Restrict AD Logins and User Lookup

Restriction AD user and group lookup using an LDAP filter.

The objective is to restrict PAM logins to a specific security group and on an object’s Grant Access (permissions) dialog only the authorized users should be shown up in the lookup.

 

The LDAP query is located in the file $PAM_HOME/web/conf/catalina.properties and the property is ldap.authn.searchFilter which is an AD / LDAP query to limit users for login (for basic authentication) and user lookups.

This property uses {0} as a placeholder for an account.

If you use the Federated Sign-In module, then the property to restrict login is cas.authn.ldap[1].userFilter with the account placeholder {user}.

 

The default value for ldap.authn.searchFilter is sAMAccountName={0}.

To switch to UPN authentication you can use UserPrincipalName={0}. Below is the example of more complex filter to limit user base to an AD group:

Copy 
(&(UserPrincipalName={0})(memberOf=CN=Group,OU=Users,DC=company,DC=com))

Note: CAS does not support secrets encryption in catalina.properties. All passwords configured in this file must be stored in plain text. When configuring multiple cas.authn.ldap[index] entries, include all LDAP configuration properties in the file. For encrypted secret support, configure CAS as described in the CAS encryption article.

In catalina.properties file, locate the cas.authn.ldap[index] properties associated with the Active Directory integration, for example cas.authn.ldap[1].

  1. Change the authentication type from `AD` to `AUTHENTICATED`.

  2. Add the bindDn value for the Active Directory account used to authenticate with LDAP. You can use the value of the ldap.managerDn property.

Note: The bindCredential value in catalina.properties is stored in unencrypted plain text.

For example:

Copy 
cas.authn.ldap[1].type=AUTHENTICATED
cas.authn.ldap[1].searchFilter=(&(sAMAccountName={user})(|(memberOf=CN=Domain Admins,CN=Users,DC=lab,DC=local)))
cas.authn.ldap[1].bindDn={Your PAM AD User Account} (such as CN=Administrator,CN=Users,DC=lab,DC=local)
cas.authn.ldap[1].bindCredential={The actual password for the CN=Administrator,CN=Users,DC=lab,DC=local user}

Other cas.authn.ldap[1] properties will remain the same.

 

Another popular way is to keep the search property as is, but instead to modify the branch entry into the AD forest using these parameters below.

This method is a quick way to limit the user base to some OU.

Both methods could be used together.

Copy 
ldap.rootDn
ldap.baseDn
ldap.roleBase
cas.authn.ldap[1].baseDn