Page History

...

• About secured Precise systems
• Installing new servers
• ConfiguringasecuredPrecisesystem
• Verifying Precise login credentials using an external password repository
• Running Precise services on Windows with a non-Administrative user
• Configuring the Single Sign On feature for Precise
• Configuring LDAP to authenticate Precise users

...

When installing a new server, a communication security key is transferred to the new server. To ensure secure transfer of the key, see Securing communication key transfer to a new server on page 48.

Anchor
ConfiguringasecuredPrecisesystem ConfiguringasecuredPrecisesystem

Configuring a secured Precise system

...

1. Log in to the Main Precise FocalPoint.
2. Run the following command from the <Precise_root> folder:
   • Windows
     infra\bin\psin_cli.bat
-i3-user<user_name>
{-i3-encrypted-password<encrypted_password>|-i3-clear-password<clear_password>}
-action communication-key-change
-type aes
   • UNIX
     ./infra/bin/psin_cli.sh
-i3-user<user_name>
{-i3-encrypted-password<encrypted_password>|-i3-clear-password<clear_password>}
-action communication-key-change
-type aes

Anchor
Distributingthenewencryptionsettingstoallservers Distributingthenewencryptionsettingstoallservers

Distributing the new encryption settings to all servers

For the new encryption settings to take effect, you must distribute them to all servers, completing no later than 24 hours after you changed the encryption configuration on the Precise FocalPoint server.

...

See Distributing the new encryption settings to all servers on page 216.

If the new encryption settings were successfully received on all servers, the scan results in an output like the following:

...

You can replace the password encryption key on the Precise FocalPoint server by using the Precise Command Line Interface (CLI) installation utility. For information on how to deploy this utility, see the Precise CLI Utility Reference Guide.

To replace the password encryption key on the Precise FocalPoint server

1. Verify that the CLI installation utility is deployed.
2. Run the following command from the <Precise_root> folder on the Precise FocalPoint server:
   • Windows
     infra\bin\psin_cli.bat
-i3-user<user_name>
{-i3-password encrypted-password
| -i3-clear-password clear-password}
-action encrypt-update
-type [aes-key]
   • UNIX
     ./infra/bin/psin_cli.sh
-i3-user user-name
{-i3-password encrypted-password
| -i3-clear-password clear-password}
-action encrypt-update
-type [aes-key]

Table C- 1 Configuring password encryption type elements on the Precise FocalPoint server

For example:

./infra/bin/psin_cli.sh
-i3-user user-name
{-i3-password encrypted-password
| -i3-clear-password clear-password}
-action encrypt-update
-type aes-key

...

1. In AdminPoint, verify that the Precise Listener is up and running on all servers.
2. Run the following command from the <Precise_root> folder on the Precise FocalPoint server:
   • Windows
     infra\bin\psin_cli.bat
-i3-user user-name
{-i3-password encrypted-password
| -i3-clear-password clear-password}
-action encrypt-distribute
   • UNIX
     ./infra/bin/psin_cli.sh
-i3-user user-name
{-i3-password encrypted-password
| -i3-clear-password clear-password}
-action encrypt-distribute

Table C- 2 Distributing new password encryption element settings to all servers

Configuring the Precise Apache Tomcat to work in HTTPS mode (SSL)

...

1. Create a certificate keystore on the Apache Tomcat server. This file is saved in the folder <Precise_root>\products\gui\website as a certificate .keystore file.
   1. Before you create the .keystore file, delete the alias Tomcat if it already exists. To delete the alias Tomcat, run the following command from the <Precise_root> folder on the Precise FocalPoint:
      

      • Windows
        java\JRE\bin\keytool -delete -alias tomcat -keystore products\gui\website\.keystore

        Info
        For the password, use "changeit." For the question "What is your first and last name," provide the server name used in the URL for the Precise GUI as the answer.

