Skip to main content

Integrate with Nutanix Prism Element

Support level: Community

What is Nutanix Prism Element?​

Nutanix Prism Element, also known as Nutanix PE, is an embedded tool used for local cluster management and operations. Every Nutanix Cluster has Prism Element built-in.

-- https://www.nutanixbible.com/3a-book-of-prism-architecture.html

Preparation​

The following placeholders are used in this guide:

  • ldap.company is the FQDN of the authentik LDAP outpost.

Prism Element authenticates users against LDAP. Prism Element must be able to reach the authentik LDAP outpost on port 636 and trust the certificate that the outpost presents for ldap.company.

info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

authentik configuration​

To support the integration of Prism Element with authentik, you need to create groups for Prism Element access and configure an LDAP provider and outpost.

Create access groups​

Create groups that Prism Element maps to roles. Prism Element can grant roles to both groups and individual users. For this guide, a single group npe-admins will be used.

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Directory > Groups and click Create.
  3. Set Name to npe-admins and click Create.
  4. Open the group, select the Users tab, and add the users who should have complete access to the underlying Nutanix cluster.

Create the LDAP resources​

Follow the LDAP provider setup to create or reuse an LDAP application and provider, create a service account with LDAP search permissions, and create an LDAP outpost.

Use the following Prism Element settings while completing the LDAP provider setup:

  • Use npe-ldap as the service account username. Note its password and full DN for the Prism Element configuration.
  • Note the LDAP provider's Base DN as <base_dn>.
  • On the LDAP provider, set Certificate to the certificate that Prism Element should trust for ldap.company.
  • Set TLS Server Name to ldap.company.
  • Select the Prism Element LDAP application on the outpost and expose the outpost as ldap.company.

If you configure application bindings, ensure that npe-ldap and npe-admins have access to the LDAP application.

Nutanix Prism Element configuration​

Configure LDAP authentication​

Local account authentication

After adding Directory Service as an authentication type, Prism Element can keep accepting local accounts as long as the Local checkbox is checked.

  1. Log in to Prism Element as a user with administrator privileges.
  2. Click the gear icon in the top right and navigate to Users and Roles > Authentication.
  3. On the Directory List tab, click New Directory.
  4. Configure the following settings. Replace <base_dn> with the Base DN of the authentik LDAP provider.
    • Directory Type: OpenLDAP
    • Name: authentik
    • Domain: the base DN in dotted form. For example, if <base_dn> is dc=ldap,dc=goauthentik,dc=io, the domain is ldap.goauthentik.io.
    • Directory URL: ldaps://ldap.company:636
    • User Object Class: user
    • User Search Base: ou=users,<base_dn>
    • Username Attribute: cn
    • Group Object Class: group
    • Group Search Base: ou=groups,<base_dn>
    • Group Member Attribute: member
    • Group Member Attribute Value: dn
    • Service Account: cn=npe-ldap,ou=users,<base_dn>
    • Service Account Password: the password for the npe-ldap service account
  5. Click Save.
  6. Click the Authentication Types tab, select Directory Service, and click Save.

Create the role mappings​

Prism Element does not grant permissions to directory users automatically. After you save the directory, map authentik groups and users to the role that they should receive.

  1. Click the gear icon in the top right and navigate to Users and Roles > Role Mapping.
  2. Click New Mapping.
  3. Select authentik from the Directory or Provider list.
  4. Select group in the Type list.
  5. Select the role Cluster Admin.
  6. Enter npe-admins into the values box, then click Save.
  7. Repeat these steps for other users and groups if needed. If mapping a role to a user, select user from the Type list.

Configuration verification​

Users append the @ symbol and the Domain value to their username when they log in. With a domain of ldap.goauthentik.io, the user akadmin logs in as [email protected]. After signing in, users in npe-admins should have administrator privileges.

You can also test the directory without logging out. On the Directory List tab, click Test, then enter the same username and password. Prism Element reports Authentication test successful when the directory is reachable and the credentials are accepted.

Resources​