4.4 Configuring LDAP

To set up LDAP authentication:

1. Log in to the Administration Console, click Users > LDAP Settings.

2. Specify the options to configure LDAP authentication:

   Host: Hostname or IP address for SSL connections.

   SSL: SSL connection to the LDAP server.

   Port: Port for the SSL connection. The default SSL port number is 636 and the default non-SSL port number is 389.

   Certificate File Path: The path of the CA certificate file for the LDAP server.

   Specify the certificate file path when you are using an SSL connection, and if the LDAP server certificate is not signed by a well-known CA and is not trusted by default.

   Anonymous Search: Option to perform anonymous searches or non-anonymous searches on the LDAP directory.

   Base DN: The root container to search for users.

   For example. set o=netiq for eDirectory.

   For anonymous search, specify the root container of the LDAP directory. This is optional for eDirectory, but mandatory for Active Directory. For eDirectory, if you do not specify the Base DN, Change Guardian searches the entire directory to locate the users.

   For non-anonymous search, specify the root container in the LDAP directory that contains users. This is mandatory if you are using Active Directory and if you set a domain name.

   Search Attribute: The LDAP attribute having the user name to search for users.

   For example, the search attribute for eDirectory is uid and for Active Directory it is sAMAccountName.

   Domain Name: The Active Directory domain.

   Change Guardian can perform anonymous search in Active Directory. Change Guardian uses the username@domainname (userPrincipalName) to authenticate the user before searching for the LDAP user object.

   NOTE:If Base DN is set and Domain Name is not set, the Base DN is appended to the relative user DN to construct the absolute user DN.

   For example, if the Base DN is set to o=netiq and the absolute user DN is cn=sentinel_ldap_user,o=netiq, Change Guardian uses the relative user DN cn=sentinel_ldap_user when you create an LDAP user account.

3. Click Test Connection to test the LDAP connection.

   • Specify the domain name and password if you did not specify earlier. The user DN can be relative to the Base DN.

   • According to LDAP standards, when you use reserved special characters as literals in a User DN, you must use \. eDirectory or Active Directory might require additional escape characters. You must use \ as the escape character for the following scenarios:

     • A space or # occurring at the beginning of the string

     • A space occurring at the end of the string

     • Any one of the following characters: +, ", \, <, >, or ;

       For example, if the User DN contains a comma as a literal, specify the User DN as follows:

       CN=Test\,User,CN=Users,DC=netiq,DC=com

   If there is an error, review the configuration details you provided and test the connection again. To learn about the errors, examine the /var/opt/novell/sentinel/log/server0.0.log file.

   NOTE:You must ensure that the test connection is successful before saving the LDAP settings.

4. Click Save to save the LDAP settings.

   Verify the configuration:

   • Check that the LdapLogin section in the /etc/opt/novell/sentinel/config/auth.login file is updated. For example:

     LdapLogin {
             com.sun.security.auth.module.LdapLoginModule required
     java.naming.ldap.factory.socket="com.esecurity.common.communication.ProxyLdapSSLSocketFactory"
             userProvider="ldap://10.0.0.1:636/o=netiq"
             userFilter="(&(uid={USERNAME})(objectclass=user))"
             useSSL=true;
     };

   • If you provided the LDAP server CA certificate, it is added to the /etc/opt/novell/sentinel/config/.ldapkeystore.jks keystore.