      • UNIX
        java/JRE/bin/keytool -delete -alias tomcat -keystore products/gui/website/.keystore
   2. To create your own certificate, run the following command from the <Precise_root> folder on the Precise FocalPoint:
      

      • Windows
        java\JRE\bin\keytool -genkey -alias tomcat -keyalg RSA -keystore products\gui\website\.keystore -validity 3000

      • UNIX
        java/JRE/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore products/gui/website/.keystore -validity 3000

        Info
        For the password, use "changeit." Also, use the host as displayed in the url for the name.

2. In the file <Precise_root>\products\gui\website\conf\server.xml
   1. Add comment tags around the non-SSL <Connector> tag, where the preliminary remark is "<!-- Define a non-SSL HTTP/1.1 ...->."
   2. Remove the comment tags around the SSL <Connector> tag, where the preliminary remark is "<!-- Define a SSL Coyote HTTP/1.1 ...->."
3. Restart the Precise FocalPoint process on the UNIX server. Restart the Precise FocalPoint service and the Precise user interface service on the Windows server.

4. Open the Precise application using HTTPS.
   For example:
   https://<host>:<port>

   Info
   After restarting the Precise FocalPoint, the SSL port changes to the default port added by the user during installation. If you want to use a different port, you can change the port as described in the Change GUI server port section in the Precise CLI Utility.

   
   When first launching Precise in a client, a security alert is displayed with the certificate details. You should sign your certificate with a trusted root authority (such as VeriSign). Alternatively you can install the certificate on each client server that uses the Precise GUI.

5. In AdminPoint, click the Setup tab and click on Nodes in the drop-down menu

6. In the Nodes tab, click Edit to update the URL of the node for which you configured the SSL, according to step 4. In addition, if you are working with the Precise Custom Portal, the following configuration must be performed.

...

For general information regarding configuring HTTPS mode, see Apache Tomcat server instructions found at this site: http://tomcat.apache.org/tomcat-4.1-doc/ssl-howto.html

For information regarding configuring J2EE to work in HTTPS mode, see About Security Options in the Precise for J2EE User Guide.For information on installing your own certificate for J2EE, see the Creating and installing certificates for SSL in the Precise Administration Guide.

Changing the session timeout for an Apache Tomcat server

...

Because the JAAS is a common Application Programming Interface (API), you can also configure it to run a custom login module that authenticates a role’s password against an external, centralized password repository. To do so, you must first define the respective role in AdminPoint. For more information on managing roles in AdminPoint, see the Precise Administration Guide.

The login module is a Java class that implements the login module interface of the JAAS API. This API exists for the Java Runtime Application (JRE) version 1.4.2 and later. It is part of the javax.security.auth.* package.

...

After you have finished installing all Precise components on a server, you may remove the user (used by the Precise services) from the Administrators group and either assigns it to the Power Users"group or Users group. In both cases the user should be set to have Login as service authorization. If the user is set to the Users group, you also need to grant access permissions to authenticated users for each Precise service on the machine. To do this, use the SC.exe utility from the Microsoft Resource Kit.

For example:

E:\Program Files\Resource Kit\sc.exe sdset psin_sentry_8.7
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA) (A;;CCLCSWRPWPDTLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
E:\Program Files\Resource Kit\sc.exe sdset psin_i3fp_8.7
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA) (A;;CCLCSWRPWPDTLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
E:\Program Files\Resource Kit\sc.exe sdset psin_gui_8.7
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA) (A;;CCLCSWRPWPDTLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

...

Anchor
ConfiguringtheSingleSignOnfeatureforPrecise ConfiguringtheSingleSignOnfeatureforPrecise

Configuring the Single Sign On feature for Precise

Support of the Single Sign On feature means adding the capability to Precise to be an integrated part of an enterprise application. It also allows the enterprise application users to log in to their systems only once, remembering the credentials and authorization used by the user, and then removing the need to log in again to each of the enterprise systems.

The prerequisites, installation, and configuration of this feature is described in the following sections:•    About

• About prerequisites

...

• Configuring the Apache Web server

...

• Installing the SiteMinder Web agent

...

• Configuring the SiteMinder Policy server

...

• Changing the Precise configuration

...

• Disabling the Precise integration with SiteMinder

Anchor
Aboutprerequisites Aboutprerequisites

About prerequisites

Before you configure the Single Sign On feature it is best to define at least one user in Precise who also appears in the SiteMinder folder. This is important for security reasons.

