Enabling an LDAP Directory Server

About this task

From the WMC, you can choose to have an LDAP server handle user authentication and authorization. When you enable an LDAP directory server, the authentications and authorizations of the LDAP directory server override any users, groups, or permissions you specified via the WMC, except for the built-in Admin user. Therefore, with the exception of the Admin user, you can authenticate and authorize users and groups via an LDAP directory server or the WMC, but not both. Regardless if you enable LDAP or not, you can updated the Admin user password via the CLI.

Note: LDAP users will not be able to access the staging database.

Procedure

  1. In the navigation pane, select Security > LDAP. The LDAP Configuration page is displayed.
  2. Select the Enable LDAP option. If you do not select this option, the Integration Appliance uses the built-in groups and users you defined in the WMC to authenticate and authorize users and their access to the WMC.
  3. Specify host information.
    1. Enter the host name and port number of the LDAP directory server.
    2. Choose a Base DN (Base Distinguished Name) or click Fetch DNs. The WMC fetches the Base DN of all the Directory Information Trees (DITs) from the LDAP directory server. Select the Base DN of the DIT that contains the users you want to authorize.
  4. Choose one of the following security options:
    • Use Secure Connection (SASL) - Enables Simple Authentication and Security (SASL) mechanisms supported by the LDAP directory server. This is the most secure option.
    • Use Simple Authentication - Enables simple authentications, but does not encrypt credentials.
    • Anonymous Bind - Enables anonymous binding to the LDAP directory server. This is the least secure option.
  5. If you selected the Use Secure Connection (SASL) security option, specify a mechanism and configure the mechanism properties and mechanism policies.
  6. If the LDAP directory server requires authentication for a directory search, specify values for the Principal and Password, which are in the Credentials section. When you select the Composed DN Mode authentication mode, this step is not required. However, this step might be required to fetch DNs or mechanisms when the LDAP directory server does not allow anonymous searches.

    If you do not specify a password, the WMC attempts to make the initial binding into the LDAP server as an anonymous user and the LDAP server ignores the Principal credential you specified.

  7. Choose one of the following authentication modes:
    • Composed DN Mode
    • Searched DN Mode
  8. Specify the User Container RDN. The authentication mode you specify determines what value you should specify here.
    • If you selected the Composed DN mode, the User Container RDN is composed of one or more attributes from the user DN. Construct the User Container RDN by walking up the tree from the immediate ancestor of the user to the entry just before the base and adding up the RDN of each entry in the path.

      For example, if:

      User DN = "uid=JohnK,ou=emp,dc=xyz,dc =com"

      then

      User Container RDN = "ou=emp"

    • If you selected the Searched DN mode, the User Container RDN is typically left blank, which causes the LDAP directory server to search the entire DIT starting from the root (Base). Otherwise, the LDAP directory server searches the subtree rooted at the entry having DN = User Container RDN +BaseDN.
  9. If you selected the Searched DN Mode, specify the User Search Filter that the LDAP directory server uses to search for the user DN. (required, only if you select the Search DN Mode) This entry accepts LDAP search filter specification and also accepts a user name in the form of $USERNAME. For example:
    • In MSAD, this entry could be "(samAccountName=$USERNAME)"
    • In SunOne, this could be "(uid=$USERNAME)"
  10. Specify the User Principal DN, which specifies the DN of the user that the LDAP directory server binds after the search. You can specify $USERNAME or $DN to represent the user name and Distinguished Name. Where $DN represents (RDN+BaseDN) for the Compose DN Mode and searched DN for Search DN Mode. In most the cases, $DN is the entry. However, when using SASL in MSAD, you might only need to specify $USERNAME. For SASL in SunOne, you might only need to specify "dn:$DN".
  11. Specify Group Mapping Information.
    1. Specify the Admin Group Filter.
    2. Specify the Publisher Group Filter.
    3. Specify the Group Filter.
  12. Click Save.



Feedback | Notices


Timestamp icon Last updated: Friday, February 5, 2016


http://pic.dhe.ibm.com/infocenter/wci/v7r0m0/topic/com.ibm.wci.appliance.doc/Security/enablingLDAP.html