Configuring Domino To Be An Ldap Directory And To Use An Ldap Directory

1900 – Configuring Domino to Be an LDAP Directory and to Use an LDAP Directory Rob Fox, Paul Godby, & Moacyr Mallemont

Copyright IBM Corporation 2006. All Rights Reserved. This presentation is intended to assist IBM SWG Sales and their business partners in understanding IBM Software marketing tactics, sales tactics, and our direction during 2006. This presentation can be used in sales situations except individual charts labeled VENDOR CONFIDENTIAL or IBM CONFIDENTIAL, in which case they should be considered confidential under the practices in place in your firm and under any existing agreements with IBM regarding disclosure of confidential information. For questions or to request permission for any other use of the information or distribution of the presentation, please contact any member of the IBM software sales team.

1900 – part I - Configuring Domino for LDAP By Rob Fox & Paul Godby January 20 th , 2006 – 10:15 am

The Agenda What is LDAP? The Anatomy of LDAP Identifying the LDAP server and its attributes Deciphering the LDAP schema Information and Configuration of LDAP for Domino servers Making Lotus Domino an LDAP server to be used by IBM WebSphere Portal Troubleshooting and Diagnostics Extra -- Mapping the LDAP attributes to a client application: WebSphere Portal and Lotus Workplace

Objective The objective of this presentation is to provide you with the following: Basic understanding of LDAP Understanding of proper usage of LDAP How LDAP relates to Lotus Domino

The Agenda What is LDAP? The Anatomy of LDAP Identifying the LDAP server and its attributes Deciphering the LDAP schema Information and Configuration of LDAP for Domino server Making Lotus Domino an LDAP server to be used by IBM WebSphere Portal Troubleshooting and Diagnostics Extra -- Mapping the LDAP attributes to a client application: WebSphere Portal and Lotus Workplace

What is LDAP? LDAP stands for Lightweight Directory Assistance Protocol Comes from the need of a smaller, less complex version of X.500, another Directory Access protocol (DAP) for directory assistance LDAP is much simpler to implement and develop for, and runs on top of TCP/IP unlike X.500 The defacto standard for client name lookups to a server used by millions of corporations and billions of users*.. *Statistic is made up. Did you know 56% of statistics are made up?

Who made LDAP? (hint – me) A bright young IBM engineer named Rob Fox. Okay, I lied. Open Standard defined by Internet Engineering Task Force (IETF) Original implementation of LDAP as server was University of Michigan Architecture designed to LDAP v3 specification Replication and Access Control are not yet standardized in LDAP v3 specification LDUP - Lightweight Directory Update Protocol draft Access Control - working standard (no acronym)

What do we use LDAP for? Corporations need an “address book” of all names and groups within the company. All of these names and groups can be stored on a dedicated server called a “Directory Server” LDAP is the standard protocol for name & group lookup on a directory server A centralized LDAP Directory Server means all applications have access to one consistent name & address book.

Anatomy of LDAP Connector Database full of Names and Addresses Magic Happy User My LDAP Directory Server Joe Mama Angie Daddy Terd Ferguson Art Major Rob Fox Travis Womack … .

Anatomy of LDAP LDAP consists of attributes, objects and values arranged in a hierarchy. Getting access to these objects is generally done by binding to the server and using search filters to find specific information. The LDAP structure can be created or modified by hand, or imported via a file called an ‘LDIF file’.

Anatomy of LDAP Objects are generally the people or groups stored in the LDAP directory. These are arranged in a hierarchal tree Example: cn=us -> o=IBM -> ou=Lexington -> cn=Users -> uid=rfox would tell us that user rfox is in the Lexington group which is part of the IBM organization in the US.

Anatomy of LDAP An attribute is a specific item defined in an entry, and a value is what it is.. Example: givenname=Rob sn=Fox mail=rob_fox@us.ibm.com phonenumber=888-555-1212

Anatomy of LDAP An LDIF is a file that has these objects and attributes already defined in a text format that can be imported into a directory server Importing a LDIF is the easiest (and recommended) way to set up your own LDAP server For Domino, use the LDIF Domino Upgrade Service in the Administration client to import users The final location of the LDIF users in the LDAP tree is determined by the cert ID used while importing The service will not process LDIF group entries

Talking to an Existing LDAP There are only 3 things you need to consume data from an existing LDAP server: Fully qualified DNS name or IP address (and port if it’s not the default of 389) Base DN for searching Credentials Typically customers want to deploy applications and web servers using their existing LDAP in their infrastructure – so lets see how to do that…

