Configuring pass-through authentication to Active Directory Global Catalog

Edit online

Configure entries of a subtree to authenticate against the authentication server by setting the pass-through authentication interface to contact Microsoft™ Active Directory Global Catalog.

Procedure

  1. Log in as the instance owner.
  2. To set pass-through authentication on a directory server instance, run the idsldapmodify command: 
    idsldapmodify -h server.com -p port -D adminDN -w adminPWD -i setPtaFile.ldif
    The setPtaFile.ldif file contains the following entries: 
    dn: cn=Configuration
changetype: modify
replace: ibm-slapdPtaEnabled
ibm-slapdPtaEnabled: true
  3. To apply changes that are made to the ibm-slapdPtaEnabled attribute value, run the idsldapexop command: 
    idsldapexop -h server.com -p port -D adminDN -w adminPWD -op readconfig \
-scope single cn=Configuration ibm-slapdPtaEnabled
  4. To configure a pass-through interface for the entries of a subtree, run the idsldapmodify command:
    idsldapmodify -h server.com -p port -D adminDN -w adminPWD \
-i setPtaGlobalCatlogFile.ldif
    The setPtaGlobalCatlogFile.ldif file contains the following entries: 
    dn: cn=Passthrough Server1, cn=Passthrough Authentication, cn=Configuration
changetype: add
cn: Passthrough Server1
ibm-slapdPtaAttrMapping: uid $ userPrincipalName
ibm-slapdPtaBindDN: bind_DN
ibm-slapdPtabindPW: bind_PWD
ibm-slapdPtaSubtree: o=sample
ibm-slapdPtaSearchBase:
ibm-slapdPtaURL: ldap://hostname:3268
ibm-slapdPtaConnectionPoolSize: 6
ibm-slapdPtaResultTimeout: 100
objectclass: top
objectclass: ibm-slapdConfigEntry
objectclass: ibm-slapdPta
objectclass: ibm-slapdPtaExt
  5. Restart the directory server and the administration server. 
    ibmslapd -I dsrdbm01 -k
ibmdiradm -I dsrdbm01 -k
ibmslapd -I dsrdbm01 -n
ibmdiradm -I dsrdbm01