Configuring Domino To Be An Ldap Directory And To Use An Ldap Directory

®

IBM Software Group

© IBM Corporation

1900 – Configuring Domino to Be an LDAP Directory and to Use an LDAP Directory

Rob Fox, Paul Godby, & Moacyr Mallemont

IBM Software Group

Copyright IBM Corporation 2006.All Rights Reserved.

This presentation is intended to assist IBM SWG Sales and their business partners in understanding IBM Software marketing tactics, sales tactics, and our direction during 2006.

This presentation can be used in sales situations except individual charts labeled VENDOR CONFIDENTIAL or IBM CONFIDENTIAL, in which case they should be considered confidential under the practices in place in your firm and under any existing agreements with IBM regarding disclosure of confidential information.

For questions or to request permission for any other use of the information or distribution of the presentation, please contact any member of the IBM software sales team.

®

IBM Software Group

© IBM Corporation

1900 – part I - Configuring Domino for LDAP

By Rob Fox & Paul GodbyJanuary 20th, 2006 – 10:15 am

IBM Software Group

The Agenda

What is LDAP?

The Anatomy of LDAP

Identifying the LDAP server and its attributes

Deciphering the LDAP schema

Information and Configuration of LDAP for Domino servers

Making Lotus Domino an LDAP server to be used by IBM WebSphere Portal

Troubleshooting and Diagnostics

Extra -- Mapping the LDAP attributes to a client application: WebSphere Portal and Lotus Workplace

IBM Software Group

Objective

The objective of this presentation is to provide you with the following:Basic understanding of LDAP

Understanding of proper usage of LDAP

How LDAP relates to Lotus Domino

IBM Software Group

The Agenda

What is LDAP?

The Anatomy of LDAP



Information and Configuration of LDAP for Domino server




IBM Software Group

What is LDAP?

LDAP stands for Lightweight Directory Assistance Protocol

Comes from the need of a smaller, less complex version of X.500, another Directory Access protocol (DAP) for directory assistance

LDAP is much simpler to implement and develop for, and runs on top of TCP/IP unlike X.500

The defacto standard for client name lookups to a server used by millions of corporations and billions of users*..

*Statistic is made up. Did you know 56% of statistics are made up?

IBM Software Group

Who made LDAP? (hint – me)

A bright young IBM engineer named Rob Fox. Okay, I lied.

Open Standard defined by Internet Engineering Task Force (IETF)

Original implementation of LDAP as server was University of Michigan

Architecture designed to LDAP v3 specification

Replication and Access Control are not yet standardized in LDAP v3 specification

LDUP - Lightweight Directory Update Protocol draft

Access Control - working standard (no acronym)

IBM Software Group

What do we use LDAP for?

Corporations need an “address book” of all names and groups within the company.

All of these names and groups can be stored on a dedicated server called a “Directory Server”

LDAP is the standard protocol for name & group lookup on a directory server

A centralized LDAP Directory Server means all applications have access to one consistent name & address book.

IBM Software Group

The Agenda

What is LDAP?

The Anatomy of LDAP







IBM Software Group

Anatomy of LDAP

ConnectorDatabase full of

Names andAddresses

Magic

Happy User

My LDAP Directory ServerJoe MamaAngie DaddyTerd FergusonArt MajorRob FoxTravis Womack….

IBM Software Group

Anatomy of LDAP

LDAP consists of attributes, objects and values arranged in a hierarchy.

Getting access to these objects is generally done by binding to the server and using search filters to find specific information.

The LDAP structure can be created or modified by hand, or imported via a file called an ‘LDIF file’.

IBM Software Group

Anatomy of LDAP

Objects are generally the people or groups stored in the LDAP directory.

These are arranged in a hierarchal tree

Example: cn=us -> o=IBM -> ou=Lexington -> cn=Users -> uid=rfox would tell us that user rfox is in the Lexington group which is part of the IBM organization in the US.

IBM Software Group

Anatomy of LDAP root

ou=Custom ers

Em ployeeObject

RetaillCustom er

Object

ou=Em ployees

ou=Branches

BranchObject

ou=Division

DivisionObject

CorporateCustom er

Object

ou=Services

ServiceObject

ou=BusinessPartners

PartnerObject

ou=Applications

ApplicationObject

NetworkDeviceObject

ou=NetworkResources

IBM Software Group

Anatomy of LDAP

An attribute is a specific item defined in an entry, and a value is what it is..

Example:

givenname=Rob

sn=Fox

[email protected]

phonenumber=888-555-1212

IBM Software Group

Anatomy of LDAP

IBM Software Group

Anatomy of LDAP

An LDIF is a file that has these objects and attributes already defined in a text format that can be imported into a directory server

Importing a LDIF is the easiest (and recommended) way to set up your own LDAP server

For Domino, use the LDIF Domino Upgrade Service in the Administration client to import usersThe final location of the LDIF users in the LDAP tree is

determined by the cert ID used while importing

The service will not process LDIF group entries

IBM Software Group

Anatomy of LDAP

IBM Software Group

The Agenda

What is LDAP?

The Anatomy of LDAP







IBM Software Group

Talking to an Existing LDAP

There are only 3 things you need to consume data from an existing LDAP server:Fully qualified DNS name or IP address (and port if it’s not

the default of 389)

Base DN for searching

Credentials

Typically customers want to deploy applications and web servers using their existing LDAP in their infrastructure – so lets see how to do that…

IBM Software Group

Get proper LDAP connection information

Get the fully qualified DNS name and port: The name and location of the server, and the port the LDAP service is listening on

Get the base DN: The first place in the LDAP hierarchy tree to begin looking for names

Get a sample user name to bind to if necessary: Determine if anonymous binding is allowed, and if the attributes needed are returned when bound anonymously. If a user is needed, determine the format of the name and password to connect to the LDAP server

Note: Active Directory typically will not list any users or groups if bound to anonymously

IBM Software Group

The Agenda

What is LDAP?

The Anatomy of LDAP







IBM Software Group

The Pieces of an LDAP DN…

Here is a standard user full distinguished name:

uid=wpsadmin,ou=users,dc=lexington,o=ibm

IBM Software Group

The Pieces of an LDAP DN…

user prefix org unit

uid=wpsadmin,cn=users,ou=lexington,o=ibm

user suffix base DN

IBM Software Group

Acquire the proper tools…

LDAPSearch utilityCommand-line utility shipped with Domino and Notes

Softerra LDAP Browser or…

Softerra LDAP Administrator or…

Java based LDAP Browser (can import LDIF files)Found on Google

IBM Software Group

Using ldapsearch

Can be used to search entries in any LDAP directory

Connects to a directory server and returns results you specify

Located in the Domino or Notes program directory

IBM Software Group

Using ldapsearch

Syntax for ldapsearch:

ldapsearch parameters searchfilter attributes

-b baseDN for your search -D username to bind with -w password to bind with -h ldap server name -p port to query on the ldap server

IBM Software Group

Using ldapsearch

Sample usage of ldapsearch:Use an authenticated bind to search under the

baseDN cn=users,ou=lexington,o=databeam for a user with the common name of Homer Simpson:

ldapsearch -h ldapserver.databeam.com -p 389 -D "cn=wpsbind,cn=users,ou=lexington,o=databeam" -w password -b "cn=users,ou=lexington,o=databeam" "cn=Homer Simpson"

IBM Software Group

Configuring Softerra…

Add a profile name

Add the FQDN of the LDAP server

Add the base DN desired (or fetch them)

Add a binding name to verify the correct format of a user

Note: If you can bind with a long LDAP name, then the application (Sametime, Workplace, etc) can find the user when configuration is complete – bind with users to verify they exist and are in the correct format!

IBM Software Group


IBM Software Group


IBM Software Group

Gather information about the LDAP user…

Determine if you want to log in with ‘cn’ or ‘uid’ or another attribute.

Make sure an objectclass such as ‘inetOrgPerson’ exists.

Determine the email attribute – typically ‘mail’.

