Searching the Help
To search for information in the Help, type a word or phrase in the Search box. When you enter a group of words, OR is inferred. You can use Boolean operators to refine your search.
Results returned are case insensitive. However, results ranking takes case into account and assigns higher scores to case matches. Therefore, a search for "cats" followed by a search for "Cats" would return the same number of Help topics, but the order in which the topics are listed would be different.
Search for | Example | Results |
---|---|---|
A single word | cat
|
Topics that contain the word "cat". You will also find its grammatical variations, such as "cats". |
A phrase. You can specify that the search results contain a specific phrase. |
"cat food" (quotation marks) |
Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase. |
Search for | Operator | Example |
---|---|---|
Two or more words in the same topic |
|
|
Either word in a topic |
|
|
Topics that do not contain a specific word or phrase |
|
|
Topics that contain one string and do not contain another | ^ (caret) |
cat ^ mouse
|
A combination of search types | ( ) parentheses |
|
- Universal CMDB Login Authentication
- Setting Up an Authentication Method
- Enabling Login to Universal CMDB with LW-SSO
- Enabling Login to Universal CMDB with SAML
- Setting a Secure Connection with the SSL (Secure Sockets Layer) Protocol
- Using the JMX Console to Test LDAP Connections
- How to Enable HTTP Communication for Universal CMDB
- Hybrid User Management with Multiple User Repositories
- How to Define LDAP Servers and Enable LDAP Authentication Method
- LDAP Authentication Settings - Example
- Example: How to Configure LDAP for Sun ONE Directory Server in UCMDB Server
- Example: How to Configure Dynamic LDAP Groups
- Retrieving Current LW-SSO Configuration in Distributed Environment
- User Lockout Mechanism
How to Define LDAP Servers and Enable LDAP Authentication Method
The table below describes features available with different versions:
UCMDB version | Features available |
---|---|
10.30 |
|
10.32 |
|
11.0 | A new global setting settings.ldap.use.referrals is added. |
Important If you are configuring LDAP on a high availability environment, you must restart the cluster for the changes to take effect.
Note
-
In a high availability environment, make sure you log in to the JMX console of the Writer server.
-
For an example of LDAP authentication settings, see LDAP Authentication Settings - Example.
-
Every LDAP user has a first name, last name, and email address saved in the local repository. If the value of any of these parameters that is stored on the LDAP server differs from the value in the local repository, the LDAP server values will overwrite the local values at each login.
- The value of the userUID setting must be unique across all LDAP servers.
The following describes how to configure single or multiple LDAP authentication settings using the JMX console.
How to view the current LDAP authentication settings
-
On the UCMDB server machine, launch your Web browser and enter the following address: https://localhost:8443/jmx-console.
You may need to log in with a user name and password.
-
Under UCMDB, click UCMDB:service=LDAP Services to open the Operations page.
-
To view the current LDAP authentication settings, locate the getLDAPSettings method.
-
Click Invoke.
A table displays all the LDAP settings and their values.
Note If you need to view the LDAP settings and their values for only one LDAP server, enter the LDAP server in the ldapHost field, and then click Invoke.
How to configure a new LDAP server
-
On the UCMDB server machine, launch your Web browser and enter the following address: https://localhost:8443/jmx-console.
You may need to log in with a user name and password.
-
Under UCMDB, click UCMDB:service=LDAP Services to open the Operations page.
-
To configure a new LDAP server, locate the configureLDAPServer method.
- Enter the values for the relevant settings and click Invoke
Note
- You can specify the order in which the LDAP servers are presented in UCMDB or in JMX after invoking the getLDAPSettings method, by entering a value in the Priority field. If two or more LDAP Severs have the same priority, the order in which they are presented is alphabetic.
- If you want to view the group information of LDAP users, set the displayUsersGroup parameter to True, and then invoke the getLDAPGroupUsersChunk() method. For details, see the "Search LDAP Users" section in the Administer section of the UCMDB Help.
How to change the values of LDAP authentication settings
-
On the UCMDB server machine, launch your Web browser and enter the following address: https://localhost:8443/jmx-console.
You may need to log in with a user name and password.
-
Under UCMDB, click UCMDB:service=LDAP Services to open the Operations page.
-
To change the values of LDAP authentication settings, locate the configureLDAPServer method.
