Skip to content

Active Directory

You can deploy Microsoft Active Directory on EDH via the following options:

Default Organizational Units (OU)

Here are the default Organizational Units (OU) deployed if you are using AWS Directory Service Managed or Simple AD:

DN AWS Directory Service Managed AD AWS Directory Service Simple AD
admins_search_base cn=socasudoadminsgroup,ou=Users,DOMAIN_BASE cn=socasudoadminsgroup,ou=Users,DOMAIN_BASE
people_search_base ou=Users,ou=NETBIOS,DOMAIN_BASE cn=Users,DOMAIN_BASE
group_search_base cn=Users,ou=NETBIOS,DOMAIN_BASE cn=Users,DOMAIN_BASE

Info

Group Name for admins_search_base can be customized via default_config.yml

Info

You cannot change the defaults OU. Also note AWS Directory Services stores user/group in a nested OU using your Netbios (short name) name.

Example: Assuming netbios is SOCA-TEST and domain_base is soca-test.local

ou=Users,ou=SOCA-TEST,dc=soca-test,dc=local

EDH AD Service Account

Independently of the Active Directory provider, EDH will automatically create an AD user with sufficient permissions for all LDAP bind/CRUD operations. You can retrieve the username/password on Secrets Manager (/edh/<EDH_CLUSTER_ID>/UserDirectoryServiceAccount).

Existing Active Directory

You can configure your own OU and AD Service Account when using an existing Active Directory via default_config.yml

UserDirectory SocaConfig tree

You can query all your User Identity configuration using edhctl CLI via /configuration/UserDirectory/ tree

/bin/bash /opt/edh/soca-demo29/cluster_manager/edhctl config get \
   --key "/configuration/UserDirectory/" \
   --output json

{
    "/configuration/UserDirectory/ad_aws_directory_service_id": "d-REDACTED",
    "/configuration/UserDirectory/ad_aws_lambda_reset_password": "False",
    "/configuration/UserDirectory/admins_search_base": "cn=AWS Delegated Server Administrators,ou=AWS Delegated Groups,dc=soca-demo29,dc=local",
    "/configuration/UserDirectory/domain_base": "dc=soca-demo29,dc=local",
    "/configuration/UserDirectory/domain_controller_ips": "['59.0.173.45', '59.0.89.133']",
    "/configuration/UserDirectory/domain_name": "soca-demo29.local",
    "/configuration/UserDirectory/people_search_base": "ou=Users,ou=SOCA-DEMO29,dc=soca-demo29,dc=local",
    "/configuration/UserDirectory/provider": "aws_ds_managed_activedirectory",
    "/configuration/UserDirectory/service_account_secret_arn": "arn:aws:secretsmanager:us-east-1:REDACTED:secret:/edh/soca-demo29/UserDirectoryServiceAccount-RV4qc6",
    "/configuration/UserDirectory/use_existing_directory": "False",
    "/configuration/UserDirectory/endpoint": "ldap://soca-demo29.local",
    "/configuration/UserDirectory/group_search_base": "ou=Users,ou=SOCA-DEMO29,dc=soca-demo29,dc=local",
    "/configuration/UserDirectory/short_name": "SOCA-DEMO29"
}

Troubleshooting

For common Active Directory problems and step-by-step fixes, see the troubleshooting guides: