Authentication domain¶
An authentication domain defines where and how user identities are verified at connection time. Every account belongs to a group, and every group to a domain: the domain is what determines where the accounts come from — a corporate directory, an internal base, or an external identity provider.
This module lists the declared domains. Click + to add one, or double-click a name to configure it. The directory type is chosen at creation time and cannot be changed afterwards.
Four types are offered:
| Directory type | Account source | Use |
|---|---|---|
| LDAP directory | External directory (Active Directory, OpenLDAP…) | The common case: existing accounts and groups are reused as they are, with no copying. |
| Local directory | Base internal to the platform | Accounts created and managed straight from the console, alongside a directory or for a small scope. |
| SAML domain | External identity provider (IdP) | Authentication is delegated to the IdP; the platform acts as the service provider. |
| Anonymous directory | None | Rare cases where reaching an application requires no authentication at all. |
Creation order
Create the domain first, then the groups, then the user accounts: application access rights are then granted to groups, through an access contract.
Common configuration elements¶
These settings are present for every domain type:
| Field | Description |
|---|---|
| Name | Choose a meaningful domain name. |
| Shortcut URL | Displayed in edit mode only. Direct URL giving access to the user portal for this specific domain, without going through the list of available domains. Format: https://{server}/cloud/?orgname={organisation}&domainid={id}. |
| Description | Optional field describing the domain content. |
| Microsoft domain | Information that accompanies user identification when single sign-on (SSO) is enabled. |
| Expiration | Maximum inactivity delay before a session expires. Default value: 60 minutes. |
| Number of attempts before lockout | Limits the number of login attempts. Recommended value: 3 attempts (protection against brute-force attacks). This limit must be ≤ any limit set in the LDAP directory. |
| Time before unlock (minutes) | Delay before locked sessions are unlocked. Set to 0 to disable. |
| The domain is part of cascading authentication | See the Cascading authentication section. |
| Delegate authentication to an external server | Options: No, CAS, IdeoSSO. |
| Alternative username attribute | LDAP attribute used as a secondary identifier when the primary attribute fails to find the user (e.g. mail, userPrincipalName). |
| Maximum number of simultaneous sessions per user | Recommended value: 1 session. |
| Automatic deletion of the oldest session | Automatically closes an active session when a new one is requested. |
| Note displayed in the authentication form | Note intended for the domain's users only. |
Authentication method¶
| Field | Description |
|---|---|
| Authentication method | Defines how the user's identity is verified at login: Form (username and password entered manually) / User certificate (the username is extracted from the certificate's CN field) / User certificate and form (a password is still required after certificate authentication) / Apache authentication (authentication delegated to the Apache web server) / Pro Santé Connect (CIBA) (authentication through the French national health identity provider). |
| Force the use of the virtual keyboard | Displays an on-screen keyboard on the authentication page to protect password entry against keyloggers. |
Pro Santé Connect (CIBA)¶
These fields are displayed only when the Pro Santé Connect (CIBA) authentication method is selected. Pro Santé Connect is the French national identity provider for healthcare professionals.
| Field | Description |
|---|---|
| Identifier (client id) | Client identifier provided by Pro Santé Connect when the application is registered. |
| Secret (client secret) | Associated client secret, used to validate the OIDC exchanges with Pro Santé Connect. |
| Sandbox | When checked, CyberElements connects to the PSC test environment instead of the production environment. Use for integration testing only. |
| RPPS retrieval | Determines where the user's RPPS number (French health professionals registry) comes from: Use the authentication attribute (the RPPS is extracted from the primary authentication attribute) or Use another user attribute (the RPPS is extracted from a separate attribute, to be specified in the next field). |
| User attribute containing the RPPS | Name of the attribute holding the RPPS number (e.g. rpps, healthcareProfessionalId). Visible and required only if the previous option is set to "Use another user attribute". |
OTP authentication token¶
| Field | Description |
|---|---|
| Authentication token | Selection of the OTP generator(s) to use (previously declared through the OTP token generators menu). Multiple selection is possible. |
| User attribute used to send the OTP | Specifies the user attribute through which the OTP is delivered for each selected token (e.g. mobile to send by SMS, mail to send by e-mail). One field is displayed per selected token. |
| Token expiration duration | Duration after which a sent OTP is no longer accepted. Set to 0 to disable expiration. |
| Time unit | Unit of the expiration duration: Hours or Days. The value entered in the previous field is multiplied by this unit (1 for hours, 24 for days). |
| Expiration starts | Starting point of the expiration countdown: From the last OTP validation (the OTP expires X hours after it was validated) or From the last successful login (the OTP expires X hours after the session opens). |
| Replace OTP characters with "*" | Masks the characters entered in the one-time password field during login. |
neomia Pulse authentication¶
neomia Pulse is a continuous authentication solution based on behavioural analysis. These fields are displayed when the Enable neomia Pulse authentication checkbox is selected.
