> For the complete documentation index, see [llms.txt](https://doc.engenius.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.engenius.ai/bmc-user-guide/security/centralized-authentication.md).

# Centralized Authentication

While local user accounts are fine for a small number of servers, they quickly become difficult to manage at scale. Centralized authentication allows you to integrate the BMC with your organization's existing directory service, such as LDAP, Active Directory, or RADIUS. This provides a single source of truth for user accounts and allows you to enforce access policies consistently across your entire infrastructure.

This chapter guides you through connecting the BMC to your centralized authentication system.

## **Integrating with LDAP / Active Directory**

Lightweight Directory Access Protocol (LDAP) and Microsoft's Active Directory are the most common directory services used in enterprise environments. Configuring the BMC to use them allows your team members to log in with their standard company credentials.

1. In the sidebar menu, navigate to **Security and access** > **LDAP**.
2. Check the **Enable LDAP authentication** box.
3. Fill in the connection details for your directory server:
   * **Service type**: Select **OpenLDAP** or **Active Directory**.
   * **Server URI**: The address of your domain controller (e.g., `ldap://dc1.example.com`). Use `ldaps://` and enable SSL for a secure connection.
   * **Bind DN**: The full Distinguished Name of the service account the BMC will use to query the directory (e.g., `cn=service-account,ou=users,dc=example,dc=com`).
   * **Bind Password**: The password for the Bind DN service account.
   * **Base DN**: The starting point for directory searches, which is typically the root of your domain (e.g., `dc=example,dc=com`).
   * **User ID attribute / Group ID attribute**: (Optional) Specify the attributes used for user and group mapping (e.g., `uid`, `cn`).
4. Click **Save settings**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdoePz_x4zxENa-4zdT4GNkGXFBM3Vyt6fVX9wQ2xtzhWnCjn9yOxl7Mw2V8aU3ijcQGgy0DllyvGpKS0UC2F0yvDrTe8YIMdOa3-t1zpt4cDgNgS5up6VAPYYvfo-h5VGkfBI4Dg?key=UlDoHTEZLTRXe-KURf91Rw" alt=""><figcaption></figcaption></figure>

Once the connection is saved, you must map your directory groups to BMC roles.

1. In the **Role groups** section, click **Add role group**.
2. Enter the exact **Group name** from your Active Directory or LDAP.
3. Assign the corresponding **Group privilege** (`Administrator`, `Operator`, or `ReadOnly`).
4. Click **Add**. Repeat for all necessary groups.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXd9H9DRv9TX5GLTFicHzkVI53fNk_9KpLUZXn_x-TM6WwZoOKKPs00c-G8Maw_eUl6gU4EaY22zXwrcSGJfgJrIE1HBBlQEvcXfu0u6qyEqsyrtOcKyNZLZdKnjYSfTRjfVMfou?key=UlDoHTEZLTRXe-KURf91Rw" alt=""><figcaption></figcaption></figure>

## **Integrating with RADIUS**

RADIUS (Remote Authentication Dial-In User Service) is another common authentication protocol, often used in network infrastructure.

1. Navigate to **Security and access** > **RADIUS**.
2. Check the **Enable RADIUS Authentication** box.
3. Enter the server details:
   * **Server Address**: The IP address or hostname of your RADIUS server.
   * **Port**: The authentication port used by the RADIUS server (the default is usually 1812).
   * **Secret**: The shared secret key that the BMC and RADIUS server use to communicate securely. This must match the configuration on the RADIUS server.
4. (Optional) You can map up to three RADIUS groups (`Group Name1`, `Group Name2`, `Group Name3`) to specific privilege levels (`Privilege 1`, `Privilege 2`, `Privilege 3`).
5. Click **Save settings**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfeXkNjdRUtaowHkW7uZqwzl4MYxUgBfKJqrJeQSXDv4j2YZjlSqx-gTyANjBBW8q7Ab9y2U9Ndt_nVgXUygoOdnZC5fAlHS15Hm859caLOytXuf_b8t9450ZperxjO8Zp1AQY_BA?key=UlDoHTEZLTRXe-KURf91Rw" alt=""><figcaption></figcaption></figure>

## **Defining the PAM authentication order**

When you have multiple authentication methods enabled (e.g., local users and LDAP), you need to tell the BMC which one to try first. This is controlled by the **PAM (Pluggable Authentication Modules) Order**.

1. Navigate to **Settings** > **PAM Order**.
2. You will see a list of the enabled authentication modules (e.g., `1 - Internal Users`, `2 - LDAP/AD`).
3. **Drag and drop** the modules to change their position in the sequence.
4. Click **Save**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc42EAGcrQnxQ6bkH5Mj1Q6S9Rt4AMIIjT8skd4mLz__2eS7SAawZi0P-owq3l0vKOHahKWw4SpzN1hltAuVCYZVwbhNIQ3uFQOdkcjIh_2jnPOLVD-V6gQQggAejrWm__MP5Ky?key=UlDoHTEZLTRXe-KURf91Rw" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
**Best Practice: Keep local users as a fallback**

It is highly recommended to place **Internal Users** at the top of the PAM order. This ensures that if your LDAP/RADIUS server becomes unreachable, you can still log in using a local administrator account (like `root`) to troubleshoot the network issue. If LDAP is first and it fails, you could be locked out.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://doc.engenius.ai/bmc-user-guide/security/centralized-authentication.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.