Now that we have installed Graylog and secured access using SSL/TLS, it is time to connect it to an external Authentication system, in this case it will be an existing Active Directory infrastructure.
The first step is to create a User Account in AD that Graylog will use to connect and perform authentication queries.
For this example I have created an account called svc.GraylogLDAP.
Next we need to create a pair of Global Security Groups, Graylog Admins and Graylog Readers and add the relevant AD users as members.
These will be mapped to Admin and Read Only roles within Graylog.
With the AD configuration now complete, log into the Graylog web interface and go to System – Authentication.
Select LDAP/Active Directory from the left hand menu.
Server Type: Choose Active Directory
Server Address: enter the FQDN or IP of one of your Domain Controllers and change the port to 636
Tick the SSL box
System Username: Enter the userPrincipalName of the service account that we created earlier (e.g. svc.GraylogLDAP@MyLab.com )
System Password: Enter the password for our service account
Click the Test Server Connection button to confirm that everything is working so far.
In the User mapping section we will be defining some search options and attributes. This will vary depending on how you have structured your AD environment.
In my lab environment I have created an OU called Accounts that houses my user accounts so this is the Search Base DN I will enter.
My User Search Pattern is
and the Display Name attribute is
The Group Mapping section will again depend on your AD structure. I have an OU called Groups that contains all of my groups so my Group Search Base DN is
As both of the Groups I am targeting begin with the word Graylog, my Group Search Pattern is
My Group Name Attribute is
and I have set the Default User Role to
Reader – basic access
To test that everything is working as expected, enter a username and password combination in the Login test section and click Test login.
Assuming everything is looking good, click the Save LDAP settings button and then scroll back up to the top of the page.
In the top right corner, hit the LDAP Group Mapping button
Here you will see any AD Groups that satisfy the Group Search Pattern criteria from the previous page and you will be able to map them to the Admin or Reader roles.
Click Save when finished.
You should now be able to log out of Graylog and then log back in using your AD credentials.
This completes the base configuration of Graylog, the next post will cover setting up some basic inputs to start collecting data.