Configure Lightweight Directory Access Protocol user registries

Review the article on Lightweight Directory Access Protocol (LDAP) before beginning this task.

  1. In the administrative console, click Security > User Registries > LDAP in the left navigation panel.

  2. Enter a valid user name in the Server User ID field. You can either enter the complete distinguished name (DN) of the user or the short name of the user as defined by the User Filter in the Advanced LDAP settings panel. For example, enter the user ID for Netscape.

  3. Enter the password of the user in the Server User Password field.

  4. Select the type of LDAP server that is used from the Type list. The type of LDAP server determines the default filters that are used by the WAS. These default filters change the Type field to Custom, which indicates that custom filters are used. This action occurs after you click OK or Apply in the Advanced LDAP settings panel. Choose the Custom type from the list and modify the user and group filters to use other LDAP servers, if required. If either the IBM Directory Server or the iPlanet Directory Server is selected, also select the Ignore Case field.

  5. Enter the fully qualified host name of the LDAP server in the Host field.

  6. Enter the LDAP server port number in the Port field. The host name and the port number represent the realm for this LDAP server in the WAS cell. So, if servers in different cells are communicating with each other using Lightweight Third Party authentication (LTPA) tokens, these realms must match exactly in all the cells.

  7. Enter the Base distinguished name (DN) in the Base Distinguished Name field. The Base DN indicates the starting point for searches in this LDAP directory server. For example, for a user with a DN of cn=John Doe, ou=Rochester, o=IBM, c=US, specify the Base DN as any of the following options (assuming a suffix of c=us): ou=Rochester, o=IBM, c=us or o=IBM c=us or c=us. This field can be case sensitive. Match the case in your directory server. This field is required for all LDAP directories except the Domino Directory. The Base DN field is optional for the Domino server.

  8. Enter the Bind DN name in the Bind Distinguished Name field, if necessary. The Bind DN is required if anonymous binds are not possible on the LDAP server to obtain user and group information. If the LDAP server is set up to use anonymous binds, leave this field blank.

  9. Enter the password corresponding to the Bind DN in the Bind password field, if necessary.

  10. Modify the Search Time Out value if required. This timeout value is the maximum amount of time that the LDAP server waits to send a response to the product client before aborting the request. The default is 120 seconds.

  11. Disable the Reuse Connection field only if you use routers to send requests to multiple LDAP servers, and if the routers do not support affinity. Leave this field enabled for all other situations.

  12. Enable the Ignore Case flag, if required. When this flag is enabled, the authorization check is case insensitive. Normally, an authorization check involves checking the complete DN of a user, which is unique in the LDAP server and is case sensitive. However, when using either the IBM Directory Server or the iPlanet Directory Server LDAP servers, this flag needs enabling because the group information obtained from the LDAP servers is not consistent in case. This inconsistency only effects the authorization check.

  13. Enable SSL if the communication to the LDAP server is through SSL. For more information on setting up LDAP for SSL, refer to Configuring SSL for LDAP clients.

  14. If SSL is enabled, select the appropriate SSL alias configuration from the list in the SSL configuration field.

  15. Click OK.The validation of the user, password, and the setup do not take place in this panel. Validation is only done when you click OK or Apply in the Global Security panel. If you are enabling security for the first time, complete the remaining steps and go to the Global Security panel. Select LDAP as the Active User Registry. If security is already enabled, but information on this panel changes, go to the Global Security panel and click OK or Apply to validate your changes. If your changes are not validated, the server might not come up.

Sets the LDAP registry configuration.

 

Usage Scenario

  1. If you are enabling security, complete the remaining steps. As the final step, validate this setup by clicking OK or Apply in the Global Security panel.

  2. Save, stop, and restart all the product servers (cell, nodes and all the appservers) for changes in this panel to take effect.

  3. If the server comes up without any problems the setup is correct.

 

See Also

Local operating system user registries
Configuring SSL for the Lightweight Directory Access Protocol client
Configuring global security
Custom user registries