Enterprise Knowledge Platform 5.6

Transcription

1 Enterprise Knowledge Platform 5.6 LDAP Authentication Integration Configuration Guide

2 Document Information Document ID: EN151 Document title: EKP LDAP Authentication Integration Configuration Guide Version: 1.2 Document date: 15 April 2009 This document may be revised from time to time. Please check NetDimensions Support site at for updates to this and other documents or send an to to request the most recent version. Please report any errors or feedback with this document by sending an to Copyright Information Copyright by NetDimensions Ltd. All Rights Reserved. Information in this document is subject to change without notice. The software described herein is furnished under a license agreement, and it may be copied only in accordance with the terms of that agreement. No part of this publication may be reproduced, transmitted, or translated in any form or by any means without the prior written permission of NetDimensions Ltd. All company and product names used herein may be trademarks or registered trademarks of their respective companies unless stated otherwise. How to Contact NetDimensions Support US toll-free number [email protected] General Enquiries [email protected]

3 Table of Contents Description...1 About This Guide... 1 If You Need Help... 1 EKP Configuration...2 Troubleshooting...4 Additional Resources...9 Lightweight Directory Access Protocol Version Open Group and the Directory Interoperability Forum... 9

4 Description About This Guide This document describes the steps required in configuring EKP to use Lightweight Directory Access Protocol (LDAP) to perform user authentication. EKP has a built-in login adapter that integrates with the LDAP server to perform user login authentication. It is implemented by using the Netscape Directory SDK 4.1 that supports both LDAP version 2 and version 3. If You Need Help If you cannot resolve a configuration problem using this guide or the online help, or if you should have any queries related to the technology employed within EKP, your first line of contact should be as described in your Technical Support Contract. For other queries, or if you are not sure whom to contact, NetDimensions Ltd. may be contacted at [email protected]. Please also refer to the support section of the NetDimensions web site at for the latest information regarding various services. 1

5 EKP Configuration 1. Enable the LDAP interface in EKP by editing the ekp.properties which is located in the <webapps>/ekp/web-inf/conf folder. See the following example, default.ldap_dir=o=netdimensions.com default.ldap_host1=corp-ldap1 default.ldap_port1=389 default.ldap_host2=corp-ldap2 default.ldap_port2=389 default.ldap_host3=corp-ldap3 default.ldap_port3=389 default.ldap_timeout=300 default.ldap_dir (mandatory) default.ldap_host1 (mandatory) default.ldap_port1 (mandatory) default.ldap_host2 (mandatory) default.ldap_port2 (mandatory) default.ldap_host3 (mandatory) default.ldap_port3 (mandatory) default.ldap_timeout (mandatory) default.ldap_filter (optional) Defines the base distinguished name from which it starts the search Defines the primary LDAP server (enter hostname or IP address) Define the port number of the LDAP server Defines the second backup LDAP server (enter hostname or IP address) Define the port number of the second backup LDAP server Defines the third backup LDAP server (enter hostname or IP address) Define the port number of the third backup LDAP server Specifies the timeout period in seconds before switching to use the next backup LDAP server. Additional search filter to locate a user entry. (Note: default is search by uid only) Note If there is no backup LDAP server, you need to set the backup LDAP server same as the primary one. 2. Configure the users to use external authentication Logon EKP as administrator, go to Manage > User Manager > User Editor. Set External Authentication to Yes for users who want to use LDAP authentication. 2

6 Note In order to do the above, the users have to be created in EKP beforehand and the User ID has to match with the uid in the LDAP. Users with External Authentication set to No will be using default internal authentication, which means that their password is stored in the EKP database. 3

