Configuring LDAP user registries for Process Federation Server

You can configure one or more Lightweight Directory Access Protocol (LDAP) servers on Process Federation Server for user authentication. The LDAP server must be common between Process Federation Server and the federated systems.

About this task

You can use an existing LDAP server, such as IBM® Security Directory Suite or Microsoft Active Directory Server, for user authentication on Process Federation Server. For a list of the supported LDAP servers, see WebSphere Application Server LDAP Server Support.
Restriction: You cannot mix LDAP user authentication with other authentication services, such as a basic user registry or a custom user registry. If you have a mixture of authentication services, the following error message is recorded in the console.log file when a user tries to log in: 
[ERROR   ] CWWKS3006E: A configuration exception has occurred. There are multiple available UserRegistry implementation services; the system cannot determine which to use.
If multiple LDAP registries are configured in the server.xml file, they are federated automatically. Ensure that the users are unique across all federated repositories, otherwise the user registry operations will not be successful and the following messages are recorded in the console.log file
[ERROR   ] CWIML4538E: The user registry operation could not be completed. More than one record exists for the u1 principal name in the configured user registries. The principal name must be unique across all the user registries.
[AUDIT   ] CWWKS1100A: Authentication did not succeed for user ID u1. An invalid user ID or password was specified.

Procedure

To set up the user registry, add the ldapRegistry-3.0 feature to the server.xml configuration file and specify the configuration information for connecting to the LDAP server.

  1. Open the server.xml configuration file for editing.
    By default, the configuration file is in the pfs_install_root/usr/servers/server_name directory on Process Federation Server.
  2. Add the ldapRegistry-3.0 feature to the featureManager section: 
    <!-- Enable features -->
<featureManager>
    <feature>ldapRegistry-3.0</feature>
</featureManager>
  3. Specify the configuration information for the LDAP server.
    Add an ldapRegistry element for each LDAP server in the federated environment and specify values for the relevant configuration properties.
    The following code snippet is an example of an LDAP server element in the server.xml file. The entries in the Filters section depend on the type of LDAP server that you are using.
    <ldapRegistry 
     baseDN="LDAP1_BASE_DN,o=mycompany,c=us" 
     ldapType="ldap_server_type"
     port="ldap_port" host="ldapserver.mycity.mycompany.com" 
     id="ldap_ID" realm="ldap_realm">
     <ldap_server_typeFilters 
          userIdMap="*:uid"
          groupIdMap="*:cn"
          userFilter="(&amp;(uid=%v)(objectclass=ePerson))"
          groupFilter="(&amp;(cn=%v)(|(objectclass=groupOfNames)(objectclass=groupOfUniqueNames)(objectclass=groupOfURLs)))"
          groupMemberIdMap="mycompany-allGroups:member;mycompany-allGroups:uniqueMember;groupOfNames:member;groupOfUniqueNames:uniqueMember";
     />
</ldapRegistry>
    If you have multiple LDAP servers in your federated environment, add a federatedRepository section with an allowOpIfRepoDown property to ensure that Process Federation Server can still authenticate users if one of the LDAP servers goes down. 
    <federatedRepository>
   <primaryRealm name="LdapRegistry" allowOpIfRepoDown="true"> 
      <participatingBaseEntry name="IBM_TDS_BASE_DN"/>
      <uniqueGroupIdMapping inputProperty="uniqueName" outputProperty="uniqueName"/> 
   </primaryRealm>
</federatedRepository>

What to do next

Secure communications between Process Federation Server and LDAP. For more information, see Securing communications between Process Federation Server and LDAP.