Configure LDAP authentication
Configure InfluxDB Enterprise to use LDAP (Lightweight Directory Access Protocol) to:
- Validate user permissions
- Synchronize InfluxDB and LDAP so each LDAP request doesn’t need to be queried
LDAP requires JWT authentication. For more information, see Configure authentication using JWT tokens.
To configure InfluxDB Enterprise to support LDAP, all users must be managed in the remote LDAP service. If LDAP is configured and enabled, users must authenticate through LDAP, including users who may have existed before enabling LDAP.
- Configure LDAP for an InfluxDB Enterprise cluster
- Sample LDAP configuration
- Troubleshoot LDAP in InfluxDB Enterprise
Configure LDAP for an InfluxDB Enterprise cluster
To use LDAP with an InfluxDB Enterprise cluster, do the following:
- Configure data nodes
- Configure meta nodes
- Create, verify, and upload the LDAP configuration file
- Restart meta and data nodes
Configure data nodes
Update the following settings in each data node configuration file (/etc/influxdb/influxdb.conf
):
- Under
[http]
, enable HTTP authentication by settingauth-enabled
totrue
. (Or set the corresponding environment variableINFLUXDB_HTTP_AUTH_ENABLED
totrue
.) - Configure the HTTP shared secret to validate requests using JSON web tokens (JWT) and sign each HTTP payload with the secret and username.
Set the
[http]
configuration setting forshared-secret
, or the corresponding environment variableINFLUXDB_HTTP_SHARED_SECRET
. - If you’re enabling authentication on meta nodes, you must also include the following configurations:
INFLUXDB_META_META_AUTH_ENABLED
environment variable, or[http]
configuration settingmeta-auth-enabled
, is set totrue
. This value must be the same value as the meta node’smeta.auth-enabled
configuration.INFLUXDB_META_META_INTERNAL_SHARED_SECRET
, or the corresponding[meta]
configuration settingmeta-internal-shared-secret
, is set a secret value. This value must be the same value as the meta node’smeta.internal-shared-secret
.
Configure meta nodes
Update the following settings in each meta node configuration file (/etc/influxdb/influxdb-meta.conf
):
- Configure the meta node META shared secret to validate requests using JSON web tokens (JWT) and sign each HTTP payload with the username and shared secret.
- Set the
[meta]
configuration settinginternal-shared-secret
to"<internal-shared-secret>"
. (Or set theINFLUXDB_META_INTERNAL_SHARED_SECRET
environment variable.) - Set the
[meta]
configuration settingmeta.ldap-allowed
totrue
on all meta nodes in your cluster. (Or set theINFLUXDB_META_LDAP_ALLOWED
environment variable.)
Authenticate your connection to InfluxDB
To authenticate your InfluxDB connection, run the following command, replacing username:password
with your credentials:
curl -u username:password -XPOST "http://localhost:8086/..."
For more detail on authentication, see Authentication and authorization in InfluxDB.
Create, verify, and upload the LDAP configuration file
To create a sample LDAP configuration file, run the following command:
influxd-ctl ldap sample-config
Save the sample file and edit as needed for your LDAP server. For detail, see the sample LDAP configuration file below.
To use fine-grained authorization (FGA) with LDAP, you must map InfluxDB Enterprise roles to key-value pairs in the LDAP database. For more information, see Fine-grained authorization in InfluxDB Enterprise. The InfluxDB admin user doesn’t include permissions for InfluxDB Enterprise roles.
Restart all meta and data nodes in your InfluxDB Enterprise cluster to load your updated configuration.
On each meta node, run:
On each data node, run:
To verify your LDAP configuration, run:
influxd-ctl ldap verify -ldap-config /path/to/ldap.toml
To load your LDAP configuration file, run the following command:
influxd-ctl ldap set-config /path/to/ldap.toml
Sample LDAP configuration
The following is a sample configuration file that connects to a publicly available LDAP server.
A DN
(“distinguished name”) uniquely identifies an entry and describes its position in the directory information tree (DIT) hierarchy.
The DN of an LDAP entry is similar to a file path on a file system.
