Question

Does JetBrains License Vault / IDE Services on-premises support authentication against multiple LDAP/AD domains in one forest, for example:

• DC=prod,DC=corp,DC=net
• DC=euprod,DC=corp,DC=net

Can this be handled by using the forest root Base DN, LDAP referrals, or Global Catalog?

Answer

For on-premises IDE Services / License Vault, the built-in LDAP/AD configuration is not intended for multi-domain AD forest authentication. Using the forest root Base DN, for example DC=corp,DC=net, is not the recommended approach for authenticating users from multiple child domains.

LDAP referrals or Global Catalog may work in some directory-specific setups, but they are not the recommended or fully supported approach for this scenario in the built-in LDAP integration.

The recommended configuration is to use JetBrains Hub as the intermediate identity provider:

1. Configure IDE Services / License Vault to authenticate through Hub.
2. In Hub, configure separate LDAP authentication modules for each LDAP/AD domain.
3. Let Hub handle user authentication and user/group mapping.
4. Point IDE Services / License Vault to Hub as the authentication provider.

Example Hub-side structure:

Hub
├── LDAP Auth Module: PROD
│   ├── Server URL: ldaps://prod.corp.net:636
│   └── Base DN: DC=prod,DC=corp,DC=net
│
└── LDAP Auth Module: EU
    ├── Server URL: ldaps://euprod.corp.net:636
    └── Base DN: DC=euprod,DC=corp,DC=net

Example IDE Services / License Vault configuration:

tbe:
  deployment:
    url: https://ides.example.com

  auth:
    login-url: https://hub.example.com/hub/api/rest/oauth2/auth
    token-url: https://hub.example.com/hub/api/rest/oauth2/token
    jwt-certs-url: https://hub.example.com/hub/api/rest/oauth2/keys
    client-id: "<Hub service client id>"
    client-secret: "<Hub service client secret>"
    required-scopes:
      - openid
      - profile
      - email

In Hub, the corresponding service should have:

Client ID: <Hub service client id>
Authorization Code flow: enabled
Base URL: https://ides.example.com
Redirect URI: https://ides.example.com/api/login/authenticated

For each LDAP/AD domain, create a separate LDAP authentication module in Hub. A typical module uses:

Server URL: ldaps://prod.corp.net:636/DC=prod,DC=corp,DC=net
Bind account: Fixed
Bind DN: <service-account-DN>
Filter: sAMAccountName=%u
Username attribute: sAMAccountName
Full name attribute: cn
Email attribute: mail
User creation: Enabled