To configure Precise and to enable it to operate using a Single Sign On feature, install and configure the following products:•    Apache

• Apache Web server version 2.2.3 or higher

...

• SiteMinder Web agent version 6.00 Hotfix 05.03 or higher*

  Info

...

• Precise does not sell or provide CA SiteMinder®. This product should be acquired from Computer Associates.

...

• Precise version 8.2 and up.
  *At the moment of creation of this text, the Web agent for the following platforms could be downloaded:

  ...

  • • Web-Agent 6QMR5 CR002 certified with ASF Apache 2.2.3 Web server on the SPARC based Solaris 8/9/10 platforms.

  ...

  • • Web-Agent 6QMR5 CR002 certified with ASF Apache 2.2.3 Web server on the RHAS 3.0 platform.

  ...

  • • Web-Agent 6QMR5 CR002 certified with ASF Apache 2.2.3 Web server on the RHAS 4.0 platform.

  ...

  • • Web-Agent 6QMR5 CR002 certified with ASF Apache 2.2.3 Web server on the Windows 2000 SP4 platform.

  ...

  • • Web-Agent 6QMR5 CR002 certified with ASF Apache 2.2.3 Web server on the Windows 2003 SP1 and Windows 2003 R2 platforms.

  ...

  • • Web-Agent 6QMR5 CR002 certified with ASF Apache 2.2.3 Web server on the AIX 5.2 and AIX 5.3 platforms.

  Anchor
  ConfiguringtheApacheWebserver ConfiguringtheApacheWebserver

  Configuring the Apache Web server

  The Precise Single Sign On feature works with Apache Web server v2.2.3 or higher. The Apache Web server should be configured to work as a reverse proxy server, which is installed using the Tomcat port of Precise.

  To configure the Apache Web server for Windows1.    Open

  1. Open the \conf\httpd.conf file in the Apache installation folder.

  ...

  1. Change the line with the Listen and port number to the GUI port of Precise (The port that the Precise Tomcat Web server listens to, in this example 20760). The information will become: Listen 20760

  ...

  1. Change the line with the ServerName and port number (in this example 20760) to the required server and GUI port.
     ServerName GUI-TEST-INST.precise.com:20760

  ...

  1. Look for the following three lines with the proxy modules and remove the pound/hash marks (# sign) from them:
     LoadModule proxy_module modules/mod_proxy.so
     LoadModule proxy_connect_module modules/mod_proxy_connect.so
     LoadModule proxy_http_module modules/mod_proxy_http.so

  ...

  1. Change the port the Precise Tomcat Web server will listen to, for example to 20761 by adding the following entries at the end of the file, where the new port of the Tomcat is used (In this case 20761, see the following section about this port):
     <Proxy *>
          Order deny,allow
          Allow from all
     </Proxy> ProxyRequests Off ProxyPreserveHost On
     ProxyPass / http://gui-test-inst.precise.com:20761/
     ProxyPassReverse / http://gui-test-inst.precise.com:20761/
     Verify that http://gui-test-inst.precise.com:20761 is replaced with the fully qualified domain name and port of your Precise installation.

  ...

  1. Open the <Precise_root>/infra/setup.xml file and edit the <tomcat-

  ...

  1. port> tag.

  ...

  1. Change the port of the Precise Tomcat Web server to a port that is not open to the outside world, or is behind a firewall, to prevent direct access to it. In this example, the Tomcat port will be 20761.

  ...

  1. Restart first the Tomcat service and then the Apache service.

  The restart order is important because the Tomcat server has to release the port that the Apache server is configured to listen to.

  To configure the Apache Web server for Linux1.    Change

  1. Change the port of the Precise Tomcat Web server to a port that is not open to the outside world, or is behind a firewall, to prevent direct access to it. In this example, the Tomcat port will be 20761.
     Remember to make the change in the Precise setup.xml file

  ...

