Hey guys, it took me a while to figure this out from reading this post, so I wanted to share the steps that worked for me. I'm on Ignition version 8.3.6 currently.
- On the IT side, after configuring Active Directory on our Windows Server serving as our domain controller (DC), our guys installed AD Certificate Services (and importantly Web Enrollment), following this documentation Design and implement AD CS - Training | Microsoft Learn. They also created a username/password on the DC for remote login from Ignition.
Manual Steps 2-3 for adding Root CA to Ignition. (Skippable if on Ignition version 8.1.26+ and adding environment variable in step 4.1 below. Credits to david.wooffindin and michael.flagler)
-
This enabled us to download a Root CA certificate from http://<ip_address>/certsrv or http://<_fqdn_>/certsrv (where fqdn = fully qualified domain name). See Export Root Certification Authority Certificate - Windows Server | Microsoft Learn
-
We then copied the Root CA certificate file (certnew.cer) into this directory on our Windows Server running our Ignition Gateway.
- C:\Program Files\Inductive Automation\Ignition\data\certificates\supplemental
-
On the Ignition gateway (which is joined to the DC), run a command prompt as administrator and use these commands to point Java to the Windows-ROOT-LOCALMACHINE keystore, and restart the gateway:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "JAVA_TOOL_OPTIONS" /t REG_SZ /d "-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT-LOCALMACHINE" /fnet stop ignitionnet start ignition -
Now to configure the Ignition gateway, go to User Sources to add a new Active Directory connection:
-
Fill out the Active Directory Properties like below. In the example below, the domain is contoso.com and the fqdn is dc01.contoso.com, which I had to put into the Primary Domain Controller Host field. Also make sure the port number is changed to 636, and the username/password created earlier on the DC is added (used secrets provider in 8.3)
-
Then make sure these other important options are selected for SSL. "Use SSL" is under Active Directory Properties, and "Security Protocol" and "Security Authentication" are under LDAP Search Properties. Inductive Support told me to set the Security Authentication to "Simple".
-
Click "Create User Source", and the users defined in AD should now show up when you click "Manage Users" on the newly created user source.
-
This method didn't require me to do anything fancy or add a SAN to our default root CA as some other users hinted at above. As a result, I'm not quite sure what to do to generate a new Root CA with SANs if you have a 4-part fqdn and need to use the IP address in the Primary Domain Controller Host field.
-
Update: I implemented this at my worksite and I wanted to also use AD for people doing gateway configuration changes (mainly myself), but I was concerned about having no option for login for anyone in the situation that our domain controller gets disconnected from our Ignition gateway. I stumbled on some more forum posts and found you can set the Failover Source to "default" and the Failover Mode to "Soft" and just leave a few administrator and/or other emergency accounts in there as backup. Note that if you choose to restrict who has read/write access to the gateway config in the Security > General Settings page using the new IdP, you will have to provide User Grants in the new IdP to grant gateway config access for the users in the "default" user source; otherwise the backup accounts won't be able to access the gateway either.