| Field | Description |
|---|---|
| Enable neomia Pulse authentication | Enables the integration with neomia Pulse. A Pulse configuration is created for the domain. |
| API URL | Base URL of the neomia Pulse API for user verification (e.g. https://pulse.example.com/api). |
| Authentication API URL | URL of the Pulse authentication endpoint if different from the main URL. |
| API key | Secret key allowing CyberElements to authenticate to the Pulse API. |
| Number of neomia Pulse attempts | Maximum number of Pulse authentication attempts before the request is blocked. Default value: 3. |
| If Pulse authentication succeeds | Behaviour when Pulse successfully validates the user: Skip the OTP token (all OTPs configured on the domain are bypassed) or Reinforce authentication (OTPs remain mandatory even after a successful Pulse validation). |
| If Pulse authentication fails | Fallback behaviour if Pulse fails or is unavailable: Block access (the user cannot log in, error code PULSE_API_ERROR is returned) or Request an additional authentication factor (automatic fallback to standard OTP authentication). |
| Display graphical components | Displays the typing-pattern visual elements of the neomia Pulse interface on the authentication page. |
| Display authentication factors | Shows the user the list of authentication factors detected by Pulse. |
External authentication delegation¶
CAS server¶
| Field | Description |
|---|---|
| CAS server URL | Full URL of the CAS server to which authentication is delegated. |
IdeoSSO¶
| Field | Description |
|---|---|
| CAS server URL | Full URL of the IdeoSSO server. |
| IdeoSSO, user property matching the identifier | Name of the IdeoSSO user property used as the login identifier in cyberelements. |
Configuring a "Local directory" domain¶
Tab: General information¶
| Field | Description |
|---|---|
| Invisible shortcut | If several domains exist, check this box so the domain does not appear in the list offered to the user. The domain is then only reachable through its full shortcut URL. |
| Display the access condition if it is invalid | If checked, when an invalid access condition prevents a user from logging in, the corresponding error message is shown to them. If unchecked, the user receives no explanation. Available in edit mode only. |
Tab: Password¶
This tab is used to configure password management for the local domain users.
| Field | Description |
|---|---|
| Change the user's password at first login | If checked, on their very first login the user is automatically redirected to a password change screen. They cannot access the portal until the change is done. |
| Display the password change form | If checked, a link allowing the user to change their password is shown on the login screen. |
| Define a custom password policy | Enables the definition of a password complexity and lifetime policy specific to this domain. |
When Define a custom password policy is checked, the following settings become available:
| Field | Description |
|---|---|
| Display the password policy to the user | If checked, the complexity rules are presented to the user when they set or change their password. |
| Minimum number of characters | Minimum required password length. Default value: 10. Set to 0 to disable. |
| Minimum number of lowercase letters | Minimum number of lowercase letters required. Set to 0 to disable. |
| Minimum number of uppercase letters | Minimum number of uppercase letters required. Set to 0 to disable. |
| Minimum number of digits | Minimum number of digits required. Set to 0 to disable. |
| Minimum number of special characters | Minimum number of special characters required. Set to 0 to disable. |
| Minimum password lifetime (days) | Minimum delay before the user is allowed to change their password. Prevents overly frequent changes. Set to 0 to disable. |
| Maximum password lifetime (days) | Delay after which the password expires and must be renewed. Default value: 60 days. Set to 0 to disable. |
| Notify the user before expiration (days) | Sends an e-mail to the user the specified number of days before their password expires. Requires a configured maximum lifetime, an SMTP server and a source e-mail address. Set to 0 to disable. |
| SMTP server | Server used to send the expiration notifications (among those declared in the SMTP configuration). |
| Source e-mail | E-mail address shown as the sender of the notifications. |
| Reject the new password if it contains the login | If checked, forbids passwords that contain the user's login identifier (protection against obvious passwords). |
| Reject the new password if it matches one of the last X | Keeps a password history and forbids reusing the specified number of previous passwords. Set to 0 to disable. |
Configuring an "LDAP directory" domain¶
Tab: General information¶
| Field | Description |
|---|---|
| Invisible shortcut | If several domains exist, check this box so the domain does not appear in the list offered to the user. |
Tab: LDAP settings¶
Connection¶
| Field | Description |
|---|---|
| Authentication through a site | If checked, CyberElements uses a site's Edge Gateway to reach the directory, avoiding the need to open inbound firewall rules from the DMZ. A second field lets you select the site to use. |
| Authentication type | Bind protocol to the LDAP server: SIMPLE (bind with DN + clear-text password over TLS) / NTLM (Windows authentication, requires the Microsoft domain suffix) / SASL/Digest-MD5 (SASL authentication with MD5 hashing, does not transmit the password in clear text). |