  1. Enable the mod_proxy feature in the Apache Web server. For example, on a Debian server it is done by symlinking some files:
          symsrv:/etc/apache2/mods-enabled# ls
          cgid.conf cgid.load userdir.conf userdir.load
          symsrv:/etc/apache2/mods-enabled# ln -s ../mods-available/proxy.* . symsrv:/etc/apache2/mods-enabled# ln –s
          ../mods-available/proxy_http.* .
          symsrv:/etc/apache2/mods-enabled# ls
          cgid.conf cgid.load proxy.conf proxy.load proxy_http.conf proxy_http.load userdir.conf userdir.load

  ...

  1. Configure the mod_proxy feature by creating a configuration file snippet, conf.d/symi3, as described in the following code:
          symsrv:/etc/apache2/mods-enabled# cd ../conf.d
          symsrv:/etc/apache2/conf.d# cat > symi3
          <Proxy *>
               Order deny,allow
               Allow from all
          </Proxy>
          ProxyRequests Off
          ProxyPreserveHost On
          ProxyPass / http://gui-test-inst.precise.com:20761/ ProxyPassReverse / http://gui-test-inst.precise.com:20761/
          teacup:/etc/apache2/conf.d#
     Verify that http://gui-test-inst.precise.com:20761 is replaced with the fully qualified domain name and port of your Precise installation.

  Anchor
  InstallingtheSiteMinderWebagent InstallingtheSiteMinderWebagent

  Installing the SiteMinder Web agent

  For installing the SiteMinder Web agent you need to have SiteMinder installed on your application and a user name and password for access to the SiteMinder support site to download the SiteMinder Web agent.

  To install the SiteMinder Web agent1.    Before

  1. Before downloading and installing the SiteMinder Web agent, perform the steps described in the procedure, To make changes on the System tab in

  ...

  1. Configuring the SiteMinder Policy server

  ...

  1. .

  ...

  1. Download and install the latest SiteMinder Web agent for Apache Web servers.
     Verify that the version you download supports the Apache Web server version that we support – in this case, version 2.2.3 and that you download the file for the platform on which your Apache Web server is installed.
     
     1. Download the agent from https//support.netegrity.com

  ...

  1. 1. .
     2. Insert your user name and password

  ...

  1. 1. .
     2. Select Tools in the left pane

  ...

  1. 1. .
     2. Choose Download Manager

  ...

  1. 1. .
     2. Select SiteMinder Web Agent in the Download a product drop-down menu

  ...

  1. 1. .
     2. Choose SiteMinder 6.x QMR's

  ...

  1. 1. .
     2. Choose the agent to be downloaded.

  ...

  1. After installing the SiteMinder Web agent, configure it according to the

  ...

  1. SiteMinder's Web agent Installation and Configuration guide.

  ...

  1. Open the WebAgent.conf file in the \Program Files\Apache Software Foundation\Apache2.2\conf folder

  ...

  1. , and then set EnableWebAgent="YES".

  ...

  1. Add the Apache Web server as a protected resource to the

  ...

  1. SiteMinder's protected resources.

  ...

  1. Restart the machine after you have installed the Web Agent.

  Anchor
  ConfiguringtheSiteMinderPolicyserver ConfiguringtheSiteMinderPolicyserver

  Configuring the SiteMinder Policy server

  The SiteMinder Policy server is used to configure the policy server to protect Precise.

  To configure the Policy server1.    Log

  1. Log in to the Policy server management application.

  ...

  1. Define the protection on the Precise application by performing steps on two of the three main tabs (System, Domains, Global Policies) on the main window of the Policy server management application as described in separate procedures.

  Anchor
  TomakechangesontheSystemtab TomakechangesontheSystemtab

  To make changes on the System tab1.    Define
  1. Define a new Web agent under the Agents item.

  ...

  1. Define a new Host Configuration Object under the Host Conf Objects item.

  ...

  1. Duplicate the DefaultHostSettings object, give it a name, and replace the complete <IPAddress> with the Policy Server IP address.

  ...

  1. Define a new Agent Configuration Object under the Agent Conf Objects item.

  ...

  1. Duplicate the ApacheDefaultSettings configuration object, give it a name, and configure the following items so that they have the values as described in the table:

  ...