7 Troubleshooting LDAP Authentication Configure EKP.PROPERTIES default.ldap_dir Defines the base distinguished name from which it starts the search must match the domain components specified in the DN string. default.ldap_dir=dc=netdimensions,dc=com default.ldap_host# Defines the LDAP server. Can be hostname, IP or DNS name default.ldap_host1=win2003-svr would be win2003-svr with the domain name Netdimensions.com default.ldap_host1= ldap.activedirectorydn specifies the name of the user for initial EKP binding to the AD, so that directory searches can be done later. The DN Distinguished Name string will be determined by how your LDAP is configured. You can use ADSI Edit on your AD servers to view the format of the DN value assigned to this user ekp so you would need to specify the same parameters. ldap.activedirectorydn=cn=ekp,cn=users,dc=netdimensions,dc=com In larger organizations It could be be more complex with multiple OUs for Organizational Units ldap.activedirectorydn=cn=ekp,ou=it,ou=users,ou=hongkong,dc=hongkong,dc=netdimension, DC=com ldap.activedirectorypassword specifies the password of the user Note: ekp is the name of the user created in the previous section and ekp_password is the password of user ekp. default.ldap_dir=dc=hongkong,dc=netdimensions,dc=com default.ldap_host1= default.ldap_port1=389 default.ldap_host2= default.ldap_port2=389 default.ldap_host3= default.ldap_port3=389 default.ldap_timeout=300 # Define the active directory DN and password for initial binding. ldap.activedirectorydn=cn=ekp,ou=it,ou=users,ou=hongkong,dc=hongkong,dc=netdimensions, DC=com ldap.activedirectorypassword= ekp_password 4

8 Using LDAP Tools To Query Your LDAP Servers Ensure you are able to connect to your LDAP servers on your specified port by telneting to it. telnet should open a connection if it does not then its likley the firewall is preventing you from doing so. Add rule between your server & the LDAP server for that port and try again. You can verify that your LDAP parameters are correct by using LDAP tools to query your LDAP servers with your parameters & password. ldp.exe from Install on your ekp server and use your parameters to check if you can communicate with your listed LDAP servers. LDP.EXE to " ", 389 binding to user ekp with password ekp_password DN=CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=hongkong,DC=netdimension,DC=com Sample Output of Successful Query & Binding of User ekp to " ", 389 ld = ldap_open(" ", 389); Established connection to Retrieving base DSA information... Result <0>: (null) Matched DNs: Getting 1 entries: >> Dn: 1> currenttime: 08/12/ :50:21 Central Standard Time Central Daylight Time; 1> subschemasubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=netdimensions,DC=com; 1> dsservicename: CN=NTDS Settings,CN=NTDCHONGKONG1,CN=Servers,CN=HongKong,CN=Sites,CN=Configuration,DC=netdim ensions,dc=com; 3> namingcontexts: CN=Configuration,DC=netdimensions,DC=com; CN=Schema,CN=Configuration,DC=netdimensions,DC=com; DC=hongkong,DC=netdimensions,DC=com; 23> supportedcontrol... 2> supportedldapversion: 3; 2; 12> supportedldappolicies: MaxPoolThreads; MaxDatagramRecv; MaxReceiveBuffer; InitRecvTimeout; MaxConnections; MaxConnIdleTime; MaxPageSize; MaxQueryDuration; MaxTempTableSize; MaxResultSetSize; MaxNotificationPerConn; MaxValRange;. 1> dnshostname: ntdchongkong1.hongkong.netdimensions.com; 5

