From 8305e014af1bc413c27a37afe05d8191627471aa Mon Sep 17 00:00:00 2001 From: Henry <166068791+KingHenry6666@users.noreply.github.com> Date: Thu, 27 Aug 2026 19:54:20 -0400 Subject: [PATCH 1/6] restructure integration docs for Nutanix PC and add Nutanix PE integration guide --- .../{nutanix-ahv => nutanix-pc}/index.mdx | 10 +++++----- .../hypervisors-orchestrators/nutanix-pe/index.mdx | 2 ++ 2 files changed, 7 insertions(+), 5 deletions(-) rename website/integrations/hypervisors-orchestrators/{nutanix-ahv => nutanix-pc}/index.mdx (93%) create mode 100644 website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx diff --git a/website/integrations/hypervisors-orchestrators/nutanix-ahv/index.mdx b/website/integrations/hypervisors-orchestrators/nutanix-pc/index.mdx similarity index 93% rename from website/integrations/hypervisors-orchestrators/nutanix-ahv/index.mdx rename to website/integrations/hypervisors-orchestrators/nutanix-pc/index.mdx index b64f36380d83..d1ee986568c0 100644 --- a/website/integrations/hypervisors-orchestrators/nutanix-ahv/index.mdx +++ b/website/integrations/hypervisors-orchestrators/nutanix-pc/index.mdx @@ -1,16 +1,16 @@ --- -title: Integrate with Nutanix AHV -sidebar_label: Nutanix AHV +title: Integrate with Nutanix Prism Central +sidebar_label: Nutanix PC support_level: community --- import SAMLProvider20265Warning from "../../\_saml-provider-2026-5-warning.mdx"; -## What is Nutanix AHV? +## What is Nutanix Prism Central? -> Nutanix AHV is the native hypervisor of the Nutanix Cloud Platform, providing enterprise virtualization for compute workloads. AHV clusters are managed through Prism Central, which supports single sign-on with SAML 2.0 identity providers. +> Nutanix Prism Central, also known as Nutanix PC, is a centralized software virtual appliance used to manage multiple Nutanix and non-Nutanix clusters from a single interface. It supports single sign-on with SAML 2.0 identity providers. > -> -- https://www.nutanix.com/products/ahv +> -- https://www.nutanix.com/products/prism ## Preparation diff --git a/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx new file mode 100644 index 000000000000..dd89a96fcf3c --- /dev/null +++ b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx @@ -0,0 +1,2 @@ +a built-in management service included with every individual Nutanix cluster +https://www.nutanixbible.com/3a-book-of-prism-architecture.html \ No newline at end of file From f268b8ce5cb5c345b0c1406a57000b7f88cdd86c Mon Sep 17 00:00:00 2001 From: Henry <166068791+KingHenry6666@users.noreply.github.com> Date: Fri, 28 Aug 2026 00:13:11 -0400 Subject: [PATCH 2/6] fixed some NPC stuff, started on NPE --- .../nutanix-pc/index.mdx | 4 +- .../nutanix-pe/index.mdx | 74 ++++++++++++++++++- 2 files changed, 74 insertions(+), 4 deletions(-) diff --git a/website/integrations/hypervisors-orchestrators/nutanix-pc/index.mdx b/website/integrations/hypervisors-orchestrators/nutanix-pc/index.mdx index d1ee986568c0..9b29c417f39c 100644 --- a/website/integrations/hypervisors-orchestrators/nutanix-pc/index.mdx +++ b/website/integrations/hypervisors-orchestrators/nutanix-pc/index.mdx @@ -1,6 +1,6 @@ --- title: Integrate with Nutanix Prism Central -sidebar_label: Nutanix PC +sidebar_label: Nutanix Prism Central support_level: community --- @@ -8,7 +8,7 @@ import SAMLProvider20265Warning from "../../\_saml-provider-2026-5-warning.mdx"; ## What is Nutanix Prism Central? -> Nutanix Prism Central, also known as Nutanix PC, is a centralized software virtual appliance used to manage multiple Nutanix and non-Nutanix clusters from a single interface. It supports single sign-on with SAML 2.0 identity providers. +> Nutanix Prism Central, also known as Nutanix PC, is a centralized software virtual appliance that allows you to manage multiple physical or cloud-based clusters from one unified dashboard. It supports single sign-on with SAML 2.0 identity providers. > > -- https://www.nutanix.com/products/prism diff --git a/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx index dd89a96fcf3c..39aef30642e2 100644 --- a/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx +++ b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx @@ -1,2 +1,72 @@ -a built-in management service included with every individual Nutanix cluster -https://www.nutanixbible.com/3a-book-of-prism-architecture.html \ No newline at end of file +--- +title: Integrate with Nutanix Prism Element +sidebar_label: Nutanix Prism Element +support_level: community +--- + +## What is Nutanix Prism Element? + +> Nutanix Prism Element, also known as Nutanix