OpenManage Enterprise 4.0.x User's Guide

Add or edit LDAP connection

Add or edit properties of Lightweight Directory Access Protocol (LDAP) groups that must be used with directory services. Use either DNS or manual methods to select domain controllers.

1. Click Application Settings > Users > Directory Services, and then click Add.
2. In the Connect to Directory Service dialog box, select the Type of Directory as LDAP.
   NOTE:To create an AD user group by using Directory Services, see Add or edit the Active Directory connection.
   1. In the Directory Name box, enter a name for the LDAP directory.
   2. Select the Domain Controller Lookup method:
      • DNS: In the Method box, enter the domain name to query DNS for the domain controller.
      • Manual: In the Method box, enter the FQDN or the IP address of the domain controller. For multiple servers, you can use a comma-separated list with a maximum of three servers.
   3. Enter the LDAP Bind Distinguished Name (DN) and password.
      NOTE:Anonymous bind is not supported for AD LDS.
3. In the Advanced Options section:
   1. By default, in the Server Port field, the LDAP port number 636 is populated. To change, enter a port number.
      NOTE:Only LDAPS ports are supported.
   2. To match the LDAP configuration on the server, enter the group base DN to search for.
   3. In the Attribute of User Login field, enter the user attributes that are already configured in the LDAP system. It is recommended that this value is unique within the selected Base DN. Else, provide a Search Filter to ensure that it is unique.
      NOTE:

      • The user attributes should be configured in the LDAP system that is used to query before integrating on the directory services.
      • You must enter the user attributes as cn or sAMAccountName for AD LDS configuration and UID for LDAP configuration.
      • If more than one user DN is found for the search combination of attribute and search filter, the login operation fails.
   4. In the Attribute of Group Membership box, enter the attribute that stores the groups and member information in the directory.
   5. Enter the Network Timeout and Search Timeout duration in seconds. The maximum timeout duration that is supported is 300 s.
      NOTE: To avoid timeouts when using Manual Lookup on multiple domain controllers, ensure that the cumulative Search Timeout value does not exceed the Network Timeout value. For example, for a list of three domain controllers, and a Network Timeout value of 300 s, the Search Timeout must not exceed 100 s.
   6. To upload an SSL certificate, select Certificate Validation and click Select a file. The certificate should be a root CA Certificate encoded in Base 64 format.
   The Test connection button is enabled.
4. Click Test connection, and then enter the bind user credentials of the domain to be connected to.
   NOTE:While testing the connection, ensure that the Test username is the value of the Attribute of User Login entered previously.
5. Click Test connection.
   In the Directory Service Information dialog box, a message is displayed to indicate a successful connection.
6. Click OK.
7. Click Finish.