  1. • PersistentCookies. Yes
     • IgnoreExt. Add the following extensions: .xml and .css

  ...

  1. • ForceFQHost. Yes
     • DefaultAgentName. Verify that this contains the name of the new Web agent defined in the Agents item.

  ...

  1. • AgentName. Verify that this contains the name of the new Web agent defined in the Agents item.

  ...

  1. • CookieDomain. Add the domain the agent is working in. For example: .precise.com

  To make changes on the Domains tab1.    In

  1. In the domain tab, add a domain and give it a name

  ...

  1. , such as precise.

  ...

  1. Add the user directories to the related Precise domain.

  ...

  1. See the SiteMinder documentation for further instructions.

  ...

  1. Under the Precise domain, add a realm and give it a name

  ...

  1. , such as precise-Realm. This realm will protect Precise.

  ...

  1. Configure the Precise-Realm

  ...

  1. in the realms subfolder

  ...

  1. .

  ...

  1. Under the Precise-Realm, create a rule and give it a name

  ...

  1. , such as Precise-rule.

  ...

  1. Add a new response under the Precise/Responses entry.

  ...

  1. Add a new policy under the Precise/Policies entry:

  To configure the Precise-Realm1.    Open

  1. Open the Realms subfolder by clicking the + icon next to the Realms folder under the Precise domain

  ...

  1. Double click the Precise-Realm folder.

  ...

  1. On the Resource tab, verify that the following items have the following values:

  ...

  1. • Agent. Add the Web agent that is installed on the Precise Web server.
     • Resource

  ...

  1. • filter. /i3/Login
     • Authentication

  ...

  1. • scheme. Basic authentication
     • Default resource

  ...

  1. • protection. Protected
  2. On the Session tab, verify that the following items have the following values:
     • Maximum Time Out

  ...

  1. • Enabled. Check 2 hours, 0 minutes Idle.
     • Time Out

  ...

  1. • Enabled. Check 2 hours, 0 minutes.
     • Persistent

  ...

  1. • Session. Choose No Persistent Session.
     • Synchronous

  ...

  1. • Auditing. Should be unchecked.

  ...

  1. On the Advanced tab, perform the following steps:

     ...

     1. 1. Configure the Directory Mapping to the location of the user folder.

     ...

     1. 1. Select the Process Authentication Events checkbox.

     ...

     1. 1. Select the Process Authorization Events checkbox.

     ...

     1. Click Apply, and the click OK.

     To create and name a rule under the Precise-Realm1.    Right

     1. Right-click in the tree on the Precise-Realm and choose Create Rule under Realm.

     ...

     1. In the Rules Properties dialog box provide a name for the rule

     ...

     1. , such as Precise-Rule.

     ...

     1. Clear the Perform Regular Expression checkbox.

     ...

     1. Under the Action group, select the Web Agent actions and Get and Post.

     ...

     1. Under the Allow/Deny and Enable/Disable group, select the Allow Access radio button.

     ...

     1. Under the Allow/Deny and Enable/Disable group, select the Enabled checkbox.

     To add a new response under the Precise/Responses entry1.    Give

     1. Give a name to the response

     ...

     1. , such as Precise-response.

     ...

     1. Select SiteMinder's Web agent response type option.

     ...

     1. Click Create and create the response attribute.

     ...

     1. Select the User Attribute radio button.

     ...

     1. Create a cookie called

     ...

     1. Precise-SiteMinderUser. That returns the FullName if it is the NT domain name. If you are working with a different folder, choose the property in the folder that holds the user name.
        This user name should be defined also in the Precise application in the Precise AdminPoint.

     ...

     1. Select the Recalculate value every xx seconds checkbox and give it a value of 15.

     To add a new policy under the Precise/Policies entry1.    Give

     1. Give a name to the policy

     ...

     1. , such as Precise-policy.

     ...

     1. Verify that the policy is enabled.

     ...

     1. In the Rules tab, insert the Precise-rule and the Precise-response with the values you set in the previous procedures.

     ...

