# Configure Control Center with LDAP Authentication on Confluent Platform Control Center provides HTTP Basic authentication through [JAAS](https://docs.oracle.com/javase/8/docs/technotes/guides/security/jaas/tutorials/GeneralAcnOnly.html). The following tutorial describes the steps necessary to enable HTTP Basic authentication backed by LDAP. This includes but is not limited to the Active Directory (AD) LDAP implementation. ## Escaping special characters #### IMPORTANT [Escape](https://tools.ietf.org/html/rfc4514#section-2.4) any restricted LDAP characters. For best results, avoid characters that require escaping. Follow [Best Practices for LDAP Naming Attributes](https://ldapwiki.com/wiki/Wiki.jsp?page=Best%20Practices%20For%20LDAP%20Naming%20Attributes). | Character | Description | |-------------|-----------------------------------| | `,` | Comma [1](#id4) | | `\` | Backslash | | `#` | Pound (hash) [2](#id5) | | `+` | Plus sign | | `=` | Equals sign | | `<` | Less than | | `>` | Greater than | | `;` | Semi-colon | | `''` | Double quote | | | Spaces [3](#id6) | * **[1]** Requires escaping with a double backslash or `\5c`. See [RFC 2254](https://datatracker.ietf.org/doc/html/rfc2254). * **[2]** You only need to escape pound (hash) `#` if it occurs at the beginning of a string. * **[3]** Leading or trailing spaces must be escaped. Embedded spaces are not escaped. ### Configure Control Center JAAS 1. Create a JAAS configuration file with the following content and save as `control-center-jaas.conf`. #### NOTE Do not enter any commented lines within the JAAS configuration file. The `#` character is not allowed. Comments in the JAAS file interfere with parsing the configuration parameters when running Control Center. ```none c3 { org.eclipse.jetty.security.jaas.spi.LdapLoginModule required useLdaps="false" contextFactory="com.sun.jndi.ldap.LdapCtxFactory" hostname="ad.confluent.io" port="389" bindDn="cn=admin,dc=confluent,dc=io" bindPassword="password" authenticationMethod="simple" forceBindingLogin="true" userBaseDn="ou=People,dc=confluent,dc=io" userRdnAttribute="sAMAccountName" userIdAttribute="sAMAccountName" userPasswordAttribute="userPassword" userObjectClass="user" roleBaseDn="ou=Groups,DC=confluent,DC=org" roleNameAttribute="cn" roleMemberAttribute="member" roleObjectClass="group"; }; ``` #### IMPORTANT If the `bindDn`, `userBaseDn`, or `roleBaseDn` contains special characters, escape them with a backslash. The comma character is designated by the LDAP filter specification as a reserved separator character for `CN` and `OU`. Any `CN` or `OU` that contains a comma `,` character needs to be escaped with a double backslash in the LDAP JAAS configuration file. For example, `"CN=adminstrator, firstclass,` is escaped as follows: `"CN=administrator\\, firstclass,OU=users,DC=confluent,DC=io"`. For further discussion about LDAP filtering and escaping, refer to this [Stack Overflow article](https://stackoverflow.com/questions/39794550/how-should-i-escape-commas-in-active-directory-filters). 2. Add these configuration options to the Control Center configuration file (`control-center.properties`). ```RST # The name of the configuration block in the JAAS configuration confluent.controlcenter.rest.authentication.realm=c3 # HTTP authentication type confluent.controlcenter.rest.authentication.method=BASIC # To enabled restricted access, add this line confluent.controlcenter.auth.restricted.roles=RestrictedGroupName # Add roles defined in the JAAS configuration file here confluent.controlcenter.rest.authentication.roles=c3users,RestrictedGroupName ``` Be aware that Control Center allows restricted access as shown above in lines 5 and 6; no editing or creating is allowed using the UI. For more information about Control Center configuration, see [Control Center Configuration Reference for Confluent Platform](../installation/configuration.md#controlcenter-configuration). #### NOTE * A user with membership in multiple groups is granted only the most restrictive permissions. For example, if a user is a member of two groups, `admin` and `readonly`, and `readonly` is a restricted role, then the user is granted only the rights for