DNs
refers to multiple DN entries.
enabled = true
[[servers]]
enabled = true
[[servers]]
host = "<LDAPserver>"
port = 389
# Security mode for LDAP connection to this server.
# The recommended security is set "starttls" by default. This uses an initial unencrypted connection
# and upgrades to TLS as the first action against the server,
# per the LDAPv3 standard.
# Other options are "starttls+insecure" to behave the same as starttls
# but skip server certificate verification, or "none" to use an unencrypted connection.
security = "starttls"
# Credentials to use when searching for a user or group.
bind-dn = "cn=read-only-admin,dc=example,dc=com"
bind-password = "password"
# Base DNs to use when applying the search-filter to discover an LDAP user.
search-base-dns = [
"dc=example,dc=com",
]
# LDAP filter to discover a user's DN.
# %s will be replaced with the provided username.
search-filter = "(uid=%s)"
# On Active Directory you might use "(sAMAccountName=%s)".
# Base DNs to use when searching for groups.
group-search-base-dns = ["dc=example,dc=com"]
# LDAP filter to identify groups that a user belongs to.
# %s will be replaced with the user's DN.
group-membership-search-filter = "(&(objectClass=groupOfUniqueNames)(uniqueMember=%s))"
# On Active Directory you might use "(&(objectClass=group)(member=%s))".
# Attribute to use to determine the "group" in the group-mappings section.
group-attribute = "ou"
# On Active Directory you might use "cn".
# LDAP filter to search for a group with a particular name.
# This is used when warming the cache to load group membership.
group-search-filter = "(&(objectClass=groupOfUniqueNames)(cn=%s))"
# On Active Directory you might use "(&(objectClass=group)(cn=%s))".
# Attribute of a group that contains the DNs of the group's members.
group-member-attribute = "uniqueMember"
# On Active Directory you might use "member".
# Create an administrator role in InfluxDB and then log in as a member of the admin LDAP group. Only members of a group with the administrator role can complete admin tasks.
# For example, if tesla is the only member of the `italians` group, you must log in as tesla/password.
admin-groups = ["italians"]
# These two roles would have to be created by hand if you want these LDAP group memberships to do anything.
[[servers.group-mappings]]
group = "mathematicians"
role = "arithmetic"
[[servers.group-mappings]]
group = "scientists"
role = "laboratory"
Troubleshoot LDAP in InfluxDB Enterprise
- InfluxDB Enterprise does not recognize a new LDAP server
- User cannot log in after updating their password in the LDAP server
InfluxDB Enterprise does not recognize a new LDAP server
If you ever replace an LDAP server with a new one, you need to update your InfluxDB Enterprise LDAP configuration file to point to the new server. However, InfluxDB Enterprise may not recognize or honor the updated configuration.
For InfluxDB Enterprise to recognize an LDAP configuration pointing to a new LDAP server, do the following:
Not recommended in production InfluxDB Enterprise clusters
Performing the following process on a production cluster may have unintended consequences. Moving to a new LDAP server constitutes and infrastructure change and may better be handled through a cluster migration. For assistance, reach out to InfluxData support.
On each meta node, update the
auth-enabled
setting tofalse
in yourinfluxdb-meta.conf
configuration file to temporarily disable authentication.[meta] auth-enabled = false
Restart all meta nodes to load the updated configuration. On each meta node, run:
On each meta node, create, verify, and upload the new LDAP configuration file.
On each meta node, update the
auth-enabled
setting totrue
in yourinfluxdb-meta.conf
configuration file to reenable authentication.[meta] auth-enabled = true
Restart all meta nodes to load the updated configuration. On each meta node, run:
User cannot log in after updating their password in the LDAP server
LDAP credentials are cached on InfluxDB Enterprise data nodes. If credentials change in the LDAP server, the cached credentials need to be purged and the cache refreshed to add the updated credentials.
Use the
influxd-ctl ldap purge-cache
command to purge LDAP credential caches on data nodes.influxd-ctl ldap purge-cache
Use the
influxd-ctl ldap warm-cache
command to warm LDAP credential caches on data nodes.influxd-ctl ldap warm-cache
Was this page helpful?
Thank you for your feedback!
Support and feedback
Thank you for being part of our community! We welcome and encourage your feedback and bug reports for InfluxDB and this documentation. To find support, use the following resources:
Customers with an annual or support contract can contact InfluxData Support.