Tenant-Specific Authentication

After implementing a multi-tenancy deployment that assigns emails to their tenant, it’s time to configure how tenants can login to xorlab. By referencing the authTenantId attribute defined in guarded_tenants.yml, you can specify which authentication backend is used for which tenant. Available authentication backends are SAML, LDAP, or password-based authentication.

LDAP-based Authentication

Expand to read the instructions.

Follow the LDAP-based Authentication Setup Guide
The tenant attribute should reference either name or authTenantId defined in guarded_tenants.yml
For roleMapping, make sure to map tenant-restricted user roles

Expert Editor: /auth/auth/auth.yml

---
ldapAuthBackends:
    ldapAuthDataSources:
      xorlabLDAP:
        host: ldap.tenantA.com
        port: 10636
        authentication:
          withQueryDn:
            bindDn: ""
            bindPassword: ""
            userBase: "ou=users,dc=tenant,dc=com"
            userSearch: "(uid={0})"
        authorization:
          query:
            roleBase: "ou=groups,dc=tenant,dc=com"
            roleSearch: "(uniqueMember={0})"
            nestedRoleDepth: 5
        attributeMapping:
          userName: "attr('uid')"
          displayName: "attr('cn')"
          emails: "attr('mail')"
          tenant: "'tenantA'" # Corresponds to "'<name>'" or "'<authTenantId>'" in guarded_tenants.yml
        roleMapping:
          xcc_tenant_analyst: [ "cn=dev_xcc_login,ou=groups,dc=example,dc=com" ]
          xcc_tenant_analyst_audit: [ "cn=dev_xcc_login,ou=groups,dc=example,dc=com" ]

SAML-based Authentication

Expand to read the instructions.

Follow the SAML-based Authentication Setup Guide
The tenant attribute should reference either name or authTenantId defined in guarded_tenants.yml
For roleMapping, make sure to map to a tenant-restricted user roles

Expert Editor: /auth/auth/auth.yml

---
saml2AuthBackends:
  tenantAuthBackend:
    idp:
      metadataUrl: https://login.microsoftonline.com/....
    attributeMapping:
      displayName: attr('http://schemas.microsoft.com/identity/claims/displayname')
      emails: attr('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name')
      roles: attr('http://schemas.microsoft.com/ws/2008/06/identity/claims/role')
      tenant: "'tenantA'" # Corresponds to "'<name>'" or "'<authTenantId>'" in guarded_tenants.yml
    roleMapping:
      xcc_tenant_analyst: [ tenant.analyst ]
      xcc_tenant_analyst_audit: [ tenant.audit ]

Password File

Expand to read the instructions.

Make sure to activate logging of login attempts
The tenant attribute should reference either name or authTenantId defined in guarded_tenants.yml
For passwordHash, generate a password hash password hash generator
Map to a tenant-restricted user roles

Using a password file for authentication is not recommended as it doesn’t allow for 2FA.

Expert Editor: /auth/auth/passwordFile.yml

---
users:
  - username: user1
    tenant: tenantA # Corresponds to <name> or <authTenantId> in guarded_tenants.yml
    passwordHash: "{bcrypt}$2y$10$.4If2RFwcvHRrxlR98m9ju/mCRYCHLAYULByGXvJY.jBuK2/bckZu"
    roles:
      - xcc_tenant_analyst
    
  - username: user2
    tenant: tenantB # Corresponds to <name> or <authTenantId> in guarded_tenants.yml
    passwordHash: "{bcrypt}$2y$10$nBZobaznyYv0Ki.lY8jNV.ls2uGh3VmsZivoG4XcdzKQU66qCHAAa"
    roles:
      - xcc_tenant_analyst

​LDAP-based Authentication

​SAML-based Authentication

​Password File

LDAP-based Authentication

SAML-based Authentication

Password File