Eaton Network-M3, User Manual

Page: 179 / 294

Configuring/Commissioning/Testing LDAP
Servicing the Network Management Module – 179
1.
2.
3.
4.
a.
b.
5.
6.
7.
1.
2.
4 Servicing the Network Management Module
4.1 Configuring/Commissioning/Testing LDAP
4.1.1 Commissioning
Refer to the section Contextual help>>>Settings>>>Remote users>>>LDAP to get help on the configuration.
4.1.1.1 Configuring connection to LDAP database
This step configures the LDAP client of the network module to request data from an LDAP base.
Activate LDAP.
Define security parameters according to LDAP servers' requirements.
Configure primary server (and optionally a secondary one).
If security configuration needs server certificate verification, import your LDAP server certificate.
Refer to the section to get help on certificate import.
In case LDAP server certificate is self-signed, import the self-signed certificate in the Trusted remote certificate list
for LDAP service.
in case LDAP server certificate has been signed by a CA, import the corresponding CA in the
Certificate authorities
(CA) list for LDAP service.
Configure credentials to bind with the LDAP server or select anonymous if no credentials are required.
Configure the Search base DN.
Configure the request parameters (see examples below).
4.1.1.1.1 Typical request parameters
Parameter OpenLDAP Active Directory™ with POSIX account
activated Active Directory™
User base DN ou=users, dc=example, dc=com ou=users, dc=example, dc=com ou=users, dc=example, dc=com
User name attribute uid uid sAMAccountName
Group base DN ou=groups, dc=example, dc=com ou=groups, dc=example, dc=com ou=groups, dc=example, dc=com
Group name attribute gid gid sAMAccountName
4.1.1.2 Map remote users to profile
Configure the rules to mapped LDAP users to profile:
Enter LDAP group name.
Select the profile to assigned.
You can define up to 20 mapping rules.
All LDAP users belonging to the configured LDAP group will have permissions granted by the associated profile.
This step is mandatory and configures the Network module to give permissions to the LDAP users.
Users not belonging to a group mapped on a profile will be rejected.