LDAP authentication

You can use an online LDAP test server provided by forumsys.com to complete this tutorial without setting up an LDAP server. To deploy an LDAP server using Active Directory instead, select the Active Directory tab.

The online LDAP server at ldap.forumsys.com is a public, read-only test server. In this public server, all user passwords are password. You may also bind to individual Users (uid).

The following group is also provided, and will be used to test Boundary's managed group access:

ou=scientists,dc=example,dc=com

• einstein
• newton
• galieleo
• tesla

You will use a terminal session and command line to start an Active Directory virtual machine.

Open a new terminal session to begin the lab setup.

For ease of cleanup and simplicity, create a directory to contain all required configuration for the scenario. This example sets up the working directory in the users home directory ~/, but you can create it elsewhere too.

$ mkdir ~/learn-boundary-ldap-auth/

Change into this directory; you will execute all scenario commands on the local host from this directory or one of its descendants.

$ cd learn-boundary-ldap-auth/

Windows Server with Active Directory

To set up your Windows Server environment with Active Directory environment, clone the vagrant-active-directory community project repository.

$ git clone https://github.com/splitbrain/vagrant-active-directory

Change into the project directory.

$ cd vagrant-active-directory

Create a directory for the extra VirtualBox network configuration.

$ sudo mkdir /etc/vbox

Write the configuration file.

$ sudo sh -c 'cat << EOF > /etc/vbox/networks.conf
* 10.0.0.0/8 192.168.0.0/16
* 2001::/64
EOF'

Start the virtual machine with Vagrant.

$ vagrant up

The last lines in the Vagrant log output show that the Active Directory server is ready because it begins creating the users and groups:

    dc: Waiting for the AD to become available... (Can take a long time)
    dc: Creating Groups...
    dc: Creating Users...

Confirm that the Active Directory services are available by connecting to the virtual machine with WinRM and using dcdiag to test services.

$ vagrant winrm -c 'dcdiag /test:Services' dc | grep passed
         ......................... DC passed test Connectivity
         ......................... DC passed test Services

If the tests also show passing status, then the Active Directory server is ready.

The following parameters are needed for the LDAP test server:

• urls: "ldap://ldap.forumsys.com"
• bind-dn: "cn=read-only-admin,dc=example,dc=com"
• bind-password: file://bind-pass.txt (passed directly if using Terraform)
• user-dn: "dc=example,dc=com"
• user-attr: "uid"
• group-dn: "dc=example,dc=com"

The following parameters are needed for the LDAP test server:

• urls: ["ldap://localhost:7389"]
• user-dn: "CN=Users,DC=example,DC=local"
• user-attr: "sAMAccountName"
• group-dn: "CN=Users,DC=example,DC=local"
• group-attr: "memberOf"
• bind-dn: "CN=vagrant,CN=Users,DC=example,DC=local"
• bind-password: file://bind-pass.txt (passed directly if using Terraform)

The Boundary Admin Console provides a UI for creating and managing LDAP resources, including auth methods and managed groups.

Open the Admin Console UI by entering the Dev Controller URL of http://localhost:9200 into a browser.

Enter the admin username admin and password password and click Authenticate.

Start by navigating to the Auth Methods settings view using the menu on the left side of the Admin Console. Select New and click LDAP.

Fill out the form details using the settings gathered from the LDAP server.

Once the form is completed, click Save.

The new authentication method has now been created. To the right of the new auth method's details, notice the state is set to Inactive. Before you can use it, the new auth method must be switched to an active state.

Next we will review the available authentication states and activate the new LDAP auth method.

password

$ boundary auth-methods create ldap \
  -urls "ldap://ldap.forumsys.com" \
  -bind-dn "cn=read-only-admin,dc=example,dc=com" \
  -bind-password file://bind-pass.txt \
  -user-dn "dc=example,dc=com" \
  -user-attr "uid" \
  -group-dn "dc=example,dc=com"

$ boundary auth-methods create ldap \
  -urls "ldap://ldap.forumsys.com" \
  -bind-dn "cn=read-only-admin,dc=example,dc=com" \
  -bind-password file://bind-pass.txt \
  -user-dn "dc=example,dc=com" \
  -user-attr "uid" \
  -group-dn "dc=example,dc=com"

Auth Method information:
  Created Time:         Tue, 03 Oct 2023 18:32:16 MDT
  ID:                   amldap_gLx3Gg3ZdG
  Type:                 ldap
  Updated Time:         Tue, 03 Oct 2023 18:32:16 MDT
  Version:              1

  Scope:
    ID:                 global
    Name:               global
    Type:               global

  Authorized Actions:
    no-op
    read
    update
    delete
    authenticate

  Authorized Actions on Auth Method's Collections:
    accounts:
      create
      list
    managed-groups:
      create
      list

  Attributes:
    bind_dn:            cn=read-only-admin,dc=example,dc=com
    bind_password_hmac: IC29KNPDTPC57nc2aT9UFthOh4Kh1i3660_euBsgL7Y
    group_dn:           dc=example,dc=com
    state:              inactive
    urls:               [ldap://ldap.forumsys.com]
    user_attr:          uid
    user_dn:            dc=example,dc=com

vagrant

$ boundary auth-methods create ldap \
  -urls "localhost" \
  -bind-dn "CN=vagrant,CN=Users,DC=example,DC=local" \
  -bind-password file://bind-pass.txt \
  -user-dn "CN=Users,DC=example,DC=local" \
  -user-attr "sAMAccountName" \
  -group-dn "CN=Users,DC=example,DC=local"

$ boundary auth-methods create ldap \
  -urls "ldap://ldap.forumsys.com" \
  -bind-dn "cn=read-only-admin,dc=example,dc=com" \
  -bind-password file://bind-pass.txt \
  -user-dn "dc=example,dc=com" \
  -user-attr "uid" \
  -group-dn "dc=example,dc=com" \

Auth Method information:
  Created Time:         Tue, 03 Oct 2023 18:32:16 MDT
  ID:                   amldap_gLx3Gg3ZdG
  Type:                 ldap
  Updated Time:         Tue, 03 Oct 2023 18:32:16 MDT
  Version:              1

  Scope:
    ID:                 global
    Name:               global
    Type:               global

  Authorized Actions:
    no-op
    read
    update
    delete
    authenticate

  Authorized Actions on Auth Method's Collections:
    accounts:
      create
      list
    managed-groups:
      create
      list

  Attributes:
    bind_dn:            cn=read-only-admin,dc=example,dc=com
    bind_password_hmac: IC29KNPDTPC57nc2aT9UFthOh4Kh1i3660_euBsgL7Y
    group_dn:           dc=example,dc=com
    state:              inactive
    urls:               [ldap://ldap.forumsys.com]
    user_attr:          uid
    user_dn:            dc=example,dc=com

The new authentication method has now been created. Under the Attributes output, notice the state is set to inactive. Before you can use it, the new auth method must be switched to an active state.

