User Identification

User identification applies to mixed mode and external mode.

The distinguished name for user identification is the fully-qualified method of locating one user in the directory service. NNMi passes the user distinguished name in an LDAP request to the directory service.

In the LDAP configuration file, the user distinguished name is the concatenation of the <base> and <baseContextDN> elements in the nms-auth-config.xml file (the baseFilter value and the baseCtxDN value in the ldap.properties file). If the password returned by the directory service matches the sign-in password the user entered into the NNMi console, user sign in continues.

For mixed mode, the following information applies:

• For NNMi console access, NNMi examines the following information and grants the user the highest possible privileges:

  • The value of the defaultRole parameter in the LDAP configuration file
  • This user’s membership in the predefined NNMi user groups in the NNMi console
• For NNMi topology object access, NNMi grants access according to the security group mappings for the NNMi user groups to which this user belongs in the NNMi console.

For external mode, the following information applies:

• For NNMi console access, NNMi examines the following information and grants the user the highest possible privileges:

  • The value of the defaultRole parameter in the LDAP configuration file
  • This user’s membership in the directory service groups that are mapped (with the Directory Service Name field) to the predefined NNMi user groups in the NNMi console
• For NNMi topology object access, NNMi grants access according to the security group mappings for the groups to which this user belongs in the directory service (as mapped to NNMi user groups in the NNMi console).

Active Directory user identification example

In the nms-auth-config.xml file

If the nms-auth-config.xml file contains <base>CN={0}</base><baseContextDN>OU=Users,OU=Accounts,DC=example,DC=com</baseContextDN>, and a user signs in to NNMi as john.doe, the string passed to the directory service is:

CN=john.doe,OU=Users,OU=Accounts,DC=example,DC=com

In the ldap.properties file

If baseFilter is set to CN={0}, baseCtxDN is set to OU=Users,OU=Accounts,DC=example,DC=com, and a user signs in to NNMi as john.doe, the string passed to the directory service is:

CN=john.doe,OU=Users,OU=Accounts,DC=example,DC=com

Other directory services user identification example

In the nms-auth-config.xml file

If the nms-auth-config.xml file contains <base>uid={0}@example.com</base><baseContextDN>ou=People,o=example.com</baseContextDN>, and a user signs in to NNMi as john.doe, the string passed to the directory service is:

uid=john.doe@example.com,ou=People,o=example.com

In the ldap.properties file

If baseFilter is set to uid={0}@example.com, baseCtxDN is set to ou=People,o=example.com, and a user signs in to NNMi as john.doe, the string passed to the directory service is:

uid=john.doe@example.com,ou=People,o=example.com