Tools

Active Directory Authentication setting for Kiwi Syslog Server Web Access

This setting allows an administrator to configure the Active Directory Authentication for Kiwi Web Access. AD users must use their Login ID as “domain\domain ID”. Then Kiwi Web Access will authenticate users through AD.

First published date

11/29/2018 10:29 PM

Last published date

5/24/2023 10:36 PM

Overview

The AD Authentication setting allows an administrator to configure the Active Directory Authentication for Kiwi Web Access (KWA). The AD user must use their Login ID as “domain\domain ID” so that Kiwi Web Access can allow authentication through AD.

Product section

Kiwi Syslog Server

Resolution

Configuring the AD authentication settings

  1. Sign in to the Kiwi Syslog web access using an Administrator account.

  2. Click on the Admin Tab

  3. Scroll down to the Active Directory Settings section.

    • *Note: The machine you are accessing the Kiwi Web Server from needs to be joined to a domain before configuring the AD authentication settings.


Domain URL:  Enter the Active Directory LDAP URL. For example:

Domain (FQDN): server.domain.com


Authentication Type:

This setting determines how the KWA Server is interacting with the Domain Server by using the Domain URL. If the field is empty, the application will treat it as "Secure" by default. The available authentication types are:

Anonymous

No authentication is performed.

Delegation

Enables Active Directory Services Interface (ADSI) to delegate the user's security context, which is necessary for moving objects across domains.

Encryption

Attaches a cryptographic signature to the message that both identifies the sender and ensures that the message has not been modified in transit.

FastBind

Specifies that ADSI will not attempt to query the Active Directory Domain Services objectClass property. Therefore, only the base interfaces that are supported by all ADSI objects will be exposed. Other interfaces that the object supports will not be available. A user can use this option to boost the performance in a series of object manipulations that involve only methods of the base interfaces. However, ADSI does not verify if any of the request objects actually exist on the server.

None

Equates to zero, which means to use basic authentication (simple bind) in the LDAP provider.

ReadonlyServer

For a WinNT provider, ADSI tries to connect to a domain controller. For Active Directory Domain Services, this flag indicates that a writable server is not required for a serverless binding.

Sealing

Encrypts data using Kerberos. The Secure flag must also be set to use sealing.

Secure

Requests secure authentication. When this flag is set, the WinNT provider uses NTLM to authenticate the client. Active Directory Domain Services uses Kerberos, and possibly NTLM, to authenticate the client. When the user name and password are a null reference (Nothing in Visual Basic), ADSI binds to the object using the security context of the calling thread, which is either the security context of the user account under which the application is running or of the client user account that the calling thread is impersonating.

SecureSocketsLayer

Attaches a cryptographic signature to the message that both identifies the sender and ensures that the message has not been modified in transit. Active Directory Domain Services requires the Certificate Server to be installed to support Secure Sockets Layer (SSL) encryption.

ServerBind

If your ADsPath includes a server name, specify this flag when using the LDAP provider. Do not use this flag for paths that include a domain name or for server-less paths. Specifying a server name without also specifying this flag results in unnecessary network traffic.

Signing

Verifies data integrity to ensure that the data received is the same as the data sent. The Secure flag must also be set to use signing.


User Groups: An administrator can restrict access to Kiwi Web Access to specific domain user groups. Multiple user groups can also be provided here (separated by a ";"). For example:

  • User Groups: Group Admins;Group Users


Example Active Directory Settings 

  • Domain (FQDN): server.domain.com
  • Authentication Type: <blank>, defaults to Secure
  • ​​​​​​​User Groups: Domain Admins;Domain Admin2
    • ​​​​​​​Note: Individual user configuration for LDAP access is not possible.