2.2 Prerequisites and System Requirements

Before installing LDAP Proxy, NetIQ recommends that you review the prerequisites and considerations.

2.2.1 Prerequisites

  • Your operating system should be running the latest service packs before you begin the installation process.

  • If you have Security-Enhanced Linux (SELinux) configured on RHEL7.x/8.x, you must either disable it or set its value to Permissive mode to keep the LDAP Proxy to run.

IMPORTANT:The installation program installs all the dependent packages for LDAP Proxy. If any of the packages reside in the system, a message stating that the package is already present is displayed.

2.2.2 System Requirements

This section provides the minimum requirements for the server(s) where you want to install LDAP Proxy.

Category

Minimum Requirement

Disk Space

2 GB

Memory

1 GB

Operating System

Certified for LDAP Proxy:

  • SLES 12 SP5

  • SLES 15 SP2

  • RHEL 7.9

  • RHEL 8.3

Certified for NLPManager:

  • SLES 12 SP3

  • SLES 12 SP5

  • SLES 15 SP2

  • RHEL 7.5

  • RHEL 8.3

Supported Operating Systems:

Latest version of service packs for the certified operating systems.

Operating System Hotfixes

Before installing LDAP Proxy and NLPManager, NetIQ recommends that you apply the latest operating system patches according to the manufacturer’s automated update facility.

Directory Servers

LDAP Proxy supports eDirectory, Active Directory, and OpenLDAP as back-end server.

  • eDirectory:

    • You can use all the supported versions of eDirectory as back-end server but NetIQ supports installing eDirectory 9.0.x only with LDAP Proxy on the same server.

  • Active Directory:

    Active Directory can be configured as back-end server. For more information, see Setting Up Your Environment.

  • OpenLDAP:

    OpenLDAP can be configured as back-end server.

2.2.3 Setting Up the Advanced Authentication Server for Multi-Factor Authentication (MFA)

Before setting up the advanced authentication server, create a backup user with administrative access in the LOCAL repository. Once the admin user is created, perform the following steps:

  1. Create the followings in the Advanced Authentication Admin panel:

    1. Create LDAP Repositories.

      Multiple repositories need to be created in case there are multiple organizations created in eDirectory.

    2. Create an Endpoint.

      Ensure to backup the endpoint id and secret generated. These will be required for configuring the MFABroker service.

    3. Create the following Chains based on your requirement:

      • LDAP Password + TOTP (Time Based One Time Password)

      • Advanced Authentication Password (AA Password) + TOTP

      • TOTP + Smartphone

      • LDAP Password + Smartphone

      • AA Password + Smartphone

    4. Create an Event.

      For example, you can create an event named LDAPProxy. The type of the event should be OS Logon. The MFA chains created in the previous step should be added to this newly created event.

    5. Ensure that only the members of the MFA groups have access to the Self service portal.

      This can be achieved by confirming that the MFA groups which are being added to any MFA chains are also added to LDAP Password only chain. The LDAP Password chain is a part of the Authenticator Management event.

    6. Configure the following Policies:

      1. Delete Me Options: Enable the Delete Me policy.

      2. Public External URL: This policy should be enabled to configure the Smartphone authentication method.

      3. Custom Messages (Optional): For smartphone notification, the message can be customized. To customize the message notification, you must select the key .method.smartphone.authentication_hint.

        A sample input for the custom message is shown below:

        User {user} from client {client_ip} requested the authentication for event {event}, tenant {tenant}, endpoint {endpoint}

Limitations for Configuring Multi-Factor Authentication

The following limitations should be considered while configuring multi-factor authentication with Advanced Authentication:

  • All the LDAP users should have unique CNs.

  • An LDAP user with MFA should have only one chain available at a time. This can be attained by assigning the user to an individual MFA group only.

  • The LDAP users cannot have & in the LDAP or AA password.

  • Those users who are using single-factor authentication, should not have access to the AA Self-Service Portal.

  • Those users who have enrolled for multi-factor authentication, might see additional chains in the Authenticator’s Management Portal. However, such users must enroll for one authentication chain only.

  • If a user has already been enrolled for the multi-factor authentication, cannot be rolled back to the single-factor authentication method. Such users can be assigned to a different authentication chain by the administrator. Then the user can login to the AA Self-Service portal to register to the methods based on the new chain assigned by the administrator. The user must delete the methods pertaining to the old chain to ensure that they are associated to only one chain.

Once you have setup the advanced authentication server successfully, refer to Configuring Multi-Factor Authentication for LDAP Proxy to configure multi-factor authentication.