Get proper LDAP connection information Get the fully qualified DNS name and port: The name and location of the server, and the port the LDAP service is listening on Get the base DN: The first place in the LDAP hierarchy tree to begin looking for names Get a sample user name to bind to if necessary: Determine if anonymous binding is allowed, and if the attributes needed are returned when bound anonymously. If a user is needed, determine the format of the name and password to connect to the LDAP server Note: Active Directory typically will not list any users or groups if bound to anonymously

The Pieces of an LDAP DN… Here is a standard user full distinguished name: uid=wpsadmin,ou=users,dc=lexington,o=ibm

The Pieces of an LDAP DN… user prefix org unit uid=wpsadmin,cn=users,ou=lexington,o=ibm user suffix base DN

Acquire the proper tools… LDAPSearch utility Command-line utility shipped with Domino and Notes Softerra LDAP Browser or… Softerra LDAP Administrator or… Java based LDAP Browser (can import LDIF files) Found on Google

Using ldapsearch Can be used to search entries in any LDAP directory Connects to a directory server and returns results you specify Located in the Domino or Notes program directory

Using ldapsearch Syntax for ldapsearch: ldapsearch parameters searchfilter attributes -b baseDN for your search -D username to bind with -w password to bind with -h ldap server name -p port to query on the ldap server

Using ldapsearch Sample usage of ldapsearch: Use an authenticated bind to search under the baseDN cn=users,ou=lexington,o=databeam for a user with the common name of Homer Simpson: ldapsearch -h ldapserver.databeam.com -p 389 -D "cn=wpsbind,cn=users,ou=lexington,o=databeam" -w password -b "cn=users,ou=lexington,o=databeam" "cn=Homer Simpson"

Configuring Softerra… Add a profile name Add the FQDN of the LDAP server Add the base DN desired (or fetch them) Add a binding name to verify the correct format of a user Note: If you can bind with a long LDAP name, then the application (Sametime, Workplace, etc) can find the user when configuration is complete – bind with users to verify they exist and are in the correct format!

Gather information about the LDAP user… Determine if you want to log in with ‘cn’ or ‘uid’ or another attribute. Make sure an objectclass such as ‘inetOrgPerson’ exists. Determine the email attribute – typically ‘mail’. Look for a unique identifier – IDS5.1 user ‘ibm-appuuid’, Domino 6.5.4+ user ‘dominoUNID’ Most importantly – right click on the name to get the long LDAP name, for example: uid=wpsadmin,cn=users,dc=ibm,dc=com

Gather information about the LDAP user…

Gather information aboot the LDAP group… Determine what attribute designates the name of the group – typically ‘cn’ Determine the objectclass of the group – typically ‘groupOfUniqueNames’ or ‘groupOfNames’ Determine the member attribute name – typically ‘uniquemember’ or ‘member’ Make sure a unique identifier exists like ‘ibm-appuuid’ Again importantly: Right click on the name to get the long LDAP name (full DN): cn=wpsadmins,cn=group,dc=ibm,dc=com

Configure Domino to use a remote LDAP directory Directory Assistance allows you to lookup information in a directory other than the local primary Domino directory Domino Directory, Extended Directory Catalog, LDAP Create a Directory Assistance document in the Directory Assistance database (often named da.nsf) The Active Directory Domino Upgrade Service (AD DUS) can be used in conjunction with the Active Directory Synchronization (AdSync) to maintain the same set of users in AD and Domino

Domino 7 LDAP service improvements Improved performance LDAP server thread pooling DA LDAP miss caching DDM LDAP server health monitoring Addition of aliases Support of universal Notes Ids (UNID) New “dominoUNID” operational attribute Enhanced LDAP search Now work with IBM Workplace products that use the WebSphere Member Manager (WMM) service to access user/group objects.

Starting the Domino LDAP service The LDAP task runs automatically on the admin server for the primary Domino directory To start automatically: Edit the “ServerTasks” setting in Notes.ini to include LDAP To start manually: Enter “Load LDAP” on the Domino console

Enable/Disable write access to the directory By default, the LDAP service does not allow write access To Enable write access: Open the directory using the Domino Admin Client Select the Servers  Configuration view Open the Configuration Settings document for the domain Create this document if it does not exist On the LDAP tab, set “Allow LDAP users write access” to Yes Restart each server in the domain running the LDAP service

Using Domino as your LDAP server for Lotus Workplace… Add a ‘wpsadmin/domain’ user and ‘wpsadmins/domain’ group with manger access to the Domino directory – make sure the username and groupname field include the ‘/domain’ or they will NOT show up in Domino. Configure the wpconfig.properties file as before except do NOT fill out the LDAPSuffix (base DN) – rather, use the user and group suffix fields. If there is an ou, put that in front like ‘ou=lexington,o=databeam’.