Copy the new LDAP Auth Method ID from the output, and export it as an environment variable.

$ export BOUNDARY_AUTH_METHOD_ID=amldap_gLx3Gg3ZdG

Next we will review the available authentication states and activate the new LDAP auth method.

Begin by creating a working directory to store the Terraform configuration file and changing into that directory. This tutorial will work out of the user's HOME directory.

$ mkdir learn-boundary-ldap-auth && cd learn-boundary-ldap-auth/

Next, create a Terraform configuration file called main.tf.

$ touch main.tf

Open the main.tf file in your code editor and add the base Boundary provider configuration below. The 1.1.8 version or above is required to support LDAP. An output value is included to print the LDAP auth method id when Terraform applies the configuration.

The initial setup should set the boundary provider to match Boundary's authentication configuration so that Terraform can authenticate to Boundary. These settings are discussed in the Get Setup section.

Copy the following configuration, but replace the recovery_kms_hcl key with the value printed in the boundary dev terminal window.

terraform {
  required_providers {
    boundary = {
      source  = "hashicorp/boundary"
      version = "1.1.10"
    }
  }
}

output "auth-method-id" {
  value = boundary_auth_method_ldap.test_server.id
}

provider "boundary" {
  addr             = "http://127.0.0.1:9200"
  recovery_kms_hcl = <<EOT
kms "aead" {
  purpose = "recovery"
  aead_type = "aes-gcm"
  key = "nXz1K39auzqY+Bs02bGga0HS8xgFsNvE"
  key_id = "global_recovery"
}
EOT
}

The Terraform Boundary provider enables LDAP using the boundary_auth_method_ldap and boundary_account_ldap resources.

The boundary_auth_method_ldap resource can use the following attributes to configure a new LDAP auth method:

resource "boundary_auth_method_ldap" "name" {
  name                        = (String)
  description                 = (String)
  scope_id                    = (String)
  account_attribute_maps      = (List of String)
  anon_group_search           = (Boolean)
  bind_dn                     = (String)
  bind_password               = (String)
  bind_password_hmac          = (String)
  certificates                = (List of String)
  client_certificate          = (String)
  client_certificate_key      = (String)
  client_certificate_key_hmac = (String)
  dereference_aliases         = (String)   
  discover_dn                 = (Boolean)
  enable_groups               = (Boolean)
  group_attr                  = (String)
  group_dn                    = (String)
  group_filter                = (String)
  insecure_tls                = (Boolean)
  is_primary_for_scope        = (Boolean)
  maximum_page_size           = (Number)
  start_tls                   = (Boolean)
  state                       = (String)
  type                        = (String)
  upn_domain                  = (String)
  urls                        = (String)
  use_token_groups            = (Boolean)
  user_attr                   = (String)
  user_dn                     = (String)
  user_filter                 = (String)
}

These parameters are explained in detail in the Connection parameters section. For a full list of attributes, refer to the boundary_auth_method_ldap Terraform registry docs.

The boundary_account_ldap resource uses the following attributes to configure a new auth method:

resource "boundary_account_ldap" "name" {
  name           = (String)
  description    = (String)
  auth_method_id = (String)
  login_name     = (String)
  name           = (String)
}

• The auth_method_id is defined by the boundary_auth_method_ldap resource, and can be accessed using the named scope id, like boundary_auth_method_ldap.name.id
• The login_name is the login name for this account.
• The name is the account name. Defaults to the resource name.
• is_primary_for_scope is set to true to make the LDAP auth method primary for the defined scope, in this case global. Users will automatically be created when logging in with LDAP.

Add these two resources into your main.tf file. The entire file contents are shown below.

terraform {
  required_providers {
    boundary = {
      source  = "hashicorp/boundary"
      version = "1.1.10"
    }
  }
}

output "auth-method-id" {
  value = boundary_auth_method_ldap.test_server.id
}

provider "boundary" {
  addr             = "http://127.0.0.1:9200"
  recovery_kms_hcl = <<EOT
kms "aead" {
  purpose = "recovery"
  aead_type = "aes-gcm"
  key = "nXz1K39auzqY+Bs02bGga0HS8xgFsNvE"
  key_id = "global_recovery"
}
EOT
}

resource "boundary_auth_method_ldap" "test_server" {
  name          = "LDAP Test Auth"
  description   = "LDAP auth method for test server"
  scope_id      = "global"
  urls          = "ldap://ldap.forumsys.com"
  bind-dn       = "cn=read-only-admin,dc=example,dc=com"
  bind-password = "password"
  user-dn       = "dc=example,dc=com"
  user-attr     = "uid"
  group-dn      = "dc=example,dc=com"
  is_primary_for_scope = true
}

resource "boundary_account_ldap" "ldap_user" {
  name           = "user1"
  description    = "LDAP account for user1"
  auth_method_id = boundary_auth_method_ldap.test_server.id
  login_name     = "user1"
}

terraform {
  required_providers {
    boundary = {
      source  = "hashicorp/boundary"
      version = "1.1.10"
    }
  }
}

output "auth-method-id" {
  value = boundary_auth_method_ldap.ad_test_server.id
}

provider "boundary" {
  addr             = "http://127.0.0.1:9200"
  recovery_kms_hcl = <<EOT
kms "aead" {
  purpose = "recovery"
  aead_type = "aes-gcm"
  key = "1jlRWVEBmsL05139sQcyq4uJTdrHFtiM"
  key_id = "global_recovery"
}
EOT
}

resource "boundary_auth_method_ldap" "ad_test_server" {
  name          = "LDAP Test Auth"
  description   = "LDAP auth method for AD test server"
  scope_id      = "global"
  urls          = ["ldap://localhost:7389"]
  bind_dn       = "CN=vagrant,CN=Users,DC=example,DC=local"
  bind_password = "vagrant"
  user_dn       = "CN=Users,DC=example,DC=local"
  user_attr     = "sAMAccountName"
  group_dn      = "CN=Users,DC=example,DC=local"
  group_attr    = "memberOf"
  insecure_tls  = true
  is_primary_for_scope = true
}

resource "boundary_account_ldap" "ldap_user" {
  name           = "user1"
  description    = "LDAP account for user1"
  auth_method_id = boundary_auth_method_ldap.ad_test_server.id
  login_name     = "user1"
}

With these resources in place, first initialize Terraform.

$ terraform init

Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/boundary versions matching "1.1.10"...
- Installing hashicorp/boundary v1.1.10...
- Installed hashicorp/boundary v1.1.10 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Next, apply the configuration. Enter yes when prompted for confirmation.

