Enabling Enterprise IWA / Kerberos authentication to authenticate REST API clients

Last Updated : Oct 28, 2020 |
Prolog information
Metadata
Keywords:
IWA is offered to clients only through the default enterprise directory service configured within the Client REST Services group. Any additional enterprise directories configured are not used for IWA authentication.
  1. On the System Manager web console, navigate to ElementsAvaya Breeze®Configuration.
  2. Click Attributes.
  3. On the Service Clusters tab, in the Cluster field, click the Presence Services cluster.
  4. In the Service field, click the Presence Services service.
  5. On the Attributes Configuration page, navigate to the Client REST Services group.
  6. In Effective Value, do the following:
    1. In the Enable Client REST Services field, click True.
    2. In the Authentication Mechanism field, click Enterprise.
    3. In the Directory URL field, specify the connection URL to the directory service in the format: ldap(s)://<address>:<port>
    4. In the Directory User DN field, specify the distinguished name of the administrative user that is used to connect to the directory service.
      ADDITIONAL INFORMATION:
      Keep this field blank if you want to use anonymous directory searching.
    5. In the Directory User Password field, specify the password of the administrative user that is used to connect to the directory service.
      ADDITIONAL INFORMATION:
      Keep this field blank if you want to use anonymous directory searching.
    6. In the User Search Base field, specify the distinguished name of the search base that is used for user searches in the directory.
    7. In the User Identity Directory Attribute field, specify userPrincipalName .
      ADDITIONAL INFORMATION:
      This is mandatory if IWA is required.
    8. In the User Mapping Directory Attribute field, specify the Enterprise Directory data field that the Presence Services server maps to the user login name that is configured in the user profile in System Manager.
    9. In the Kerberos Service Principal field, specify the service principal name (SPN) that is used to generate the Kerberos keytab file.
      ADDITIONAL INFORMATION:
      Enterprise IWA authentication is enabled after you specify the SPN in this field. If you do not specify the SPN in this field, Presence Services uses Enterprise Basic authentication.
    10. In the Session Expiry field, specify the session time out in minutes.
      ADDITIONAL INFORMATION:
      The default is 15 minutes.
  7. To override the default value, select the Override Default check box.
  8. Click Commit.
Example of service attribute configuration for Enterprise IWA authentication of an REST API client.
Service attribute
Example value
Comments
Enable Client REST Services
True
Set to True to enable the REST interface for REST API clients.
Authentication Mechanism
Enterprise
Set to enable Enterprise – IWA authentication.
Directory URL
ldap://198.51.100.10:389
Enterprise Directory IP address and port.
Note:
The scheme is ldap, which is not secure.
Directory User DN
CN=admin,OU=Users, DC=lab1,DC=avaya,DC=com
The Directory access user is defined as admin under the Users container.
Directory User Password
my-nice-password
The password of the user to access the Enterprise Directory.
User Search Base
OU=MYLAB,DC=lab1,DC=avaya,DC=com
Search for users under the MYLAB organizational unit.
User Identity Directory Attribute
userPrincipalName
The Enterprise Directory server uses this data field to search for users.
User Mapping Directory Attribute
userPrincipalName
The Presence Services server uses this data field to verify against the login name of the user that is configured in System Manager.
Kerberos Service Principal
HTTP/ps.example.com@EXAMPLE.COM
The service principal name (SPN) that is used to generate the Kerberos keytab file.
Session Expiry
15 (default)
The session time out (in minutes) after which REST sessions expire.
Related links
Enterprise IWA over Kerberos authentication to authenticate REST API clients