Configuring BMC AREA LDAP Using AD domain credentials for the BMC Windows User Tool

Transcription

1 Cnfiguring BMC AREA LDAP Using AD dmain credentials fr the BMC Windws User Tl Versin 1.0

2 Cnfiguring the BMC AREA LDAP Plugin fr Dmain Username and Passwrds Intrductin...3 LDAP Basics...4 What is LDAP and why use it?...4 What des it mean t Bind in LDAP?...4 What is an Attribute in LDAP?...4 What is a BaseDN in LDAP?...4 What is a Bind User?...5 What is the User Search Filter?...5 What is the default prt fr LDAP and can it be changed?...5 Hw a user is authenticated using the BMC AREA LDAP plugin?...6 Installatin and Cnfiguratin...7 Step 1 The BMC AREA LDAP Cnfiguratin frm...7 Using ldp.exe t find the BaseDN / User Base...8 Step 2 Cnfiguring the ar.cfg/cnf...11 Step 3 Verifying the cnfiguratin...12

3 Page 3 f 12 Intrductin This fllwing dcument describes the basic cnfiguratin fr the BMC AREA LDAP plugin. This shuld nly be cnsidered if the custmer wants t use their dmain username and passwrd, nt utilising SSO, thrugh the BMC Windws User Tl.

4 Page 4 f 12 LDAP Basics The fllwing sectin describes cmmn terms used by AD/LDAP assciated with the BMC AREA plugin. What is LDAP and why use it? LDAP is a lightweight prtcl fr accessing infrmatin in a Directry Service (Lightweight Directry Access Prtcl). It is used by many Grupware, Middleware, and OS vendrs that stre data in what can be called an LDAP database, r rather a data repsitry that can be accessed via the LDAP prtcl. There are many different LDAP client tls that exist fr the purpse f accessing and administering an LDAP database. Active Directries, Nvell Directry Services, SunONE, and many ther prducts supprt LDAP. If yu are using an LDAP cmpliant prduct t stre user infrmatin, then the AR System can be cnfigured t make use f that data fr authenticatin and ther purpses. What des it mean t Bind in LDAP? An LDAP Bind is the equivalent t a Lgin. T bind, yu prvide a valid Directry Service accunt name and passwrd. What is an Attribute in LDAP? An attribute in LDAP is a structure used t hld data. In sme ways, an attribute is like a clumn in a database. Hwever, within a database, clumns are defined in a certain way. There is a data type assciated with a clumn. Attributes are different than database clumns in that they can be multi-valued. They are defined based n attribute syntax, which is like a set f rules that tells the LDAP server what type f data is being stred. In this way, the LDAP server can make cmparisns between different types f data. What is a BaseDN in LDAP? A BaseDN is essentially a lcatin in the LDAP Directry Service. In LDAP, data can be presented in a hierarchical tree structure. S the BaseDN is the level f this structure at which yu will begin lking fr yur data. Literally, BaseDN means the Distinguished Name f the Base (lcatin in the tree t begin). Within the BMC AREA LDAP Cnfiguratin frm, this value is represented as the User Base in the User and Grup Infrmatin sectin.

5 What is a Bind User? Page 5 f 12 This is a user accunt within the AD/LDAP that can query the repsitry fr any existing users. What is the User Search Filter? What needs t be specified here is a valid LDAP filter that is used t identify a user s unique LDAP bject, based upn the value they prvide in the BMC Windws User Tl lgin prmpt. The mst cmmn way t uniquely identify a user in LDAP is by their username. It takes an LDAP Administratr r ne f the LDAP tls t query the LDAP database t determine the name f the bject that will uniquely identify a user. Once this bject is identified, the bject is equated t a keywrd based upn the value the users prvide in the Windws User Tl prmpt. The bject equalling the keywrd makes the value fr the User Search Filter. $\USER$ is the keywrd t get the value entered by the user at the lgin prmpt. Fr example, in Micrsft Active Directry, yu can ften use the samaccuntname bject since it nrmally is the value fr the username. Here is what the User Search Filter value wuld lk like fr this example: samaccuntname=$\user$ r cn=$\user$ This is a cmmn example that applies t Active Directry nly. Any bject in LDAP that uniquely identifies the user can be used. The frmat wuld be: <bject name>=$\user$ What is the default prt fr LDAP and can it be changed? The default prt fr LDAP is TCP 389 but this can be changed. The BMC article KA describes hw t change it.

