IDE Services On-Prem Entra Domain Services LDAPS with Hub On-Prem

Prerequisites

• Installed and configured IDE Services application (refer to https://www.jetbrains.com/help/ide-services/set-up-server.html)
• Installed and configured Hub On-Premise ( refer to https://www.jetbrains.com/help/hub/docker-installation.html)
• Configured Azure Entra Domain Services. ides-support.onmicrosoft.com is used as DNS here.

How-to integrate Entra Domain Services to Hub

Entra Domain Service side

1. First, we should generate the key and the certificate to enable LDAPS:

openssl genrsa -aes256 -out Entra_LDAP.key 2048
openssl req -x509 -new -key Entra_LDAP.key -sha256 -days 365   -subj "/CN=*.ides-support.onmicrosoft.com"   -addext "subjectAltName=DNS:*.ides-support.onmicrosoft.com"   -addext "extendedKeyUsage=serverAuth"   -addext "keyUsage=digitalSignature,keyEncipherment"   -addext "basicConstraints=CA:FALSE"   -out Entra_LDAP.crt
openssl pkcs12 -export   -out Entra_LDAP.pfx   -inkey Entra_LDAP.key   -in Entra_LDAP.crt   -name "Entra_LDAP"

It is important to define the -subj value with the wildcard.

2. Enable Secure LDAP and Allow secure LDAP access over the internet toggles in your Entra Domains Service Settings --> Secure LDAP setting.

3. Attach the Entra_LDAP.pfx certificate to your Domain Service and provide the password for it.
4. Once the certificate is applied go to Synchronization tab and verify you have required groups synchronized with Domain Service.

Hub Side

1. Ensure your Domain Service DNS is reachable from your hub server.
2. In case it's not, add the Secure LDAP external IP addresses to your /etc/hosts file:

echo "123.456.7.89 ldaps.ides-support.onmicrosoft.com" | sudo tee -a /etc/hosts

3. Now, let's create a LDAP auth module on Hub side. Go to <hub_url>/hub/authmodules and create a new LDAP identity provider:

• Define LDAP IdP URL: ldaps.ides-support.onmicrosoft.com. Note, that ldaps prefix is mandatory here.
• Enable SSL mode.
• Define the Search base according to your Domain Service DNS: dc=ides-support,dc=onmicrosoft,dc=com

4. Once the module is created, go to its settings page and configure the next parameters:

• Provide the SSL Key you have created earlier (p.1)
• Set Bind account to Fixed so your Domain Service users and groups will be synced with Hub. (more details here https://www.jetbrains.com/help/hub/ldap-authentication-module.html#bind-account-options).
• Specify Bind DN of the account which authenticates the queries and queries the directory service.
• Set a password for that account.
• Set the desired synchronization interval.
• In Attribute Mapping define Username as userPrincipalName
• Click on Save button.

5. Once module is configured, test the module by clicking on Test login... button and try to login with your LDAP user.

Notes

Please note, that LDAP synchronization works with the users already logged in Hub. That means, users' provisioning is held after the first login. To have group mapping enabled refer to this article: https://www.jetbrains.com/help/hub/ldap-authentication-module.html#ldap-group-mappings

Links to the useful docs:

https://www.jetbrains.com/help/hub/ldap-authentication-module.html https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-configure-ldaps