$ terraform apply

Terraform used the selected providers to generate the following execution plan. Resource
actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # boundary_account_ldap.ldap_user will be created
  + resource "boundary_account_ldap" "ldap_user" {
      + auth_method_id = (known after apply)
      + description    = "LDAP account for user1"
      + id             = (known after apply)
      + login_name     = "user1"
      + name           = "user1"
      + type           = "ldap"
    }

  # boundary_auth_method_ldap.test_server will be created
  + resource "boundary_auth_method_ldap" "test_server" {
      + bind_dn                     = "cn=read-only-admin,dc=example,dc=com"
      + bind_password               = "password"
      + bind_password_hmac          = (known after apply)
      + client_certificate_key_hmac = (known after apply)
      + dereference_aliases         = (known after apply)
      + description                 = "LDAP auth method for test server"
      + group_dn                    = "dc=example,dc=com"
      + id                          = (known after apply)
      + is_primary_for_scope        = true
      + name                        = "LDAP Test Auth"
      + scope_id                    = "global"
      + state                       = "active-public"
      + type                        = "ldap"
      + urls                        = [
          + "ldap://ldap.forumsys.com",
        ]
      + user_attr                   = "uid"
      + user_dn                     = "dc=example,dc=com"
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + auth-method-id = (known after apply)

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

boundary_auth_method_ldap.test_server: Creating...
boundary_auth_method_ldap.test_server: Creation complete after 0s [id=amldap_bGdOpSdD6u]
boundary_account_ldap.ldap_user: Creating...
boundary_account_ldap.ldap_user: Creation complete after 0s [id=acctldap_6E0BNj9UgA]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Outputs:

auth-method-id = "amldap_bGdOpSdD6u"

$ terraform apply

Terraform used the selected providers to generate the following execution plan. Resource
actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # boundary_account_ldap.ldap_user will be created
  + resource "boundary_account_ldap" "ldap_user" {
      + auth_method_id = (known after apply)
      + description    = "LDAP account for user1"
      + id             = (known after apply)
      + login_name     = "user1"
      + name           = "user1"
      + type           = "ldap"
    }

  # boundary_auth_method_ldap.ad_test_server will be created
  + resource "boundary_auth_method_ldap" "ad_test_server" {
      + bind_dn                     = "CN=vagrant,CN=Users,DC=example,DC=local"
      + bind_password               = "vagrant"
      + bind_password_hmac          = (known after apply)
      + client_certificate_key_hmac = (known after apply)
      + dereference_aliases         = (known after apply)
      + description                 = "LDAP auth method for AD test server"
      + group_attr                  = "memberOf"
      + group_dn                    = "CN=Users,DC=example,DC=local"
      + id                          = (known after apply)
      + insecure_tls                = true
      + is_primary_for_scope        = true
      + name                        = "LDAP Test Auth"
      + scope_id                    = "global"
      + state                       = (known after apply)
      + type                        = "ldap"
      + urls                        = [
          + "ldap://localhost:7389",
        ]
      + user_attr                   = "sAMAccountName"
      + user_dn                     = "CN=Users,DC=example,DC=local"
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + auth-method-id = (known after apply)

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

boundary_auth_method_ldap.ad_test_server: Creating...
boundary_auth_method_ldap.ad_test_server: Creation complete after 0s [id=amldap_IffTU3qAy5]
boundary_account_ldap.ldap_user: Creating...
boundary_account_ldap.ldap_user: Creation complete after 0s [id=acctldap_XAy2Jza0yy]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Outputs:

auth-method-id = "amldap_IffTU3qAy5"

Currently the login type is set as inactive, and won't allow authentication.

$ boundary authenticate ldap -auth-method-id $BOUNDARY_AUTH_METHOD_ID -login-name einstein
Please enter the password (it will be hidden):
Error from controller when performing authentication

Error information:
  Kind:                Unauthenticated
  Message:             Unable to authenticate.
  Status:              401
  context:             Error from controller when performing authentication

$ boundary authenticate ldap -auth-method-id $BOUNDARY_AUTH_METHOD_ID -login-name m.barten
Please enter the password (it will be hidden):
Error from controller when performing authentication

Error information:
  Kind:                Unauthenticated
  Message:             Unable to authenticate.
  Status:              401
  context:             Error from controller when performing authentication

You must set the new auth method to an active state before it will be allowed.

Under the settings for the new auth method, select Inactive from the menu in the upper-right side of the page and change its state by clicking Public.

The login type is now allowed.

Set LDAP as primary login

Global and organization scopes may have auth methods in Boundary, and each scope has one primary auth-method ID. Boundary automatically creates a user upon first successful authentication via the scope’s primary auth method, which will be used by scopes with only one auth method available.

When migrating the database, Boundary will produce a log of any auth methods which resulted in no primary auth method being set for the scope.

Set the new LDAP auth method as the primary auth method for the global scope.

Under the settings for the new auth method, select Manage from the menu in the upper-right side of the page.

A confirmation window will be displayed to inform you that new users that sign in via LDAP will automatically be added to the new auth method. Click OK to continue.

Currently the login type is set as inactive, and won't allow authentication.

$ boundary authenticate ldap -auth-method-id $BOUNDARY_AUTH_METHOD_ID -login-name einstein
Please enter the password (it will be hidden):
Error from controller when performing authentication

Error information:
  Kind:                Unauthenticated
  Message:             Unable to authenticate.
  Status:              401
  context:             Error from controller when performing authentication

$ boundary auth-methods update ldap -id $BOUNDARY_AUTH_METHOD_ID -state active-public

Auth Method information:
  Created Time:         Tue, 03 Oct 2023 18:32:16 MDT
  ID:                   amldap_gLx3Gg3ZdG
  Type:                 ldap
  Updated Time:         Tue, 03 Oct 2023 18:49:23 MDT
  Version:              2

  Scope:
    ID:                 global
    Name:               global
    Type:               global

  Authorized Actions:
    no-op
    read
    update
    delete
    authenticate

  Authorized Actions on Auth Method's Collections:
    accounts:
      create
      list
    managed-groups:
      create
      list

  Attributes:
    bind_dn:            cn=read-only-admin,dc=example,dc=com
    bind_password_hmac: IC29KNPDTPC57nc2aT9UFthOh4Kh1i3660_euBsgL7Y
    group_dn:           dc=example,dc=com
    state:              active-public
    urls:               [ldap://ldap.forumsys.com]
    user_attr:          uid
    user_dn:            dc=example,dc=com

$ boundary authenticate ldap -auth-method-id $BOUNDARY_AUTH_METHOD_ID -login-name m.barten
Please enter the password (it will be hidden):
Error from controller when performing authentication

Error information:
  Kind:                Unauthenticated
  Message:             Unable to authenticate.
  Status:              401??
  context:             Error from controller when performing authentication

$ boundary auth-methods update ldap -id $BOUNDARY_AUTH_METHOD_ID -state active-public

Auth Method information:
  Created Time:         Thu, 05 Oct 2023 14:07:56 MDT
  ID:                   amldap_1cOqu39sSS
  Type:                 ldap
  Updated Time:         Thu, 05 Oct 2023 14:13:40 MDT
  Version:              2

  Scope:
    ID:                 global
    Name:               global
    Type:               global

  Authorized Actions:
    no-op
    read
    update
    delete
    authenticate

  Authorized Actions on Auth Method's Collections:
    accounts:
      create
      list
    managed-groups:
      create
      list

  Attributes:
    bind_dn:            CN=vagrant,CN=Users,DC=example,DC=local
    bind_password_hmac: jHkdqn-vmn6IbSaT1rkzz5ypVrRCwZ2BjBV4aCwpP5E
    group_dn:           CN=Users,DC=example,DC=local
    state:              active-public
    urls:               [ldap://4.tcp.us-cal-1.ngrok.io:13713]
    user_attr:          sAMAccountName
    user_dn:            CN=Users,DC=example,DC=local

The login type will now allow be allowed.

