Configure Nexus Repository Manager LDAP authentication for enterprise user management

Gather LDAP server information

Before configuring Nexus, collect the necessary LDAP server details from your system administrator.

You'll need:

• LDAP server hostname or IP address
• LDAP port (389 for LDAP, 636 for LDAPS)
• Base DN (Distinguished Name) for user searches
• Service account credentials for LDAP binding
• User and group object classes and attributes

Test LDAP connectivity

Verify that your Nexus server can reach the LDAP server on the required port.

telnet ldap.example.com 389

For LDAPS connections, test the secure port:

openssl s_client -connect ldap.example.com:636

Create LDAP service account

Create a dedicated service account in your LDAP directory for Nexus to use when querying user and group information. This account needs read access to user and group objects but should follow the principle of least privilege.

Access Nexus administration panel

Log into Nexus Repository Manager as an administrator and navigate to the LDAP configuration section.

Open your web browser and go to your Nexus instance:

https://nexus.example.com:8081

Navigate to Administration → Security → LDAP.

Create new LDAP connection

Click "Create connection" and configure the basic LDAP server settings.

Fill in the connection details:

• Name: Active Directory (or descriptive name)
• Protocol: ldap or ldaps
• Hostname: ldap.example.com
• Port: 389 (LDAP) or 636 (LDAPS)
• Search base: dc=example,dc=com

Configure authentication method

Set up the service account authentication that Nexus will use to query the LDAP directory.

Configure the authentication settings:

• Authentication method: Simple Authentication
• SASL realm: Leave blank for simple auth
• Username or DN: cn=nexus-service,ou=Service Accounts,dc=example,dc=com
• Password: Your service account password

Configure user and group settings

Define how Nexus should search for users and groups in your LDAP directory structure.

User configuration:

• Base DN: ou=Users,dc=example,dc=com
• Object class: user (Active Directory) or inetOrgPerson (OpenLDAP)
• User filter: Leave blank for default
• User ID attribute: sAMAccountName (AD) or uid (OpenLDAP)
• Real name attribute: cn
• Email attribute: mail

Group configuration:

• Base DN: ou=Groups,dc=example,dc=com
• Object class: group (Active Directory) or groupOfNames (OpenLDAP)
• Group filter: Leave blank for default
• Group ID attribute: cn
• Group member attribute: member
• Group member format: ${dn}

Test LDAP connection

Use Nexus's built-in connection test to verify your LDAP configuration before saving.

In the LDAP configuration form:

1. Click "Verify connection" to test basic connectivity
2. Click "Verify user mapping" and enter a test username
3. Click "Verify login" with test user credentials

All tests should return success before proceeding.

Create Nexus roles for LDAP groups

Define roles in Nexus that correspond to your LDAP groups and assign appropriate privileges.

Navigate to Administration → Security → Roles and create new roles:

• Role ID: nexus-developers
• Role Name: Nexus Developers
• Description: Developer access to artifact repositories
• Privileges: Select repository read/write privileges as needed

Repeat for other roles like nexus-administrators, nexus-readonly, etc.

Map LDAP groups to Nexus roles

Configure automatic role assignment based on LDAP group membership.

Go to Administration → Security → LDAP and edit your LDAP configuration:

1. Scroll to the "User and Group" section
2. Click "Map LDAP groups as roles"
3. Add mappings for each LDAP group:

• LDAP Group: CN=Nexus-Developers,OU=Groups,DC=example,DC=com
• Nexus Roles: nexus-developers

Configure role mapping settings

Fine-tune how LDAP groups are mapped to Nexus roles and handle group nesting if needed.

Additional mapping options:

• Group type: Static (default) or Dynamic
• Member attribute: member (for nested groups)
• Member format: ${dn} (use distinguished names)

For Active Directory with nested groups, enable dynamic group membership to automatically resolve nested group memberships.

Test user login

Verify that LDAP users can successfully authenticate and receive appropriate permissions.

Open an incognito browser window and navigate to your Nexus instance. Try logging in with an LDAP user account that belongs to a mapped group.

After successful login, verify the user's assigned roles by checking their profile or attempting to access resources that should be available to their role.

Monitor authentication logs

Check Nexus logs for LDAP authentication events and potential issues.

sudo tail -f /opt/sonatype-nexus/sonatype-work/nexus3/log/nexus.log | grep -i ldap

Look for successful authentication events and any error messages related to LDAP connectivity or user/group resolution.

Enable detailed LDAP logging

If you encounter authentication issues, enable debug logging for LDAP operations.

Navigate to Administration → System → Logging and add a new logger:

• Name: org.sonatype.nexus.ldap
• Level: DEBUG

This will provide detailed information about LDAP queries and authentication attempts in the nexus.log file.