3.
Issue the
checkpassword
command to verify that the users have the roles you assigned for
the desired groups. Use a member of a specific group to verify the role.
Example
:
system1 cli% setauthparam -f edit-map CN=Software,CN=Users,DC=3par,DC=com
system1 cli% setauthparam -f browse-map CN=Eng,CN=Users,DC=3par,DC=com
In the example above:
•
Users belonging to the
Software
group are configured to have Edit rights within the
system.
•
Users belonging the
Eng
group are configured to have Browse rights within the system.
system1 cli% checkpassword 3PARuser
...
+ search result: memberOf: CN=Software,CN=Users,DC=3par,DC=com
+ search result: memberOf: CN=Eng,CN=Users,DC=3par,DC=com
+ search result: memberOf: CN=Golfers,CN=Users,DC=3par,DC=com
+ mapping rule: edit mapped to by CN=Software,CN=Users,DC=3par,DC=com
+ rule match: edit mapped to by CN=Software,CN=Users,DC=3par,DC=com
+ mapping rule: browse mapped to by CN=Eng,CN=Users,DC=3par,DC=com
+ rule match: browse mapped to by CN=Eng,CN=Users,DC=3par,DC=com
user 3PARuser is authenticated and authorized
In the example above:
•
3PARuser
is found to be a member of the
Software
group and is assigned Edit rights
within the system.
•
Although
3PARuser
is also a member of the
Eng
group, the Edit rights associated with
the
Software
group supersede the Browse rights associated with the
Eng
group.
•
The mapping rules set for
3PARuser
are applied to all members of the
Software
group
and
Eng
group; all
Software
group members have Edit rights within the system and all
Eng
group members have Browse rights within the system.
OpenLDAP Configuration with Simple Binding Over SSL
To configure your system to use OpenLDAP with simple binding over SSL, the following process
must be performed (detailed instructions follow):
•
Configure connection parameters using the following command:
setauthparam ldap-server <IP_address>
◦
◦
setauthparam ldap-ssl 1
•
Configure binding (authentication) parameters using the following commands:
setauthparam binding <binding_type>
◦
◦
setauthparam user-dn-base <value>
◦
setauthparam user-attr <attribute>
•
Configure group location parameters using the following commands:
setauthparam groups-dn <value>
◦
◦
setauthparam group-object <group_object_class>
Configuring LDAP Connections
33