PE, is a built-in management service included with every individual Nutanix cluster +> +> -- https://www.nutanixbible.com/3a-book-of-prism-architecture.html + +## Preparation + +The following placeholders are used in this guide: + +- `ldap.company` is the FQDN of the authentik LDAP outpost. + +Prisn Element authenticates users against LDAP. Nutanix PE must be able to reach the authentik LDAP outpost on port `636` and trust the certificate that the outpost presents for `ldap.company`. + +## authentik configuration + +### Create access groups + +Create groups that Prisn Element uses to allow login and to grant administrator privileges. The user filter permits members of either group to log in, while the admin filter grants administrator privileges only to members of `npe-admins`. + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Directory** > **Groups** and click **Create**. +3. Set **Name** to `npe-users` and click **Create**. +4. Open the group, select the **Users** tab, and add the users who should have non-administrative access to Prisn Element. +5. Repeat these steps with the name `npe-admins`, and add the users who should have administrator privileges. + +### Create the LDAP resources + +Follow the [LDAP provider setup](/docs/add-secure-apps/providers/ldap/create-ldap-provider/) to create or reuse an LDAP application and provider, create a service account with LDAP search permissions, and create an LDAP outpost. + +Use the following NPE-specific settings while completing the LDAP provider setup: + +- Use `npe-ldap` as the service account username. Note its password and full DN for NPE configuration. +- The LDAP provider's **Base DN** is represented as ``. Replace this correspondingly. +- On the LDAP provider, set **Certificate** to the certificate that NPE should trust for `ldap.company`. +- Select the NPE LDAP application on the outpost and expose the outpost as `ldap.company`. + +If you configure application bindings, ensure that `npe-ldap` as well as the `npe-users` and `npe-admins` groups have access to the LDAP application. + +## Prisn Element configuration + +### Configure LDAP authentication + +:::info Dual Authentication +After you save LDAP as the authentication method, Prisn Element will continue allowing local accounts to authenticate. +::: + +1. Log in to Prisn Element as a user with administrator privileges. +2. Click the Gear icon on the top right and navigate to **Users and Roles** --> **Authentication** + + +### Add Role Mappings + + + +## Configuration verification + +To confirm that authentik is properly configured with Prisn Element, open the NPE UI and log in with an authentik username and password. A user in `npe-users` should reach the NPE dashboard without administrator privileges, and a user in `npe-admins` should have administrator privileges. + +## Resources + +- [Prisn Element documentation - Configuring OpenLDAP Authentication](https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v7_6:wc-openldap-authentication-wc-t.html) +- [Prisn Element documentation - UI Navigation](https://www.nutanixbible.com/3b-book-of-prism-navigation.html) + + + From 2990dc81fae1bede5ecb735b6f69cb804af70062 Mon Sep 17 00:00:00 2001 From: Henry <166068791+KingHenry6666@users.noreply.github.com> Date: Fri, 28 Aug 2026 01:51:27 -0400 Subject: [PATCH 3/6] Finished NPE Documentation --- .../nutanix-pe/index.mdx | 37 ++++++++++++++++--- 1 file changed, 31 insertions(+), 6 deletions(-) diff --git a/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx index 39aef30642e2..8e4434c7028d 100644 --- a/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx +++ b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx @@ -52,21 +52,46 @@ After you save LDAP as the authentication method, Prisn Element will continue al ::: 1. Log in to Prisn Element as a user with administrator privileges. -2. Click the Gear icon on the top right and navigate to **Users and Roles** --> **Authentication** +2. Click the gear icon on the top right and navigate to **Users and Roles** --> **Authentication** +3. Click **Add** in the **Directory List** tab +4. Configure the following settings. Replace `` with the **Base DN** of the authentik LDAP provider. + - **Directory Type**: `OpenLDAP` + - **Name**: Give it a name + - **Domain**: Your combined base dn (like `ldap.goauthentik.io`) + - **Directory URL**: `ldaps://IP:636` + - **Search Type**: Non-recursive (Default) + - **User Object Class**: `user` + - **User Search Base**: `ou=users,dc=ldap,dc=goauthentik,dc=io` + - **Username Attribute**: `cn` + - **Group Object Class**: `group` + - **Group Search Base**: `ou=groups,dc=ldap,dc=goauthentik,dc=io` + - **Group Member Attribute**: `member` + - **Group Member Attribute Value**: `dn` + - **Service Account**: `cn=npe-ldap,ou=users,dc=ldap,dc=goauthentik,dc=io` + - **Service Account Password**: the password for the `npe-ldap` service account +5. **Save** your changes, then navigate to **Authentication Types** and check **Directory Service**. Save your changes. ### Add Role Mappings +Role Mappings are required for RBAC on NPE. +1. Click the gear icon on the top right and navigate to **Users and Roles** --> **Role Mapping**. +2. Click **New Mapping** +3. Select your Directory from the **Directory or Provider** dropdown menu +4. Select `group` as the type in the **Type** dropdown menu +5. The value should be the name of the group as represented in Authentik. For example, if your group is `npe-admins`, put `npe-admins` in this box. Spaces are only required for groups with a space in the name, like `authentik Admins`. +6. Select a Role. For more information on roles, refer to the [Nutanix Role Mapping documentation](https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v7_6:wc-security-role-permissions-wc-t.html). +7. Click Save ## Configuration verification -To confirm that authentik is properly configured with Prisn Element, open the NPE UI and log in with an authentik username and password. A user in `npe-users` should reach the NPE dashboard without administrator privileges, and a user in `npe-admins` should have administrator privileges. +To confirm that authentik is properly configured with Prisn Element, click the **Test** button in the **Directory List** menu. Enter a user and append `@` in the username box, and enter their password in the password box. If everything was done correctly, a green banner should pop up saying **Authentication test successful.** + +## Logging in +To log in via LDAP, specify a username and then append `@ Date: Fri, 28 Aug 2026 13:13:10 -0400 Subject: [PATCH 4/6] wip --- .../nutanix-pc/index.mdx | 10 +- .../nutanix-pe/index.mdx | 199 +++++++++--------- website/integrations/static/_redirects | 3 + 3 files changed, 109 insertions(+), 103 deletions(-) diff --git a/website/integrations/hypervisors-orchestrators/nutanix-pc/index.mdx b/website/integrations/hypervisors-orchestrators/nutanix-pc/index.mdx index 9b29c417f39c..d76465b23bf4 100644 --- a/website/integrations/hypervisors-orchestrators/nutanix-pc/index.mdx +++ b/website/integrations/hypervisors-orchestrators/nutanix-pc/index.mdx @@ -16,7 +16,7 @@ import SAMLProvider20265Warning from "../../\_saml-provider-2026-5-warning.mdx"; The following placeholders are used in this guide: -- `prismcentral.company` is the FQDN of the Prism Central instance that manages the Nutanix AHV cluster. +- `prismcentral.company` is the FQDN of the Prism Central installation. - `authentik.company` is the FQDN of the authentik installation. :::info @@ -27,7 +27,7 @@ This guide follows the authorization policy workflow available in Prism Central ## authentik configuration -To support the integration of Nutanix AHV with authentik, you need to create two property mappings and an application/provider pair in authentik. Prism Central identifies users by the username and email attributes in the SAML assertion, and uses the NameID attribute for role mapping. +To support the integration of Prism Central with authentik, you need to create two property mappings and an application/provider pair in authentik. Prism Central identifies users by the username and email attributes in the SAML assertion, and uses the NameID attribute for role mapping. ### Create property mappings @@ -79,9 +79,7 @@ To support the integration of Nutanix AHV with authentik, you need to create two 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section. 2. Under **Related objects** > **Metadata**, click **Download**. This metadata file is required in the next section. -## Nutanix AHV configuration - -Authentication for Nutanix AHV clusters is configured in Prism Central. +## Nutanix Prism Central configuration ### Add the identity provider @@ -111,7 +109,7 @@ On earlier Prism Central versions, select or create a role, then use **Actions** ## Configuration verification -To confirm that authentik is properly configured with Nutanix AHV, open Prism Central and select the authentik configuration on the login screen. Complete the authentik authentication flow and confirm that Prism Central opens with the expected role. +To confirm that authentik is properly configured with Prism Central, open Prism Central and select the