Set LDAP as the primary login

Global and organization scopes may have auth methods in Boundary, and each scope has one primary auth-method ID. Boundary automatically creates a user upon first successful authentication via the scope’s primary auth method, which will be used by scopes with only one auth method available.

When migrating the database, Boundary will produce a log of any auth methods which resulted in no primary auth method being set for the scope.

If LDAP is not the only auth method for a scope, it should be set as primary when initially creating the auth method.

Set the new LDAP auth method as the primary auth method for the global scope.

$ boundary scopes update -primary-auth-method-id $BOUNDARY_AUTH_METHOD_ID -id global

Scope information:
  Created Time:             Wed, 20 Sep 2023 10:22:22 MDT
  ID:                       global
  Primary Auth Method ID:   amldap_gLx3Gg3ZdG
  Updated Time:             Tue, 03 Oct 2023 18:54:24 MDT
  Version:                  4

  Scope (parent):
    ID:                     global
    Name:                   global
    Type:                   global

  Authorized Actions:
    no-op
    read
    update
    delete

  Authorized Actions on Scope's Collections:
    auth-methods:
      create
      list
    auth-tokens:
      list
    groups:
      create
      list
    roles:
      create
      list
    scopes:
      create
      list
      list-keys
      rotate-keys
      list-key-version-destruction-jobs
      destroy-key-version
    session-recordings:
      list
    storage-buckets:
      create
      list
    users:
      create
      list
    workers:
      create:controller-led
      create:worker-led
      list
      read-certificate-authority
      reinitialize-certificate-authority

Auth methods must be updated to an active state before they can be used.

You can check the state of the new auth method using the read operation. First, ensure you are logged in as the admin user.

$ boundary authenticate password -auth-method-id ampw_1234567890 -login-name admin
Please enter the password (it will be hidden): <password>

Authentication information:
  Account ID:      apw_DZRvFzmb0Y
  Auth Method ID:  ampw_1234567890
  Expiration Time: Thu, 20 May 2021 16:32:06 MDT
  User ID:         u_1234567890

The token was successfully stored in the chosen keyring and is not displayed here.

Next read the auth method details. Use the auth-method-id you copied from the terraform apply output.

$ boundary auth-methods read -id amldap_tXtzfylpwz

Auth Method information:
  Created Time:         Fri, 01 Dec 2023 12:03:23 MST
  Description:          LDAP auth method for test server
  ID:                   amldap_tXtzfylpwz
  Name:                 LDAP Test Auth
  Type:                 ldap
  Updated Time:         Fri, 01 Dec 2023 12:03:23 MST
  Version:              1

  Scope:
    ID:                 global
    Name:               global
    Type:               global

  Authorized Actions:
    no-op
    read
    update
    delete
    authenticate

  Authorized Actions on Auth Method's Collections:
    accounts:
      create
      list
    managed-groups:
      create
      list

  Attributes:
    bind_dn:            cn=read-only-admin,dc=example,dc=com
    bind_password_hmac: sHocbfa-JtlGvCzZ6-aTMFAlvun7t4oMl0SmxLbUn_g
    group_dn:           dc=example,dc=com
    state:              active-public
    urls:               [ldap://ldap.forumsys.com]
    user_attr:          uid
    user_dn:            dc=example,dc=com

Notice at the bottom of the output that the login state is already set to active-public.

It's important to be aware that using Terraform to provision an auth method will set the state to active by default, unless otherwise defined. The state attribute can be used on the boundary_auth_method_ldap resource to set an auth method to active-private or inactive.

Now that the auth method state has been verified, define it explicitly in the Terraform configuration file.

Set LDAP to active-public

Global and organization scopes may have auth methods in Boundary, and each scope has one primary auth-method ID. Boundary will automatically create a user upon first successful authentication via the scope’s primary auth method, which will be used by scopes with only one auth method available.

When migrating the database, Boundary will produce a log of any auth methods which have more than one auth method which resulted in no primary auth method being set for the scope.

Update the boundary_auth_method_ldap resource in the main.tf file to set the auth method's state to active-public for clarity

Below is an example. Update your main.tf file accordingly.

resource "boundary_auth_method_ldap" "test_server" {
  name                 = "LDAP Test Auth"
  description          = "LDAP auth method for test server"
  scope_id             = "global"
  urls                 = ["ldap://ldap.forumsys.com"]
  bind_dn              = "cn=read-only-admin,dc=example,dc=com"
  bind_password        = "password"
  user_dn              = "dc=example,dc=com"
  user_attr            = "uid"
  group_dn             = "dc=example,dc=com"
  is_primary_for_scope = true
  state                = "active-public"
}

resource "boundary_auth_method_ldap" "ad_test_server" {
  name          = "LDAP Test Auth"
  description   = "LDAP auth method for AD test server"
  scope_id      = "global"
  urls          = ["ldap://localhost:7389"]
  bind_dn       = "CN=vagrant,CN=Users,DC=example,DC=local"
  bind_password = "vagrant"
  user_dn       = "CN=Users,DC=example,DC=local"
  user_attr     = "sAMAccountName"
  group_dn      = "CN=Users,DC=example,DC=local"
  group_attr    = "memberOf"
  insecure_tls  = true
  is_primary_for_scope = true
  state                = "active-public"
}

Apply the updated configuration. Enter yes when prompted.

$ terraform apply
boundary_auth_method_ldap.test_server: Refreshing state... [id=amldap_07AEZFZtR7]
boundary_account_ldap.ldap_user: Refreshing state... [id=acctldap_KsFP35tx0Z]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no
differences, so no changes are needed.

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

auth-method-id = "amldap_07AEZFZtR7"

Notice no changes were made, since the auth method is already set as active-public. The auth method can be disabled in the future by updating the state attribute and re-applying the Terraform configuration.

With the auth method verified as active and defined as the primary login method, users can authenticate using the LDAP server.

The Boundary Desktop app is currently available for MacOS and Windows users.

1. Launch the Boundary Desktop app and enter the Boundary Cluster URL.

   Launch the Boundary Desktop app and enter http://localhost:9200 as the Cluster URL, then click Submit.