Using Domino as your LDAP server for Lotus Workplace… Domino servers below 6.5.4 MUST do the following: Create a field called ‘dominoUNID’ in the Person, Group and Certifier forms with the computed text value of: @Text(@DocumentUniqueID) Create an agent to open/close/save all documents in the Domino Directory so the new field is computed and populated – verify the field shows up in LDAP by reloading the schema.

Using Domino as your LDAP server for Lotus Workplace… Edit <WP_root>\shared\app\wmm\wmm.xml and <WP_root>\wmm\wmmLDAPServerAttributes.xml to use Domino attributes (including the one you just created) so WebSphere Member Manager will recognize users. Change the WAS Admin user search filter and user id map: User search filter: (&(|(cn=%v)(mail=%v)(uid=%v))(objectclass=inetOrgPerson)) User ID map: *:uid Restart all services and servers.. It should work! (heh, yeah right)

Troubleshooting… Q.) It doesn’t work. A.) Sorry, works for me. Q.) No Seriously… I followed all the steps for setting up Directory Assistance to an external LDAP directory, but user authentication still fails. A.) Domino will check the local directory for a username BEFORE using Directory Assistance to check the external directory. Make sure the name you are trying to authenticate with does not exist in the local Domino Directory.

Troubleshooting… Q.) Help! When using Domino as my LDAP server the searches are very slow! A.) Create a full-text index for the directory. If it’s still slow, limit the number of entries returned or create a timeout. Q.) My searches against my Domino LDAP server do not return a CN value. My “co-workers” configured that part…not me. What did they do wrong? A.) They likely added users to the directory without using Notes registration. You will have to add the common name as a second value in the FullName field of the Person documents.

Bonus Level - Applying Our LDAP Experience in the Real World In the “real world” companies take their many applications and point to their LDAP server Having a centralized LDAP reduces management of multiple directories such as new passwords, name changes, department updates, etc Many IBM products can hook into an existing LDAP directory for authentication, user information, etc..

Bonus Level - Applying Our LDAP Experience in the Real World IBM Lotus Web Conferencing and Instant Messaging (Sametime) IBM Lotus Team Spaces (QuickPlace) IBM WebSphere Portal IBM Lotus Workplace These products use LDAP for user authentication, authorization and mapping of names to specific application needs

Bonus Level - Applying Our LDAP Experience in the Real World To get some hands on experience, we are going to configure IBM WebSphere Portal to use an existing LDAP server. This procedure is exactly the same for configuring IBM Lotus Workplace. These same principles apply to other applications such as Sametime and QuickPlace.

Bonus Level - Configure wpconfig.properties file… Located C:\WebSphere\PortalServer\config The LDAP section is at the bottom – we simply map the attributes and data we discovered with Softerra to the fields in the file Once wpconfig.properties is verified (twice) to be correct, in that same directory we run this script: WPSconfig enable-ldap-security > enablesecurity.log ‘ server1’ is the only server that should be running – stop ‘WebSphere_Portal’ and ‘LotusWorkplace_Server’ before running the script – run this to see what is up: serverStatus –all –username wpsadmin –password password Activity is logged to this file (tail –f to see it) – do a search to make sure no ‘FAILED’ messages appeared

Bonus Level - Configure wpconfig.properties file…

Bonus Level - Configure wpconfig.properties file… The ‘cn=root’ user is the administrator of the LDAP server with read/write access. The ‘wpsadmin’ user that was added should read/write access as well – they can be used as the Wps.LDAPAdminUId instead. Notice which entries use a short name and a long name. The ‘wpsadmins’ group is not checked when the script is run – VERIFY with Softerra it exists! If you see any BUILD FAILED messages in the enablesecurity.log file, examine the fields in the previous slide again and rerun the script – there should be NO ‘BUILD FAILED’ scripts. If you see SQL errors you may need to delete rows and read them with the DB2 Command Center if said tables with errors have primary keys in them.

Bonus Level - Verify ‘wpsadmin’ and ‘wpsadmins’ exist properly… Now is a good time to make sure the ‘wpsadmin’ user exists, the ‘wpsadmins’ group exists, and ‘wpsadmin’ exists in the ‘wpsadmins’ group. If your LDAP browser doesn’t show these two entries properly, DON’T PROCEED until they do!

