Administer > Integrate NNMi with a Directory Service through LDAP > NNMi User Access Information and Configuration Options

NNMi User Access Information and Configuration Options

Together, the following items define an NNMi user:

  • The user name uniquely identifies the NNMi user. The user name provides access to NNMi and receives incident assignments.
  • The password is associated with the user name to control access to the NNMi console or NNMi command line.
  • NNMi user group membership controls the information available and the type of actions that a user can take in the NNMi console. User group membership also controls the availability of NNMi commands to the user.

NNMi provides several options for where the NNMi user access information is stored, as described in the following topics. The following table indicates the databases that store the NNMi user access information for each configuration option.

Note If a user is not specified using External (Option 3), NNMi does not have a mechanism for enforcing password policies, such as password strength checks and other account protection mechanisms. It is recommended that you implement best practices for password policy management, including requiring that users change passwords at regular intervals.

Options for Storing User Information

Mode

User Accounts

User Group

User Group Membership

Internal (Option 1)

NNMi

NNMi

NNMi

Mixed (Option 2)

Mixed (account name in NNMi, account passwords in LDAP)

NNMi

NNMi

External (Option 3)

Directory Service

Both

Directory Service

 

NNMi communicates with the directory service using Lightweight Directory Access Protocol (LDAP). If you want to use LDAP with NNMi, use one of the following modes shown in previous table:

  • Mixed Mode (Originally Referred to as Option 2): Some NNMi User Information in the NNMi Database and Some NNMi User Information in the Directory Service

    Using mixed mode involves configuring NNMi to store user names, user groups and user group mappings in the NNMi database, and relying on the directory service for user names and passwords (User Accounts). That means that account name information must be stored in both NNMi and LDAP, however account passwords should only be stored in LDAP.

  • External Mode (Originally Referred to as Option 3): All NNMi User Information in the Directory Service

    When using external mode, there is no need to add user account information to NNMi, as all user account information is stored using LDAP.

NNMi's LDAP configuration file: In both the modes, NNMi retrieves the LDAP server information from a configuration file. You can use the ldap.properties or nms-auth-config.xml file to specify the details of the LDAP server information.

When adding new user accounts, or modifying existing accounts using mixed mode, you must select the Directory Service Account check box. When configuring User Accounts do not select the Directory Service Account check box for some users and not select it for others as a method of combining internal, mixed, and external modes. Doing so is an unsupported configuration.

When NNMi is integrated with a directory service for some or all of the user access information, the user account and user group definition statement on the Server tab of the System Information window indicates the type of information that was obtained through LDAP queries.

Single sign-on (SSO) between NNMi and other applications is not dependent on how the NNMi user access information is configured or where this information is stored.

Send Help Center feedback