Hawkeye User Authentication
You can authenticate Hawkeye users in the following ways:
- Users defined locally;
- Users defined in a LDAP Server;
- Users defined in a secure (Keysight) login server.
There is a parameter in Administration > Preferences, which defines the system Authentication Mode to be used.
Users Defined Locally
The administrator can define new users in Administration > System Users Management. The System Authentication Mode is set to Local for this authentication type.
The administrator can enforce complex passwords by setting a parameter in Administration > Preferences > Main > Enforce Complex Password.
New users will be prompted to change their password on first log in.
Sysadmin can force user password changes on next log in by enabling the Force Change Password option in a user profile under System Users Management.
Accounts will be locked out for 5 minutes after 5 unsuccessful log in attempts.
If password complexity is enabled, users will be forced to comply with complexity standards on next password change.
Users Defined in LDAP Server
In Administration > Preferences, the administrator can configure an LDAP server for authenticating users. Hawkeye supports using both regular LDAP and secure LDAP servers. The System Authentication Mode is set to LDAP for this authentication type.
In Administration > Preferences, define the following parameters to use the LDAP server:
| Preference | Description | Example |
|---|---|---|
| LDAP server address | LDAP Server (hostname or ip address) or a list of comma delimited servers. | dc1.hawkeye.labs |
| LDAP Domain DN | Domain DN in the format of either example.org or dc=example,dc=org | hawkeye.labs |
| LDAP - Users Path | The user account folder in the LDAP tree. Example - CN=Users | ou=Users |
| LDAP - User Attributes | The comma separated list of user attributes to search for and compare the login against in the LDAP element. | uid,cn,sAMAccountName |
| LDAP - Enable secure LDAP (LDAPS) | 0 - sets regular LDAP connection 1 - sets LDAPS connection | 1 |
| LDAP - Auto create Hawkeye user | 0 - Users must be created in Administration > Users before they can authenticate using the LDAP server. 1 - Auto create Hawkeye user (if it does not exist already) when Authentication Mode is set to LDAP and user is authenticated successfully | 1 |
| LDAP - Enable group based authentication | 0 – If the user exists in LDAP they can login. 1 - Authenticate users based on their existence in the LDAP Group Path specified. | 1 |
| LDAP Group Path | Defines the group path as defined in the LDAP tree. (Used only when LDAP group based authentication preference above is set to 1) | cn=QualityControl,ou=Groups |
| LDAP Bind DN | Bind DN for connecting to LDAP. Leave it as empty for anonymous bind. (Used only when LDAP group based authentication preference above is turned on) | CN=read-admin,DC=hawkeye,DC=labs |
| LDAP Bind DN Password | Password of LDAP Bind DN. Leave it as empty for anonymous bind (Used only when LDAP group based authentication preference above is turned on) | Hard2Guess |
Refer to your Organizations LDAP server configuration to know the DN parameters that you must specify. These can include a combination of: OU, UID, CN and DC/DC. The values are not case sensitive.
Users Defined in Keysight Login
The Keysight Login is a service allowing users to be authenticated (email/password validation) for using a Hawkeye server. The Keysight Login service manages and validates passwords for an email address. The user will still have to be pre-added to the local Hawkeye server by sysadmin. If Keysight Login is enabled, and a user attempts to login to the Hawkeye server. First the user is confirmed to be defined in the local Hawkeye database, then the Hawkeye server queries the Keysight Login service to confirm the user entered a valid password (authentication).
The Keysight login feature for authenticating users is applied when the system Authentication mode is set to Ixia. To use the Keysight Login service, the administrator defines a new user in the Administration > System Users Management and the user is defined with an email address that ends in engineer@ixiacom.com. This allows a defined user to access the Hawkeye server. The user engineer must then access the Keysight login server and register, which means providing an email address and password. The Keysight Login service will then send an email to the email address provided requiring confirmation to make the user active.
When the user engineer attempts to login, the Hawkeye server contacts Keysight to validate the password provided for the login. If the username and password match in the secure Keysight Authentication server, the user engineer is allowed to login. The privileges allowed to the engineer is determined by the sysadmin administrator that defined the account for the engineer in the Administration > System Users Management (refer to Users and Groups Management).
In the Login you must provide a valid email address registered at https://login.ixiacom.com.