Configure LDAP user registries

 

+

Search Tips   |   Advanced Search

 

Overview

1. In the administrative console, click...

   Security | User Registries | LDAP

   

2. Enter a valid user name in the Server User ID field. You can either

   In the Server User ID field, enter the complete distinguished name (DN) of the user or the short name of the user as defined by the User Filter.

3. Enter the password of the user in the Server User Password field.

4. Select the type of LDAP server that is used from the Type list.

   The type of LDAP server determines the default filters that are used by the WAS. These default filters change the Type field to Custom, which indicates that custom filters are used. This action occurs after you click OK or Apply in the Advanced LDAP settings panel. Choose the Custom type from the list and modify the user and group filters to use other LDAP servers, if required.

   If either the IBM Directory Server or the iPlanet Directory Server is selected, also select the Ignore Case field.

5. Enter the fully qualified host name of the LDAP server in the Host field.

6. Enter the LDAP server port number in the Port field.

   The host name and the port number represent the realm for this LDAP server in the WAS cell. So, if servers in different cells are communicating with each other using LTPA tokens, these realms must match exactly in all the cells.

   If you are using single signon between a WAS v 5.0.x server and a WAS v 4.0.x appserver, specify an LDAP server port number in the administrative console by clicking Security > User registries > LDAP. You must set the LDAP ports numbers to the same numerical value because for WAS v 5.0.x the default value is 0 and for WAS v 4.0.x the default value for the port is not 0.

7. Enter the Base distinguished name (DN) in the Base Distinguished Name field.

   The Base DN indicates the starting point for searches in this LDAP directory server. For example, for a user with a DN of cn=John Doe, ou=Rochester, o=IBM, c=US, specify the Base DN as any of the following options (assuming a suffix of c=us): ou=Rochester, o=IBM, c=us or o=IBM c=us or c=us. This field can be case sensitive. Match the case in your directory server. This field is required for all LDAP directories except the Domino Directory. The Base DN field is optional for the Domino server.

8. Enter the Bind DN name in the Bind Distinguished Name field, if necessary.

   The Bind DN is required if anonymous binds are not possible on the LDAP server to obtain user and group information. If the LDAP server is set up to use anonymous binds, leave this field blank.

9. Enter the password corresponding to the Bind DN in the Bind password field, if necessary.

10. Modify the Search Time Out value if required.

    This timeout value is the maximum amount of time that the LDAP server waits to send a response to the product client before aborting the request. The default is 120 seconds.

11. Disable the Reuse Connection field only if you use routers to send requests to multiple LDAP servers, and if the routers do not support affinity.

    Leave this field enabled for all other situations.

12. Enable the Ignore Case flag, if required.

    When this flag is enabled, the authorization check is case insensitive. Normally, an authorization check involves checking the complete DN of a user, which is unique in the LDAP server and is case sensitive. However, when using either the IBM Directory Server or the iPlanet Directory Server LDAP servers, this flag needs enabling because the group information obtained from the LDAP servers is not consistent in case. This inconsistency only effects the authorization check.

13. Select SSL Enabled if the communication to the LDAP server is through SSL.

14. If SSL is enabled, select the appropriate SSL alias configuration from the list in the SSL configuration field.

15. Click OK.

    The validation of the user, password, and the setup do not take place in this panel. Validation is only done when you click OK or Apply in the Global Security panel. If you are enabling security for the first time, complete the remaining steps and go to the Global Security panel. Select LDAP as the Active User Registry. If security is already enabled, but information on this panel changes, go to the Global Security panel and click OK or Apply to validate your changes. If your changes are not validated, the server might not come up.

16. If you are enabling security, complete the remaining steps.

17. Validate this setup by clicking OK or Apply in the Global Security panel.

18. Save, stop, and restart all the product servers (deployment managers, nodes and Application Servers) for changes in this panel to take effect.

19. If the server comes up without any problems the setup is correct.

---

Local operating system user registries

Configuring LDAP search filters
Configuring Secure Sockets Layer for the LDAP client
Configuring global security

LDAP settings
LDAP advanced settings
Custom user registries

 

---