authentik configuration on the login screen. Complete the authentik authentication flow and confirm that Prism Central opens with the expected role. ## Resources diff --git a/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx index 8e4434c7028d..defcaa74d7b9 100644 --- a/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx +++ b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx @@ -1,97 +1,102 @@ ---- -title: Integrate with Nutanix Prism Element -sidebar_label: Nutanix Prism Element -support_level: community ---- - -## What is Nutanix Prism Element? - -> Nutanix Prism Element, also known as Nutanix PE, is a built-in management service included with every individual Nutanix cluster -> -> -- https://www.nutanixbible.com/3a-book-of-prism-architecture.html - -## Preparation - -The following placeholders are used in this guide: - -- `ldap.company` is the FQDN of the authentik LDAP outpost. - -Prisn Element authenticates users against LDAP. Nutanix PE must be able to reach the authentik LDAP outpost on port `636` and trust the certificate that the outpost presents for `ldap.company`. - -## authentik configuration - -### Create access groups - -Create groups that Prisn Element uses to allow login and to grant administrator privileges. The user filter permits members of either group to log in, while the admin filter grants administrator privileges only to members of `npe-admins`. - -1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Directory** > **Groups** and click **Create**. -3. Set **Name** to `npe-users` and click **Create**. -4. Open the group, select the **Users** tab, and add the users who should have non-administrative access to Prisn Element. -5. Repeat these steps with the name `npe-admins`, and add the users who should have administrator privileges. - -### Create the LDAP resources - -Follow the [LDAP provider setup](/docs/add-secure-apps/providers/ldap/create-ldap-provider/) to create or reuse an LDAP application and provider, create a service account with LDAP search permissions, and create an LDAP outpost. - -Use the following NPE-specific settings while completing the LDAP provider setup: - -- Use `npe-ldap` as the service account username. Note its password and full DN for NPE configuration. -- The LDAP provider's **Base DN** is represented as ``. Replace this correspondingly. -- On the LDAP provider, set **Certificate** to the certificate that NPE should trust for `ldap.company`. -- Select the NPE LDAP application on the outpost and expose the outpost as `ldap.company`. - -If you configure application bindings, ensure that `npe-ldap` as well as the `npe-users` and `npe-admins` groups have access to the LDAP application. - -## Prisn Element configuration - -### Configure LDAP authentication - -:::info Dual Authentication -After you save LDAP as the authentication method, Prisn Element will continue allowing local accounts to authenticate. -::: - -1. Log in to Prisn Element as a user with administrator privileges. -2. Click the gear icon on the top right and navigate to **Users and Roles** --> **Authentication** -3. Click **Add** in the **Directory List** tab -4. Configure the following settings. Replace `` with the **Base DN** of the authentik LDAP provider. - - **Directory Type**: `OpenLDAP` - - **Name**: Give it a name - - **Domain**: Your combined base dn (like `ldap.goauthentik.io`) - - **Directory URL**: `ldaps://IP:636` - - **Search Type**: Non-recursive (Default) - - **User Object Class**: `user` - - **User Search Base**: `ou=users,dc=ldap,dc=goauthentik,dc=io` - - **Username Attribute**: `cn` - - **Group Object Class**: `group` - - **Group Search Base**: `ou=groups,dc=ldap,dc=goauthentik,dc=io` - - **Group Member Attribute**: `member` - - **Group Member Attribute Value**: `dn` - - **Service Account**: `cn=npe-ldap,ou=users,dc=ldap,dc=goauthentik,dc=io` - - **Service Account Password**: the password for the `npe-ldap` service account -5. **Save** your changes, then navigate to **Authentication Types** and check **Directory Service**. Save your changes. - - -### Add Role Mappings - -Role Mappings are required for RBAC on NPE. -1. Click the gear icon on the top right and navigate to **Users and Roles** --> **Role Mapping**. -2. Click **New Mapping** -3. Select your Directory from the **Directory or Provider** dropdown menu -4. Select `group` as the type in the **Type** dropdown menu -5. The value should be the name of the group as represented in Authentik. For example, if your group is `npe-admins`, put `npe-admins` in this box. Spaces are only required for groups with a space in the name, like `authentik Admins`. -6. Select a Role. For more information on roles, refer to the [Nutanix Role Mapping documentation](https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v7_6:wc-security-role-permissions-wc-t.html). -7. Click Save - - -## Configuration verification - -To confirm that authentik is properly configured with Prisn Element, click the **Test** button in the **Directory List** menu. Enter a user and append `@` in the username box, and enter their password in the password box. If everything was done correctly, a green banner should pop up saying **Authentication test successful.