Authentication: Getting started

By default, user authentication is disabled and all actions are performed under the special account named Unique User.

The unique user has unrestricted access and does not require a password, so anyone can access the platform.

We strongly advise you to enable user authentication to secure the access to your data once Linkurious Enterprise is deployed on a server.

There are 2 possible authentication options:

• Local authentication: user accounts are managed within Linkurious Enterprise
• External authentication: user accounts are managed in a 3rd party application

Local authentication

Local authentication can be enabled from Linkurious Enterprise user interface.

Once local authentication is enabled, users need an account to access Linkurious Enterprise. Administrators can create accounts directly in Linkurious Enterprise (see how to create users).

To enable authentication use the Web user interface via the Admin > Users menu:

The following screen will be prompted if authentication is disabled. Click Enable Authentication.

Create an admin account and click Save and enable.

Password hashing

Passwords of local users are hashed with the PBKDF2 algorithm and the following parameters:

• iterations: 1000
• salt length: 96 bits
• key length: 256 bytes

External authentication

When using an external source for authentication, users are automatically created in Linkurious Enterprise when they connect for the first time.

These shadow-users allow to store specific data such as preferences, groups and visualizations.

Passwords of external users are never stored inside Linkurious Enterprise.

Authentication services

Linkurious Enterprise supports the following external authentication services:

• LDAP
• Microsoft Active Directory
• Microsoft Azure Active Directory
• Google Suite
• OpenID Connect
• SAML2 / ADFS

If your company uses an authentication service that Linkurious Enterprise does not support yet, please get in touch.

If you enable an Single-Single-On (SSO) capable authentication service (OAuth/OpenID Connect or SAML2), your users won't need to login directly in Linkurious Enterprise but, instead, by clicking the SSO button they will be redirected to the identity provider for authentication.

Group mapping

If an external source already organizes users in groups, it's possible to use this information to map automatically external groups to Linkurious groups. To do so, you have to set the access.externalUsersGroupMapping configuration key to be an object with the external group IDs as keys and the internal group IDs as values.

For example, if we want to provide group mapping for Microsoft Active Directory:

{ // under the access configuration key 
  // ... 
  "externalUsersGroupMapping": {
    "Administrators": 1 // any Active Directory admin is a Linkurious admin 
  }
  // ... 
}

For some identity providers the external group IDs is an actual name, for others is an ID:

• Azure AD uses the group ID, e.g. "818b6e03-15dd-4e19-8cb1-a4f434b40a04"
• LDAP uses the content of the field configured in access.ldap.groupField
• Microsoft Active Directory uses the group common name, e.g. "Administrators" or the group distinguished name, e.g. "CN=Administrators,CN=Users,DC=linkurious,DC=local"

To exclude some groups of users from logging in into Linkurious, set up a list of authorized groups in the configuration key access.externalUsersAllowedGroups.

{ // under the access configuration key 
  // ... 
  "externalUsersAllowedGroups": [
    "CN=Administrators,CN=Users,DC=linkurious,DC=local",
    "CN=Analysts,CN=Users,DC=linkurious,DC=local"
  ]
  // ... 
}

By default, when an external user is connected for the first time, their external groups are mapped once. So any change in the user's group in the external source would not be reflected in the LKE user. However, setting autoRefreshGroupMapping to true makes an external user's groups to be reset according to externalUsersGroupMapping, each time the external user logs in.

{ // under the access configuration key 
   // ... 
   "autoRefreshGroupMapping": true,
   // ... 
 }

Also, note that when autoRefreshGroupMapping is true updating external users' groups from within LKE is not allowed.