LDAP user authentication using Microsoft Active Directory

This appendix is meant to assist IBM Tivoli Monitoring users that wish to use Microsoft's LDAP-based Active Directory product for user authentication. Enabling user authentication explains how to enable LDAP user authentication for users of the Tivoli Enterprise Monitoring Server, the Tivoli Enterprise Portal Server, or both. This appendix extends this information to cover the steps you must complete to incorporate LDAP as implemented in an Active Directory environment, while presenting the topic from an Active Directory perspective. Two user scenarios (one illustrating monitoring server integration with Active Directory, the other portal server integration with Active Directory) are provided to show you how this process can help you implement Tivoli Monitoring security in the real world; see User scenarios.

This procedure uses the TEPS/e Web browser interface to complete the portal server configuration; see TEPS/e administration console.

Notes:

Portal server authentication has the advantage that it allows userids longer than 10 characters, the limit imposed by monitoring server authentication. It also supports SSO (single sign-on), which monitoring server authentication does not.
On the other hand, only monitoring server-based user authentication allows userids to make SOAP Server requests or to issue CLI commands that invoke SOAP Server methods.
The configuration procedures and steps for enabling IBM Tivoli Monitoring LDAP user authentication are the same for all LDAP implementations (Active Directory, Tivoli Directory Server, and so on), but the configuration values you specify will vary. These differences are due to the differences within the LDAP implementations themselves. The most pronounced differences are the syntax for Distinguished Names of objects within the directory. Additionally, the LDAP schema differences between LDAP implementations and any LDAP schema customizations will have a high impact on the LDAP user authentication configuration values provided.
Although the scenarios in this chapter assume a Microsoft Active Directory version 2003 environment, these instructions and scenarios have also been verified using Active Directory V2008.

The configuration uses all information provided to connect, bind, query, and filter records from a specified LDAP Base to the targeted LDAP Repository for user authentication. The configurations of the monitoring server and portal server LDAP user authentication are separate operations; these configurations (after completion) can be enabled and disabled independently. Do not consider that the steps for configuring the monitoring server's LDAP user authentication will translate to the portal server's LDAP user authentication, nor vice versa.