Look for a unique identifier – IDS5.1 user ‘ibm-appuuid’, Domino 6.5.4+ user ‘dominoUNID’

Most importantly – right click on the name to get the long LDAP name, for example:

uid=wpsadmin,cn=users,dc=ibm,dc=com

IBM Software Group


IBM Software Group

Gather information aboot the LDAP group…

Determine what attribute designates the name of the group – typically ‘cn’

Determine the objectclass of the group – typically ‘groupOfUniqueNames’ or ‘groupOfNames’

Determine the member attribute name – typically ‘uniquemember’ or ‘member’

Make sure a unique identifier exists like ‘ibm-appuuid’

Again importantly: Right click on the name to get the long LDAP name (full DN):

cn=wpsadmins,cn=group,dc=ibm,dc=com

IBM Software Group


IBM Software Group

The Agenda

What is LDAP?

The Anatomy of LDAP







IBM Software Group

Configure Domino to use a remote LDAP directory

Directory Assistance allows you to lookup information in a directory other than the local primary Domino directory

Domino Directory, Extended Directory Catalog, LDAP

Create a Directory Assistance document in the Directory Assistance database (often named da.nsf)

The Active Directory Domino Upgrade Service (AD DUS) can be used in conjunction with the Active Directory Synchronization (AdSync) to maintain the same set of users in AD and Domino

IBM Software Group

Directory Assistance example

IBM Software Group

Domino 7 LDAP service improvements

Improved performanceLDAP server thread poolingDA LDAP miss caching

DDM LDAP server health monitoring

Addition of aliases

Support of universal Notes Ids (UNID)New “dominoUNID” operational attribute

Enhanced LDAP searchNow work with IBM Workplace products that use the

WebSphere Member Manager (WMM) service to access user/group objects.

IBM Software Group

Starting the Domino LDAP service

The LDAP task runs automatically on the admin server for the primary Domino directory

To start automatically:

Edit the “ServerTasks” setting in Notes.ini to include LDAP

To start manually:

Enter “Load LDAP” on the Domino console

IBM Software Group

Enable/Disable write access to the directory

By default, the LDAP service does not allow write access

To Enable write access:

Open the directory using the Domino Admin Client

Select the Servers Configuration view

Open the Configuration Settings document for the domain

Create this document if it does not exist

On the LDAP tab, set “Allow LDAP users write access” to Yes

Restart each server in the domain running the LDAP service

IBM Software Group

The Agenda

What is LDAP?

The Anatomy of LDAP







IBM Software Group

Using Domino as your LDAP server for Lotus Workplace…

Add a ‘wpsadmin/domain’ user and ‘wpsadmins/domain’ group with manger access to the Domino directory – make sure the username and groupname field include the ‘/domain’ or they will NOT show up in Domino.

Configure the wpconfig.properties file as before except do NOT fill out the LDAPSuffix (base DN) – rather, use the user and group suffix fields. If there is an ou, put that in front like ‘ou=lexington,o=databeam’.

IBM Software Group


Domino servers below 6.5.4 MUST do the following:Create a field called ‘dominoUNID’ in the Person,

Group and Certifier forms with the computed text value of:

@Text(@DocumentUniqueID)Create an agent to open/close/save all documents

in the Domino Directory so the new field is computed and populated – verify the field shows up in LDAP by reloading the schema.

IBM Software Group


Edit <WP_root>\shared\app\wmm\wmm.xml and <WP_root>\wmm\wmmLDAPServerAttributes.xml

to use Domino attributes (including the one you just created) so WebSphere Member Manager will recognize users.

Change the WAS Admin user search filter and user id map:

User search filter: (&(|(cn=%v)(mail=%v)(uid=%v))(objectclass=inetOrgPerson))

User ID map: *:uid Restart all services and servers.. It should work! (heh, yeah right)

IBM Software Group

The Agenda

What is LDAP?

The Anatomy of LDAP







IBM Software Group

Troubleshooting…

Q.) It doesn’t work.

A.) Sorry, works for me.

Q.) No Seriously… I followed all the steps for setting up Directory Assistance to an external LDAP directory, but user authentication still fails.

A.) Domino will check the local directory for a username BEFORE using Directory Assistance to check the external directory. Make sure the name you are trying to authenticate with does not exist in the local Domino Directory.

