WebSphere Application Server security supports the implementation
of most major LDAP directory servers, which can act as the repository for
user and group information. These directory servers are called by the WebSphere servers
for authenticating a user and other security-related tasks (for
example, getting user or group information). This support is provided by using
different user and group filters to obtain the user and group information.
These filters have default values that you can modify to fit your needs. The
custom LDAP feature enables you to use any other LDAP server (which is not
in the product supported list of LDAP servers) for its user registry by using
the appropriate filters.
<br/>
<br/>
To continue, click <strong> Start</strong>.
-
<ol>
<li>Click <strong> Click to perform</strong> to load the LDAP User Registry panel</li>
<li>Enter a valid user name in the Server User ID field. You can either enter the complete distinguished name (DN) of the user or the short name of the user as defined by the User Filter in the Advanced LDAP settings panel. For example, for IBM Directory Server enter <strong>cn=WAS admin,o=ibm,c=us</strong> or <strong>WASadmin</strong>, where <strong>WASadmin</strong> is the user ID.</li>
<li>Enter the password of the user in the Server User Password field.</li>
</ol>
To continue, click <strong> Next step</strong>.
-
Select the type of LDAP server that is used from the Type list.
The type of LDAP server determines the default filters that are used by the WebSphere Application Server.
If either the IBM Directory Server or the iPlanet Directory Server is selected, also select the
checkbox for the Ignore case for authorization field below.
For more information on using specific types of LDAP servers, see
<a target="help" href="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.base.doc/info/aes/ae/tsec_tmsad.html">Using specific directory servers as the LDAP server</a>.
<br/>
<br/>
To continue, click <strong> Next step</strong>.
-
<ol>
<li>Enter the fully qualified host name of the LDAP server in the Host field.</li>
<li>Enter the LDAP server port number in the Port field.
The host name and the port number represent the realm for this LDAP server in the WebSphere Application Server cell.
</li>
</ol>
To continue, click <strong> Next step</strong>.
-
<ol>
<li>Enter the Base distinguished name (DN) in the Base Distinguished Name field.
The Base DN indicates the starting point for searches in this LDAP directory server.
For example, for a user with a DN of <TT>cn=John Doe, ou=Rochester, o=IBM, c=US</TT>, specify the Base DN as any of the following options (assuming a suffix of c=us):
<TT>ou=Rochester, o=IBM, c=us</TT> or <TT>o=IBM c=us</TT> or <TT>c=us</TT>.
This field can be case sensitive. Match the case in your directory server.
This field is required for all LDAP directories except the Domino Directory.
</li>
<li>Enter the Bind DN name in the Bind Distinguished Name field, if necessary.
The Bind DN is required if anonymous binds are not possible on the LDAP server to obtain user and group information.
If the LDAP server is set up to use anonymous binds, leave this field blank.</li>
<li>Enter the password corresponding to the Bind DN in the Bind password field, if necessary.</li>
<li>Disable the Reuse Connection field only if you use routers to send requests to multiple LDAP servers, and if the routers do not support affinity.
Leave this field enabled for all other situations.</li>
<li>Click <strong>OK</strong> to submit your changes made so far.</li>
</ol>