HP Device Manager 4.7

Transcription

1 Technical white paper HP Device Manager 4.7 LDAP Troubleshooting Guide Table of contents Introduction... 2 HPDM LDAP-related context and background... 2 LDAP in HPDM... 2 Full domain account name login... 4 Multiple trusted domains login... 5 Environment... 5 Parent domain... 5 Child domain... 6 HPDM Server... 6 DNS Server... 6 Multiple trusted domains support... 8 User authentication with hpdm.com... 8 Support HPDM login of test.hpdm.com... 8 Universal group login LDAP subgroup login Troubleshooting steps General configuration For more information... 15

2 Introduction The purpose of this document is to demonstrate the principle of Lightweight Directory Access Protocol (LDAP) used in HP Device Manager (HPDM), some common scenarios, and how to troubleshoot issues that might occur while attempting to use user authentication with Active Directory and other LDAP servers. HPDM LDAP-related context and background Users and groups in an Active Directory, or a different LDAP server, can be used to log in to HPDM. This allows the reuse of existing login accounts and simplifies the management of administrative privileges with HPDM. For more background information, see the HP Device Manager 4.7 Administrator Guide. LDAP in HPDM Figure 1. HPDM network with an LDAP server HPDM Server stores the LDAP Server Configuration and imported User/Group information LDAP Server HPDM Console Router Router Trust HPDM Server HPDM Console LDAP Server LDAP Server is responsible for Authentication of LDAP user from HPDM Server The LDAP server configuration information, including User Authentication, needs to be set in HPDM (see Configuring User Authentication). HPDM will use the configuration information to connect to the specified LDAP server. The LDAP users and groups need to be imported into HPDM (see Importing a user or group from LDAP). The LDAP server configuration and basic imported user and group information is stored in the database of HPDM. HPDM does not store the LDAP user s password. (It is only transported to the LDAP server when the user logs in to HPDM.) After the import is completed, you can log in to HPDM as an LDAP user or group. HPDM supports logging in using a full domain account name such as domain\account. HPDM supports multiple trusted domains. HPDM supports a universal group. HPDM supports subgroups. For HPDM inner users, HPDM authenticates by itself. When you use an LDAP account to log in to HPDM, the LDAP server is responsible for authentication and returns the result to HPDM (see Logging in as an LDAP user). The following chart is the basic flow of logging in to HPDM as an LDAP user. 2

3 Figure 2. Logging in to HPDM as an LDAP user flow chart Log in HPDM with LDAP user HPDM Console HPDM Server LDAP Server Start Console Input LDAP domain account and password Click OK button Check if the account is contained in HPDM inner account list No Check if the account is LDAP user in HPDM No Check if account belongs to a LDAP group Yes Yes Verify account password from HPDM Server Yes Verify account password from LDAP Server Yes Legal account and password Legal account and password Show Main Frame Yes End No Show error dialog No No End 3

4 Full domain account name login HPDM supports full domain account name login, which prevents the issue of duplicate accounts logging in. To log in to HPDM with a domain account: 1. In the Username field, enter a username in the format [DomainName\]Username. Note Move the pointer to the username field to see a tooltip that displays the proper format. 2. In the HPDM Console, verify that the title of the window shows the full domain account name. 4

5 3. In the User Management dialog and Group Properties dialog, verify that the accounts under Users are displayed in the new username format. Multiple trusted domains login If you have parent domain and multiple trusted child domains, you can log in to HPDM with different child domain accounts by configuring a single parent domain to use for user authentication. Environment Parent domain Domain: hpdm.com Host: User Authentication Account: CN=Administrator,CN=Users,DC=hpdm,DC=com 5

6 Child domain Domain: test.hpdm.com Host: User Authentication Account: CN=Administrator,CN=Users,DC=test,DC=hpdm,DC=com Imported user: CN=tester,CN=Users,DC=test,DC=hpdm,DC=com HPDM Server Host: DNS Server You must set up a DNS Server strategy so that the HPDM Server can communicate with both the parent and child domain servers using the domain name. 1. If the parent domain and child domain use the same DNS Server, the DNS of the HPDM Server needs to point to this DNS Server. 2. If the parent domain and child domain use different DNS Servers, be sure the Forwarders of both the parent domain and child domain DNS Server point to each other. Then, then make the DNS of HPDM Server point to the DNS Server of the parent domain. To make the Forwarders of the parent domain and child domain point to each other: A. In the DNS Server of the parent domain, select the Forwarders tab and then select Edit. Enter the IP address of the DNS Server of the child domain. 6

