Configure LDAP user registries

Before you configure an LDAP user registry for WebSphere security, see these topics:

• Lightweight Directory Access Protocol
• Supported directory services
• Using specific directory servers as the LDAP server
• Adding users to the LDAP user registry

To configure WebSphere security to use an LDAP user registry, perform these steps in the administrative console:

1. Click Security --> User Registries --> LDAP.

2. Enter a valid user name in the Server User ID field. You can either enter the complete distinguished name (DN) of the user or the shortname of the user as defined by the User Filter in the Advanced LDAP settings panel.

3. Enter the password of the user in the Server User Password field.

4. Select the type of LDAP server that is used from the Type drop-down list.

   Note: If you are using the i5/OS Directory Services product, select SecureWay from the Type list.

   The type of LDAP server determines the default filters that are used by the WebSphere Application Server - Express. When these default filters are changed the Type field changes to Custom, which indicates that custom filters are used. This action occurs after OK or Apply is clicked in the LDAP advanced settings panel. For more information about LDAP filters, see Configure LDAP search filters.

   Choose the Custom type from the list and modify the user and group filters to use other LDAP servers, if required. However, it is the customer's responsibility to configure and validate the filters for other LDAP servers. Also, if either IBM_Directory_Server or iPlanet is selected, the Ignore Case field should also be selected.

5. Enter the fully qualified host name of the LDAP server in the Host field.

6. Enter the LDAP server port number in the Port field. The host name along with the port number represent the realm for this LDAP server in the WebSphere Application Server - Express cell. So, if servers in different cells are communicating with each other (using LTPA tokens), these realms should match exactly in all the cells.

   Note: If you are using single signon between a WebSphere Application Server - Express Version 5 server (either 5.0 or 5.1) and a WebSphere Application Server Version 4 application server, you must specify an LDAP server port number in the administrative console. By default, the default LDAP port number for WebSphere Application Server - Express Version 5 is 0, but for WebSphere Application Server Version 4, it is not 0. Set the LDAP port numbers for both servers to the same value. In the Version 5 administrative console, set the LDAP port number on the LDAP settings page: click Security --> User registries --> LDAP.

7. Enter the Base distinguished name (DN) in the Base Distinguished Name field. The Base DN indicates the starting point for searches in this LDAP directory server. For example, for a user with a DN of cn=John Doe, ou=Rochester, o=IBM, c=US, the Base DN can be specified as any of (assuming a suffix of c=us): ou=Rochester, o=IBM, c=us or o=IBM c=us or c=us. This field can be case sensitive, and it is recommended that they match the case in your directory server. This field is required for all LDAP directories except the Domino Directory. The Base DN field is optional for the Domino Server.

8. Enter the Bind DN name in the Bind Distinguished Name field, if necessary. The Bind DN is required if anonymous binds cannot be performed on the LDAP server to obtain user and group information. If the LDAP server is set up to use anonymous binds, leave this field blank.

9. Enter the password that corresponds to the Bind DN in the Bind password field, if necessary.

10. Modify the Search Time Out value if required. This time out value is the maximum amount of time the LDAP server waits to send a response to the product client before aborting the request. The default is 120 seconds.

11. Disable the Reuse Connection field only if you are using routers to spray requests to multiple LDAP servers, and if the routers do not support affinity. Leave this field enabled for all other situations.

12. Enable the Ignore Case flag, if required. When this is enabled, the authorization check is case insensitive. Normally, an authorization check involves checking the complete DN of a user (which is unique in the LDAP server) and is case sensitive. However, when using either IBM Directory Server, i5/OS Directory Services, or the iPlanet LDAP servers, this flag needs to be enabled because the group information obtained from the LDAP servers is not consistent in terms of case. This inconsistency only affects the authorization check.

13. Enable secure sockets layer (SSL) if the communication to the LDAP server is through SSL. Check SSL Enabled to enable SSL. For more information on setting up LDAP for SSL, refer to Configure SSL connections between WebSphere Application Server - Express and an LDAP server.

14. If SSL is enabled, select the appropriate SSL alias configuration from the drop-down list in the SSL configuration field.

15. Click OK.

    The validation of the user and password and the setup does not take place in this panel. Validation is only done when you click OK or Apply in the Global Security panel. If you are enabling security for the first time, complete the remaining steps and then go to the Global Security panel. Select LDAP as the Active User Registry. If security is already enabled but information on this panel is changed, make sure to go to the Global Security panel and click OK or Apply to validate your changes. If your changes are not validated, the server may not be able to start.