   

2. Select LDAP.

   Enter the following LDAP credentials:

   LDAP test serverActive Directory

   • Login Name: einstein
   • Password : password

   • Login Name: m.barten
   • Password : Foo_b_ar123!

   Click Sign in.

The Boundary Desktop App provides a view of Targets and Sessions.

To continue learning about assigning LDAP accounts to a managed group to control permissions grants, ensure you can also log in using the Admin Console or CLI.

Select the admin user menu in the top-right corner of the page and click Sign Out.

Next, select the new auth method called LDAP-test-auth.

Enter the following LDAP credentials:

After successful authentication you are automatically redirected to the Admin Console. Notice the restricted permissions for this new user, which cannot currently view resources like auth methods or roles.

If you were to log back into the Admin Console as the admin user, you would notice the new LDAP user has automatically been added under the Users view.

Next you will review the various methods that can be used to authenticate to Boundary using the new LDAP auth method.

The boundary authenticate command will use the primary auth method for the default scope, which has been set to the LDAP auth method. The boundary authenticate ldap command can be used to select an LDAP auth method not set as primary for a scope.

Now try authenticating using the newly created LDAP auth method.

$ boundary authenticate
Please enter the login name: einstein
Please enter the password (it will be hidden):

Authentication information:
  Account ID:      acctldap_xj6SPKdN6a
  Auth Method ID:  amldap_gLx3Gg3ZdG
  Expiration Time: Tue, 10 Oct 2023 18:55:33 MDT
  User ID:         u_DHVWuJUCve

The token was successfully stored in the chosen keyring and is not displayed here.

$ boundary authenticate
Please enter the login name: m.barten
Please enter the password (it will be hidden):

Authentication information:
  Account ID:      acctldap_xj6SPKdN6a
  Auth Method ID:  amldap_gLx3Gg3ZdG
  Expiration Time: Tue, 10 Oct 2023 18:55:33 MDT
  User ID:         u_DHVWuJUCve

The token was successfully stored in the chosen keyring and is not displayed here.

You have now successfully authenticated using the new LDAP auth method.

After logging in your terminal should confirm the account and user IDs.

Listing various scope items show this user is not able to access most resources by default.

Try recursively listing the available roles.

$ boundary roles list -recursive
Error from controller when performing list on roles

Error information:
  Kind:                PermissionDenied
  Message:             Forbidden.
  Status:              403
  context:             Error from controller when performing list on roles

Next, you will set up a Boundary managed group to provide role-based access for LDAP groups.

According to the Online LDAP Test Server, two groups exist for testing LDAP:

• ou=mathematicians
• ou=scientists

The scientists group contains the following users:

• uid=einstein
• uid=newton
• uid=galieleo
• uid=tesla

Verify LDAP account details

Earlier, you authenticated with the einstein user account. First, check that this account is associated with the LDAP auth method.

$ boundary authenticate password -auth-method-id $ADMIN_AUTH_METHOD_ID

$ boundary accounts list -auth-method-id $BOUNDARY_AUTH_METHOD_ID

Account information:
  ID:                    acctldap_xj6SPKdN6a
    Version:             2
    Type:                ldap
    Authorized Actions:
      no-op
      read
      update
      delete

$ boundary accounts read -id acctldap_xj6SPKdN6a

Account information:
  Auth Method ID:      amldap_gLx3Gg3ZdG
  Created Time:        Tue, 03 Oct 2023 18:44:46 MDT
  ID:                  acctldap_xj6SPKdN6a
  Type:                ldap
  Updated Time:        Tue, 03 Oct 2023 18:55:33 MDT
  Version:             2

  Scope:
    ID:                global
    Name:              global
    Type:              global

  Authorized Actions:
    no-op
    read
    update
    delete

  Attributes:
    Login Name:        einstein
    dn:                uid=einstein,dc=example,dc=com

$ boundary auth-methods update ldap -id $BOUNDARY_AUTH_METHOD_ID -enable-groups

Auth Method information:
  Created Time:           Tue, 03 Oct 2023 18:32:16 MDT
  ID:                     amldap_gLx3Gg3ZdG
  Is Primary For Scope:   true
  Type:                   ldap
  Updated Time:           Wed, 04 Oct 2023 21:52:40 MDT
  Version:                3

  Scope:
    ID:                   global
    Name:                 global
    Type:                 global

  Authorized Actions:
    no-op
    read
    update
    delete
    authenticate

  Authorized Actions on Auth Method's Collections:
    accounts:
      create
      list
    managed-groups:
      create
      list

  Attributes:
    bind_dn:              cn=read-only-admin,dc=example,dc=com
    bind_password_hmac:   IC29KNPDTPC57nc2aT9UFthOh4Kh1i3660_euBsgL7Y
    enable_groups:        true
    group_dn:             dc=example,dc=com
    state:                active-public
    urls:                 [ldap://ldap.forumsys.com]
    user_attr:            uid
    user_dn:              dc=example,dc=com

$ boundary managed-groups create ldap \
-name science-group \
-group-names Scientists

$ boundary managed-groups create ldap \
-name science-group \
-group-names Scientists

Managed Group information:
  Auth Method ID:      amldap_gLx3Gg3ZdG
  Created Time:        Wed, 04 Oct 2023 21:19:49 MDT
  ID:                  mgldap_hk5TbtFkQv
  Name:                science-group
  Type:                ldap
  Updated Time:        Wed, 04 Oct 2023 21:19:49 MDT
  Version:             1

  Scope:
    ID:                global
    Name:              global
    Type:              global

  Authorized Actions:
    no-op
    read
    update
    delete

  Attributes:
    group_names:       [Scientists]

$ export MG_LDAP_ID="mgldap_hk5TbtFkQv"

$ boundary authenticate password -auth-method-id $ADMIN_AUTH_METHOD_ID -login-name admin

$ boundary accounts list -auth-method-id $BOUNDARY_AUTH_METHOD_ID

Account information:
  ID:                    acctldap_xj6SPKdN6a
    Version:             2
    Type:                ldap
    Authorized Actions:
      no-op
      read
      update
      delete

$ boundary accounts read -id acctldap_xj6SPKdN6a

Account information:
  Auth Method ID:      amldap_gLx3Gg3ZdG
  Created Time:        Tue, 03 Oct 2023 18:44:46 MDT
  ID:                  acctldap_xj6SPKdN6a
  Type:                ldap
  Updated Time:        Tue, 03 Oct 2023 18:55:33 MDT
  Version:             2

  Scope:
    ID:                global
    Name:              global
    Type:              global

  Authorized Actions:
    no-op
    read
    update
    delete

  Attributes:
    Login Name:        einstein
    dn:                uid=einstein,dc=example,dc=com

resource "boundary_auth_method_ldap" "test_server" {
  name                 = "LDAP Test Auth"
  description          = "LDAP auth method for test server"
  scope_id             = "global"
  urls                 = ["ldap://ldap.forumsys.com"]
  bind_dn              = "cn=read-only-admin,dc=example,dc=com"
  bind_password        = "password"
  user_dn              = "dc=example,dc=com"
  user_attr            = "uid"
  group_dn             = "dc=example,dc=com"
  is_primary_for_scope = true
  state                = "active-public"
  enable_groups        = true
}

resource "boundary_managed_group_ldap" "science_group" {
  auth_method_id = boundary_auth_method_ldap.test_server.id
  name           = "science-group"
  group_names    = ["Scientists"]
}

According to the vagrant-active-directory usage docs, sevaral groups exist for testing LDAP, including:

• alpha
• beta
• Gamma Nested
• omega nested

The alpha group contains many users, including:

• m.barten
• j.padula
• g.schrei
• a.clemot

All users have the password Foo_b_ar123!

