DPOD includes an LDAP configuration script for easy configuration of DPOD to use an LDAP user registry.

Based on a properties file, this script verifies the configuration and updates the configuration file and System Parameters. It can also disable the LDAP configuration in order to rollback to the internal database registry.

Properties File

A template of the LDAP properties file is provided at /app/utils/LDAP_parameters.properties.

It is recommended to backup the file before modifying it:

cp /app/utils/LDAP_parameters.properties /app/utils/LDAP_parameters.properties.orig

Edit the properties file and set the following properties based on the information that was collected in Planning LDAP Configuration:

DPOD is deployed on an application server, which is responsible for authenticating the user and assigning authenticated user with the built-in roles.
To configure LDAP for the application server, edit the following file:

vi /app/ui/MonTier-UI/conf/server.xml

Disabling DB registry

DPOD is set up by default with the internal database user management option. To use LDAP, you will first have to disable the DB registry
To do that, comment out the DataSourceRealm element (see below)

<!--
<Realm className="org.apache.catalina.realm.DataSourceRealm"
...
/>
-->

Scenario A - An attribute of the user directory entry

When your installation scenario matches Scenario A in the Concepts Section - add the following XML element right after the DataSourceRealm element you've commented out in the previous step.

<Realm className="org.apache.catalina.realm.JNDIRealm"
   connectionURL="ldap://<LDAP Server Host>:389"
   alternateURL="ldap://<LDAP Server Host>:389"
   referrals="ignore"
   connectionName="CN=...,OU=...,DC=..."
   connectionPassword="pass"
   userBase="OU=...,DC=..."
   userSubtree="true"
   userSearch="(&amp;(objectClass=Person)(sAMAccountName={0}))"
   userRoleName="some_role"
/>

Consult the following table when deciding which values to use:

Scenario B - An attribute of the group directory entry

When your installation scenario matches Scenario B in the Concepts Section - add the following XML element right after the DataSourceRealm element you've commented out in the previous step.

<Realm className="org.apache.catalina.realm.JNDIRealm"
   connectionURL="ldap://<LDAP Server Host>:389"
   alternateURL="ldap://<LDAP Server Host>:389"
   referrals="ignore"
   connectionName="CN=...,OU=...,DC=..."
   connectionPassword="pass"
   userBase="OU=...,DC=..."
   userSubtree="true"
   userSearch="(&amp;(objectClass=Person)(sAMAccountName={0}))"
   roleBase="OU=...,DC=..."
   roleSubtree="true"
   roleSearch="(&amp;(objectClass=group)(member={0}))"
   roleName="some_role"
   roleNested ="true"
/>

Consult the following table when deciding which values to use:

Encrypting connection password

As noted above, you should not enter the clear-text password in server.xml. Instead, you provide a hash digest of the password. Use the following command to generate an encrypted password

1. Run the following command (Replace <CLEAR-TEXT-PASSWORD> with your password): 

    java -cp "/app/ui/MonTier-UI/lib/*:/app/ui/MonTier-UI/bin/*" org.apache.catalina.realm.RealmBase -a SHA1 <CLEAR-TEXT-PASSWORD>  
   or
     
   /app/ui/MonTier-UI/bin/digest.sh -a SHA1 <CLEAR-TEXT-PASSWORD>

   The system will create an encrypted password and display the result in the following format:

   <CLEAR-TEXT-PASSWORD>:<ENCRYPTED-PASSWORD>

    

2. Modify the JNDIRealm XML element (this is the element discussed above)

   <Realm className="org.apache.catalina.realm.JNDIRealm"
      ...
      connectionPassword="<ENCRYPTED-PASSWORD>"
      digest="MD5"
      ...
   />

Connect to LDAP over SSL

In order to connect to the LDAP server over SSL (LDAPS ) perform the following steps:

1. The default password for the JVM TrustStore is “changeit”, and you should change it to a new password

   Keytool -storepasswd -keystore /app/java/jre/lib/security/cacerts 
   
   Enter keystore password:  <old password>
   New keystore password: <new password>
   Re-enter new keystore password: <new password>
                           

2. Import the LDAP / CA certificate to the JVM trustStore. You can either import a self signed certificate, or the CA certificate that signed the LDAP certificate.

   Keytool -import -v -noprompt -trustcacerts -file <certificate file location > -keystore /app/java/jre/lib/security/cacerts -storepass <key store password>
                           

3.  Change the LDAP URL in both UI application server and DPOD system parameters (via DPOD Console)

   1. Edit server.xml to use the SSL port (The default SSL port for Active directory is 686). todo:hk montier-ui

       vi /app/ui/MonTier-UI/conf/server.xml

      and then

      <Realm className="org.apache.catalina.realm.JNDIRealm"
       connectionURL="ldaps://<LDAP Server Host>:686"
       alternateURL="ldaps://<LDAP Server Host>:389"
       referrals="ignore"
       connectionName="CN=...,OU=...,DC=..."

   2. Change LDAP Connection URL in DPOD's Web Console to use LDAPS. Use the SSL port (The default for Active directory for Global catalog is 3269).
      example : ldaps://ldap-server:3269
       

4. Restart the DPOD Console
   DPOD Console must be restarted so LDAP configuration becomes effective.

   stop_services.sh -o ui
   start_services.sh -o ui