** - -## Logging in -To log in via LDAP, specify a username and then append `@ Localized cluster manager responsible for local cluster management and operations. Every Nutanix Cluster has Prism Element built-in. +> +> -- https://www.nutanixbible.com/3a-book-of-prism-architecture.html + +## Preparation + +The following placeholders are used in this guide: + +- `ldap.company` is the FQDN of the authentik LDAP outpost. + +Prism Element authenticates users over LDAP, so it must be able to reach the authentik LDAP outpost on port `636` and trust the certificate that the outpost presents for `ldap.company`. + +This guide uses the default LDAP provider **Base DN** of `dc=ldap,dc=goauthentik,dc=io`. If you use a different Base DN, adjust the distinguished names below to match. + +:::info +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. +::: + +## authentik configuration + +To support the integration of Prism Element with authentik, you need groups for the Prism Element roles, an LDAP application/provider pair, a service account for LDAP binding, LDAP search permissions for that service account, and an LDAP outpost. + +### Create access groups + +Prism Element grants roles to directory groups, so create one group in authentik for each Prism Element role that you want to assign. + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Directory** > **Groups** and click **Create**. +3. Set **Name** to `nutanix-users` and click **Create**. +4. Click the name of the group, open the **Users** tab, and add the users that should have non-administrative access to Prism Element. +5. Repeat these steps for a `nutanix-admins` group, and add the users that should have administrator access. + +### Create the LDAP resources + +Follow the [LDAP provider documentation](/docs/add-secure-apps/providers/ldap/create-ldap-provider) to create the remaining resources, and use the following Prism Element-specific settings: + +- On the LDAP provider, set **Certificate** to the certificate that Prism Element will trust for `ldap.company`. +- On the LDAP provider, set **TLS Server Name** to `ldap.company`. +- For the LDAP bind service account name, use a descriptive name such as `nutanix-user`. +- If you configure application bindings, ensure that the LDAP bind service account and the `nutanix-users` and `nutanix-admins` groups have access to the application. + +## Nutanix Prism Element configuration + +### Add the directory + +1. Log in to Prism Element as a user with administrator privileges. +2. Click the gear icon in the top right and navigate to **Users and Roles** > **Authentication**. +3. On the **Directory List** tab, click **New Directory**. +4. Configure the directory with the following settings: + - **Directory Type**: `OpenLDAP` + - **Name**: `authentik` + - **Domain**: `ldap.goauthentik.io` + - **Directory URL**: `ldaps://ldap.company:636` + - **User Object Class**: `user` + - **User Search Base**: `ou=users,dc=ldap,dc=goauthentik,dc=io` + - **Username Attribute**: `cn` + - **Group Object Class**: `group` + - **Group Search Base**: `ou=groups,dc=ldap,dc=goauthentik,dc=io` + - **Group Member Attribute**: `member` + - **Group Member Attribute Value**: `dn` + - **Service Account**: `cn=nutanix-user,ou=users,dc=ldap,dc=goauthentik,dc=io` + - **Service Account Password**: the password for the `nutanix-user` service account + +5. Click **Save**. +6. Open the **Authentication Types** tab, select **Directory Service**, and click **Save**. + +**Domain** is the Base DN written in dotted form, and users append it to their username when they log in. With the default Base DN, `akadmin` logs in as `akadmin@ldap.goauthentik.io`. + +:::info Local accounts stay enabled +Selecting **Directory Service** adds LDAP as an authentication type. Prism Element keeps accepting local accounts. +::: + +### Map groups to roles + +Directory users receive no permissions until a role mapping grants them one. + +1. Click the gear icon in the top right and