Verify LDAP account details

Earlier, you authenticated with the m.barten user account.

First, check that this account is associated with the LDAP auth method.

$ boundary authenticate password -auth-method-id $ADMIN_AUTH_METHOD_ID

$ boundary accounts list -auth-method-id $BOUNDARY_AUTH_METHOD_ID

Account information:
  ID:                    acctldap_xj6SPKdN6a
    Version:             1
    Type:                ldap
    Authorized Actions:
      no-op
      read
      update
      delete

$ boundary accounts read -id acctldap_xj6SPKdN6a

Account information:
  Auth Method ID:      amldap_inmNgkYyBA
  Created Time:        Thu, 05 Oct 2023 18:04:53 MDT
  ID:                  acctldap_Gh2bYmHRC2
  Type:                ldap
  Updated Time:        Thu, 05 Oct 2023 18:04:53 MDT
  Version:             1

  Scope:
    ID:                global
    Name:              global
    Type:              global

  Authorized Actions:
    no-op
    read
    update
    delete

  Attributes:
    Login Name:        m.barten
    dn:                CN=Milka Barten,CN=Users,DC=example,DC=local

$ boundary auth-methods update ldap -id $BOUNDARY_AUTH_METHOD_ID -enable-groups

Auth Method information:
  Created Time:         Thu, 05 Oct 2023 18:03:21 MDT
  ID:                   amldap_inmNgkYyBA
  Type:                 ldap
  Updated Time:         Thu, 05 Oct 2023 20:19:14 MDT
  Version:              3

  Scope:
    ID:                 global
    Name:               global
    Type:               global

  Authorized Actions:
    no-op
    read
    update
    delete
    authenticate

  Authorized Actions on Auth Method's Collections:
    accounts:
      create
      list
    managed-groups:
      create
      list

  Attributes:
    bind_dn:            CN=vagrant,CN=Users,DC=example,DC=local
    bind_password_hmac: 8x3QV2Mc2E-OyAQ3vZ0Xi--rXjLrz3GB132TFX7ftRU
    enable_groups:      true
    group_attr:         memberOf
    group_dn:           CN=Users,DC=example,DC=local
    state:              active-public
    urls:               [ldap://4.tcp.us-cal-1.ngrok.io:17592]
    user_attr:          sAMAccountName
    user_dn:            CN=Users,DC=example,DC=local

$ boundary managed-groups create ldap \
-name alpha-group \
-group-names alpha

Managed Group information:
  Auth Method ID:      amldap_inmNgkYyBA
  Created Time:        Thu, 05 Oct 2023 20:22:53 MDT
  ID:                  mgldap_wiow7ig6DI
  Name:                alpha-group
  Type:                ldap
  Updated Time:        Thu, 05 Oct 2023 20:22:53 MDT
  Version:             1

  Scope:
    ID:                global
    Name:              global
    Type:              global

  Authorized Actions:
    no-op
    read
    update
    delete

  Attributes:
    group_names:       [alpha]

$ export MG_LDAP_ID="mgldap_hk5TbtFkQv"

$ boundary authenticate password -auth-method-id $ADMIN_AUTH_METHOD_ID -login-name admin

$ boundary accounts list -auth-method-id $BOUNDARY_AUTH_METHOD_ID

Account information:
  ID:                    acctldap_xj6SPKdN6a
    Version:             1
    Type:                ldap
    Authorized Actions:
      no-op
      read
      update
      delete

$ boundary accounts read -id acctldap_xj6SPKdN6a

Account information:
  Auth Method ID:      amldap_inmNgkYyBA
  Created Time:        Thu, 05 Oct 2023 18:04:53 MDT
  ID:                  acctldap_Gh2bYmHRC2
  Type:                ldap
  Updated Time:        Thu, 05 Oct 2023 18:04:53 MDT
  Version:             1

  Scope:
    ID:                global
    Name:              global
    Type:              global

  Authorized Actions:
    no-op
    read
    update
    delete

  Attributes:
    Login Name:        m.barten
    dn:                CN=Milka Barten,CN=Users,DC=example,DC=local

resource "boundary_auth_method_ldap" "ad_test_server" {
  name                 = "LDAP Test Auth"
  description          = "LDAP auth method for AD test server"
  scope_id             = "global"
  urls                 = ["ldap://localhost:7389"]
  bind_dn              = "CN=vagrant,CN=Users,DC=example,DC=local"
  bind_password        = "vagrant"
  user_dn              = "CN=Users,DC=example,DC=local"
  user_attr            = "sAMAccountName"
  group_dn             = "CN=Users,DC=example,DC=local"
  group_attr           = "memberOf"
  insecure_tls         = true
  is_primary_for_scope = true
  state                = "active-public"
  state                = "active-public"
  enable_groups        = true
}

resource "boundary_managed_group_ldap" "alpha_group" {
  auth_method_id = boundary_auth_method_ldap.ad_test_server
  name           = "alpha-group"
  group_names    = ["alpha"]
}

First, create a new role in the global scope.

1. Navigate to the Roles page in the Global scope.

2. Click New Role. Fill in the following role details:

   • Name: read-roles

   Click Save.

3. On the Settings page, Click Edit Form. Select a scope underneath Global, such as Generated org scope, quick-start-org, or any other org you have created.

   Click Save.

Assign grants to roles

Use the grant ids=*;type=role;actions=list,read, which selects any role ID and allows you to perform list and read actions. Include the grant ids=*;type=scope;actions=list,read, which selects any scope and allows you to perform list and read actions. To learn more about setting permission grants, check out the Permission Grant Formats documentation.

1. Select the Grants tab.

2. In the New Grant field, enter the following:

   • ids=*;type=role;actions=list,read

3. Click Add.

4. In the New Grant field, enter the following:

   • ids=*;type=scope;actions=list,read

5. Click Add, then Save.

Add managed group as a role principle

Next, add the new managed group as a role principal so the group will inherit any grants associated with the role.

With the grants in place the LDAP user should automatically be allowed to list and read roles upon authentication.

Test managed group membership

Test that the LDAP user belongs to the managed group, and has inherited the defined role principals.

