Implementing LDAP-Based Authentication for Internal ALBs

Integrating LDAP-based authentication into your internal Application Load Balancers (ALBs) in AWS can provide seamless single sign-on capabilities by leveraging your existing on-premises Active Directory infrastructure. In this tutorial, we will walk through the steps to set up LDAP authentication for an internal ALB, allowing you to require LDAP credentials before users can access applications behind the load balancer.

The key prerequisites for implementing LDAP authentication are having an Active Directory environment on-premises to authenticate against, as well as having an internal ALB deployed in a private subnet in your VPC. The ALB listener needs to be configured for authentication.

We will use AWS Directory Service to bridge our on-premises AD with AWS through AD Connector. A new LDAP directory will be created in AWS and joined to AD, providing connectivity. An authorization policy will be created to allow the ALB permissions to call LDAP authentication APIs.

Prerequisites

• An existing Active Directory infrastructure with users and groups configured.
• An internal ALB configured in a private subnet in your VPC.
• The ALB listener configured to use authentication.

Steps

1. Create an IAM policy for the ALB

The first step is to create an IAM policy that grants the ALB permissions to call the LDAP authentication APIs. This is required for the ALB to be able to communicate with the LDAP server to authenticate users.

The policy should allow the ldap:ListUsers and ldap:ListGroupsForUser actions on the LDAP directory resource that will be created later.

An example policy is shown below:

The policy can be created using the AWS CLI:

Once created, the policy needs to be attached to the IAM role used by the ALB. This role is specified when creating the ALB.

To attach the policy using the AWS CLI:

Now the ALB role has the required permissions to call the LDAP authentication APIs. The next step will be to create the LDAP directory that the ALB will authenticate against.

2. Create and join an LDAP directory

Now that we have the IAM policy configured, the next step is to create the LDAP directory that will be used for authentication. This is done using AWS Directory Service.

When creating the directory, key settings include:

Directory type — Select "AWS managed Microsoft AD" to create an Active Directory compatible LDAP directory.

Edition — Choose "Enterprise" for access to features like AD trust relationships.

Size — Start with "Small" for basic deployments. This can scale up later if needed.

VPC settings — Specify the VPC and subnets to deploy the directory servers into. Should be private subnets.

Administrator password — Set a secure password for the directory admin account.

Access URL — Provide the LDAP endpoint that will be accessed by the ALB.

Once the directory is created, we need to connect it to our on-premises Active Directory domain. This is done by enabling AD Connector:

• Provide the on-prem AD domain details like DNS address and admin credentials.
• Choose which OUs to sync users and groups from.
• Let the connection sync.

After AD Connector syncs, the AWS LDAP directory will contain all the users and groups from on-premises AD. The ALB can use this for authentication.

To create and connect the directory with the CLI:

The LDAP directory is now ready to be used for authentication by the ALB.

3. Test authentication

After configuring the ALB listener to use LDAP authentication, we need to test it to validate that everything is working correctly.

Some ways to test the authentication includes:

Accessing Protected URL: Try accessing the '/protected' URL path on the ALB which has LDAP auth enabled. You should be redirected to an authentication page prompting for LDAP credentials before accessing the backend application.

Valid User Login: Enter valid LDAP user credentials that exist in your Active Directory environment. The login should succeed and you should be able to access the application.

Invalid User Login: Try entering invalid credentials that do not match a user in LDAP. This should result in an authentication failure error.

User Group Access: If you have LDAP groups configured and have applied group-level access rules on the ALB, test login with users from different groups. Verify users can only access applications if authorized by their group membership.

Expired Token: Try using an expired auth token in the ALB configuration. Authentication requests should be denied due to an unauthorized or expired token.

Traffic Logs: Check the ALB access logs in CloudWatch Logs. The logs should contain entries for each authentication request and response code indicating if it succeeded or failed.

Monitoring these access logs is helpful for auditing and can alert you to any suspicious authentication activity. Be sure to test with multiple valid and invalid users and groups to fully validate that the LDAP authentication is working as expected.

AWS CLI Commands for setting up LDAP Authentication

Here are some example AWS CLI commands for the key steps in setting up LDAP authentication on an internal ALB:

Create the IAM policy

Attach IAM policy to ALB role

Create LDAP directory

Join LDAP directory to on-prem AD

Conclusion

In this tutorial, we walked through the steps to implement LDAP-based authentication for an internal Application Load Balancer in AWS.

We started by creating an IAM policy to grant the ALB permissions to call LDAP APIs. Next, AWS Directory Service was used to create a new LDAP directory and join it to our on-premises Active Directory domain using AD Connector.

After completing these steps, we successfully tested accessing a protected application path which prompted for LDAP credentials before granting access. Users can now leverage their existing AD accounts to seamlessly authenticate via single sign-on.

Setting up LDAP-based authentication provides a more integrated authentication experience by leveraging your on-premises credentials. This allows managing users and access in one place through AD rather than duplicating user accounts.

As your application infrastructure expands to AWS, integrating LDAP authentication to internal ALBs helps provide a consistent access control and auditing process using your centralized AD environment.