     1. In the Users tab, define the relevant users.

     Anchor
     ChangingthePreciseconfiguration ChangingthePreciseconfiguration

     Changing the Precise configuration

     The Precise configuration needs to be changed to connect it to SiteMinder and activate the Single Sign On feature. To connect SiteMinder and activate the Single Sign On feature to Precise.1.    Edit the siteMinder

     1. Edit the SiteMinder.htm file located in:
        

     ...

     1. <Precise_

     ...

     1. root>\products\gui\website\webapps\i3\Login

     ...

     ...

     1. Set the bSiteMinderActive variable to

     ...

     1. True (bSiteMinderActive = true;).

     ...

     1. Save the file.

     ...

     1. Edit the products\i3fp\login\jaas.config file so that its content looks like:
        StartPoint{com.precise.infra.login.SiteMinderLoginModule required;};

     ...

     1. Stop and then restart the Precise FocalPoint.

     ...

     Anchor
     DisablingthePreciseintegrationwithSiteMinder DisablingthePreciseintegrationwithSiteMinder

     Disabling the Precise integration with SiteMinder

     To disable the integration between SiteMinder and Precise, two procedures need to be performed: one to roll back the Precise configuration changes and one to roll back the Apache Web agent configuration changes.

     To roll back the Precise configuration changes1.    Edit

     1. Edit the siteMinder.htm file located in:
        

     ...

     1. <Precise_

     ...

     1. root>\products\gui\website\webapps\i3\Login

     ...

     ...

     1. Set the bSiteMinderActive variable to

     ...

     1. False (bSiteMinderActive = false;).

     ...

     1. Edit the products\i3fp\login\jaas.config file so that its content looks like:
        StartPoint{com.precise.infra.login.InfraDbLoginModule required;};

     ...

     1. Stop and then restart the Precise FocalPoint.

     To rollback the SiteMinder configuration changes1.    Shut

     1. Shut down the Web Agent installed on Precise Web

     ...

     1. server machine. For more information on how to shut down the Web agent, see the SiteMinder documentation.

     ...

     1. In the Apache installation folder, open the WebAgent.conf file which is located in:
        
        • Windows

     ...

     1. • . \Program Files\Apache Software Foundation\Apache2.2\conf
        • Linux

     ...

     1. • . web_server_home/conf
        where web_server_home is the location of the installed Web server.

     ...

     1. Change EnableWebAgent to

     ...

     1. No (EnableWebAgent="NO").

     ...

     1. Restart the Apache service.

     Anchor
     ConfiguringLDAPtoauthenticatePreciseusers ConfiguringLDAPtoauthenticatePreciseusers

     Configuring LDAP to authenticate Precise users

     Precise Version 9.6 can integrate with Lightweight Directory Access Protocol (LDAP). LDAP is a better option than JAAS. The following section describes how to configure LDAP.

     Best practices for LDAP configuration

     Once integrated with LDAP, Precise Version 9.6 gets all users and groups from the LDAP and synchronizes them into its own database. Login passwords are authorized by LDAP, thus preventing the need to keep (and verify) the users’ users' passwords within Precise.

     LDAP provides access for management and browser applications that provide read/write interactive access to the X500 folder. Setting up an LDAP configuration will reduce Users/Roles management in Precise; it also uses the already managed LDAP repository for Precise.

     Pay close attention to your organizational structure in the LDAP repository before setting up the LDAP configuration for Precise. You must understand the current LDAP structure to determine the data needed from existing LDAP repository entities for Precise.

     Map a set of users and roles to a Precise domain. While synchronizing the LDAP data to Precise, the relevant users/roles will be identified by the given domain. For login, the domain name will be the user.

     Info

     ...

     It is preferable to set the domain name as the enterprise domain, and the Users/Roles root as the relevant LDAP branch which contains the domain users.

     Setting up the Precise system to work with LDAP blocks all user/role management operations in the Precise system, except for permissions management. The LDAP synchronization process deletes all Precise users and roles from the Precise system which are not also found in the LDAP repository, except for user “admin” "admin" and role “Precise manager”"Precise manager."