-
Enter the value for the ldapURL and the values for the relevant settings and click Invoke.
The JMX MBEAN Operation Result page indicates whether the LDAP authentication settings were updated successfully.
Note
- If you do not enter a value for a setting, the setting retains its current value.
- If you want to delete an existing value, you have to delete the LDAP server and then reconfigure it by performing the steps described in this procedure.
How to verify the LDAP user credentials
After configuring the LDAP settings, you can verify the LDAP user credentials.
- Locate the verifyLDAPCredentials method.
- Provide values for ldapHost, username, and password.
-
Click Invoke.
The JMX MBEAN Operation Result page indicates whether the user passes LDAP authentication.
How to map LDAP user groups to UCMDB user groups
-
On the UCMDB server machine, launch your Web browser and enter the following address: https://localhost:8443/ucmdb-ui.
-
Enter your login parameters.
-
Go to Security > LDAP Mapping, and from the drop-down list, select the LDAP Sever for which you want to map the user groups.
For details, see LDAP Mapping in the Administer section of the UCMDB Help.
Note
- Only the global settings are visible in the Administration > Infrastructure Settings Manager > LDAP General category.
-
Also, the following two settings are available in Administration > Infrastructure Settings Manager > LDAP General category:
- Check subgroup existence in the LDAP Mapping, and
- Enable LDAP Authentication in non interactive flows
How to configure new LDAP dynamic groups
-
On the UCMDB server machine, launch your Web browser and enter the following address: https://localhost:8443/jmx-console.
You may need to log in with a user name and password.
-
Under UCMDB, click UCMDB:service=LDAP Services to open the Operations page.
-
To configure new LDAP dynamic groups, locate the configureLdapDynamicGroups operation.
-
Provide values for one or more of the general configuration settings for dynamic groups as described below:
Parameter Name Description Sample Value ldapHost Host name of an already configured LDAP server dynamicGroupsClass Class from which the groups inherit.
For example, in SunONE, a static group inherits from the groupOfUniqueNames object class.
groupOfURLs dynamicGroupsDescAttribute Description of the dynamic groups desc dynamicGroupsDisplayNameAttribute Display name of the dynamic groups cn dynamicGroupsMemberAttribute Attribute that is found being used by dynamic group members, which defines if a user is member of a dynamic group
memberURL dynamicGroupsNameAttribute Dynamic group name cn -
Click Invoke.
The JMX MBEAN Operation Result page indicates whether the new LDAP dynamic groups are configured successfully.
Note When you configure new LDAP dynamic groups, both the static and dynamic groups on the target LDAP server are enabled automatically.
How to enable or disable the use of dynamic groups
In case you want to enable or disable the dynamic group configurations for an LDAP server, do the following:
-
On the UCMDB server machine, launch your Web browser and enter the following address: https://localhost:8443/jmx-console.
You may need to log in with a user name and password.
-
Under UCMDB, click UCMDB:service=LDAP Services to open the Operations page.
-
Locate the useDynamicGroups operation.
-
Provide the LDAP server host name in the ldapHost field, and set the isEnable flat to True or False to enable or disable the use of dynamic groups.
- Click Invoke.
How to disable the use of REFERRALS
By default the REFERRALS property is used in LDAP bind. To disable the use of REFERRALS, do either of the following:
-
From JMX Console:
-
On the UCMDB server machine, launch your Web browser and enter the following address: https://localhost:8443/jmx-console.
You may need to log in with a user name and password.
-
Search and open the UCMDB:service=Settings Services Operations page.
-
To disable the use of REFERRALS, provide values for the following parameters for the setGlobalSettingValue method:
name: settings.ldap.use.referrals
value: false (Default: true)
-
Click Invoke.
- Restart the UCMDB server.
-
-
From UCMDB UI:
- In UCMDB UI, go to Administration > Infrastructure Settings Manager.
- Locate the Use referrals for LDAP Servers setting and change its value to False. (Default: True)
- Restart the UCMDB server.
Note The retrieved value for this setting will be logged in the cmdb.dal.server log when this is set to DEBUG.
We welcome your comments!
To open the configured email client on this computer, open an email window.
Otherwise, copy the information below to a web mail client, and send this email to cms-doc@microfocus.com.
Help Topic ID:
Product:
Topic Title:
Feedback: