© 2009 GroundWork Open Source, Inc. PROPRIETARY INFORMATION: Information contained herein is not for use or disclosure outside of GroundWork Open Source,

© 2009 GroundWork Open Source, Inc.PROPRIETARY INFORMATION: Information contained herein is not for use or disclosure outside of GroundWork Open Source, Inc. © 2007 GroundWork Open Source, Inc.

Getting Started with GroundWork Monitor

GroundWork Monitor Enterprise Edition 6.2

Page 1

© 2009 GroundWork Open Source, Inc.

Integration with Active Directory

Requirements Getting it going Setting up Groups and Roles Disabling default authentication

Integration with OpenLDAP

• Requirements• Getting it going• Groups and Roles again

LDAPS

• Requirements• Setup• Certificates export and import

Course Objectives for this Module

Getting Started with GroundWork Monitor

Page 2

© 2009 GroundWork Open Source, Inc. Page 3

GroundWork Monitor Enterprise Edition 6.2Module 8 : LDAP for AD, Open LDAP and LDAPS Setup


Resource How-to: Home > USING APPLICATIONS > Operational How To's

• Some important points:

• LDAP users cannot be assigned to roles using the portal administrator

application• LDAP users do NOT need to be defined in the portal (this is different from

GroundWork Monitor 5.x)• Configuration of LDAP parameters is done outside of the User Interface,

and requires a restart of gwservices.• Role Names have changed

• User is now GWUser• Operator is now GWOperator• Admin is now GWAdmin

Active Directory

LDAP Authentication Configuration

Page 4

http://themisto.groundwork.groundworkopensource.com/bookshelf-data/Welcome_to_GroundWork_Monitor/index.htm

http://themisto.groundwork.groundworkopensource.com/bookshelf-data/Using_Applications/usingapplications_aboutusingapplications.htm

http://themisto.groundwork.groundworkopensource.com/bookshelf-data/Using_Applications/usingapplications_aboutusingapplications.htm


Required:

• Active Directory domain controller to which you have access

• Account with rights to browse the container in which you store the users:

Example: ldapauth, context:

cn=ldapauth,ou=GWUsers,dc=demo,dc=com

Optional:

• Roles in the portal for desired access levels

• A container and groups set up to match roles in the portal

Useful:

• Adsiedit.msc

Active Directory: Requirements


Page 5


Organizational Unit (OU) GWUsers

Groups in the OU GWUser

GWAdmin

GWOperator

Users and membership ldapauth

admin GWAdmin

test1 GWOperator

test2 GWUser

test3

Active Directory: Sample Set of Users and Groups


Page 6


Edit login-config.xml

Copy and paste the section from the how-to

Change the AD server name or IP address

Change the LDAP admin user and password

Change the contexts for the LDAP admin and users, roles

Restart the portal (gwservices)

Test the login

Active Directory: Getting it going


Page 7


Add roles to the portal

Example:

Add Executive role

Allow view to reports tab to Executive role

Add groups to AD

Example:

Add Executive group

Add user to Executive group

Test the login

Active Directory: Setting up groups and roles


Page 8


• Roles are additive• There is no (easy) way to change the automatic mapping of all AD users to the

the GWUser role in the portal. Restrict this role if you do not want all users to

have the default apps.

Active Directory: Notes about Roles


Page 9


A good idea… because…

LDAP Users are stored in portal with no password

LDAP failure means all can login without password

For instance is a user is deleted from LDAP…

Easy to do (and undo):

Edit login-config.xml:

Comment out DBIdentityLoginModule section

Change “sufficient” to “required” in

SynchronizingLDAPExtLoginModule section

Restart gwservices

Disabling Default Authentication


Page 10


Some important points:

• OpenLDAP is hard to configure. • OpenLDAP allows anonymous browsing by default. This can be a bad thing.

Always configure GWME to use a user to access containers.• The user must have access to browse the tree in the User and Role context

containers

OpenLDAP


Page 11


Required:• An OpenLDAP server• Administrative access to OpenLDAP (for setting up Users and Roles)• A user account with rights to scan the containers for Users and Roles

Useful:• LDAP browser

OpenLDAP: Requirements


Page 12


Login to the OpenLDAP server and set up the Users container (default is

ou=People)

Set up the Roles container

Add users to Users container

Add users to roles

It is a good idea to test your LDAP user login for browsing. Note: root user is

cn=manager by default, and while the uid=root object is in the People

container, the context is the default, for example:

cn=manager,dc=groundworkers,dc=com

OpenLDAP: Getting it Going


Page 13



Paste in the same text from the how-to as you would for active directory

Change the LDAP server from the default to your OpenLDAP server

Change the bindDN to the LDAP auth user

Change the bindCredential to the LDAP auth user’s password

Change the contexts for users and roles, and make sure to change the

format of the role filter and attributes. These differ from AD.

Restart gwservices

Test login

OpenLDAP: Getting it Going


Page 14


Setting up Role-based access in GWME and OpenLDAP is similar to the process

with AD.

The main differences are:

OpenLDAP uses a separate container for the Roles (technically, groups), while AD

typically places the groups in the same container as the users.

To set up, match the roles in GWME to the roles in OpenLDAP as you would for

AD, and add users to roles in OpenLDAP.

OpenLDAP: Roles and Groups


Page 15


LDAPS is LDAP over SSL.

Some important points:

LDAPS requires a certificate. Administrators will likely already have this as a text

files somewhere safe. This process goes through extracting the certificate, so

care should be taken to use the correct parts of this procedure.

LDAPS


Page 16


An OpenLDAP server with LDAPS turned on.

The OpenLDAP setup completed as above, but stop before you restart the

portlal.

LDAPS: Requirements


Page 17



Add the setting for SSL

Change the LDAP server protocol and port

Extract the cert from OpenLDAP (unless the administrator already has it)

Run the openssl command

Grab the cert from the output and place it in a text file (example ldaps.pem)

Import the cert into JBoss

Run the keytool command

Restart gwservices

LDAPS:Setup


Page 18


If the LDAP logins do not work:

Check the framework.log file for startup errors. A simple problem with an XML

tag can keep a module from loading and working.

Enable debug for the org.jboss.security class, and look in the framework.log for

JNDI error and debug messages. Errors will be in the form of java exceptions.

Double check that you can log in with a LDAP client with the LDAP auth user

and password, as entered in the login-config.xml. Also check a test user in

user context.

Log files in AD and OpenLDAP may also give clues.

Troubleshooting


Page 19

© 2009 GroundWork Open Source, Inc. Page 20

GroundWork Open Source, Inc.

139 Townsend Street, Suite 500

San Francisco, CA 94107

Phone: 415.992.4500

Website: www.gwos.com

Email: [email protected]

GroundWork Subscription Support: support.gwos.com

Confidential - Do not distribute

Thank you

http://www.gwos.com/

mailto:[email protected]

http://www.groundworkconnect.com/

Documents

© 2009 GroundWork Open Source, Inc. PROPRIETARY INFORMATION: Information contained herein is not for use or disclosure outside of GroundWork Open Source,