LDAP/AD

^{Last updated: 2019-07-04}

Purpose

This article provides information on how to set up and use either a Lightweight Directory Access Protocol (LDAP) or an Active Directory (AD) server with the HIAB.

Introduction

The LDAP/AD integration enables the HIAB platform to connect to an external directory service such as Lightweight Directory Access Protocol (LDAP) or Microsoft Active Directory (AD). This integration allows the system to authenticate users against the organization’s existing directory infrastructure instead of maintaining separate user accounts within the platform. By relying on centralized directory services, organizations can manage authentication and access control through their established identity management systems while maintaining consistent user information across environments.

In addition to authentication, the integration can also be used to import user accounts and network assets directly from the directory service into the scanning platform. User attributes such as names, email addresses, and group memberships can be mapped from the directory to the platform, enabling automatic assignment of roles and permissions based on organizational groups. The same directory data can also be used to discover and import devices that exist in the directory, allowing them to be added as scanning targets.

By integrating LDAP or Active Directory with the platform, organizations can centralize identity management, reduce administrative overhead, and ensure that vulnerability scanning targets and user access are aligned with the organization’s existing directory structure. This approach improves operational efficiency while supporting secure and consistent access management across the vulnerability management environment.

Setting up LDAP/AD

To set up LDAP/AD, follow the below procedure:

1. Go to Main Menu > Settings > Integrations.

2. Select LDAP/AD tab.
   

   

The elements of the LDAP/AD tab are described below:

• Enabled: Tick to enable the use of LDAP/AD feature.

Primary Server and Failover Server

The system allows you to define both Primary Server and Failover Server.
The Failover Server is accessed if the Primary Server is unavailable when required. The following options are available for both Primary and Failover servers.

Import and specific mapping settings for the user and target integration are located under respective settings sections.

Attribute Mapping Users
Provide the LDAP server attribute names that corresponds to the fields mentioned below.

Attribute Mapping Targets
Provide the LDAP server attribute names that corresponds to the fields mentioned below. 

LDAP/AD Configuration

User Roles

The User Roles section allows you to define if roles should automatically be assigned to imported user, based on already defined group belongings in the LDAP/AD tree. If enabled, you can define a matching field on each user role in the HIAB. If they match, that user role is then automatically assigned to the imported user. The matching field is present in the Maintaining User Role section when you edit or create a new role.

Example:

In the above example, HIAB.Administrator is automatically assigned to users that belong to the group admin in the LDAP/AD tree.

Click Save to save the current settings. 

Integrate Users

Once the LDAP/AD feature has been enabled:

1. Go to Main Menu > Settings > Manage Users.

2. Click on Import from LDAP/AD in the Manage User Accounts section to open a window where you can filter which users to import into the system.
   
   

   

   
   

   

If the text is marked red as above, it implies that the user details either does not contain all required fields or it has content which is not allowed to use. Grey text indicates that the user already exists in the system.
A user is valid if the following criteria are fulfilled:

• Username must be longer than 1 character.

• First name must exist.

• Last name must exist.

• Email address must be valid.

The Parent Account setting allows you to import users in different levels if required.

Verify Users

Once the user is imported, you can verify the authentication and see the associated groups for that user.
Go to Manage User Accounts, right click on the user and select LDAP/AD Lookup as shown below.

This displays the LDAP/AD Lookup window:

Here, you can view the different values for the user along with the defined groups associated with him/her.

Click on Test Authentication to verify the user's authentication. 

Integrate Targets

Once the LDAP/AD feature has been enabled:

1. Go to Main Menu > Netsec > Manage Targets.

2. Click on Import from LDAP/AD while adding +New targets.

This opens a new window where you can filter which targets to import into the system. If the line is marked red then the target details either does not contain all required fields, or it has content that is not allowed to use.

A target is valid if the following criteria is provided:

• IP address or hostname.

• MAC address is formatted correctly. If applicable.

If Update existing targets checkbox is ticked, the Import updates the available targets.
The Scanner option is only available if you have a distributed environment (multiple HIAB instances connected) and it determines which scanner will execute the scans against those targets associated with it.