HP Device Manager 4.6

Transcription

1 Technical white paper HP Device Manager 4.6 LDAP Troubleshooting Guide Table of contents Introduction... 2 HPDM LDAP-related context and background... 2 LDAP in HPDM... 2 Configuring User Authentication... 4 Importing a user or group from LDAP... 6 Logging in as an LDAP user... 7 Troubleshooting steps... 7 General configuration... 7 Multiple child domain users login... 9 Testing environment:... 9 LDPA child domain account testing Testing environment: Conclusion: For more information... 14

2 Introduction The purpose of this document is to demonstrate the principle of Lightweight Directory Access Protocol (LDAP) used in HP Device Manager (HPDM) and how to troubleshoot issues that might occur while attempting to use user authentication with Active Directory and other LDAP servers. HPDM LDAP-related context and background Users and groups in an Active Directory, or a different LDAP server, can be used to log in to HPDM. This allows the reuse of existing login accounts and simplifies the management of administrative privileges with HPDM. For more background information, see the HP Device Manager Administrator Guide. LDAP in HPDM Figure 1. HPDM network with an LDAP server HPDM Server Stores the LDAP Server Configuration and imported User/Group information HPDM Console Router HPDM Server HPDM Console Router LDAP Server LDAP Server is responsible for Authentication of LDAP user from HPDM Server The LDAP server configuration information, including User Authentication, needs to be set in HPDM (see Configuring User Authentication). HPDM will use the configuration information to connect to the specified LDAP server. The LDAP users and groups need to be imported into HPDM (see Importing a user or group from LDAP). All LDAP Server configuration and imported user and group information will be stored in the database. HPDM will not store the LDAP user s password. (It is only transported to the LDAP server when the user logs in to HPDM.) After the import is completed, you can log in to HPDM as an LDAP user or group. If you import a user, you can log in to HPDM with that username. If you import a group, all users belonging to that group can log in to HPDM with their LDAP username. 2

3 For HPDM inner users, HPDM authenticates by itself. When you use LDAP to log in to HPDM, the LDAP server authenticates you and returns the result to HPDM (see Logging in as an LDAP user). The following chart is the basic flow of logging in to HPDM as an LDAP user. Figure 2. Logging in to HPDM as an LDAP user flow chart Log in HPDM with LDAP user HPDM Console HPDM Server LDAP Server Start Console Input LDAP username and password Click OK button Check if the username is contained in HPDM inner username list No Check if the username is LDAP user in HPDM No Check if username belongs to a LDAP group Yes Yes Verify username password from HPDM Server Yes Verify username password from LDAP Server Yes Legal username and password Legal username and password Show Main Frame Yes End No Show error dialog No No End 3

4 Configuring User Authentication User Authentication must be configured for the LDAP users and groups before using LDAP to log in to HPDM. In the following example, the LDAP server is used to log in to HPDM with specifications as follows: LDAP server type: Active Directory LDAP server address: LDAP server port: 389 LDAP server domain: magic.com LDAP server administrator: cn=administrator,cn=users,dc=magic,dc=com LDAP server password: From the HPDM Console s menu bar, click Tools > Configuration > User Authentication Panel. 2. Select the Server Type, and then enter the host, bort, encryption, server type, server domain, username, and password. The following examples show two ways to enter the information when using Active Directory as the Server Type. The first example uses the short names of the domain and username. 4

5 The second example uses the fully qualified domain names (FQDN). The following example shows how to enter the information when using General LDAP as the Server Type. 3. Click the Test button to verify the configuration.. 5

6 Importing a user or group from LDAP 1. Click Tools > User Management > Import from LDAP. 2. The Import Users and Groups dialog will open and display the LDAP server information as a tree. Select groups and users from the LDAP tree to import them to HPDM. HPDM will store the user names and group names in the HPDM database. View the users that belong to an imported group by double-clicking the group name. 6

7 Logging in as an LDAP user 1. Log in to HPDM using the creditials of an imported LDAP user. Troubleshooting steps General configuration Make sure that the network between the HPDM Server and the LDAP server is working and that the HPDM Server can access the LDAP server. Verify using the ping command. The following example uses as the LDAP server address. 7

8 Make sure that the LDAP server firewall does not block the port. Verify using the telnet command. The following example uses the default port, 389. Make sure that the LDAP User Authentication is configured correctly from the HPDM Console before importing users and groups. See Configuring User Authentication. To configure the User Authentication using the FQDN, you must enter the full name in both the Domain and the Username fields, such as dc=magic,dc=com for the domain and cn=administrator,cn=users,dc=magic,dc=com for the user named Administrator in the Users folder. Verify that the LDAP server works by clicking the Test button during the User Authentication configuration. To log in to HDPM as an LDAP user, enter the short username, not the FQDN. For example, if the FQDN is cn=administrator,cn=users,dc=magic,dc=com, enter Administrator as the username. In the Server Address field, enter the HPDM Server address, not the LDAP server address. 8

9 If an HPDM inner user and an imported LDAP user share credentials, HPDM will default to the inner user. If a user or group is modified on the LDAP server, their information will not be updated in the HPDM Console until their next login. For example, if the imported LDAP user Administrator changes their password on the LDAP Server side, they must log in to the HPDM Console again for the new password to take effect. Multiple child domain users login If you have a main domain and multiple child domains, you can configure the domains trust each other. This enables all child domain users login into HPDM. Testing environment: Parent domain: Domain: hpdm.dto Host: hpdmdcsvr001.hpdm.dto Test User Account: cn=administrator, cn=users, dc=hpdm, dc=dto Child domain: Domain: subhpdm.dto User to Login HPDM: dmtest To log in to HPDM as user dmtest in child domain subhpdm.dto: 1. Configure the LDAP User Authentication with the parent domain specifications. In the testing environment, the specifications would be as follows: Host: hpdmdcsvr001.hpdm.dto Domain: hpdm.dto Username: administrator 9

10 2. Import the child domain user into HPDM. The tree path is restricted. In the testing environment, it is dc=hpdm, dc=dto. When you import the user from the LDAP server, the Base DN is already filled in. You can see users within the DN only. A. Change the Base DN to see users from other trusted domains, including the child domain. In the testing environment, the Base DN needs to be dc=subhpdm, dc=hpdm, dc=dto. B. Then, search for the user you want and import the user into HPDM. In the testing environment, that is user dmtest. 3. Log in to HPDM as the child domain user. LDPA child domain account testing Testing environment: Parent domain: Domain: 3ls.com IP: Test user account: jasons Child domain: Domain: sh.3ls.com IP: Test user account: jasonss Note The parent and child domains must trust each other. 10

11 11

12 Test case 1 Parent host: Child domain: sh.3ls.com Child domain account: jasonss Test result: Success Test case 2 Child host: Child domain: sh.3ls.com Child domain account: jasonss Testing result: Success 12

13 Test case 3 Child host Parent domain 3ls.com Parent domain account jasons Testing result: Fail Test case 4 Parent host Parent domain 3ls.com Parent domain account jasons Testing result: Success Conclusion: To use a child domain account to connect to the LDAP server, the account must belong to the child domain. Either the parent host or the child host can be used. To use a parent domain account to connect to the LDAP server, the account must belong to parent domain. Only the parent host can be used. 13

14 For more information To read more about LDAP, go to Sign up for updates hp.com/go/getupdated Copyright 2014 Hewlett-Packard Development Company, L.P. Microsoft and Windows are U.S. registered trademarks of the Microsoft group of companies. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. First Edition: March 2014