the `readonly` group. * Enabling restricted roles also prevents users from [inspecting topics](../topics/messages.md#c3-topic-message-browser) and [running ksqlDB queries](../ksql.md#controlcenter-userguide-ksql). * For fine-grained access control, consider configuring [role-based access control (RBAC)](c3-rbac.md#controlcenter-security-rbac). * Messages cannot be viewed if LDAP Basic Auth is implemented and the user is a member of a restricted group. If users need to view messages, consider using RBAC instead of LDAP Basic Auth. ## Start Control Center You must pass a few system flags to the JVM at Control Center start-up. To do so, export the `CONTROL_CENTER_OPTS` flag as shown below. #### NOTE Replace `/path/to` with the actual filepath. ```none CONTROL_CENTER_OPTS="-Djava.security.auth.login.config=/path/to/propertyfile.jaas" \ control-center-start /path/to/control-center.properties`` ``` When a user accesses Control Center, they are shown a dialog similar to the one that follows, which prompts them for sign-in credentials. ![image](images/c3-auth-sign-in.png) For more information about Control Center properties files, see [Control Center Configuration Examples for Confluent Platform](../installation/properties.md#c3-properties-files). ## Configure LdapLoginModule The following parameters configure the LdapLoginModule: debug : Indicate whether to turn on debug output. contextFactory : Specify the LDAP context factory class; for example, `com.sun.jndi.ldap.LdapCtxFactory`. hostname : Specify the hostname of the LDAP server. port : Specify the port on which the LDAP server should listen. Default port is 389 for non-TLS/SSL LDAP and AD; 636 for TLS/SSL LDAP and AD. bindDn : Required. If not using binding authentication, set this to the root DN that should bind; for example, `cn=administrator,dc=confluent,dc=io`.
See [Escaping special characters](#c3-ldap-escape-chars). bindPassword : Specify the password for bindDn.
See [Escaping special characters](#c3-ldap-escape-chars). authenticationMethod : Use `authenticationMethod=simple`. This is the only LDAP authentication method currently supported by Control Center. forceBindingLogin : Indicate whether to bind as the user that is authenticating (true), otherwise bind as the manager and perform a search to verify user password (false). useLdaps : Indicate whether to use Secure LDAP (LDAPS), required when TLS/SSL is enabled. Set to `true` to use LDAPS. The default value is `false`. userBaseDn : Specify the base DN to search for users; for example: `ou=People,dc=cops,dc=confluent,dc=io`.
See [Escaping special characters](#c3-ldap-escape-chars). userRdnAttribute : Specify the attribute name for username, used when searching for user role membership by DN, default `uid`. userIdAttribute : Specify the attribute name to identify user by username. The default value is `acn`. userPasswordAttribute : Specify the attribute name for user password. The default value is `userPassword`. userObjectClass : Specify the attribute name for user object class. The default value is `inetOrgPerson`. roleBaseDn : Specify the base DN for role membership search; for example, `ou=Groups,dc=cops,dc=confluent,dc=io`.
See [Escaping special characters](#c3-ldap-escape-chars). roleNameAttribute : Specify the attribute name for role name. The default value is `roleName`. roleMemberAttribute : Specify the attribute name for a role that would contain a user’s DN. The default value is `uniqueMember`. roleUsernameMemberAttribute : Specify the attribute name for a role that would contain a user’s username. If set, this overrides the roleMemberAttribute behavior. roleObjectClass : Specify the object class for role. The default value is `groupOfUniqueNames`. rolePrefix : Specify the prefix string to remove from role names before returning to the application, for example, `confluent\_`. ## Related content - [Control Center Security on Confluent Platform](overview.md#security-control-center) - [Configure HTTP Basic Authentication with Control Center on Confluent Platform](authentication.md#ui-authentication) - [Configure RBAC for Control Center on Confluent Platform](c3-rbac.md#controlcenter-security-rbac)