navigate to **Users and Roles** > **Role Mapping**. +2. Click **New Mapping**. +3. Select the directory that you created in **Directory or Provider**. +4. Select `Group` in **Type**. +5. Enter the group name exactly as it appears in authentik, for example `nutanix-admins`. +6. Select the role to grant, then click **Save**. +7. Repeat these steps for each remaining group. + +## Configuration verification + +To confirm that authentik is properly configured with Prism Element, open Prism Element and log in as `akadmin@ldap.goauthentik.io` with the authentik password for that user. + +You can also test the directory without logging out. On the **Directory List** tab, click **Test**, then enter the same username and password. Prism Element reports **Authentication test successful** when the directory is reachable and the credentials are accepted. + +## Resources + +- [Nutanix Security Guide - Configuring OpenLDAP Authentication](https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v7_6:wc-openldap-authentication-wc-t.html) +- [Nutanix Security Guide - Role permissions](https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v7_6:wc-security-role-permissions-wc-t.html) diff --git a/website/integrations/static/_redirects b/website/integrations/static/_redirects index b6b08a7fd5ff..a5ef6cf914e5 100644 --- a/website/integrations/static/_redirects +++ b/website/integrations/static/_redirects @@ -30,3 +30,6 @@ /networking/cloudflare-access /security/cloudflare-access 301! /platforms/microsoft /platforms/microsoft-saml 301! + +/hypervisors-orchestrators/nutanix-ahv /hypervisors-orchestrators/nutanix-pc 301! +/hypervisors-orchestrators/nutanix-ahv/ /hypervisors-orchestrators/nutanix-pc/ 301! From df1d18d5e25147899e419d3fc8507ad6d011c104 Mon Sep 17 00:00:00 2001 From: Dominic R Date: Fri, 28 Aug 2026 13:16:40 -0400 Subject: [PATCH 5/6] wip2 --- .../hypervisors-orchestrators/nutanix-pe/index.mdx | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx index defcaa74d7b9..ac35b1d9e317 100644 --- a/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx +++ b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx @@ -18,7 +18,7 @@ The following placeholders are used in this guide: Prism Element authenticates users over LDAP, so it must be able to reach the authentik LDAP outpost on port `636` and trust the certificate that the outpost presents for `ldap.company`. -This guide uses the default LDAP provider **Base DN** of `dc=ldap,dc=goauthentik,dc=io`. If you use a different Base DN, adjust the distinguished names below to match. +This guide uses the default LDAP provider **Base DN** of `DC=ldap,DC=goauthentik,DC=io`. If you use a different Base DN, adjust the distinguished names below to match. :::info This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. @@ -53,26 +53,26 @@ Follow the [LDAP provider documentation](/docs/add-secure-apps/providers/ldap/cr 1. Log in to Prism Element as a user with administrator privileges. 2. Click the gear icon in the top right and navigate to **Users and Roles** > **Authentication**. -3. On the **Directory List** tab, click **New Directory**. +3. On the **Directory List** tab, click **Add**. 4. Configure the directory with the following settings: - **Directory Type**: `OpenLDAP` - **Name**: `authentik` - **Domain**: `ldap.goauthentik.io` - **Directory URL**: `ldaps://ldap.company:636` - **User Object Class**: `user` - - **User Search Base**: `ou=users,dc=ldap,dc=goauthentik,dc=io` + - **User Search Base**: `OU=users,DC=ldap,DC=goauthentik,DC=io` - **Username Attribute**: `cn` - **Group Object Class**: `group` - - **Group Search Base**: `ou=groups,dc=ldap,dc=goauthentik,dc=io` + - **Group Search Base**: `OU=groups,DC=ldap,DC=goauthentik,DC=io` - **Group Member Attribute**: `member` - **Group Member Attribute Value**: `dn` - - **Service Account**: `cn=nutanix-user,ou=users,dc=ldap,dc=goauthentik,dc=io` + - **Service Account**: `CN=nutanix-user,OU=users,DC=ldap,DC=goauthentik,DC=io` - **Service Account Password**: the password for the `nutanix-user` service account 5. Click **Save**. 