Configure Lightweight Directory Access Protocol user registries

 

Review the article on Lightweight Directory Access Protocol before beginning this task.

 

  1. In the administrative console, click Security > User Registries > LDAP in the left navigation panel.

  2. Enter a valid user name in the Server User ID field. You can either enter the complete distinguished name (DN) of the user or the short name of the user as defined by the User Filter in the Advanced LDAP settings panel. For example, for Netscape enter the user ID.

  3. Enter the password of the user in the Server User Password field.

  4. Select the type of LDAP server that is used from the Type list. The type of LDAP server determines the default filters that are used by the WebSphere Application Server. When these default filters change the Type field changes to Custom, which indicates that custom filters are used. This action occurs once you click OK or Apply in the Advanced LDAP settings panel. Choose the Custom type from the list and modify the user and group filters to use other LDAP servers, if required. If either the IBM Directory Server or iPlanet Directory Server is selected, also select the Ignore Case field.

  5. Enter the fully qualified host name of the LDAP server in the Host field.

  6. Enter the LDAP server port number in the Port field. The host name along with the port number, represent the realm for this LDAP server in the WebSphere Application Server cell. So, if servers in different cells are communicating with each other using Lightweight Third Party Authentication (LTPA) tokens, these realms must match exactly in all the cells.

  7. Enter the Base distinguished name (DN) in the Base Distinguished Name field. The Base DN indicates the starting point for searches in this LDAP directory server. For example, for a user with a DN of cn=John Doe, ou=Rochester, o=IBM, c=US, specify the Base DN as any of (assuming a suffix of c=us): ou=Rochester, o=IBM, c=us or o=IBM c=us or c=us. This field can be case sensitive, and it is recommended that they match the case in your directory server. This field is required for all LDAP directories except the Domino Directory. The Base DN field is optional for the Domino server.

  8. Enter the Bind DN name in the Bind Distinguished Name field, if necessary. The Bind DN is required if anonymous binds are not possible on the LDAP server to obtain user and group information. If the LDAP server is set up to use anonymous binds, leave this field blank.

  9. Enter the password corresponding to the Bind DN in the Bind password field, if necessary.

  10. Modify the Search Time Out value if required. This timeout value is the maximum amount of time the LDAP server waits to send a response to the product client before aborting the request. The default is 120 seconds.

  11. Disable the Reuse Connection field only if you use routers to spray requests to multiple LDAP servers, and if the routers do not support affinity. Leave this field enabled for all other situations.

  12. Enable the Ignore Case flag, if required. When this is enabled, the authorization check is case insensitive. Normally, an authorization check involves checking the complete DN of a user, which is unique in the LDAP server and is case sensitive. However, when using either the IBM Directory Server or the iPlanet Directory Server LDAP servers, this flag needs enabling because the group information obtained from the LDAP servers is not consistent in case. This inconsistency only effects the authorization check.

  13. Enable Single Sockets Layer if the communication to the LDAP server is through SSL. For more information on setting up LDAP for SSL, refer to Configure SSL for LDAP clients.

  14. If SSL is enabled, select the appropriate SSL alias configuration from the list in the SSL configuration field.

  15. Click OK. The validation of the user, password, and the setup do not take place in this panel. Validation is only done when you click OK or Apply in the Global Security panel. If you are enabling security for the first time, complete the remaining steps and go to the Global Security panel. Select LDAP as the Active User Registry. If security is already enabled, but information on this panel changes, go to the Global Security panel and click OK or Apply to validate your changes. If your changes are not validated, the server might not come up.

 

Results

Sets the LDAP registry configuration.

 

Usage scenario

This step is required to set up the LDAP registry. This step is required as part of enabling security in the WebSphere Application Server.

 

What to do next

  1. If you are enabling security, complete the remaining steps. As the final step, validate this setup by clicking OK or Apply in the Global Security panel.

  2. For changes in this panel to take effect, save, stop and restart all the product servers (cell, nodes and all the appservers).

  3. If the server comes up without any problems the setup is correct.

Local operating system user registries
Configure secure sockets layer for the lightweight directory access protocol client
Configure global security
Custom user registries

 

WebSphere is a trademark of the IBM Corporation in the United States, other countries, or both.

 

IBM is a trademark of the IBM Corporation in the United States, other countries, or both.