Enable an integration to LDAP

You must have the SysAdmin capability word to use this procedure.

To enable an integration to LDAP:

1. Do one of the following to enable Service Manager to create operator records dynamically when LDAP users log in:
   • Define the System Information Record operator template for LDAP users.
   • Define a system default record for the operator file. For details, see Create a system default operator record.
   These settings allow LDAP users to log in to Service Manager without having existing operator records.
2. Define the default LDAP server and authentication base directory to which you want Service Manager to connect.
3. Define the file and field mappings you want to the LDAP directory service.
4. Set LDAP query parameters in the Service Manager initialization file.

Define the default LDAP server

You must have the SysAdmin capability word to use this procedure.

You must define a default LDAP server to integrate Service Manager files to an LDAP directory service.

To define the default LDAP server:

1. Click System Administration > Ongoing Maintenance > System > LDAP Mapping.
   The Service Manager LDAP Mapping – System Level Specification form opens.
2. Type or select the LDAP mapping information.
3. Click Save.
   Service Manager displays the message;
   Record updated in the scldapconfig file.

Define file and field-level mappings to an LDAP server

You must have the SysAdmin capability word to use this procedure.

You must define a default LDAP server to integrate Service Manager files to an LDAP directory service.

To define file and field-level mappings to an LDAP server:

1. Click System Administration > Ongoing Maintenance > System > LDAP Mapping.
   The Service Manager LDAP Mapping – System Level Specification form opens.
2. Click Set File/Field-level Mappings.
   The Service Manager LDAP Mapping – File/Field Specification page opens.
3. In the Name field, type the name of the Service Manager file for which you want to create LDAP mappings.
4. Click Search.
   Service Manager displays a list of fields for the file.
5. Type or select the LDAP mapping settings. If necessary, press Ctrl+H to view help for each field.
6. Click Save.
   Service Manager displays the message:
   Data Policy record updated.

Set the LDAP authentication base name

You can define an operator to use a different LDAP base name than the operator name. By default, Service Manager uses the operator name to bind to the LDAP. You can define a different LDAP base name to allow users to connect to Service Manager with one name and to LDAP with a different name.

To set the LDAP authentication base name:

1. Click System Administration > Ongoing Maintenance > Operators.
2. Click Search.
3. Select the operator whose LDAP base name you want to set from the record list.
4. Click the Security tab.
5. In the LDAP Base Name field, type the name you want to use to authenticate the LDAP connection.
6. Click Save.
   Service Manager displays the message:
   Operator record updated.

Enable LDAP over SSL

You must have the SysAdmin capability word to use the procedures below.

By default, when you enable LDAP over SSL, you need to set the root certificate of the CA that issued the LDAP server’s certificate on the Service Manager server, and then specify the location of the certificate file in the LDAP SSL DB Path field.

If you do not want to set the CA's root certificate on the Service Manager server, follow these steps:

1. Set the ldapsslallownocert parameter to 1.
2. Log in to Service Manager, and then click System Administration > Ongoing Maintenance > System > LDAP Mapping.
3. Set the LDAP Server and LDAP Base Directory fields, select the LDAP SSL check box. Leave the LDAP SSL DB Path field blank. 
4. Click Set File/Field level mapping, enter operator in the Name field, and then map the name field of operator to sAMAccountName (for Active Directory server).
5. Restart the Service Manager server.

If you wish to authenticate Service Manager users that belong to different domains or subdomains, you can deploy multiple LDAP servers that belong to the corresponding domains, and then set up a horizontal scaled (HS) cluster. By the following configuration, users belong to different domains can share the same database while at the same time be authenticated by different domain’s LDAP server over SSL.

1. Set the ldapsslallownocert parameter to 1.
2. Log in to Service Manager, and then click System Administration > Ongoing Maintenance > System > LDAP Mapping. Leave everything on this page empty.
3. Click Set File/Field Level Mapping, enter operator in the Name field, and then map the name field of operator to sAMAccountName.

4. Add the ldapserver parameter in the sm.ini file as the following example:

   ldapserver1:16.183.93.217%636%cn=users,dc=swsm,dc=ind,dc=lab

   You can add this parameter multiple times if you have more than one LDAP server.

5. Restart the Service Manager server.

 

Related topics

Lightweight Directory Access Protocol (LDAP)
Create a system default operator record
Define the operator template applied to LDAP users