6. Open the **Authentication Types** tab, select **Directory Service**, and click **Save**. -**Domain** is the Base DN written in dotted form, and users append it to their username when they log in. With the default Base DN, `akadmin` logs in as `akadmin@ldap.goauthentik.io`. +**Domain** is the Base DN written in dotted form, and users append it to their username when they log in. With the default Base DN, the user `akadmin` logs in as `akadmin@ldap.goauthentik.io`. :::info Local accounts stay enabled Selecting **Directory Service** adds LDAP as an authentication type. Prism Element keeps accepting local accounts. @@ -92,7 +92,7 @@ Directory users receive no permissions until a role mapping grants them one. ## Configuration verification -To confirm that authentik is properly configured with Prism Element, open Prism Element and log in as `akadmin@ldap.goauthentik.io` with the authentik password for that user. +To confirm that authentik is properly configured with Prism Element, open Prism Element and log in as a member of `nutanix-admins`, appending `@ldap.goauthentik.io` to their username. You can also test the directory without logging out. On the **Directory List** tab, click **Test**, then enter the same username and password. Prism Element reports **Authentication test successful** when the directory is reachable and the credentials are accepted. From aecb60b16314da66200dc183506280bd19c597ac Mon Sep 17 00:00:00 2001 From: Dominic R Date: Fri, 28 Aug 2026 13:18:22 -0400 Subject: [PATCH 6/6] wi3p --- .../nutanix-pe/index.mdx | 68 ++++++++++--------- 1 file changed, 35 insertions(+), 33 deletions(-) diff --git a/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx index ac35b1d9e317..f08171d2442e 100644 --- a/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx +++ b/website/integrations/hypervisors-orchestrators/nutanix-pe/index.mdx @@ -16,9 +16,7 @@ The following placeholders are used in this guide: - `ldap.company` is the FQDN of the authentik LDAP outpost. -Prism Element authenticates users over LDAP, so it must be able to reach the authentik LDAP outpost on port `636` and trust the certificate that the outpost presents for `ldap.company`. - -This guide uses the default LDAP provider **Base DN** of `DC=ldap,DC=goauthentik,DC=io`. If you use a different Base DN, adjust the distinguished names below to match. +Prism Element authenticates users against LDAP. Prism Element must be able to reach the authentik LDAP outpost on port `636` and trust the certificate that the outpost presents for `ldap.company`. :::info This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. @@ -26,73 +24,77 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration -To support the integration of Prism Element with authentik, you need groups for the Prism Element roles, an LDAP application/provider pair, a service account for LDAP binding, LDAP search permissions for that service account, and an LDAP outpost. +To support the integration of Prism Element with authentik, you need to create groups for Prism Element access and configure an LDAP provider and outpost. ### Create access groups -Prism Element grants roles to directory groups, so create one group in authentik for each Prism Element role that you want to assign. +Create groups that Prism Element maps to roles. Prism Element grants a role to a group rather than to individual users, so create one group for each role that you want to assign. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Groups** and click **Create**. -3. Set **Name** to `nutanix-users` and click **Create**. -4. Click the name of the group, open the **Users** tab, and add the users that should have non-administrative access to Prism Element. -5. Repeat these steps for a `nutanix-admins` group, and add the users that should have administrator access. +3. Set **Name** to `npe-users` and click **Create**. +4. Open the group, select the **Users** tab, and add the users who should have non-administrative access to Prism Element. +5. Repeat these steps with the name `npe-admins`, and add the users who should have Prism Element administrator privileges. ### Create the LDAP resources -Follow the [LDAP provider documentation](/docs/add-secure-apps/providers/ldap/create-ldap-provider) to create the remaining resources, and use the following Prism Element-specific settings: +Follow the [LDAP provider setup](/docs/add-secure-apps/providers/ldap/create-ldap-provider/) to create or reuse an LDAP application and provider, create a service account with LDAP search permissions, and create an LDAP outpost. + +Use the following Prism Element settings while completing the LDAP provider setup: + +- Use `npe-ldap` as the service account username. Note its password and full DN for the Prism Element configuration. +- Note the LDAP provider's **Base DN** as ``. +- On the LDAP provider, set **Certificate** to the certificate that Prism Element should trust for `ldap.company`. +- Set **TLS Server Name** to `ldap.company`. +- Select the Prism Element LDAP application on the outpost and expose the outpost as `ldap.company`. -- On the