SSL/TLS How-to for Active Directory LDAPS User source

Ignition
41

Hey guys, it took me a while to figure this out from reading this post, so I wanted to share the steps that worked for me. I'm on Ignition version 8.3.6 currently.

  1. On the IT side, after configuring Active Directory on our Windows Server serving as our domain controller (DC), our guys installed AD Certificate Services (and importantly Web Enrollment), following this documentation Design and implement AD CS - Training | Microsoft Learn. They also created a username/password on the DC for remote login from Ignition.

  2. This enabled us to download a Root CA certificate from http://<ip_address>/certsrv or http://<_fqdn_>/certsrv (where fqdn = fully qualified domain name). See Export Root Certification Authority Certificate - Windows Server | Microsoft Learn

  3. We then copied the Root CA certificate file (certnew.cer) into this directory on our Windows Server running our Ignition Gateway.

    • C:\Program Files\Inductive Automation\Ignition\data\certificates\supplemental

  4. On the Ignition gateway, we then ran a command prompt as administrator and used these commands to restart the gateway:

    • net stop ignition
    • net start ignition

  5. Now to configure the Ignition gateway, go to User Sources to add a new Active Directory connection:

    image
    image1533×286 21.7 KB

  6. Fill out the Active Directory Properties like below. In the example below, the domain is contoso.com and the fqdn is dc01.contoso.com, which I had to put into the Primary Domain Controller Host field. Also make sure the port number is changed to 636, and the username/password created earlier on the DC is added.

    image
    image1531×1114 76 KB

  7. Then make sure these other important options are selected for SSL. "Use SSL" is under Active Directory Properties, and "Security Protocol" and "Security Authentication" are under LDAP Search Properties. Inductive Support told me to set the Security Authentication to "Simple".

    image

    image
    image1536×234 11.9 KB

  8. Click "Create User Source", and the users defined in AD should now show up when you click "Manage Users" on the newly created user source.

  9. This method didn't require me to do anything fancy or add a SAN to our default root CA as some other users hinted at above. As a result, I'm not quite sure what to do if you have a 4-part fqdn and need to use the IP address in the Primary Domain Controller Host field.

42

If your Ignition server is joined to that domain, I believe you can simply add the registry entry I mentioned above to inform Java to use Windows' trust store so that when that certificate renews, it will happen automatically rather than you having to update it on your own. Doing it this way you don't have to download any certificates or anything as your domain controller is hopefully pushing those out to member computers as a trusted root certificate automatically.