# Connecting an Account to a Microsoft Active Directory Identity Provider zCompute accounts’ users can be authenticated using an external LDAP-compatible identity provider, such a Microsoft Active Directory domain. Once it’s set up, users and groups of the identity provider can be granted permissions to zCompute. To enable this, the zCompute account must be connected to Active Directory. Each zCompute account requires independent configuration for the Identity Provider connection. ## Connecting an Account to an Active Directory Identity Provider To connect an account to an Active Directory Identity Provider: 1. Navigate to the **Identity & Access** > **Accounts** view, and highlight the row of the account that you wish to connect to the Identity Provider. An **Identity Provider** button appears in the toolbar. 2. Click **Identity Provider**. The **Create Identity Provider** dialog opens at the **Connection** step.  1. Enter the Active Directory domain controller (DC) details: * **Server** - The LDAP server or Active Directory domain controller’s IP address. For example: `10.11.12.13` * **Secure** - Check this box if your LDAP server supports the secure LDAP protocol over SSL or TLS. * **Port** - The reserved port is 389 if the connection is not secure, or 636 if the connection is secure. * **Secondary Server** (optional) - A backup server if the first one is not available. The Active Directory Domain Controller address, expressed as an IP address or a DNS hostname. For example: `10.11.12.14` or `dc4.mydomain.com`. * **Secure** - Check this box if your secondary LDAP server supports the secure LDAP protocol over SSL or TLS. * **Port** - The reserved port for the secondary server is 389 if the connection is not secure, 636 if the connection is secure. * **User** - This is the user principal name (UPN) or distinguished name (DN) of a user through which one can gain access to Active Directory Server. DN example: `cn=zadaraexample,cn=Users,dc=example,dc=com` UPN example: `zadaraexample@example.com` * **Password** - The Active Directory password of the user. * Click **Next**. After validating the connection to the Active Directory server, the dialog displays the **LDAP Parameters** step. 2. **LDAP Parameters** - All parameters are expressed in the LDAP syntax.  * **Domain** - The customer’s domain in Active Directory. For example: `dc=example,dc=com` * **User Tree DN** - The location in the Active Directory in which the users will be scanned. For example: `OU=Enterprise,DC=example,DC=com` * **User ID Attribute**: The attribute name in Active Directory that represents the User ID. For example: `sAMAccountName`. * **User Name Attribute**: The attribute name in Active Directory that represents the User Name. For example: `sAMAccountName`. * **User Object Class**: The objectClass property of a user object in Active Directory. For example: `person`. * **User Filter** - Filters the users scanned in the User Tree. For example: * `(name=example-*)` searches the User Tree for any user beginning with `example-`. * `(memberOf=cn=grp-exampleldap,cn=Users,dc=example,dc=com)` searches for all users who belong to the group `grp-exampleldap` in the Active Directory with domain components matching `dc=example,dc=com`. * **Group Tree DN** - The location in the Active Directory in which the groups will be scanned. For example: `cn=Users,dc=example,dc=com` * **Group Object Class** - Active Directory’s group object class for the groups. Default: `group` * **Group Filter** - Filters the groups scanned in the Group Tree. For example: `(name=grp-*)` searches for all groups with the prefix `grp-`. Click **Finish**. * The selected account is connected to MS Active Directory. * Users matching the filters described above will appear as LDAP Users of the selected account. On completion of configuring Active Directory as an identity provider for the zCompute account, these users’ AD passwords will be used for authentication. * The groups matching the filters described above will appear as groups of the selected account, containing the users defined in Active Directory. * The account’s top pane **Overview** section displays the **LDAP** badge, and summarizes the number of LDAP **Groups** and LDAP **Users**.  ## Viewing LDAP Groups To view the LDAP Groups: In the account’s lower pane, click the **Groups** tab. The LDAP Groups list displays.  By default, users in a group can’t sign on until the group is assigned project permissions. The Projects column for groups without project permissions displays an alert symbol to indicate this. To configure project permissions for a group, see [Managing an LDAP Group’s Permissions](#managing-ldap-group-permissions). ### Managing an LDAP Group’s Permissions To assign permissions to an LDAP group and its members: 1. In the account’s lower pane, click the **Groups** tab. The LDAP Groups list displays. 2. Highlight the row of the group to apply permissions. 3. In the lower pane menu bar, click **Manage Policies**. The **Manage Permissions for Group** dialog opens.  1. Configure the projects and and their permissions for the group 2. Click **Finish**. The updated projects appear in the Projects column for the group, in the **Groups** tab.  ## Viewing LDAP Users To view the LDAP Users: In the account’s lower pane, click the **LDAP Users** tab. The LDAP Users list displays.  Users who are members of groups configured with project permissions have their associated projects listed in the Projects column. For other users, the Projects column displays an alert symbol, indicating that the user cannot sign on until project permissions are assigned. User permissions can be assigned individually or as a member of a group with configured permissions. ## Assigning zCompute Roles and permissions to an Active Directory User - UI The following UI actions are recommended for assigning the Account and Project ‘Admin’ roles and permissions to a user added to zCompute via Active Directory: 1. Locate the new user added to zCompute via Active Directory. 1. On the **Identity & Access** > **Accounts** view for the requested account, click the **LDAP Users** tab. The list of users for that account displays. 