Managing Domain Credentials

Introduced in 2022.1

Alloy Navigator Express helps you leverage LDAP authentication and continual user synchronization for remote Active Directory domains and directory services other than Microsoft Active Directory, such as JumpCloud, Okta, OneLogin, AWS Directory Service, and others.

A common use of LDAP (Lightweight Directory Access Protocol) is to provide a central place to store usernames and passwords. Using LDAP authentication in Alloy Navigator Express enables you to consolidate the credentials for all of your users in a single identity store, eliminating the need to remember additional sets of credentials for users and simplifying the task of creating and maintaining Alloy Navigator Express accounts for administrators.

In Alloy Navigator Express, LDAP authentication works as follows:

1. On the sign-in page of a web application (the Web App, Mobile App, or the Self Service Portal), users are required to type in their credentials that consist of a login name and password.

   IMPORTANT: Users must specify their login name in this format: DOMAIN\username.

2. The web application searches Domain Credentials records set up in the Alloy Navigator Express by the entered DOMAIN name. If the corresponding Domain Credentials record exists, the application uses the connection information stored there to look up the user account in the specified directory service container.

3. If that is successful, i.e. the corresponding user account exists and is active:

   • The Web App or Mobile App queries the Alloy Navigator Express database to see whether that user has a Technician account. If a matching Technician account exists and is active, the web application lets the technician in.

   • The Self Service Portal simply lets the user in. If the user's domain (container) is in the list of "trusted" containers, the user can sign in to the Self Service Portal without an Alloy Navigator Express account. For other containers, the Self Service Portal first checks whether the user has a matching SSP Customer account in the Alloy Navigator Express database.

To enable LDAP authentication , you must set up Domain Credentials records in the Services > Active Directory Integration > Domain Credentials section of the Admin Center. Alloy Navigator Express web applications will use information from those records to connect to the specified directory services to authenticate users.

To add a Domain Credentials record:

1. In Admin Center, go to Users & Security > SSO Providers and click New > Domain to open the Domain Credentials form.

2. In the Domain field, enter the name of your directory service (for example, JumpCloud). If you are connecting to a non-trusted Active Directory domain, enter the domain name.

   Alloy Navigator Express will use that name to match user credentials against it, so make sure that you provide the exact name used in your network.

IMPORTANT: To sign in to the Web App, Mobile App, or Self Service Portal, users are required to provide their usernames in this format: DOMAIN\UserName, where DOMAIN is the name that you specify in the Domain field here. Technicians must have Technician accounts in Alloy Navigator Express that match their DOMAIN\UserName usernames. For Self Service Portal users, SSP customer accounts in Alloy Navigator Express are not required

3. In the Server Name field, enter the name or IP address of your LDAP server (for example, ldap.jumpcloud.com). For an Active Directory domain, enter the name or IP address of a domain controller.

4. Under Directory Service, choose what you want to connect:

   • Active Directory - for connection to an Active Directory domain.

   • LDAP Server - for connection to the LDAP server using simple bind authentication. In the Users DN field below, enter a distinguished name (DN) for your Users container. This is the organizational unit where the directory service stores user information.

     For example, integration with JumpCloud requires a string in the following format:
     ou=Users,o=<organizationId>,dc=jumpcloud,dc=com,
     where o=<organizationId> is the ID that uniquely identifies your organization in the JumpCloud directory. For example:
     ou=Users,o=5f6cf0506fb08c77c1ee69fa,dc=jumpcloud,dc=com.

5. In the User Name field, enter a username or user ID, depending on how your directory service identifies users, for an account with enough permissions to read user information. In the Password field, enter the password.

6. If you want to enable secure TLS-encrypted connection, select the Secure Connection check box. Note that the default Port value has been changed to 636.

7. In the Port field next to the Server Name field, change the default port number, if needed.

8. Click Test Connection to test the specified connection information.

   FOR SECURE CONNECTION TO LDAP SERVER: If the TLS connection request fails, consider applying the steps from Microsoft Knowledge Base Article 2275950. The article suggests creating a registry subkey on the computer that establishes TLS-encrypted connection (i.e. on the Automation Server computer and the IIS server computer):

   1. Start Registry Editor.
   2. Locate the following subkey in the registry:
      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP
   3. Create a new REG_DWORD value that is named UseHostnameAsAlias, and set the value to anything other than zero. For example, 1.

   4. Exit Registry Editor, and then restart the computer.

9. Click OK to save your changes.

What do you want to do?

After you have integrated your directory service with Alloy Navigator Express and tested your connection, you will need to set up LDAP authentication for users. Use the table below as a reference for information required to perform different actions related to this task.

Related information:

Managing Active Directory Synchronization jobs

Creating or modifying Active Directory Synchronization jobs