Using specific directory servers as the LDAP server

Before you begin

For Using Microsoft (MS) Active Directory server as the LDAP server in the following section, note that to use Microsoft Active Directory as the LDAP server for authentication with WebSphere Application Server you must take specific steps. By default, Microsoft Active Directory does not permit anonymous LDAP queries. To create LDAP queries or to browse the directory, an LDAP client must bind to the LDAP server using the distinguished name (DN) of an account that belongs to the administrator group of the Windows system. A group membership search in the Active Directory is done by enumerating the memberof attribute that is possessed by a given user entry, rather than browsing through the member list in each group. If you change this default behavior to browse each group, you can change the Group Member ID Map field from memberof:member to group:member.

Microsoft Active Directory forest is not supported in the user registry in this product.

Why and when to perform this task

[5.0 only][Version 5.0.1][Version 5.0.2] Using IBM Directory Server as the LDAP server

[5.0 only][Version 5.0.1][Version 5.0.2]You can choose the directory type of either IBM Directory Server or SecureWay for the IBM Directory Server.

For supported directory servers, refer to the Supported directory services article. The difference between these two types is group membership lookup. Choose the IBM Tivoli Directory Server for optimum performance during run time. In the IBM Tivoli Directory Server, the group membership is an operational attribute. With this attribute, a group membership lookup is done using the ibm-allGroups attribute for the entry. To utilize this attribute in a security authorization application, use a case-insensitive match so that attribute values returned by the ibm-allGroups attribute are all in uppercase.

Using a Lotus Domino Server as the LDAP server

If you choose the Lotus Domino LDAP server Version 6 and the attribute short name is not defined in the schema, you can take either of the following actions:

[5.0 only][Version 5.0.1][Version 5.0.2]Using iPlanet Directory Server as the LDAP server

[5.0 only][Version 5.0.1][Version 5.0.2]You can choose the iPlanet Directory Server or Netscape for your iPlanet Directory Server system. For supported directory servers, refer to the article, Supported directory services. The difference between the two directory server types is group membership lookup. The iPlanet Directory Server directory is selected to use with the iPlanet Directory Server new grouping mechanism only. The new grouping mechanism is called roles in the iPlanet Directory Server, and the attribute is nsRole.

Roles unify entries. Roles are designed to be more efficient and easier to use for applications. For example, an application can locate the role of an entry by enumerating all the roles that are possessed by a given entry, rather than selecting a group and browsing through the members list.

When using roles, you can create a group using a:

All of these roles are computable by the nsRole attribute. If you plan to use traditional grouping methods to group entries in the Sun One Directory Server, select Netscape as the directory type.

Using Microsoft Active Directory server as the LDAP server

To set up Microsoft Active Directory as your LDAP server, complete the following steps.

Steps for this task

  1. Determine the full distinguished name (DN) and password of an account in the administrators group.
    For example, if the Active Directory administrator creates an account in the Users folder of the Active Directory Users and Computers Windows control panel and the DNS domain is ibm.com, the resulting DN has the following structure:
    cn=<adminUsername>, cn=users, dc=ibm, 
    dc=com 
    
  2. Determine the short name and password of any account in the Microsoft Active Directory.
    This password does not have to be the same account that is used in the previous step.
  3. Use the WebSphere Application Server administrative console to set up the information that is needed to use Microsoft Active Directory:
    1. Start the administrative server for the domain, if necessary.
    2. On the administrative console, click Security on the left navigation panel.
    3. Click the Authentication mechanisms tabbed page. Select Lightweight Third Party Authentication (LTPA) as the authentication mechanism.
    4. Enter the following information in the LDAP settings fields:
      • Security Server ID: The short name of the account that is chosen in step 2
      • Security Server Password: The password of the account that is chosen in step 2
      • Directory Type: Active Directory
      • Host: The domain name service (DNS) name of the machine that runs Microsoft Active Directory
      • Base Distinguished Name: The domain components of the DN of the account that is chosen in step 1. For example: dc=ibm, dc=com Bind
      • Distinguished Name: The full DN of the account chosen in step 1. For example: cn=<adminUsername>, cn=users, dc=ibm, dc=com
      • Bind Password: The password of the account that is chosen in step 1
    5. Click OK to save the changes.
    6. Stop and restart the administrative server so that the changes take effect.
  4. (Optional)   Set ObjectCategory as the filter in the Group member Id map field to improve LDAP performance.
    1. Select Security > User Registries > LDAP > Advanced LDAP Settings .
    2. Add ;objectCategory:group to the end of the Group member ID map field.
    3. Click OK to save the changes
    4. Stop and restart the administrative server so that the changes take effect.

Related concepts
Lightweight Directory Access Protocol
Related tasks
Changing HTTP transport ports
Related reference
Lightweight Directory Access Protocol advanced settings
Lightweight Directory Access Protocol settings
Supported directory services



Searchable topic ID:   tsectmsad
Last updated: Jun 21, 2007 4:55:42 PM CDT    WebSphere Application Server Network Deployment, Version 5.0.2
http://publib.boulder.ibm.com/infocenter/wasinfo/index.jsp?topic=/com.ibm.websphere.nd.doc/info/ae/ae/tsec_tmsad.html

Library | Support | Terms of Use | Feedback