| Microsoft domain suffix | Suffix of the Windows domain used to build the NTLM identifier (e.g. CONTOSO). Visible only if the authentication type is NTLM. |
Searching for users and groups¶
| Field | Description |
|---|---|
| Search mode | Defines the strategy for retrieving groups from the directory: Retrieve groups from a group attribute (iterates over groups and reads their members — suited to standard directories) / Retrieve groups from a user attribute (reads the memberOf attribute of each user — faster on Active Directory) / Retrieve nested groups through the TokenGroups attribute (uses the special AD tokenGroups attribute to resolve nested groups recursively — recommended on Active Directory). |
| User attribute containing the groups | Name of the user object attribute that lists the groups it belongs to. Visible only if the "from a user attribute" mode is selected. |
| Use the user's DN to log in | If checked, the user's full DN is used during the LDAP bind operation (authentication). |
| User authentication attribute | LDAP attribute used as the unique identifier for the user at login. Suggested values: sAMAccountName (Active Directory), cn, sn, uid, mailNickname, userPrincipalName, employeeID, or custom. |
| User attribute customisation | Lets you manually enter an attribute not present in the list. Visible only if "custom" is selected. |
| Group authentication attribute | LDAP attribute used to uniquely identify the groups (e.g. cn, sAMAccountName). |
Tree¶
| Field | Description |
|---|---|
| Users branch | Full DN of the organisational unit containing the users (e.g. ou=Users,dc=example,dc=com). |
| Groups branch | Full DN of the organisational unit containing the groups (e.g. ou=Groups,dc=example,dc=com). |
| Manual group management | If checked, groups are not synchronised automatically from the LDAP directory. Administrators must add and remove groups manually in cyberelements. |
Service account¶
| Field | Description |
|---|---|
| Read access account | Full DN of the service account used by CyberElements to query the directory (e.g. cn=service-cye,ou=ServiceAccounts,dc=example,dc=com). Defining a dedicated proxy account and disabling anonymous binding to the directory is strongly recommended. |
| Password | Password of the service account. |
| User class | LDAP object class of the users to search for in the directory (e.g. person, inetOrgPerson, user for Active Directory). |
| Group filter | Additional attribute/value filter to identify the groups in the directory. Used only with the "from a group attribute" search mode. |
User password¶
| Field | Description |
|---|---|
| Display the password change form | If checked, a password change link is shown on the login screen. This option is only available if the directory connection uses SSL (LDAPS) or goes through a site. |
| Check whether the password must be changed | If checked, CyberElements queries the LDAP directory to find out whether the user must change their password (pwdLastSet attribute on Active Directory) and forces them to do so if necessary. |
| Check the password complexity when it is changed | If checked, CyberElements verifies that the new password meets the complexity policy defined in the directory when a change is initiated from the portal. |
Radius option¶
| Field | Description |
|---|---|
| Enable the Radius option | Check this box only if the LDAP directory is coupled with Radius authentication (two-factor). This option can only be enabled when the domain is created and cannot be changed afterwards. |
When the Radius option is enabled, the following settings appear:
| Field | Description |
|---|---|
| Mode | Operating mode of the Radius server: quicklog (direct authentication: the password is passed as is to the Radius server) or challenge/response (the Radius server sends a challenge to which the user must respond). |
| Server | IP address or DNS name of the Radius server. |
| Port | Listening port of the Radius server. Default value: 1812. |
| Secret | Shared secret between CyberElements and the Radius server, used to encrypt the exchanges. |
| Number of attempts | Maximum number of tries before CyberElements gives up on the request to the Radius server. Default value: 3. |
| Timeout (seconds) | Maximum time to wait for the Radius server response before timing out. Default value: 10 seconds. |
| Radius NAS IP address | Source IP address that CyberElements declares to the Radius server (NAS-IP-Address attribute). To be set if the Radius server filters requests by source IP address. |
Other settings¶
| Field | Description |
|---|---|
| Allow RDS server management | If checked, accounts in this domain can be associated with RDS servers in the RDS server management module. |
| Use specific certificate authorities to validate LDAPS certificates | If checked, CyberElements uses a custom CA certificate to validate the certificate presented by the LDAP server during SSL connections. If unchecked, the system CAs are used (/etc/ssl/certs/ca-certificates.crt). |
| Certificate authorities (base64 encoding) | File containing the root CA(s) in PEM format (text starting with -----BEGIN CERTIFICATE-----). Visible and required only if the previous option is enabled. |
LDAP servers¶
The server grid lists the servers associated with the domain (columns: Server, Port, Protocol). Defining several servers enables high availability: CyberElements automatically switches to an available server in case of failure.
