Manually configure an LDAP repository in a federated repository configuration

As a prerequisite, add an LDAP repository to the WebSphere Application Server configuration, where we define the following information:

Item Name	Example
Repository identifier	ldaprepo1
Directory type	IBM Security Directory Server
Primary host name	localhost
Port	389
Bind distinguished name	cn=ldapadmin
Bind password	yourpwd
Login properties	uid (a property containing login information)

See LDAP repository configuration settings for the specific steps we must perform to establish this LDAP repository.

At this point, we have a valid LDAP repository ready to be manually configured in a federated repository configuration.

Tasks

1. Map the federated repository entity types to the LDAP object classes.

   1. Configure the LDAP repository to match the used LDAP object class for users.

      1. In the administrative console, click...
         Security > Global security > User account repository > Available realm definitions > Federated repositories > Configure

         To configure for a specific domain in a multiple security domain environment, click...

         Security domains > domain_name > Security Attributes > User Realm > Customize for this domain > Realm type > Federated repositories Configure

      2. Under Related items, click Manage repositories.

      3. Select the repository (for example, ldaprepo1).

      4. Click LDAP entity types.

      5. Click PersonAccount.
      6. Insert the objectclass name used in our LDAP server, for example, inetOrgPerson.

      7. Click Apply.

      8. Click Save.

      See LDAP for a description of the LDAP default mappings.

   2. Configure the LDAP repository to match the used LDAP objectclass for groups

      1. In the administrative console, click...
         Security > Global security > User account repository > Available realm definitions > Federated repositories Configure

         To configure for a specific domain in a multiple security domain environment, click...

         Security domains > domain_name > Security Attributes > User Realm > Customize for this domain > Realm type > Federated repositories > Configure

      2. Under Related items, click Manage repositories.

      3. Select ldaprepo1.

      4. Click LDAP entity types.

      5. Click Group.
      6. Insert the objectclass name used for our LDAP server, for example, groupOfUniqueNames.

      7. Click Apply.

      8. Click Save.

      See Group attribute definition settings for an explanation of group attribute definitions.

2. Map the federated repository property names to the LDAP attribute names.

   1. Configure the supported LDAP repository attributes.

      1. In the administrative console, click...
         Security > Global security User account repository > Available realm definitions > Federated repositories > Configure

         To configure for a specific domain in a multiple security domain environment, click...

         Security domains > domain_name > Security Attributes > User Realm > Customize for this domain > Realm type > Federated repositories > Configure

      2. Under Related items, click Manage repositories > repository_ID, and then, under Additional properties, click the LDAP attributes link.

      3. If the attribute mapping exists, first delete the existing mapping for the LDAP attribute, and then add a new mapping for the attribute. Select the checkbox next to the LDAP attribute name and click Delete.

      4. To add an attribute mapping, click Add, and select Supported.

      5. Enter the LDAP attribute name in the Name field, the federated repositories property name in the Property name field, and the entity type which applies the attribute mapping in the Entity types field.

      For all given federated repository properties, a one-to-one mapping is assumed. If no explicit mapping of the given type is defined, for example the federated repository property departmentNumber, the underlying LDAP attribute name, departmentNumber is assumed. See Configure LDAP attributes in a federated repository configuration for more information.

   2. Configure the unsupported properties of the federated repository. To indicate that a given federated repository property, such as departmentNumber is not supported by any LDAP attributes, define an unsupported property.

      1. On the LDAP attributes panel, click Add, and select Unsupported from the drop-down menu.

      2. Enter the federated repositories property name in the Property name field, and the entity type in the Entity types field.

      3. Click Apply and then Save.

   3. Configure the LDAP repository to match the used LDAP attributes for a user.

      1. Edit the file...
         {WAS_HOME}\profiles\{profileName}\config\cells\{cellName}\wim\config\wimconfig.xml

      2. Look for the section in this file containing the LDAP repository configuration, For example,
         <config:repositories xsi:type="config:LdapRepositoryType" adapterClassName="com.ibm.ws.wim.adapter.ldap.LdapAda pter" id="ldaprepo1" ...>
         <config:attributeConfiguration>
         ...
         <config:attributes name="anLDAPattribute" propertyName="aVMMattribute"/>
         ...
         <config:attributeConfiguration>

      3. Add an element of type config:attributes to define the mapping between a given federated depository property name, such as departmentNumber, to a desired LDAP attribute name, such as warehouseSection.

         For all given federated depository properties, a one-to-one mapping is assumed. If no explicit mapping of the given type is defined, for example the federated repository property departmentNumber, the underlying LDAP attribute name, departmentNumber is assumed.

   4. Configure the unsupported properties of the federated repository.

      To indicate that a given federated repository property, such as departmentNumber is not supported by any LDAP attributes, define the following type of element:

      <config:repositories xsi:type="config:LdapRepositoryType" adapterClassName="com.ibm.ws.wim.adapter.ldap.LdapAdapter" id="ldaprepo1" ...>
      <config:attributeConfiguration>
      ...
      <config:propertiesNotSupported name=" departmentNumber"/>
      ...
      <config:attributeConfiguration>

   5. Configure the LDAP repository to match the used LDAP user membership attribute in the groups.

      1. In the administrative console, click Security > Global security.

      2. Under User account repository, select Federated repositories from the Available realm definitions field and click Configure.

         To configure for a specific domain in a multiple security domain environment, click Security domains > domain_name. Under Security Attributes, expand User Realm, and click Customize for this domain. Select the Realm type as Federated repositories and then click Configure.

      3. Under Related items, click Manage repositories.

      4. Select ldaprepo1

      5. Click Group attribute defintions.

      6. Click Member attributes.

      7. Check if the LDAP attributes (for example, uniqueMember) is specified for our LDAP objectclass (for example, groupOfUniqueNames).

         • If not specified, click New and add the pair (objectclass / member attribute name) that applies to the LDAP schema (for example, uniqueMember / groupOfUniqueNames

         • If specified, proceed.

      8. Click Apply.

      9. Click Save.

3. Map other LDAP settings by configuring a new base entry for the new LDAP repository.

   1. In the administrative console, click...
      Security > Global security > User account repository > Available realm definitions > Federated repositories Configure

      To configure for a specific domain in a multiple security domain environment, click...

      Security domains > domain_name > Security Attributes > User Realm > Customize for this domain > Realm type > Federated repositories Configure

   2. Click Add Base Entry to Realm.

   3. Select ldaprepo1.

   4. Specifiy:

      • The base entry within the federated repository realm, for example, o=Default Organization
      • The base entry within the LDAP repository, for example, o=Default Organization

   5. Click Apply.

   6. Click Save.

   For an explanation of base entries, see the Configuring supported entity types in a federated repository configuration topic.

After completing these steps, the federated repository matches the LDAP server settings.

What to do next

Related

Configure supported entity types in a federated repository configuration

LDAP repository configuration settings

http://publib.boulder.ibm.com/infocenter/wasinfo/v6r1/topic/com.ibm.websphere.wim.doc.en/ldap.html