4.1 Configuring LDAP Server Settings

You can configure multiple LDAP Servers using the LDAP Servers settings page.

  • Click Settings > LDAP Servers on the home page of the console. In the External Services page click Add New and specify the following fields:

Fields

Details

Domain Name

Enter the Domain Name.

Type

Select from the three drop down list

  • Windows Active Directory

  • NetIQ eDirectory

  • OpenLDAP

Host Name/IP Address

Enter the Host Name or IP address.

SSL

Select this option if you want connect using SSL connection.

Verify Certificate

Select this option if you want to import the Certificate Authority (CA) certificates into Primary and Backup PAM Managers for verifying the LDAP server certificate.

Port

Specify either 389 or 636.

Scope

Specify One or Subtree from the drop down list. Selecting One includes all objects immediately subordinate to the base object, but not including the base object. but selecting Subtree allows the base object and all entries subordinate to the base object.

User DN

Domain name of the user with administrator privileges.

User Name

The corresponding user's name.

Password

Specify the password.

Profile Status

Enable or Disable this field by moving the slider to the left or the right.

Set as Default

Move the slider to Set as Default.

LDAP Attributes

Add the Mapped Attribute to the LDAP Attribute.

4.1.1 Exporting the Certificate From the Active Directory Server

You must export the CA certificate from the Active Directory server and import it to your PAM manager server to enable communication over Secure Sockets Layer (SSL).

  1. Log in to Active Directory domain server as a domain administrator.

  2. In the Active Directory server, launch the Certificate Authority application using Start | Run | certsrv.msc.

  3. Right click the Certificate Authority you created and select Properties.

  4. Click General > View Certificate.

  5. Select Copy to File from the Details tab.

  6. Follow the wizard prompts and select the DER Encoded binary X.509 (.cer) format.

  7. Click browse and specify a path and filename to save the certificate.

4.1.2 Exporting the Certificate From the NetiQ eDirectory Server

You must export the CA certificate from the NetiQ eDirectory server and import it to your PAM manager server to enable communication over Secure Sockets Layer (SSL).

  1. Log in to iManager as an admin user.

  2. On the iManager console, navigate to Roles and Tasks .

  3. Select Configure Certificate Authority option from NetIQ Certificate Server.

  4. Click Next without selecting any option on the page.

  5. Click Certificates.

  6. Enable the check box next to the certificate you want to export.

  7. Click Export. The certificate is typically marked as Organizational CA.

  8. Select the certificate from Certificates drop down list.

  9. De-select Export private key and select base64 as the Export format.

  10. Click the link Save the exported certificate to save the exported certificate.

  11. Rename the saved file with.cer extension for easy identification.

4.1.3 Importing Active Directory or eDirectory Certificates on RHEL or SLES Servers

For importing certificates on RHEL server:

  1. Copy the rootCA.cer certificate file to /etc/pki/ca-trust/source/anchors/ directory.

  2. Run the update-ca-trust extract command to update the system certificates.

For importing certificates on SLES server:

  1. Copy the rootCA.cer certificate file to /etc/pki/trust/anchors directory.

  2. Run the update-ca-certificates command to update the system certificates.

NOTE:If you are using an older version of the operating system, use the below commands:

  1. The LDAP CA certificate must be placed in the /etc/ssl/certs/ folder

  2. Run command c_rehash.

The c_rehash command is deprecated in newer versions of Linux operating system.

HINT:In case you face any issue, ensure that host names used in certificates are resolvable from your PAM manager server to the target LDAP server.