Enabling LDAP Authentication

After setting network parameters, the wizard takes you to the Authentication window:

Enter the required information:

Authentication Method: Simple authentication. Bind DN or user: The root user of the database, as defined on the LDAP configuration file and created with the LDIF import described above. In this case, cn=Manager,dc=company,dc=com. Bind password: The password for the database root user, as defined on the LDAP configuration file.

Click Check Authentication to verify authentication, then click Finish.

Apache Directory Studio is now connected to the LDAP server. The LDAP Browser pane displays a top-level entry called DIT (Directory Information Tree). Click the arrow next to DIT to expand the contents of the database. At this point, the database only contains one object: the root user, Manager.

===== Creating organizational units

We create two organizational units (ou): groups, for storing group definitions; and people, for storing user definitions.

The window displays the list of attributes of the object just created. . Click Finish to write the changes to the LDAP database. An object of type OrganizationalUnit called groups, with DN ou=groups,dc=company,dc=com, is created, and it appears in the LDAP Browser pane.

Repeat the above process, creating a new OrganizationalUnit object called people.

===== Creating users

At this point, the LDAP database contains the root user plus two empty organizational units called groups and people. We next create the entries for three users, all under the people organizational unit.

The procedure for creating users is the same as that for creating groups. The values (object type and attributes) differ, of course.

The mmc user has been created with the following attributes:

You must add two more attributes:

uid: mmc userPassword: mmc123

User mmc has now been defined with all the attributes that will be employed in this example configuration.

Repeat the above procedure to create users admin and testuser1, assigning the passwords of your choice. These passwords will be entered by the users when logging into the console.

===== Creating and Defining the Administrators Group

After you have defined the cn attribute, the object creation wizard prompts you to enter a value for the member attribute. This is the DN of the user that will belong to the Administrators group. You can either type the DN of the user (see above) or click Browse to select the user from the database:

As you can see, group membership is not stored with the user’s definition, but with the definitions of the groups to which the user belongs. If you want more than one user to belong to the group, use the New Attribute icon, (see above) to add more attributes to the group, completing these steps as well:

When a user logs in to the console, the console first asks the LDAP server to verify the user name and password, and then requests a list of the groups that the user belongs to. The parameters for this search are defined in the following line on the mmc-ldap.properties file:

===== Creating and defining a test user and group

Following the procedures outlined above, create a user called testuser1 and a group called testgroup, with testuser1 as member of the group.

==== Configure the console for LDAP

Follow the procedure outlined Enabling LDAP on the console to Enable LDAP on the console. For this example, the contents of the mmc-ldap.properties file are as follows:

===== Test console logins

Start the console and log in as user admin, using the password set in LDAP when creating the user. Since user admin is a member of the Administrators group, the console has given the user the default set of full administrative permissions for the group. On log in, the console displays the Dashboard, which exposes full functionality for members of the group.

Once logged in to the console, verify that the console has correctly read all users from the LDAP server. To do this, click Administration. You should see a list of all the users created on the LDAP database, in this case, mmc, admin and testuser1.

Create a group called testgroup:

For this test group, set the following permissions:

Applications - View Deployments - View Flows - View Tracking - View Files - View Servers - View

Server Group Permissions: All

Log out of the console, then log back in as testuser1. The console displays the Dashboard, but with limited options matching the limited permissions of group testgroup:

==== Where to Go from Here

You can create new users and groups on LDAP and assign members to the groups. Then, on the console, set the desired permissions for each group. You can then remove the Administrators group from LDAP, if desired.

=== Alternative Method of Populating the LDAP Database: Importing an LDIF file

To automatically create database objects in LDAP, you first define the objects in an LDIF file, then import the file into LDAP with the ldapadd command.

Below you will find the LDIF file for all of the database user and group objects created in this example. If you wish to automatically replicate this user and group configuration into your LDAP database, copy-paste the below code into a plain text file, then import the file with the command:

You may wish to modify the userPassword values before importing.

LDIF file contents:

=== Basic Logging of LDAP Events

By default, the LDAP server logs events to /var/log/syslog. In case of authentication issues, check this log for details.

Below is an extract of the log, showing events logged by slapd when a user logs into the console. There are two BIND operations (user authentications) to the LDAP server; the first occurs when the console starts and authenticates itself (See: the second and third lines in the extract below). After establishing the context base for searching, LDAP searches for user admin, authenticates the user, then searches for the groups the user belongs to.