WAS v8.5 > Secure applications > Authenticate users > Use Microsoft Active Directory for authentication
Microsoft Active Directory Global Catalog
A Global Catalog is a Global Catalog Server. A Global Catalog holds a full set of attributes for the domain in which it resides and a subset of attributes for all objects in the Microsoft Active Directory Forest. The primary two functions of a Global Catalog within the Microsoft Active Directory are logon capability and Microsoft Active Directory queries.
A Global Catalog in a Microsoft Active Directory installation with the product is a single LDAP repository containing a subset of user information from all the domains in the forest. This information includes user IDs, authentication information, and groups, but not all the group information.
We can use the Global Catalog on any domain controller in the forest, even in subdomains. The Global Catalog is a solution to the WebSphere Application Server limitation of a "single registry". There are limitations to the Global Catalog. Users from the local domain controller contain group "memberOf" information. Users from a foreign domain controller contain limited "memberOf" information because the global group information is not replicated to every domain controller.
Nested global groups in universal groups
This is a typical structure of group membership and consists of the following characteristics:
- Users are distributed across domain controllers in a forest containing
multiple domain controllers.
- Users are defined in global groups within their own local domain controller.
- A universal group contains the global groups, which reflects a Java Platform Enterprise Edition (Java EE) role that maps to a set of users spread across multiple domain controllers.
The following figure illustrates nested global groups in universal groups.
Figure 1. Nested global groups in universal
groups . This figure illustrates nested global groups in universal groups.
It is a challenge to develop methods of configuring WAS to be able to find users and their group memberships when the information is spread across multiple domain controllers. One method requires that WAS follow LDAP referrals to find the home domain controller for each user and that WAS perform nested group queries.
This approach does not use the Global Catalog.
Another method and the simplest approach has universal groups containing users and uses a Global Catalog, which requires using referrals. The figure that follows illustrates this method.
Figure 2. Locating
group memberships. This figure illustrates the process of locating group memberships.
A variation on this method is to not use universal groups. We can use this approach when universal groups are not available.
This approach does not use the Global Catalog.
You might consider using the Microsoft Active Directory Global Catalog as the WAS registry. There are three scenarios; however, the first two scenarios demonstrate how failures occur.
- If you configure WAS to use Global Catalog as its LDAP registry and follow referrals, then individual users are visible in each domain controller. Because a user must exist only once in the registry, all logins fail.
- If you configure WAS to use Global Catalog as its LDAP registry and do not follow
referrals and the individual users are within global groups, then group membership is incomplete. See the following figure, which illustrates
this limitation.
Figure 3. Global catalog (without using referrals). An illustration of a Global Catalog without using referrals
- When you configure WAS to use Global Catalog as its LDAP registry, do not follow referrals, and users are directly contained within universal global groups, then group membership is complete.
When you select any of these scenarios, consult appropriate Microsoft Active Directory information to completely understand any implications the scenarios might have on your configuation planning.
Related concepts:
Groups spanning domains with Microsoft Active Directory
Authentication using Microsoft Active Directory
Options for finding group membership within a Microsoft Active Directory forest
Related
Use Microsoft Active Directory for authentication
Locating user group memberships in a LDAP registry
Authenticate users with LDAP registries in a Microsoft Active Directory forest