How to configure basic authentication with an LDAP user registry

For more information about configuration elements, see Configuration elements in the Reference section.

1. Ensure that the server is configured to require authentication for the request.
   This configuration can be set at different scopes:

   • To require authentication globally for the server, set requireAuth="true" on the zosconnect_zosConnectManager element in the server.xml configuration file. For example,

     <zosconnect_zosConnectManager requireAuth="true" ... />

   • To require authentication for a specific API, which takes precedence over the global server setting, set requireAuth="true" on the zosConnectAPI element in the server.xml configuration file. For example,

     <zosconnect_zosConnectAPIs>
         <zosConnectAPI name="Api1" requireAuth="true"/>
     </zosconnect_zosConnectAPIs>

   • To require authentication for a specific service, which takes precedence over the global server setting, set requireAuth="true" on the service element in the server.xml configuration file. For example,

     <zosconnect_services>
         <service name="Service1" requireAuth="true"/>
     </zosconnect_services>

2. Configure the server to use basic authentication.
   IBM z/OS Connect attempts to use a TLS client certificate for authentication, unless an alternative authentication mechanism is configured. Use one of the following methods to configure basic authentication:

   • Configure fail-over to basic authentication, by adding the following element to the server.xml configuration file:

     <webAppSecurity allowFailOverToBasicAuth="true"/>

   • Configure basic authentication to override the client certificate authentication default, by adding the following element to the server.xml configuration file:

     <webAppSecurity overrideHttpAuthMethod="BASIC"/>

3. Optional: Map the LDAP user ID received in the basic authentication header to a SAF user ID.
   If you require a SAF user ID because the IBM z/OS Connect server uses SAF for authentication, or the System of Record requires a SAF user ID, then you can map the authenticated LDAP user ID to a SAF user ID. For more information, see the task How to map an LDAP user ID to a RACF user ID.
4. Assign users and groups to the zosConnectAccess role.
   If you mapped the LDAP user ID to a SAF user ID, as described in step 3, follow the instructions in task How to configure the zosConnectAccess role with a SAF user registry. Otherwise, follow the instructions in task How to configure the zosConnectAccess role with an LDAP user registry.