Configuring pass-through authentication for entries not in the authentication server

Edit online

Configure entries of a subtree for pass-through authentication even if the entries are not in the authentication server.

Procedure

  1. Log in as the instance owner.
  2. To set pass-through authentication on a directory server instance, run the idsldapmodify command:
    idsldapmodify -h server.com -p port -D adminDN -w adminPWD -i setPtaFile.ldif
    The setPtaFile.ldif file contains the following entries: 
    dn: cn=Configuration
changetype: modify
replace: ibm-slapdPtaEnabled
ibm-slapdPtaEnabled: true
  3. To apply the changes that are made to the ibm-slapdPtaEnabled attribute value, run the idsldapexop command: 
    idsldapexop -h server.com -p port -D adminDN -w adminPWD -op readconfig \
-scope single cn=Configuration ibm-slapdPtaEnabled
  4. To configure a pass-through interface for the entries of a subtree, run the idsldapmodify command:
    idsldapmodify -h server.com -p port -D adminDN -w adminPWD \
-i setPtaNonExistEntriesFile.ldif
    The setPtaNonExistEntriesFile.ldif file contains the following entries: 
    dn: cn=Passthrough Server1, cn=Passthrough Authentication, cn=Configuration
changetype: add
cn: Passthrough Server1
ibm-slapdPtaURL: ldap://hostnameOfPassThroughServer:port
ibm-slapdPtaSubtree: o=sample
ibm-slapdPtaConnectionPoolSize: 6
ibm-slapdPtaResultTimeout: 100
objectclass: top
objectclass: ibm-slapdConfigEntry
objectclass: ibm-slapdPta
  5. Restart the directory server and the administration server. 
    ibmslapd -I dsrdbm01 -k
ibmdiradm -I dsrdbm01 -k
ibmslapd -I dsrdbm01 -n
ibmdiradm -I dsrdbm01

Examples

Example 1:
To search for an entry in the authentication server, run the idsldapsearch command in the following format:
idsldapsearch -h server.com -p port -D cn=Tom Brown,o=sample -w userPWD \
-s base -b "" objectclass=* namingcontexts

namingcontexts=CN=SCHEMA
namingcontexts=CN=LOCALHOST
namingcontexts=CN=IBMPOLICIES
namingcontexts=O=SAMPLE
Example 2:
To compare the user password value, run the idsldapcompare command in the following format:
idsldapcompare -h server.com -p port -D adminDN -w adminPWD \
cn=Tom Brown,o=sample userpassword=userPWD
 Compare true