1. Log back in using the LDAP auth method.

2. Select the admin user menu in the top-right corner of the page and click Sign Out.

3. Authenticate using the new auth method.

   Select the auth method called LDAP-test-auth.

   Enter the following LDAP credentials:

   LDAP test serverActive Directory

   • Login Name: einstein
   • Password : password

   • Login Name: m.barten
   • Password : Foo_b_ar123!

   Click Sign In.

4. After successful authentication you are automatically redirected to the Admin Console. Select global scope.

5. Check that you are now able to view the Roles page.

   

First, create a new role in the global scope.

$ boundary roles create -scope-id=global -name="read-roles"

Role information:
  Created Time:        Wed, 04 Oct 2023 21:24:38 MDT
  Grant Scope ID:      global
  ID:                  r_12BNVEo23v
  Updated Time:        Wed, 04 Oct 2023 21:24:38 MDT
  Version:             1

  Scope:
    ID:                global
    Name:              global
    Type:              global

  Authorized Actions:
    no-op
    read
    update
    delete
    add-principals
    set-principals
    remove-principals
    add-grants
    set-grants
    remove-grants

Copy the role ID from the output, such as r_12BNVEo23v and create an environment variable.

$ export ROLE_ID="r_12BNVEo23v"

Add managed group as a role principle

Next, add the new managed group as a role principal so the group will inherit any grants associated with the role.

$ boundary roles add-principals -id=$ROLE_ID -principal $MG_LDAP_ID

Role information:
  Created Time:        Wed, 04 Oct 2023 21:24:38 MDT
  Grant Scope ID:      global
  ID:                  r_12BNVEo23v
  Updated Time:        Wed, 04 Oct 2023 21:27:17 MDT
  Version:             2

  Scope:
    ID:                global
    Name:              global
    Type:              global

  Authorized Actions:
    no-op
    read
    update
    delete
    add-principals
    set-principals
    remove-principals
    add-grants
    set-grants
    remove-grants

  Principals:
    ID:             mgldap_hk5TbtFkQv
      Type:         managed group
      Scope ID:     global

Assign grants to roles

Use the grant ids=*;type=role;actions=list,read, which selects any role ID and allows you to perform list and read actions. Include the grant ids=*;type=scope;actions=list,read, which selects any scope and allows you to perform list and read actions. To learn more about setting permission grants, check out the Permission Grant Formats documentation.

$ boundary roles add-grants -id=$ROLE_ID -grant "ids=*;type=role;actions=list,read" -grant "ids=*;type=scope;actions=list,read"

Role information:
  Created Time:        Wed, 04 Oct 2023 21:24:38 MDT
  Grant Scope ID:      global
  ID:                  r_12BNVEo23v
  Updated Time:        Wed, 04 Oct 2023 21:28:30 MDT
  Version:             3

  Scope:
    ID:                global
    Name:              global
    Type:              global

  Authorized Actions:
    no-op
    read
    update
    delete
    add-principals
    set-principals
    remove-principals
    add-grants
    set-grants
    remove-grants

  Principals:
    ID:             mgldap_hk5TbtFkQv
      Type:         managed group
      Scope ID:     global

  Canonical Grants:
    ids=*;type=role;actions=list,read
    ids=*;type=scope;actions=list,read

With the grants in place the LDAP user should automatically be allowed to list and read roles upon authentication.

Test managed group membership

Test that the LDAP user belongs to the managed group, and has inherited the defined role principals.

First, create a new role in the global scope.

Open the main.tf file and add a new boundary_role resource. Add the name, description, principal_ids, grant_strings, and scope_id schema.

Use the global scope id. For the principal_ids, add the new managed group as a role principal so the group will inherit any grants associated with the role.

Set grant_strings to grant_strings = ["ids=*;type=role;actions=list,read","ids=*;type=scope;actions=list,read"], which selects any role ID and allows list and read actions to be performed, and allows the user to view the scopes that contain the role. To learn more about setting permission grants, check out the Permission Grant Formats documentation.

Additionally, add a new outputs value to print the id of the role.

resource "boundary_role" "read_roles" {
  name          = "read-roles"
  description   = "List and read roles"
  principal_ids = [boundary_managed_group.science_group.id]
  grant_strings = ["ids=*;type=role;actions=list,read","ids=*;type=scope;actions=list,read"]
  scope_id      = "global"
}

output "role-id" {
  value = boundary_role.read_roles.id
}

terraform {
  required_providers {
    boundary = {
      source  = "hashicorp/boundary"
      version = "1.1.10"
    }
  }
}

output "auth-method-id" {
  value = boundary_auth_method_ldap.test_server.id
}

output "managed-group-id" {
  value = boundary_managed_group.science_group.id
}

output "role-id" {
  value = boundary_role.read_roles.id
}

provider "boundary" {
  addr             = "http://127.0.0.1:9200"
  recovery_kms_hcl = <<EOT
kms "aead" {
  purpose = "recovery"
  aead_type = "aes-gcm"
  key = "EDrPfCkzxRrNlsPwp+lAp11Dtnu0C14vLDCzBSxvo1s="   #updateme
  key_id = "global_recovery"
}
EOT
}

resource "boundary_auth_method_ldap" "test_server" {
  name                 = "LDAP Test Auth"
  description          = "LDAP auth method for test server"
  scope_id             = "global"
  urls                 = ["ldap://ldap.forumsys.com"]
  bind_dn              = "cn=read-only-admin,dc=example,dc=com"
  bind_password        = "password"
  user_dn              = "dc=example,dc=com"
  user_attr            = "uid"
  group_dn             = "dc=example,dc=com"
  is_primary_for_scope = true
  state                = "active-public"
  enable_groups        = true
}

resource "boundary_account_ldap" "ldap_user" {
  name           = "user1"
  description    = "LDAP account for user1"
  auth_method_id = boundary_auth_method_ldap.ad_test_server.id
  login_name     = "user1"
}

resource "boundary_managed_group_ldap" "science_group" {
  auth_method_id = boundary_auth_method_ldap.test_server.id
  name           = "science-group"
  group_names    = ["Scientists"]
}

resource "boundary_role" "read_roles" {
  name          = "read-roles"
  description   = "List and read roles"
  principal_ids = [boundary_managed_group.science_group.id]
  grant_strings = ["ids=*;type=role;actions=list,read","ids=*;type=scope;actions=list,read"]
  scope_id      = "global"
}

$ terraform apply
boundary_auth_method_ldap.test_server: Refreshing state... [id=amldap_OghYhJ8kG6]
boundary_account_ldap.ldap_user: Refreshing state... [id=acctldap_WGVbJLXtEm]

Terraform used the selected providers to generate the following execution plan. Resource actions
are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # boundary_auth_method_ldap.test_server will be updated in-place
  ~ resource "boundary_auth_method_ldap" "test_server" {
      ~ enable_groups        = false -> true
        id                   = "amldap_OghYhJ8kG6"
        name                 = "LDAP Test Auth"
        # (17 unchanged attributes hidden)
    }

  # boundary_managed_group_ldap.science_group will be created
  + resource "boundary_managed_group_ldap" "science_group" {
      + auth_method_id = "amldap_OghYhJ8kG6"
      + group_names    = [
          + "Scientists",
        ]
      + id             = (known after apply)
      + name           = "science-group"
    }

  # boundary_role.read_roles will be created
  + resource "boundary_role" "read_roles" {
      + description    = "List and read roles"
      + grant_scope_id = (known after apply)
      + grant_strings  = [
          + "ids=*;type=role;actions=list,read",
          + "ids=*;type=scope;actions=list,read",
        ]
      + id             = (known after apply)
      + name           = "read-roles"
      + principal_ids  = (known after apply)
      + scope_id       = "global"
    }

Plan: 2 to add, 1 to change, 0 to destroy.