Bonus Level - Hoping it works… The script shouldn’t take that long to run.. Either ‘tail –f’ the enablesecurity.log or entertain yourself in other productive ways:

Bonus Level - It works! (Da Da Da Dah!) Stop all servers (including IBM HTTP) and restart all servers. Log into Portal: http://nameofserver.domain.com/wps/portal or log into Workplace: http://nameofserver.domain.com/lwp/workplace verify the Web Conferences and Team Spaces places work properly

What you (should have) learned You now have the following information at your disposal thanks to this presentation: Basic understanding of LDAP, how it works, how it is put together and how to configure it Understanding of proper usage of LDAP including where and how to find names, and understand an LDAP schema How LDAP relates to our product suite and how to map attributes from an existing LDAP for client consumption and how to customize Domino into an LDAP server for the IBM product suite

1900 – part II – Linux Desktop Authentication Using Domino LDAP Moacyr Mallemont – IT Specialist Lotus/IBM Software Group

Session Objectives Provide an overview (step-by-step) on how to configure the Domino LDAP service to allow Linux desktop authentication. Show how easy is to integrate Domino and Linux and have an end-to-end Domino solution running on Linux

Agenda Requirements PAM configuration Extending the Domino LDAP Schema Enabling the Domino LDAP service as the default Linux directory Authenticating Setting up Domino to allow password changes from Linux prompt Troubleshooting

Requirements Default domino installation on a linux system (we used Domino 6.5.4 and RedHat AS 2.1) Domino Administrator and Designer Download and compile pam_ldap and nss_ldap on the Linux desktop client Knowledge on how to compile linux applications (it is really easy :)

PAM Configuration – What is pam and nss?

PAM Configuration – Making a ldap search

PAM Configuration – setting up ldap.conf file

PAM Configuration – Setting up ldap.secrets file

Extending the Domino LDAP Schema – “LDAP POSIX Account” subform

Extending the Domino LDAP Schema – Creating the fields

Extending the Domino LDAP Schema – Insert the subform in the form “$PersonExtensibleSchema”

Extending the Domino LDAP Schema – Reload the LDAP Schema

Extending the Domino LDAP Schema - Verify the new fields in the LDAP Schema

Enabling the Domino LDAP service as the default Linux Directory – User Information Config

Enabling the Domino LDAP service as the default Linux Directory – Authentication Config

Enabling the Domino LDAP service as the default Linux Directory – Authenticating a Domino user!

Enabling the Domino LDAP service as the default Linux Directory – Creating home directories

Enabling the Domino LDAP service as the default Linux Directory – the “id” command

Setting up Lotus Domino to allow password change for LDAP users – Configuration Document and rights in the NAB ACL

Setting up Lotus Domino to allow password change for LDAP users – “Allow LDAP users write=yes”

Setting up Lotus Domino to allow password change for LDAP users - Advanced ACL

Setting up Lotus Domino to allow password change for LDAP users – Changing an user password from the Linux prompt

Troubleshooting Ldapsearch If you can’t run the suggested searches in this presentation, don’t go ahead to the next step. Try to understand what is going on! Password change from Linux Desktop If password change does not work, verify user rights in the NAB ACL, and the ldap.conf & ldap.secrets files. User root cannot login anymore! Use single user mode (in rescue) and clean every entry in the /etc/nsswitch.conf that has ldap references. While configuring and testing you can let “some” root sessions open that will allow you to fix your system.

Summary It can be very easy to integrate domino with other systems Domino uses and make use of open standards and protocols, that’s why it is so flexible! This is just another example on how Domino can be used to reduce the TCO of IT Solutions There are more complete solutions that should be evaluated as Tivoli solutions that are much more complete and can do much more If you already has Domino, your investments are preserved and extended - start integrating today!

Resources http://www.padl.com/Contents/OpenSourceSoftware.html http://www.redhat.com/docs/manuals/linux/RHL-7.3-Manual/ref-guide/s1-ldap-extrafunctionality.html http://www.ibm.com/dominolinux http://www-306.ibm.com/software/tivoli/solutions/security/

Configuring Domino To Be An Ldap Directory And To Use An Ldap Directory

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Configuring Domino To Be An Ldap Directory And To Use An Ldap Directory (20)

Recently uploaded (20)

Configuring Domino To Be An Ldap Directory And To Use An Ldap Directory

Editor's Notes