LDAP provider, set **Certificate** to the certificate that Prism Element will trust for `ldap.company`. -- On the LDAP provider, set **TLS Server Name** to `ldap.company`. -- For the LDAP bind service account name, use a descriptive name such as `nutanix-user`. -- If you configure application bindings, ensure that the LDAP bind service account and the `nutanix-users` and `nutanix-admins` groups have access to the application. +If you configure application bindings, ensure that `npe-ldap`, `npe-users`, and `npe-admins` have access to the LDAP application. ## Nutanix Prism Element configuration -### Add the directory +### Configure LDAP authentication + +:::info Local accounts stay enabled +Selecting **Directory Service** adds LDAP as an authentication type. Prism Element keeps accepting local accounts. +::: 1. Log in to Prism Element as a user with administrator privileges. 2. Click the gear icon in the top right and navigate to **Users and Roles** > **Authentication**. 3. On the **Directory List** tab, click **Add**. -4. Configure the directory with the following settings: +4. Configure the following settings. Replace `` with the **Base DN** of the authentik LDAP provider. - **Directory Type**: `OpenLDAP` - **Name**: `authentik` - - **Domain**: `ldap.goauthentik.io` + - **Domain**: the base DN in dotted form. For example, if `` is `dc=ldap,dc=goauthentik,dc=io`, the domain is `ldap.goauthentik.io`. - **Directory URL**: `ldaps://ldap.company:636` - **User Object Class**: `user` - - **User Search Base**: `OU=users,DC=ldap,DC=goauthentik,DC=io` + - **User Search Base**: `ou=users,` - **Username Attribute**: `cn` - **Group Object Class**: `group` - - **Group Search Base**: `OU=groups,DC=ldap,DC=goauthentik,DC=io` + - **Group Search Base**: `ou=groups,` - **Group Member Attribute**: `member` - **Group Member Attribute Value**: `dn` - - **Service Account**: `CN=nutanix-user,OU=users,DC=ldap,DC=goauthentik,DC=io` - - **Service Account Password**: the password for the `nutanix-user` service account - + - **Service Account**: `cn=npe-ldap,ou=users,` + - **Service Account Password**: the password for the `npe-ldap` service account 5. Click **Save**. 6. Open the **Authentication Types** tab, select **Directory Service**, and click **Save**. -**Domain** is the Base DN written in dotted form, and users append it to their username when they log in. With the default Base DN, the user `akadmin` logs in as `akadmin@ldap.goauthentik.io`. - -:::info Local accounts stay enabled -Selecting **Directory Service** adds LDAP as an authentication type. Prism Element keeps accepting local accounts. -::: +Users append the **Domain** value to their username when they log in. With a domain of `ldap.goauthentik.io`, the user `akadmin` logs in as `akadmin@ldap.goauthentik.io`. -### Map groups to roles +### Create the role mappings -Directory users receive no permissions until a role mapping grants them one. +Prism Element does not grant permissions to directory users automatically. After you save the directory, map each authentik group to the role that its members should receive. 1. Click the gear icon in the top right and navigate to **Users and Roles** > **Role Mapping**. 2. Click **New Mapping**. -3. Select the directory that you created in **Directory or Provider**. -4. Select `Group` in **Type**. -5. Enter the group name exactly as it appears in authentik, for example `nutanix-admins`. +3. Select the directory that you created from the **Directory or Provider** list. +4. Select `Group` in the **Type** list. +5. Enter the group name exactly as it appears in authentik, for example `npe-admins`. 6. Select the role to grant, then click **Save**. -7. Repeat these steps for each remaining group. +7. Repeat these steps for `npe-users`. ## Configuration verification -To confirm that authentik is properly configured with Prism Element, open Prism Element and log in as a member of `nutanix-admins`, appending `@ldap.goauthentik.io` to their username. +To confirm that authentik is properly configured with Prism Element, open Prism Element and log in with an authentik username and the **Domain** value appended, along with the authentik password. A user in `npe-users` should reach Prism Element with the role that you mapped, and a user in `npe-admins` should have administrator privileges. You can also test the directory without logging out. On the **Directory List** tab, click **Test**, then enter the same username and password. Prism Element reports **Authentication test successful** when the directory is reachable and the credentials are accepted.