Changes to Outputs:
  + managed-group-id = (known after apply)
  + role-id          = (known after apply)

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

boundary_auth_method_ldap.test_server: Modifying... [id=amldap_OghYhJ8kG6]
boundary_auth_method_ldap.test_server: Modifications complete after 0s [id=amldap_OghYhJ8kG6]
boundary_managed_group_ldap.science_group: Creating...
boundary_managed_group_ldap.science_group: Creation complete after 0s [id=mgldap_8txVupegPg]
boundary_role.read_roles: Creating...
boundary_role.read_roles: Creation complete after 0s [id=r_KVncZBh6tj]

Apply complete! Resources: 2 added, 1 changed, 0 destroyed.

Outputs:

auth-method-id = "amldap_OghYhJ8kG6"
managed-group-id = "mgldap_8txVupegPg"
role-id = "r_KVncZBh6tj"

resource "boundary_role" "read_roles" {
  name          = "read-roles"
  description   = "List and read roles"
  principal_ids = [boundary_managed_group.alpha_group.id]
  grant_strings = ["ids=*;type=role;actions=list,read","ids=*;type=scope;actions=list,read"]
  scope_id      = "global"
}

output "role-id" {
  value = boundary_role.read_roles.id
}

terraform {
  required_providers {
    boundary = {
      source  = "hashicorp/boundary"
      version = "1.1.10"
    }
  }
}

output "auth-method-id" {
  value = boundary_auth_method_ldap.ad_test_server.id
}

output "managed-group-id" {
  value = boundary_managed_group.alpha_group.id
}

output "role-id" {
  value = boundary_role.read_roles.id
}

provider "boundary" {
  addr             = "http://127.0.0.1:9200"
  recovery_kms_hcl = <<EOT
kms "aead" {
  purpose = "recovery"
  aead_type = "aes-gcm"
  key = "EDrPfCkzxRrNlsPwp+lAp11Dtnu0C14vLDCzBSxvo1s="   #updateme
  key_id = "global_recovery"
}
EOT
}

resource "boundary_auth_method_ldap" "ad_test_server" {
  name                 = "LDAP Test Auth"
  description          = "LDAP auth method for AD test server"
  scope_id             = "global"
  urls                 = ["ldap://localhost:7389"]
  bind_dn              = "CN=vagrant,CN=Users,DC=example,DC=local"
  bind_password        = "vagrant"
  user_dn              = "CN=Users,DC=example,DC=local"
  user_attr            = "sAMAccountName"
  group_dn             = "CN=Users,DC=example,DC=local"
  group_attr           = "memberOf"
  insecure_tls         = true
  is_primary_for_scope = true
  state                = "active-public"
  enable_groups        = true
}

resource "boundary_account_ldap" "ldap_user" {
  name           = "user1"
  description    = "LDAP account for user1"
  auth_method_id = boundary_auth_method_ldap.ad_test_server.id
  login_name     = "user1"
}

resource "boundary_managed_group_ldap" "alpha_group" {
  auth_method_id = boundary_auth_method_ldap.ad_test_server.id
  name           = "alpha-group"
  group_names    = ["alpha"]
}

resource "boundary_role" "read_roles" {
  name          = "read-roles"
  description   = "List and read roles"
  principal_ids = [boundary_managed_group_ldap.alpha_group.id]
  grant_strings = ["ids=*;type=role;actions=list,read","ids=*;type=scope;actions=list,read"]
  scope_id      = "global"
}

$ terraform apply
boundary_auth_method_ldap.ad_test_server: Refreshing state... [id=amldap_Tn4uKBpo1b]
boundary_account_ldap.ldap_user: Refreshing state... [id=acctldap_wA9ibRCGzD]

Terraform used the selected providers to generate the following execution plan. Resource actions
are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # boundary_auth_method_ldap.ad_test_server will be updated in-place
  ~ resource "boundary_auth_method_ldap" "ad_test_server" {
      ~ enable_groups        = false -> true
        id                   = "amldap_Tn4uKBpo1b"
        name                 = "LDAP Test Auth"
        # (18 unchanged attributes hidden)
    }

  # boundary_managed_group_ldap.alpha_group will be created
  + resource "boundary_managed_group_ldap" "alpha_group" {
      + auth_method_id = "amldap_Tn4uKBpo1b"
      + group_names    = [
          + "alpha",
        ]
      + id             = (known after apply)
      + name           = "alpha-group"
    }

  # boundary_role.read_roles will be created
  + resource "boundary_role" "read_roles" {
      + description    = "List and read roles"
      + grant_scope_id = (known after apply)
      + grant_strings  = [
          + "ids=*;type=role;actions=list,read",
          + "ids=*;type=scope;actions=list,read",
        ]
      + id             = (known after apply)
      + name           = "read-roles"
      + principal_ids  = (known after apply)
      + scope_id       = "global"
    }

Plan: 2 to add, 1 to change, 0 to destroy.

Changes to Outputs:
  + managed-group-id = (known after apply)
  + role-id          = (known after apply)

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

boundary_auth_method_ldap.ad_test_server: Modifying... [id=amldap_Tn4uKBpo1b]
boundary_auth_method_ldap.ad_test_server: Modifications complete after 0s [id=amldap_Tn4uKBpo1b]
boundary_managed_group_ldap.alpha_group: Creating...
boundary_managed_group_ldap.alpha_group: Creation complete after 0s [id=mgldap_Sdx83nE1HC]
boundary_role.read_roles: Creating...
boundary_role.read_roles: Creation complete after 1s [id=r_puRWK8bxT1]

Apply complete! Resources: 2 added, 1 changed, 0 destroyed.

Outputs:

auth-method-id = "amldap_Tn4uKBpo1b"
managed-group-id = "mgldap_Sdx83nE1HC"
role-id = "r_puRWK8bxT1"

Note the role ID from the output, such as r_0Uz8McGUEs

With the grants in place the ldap user should automatically be allowed to list and read roles upon authentication.

Test managed group membership

Test that the LDAP user belongs to the managed group, and has inherited the defined role principals.