9 1> ldapservicename: 1> servername: CN=NTDCHONGKONG1,CN=Servers,CN=HongKong,CN=Sites,CN=Configuration,DC=netdimensions, DC=com; 3> supportedcapabilities: ; ; ; 1> issynchronized: TRUE; 1> isglobalcatalogready: TRUE; 1> domainfunctionality: 0 = ( DS_BEHAVIOR_WIN2000 ); 1> forestfunctionality: 0 = ( DS_BEHAVIOR_WIN2000 ); 1> domaincontrollerfunctionality: 2 = ( DS_BEHAVIOR_WIN2003 ); res = ldap_bind_s(ld, NULL, &NtAuthIdentity, 1158); // v.3 {NtAuthIdentity: User='ekp'; Pwd= <unavailable>; domain = 'DN=CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=hongkong,DC=netdimensions,DC=com'.} Authenticated as dn:'ekp'. This confirms that the parameters for that particular LDAP server will work and you can do same test for each of your LDAP servers. If the query to the LDAP servers fail, check your parameters and check you have enabled your firewall to communicate on the specified ports. LDP.EXE returns same Error<0x51>: Fail to connect message when I query the wrong server or wrong port. ld = ldap_open(" ", 389); Error <0x51>: Fail to connect to ld = ldap_open(" ", 355); Error <0x51>: Fail to connect to If you get initial LDAP query info but then Error <49>: ldap_bind_s() failed: Invalid Credentials. it means the LDAP Server parameters were successful but the bind to user and/or password failed. res = ldap_simple_bind_s(ld, 'ekp', <unavailable>); // v.3 Authenticated as dn:'ekp'. res = ldap_bind_s(ld, NULL, &NtAuthIdentity, 1158); // v.3 {NtAuthIdentity: User='ekp'; Pwd= <unavailable>; domain = 'DN=CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=HongKong,DC=netdimensions,DC=com'.} Error <49>: ldap_bind_s() failed: Invalid Credentials. Server error: C: LdapErr: DSID-0C09043E, comment: AcceptSecurityContext error, data 0, vece Once you have verified your LDAP connection and parameters with successful authentication using LDAP tools you can proceed to attempt log in on your ekp server. 6

10 On the ekp site logging in with user ekp and check the ekp.log for any errors. You should have ekp set up in debug mode. Sample EKP.LOG - user ekp logs in after successful authentication with LDAP server Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connecting to LDAP server at :389 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connected OK Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Authenticating to LDAP server as: 'CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=HongKong,DC=netdimensions,DC=com'; password: '*********' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Authenticated OK Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): about to search Active Directory server for user: 'ekp' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): base: 'dc=hongkong,dc=netdimensions,dc=com' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): filter: '(&( (objectclass=user)(objectclass=person))( (cn=ekp)(samaccountname=ekp)))' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Search returned normally with 2 results Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): results.hasmoreelements: true Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticateEntry): LDAP DN(basic): CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=HongKong,DC=netdimensions,DC=com Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connecting to LDAP server at :389 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connected OK 2009/Aug/12 23:04:42 Severity(DEBUG) Source(com.netdimen.jdbc.core.JdbcTemplate.logSql): executing sql [SELECT * FROM userstats WHERE userid =?] for arguments ('ekp') 2009/Aug/12 23:04:42 Severity(DEBUG) Source(com.netdimen.jdbc.core.JdbcTemplate.logSql): executing sql [SELECT COUNT(*) FROM messages WHERE readindicator = 'N' AND userid =?] for arguments ('ekp') 7

11 EKP.LOG showing LDAP Authentication Failed Use LDAP tools to verify your parameters. 2009/Aug/12 09:23:16 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connecting to LDAP server at : /Aug/12 09:23:16 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.connect): Connected OK 2009/Aug/12 09:23:16 Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Authenticating to LDAP server as: 'CN=ekp,OU=IT,OU=Users,OU=HongKong,DC=HongKong,DC=netdimensions,DC=com'; password: '*********' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Authenticated OK Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): about to search Active Directory server for user: 'ekp' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): base: 'dc=hongkong.netdimensions.com' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): filter: '(&( (objectclass=user)(objectclass=person))( (cn=ekp)(samaccountname=ekp)))' Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): Search returned normally with 1 results Severity(DEBUG) Source(com.netdimen.ldap.LdapServer.authenticate): results.hasmoreelements: true Severity(DEBUG) Source(com.netdimen.auth.login.LDAPLoginAdapter.authenticate): LDAP server 1 authentication failed com.netdimen.auth.login.generalauthenticationexception at com.netdimen.ldap.ldapserver.authenticate(ldapserver.java:255) at com.netdimen.auth.login.ldaploginadapter.authenticate(ldaploginadapter.java:50) 8

12 Additional Resources See the following resources for further information: Lightweight Directory Access Protocol Version 3 The IETF LDAPv3 Working Group: The LDAPv3 Working Group archived newsgroup: RFC 3377, the current definition of LDAPv3: ftp://ftp.rfc-editor.org/in-notes/rfc3377.txt Open Group and the Directory Interoperability Forum The Open Group s VSLDAP compliance testing suite overview: The Directory Interoperability Forum (DIF): 9