     Map a set of users and roles to the Precise domain. After synchronizing the LDAP data to the Precise system, the domain will identify relevant users or roles. The domain name will be user-defined for login purposes. Set the domain name as the enterprise domain, and the users/roles root as the relevant LDAP branch that holds domain users.

     To enable synchronization of Users and Roles from the LDAP repository into the Precise database, configure the LDAP as described below.

     To configure LDAP1.    Update

     1. Update the ldap file (as specified below) in the main Precise FocalPoint machine under:
        <precise_root>\products\i3fp\registry\products\infrastructure\login\ldap.xml

     ...

     1. Delete the ldap.xml.status file (in the same folder as ldap.xml)

     ...

     1. Update the roles file in the main Precise FocalPoint server under:
        <precise_root>\products\i3fp\registry\products\infrastructure\roles\settings.xml by updating ignore-last-role-on-delete to true:
        <ignore-last-role-on-delete>true</ignore-last-role-on-delete>

     ...

     1. Delete the settings.xml.status file (in the same folder as settings.xml)

     ...

     1. Restart the Precise FocalPoint.

     Connection details

     Enter the following connection information:•    <host>

     • <host> to specify the host name/IP of the LDAP repository server

     ...

     • <port> to specify the port on which the LDAP repository server is listening on

     ...

     • <bind-user> to specify the LDAP user name for binding in the synchronization process

     ...

     • <bind-password> to specify the password of the bind user

     Info

     ...

     The <bind-password> will be supplied encrypted. Use the

     ...

     "encrypt" CLI action to encrypt. If <use-ldap-authentication> is

     ...

     "false," the password setting must be an encrypted empty string. For more details on how to encrypt a password, see the Precise CLI Utility Reference Guide.

     Mapping information

     The domain element holds information for the domains that are required to synchronize. You can specify one or more domain elements. Enter the following mapping information:

     • <domain-

     ...

     • name> A unique name for the domain, to be concatenated to the imported users or roles name. The user name of such user is: domain-name\user-name.
     • <root-

     ...

     • group> To specify an LDAP group DN. The import process will take all members (users and groups) of this group. (Use this when <domain-root-method> is

     ...

     • 'single'.)
     • <users-

     ...

     • root> To specify an LDAP object DN. The import process will take all users under this object. (Use this

     ...

     • when <domain-root-method> is ‘multiple’.)
     • <groups-

     ...

     • root> To specify an LDAP object DN. The import process will take all groups under this object. (Use this

     ...

     • when <domain-root-method> is

     ...

     • 'multiple'.)

     Info

     ...

     The names <root-group>, <users-root>, and <groups-root> may have multiple entries under each domain entry.

     General information

     Enter the following general information:

     • <user-object-

     ...

     • class> Indicates the object class name in the LDAP for the user entity.
     • <group-object-

     ...

     • class> Indicates the object class name in LDAP for the group entity.
     • <user-name-

     ...

     • attribute> Indicates the attribute name in the LDAP for the user name.
     • <group-name-

     ...

     • attribute> Indicates the attribute name in the LDAP for the group name.
     • <user-dn-

     ...

     • attribute> Indicates the attribute name in the LDAP for the user entity DN.
     • <user-login-

     ...

     • attribute> Indicates the attribute name in the LDAP for the user login ID.
     • <group-members-

     ...

     • attribute> Indicates the attribute name in the LDAP for the group members list.
     • <max-

     ...

     • users> Indicates the maximum number of users allowed to import into Precise.
     • <max-

     ...

     • groups> Indicates the maximum number of groups allowed to import into Precise.
     • <domain-root-

     ...

     • method> Indicates whether to use the <root-group> or the <users-root>/<groups-root> configuration for the entities mapping. Specify single or multiple.
     • <paging-

     ...

     • size> Indicates the number of entities per page in the result set from the LDAP. If zero (0) is specified, the paging mechanism is not used.
     • <use-ldap-

     ...

     • authentication> Indicates whether the LDAP authentication mechanism is used. Specify true or false.
     • <use-ldap-

     ...

     • management> If <use-ldap-authentication> is set to true, this parameter specifies whether users/roles management is by LDAP or by the Precise user interface. Specify true or false.
     • <use-case-

     ...

