WebConsole - Security Options
37
NetLinx Integrated Controllers (Firmware v4)- WebConsole & Programming Guide
LDAP Options
Check the
LDAP
Enabled
option on the right side of this page to make the LDAP options available for selection.
All parameters are case sensitive and must be entered exactly as they are entered into the LDAP database.
LDAP Client Configuration can also be done via terminal commands to the NetLinx Master’s Program Port - see the
section on page 103 for details.
Refer to <$paratext> on page 108 for additional information on implementing LDAP on the NetLinx Master.
The LDAP options are described in the following table:
When LDAP is enabled, users are authenticated using the configuration set up on the LDAP server.
The "
administrator
" user is handled by the local NetLinx Master, and does not connect to the LDAP server for user
verification.
If an administrator password change is desired, LDAP must be disabled, the password changed and saved and then LDAP re-
enabled.
Users may not be added or deleted via the web pages when LDAP is enabled.
AMX equipment users are set up on the LDAP server with either full access to the master or HTTP access only.
User access privileges cannot be changed via the web pages.
As users log onto a NetLinx Master, their username and access privileges are displayed on the User Security Details page
(see
section on page 41). This information is stored in the master's RAM but is not written to
non-volatile memory, and is lost after a reboot of the Master.
If a user is removed from the LDAP directory tree, access is denied, and if that username is on the master's User Security
Details web page it is removed.
Configuring ICSP Connectivity with LDAP Enabled
If ICSP connectivity security is desired, the username and password must be set up on the LDAP server and its DN added as a
member to the administrator groupOfNames objectClass. This username and password must also be present on the master due to
the authentication algorithms used for this type security. Before LDAP is enabled, a user account must be set up with the
username, password and privileges matching the ones stored on the LDAP server.
If there is a mismatch with the username or password, the AMX hardware or software component will not be allowed
access.
If there is a mismatch with the access privileges, the master will use the privileges value stored on the server.
Accepting Changes
Click the
Accept
button to save changes on this page. Accepting changes is instantaneous and does not require a reboot.
LDAP Options
Option
Description
LDAP Enabled:
This parameter enables the LDAP configuration parameters described below.
LDAP URI:
This parameter has the syntax
ladp[s]://hostname:port
.
• The
ldap:// URL
is used to connect to LDAP servers over unsecured connections.
• The
ldaps:// URL
is used to connect to LDAP server over Secure Sockets Layer (SSL) connections.
• The
hostname
parameter is the name or IP address, in dotted format, of the LDAP server (for example,
LDAPServer01
or
192.202.185.90
).
• The
port
parameter is the port number of the LDAP server (for example,
696
).
Note: The standard unsecured port number is 389 and the standard secured port number is 636.
LDAP BASE DN:
This parameter specifies the Distinguished Name (DN) of an entry in the directory. It identifies the entry that
is the starting point of the user search.
BIND DN:
This parameter specifies the Distinguished Name (DN) to use to bind to the LDAP server for the initial search
for the user's DN.
User Query Attr.
This LDAP attribute is used for the AMX equipment user search (for example, UID).
Note: This attribute MUST be unique in the context of the LDAP BASEDN or the search will fail.
Search Password:
This is the password used for the initial bind to the LDAP server - it is the password associated with BIND
DN.
Admin groupOfNames cn: This parameter is the common name (cn) of the groupOfNames objectClass that contains the member DNs
of the AMX equipment users that have administrator privileges.
User groupOfNames cn:
This parameter is the common name (cn) of the groupOfNames objectClass that contains the member DNs
of the AMX equipment users that have only user privileges.