SCA and LDAP, anyone get this to work?

Hello Hernan,

Let me see if I can assist clear up some of the issues you are having. There are few items which I think a step by step example may assist in this configuration, which follows below;

We have user named Ginger Bread who assigned/created in the domain “tse” within the larger domain “emc.com”. When Ginger logs in he does so by inserting the domain\username, which in this case is “tse\breadg”. Based on this detail we can confirm the base domain for Ginger is “tse.emc.com”.

The “dsquery” results form a string that corresponds to the users location in the LDAP tree, for Ginger his results are;

CN=Bread\, Ginger,OU=Technical Support,OU=AK Anchorage, OU=US TSE,DC=tse,DC=emc,DC=com

1. So, when we authenticate the user “breadg” that correlates to value for the sAMAccountName and it drills down through the tree as follows à com à emc à tse à us tse à ak anchorage à technical support à bread\, ginger

Now we can translate this to the SCA LDAP configuration, which I suggest typing the “Pattern” in backwards (right to left), because once the values run out of the view we can no longer see them.

To leverage Ginger Bread’s LDAP credentials for the domain we will setup the Manage Authentication view as follows;

Domain Name: tse

Server: FQDN OR IP of LDAP Server

LDAP Port: Port being used for LDAP

Base Domain: DC=tse,DC=emc,DC=com

Patterns: CN=Bread\, Ginger,OU=Technical Support,OU=AK Anchorage, OU=US TSE

NOTES:

1. Once this is accepted create a new user defined by Authentication Method LDAP enter valid requirements.
2. Log out
3. Refresh the browser view to recreate the login screen
4. Expand the link “Options>>”
5. Enter valid domain (e.g. tse for Ginger Bread)
   1. Do not append domain name in the User Name: field
6. For our example:
   1. User Name: breadg
   2. Password: tastyTreat
   3. Domain: tse
7. Click login.

I hope this helps you and others setup SCA LDAP authentication and if there are any questions/comments please post back or possibly open an SR if you feel that this needs further investigation.

Cheers,

-RyanT

Hi Hernan,

You will not be required to add a new entry LDAP Pattern for each additional user. SCA will leverage the current parameters in the LDAP configuration to search out and authenticate the next 6 users you create.

Just add a new user and change the authentication to LDAP and proceed.This should allow all your users to login successfully.

Let us know what you find,

-Ryan

Thanks for the feedback. OK, your example works well, HOWEVER...

If I add another user directly under the first, working/authenticated in SCA, SCA/LDAP authentication fails.

(I need to add 6 users altogether, and yes I have added the users in SCA and chose LDAP auth.)

I've tried using comma and semicolon, and without either, to separate the users, but that does not work either. WHAT AM I MISSING HERE?

Example:

Single user setup such as this works!

CN=UserA,OU=Users,OU=NJ

Add a second user, like below, SCA/LDAP authentication breaks, cannot login!

CN=UserA,OU=Users,OU=NJ

CN=UserB,OU=Users,OU=NJ

CN=UserA,OU=Technical Support,OU=AK Anchorage, OU=US TSE

CN=UserB,OU=Technical Support,OU=AK Anchorage, OU=US TSE

Ryan,

Thanks for the clarification. I do believe the carriage return was my issue, so for anyone else having issues, BE VERY CAREFUL with any spaces you can't see when configuring LDAP in SCA, within ALL of the fields of Manage Authentication dialog box.

I have tested with myself and another user, and we can both login successfully with our domain (LDAP) accounts. I will add the other users, very carefully.

Finally, are we limited to only ONE domain? For example, in my case most users are in our North America child domain. Can users in our Europe child domain also use this SCA instance? The Manage Authentication config page appears to allow only 1 domain.

Thanks again,

Be aware and carefully also with this implemenation of LDAP authentication.

When an user try to login the SCA starts from begin of the user list to the end until it gets an successfull login to the LDAP server.

If you use some password security on the LDAP server like account lockout it will increase the counter for each user until SCA hit the correct user.

If you login 3 times (as example if you have lockout account after 3 atempts) into SCA and the other users are  on vacation or didn't login into LDAP during the time you login into SCA to reset the counter they account will get locked.

The whole SCA seems not to be in a public state and is not well designed or developed even if the idea behind will be fine.