DPOD includes an LDAP configuration script for easy configuration of DPOD to use an LDAP user registry.
Based on The script uses a properties file , this script verifies to verify the configuration and updates update the configuration file and System Parameters. It can also disable the LDAP configuration in order to rollback to the internal database registry.
...
Edit the properties file and set the following properties based on the information that was collected in Planning LDAP Configuration:
| Property | Description |
|---|---|
| dpod_ldap_method | Should be "user_attribute" (for scenario A) or "group_attribute" (for scenario B). |
| test_user | The username of a user for testing e,g, "adminford" |
| test_user_password | The password of a user for testing e.g. "pass123" |
| connectionURL | Primary LDAP server URL. Use ldap:// prefix for non-SSL connection and ldaps:// prefix for SSL connection. e.g. "ldap://192.168.110.15:389" |
| alternateURL | Alternate LDAP server URL. Use ldap:// prefix for non-SSL connection and ldaps:// prefix for SSL connection. e.g. "ldap://192.168.110.16:389" |
| referrals | Follow or ignore LDAP referrals (follow/ignore) |
| connectionName | Query user distinguished name (DN) e.g. "cn=LDAP Query User,ou=people,dc=example,dc=org" |
| connectionPassword | Query user password This password will be encrypted in the configuration file e.g. "pass123" |
| userBase | User base entry e.g. "ou=people,dc=example,dc=org" |
| userSubtree | User query sub-tree (true/false) e.g. "true" |
| userSearch | User search filter Operators (e.g. "&") are escaped (e.g. "&") {0} - a placeholder for the user name entered in the login screen e.g. "(&(objectClass=person)(sAMAccountName={0}))" |
| userRoleName | For scenario A only |
| roleBase | For scenario B only |
| roleSubtree | For scenario B only Role query sub-tree (true/false) e.g. "true" |
| roleSearch | For scenario B only Group search filter Operators (e.g. "&") are escaped (e.g. "&") {0} - a placeholder for the full DN of the authenticated user {1} - a placeholder for the user name of the authenticated user e.g. "(&(objectClass=groupOfUniqueNames)(uniqueMember={0}))" |
| roleNested | For scenario B only Nested groups (true/false) e.g. "true" |
| roleName | For scenario B only |
| LDAPConnectionURL | Primary LDAP server URL. Use ldap:// prefix for non-SSL connection and ldaps:// prefix for SSL connection. |
| LDAPReferral | Follow or ignore LDAP referrals (follow/ignore) |
| LDAPConnectionName | Query user distinguished name (DN) e.g. "cn=LDAP Query User,ou=people,dc=example,dc=org" (identical to the connectionName property) |
| LDAPConnectionPASSWORD | Query user password |
| LDAPUserBaseEntry | User base entry e.g. "ou=people,dc=example,dc=org" (identical to the userBase property) |
| LDAPUserSearchFilter | User search filter |
| LDAPGroupBaseEntry | Group base entry |
| LDAPGroupSearchFilter | Group search filter |
| LDAPGroupNameAttribute | Group entry name attribute' name |
Testing LDAP Configuration
Before using the LDAP configuration script for the first time, please issue the following command:
| Code Block | ||||
|---|---|---|---|---|
| ||||
cp /app/utils/LDAPUtilitiesTrustStore.jks /app/utils/LDAPtestTrustStore.jks |
In order to test LDAP configuration, use the following command:
| Code Block | ||||
|---|---|---|---|---|
| ||||
cd /app/utils/
/app/scripts/app_ldap_utilities.sh -f /app/utils/LDAP_parameters.properties |
In case the LDAP configuration is valid, the command For a valid LDAP configuration the command's output should be:
| Code Block | ||||
|---|---|---|---|---|
| ||||
INFO: Testing LDAP configuration... INFO: LDAP configuration tests finished successfully. INFO: The operation completed successfully. |
In case the For an invalid LDAP configuration is invalid, the command's output should be:
| Code Block | ||||
|---|---|---|---|---|
| ||||
INFO: Testing LDAP configuration... ERROR: LDAP parameters tests failed. Please check the log file, change the parameters and try again. ERROR: The operation was aborted. See log file for more details. |
Inspect the log file for detailed test failure messages of which test failed. The log files are located in /logs/ui/app_ldap_utilities.log-<timestamp>.log.
Change the LDAP configuration in the properties file and rerun the script until tests are successful.
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
cd /app/utils/ /app/scripts/app_ldap_utilities.sh -f /app/utils/LDAP_parameters.properties -u |
| Note |
|---|
Make sure Ensure DPOD's services are up and running before updating the LDAP configuration. |
...
Enabling LDAP in Configuration File (server.xml)
Edit the following server configuration file:
| Code Block | ||||
|---|---|---|---|---|
| ||||
vi /app/ui/MonTier-UI/conf/server.xml |
...
DPOD's internal database registry has to be disabled . To do that, comment by commenting out the DataSourceRealm element:
...
Restart DPOD's Web Console to take make the LDAP configuration into take effect.
Disabling LDAP Configuration
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
/app/scripts/app_ldap_utilities.sh -d |
| Note |
|---|
Make sure Ensure DPOD's services are up and running before disabling the LDAP configuration. |
...
Disabling LDAP in Configuration File (server.xml)
Edit the following server configuration file:
| Code Block | ||||
|---|---|---|---|---|
| ||||
vi /app/ui/MonTier-UI/conf/server.xml |
...
Restart DPOD's Web Console to take make the LDAP configuration into take effect.
Manually Inspecting LDAP Configuration
Inspecting LDAP Configuration in Configuration File (server.xml)
Edit the following server configuration file and look for for the LDAPRealm element. This element contains all the configuration set automatically by the script.
...