     • sensitive> If <use-case-sensitive> is set to true, the LDAP sync user will be set to case sensitive.

     Example of a registry entry

     Below is a registry entry example for the ldap.xml file.

          <ldap>
               <!-- Indicator for using Ldap authentication true/false -->
               <use-ldap-authentication>true</use-ldap-authentication>
               <!-- Indicator for using Ldap for managing users/roles, true will block I3 GUI operations -->
               <use-ldap-managment>true</use-ldap-managment>
               <!-- Ldap server host name -->
               <host>pss-dc01</host>
               <!-- Ldap server port -->
               <port>389</port>
               <!-- Ldap paging size -->
               <paging-size>500</paging-size>
               <!-- Ldap bind user name -->
               <bind-user>CN=i4dcf,OU=APM Service Users &amp; Groups,DC=precise,DC=com</bind-user>
               <!-- Ldap bind user password, encrypted!! -->
               <bind-password>_EncryptI3_A_1_F10EEB2FC3B6F88E</bind-password>
               <!-- in case there is only on domain the user can configure not to type the domain in the login -->
               <use-domain-in-login>false</use-domain-in-login>
               <domains>
                    <domain>
                         <domain-name>development</domain-name>
                         <!-- Ldap group to import its members -->
                         <root-group>CN=BU_RnD,OU=R&amp;D,OU=APM,DC=precise,DC=com</root-group>
                         <!-- Ldap group to import its members -->
                         <root-group>CN=GRP_Integration,OU=Unknown users &amp; groups,OU=APM Service Users &amp; Groups,DC=precise,DC=com</root-group>
                    </domain>
                    <domain>
                         <domain-name>QA</domain-name>
                         <!-- Ldap group to import its members -->
                         <root-group>CN=BU_RnD,OU=R&amp;D,OU=APM,DC=precise,DC=com</root-group>
                    </domain>
               </domains>
               <!-- Ldap objectClass of the Users to sync -->
               <user-object-class>person</user-object-class>
               <!-- Ldap objectClass of the Roles to sync -->
               <group-object-class>group</group-object-class>
               <!-- Ldap attribute name of the User name -->
               <user-name-attribute>name</user-name-attribute>
               <!-- Ldap attribute name of the User distinguished name -->
               <user-dn-attribute>distinguishedName</user-dn-attribute>
               <!-- Ldap attribute name of the User login name -->
               <user-login-attribute>sAMAccountName</user-login-attribute>
               <!-- Ldap attribute name of the Role member list -->
               <group-members-attribute>member</group-members-attribute>
               <!-- Ldap attribute name of the Role name -->
               <group-name-attribute>name</group-name-attribute>
               <!-- I3 max users -->
               <max-users>500</max-users>
               <!-- I3 max roles -->
               <max-roles>500</max-roles>
               <!-- Parameters handling method: single/multiple -->
               <domain-root-method>single</domain-root-method>
               <!-- Ldap sync user set as case sensitive -->
               <use-case-sensitive>false</use-case-sensitive>
          </ldap>

     For more information on running LDAP-sync command, see the Precise CLI Utility Reference Guide.

     Precise. Performance intelligence from click to storage. Learn more > >

     Precise Website	Solutions	Support	Support Portal	Community	About Us	Legal

      

      

      

      

      

      

     ...

     
     

     Scroll Ignore
     scroll-pdf true scroll-office true scroll-chm true scroll-docbook true scroll-eclipsehelp true scroll-epub true scroll-html true
     Newtabfooter alias IDERA url http://www.idera.com  |  Newtabfooter alias Products url https://www.idera.com/productssolutions/sqlserver  |  Newtabfooter alias Purchase url https://www.idera.com/buynow/onlinestore  |  Newtabfooter alias Support url https://idera.secure.force.com/precise/  |  Newtabfooter alias Community url http://community.idera.com  |   Newtabfooter alias Resources url http://www.idera.com/resourcecentral  |  Newtabfooter alias About Us url http://www.idera.com/about/aboutus   |  Newtabfooter alias Legal url https://www.idera.com/legal/termsofuse