IBM Software Group

Troubleshooting…

Q.) Help! When using Domino as my LDAP server the searches are very slow!

A.) Create a full-text index for the directory. If it’s still slow, limit the number of entries returned or create a timeout.

Q.) My searches against my Domino LDAP server do not return a CN value. My “co-workers” configured that part…not me. What did they do wrong?

A.) They likely added users to the directory without using Notes registration. You will have to add the common name as a second value in the FullName field of the Person documents.

IBM Software Group

The Agenda

What is LDAP?

The Anatomy of LDAP







IBM Software Group

Bonus Level - Applying Our LDAP Experience in the Real World

In the “real world” companies take their many applications and point to their LDAP server

Having a centralized LDAP reduces management of multiple directories such as new passwords, name changes, department updates, etc

Many IBM products can hook into an existing LDAP directory for authentication, user information, etc..

IBM Software Group


IBM Lotus Web Conferencing and Instant Messaging (Sametime)

IBM Lotus Team Spaces (QuickPlace)

IBM WebSphere Portal

IBM Lotus Workplace

These products use LDAP for user authentication, authorization and mapping of names to specific application needs

IBM Software Group


To get some hands on experience, we are going to configure IBM WebSphere Portal to use an existing LDAP server.

This procedure is exactly the same for configuring IBM Lotus Workplace.

These same principles apply to other applications such as Sametime and QuickPlace.

IBM Software Group

Bonus Level - Configure wpconfig.properties file…

Located C:\WebSphere\PortalServer\config

The LDAP section is at the bottom – we simply map the attributes and data we discovered with Softerra to the fields in the file

Once wpconfig.properties is verified (twice) to be correct, in that same directory we run this script:

WPSconfig enable-ldap-security > enablesecurity.log

‘server1’ is the only server that should be running – stop ‘WebSphere_Portal’ and ‘LotusWorkplace_Server’ before running the script – run this to see what is up:

serverStatus –all –username wpsadmin –password password

Activity is logged to this file (tail –f to see it) – do a search to make sure no ‘FAILED’ messages appeared

IBM Software Group


IBM Software Group


The ‘cn=root’ user is the administrator of the LDAP server with read/write access.

The ‘wpsadmin’ user that was added should read/write access as well – they can be used as the Wps.LDAPAdminUId instead.

Notice which entries use a short name and a long name. The ‘wpsadmins’ group is not checked when the script is run –

VERIFY with Softerra it exists! If you see any BUILD FAILED messages in the enablesecurity.log

file, examine the fields in the previous slide again and rerun the script – there should be NO ‘BUILD FAILED’ scripts.

If you see SQL errors you may need to delete rows and read them with the DB2 Command Center if said tables with errors have primary keys in them.

IBM Software Group

Bonus Level - Verify ‘wpsadmin’ and ‘wpsadmins’ exist properly…

Now is a good time to make sure the ‘wpsadmin’ user exists, the ‘wpsadmins’ group exists, and ‘wpsadmin’ exists in the ‘wpsadmins’ group. If your LDAP browser doesn’t show these two entries properly, DON’T PROCEED until they do!

IBM Software Group

Bonus Level - Hoping it works…

The script shouldn’t take that long to run.. Either ‘tail –f’ the enablesecurity.log or entertain yourself in other productive ways:

IBM Software Group

Bonus Level - It works! (Da Da Da Dah!)

Stop all servers (including IBM HTTP) and restart all servers. Log into Portal: http://nameofserver.domain.com/wps/portal

or log into Workplace:

http://nameofserver.domain.com/lwp/workplace

verify the Web Conferences and Team Spaces places work properly

IBM Software Group

What you (should have) learned

You now have the following information at your disposal thanks to this presentation:Basic understanding of LDAP, how it works, how it is

put together and how to configure it

Understanding of proper usage of LDAP including where and how to find names, and understand an LDAP schema

How LDAP relates to our product suite and how to map attributes from an existing LDAP for client consumption and how to customize Domino into an LDAP server for the IBM product suite

®

IBM Software Group

© IBM Corporation

Thanks a million.