7 B. In the DNS Server of the child domain, select the Forwarders tab and then select Edit. Enter the IP address of the DNS Server of the parent domain. To verify that the DNS Server strategy is correctly configured, enter either ping hpdm.com or ping test.hpdm.com on the command line. 7

8 Multiple trusted domains support User authentication with hpdm.com To log in to HPDM with a child domain account using parent user authentication: 1. Go to HPDM Console > Tools > Configurations > User authentication. 2. Under User Authentication, use the user account for hpdm.com. Note If you use SSL encryption in LDAP authentication, be sure to get a key from the parent domain and any other trusted domains (that you want to use to log in to HPDM). To get a key: A. In the Host field, enter the IP or hostname of the domain. B. Select Get Key From Host. C. Repeat steps A and B for each trusted domain that you want to use. If you select None under encryption, do nothing. Support HPDM login of test.hpdm.com 1. In the HPDM Console, select Tools > User Management > Import from LDAP. 2. On the Search tab, enter DC=test,DC=hpdm,DC=com in the Base DN field. 3. In the Query field, select cn, =, and t1. 4. Select Search to find this user in the domain DC=test,DC=hpdm,DC=com. Note You can refine the UI by setting CN as the selected item. 8

9 5. Select Add to import this user account into HPDM. 6. Log in to HPDM using this test\t1 account. It can log in to HPDM successfully. 9

10 Universal group login A universal group is a group that can contain accounts from the current domain and other trusted domains. The advantage of using a universal group is that you can import the group into HPDM. You only need to add accounts from different domains into it. To import a universal group: This example uses a universal group in the domain hpdm.com that contains two accounts. jasons is an account in the domain hpdm.com. t2 is an account in the domain test.hpdm.com. 1. In the HPDM Console, select Tools > User Management > Import from LDAP. 2. Select this universal group and then select Import. 10

11 3. To verify that the universal group has been imported, log in to HPDM as both jasons (from hpdm.com) and t2 (from test.hpdm.com). Note To support multiple domains, the following conditions must be met: The DNS server of each server should work well, which means that the HPDM Server and each domain server can reach each other by domain name. All domains must trust each other so that they all have the right to communicate with each other. HPDM must support multiple domains when it is supporting universal group login. LDAP subgroup login HPDM supports the login of each user of LDAP subgroup. Consider the following LDAP server: Group: G1 It contains group G2. It contains user account t1. Group: G2, It contains user account t2 If you import user group G1 into HPDM, user accounts t1 and t2 can both log in to HPDM. To import an LDAP subgroup: 1. Under Groups to Import, select the group name. 11

12 2. In the User Management dialog, select Groups > Edit and verify that t1 and t2 are both listed under Users. 3. Verify that the group has imported correctly by logging in to HPDM as both t1 and t2. 12

13 Troubleshooting steps General configuration Make sure that the network between the HPDM Server and the LDAP server is working and that the HPDM Server can access the LDAP server. Verify using the ping command. The following example uses as the LDAP server address. Make sure that the LDAP server firewall does not block the port. Verify using the telnet command. The following example uses the default port,

14 Make sure that the LDAP User Authentication is configured correctly from the HPDM Console before importing users and groups. See Configuring User Authentication. To configure the User Authentication using the FQDN, you must enter the full name in both the Domain and the Username fields, such as dc=magic,dc=com for the domain and cn=administrator,cn=users,dc=magic,dc=com for the user named Administrator in the Users folder. Verify that the LDAP server works by clicking the Test button during the User Authentication configuration. To log in to HDPM as an LDAP user, enter the short username, not the FQDN. For example, if the FQDN is cn=administrator,cn=users,dc=magic,dc=com, enter Administrator as the username. In the Server Address field, enter the HPDM Server address, not the LDAP server address. If an HPDM inner user and an imported LDAP user share credentials, HPDM will default to the inner user. If a user or group is modified on the LDAP server, their information will not be updated in the HPDM Console until their next login. For example, if the imported LDAP user Administrator changes their password on the LDAP Server side, they must log in to the HPDM Console again for the new password to take effect. 14

15 For more information To read more about LDAP, go to Sign up for updates hp.com/go/getupdated Copyright 2015 HP Development Company, L.P. ARM is a registered trademark of ARM Limited. Java is a registered trademark of Oracle and/or its affiliates. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Microsoft, Windows, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Pentium is a trademark of Intel Corporation in the U.S. and other countries. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. First Edition: October 2015