6 Page 6 f 12 Hw a user is authenticated using the BMC AREA LDAP plugin? The AREA LDAP plug-in perfrms the fllwing steps t authenticate a user: The Plug-in binds as the Bind User defined in the Directry Service Infrmatin sectin f the AREA LDAP Cnfiguratin frm. This is typically a user wh can query the AD/LDAP repsitry. The Plug-in perfrms a query in the LDAP database using the values fr the Hst Name, Prt Number, User Base, and User Search Filter in the AREA LDAP Cnfiguratin frm. If a user in nt fund, return an invalid user errr, therwise cntinue. The Distinguished Name and all available attributes fr the user are returned t the Plug-in. The Plug-in then perfrms anther bind as the Distinguished Name fund in the previus step with passwrd passed frm the BMC Windws User Tl. If Bind fails, return a bad passwrd errr (ARERR 329), therwise the AR Server is infrmed that the user is successfully authenticated.

7 Page 7 f 12 Installatin and Cnfiguratin The fllwing sectins describe the installatin and cnfiguratin steps t enable the BMC AREA Ldap plugin with the JSS SSO Plugin. Step 1 The BMC AREA LDAP Cnfiguratin frm The fllwing sectin describes the minimum values needed t enable this BMC feature. Lgin t the applicatin via the Windws User Tl r Mid Tier as an administrative user. Frm the applicatin list, select the AR System Administratin Cnsle Select System > LDAP > AREA Cnfiguratin Field Hst Name Prt Number Bind User Bind Passwrd User Base User Search Filter Grup Membersh ip Use Secure Scket Layer Failver Timeut Pssible Values This is the hst name f yur AD/LDAP cntrller. E.g. ad.javasystemslutins.lcal The default is 389 This is a user name cnfigured in the AD/LDAP wh has the permissins t query the repsitry The dmain passwrd fr the accunt abve Yu can ask yur AD administratr fr this namingcntext r yu culd fllwing this sectin t utilise the ldp.exe There are typically tw pssible values fr this field. Use ne and test. samaccuntname=$\user$ r cn=$\user$ N N 120

8 Chase referral Yes Page 8 f 12 Using ldp.exe t find the BaseDN / User Base Dwnlad the ldp.exe frm the fllwing URL /dwnlads/ldp.exe Select Cnnectin > Cnnect frm the menu. Once yu select OK, frm the menu, select Cnnectin > Bind and fill in the details frm yur Bind User and Bind Passwrd

9 Page 9 f 12 Then frm the menu select View > Tree A BaseDN bx will appear, just select OK A tree will appear n the left pane. Expand the selectin Lk fr the selectin that is mst likely t have the users.

10 Page 10 f 12 The highlighted area will be the BaseDN / User Base fr the AREA LDAP cnfiguratin frm.

11 Page 11 f 12 Step 2 Cnfiguring the ar.cfg/cnf Open the ar.cfg (Windws) r ar.cnf (LINUX r UNIX). Verify the arealdap.dll (Windws) r arealdap.s (LINUX r UNIX) is present and cnfigured t use the BMC AREA HUB. The fllwing rules must be applied and checked. Areahub is cnfigured. This can be verified by the typical line: Windws Plugin: /pathtarsysteminstallatin/arealdap/areahub.s LINUX/UNIX Plugin: C:\Prgram Files\BMC Sftware\AR System\arealdap\areahub.dll JSS SSO Plugin is cnfigured t be the first AREA-Hub-Plugin within the ar.cfg Starting frm the tp f the file, the first instance f AREA- Hub-Plugin must cntain the jss-ss.dll (Windws) r jss-ss.s (LINUX r UNIX) Windws AREA-Hub-Plugin: /pathtarsysteminstallatin/arealdap/areahub.s LINUX/UNIX AREA-Hub-Plugin: C:\Prgram Files\BMC Sftware\AR System\arealdap\areahub.dll BMC AREA LDAP plugin cnfigured after the JSS SSO Plugin Starting frm the tp f the file, the after the instance f SSO Plugin. Windws AREA-Hub-Plugin: /pathtarsysteminstallatin/arealdap/arealdap.s LINUX/UNIX AREA-Hub-Plugin: C:\Prgram Files\BMC Sftware\AR System\arealdap\ arealdap.dll

12 Page 12 f 12 Step 3 Verifying the cnfiguratin. All plugins will reprt t the AR Server arplugin lg. Lgin t the applicatin via the Windws User Tl r Mid Tier as an administrative user. Frm the applicatin list, select the AR System Administratin Cnsle Select System > General > Server Infrmatin > Lg Select the arplugin lg and set the Plugin Lg Level t ALL. The AR server will need a restart.