Specify multiple AD servers in TheHive configuration

[BrevilleBro]

Request Type

Feature Request

Request

Specify multiple AD servers in the configuration file. If one AD server fails, try the next.
Example: domainFQDN = ["ad.server1.com", "ad.server2.com"]

We experienced an issue tonight when one of our AD servers went offline and AD auth into TheHive failed. Being able to specify a backup AD server may be beneficial if this ever occurs again.

[To-om]

If you specify DNS domain name (without AD server name), resolution of name will use round-robin on all your AD servers.

[bullerdude]

There is an issue with that approach when ldap on active directory servers aren't using wildcard certificates (not uncommon), which in turn will result in certificate validation failing as the ldap server isn't accessed using its FQDN.

…

_____________________________ From: To-om <notifications@github.com<mailto:notifications@github.com>> Sent: Thursday, June 1, 2017 11:06 pm Subject: Re: [CERT-BDF/TheHive] Specify multiple AD servers in TheHive configuration (#231) To: CERT-BDF/TheHive <thehive@noreply.github.com<mailto:thehive@noreply.github.com>> Cc: Subscribed <subscribed@noreply.github.com<mailto:subscribed@noreply.github.com>> If you specify DNS domain name (without AD server name), resolution of name will use round-robin on all your AD servers. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<#231 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AFKrD2AxT9kjjV3xWyZKqRWeRb7cRoXUks5r_rdVgaJpZM4Ns8iG>.

[To-om]

It depends on how certificate are created. I think that certificate installed on AD servers should have server FQDN in CN and the domain name in subject alternative name.

Anyway, this can't be a prerequisite to use AD authentication in TheHive. Make the settings auth.ad.domainFQDN and auth.ldap.serverName multi-valued is probably a better approch.

[To-om]

For LDAP or AD authentication, it is now possible to specify multiple server names in configuration file:

auth {
  ad {
    domainFQDN=thehive-project.org
    domainName=THEHIVE
    // serverNames is optional. If not set, try to resolve domainFQDN
    serverNames=[ad1.thehive-project.org, ad2.thehive-project.org]
    useSSL=true
  }
  ldap {
    // single-valued setting, kept for compatibility reason
    serverName=ldap.thehive-project.org
    serverNames=[ldap1.thehive-project.org, ldap2.thehive-project.org]
    bindDN=uid=thehive_srv,ou=users,dc=thehive-project,dc=org
    bindPW=***secret***
    baseDN=ou=users,dc=thehive-project,dc=org
    filter=(uid={0})
    useSSL=true
}

Servers are used in order: try to connect to the first one. If connection fails, try the next one and so on.