Configure Lightweight Directory Access Protocol user registries
Before you beginReview the article on Lightweight Directory Access Protocol before beginning this task.
- In the administrative console, click...Security | Global security | User registries | LDAP
- Enter a valid user name in the Server user ID field.
You can either enter the complete distinguished name (DN) of the user or the short name of the user as defined by the User Filter in the Advanced LDAP settings panel.
- Enter the password of the user in the Server user password field.
- Select the type of LDAP server that is used from the Type list.
The type of LDAP server determines the default filters that are used by the WebSphere Application Server. These default filters change the Type field to Custom, which indicates that custom filters are used. This action occurs after you click OK or Apply in the Advanced LDAP settings panel. Choose the Custom type from the list and modify the user and group filters to use other LDAP servers, if required.
If either the IBM Directory Server or the iPlanet Directory Server is selected, also select the Ignore Case field.
- Enter the fully qualified host name of the LDAP server in the Host field.
- Enter the LDAP server port number in the Port field.
The host name and the port number represent the realm for this LDAP server in the WAS cell. So, if servers in different cells are communicating with each other using LTPA tokens, these realms must match exactly in all the cells.
- Enter the Base distinguished name (DN) in the Base distinguished name field.
The Base DN indicates the starting point for searches in this LDAP directory server. For example, for a user with a DN of...cn=John Doe, ou=Rochester, o=IBM, c=US
...specify the Base DN as any of the following options (assuming a suffix of c=us):...ou=Rochester, o=IBM, c=us
...or...o=IBM c=us or c=us
This field can be case sensitive. Match the case in your directory server. This field is required for all LDAP directories except the Domino Directory. The Base DN field is optional for the Domino server.
- Enter the Bind DN name in the Bind distinguished name field, if necessary.
The Bind DN is required if anonymous binds are not possible on the LDAP server to obtain user and group information. If the LDAP server is set up to use anonymous binds, leave this field blank.
- Enter the password corresponding to the Bind DN in the Bind password field, if necessary.
- Modify the Search time out value if required.
This timeout value is the maximum amount of time that the LDAP server waits to send a response to the product client before aborting the request. The default is 120 seconds.
- Deselect the Reuse connection option only if you use routers to send requests to multiple LDAP servers, and if the routers do not support affinity. Leave this field enabled for all other situations.
- Select the Ignore case for authorization option, if required.
When this flag is enabled, the authorization check is case insensitive. Normally, an authorization check involves checking the complete DN of a user, which is unique in the LDAP server and is case sensitive. However, when using either the IBM Directory Server or the iPlanet Directory Server LDAP servers, this flag needs enabling because the group information obtained from the LDAP servers is not consistent in case. This inconsistency only effects the authorization check.
- Enable SSL if the communication to the LDAP server is through SSL.
- Select the SSL enabled option if you want to use secure sockets layer communications with the LDAP server. If you select the SSL enabled option, select the appropriate SSL alias configuration from the list in the SSL configuration field.
- Click OK.
The validation of the user, password, and the setup do not take place in this panel. Validation is only done when you click OK or Apply in the Global Security panel. If you are enabling security for the first time, complete the remaining steps and go to the Global Security panel. Select LDAP as the active user registry. If security is already enabled, but information on this panel changes, go to the Global Security panel and click OK or Apply to validate your changes. If your changes are not validated, the server might not come up.
Sets the LDAP registry configuration. This step is required to set up the LDAP registry. This step is required as part of enabling security in the WebSphere Application Server.
What to do next
- If you are enabling security, complete the remaining steps. As the final step, validate this setup by clicking OK or Apply in the Global Security panel.
- Save, stop, and restart all the product servers (deployment managers, nodes and Application Servers) for changes in this panel to take effect.
- If the server comes up without any problems the setup is correct.
See alsoLightweight Directory Access Protocol settings
Advanced LDAP user registry settings
See AlsoLocal operating system user registries
Related TasksConfigure LDAP search filters
Configure Secure Sockets Layer for the LDAP client
Configuring global security
See AlsoCustom user registries
WebSphere is a trademark of the IBM Corporation in the United States, other countries, or both.
IBM is a trademark of the IBM Corporation in the United States, other countries, or both.