How to configure an LDAP authentication space

Ops Center Protector User Guide

Version

7.7.x

Audience

anonymous

Part Number

MK-99PRT002-08

ft:lastEdition

2023-10-26

Ensure the LADPv3 server is correctly configured as per the instructions supplied with the LDAP software.

Configure a Linux based Protector (Master or Client) node with a connection to the LDAP server to act as a proxy. If you have a Windows Master, then you must select a Linux Client as a proxy. In this example the node Client5RHEL will be nominated as the proxy.

If using LDAP over TLS, place the TLS CA certificate file on the Protector proxy node.

Note: Protector supports LDAP and LDAP over TLS (LDAPS) protocols. We recommend that initial communication checks are performed without TLS (using LADP protocol). Once correct operation has been confirmed, change to TLS (using LADPS protocol).

This is an illustrative example only. LDAP configurations vary considerably between organisations so the output for your environment may be quite different to that shown here. It is assumed that the person performing this configuration is well versed in LDAP and the way it is configured in your organization:

Examine the configuration of the LDAP server, using one of the following methods to ensure you can log into the LDAP server (preferably via the Protector proxy node to confirm the connection is working). Make a note of the Base DN and User/Group DNs listed in the output:

Either connect to the LDAP server via a web based interface.
Or connect via a command shell using the following Linux command. Consult the Linux man page for full syntax:
```
ldapsearch 
	-D "uid=admin,dc=mydomain,dc=com" 
	-w pa55w0rd 
	-H ldap://mydomain.com  
	-b "dc=mydomain,dc=com" 	
	-s sub "(objectClass=*)"
```
Where the mydomain.com LDAP server's administrator UID is admin and the password is pa55w0rd.

As an example, the output from ldapsearch should include the following configuration information. The highlighted parts will be required in the steps that follow:

The Base DN:

# mydomain.com
dn: dc=mydomain,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: mydomain.com
dc: mydomain

The Administrator's DN (used as the Bind DN):

# admin, mydomain.com
dn: cn=admin,dc=mydomain,dc=com
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator

User DNs and UIDs:

# Joe Bloggs, mydomain.com
dn: cn=Joe Bloggs,dc=mydomain,dc=com
givenName: Joe
sn: Bloggs
cn: Joe Bloggs
uid: jbloggs
uidNumber: 1000
gidNumber: 500
homeDirectory: /home/users/jbloggs
loginShell: /bin/bash
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top

Group DNs and memberUids:

# Managers, Groups, mydomain.com
dn: cn=Managers,ou=Groups,dc=mydomain,dc=com
gidNumber: 501
objectClass: posixGroup
objectClass: top
cn: Managers
memberUid: jbloggs
memberUid: tsmith
memberUid: mjones
...

Configure the parameters in the Access Control Authentication Space Wizard as follows:

Note: The values entered are dependent on the particular LDAP configuration. Be sure to check the output generated by searchldap for your configuration to obtain the correct values.
1. On the Configure authentication type page, select LDAP authentication, then enter the following parameters:
  - Proxy: Client5RHEL
  - Server URI: ldaps://mydomain.com
  - Server Port: If not using the default value, enter a port number.
  - Base DN: dc=mydomain,dc=com from the searchldap output:
```
# mydomain.com
...
dn: dc=mydomain,dc=com
...
```
  - Select Bind using specified account
  - Bind Account DN: cn=admin,dc=mydomain,dc=com from the searchldap output:
```
# admin, mydomain.com
...
dn: cn=admin,dc=mydomain,dc=com
...
```
  - Bind Account Password: pa55w0rd
2. If using the LDAPS protocol, click TLS Configuration and configure the TLS Request Certificate Check method, TLS CA Certificate Directory and TLS CA Certificate File to use.
3. Click Advanced Configuration and enter the following parameters based on the given searchldap output:
  - Person Filter: (objectClass=inetOrgPerson)
```
# Joe Bloggs, mydomain.com
...
objectClass: inetOrgPerson
...
```
  - Group Filter: (objectClass=posixGroup)
```
# Managers, Groups, mydomain.com
...
objectClass: posixGroup
...
```
  - Group Strategy: select Groups know users
```
# Managers, Groups, mydomain.com
...
memberUid: jbloggs
memberUid: tsmith
memberUid: mjones
...
```
  - Group Member Attribute: memberUid
```
# Managers, Groups, mydomain.com
...
memberUid: jbloggs
...
```
  - Group Member Type: select Member value contains a UID
```
# Managers, Groups, mydomain.com
...
memberUid: jbloggs
...
```
```
# Joe Bloggs, mydomain.com
...
uid: jbloggs
...
```
  - The following attribute values are evident from the output:
    - CN Attribute: cn
    - DN Attribute: dn
    - UID Attribute: uid
Click Finish to close the wizard.