®

IBM Software Group

© IBM Corporation

1900 – part II – Linux Desktop Authentication Using Domino LDAP

Moacyr Mallemont – IT Specialist

Lotus/IBM Software Group

IBM Software Group

Session Objectives

Provide an overview (step-by-step) on how to configure the Domino LDAP service to allow Linux desktop authentication.

Show how easy is to integrate Domino and Linux and have an end-to-end Domino solution running on Linux

IBM Software Group

Agenda

Requirements

PAM configuration

Extending the Domino LDAP Schema

Enabling the Domino LDAP service as the default Linux directory

Authenticating

Setting up Domino to allow password changes from Linux prompt

Troubleshooting

IBM Software Group

Requirements

Default domino installation on a linux system (we used Domino 6.5.4 and RedHat AS 2.1)

Domino Administrator and Designer

Download and compile pam_ldap and nss_ldap on the Linux desktop client

Knowledge on how to compile linux applications (it is really easy :)

IBM Software Group

PAM Configuration – What is pam and nss?

IBM Software Group

PAM Configuration - Compiling

IBM Software Group

PAM Configuration – Making a ldap search

IBM Software Group

PAM Configuration – Making a ldap search

IBM Software Group

PAM Configuration – setting up ldap.conf file

IBM Software Group

PAM Configuration – Setting up ldap.secrets file

IBM Software Group

Extending the Domino LDAP Schema – “LDAP POSIX Account” subform

IBM Software Group

Extending the Domino LDAP Schema – Creating the fields

IBM Software Group

Extending the Domino LDAP Schema – Insert the subform in the form “$PersonExtensibleSchema”

IBM Software Group

Extending the Domino LDAP Schema – Reload the LDAP Schema

IBM Software Group

Extending the Domino LDAP Schema - Verify the new fields in the LDAP Schema

IBM Software Group

Extending the Domino LDAP Schema - Verify the new fields in the LDAP Schema

IBM Software Group

Enabling the Domino LDAP service as the default Linux Directory – User Information Config

IBM Software Group

Enabling the Domino LDAP service as the default Linux Directory – Authentication Config

IBM Software Group

Enabling the Domino LDAP service as the default Linux Directory – Authenticating a Domino user!

IBM Software Group

Enabling the Domino LDAP service as the default Linux Directory – Creating home directories

IBM Software Group

Enabling the Domino LDAP service as the default Linux Directory – the “id” command

IBM Software Group

Setting up Lotus Domino to allow password change for LDAP users – Configuration Document and rights in the NAB ACL

IBM Software Group

Setting up Lotus Domino to allow password change for LDAP users – “Allow LDAP users write=yes”

IBM Software Group

Setting up Lotus Domino to allow password change for LDAP users - Advanced ACL

IBM Software Group

Setting up Lotus Domino to allow password change for LDAP users – Changing an user password from the Linux prompt

IBM Software Group

Troubleshooting

Ldapsearch If you can’t run the suggested searches in this presentation,

don’t go ahead to the next step. Try to understand what is going on!

Password change from Linux Desktop If password change does not work, verify user rights in the

NAB ACL, and the ldap.conf & ldap.secrets files.

User root cannot login anymore! Use single user mode (in rescue) and clean every entry in the

/etc/nsswitch.conf that has ldap references.

While configuring and testing you can let “some” root sessions open that will allow you to fix your system.

IBM Software Group

Summary

It can be very easy to integrate domino with other systems

Domino uses and make use of open standards and protocols, that’s why it is so flexible!

This is just another example on how Domino can be used to reduce the TCO of IT Solutions

There are more complete solutions that should be evaluated as Tivoli solutions that are much more complete and can do much more

If you already has Domino, your investments are preserved and extended - start integrating today!

IBM Software Group

Resources

http://www.padl.com/Contents/OpenSourceSoftware.html

http://www.redhat.com/docs/manuals/linux/RHL-7.3-Manual/ref-guide/s1-ldap-extrafunctionality.html

http://www.ibm.com/dominolinux

http://www-306.ibm.com/software/tivoli/solutions/security/

IBM Software Group

Questions?

Education

Configuring Domino To Be An Ldap Directory And To Use An Ldap Directory