base domain. For example:
DC=yellowfin,DC=support
LDAP Group
This setting defines which group membership Yellowfin will check before allowing a user access. In this example, a global security group called YFgroup has been created in Active Directory.
The following value instructs Yellowfin to verify membership of this group before granting access:
CN=YFgroup,OU=Yellowfin Folder,DC=yellowfin,DC=support
This is interpreted as: CN = group name, OU = the folder the group is in, DC = your domain components from the Base DN.
LDAP Bind User
Enter the username of a user with sufficient rights to search your LDAP directory. Using admin credentials for this is not recommended. If you are unsure how to create a suitable service account, contact your IT Administrator. The username must be in either NETBIOS or full domain format, for example:
Administrator@yellowfin.support YELLOWFIN\Administrator
LDAP Bind Password
Enter the password for the Bind User above. You must click Update Password before testing your settings.
LDAP Search Attribute
This setting depends on whether your Yellowfin instance uses email addresses or user IDs for authentication. The default is email. To find the correct attribute, open the properties of an LDAP user object and review the Attribute Editor tab. Use the Filter option to show only attributes with values.
In this example, userPrincipalName holds the email address. Since Yellowfin is configured for email authentication, we will use this for the value of LDAP Search Attribute. Enter it in its simple format:
userPrincipalName
LDAP First Name Attribute
Yellowfin requires a first and last name for each user. Review your LDAP attributes and enter the one that holds the first name. In this example, the attribute is givenName.
LDAP Last Name Attribute
Enter the attribute that holds the user's last name. In this example, the attribute sn contains the surname.
LDAP Role Attribute
You can pre-assign a Yellowfin role to users via an LDAP attribute before their first login. If this is not set, users will receive the default Consumer & Collaborator role.
In this example, the title attribute on the ldapadmin user has been set to YFADMIN. Enter title as the LDAP Role Attribute value.
LDAP Group Filtering Criteria
This setting allows you to filter which LDAP Groups are available when pulling groups into Yellowfin. Leave this field empty if you do not require filtering.
Ordering
This setting determines how Yellowfin handles authentication attempts. In most cases, leave this set to the default LDAP Authentication First. The alternative is useful if you maintain some internal Yellowfin accounts that are not managed through LDAP.
Testing and Saving
Once all settings are configured, your LDAP Configuration section should look similar to the following:
Click Test to verify the connection. A successful result will be displayed as shown below:
Click Save near the top of the screen. You can now log in as an LDAP user. Since Yellowfin is configured for email authentication in this example, enter the user's email address and their LDAP password:
ldapuser1@yellowfin.support
This will create the user account within Yellowfin without storing a password. Authentication is always passed through to your LDAP service.
To verify role assignment, log in with the ldapadmin@yellowfin.support account. You should see that the role set via the title attribute has been automatically applied:
Related Articles
- LDAP Users in Yellowfin
- Create Yellowfin Groups from LDAP Groups
- Assigning LDAP Users to Client Orgs
If you have any further questions on this article, contact Support with a new ticket or send us an email.