b.
Select the
Details
tab.
c.
Click
Copy to File....
d.
Click
Next
.
e.
Select
Base-64 encoded x.5098
format.
f.
Click
Next
.
g.
Click
Browse...
and select a filename for the certificate (ending in the
.cer
file extension)
and a folder in which the certificate will be stored.
h.
Click
Next
and then
Finish
.
Or, use the
openssl x509
program.
3.
Set the certificate using the
setauthparam ladp-ssl-cacert <certicate>
command,
where
<certificate>
is the name of the certificate you previously located or converted.
Example
:
openssl x509 -inform DER -in ca.crt -outform PEM -out ca.cer
In the example above, the
openssl x509
command is used to convert the CA certificate
from
ca.crt
format to
ca.cer
format, which can then be used with the
setauthparam
command.
setauthparam -f ldap-ssl-cacert ca.cer
In the example above, the
setauthparam
command is issued to set the CA certificate to the
ca.cer
file.
Configuring Account Location Parameters
To configure the account location parameters:
1.
If you are unsure of the user’s account information, select a known user’s full name (to be
entered as the
cn
value) and run the
ldapsearch
command using the
defaultNamingContext
value previously displayed in
“Configuring Connection Parameters”
(page 28)
. Make a note of the group information displayed in the command’s output.
2.
Issue the
setauthparam accounts-dn <DN_path>
command.
3.
Issue the
setauthparam account-obj user
command.
4.
Issue the
setauthparam account-name-attr sAMAccount
command.
5.
Issue the
setauthparam memberof-attr memberOf
command.
NOTE:
You must know the user’s password in order to successfully use the
checkpassword
command.
6.
Issue the
checkpassword
command to obtain information about the user’s group memberships
from the LDAP server.
Example
:
% ldapsearch -LLL -x -H ldap://192.168.10.13 -D 'NTDOM1\joeadmin' -W -b
DC=3par,DC=com -s sub '(cn=3PARuser)' dn
Enter LDAP Password:
dn: CN=3PAR User,OU=Engineering,OU=Users,DC=3par,DC=com
30
Managing User Accounts and Connections