Configuring Active Directory
Configure Active Directory for the everRun system to authorize existing users or groups from an Active Directory domain to log on to the everRun Availability Console with their Active Directory credentials.
After you add the everRun system to an Active Directory domain, you can assign administrative privileges to domain users using the Grant Access wizard, which you start from the Users & Groups page (see Configuring Users and Groups).
Prerequisite: If you are configuring Active Directory for the first time on everRun Release 8.x or higher, or upgrading from Release 7.x to 8.x or higher, you need to create new rootCA SSL certificate and install it into the Java keystore of the everRun system to enable the more secure Active Directory/LDAP over SSL support in Release 8.x or higher.
For detailed information about creating and installing a custom certificate for Active Directory, access the Knowledge Base (see Accessing Knowledge Base Articles) to search for the article How to re-enable Active Directory after migrating from everRun Enterprise 7.9.x to 8.x (KB0015895). For information about the certificate_installer script, see To install a custom certificate into the Java keystore.
For detailed information about creating and installing a custom certificate for Active Directory, access the Knowledge Base (see Accessing Knowledge Base Articles) to search for the article How to re-enable Active Directory after migrating from everRun Enterprise 7.9.x to 8.x (KB0015895). For information about the certificate_installer script, see To install a custom certificate into the Java keystore.
To add the everRun system to an Active Directory domain
- Click Preferences in the left-hand navigation panel, to open the Preferences page.
- Click Users & Groups.
- Click the Enable Active Directory button in the lower pane.
- Next to Active Directory Domain, type the name of the domain to use.
-
Click one of the following to prevent or allow automatic assignment of the "Everyone" role:
- Prevent all AD users from being automatically assigned the "Everyone" role (the default).
-
Allow all AD users to authenticate and be authorized for "Everyone" role access.
- Click Add System to Active Directory.
- Type the Username and Password of an Active Directory Administrator in order to add this everRun system to the domain. When entering the username, enter only the username without specifying the domain. The system automatically appends the domain that you entered in step 4.
- Click Add.
- Assign administrative privileges to domain users on the Users & Groups page, as described in Managing Domain User Accounts.
To remove an everRun system from an Active Directory domain
- In the everRun Availability Console, click Preferences in the left panel, to open the Preferences page.
- Click Users & Groups.
- Click Remove System from Active Directory in the lower pane.
- Type a Username and Password that provides you with administrative privileges within the domain. When entering the username, enter only the username without specifying the domain. The system automatically appends the domain.
- Click Remove.
To disable domain authentication
- In the everRun Availability Console, click Preferences in the left panel, to open the Preferences page.
- Click Users & Groups.
- Click Disable Active Directory in the lower pane.
Note: Disabling Active Directory prevents the use of domain authentication for authorizing administrators of the everRun system; however, it does not remove the system from the domain. To restore the use of domain authentication, click Enable Active Directory. You do not need to retype the name of the controller or restore domain users on the Users & Groups page.