To add a server, click +. Enter:
| Field | Description |
|---|---|
| Server | IP address or DNS name of the LDAP server. |
| Port | Access port. Default value: 389 (LDAP) or 636 (LDAPS). |
| Protocol | LDAP or LDAP over SSL. Using SSL is strongly recommended even on an internal network. |
To edit an existing server, select it and click the Properties icon.
To delete a server, select it and click ×.
Configuring an "Anonymous directory" domain¶
An anonymous domain can be used in the rare cases where accessing an application does not require authentication because the user has already been authenticated by specific means.
| Field | Description |
|---|---|
| Maximum number of connections | Limits the number of simultaneous connections allowed on this domain. |
| Use the certificate CN as the user identifier | If checked, the user's identifier is automatically extracted from the CN field of the client certificate presented at connection. This identifier is then used for SSO. |
| Identifier format, from the DN | Expression for building the identifier from the components of the certificate DN (e.g. %CN%@%OU%). Visible only if the previous option is enabled. |
Configuring a "SAML" domain¶
When a SAML domain is used, CyberElements acts as the service provider (SP) and delegates authentication to an external identity provider (IdP).
Tab: General information¶
| Field | Description |
|---|---|
| Identity provider | Type of identity provider: Other (any standard SAML IdP) or Azure (Microsoft Azure AD / Entra ID, which additionally enables asynchronous group synchronisation). |
| Identity provider EntityId | Unique identifier of the IdP in the SAML federation. Its value is provided by the IdP (e.g. https://sts.windows.net/{tenant-id}/ for Azure, https://[serverName]/idp/shibboleth for Shibboleth). |
| Group names variable | Name of the SAML attribute carrying the user's group memberships in the assertion (e.g. http://schemas.microsoft.com/ws/2008/06/identity/claims/groups for Azure). |
| Email variable | Name of the SAML attribute the platform reads the e-mail address from. Read-only field: the value is fixed to saml-mail and cannot be configured. |
| Login variable | Name of the SAML attribute used as the login identifier in CyberElements (e.g. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name). |
| The domain is part of cascading authentication | See the Cascading authentication section. |
| Manual configuration | If checked, the identity provider parameters must be entered manually (EntityId of the SAML endpoints). If unchecked, these parameters are extracted automatically from the metadata file. Available in edit mode only. |
Identity provider metadata
The administration console exposes no SAML metadata exchange screen: that tab belongs to the SaaS offering. In client hosted, the IdP metadata and the service provider metadata are configured manually, in the Shibboleth configuration files of the Mediation Controller.
Cascading authentication¶
Visit the general options page to enable cascading authentication.
When a user accesses the portal, the system searches the cascading domains for which authentication is possible without login/password (SAML, Apache, certificate). The first domain that recognises the user is used. If no domain can authenticate without a password, the login/password fields are displayed.
Once enabled, two buttons appear in the domain list:
- Check "The domain is part of cascading authentication" for each desired domain.
- The order can be changed using the up/down arrows. Order 0 is processed first.
Note
Anonymous and Radius domains, and those that delegate authentication to an external server (CAS), cannot be used in cascading authentication.