In the console:
- select the default realm in the Security/Realms node.
- select the Providers/Authentication node
- configure a new Active Directory Authenticator
- set Host to the AD server (e.g. dc.mm.local)
- set Principal to the DN of a user account that can query the LDAP server (e.g. CN=Service Account,OU=Service Accounts,OU=mm,DC=mm,DC=local)
- set Credential to the password for the user account
- switch to the Users tab
- set User Object Class to user
- set User Name Attribute to sAMAccountName
- leave User Dynamic Group DN Attribute blank
- set User Base DN to the root of the user tree (e.g. DC=mm,DC=local)
- set User From Name Filter to (&(sAMAccountName=%u)(objectclass=user))
- switch to the Groups tab
- set Group Base DN to the base of the group tree (e.g. DC=mm,DC=local)
- set Static Group Object Class to group
- set Static Group Name Attribute to cn
- switch to the Details tab
- check Use Token Groups for Group Membership Lookup
- Restart the server.
- Verify that these changes work by browsing the Users and Groups nodes under the realm.
Many of these settings can be figured out by browsing the AD LDAP tree using an LDAP browser.
