Setting up Microsoft Server AD with Liferay

Issue

• This article provides you detailed steps to set up and configure Microsoft Server AD to Liferay.

Environment

• Liferay DXP 7.1

Resolution

Changing Computer Name:

1. Control Panel → System and Security → System
2. Computer name, domain and workgroup settings → Change Settings
3. Click Change. You will see your computer's name listed.
4. In the space marked Computer Name, delete the text and enter a new name for your computer (Example Name: WINSERVER )
5. Restart

Set up Active Directory:

1. On server manager click on 'Add roles and features'
2. It opens the add roles and features wizard. Click on Next to proceed
3. Select Role-based or feature-based installation and click on Next
4. Select your computer name and click on Next
5. In this window put tick box for Active Directory Domain Services and DNS
   Server. It will prompt to show you what are the associated features for the role. Click on
   add features to add all (ignore the DNS warning for the moment). Then click Next to
   continue
6. In the next window, mark all the .NET Framework Features and click Next
7. It will give a brief description about AD DS service and DNS Server, click next to proceed
   and Install
8. Once installation completes, click on the option Promote this server to a domain
   controller
9. Then it will open the active directory configuration wizard, select the option to Add new
   forest and type the root domain name (Example: INTDOMAIN.LOCAL )
10. Type a password for DSRM, then click Next
11. No need for any DNS modifications yet. Click Next to proceed
12. For the NETBIOS name keep the default (Example: INTDOMAIN ) and click Next
13. Next page is to define the NTDS, SYSVOL, and LOG file folders. You can keep defaults.
    Click Next
14. Next page will give the option to review the configuration changes. If everything okay you can
    Click Next to proceed
15. Install and wait. After the installation system will restart automatically. Once it comes
    back log in to the server domain (Example: INTDOMAIN\Administrator )
16. Open a PowerShell console and use Get-ADDomain | fl Name, DomainMode and
    Get-ADForest | fl Name, ForestMode to confirm domain and forest functional
    levels

Creating the user in AD:

1. Server Manager Dashboard → Tools → Active Directory Users and
   Computers
2. Your Domain (Example: INTDOMAIN.LOCAL ) → Users → Right Click → New → User
3. Add First name/Full name and User logon name, assign a password, and Finish
   
4. Go to Properties of the user and assign the rest of the data (email, last name, etc.)

Configuration at Liferay Side:

Setting user authentication with screen name: Control Panel → Configuration → Instance Settings → Authentication → General → How do users authenticate? set By Screen Name

1. Go to Configuration → Instance Settings → Authentication → LDAP and
   add a new LDAP Server, assign a name (e.g.: WINSERVER)
2. Select the Microsoft Active Directory Server in the default value
3. Now provide the asked information as follows:

• Base Provider URL :  ldap://windows server machine IP:389 (example:
  ldap://10.0.2.7:389) 
• Base DN : indicate your domain data (example:
  DC=INTDOMAIN,DC=LOCAL)
• Principal / Credentials : created Admin user Login Credentials (example: INTDOMAIN\Administrator / password)
• Authentication Search Filter :
  (&(objectCategory=person)(sAMAccountName=@screen_name@))
• Import Search Filter :
  (&(objectCategory=Person)(sAMAccountName=*))
• UUID and Screen Name : sAMAccountName
• Email Address: mail
• Password: userPassword
• First Name: givenName
• Last Name: sn
• Full name: cn

Test LDAP Connection and Test LDAP Users to check the connection and
recover the available users. Save and Enable the LDAP at the principal screen

 

Additional Information

• At the time of AD user login, there might be a case you can get an authentication error which can be solved by unchecking "User must change password at next logon" at the time of user creation.