2. Click the user to assign zCompute permissions. The user’s **Project Permissions** tab displays the user’s role and policies per project. 2. Assign a project to the user with a project role and zCompute policy. 1. In the user’s upper menu bar, click **Manage Permissions**. 2. The dialog box **Manage Permissions for User** opens. 3. From the **+ Add Project** dropdown list, select the project. 4. In the section that opens for the project, complete the user’s permission settings: The **Roles**, **AWS API Policies** and **Symp API Policies** have descriptive names that reflect the role or policy scope. 1. **Roles** - From the dropdown, select the role. Multiple roles can be applied. 2. **AWS API Policies** - From the dropdown, select the policy. Multiple AWS API policies can be applied. 3. **Symp API Policies** - From the dropdown, select the policy. Multiple Symp API policies can be applied. 4. Optionally, repeat these steps to assign roles and policies to the user for additional projects. 5. Click **Finish** to save the user’s roles and policies per project. The user’s **Project Permissions** tab in the lower pane displays the user’s role and policies per project. ## Assigning zCompute Roles and permissions to an Active Directory User - CLI The following CLI commands are recommended for assigning the Account and Project ‘Admin’ roles and permissions to a user made available to zCompute via Active Directory: 1. Use symp’s [user list](symp-ref-guide/user.md#user-list-cmd) command to locate the user. ```console user list -c id -c name -c domain_id +----------------------------------+----------+----------------------------------+ | id | name | domain_id | +==================================+==========+==================================+ | c8a63b29558d4765a6cd78760729a2f7 | new_user | 2d27e2fe6d8a4398b901c4d84c478777 | +----------------------------------+----------+----------------------------------+ | admin | admin | default | +----------------------------------+----------+----------------------------------+ ``` Note the user’s domain ID. 2. Use symp’s [user list](symp-ref-guide/user.md#user-list-cmd) command to verify that the user `new_user` from the Active Directory list, does not already appear in another zCompute account. ```console user list --name new_user -c id -c name -c domain_id +-----------+----------------------------------+ | id | c8a63b29558d4765a6cd78760729a2f7 | | name | new_user | | domain_id | 2d27e2fe6d8a4398b901c4d84c478777 | +-----------+----------------------------------+ ``` 3. Use symp’s `domain list` command to list the domains with their IDs and names. ```console domain list -c id -c name +----------------------------------+---------------+ | id | name | +==================================+===============+ | 2d27e2fe6d8a4398b901c4d84c478777 | new_account | | default | cloud_admin | +----------------------------------+---------------+ ``` 4. Use symp’s [project list](symp-ref-guide/project.md#project-list-cmd) command to list the projects with their IDs, names and domains. ```console project list -c id -c name -c domain_name +----------------------------------+-------------+---------------+ | id | name | domain_name | +==================================+=============+===============+ | 4bd79a2fa9574af2a4b9a7a87195f144 | default | cloud_admin | | 1569c28e3a344ee2b3989640499b8eca | new_project | new_account | +----------------------------------+-------------+---------------+ ``` 5. Use symp’s [role list](symp-ref-guide/role.md#role-list-cmd) command to list all roles in zCompute. ```console role list +--------------------+--------------------+ | id | name | +====================+====================+ | admin | admin | | tenant_admin | tenant_admin | | _member_ | member | +--------------------+--------------------+ ``` 6. Use symp’s [project list-roles-on-project](symp-ref-guide/project.md#project-list-roles-cmd) command to check if user `new_user` has already been assigned a role in the project `new-project`. Syntax: `project list-roles-on-project ` ```console project list-roles-on-project 1569c28e3a344ee2b3989640499b8eca c8a63b29558d4765a6cd78760729a2f7 +--------------+--------------+ | value | tenant_admin | +--------------+--------------+ ``` If the user is already assigned a role other than `admin` in the project `new_project`, use the [project revoke-role](symp-ref-guide/project.md#project-revoke-role-cmd) command to remove the role from `new_user`. Syntax: `project revoke-role ` ```console project revoke-role 1569c28e3a344ee2b3989640499b8eca c8a63b29558d4765a6cd78760729a2f7 tenant_admin +-------+---------+ | value | Success | +-------+---------+ ``` 7. Use symp’s [project grant-role](symp-ref-guide/project.md#project-grant-role-cmd) command to assign the admin role to user `new_user` in the project `new_project`. Syntax: `project grant-role ` ```console project grant-role 1569c28e3a344ee2b3989640499b8eca c8a63b29558d4765a6cd78760729a2f7 admin +-------+---------+ | value | Success | +-------+---------+ ``` 8. Use symp’s [project list-roles-on-project](symp-ref-guide/project.md#project-list-roles-cmd) command to verify that the role of `new_user` in `new_project` is `admin`. Syntax: `project list-roles-on-project ` ```console project list-roles-on-project 1569c28e3a344ee2b3989640499b8eca c8a63b29558d4765a6cd78760729a2f7 +--------------+--------------+ | value | admin | +--------------+--------------+ ``` ## LDAP User Sign-on to zCompute After LDAP users’ project and permission assignments are configured in zCompute, the users can sign on to zCompute using their short username, as registered in zCompute, and listed in the account’s **LDAP Users** tab.  In this example: * The zCompute account name is `tenant`. For this example, this is the account where the administrator loaded LDAP users and groups, and assigned them zCompute projects and permissions. * The LDAP user’s username is `operator.1`. This is the short username of the LDAP user, imported into zCompute based on the mapping of the LDAP **User Name Attribute** `sAMAccountName`. The mapping was configured in the **LDAP Parameters** step of the **Create Identity Provider** dialog.