When users login using the Active Directory external authentication type, Navigator creates a principal name from the user login to search for the user's LDAP object. Navigator creates a user principal name by prepending the login username with @ and the configured value for the Active Directory domain. If your users' principal names differ in format from their login names, you should use the LDAP authentication type to configure a more flexible model for searching LDAP. For example, if user principal names have the form jane.doe@mydomain.com but the user login name is jdoe, authentication will fail in the Active Directory configuration. See Configuring Cloudera Navigator for LDAP.

To configure Cloudera Navigator for external authentication with Active Directory:

1. Log in to Cloudera Manager Admin Console.
2. Select Clusters > Cloudera Management Service.
3. Click the Configuration tab.
4. Select Navigator Metadata Server for the Scope filter.
5. Select External Authentication for the Category filter.
6. Leave the Authentication Backend Order set to the default value—Cloudera Manager Only until after the external system has been successfully configured for Cloudera Navigator (as detailed in these steps) and user accounts in Active Directory instance are members of groups that have been granted Cloudera Navigator user role privileges. When Cloudera Navigator receives a login request, it checks user repositories in the order specified. Checking only the external system before having user accounts and roles configured can result in authentication failures.
   • If user accounts and groups for Cloudera Navigator already exist in the Active Directory and a group with privileges for Cloudera Manager Full Administrator or Navigator Administrator user roles contains user accounts—so that the system can be managed—the order can be set to External then Cloudera Manager or External Only.
7. Configure the remaining settings for the Active Directory instance as detailed in the table.

   Property	Description and usage note
   External Authentication Type	Active Directory
   LDAP URL	Full path to the Active Directory instance, including the protocol specifier, ldap or ldaps (for TLS/SSL). Not necessary to specify port number if the Active Directory service is hosted using the default ports—389 (LDAP), 636 (LDAPS). For example: ldap://ad-srv.ldap-srvs.subnet.example.com
   LDAP Bind User Distinguished Name	The user name that connects to the Active Directory service to look up login requests on behalf of Cloudera Navigator. Enter either the complete user principal name or just the short name. For example, cn-admin@EXAMPLE.COM or cn-admin. For Active Directory, this distinguished name (DN) corresponds to the sAMAcountName.
   LDAP Bind Password	Enter the password used to log in to the Active Directory instance using the DN specified for the bind user.
   Active Directory Domain	The fully-qualified domain name of the Active Directory domain controller host system. This is the service to which the bind operation For example: ldap-servs.subnet.example.com
   LDAP Distinguished Name Pattern	Leave blank if LDAP User Search Base is set.
   LDAP User Search Base	Specify the organizational unit (OU) and domain component (DC) properties for the LDAP search tree. For example: ou=nav_people,dc=ldap-srvs,dc=subnet,dc=example,dc=com
   LDAP User Search Filter	Optional.
   LDAP Group Search Base	ou=nav_groups,dc=ldap-srvs,dc=subnet,dc=example,dc=com
   LDAP Group Search Filter For Logged In User	Optional.
   LDAP Groups Search Filter	(&(objectClass=groupOfNames)(cn=*{0}*))

8. Click Save Changes.
9. Restart the Navigator Metadata Service:
   • From Cloudera Management Service, click the Instances tab.
   • Select Navigator Metadata Service from among the instances listed.
   • Click the Actions for Selected button and select Restart.