Enabling Enterprise Basic authentication to authenticate REST API clients

Last Updated : May 27, 2021 |
Prolog information
Metadata
Keywords:
In Enterprise Basic authentication, Presence Services authenticates the user name and password of the REST API client against the user data that is configured in the Enterprise Directory Service.
Presence Services verifies the client-provided user name against the value that is configured in the User Identity Directory Attribute field, and the client-provided password against the value that is configured in the Directory User Password field. The set of attributes under the Client REST Services is the default Enterprise Directory service.
Nine additional Enterprise Directory services can be configured. Settings for the Enterprise Directory services are located at the bottom of the Service Attributes. Each service group is labelled as Enterprise Directory 2-10 respectively. Each service group is configured in a similar fashion as the default Enterprise Directory service with one additional constraint. Each of these additional services must be configured with a list of comma-separated domains. For users in these domains or any sub-domains, the matching Enterprise Directory service will be used to authenticate the user. If no matching domain is specified among these additional services, the default Enterprise Directory service is used. Administrator must ensure that there are no duplicate domains used among the Enterprise Directory configurations. Otherwise, the wrong directory service could be used to authenticate and fail. Additionally, a health check alarm is raised if there are duplicate domains amongst the additional enterprise directories, which means, none of the additional enterprise directory should have a domain in common. If the domain attribute is blank, the entire Enterprise Directory configuration for that service group is ignored. All Enterprise Directory configuration changes require a Presence Services restart to take effect.
  1. On the System Manager web console, navigate to ElementsAvaya Breeze®Configuration.
  2. Click Attributes.
  3. On the Service Clusters tab, in the Cluster field, click the Presence Services cluster.
  4. In the Service field, click the Presence Services service.
  5. On the Attributes Configuration page, navigate to the Client REST Services group.
  6. In Effective Value, do the following:
    1. In the Enable Client REST Services field, click True.
    2. In the Authentication Mechanism field, click Enterprise.
    3. In the Directory URL field, specify the connection URL to the directory service in the format: ldap(s)://<address>:<port>
    4. In the Directory User DN field, specify the distinguished name of the administrative user that is used to connect to the directory service.
      ADDITIONAL INFORMATION:
      Keep this field blank if you want to use anonymous directory searching.
    5. In the Directory User Password field, specify the password of the administrative user that is used to connect to the directory service.
      ADDITIONAL INFORMATION:
      Keep this field blank if you want to use anonymous directory searching.
    6. In the User Search Base field, specify the distinguished name of the search base that is used for user searches in the directory.
    7. In the User Identity Directory Attribute field, specify the user attribute in the Enterprise Directory that is used by the Presence Services server for user identification.
      ADDITIONAL INFORMATION:
      You can set this attribute to any attribute, but the typical attributes are userPrincipalName, sAMAccountName, or uid.
    8. In the User Mapping Directory Attribute field, specify the Enterprise Directory data field that the Presence Services server maps to the user login name that is configured in the user profile in System Manager.
    9. In the Session Expiry field, specify the session time out in minutes.
      ADDITIONAL INFORMATION:
      The default is 15 minutes.
    ADDITIONAL INFORMATION:
    Note:
    The Kerberos Service Principal field is not applicable for Enterprise Basic Authentication.
  7. To override the default value, select the Override Default check box.
  8. Click Commit.
Example of service attribute configuration for Enterprise Basic authentication of an REST API client:
Service attribute
Example value
Comments
Enable Client REST Service
True
Set to true to enable the REST interface for REST API clients.
Authentication Mechanism
Enterprise
Set to enable Enterprise – Basic authentication.
Directory URL
ldap://198.51.100.10:389
The Enterprise directory IP address and port.
Note:
The scheme is ldap, which is not secure.
Directory User DN
CN=admin,OU=Users, DC=lab1,DC=avaya,DC=com
The Directory access user is defined as admin under the Users container.
Directory User Password
my-nice-password
The password of the user to access the Enterprise Directory.
User Search Base
OU=MYLAB,DC=lab1,DC=avaya,DC=com
Search for users under the MYLAB organizational unit.
User Identity Directory Attribute
uid
The Enterprise Directory server uses this data field to search for users.
User Mapping Directory Attribute
userPrincipalName
The Presence Services server uses this data field to verify against the login name of the user that is configured in System Manager.
Kerberos Service Principal
Not applicable
Not applicable
Session Expiry
15 (default)
The session time out (in minutes) after which REST sessions expire.
Related links
REST API clients authentication