Skip to main content

3.5.12 Managing XSCF User Accounts Using LDAP


3.5.12 Managing XSCF User Accounts Using LDAP
Lightweight Directory Access Protocol (LDAP) is a protocol that is used to access a directory service on a network. Normally, user authentication and user privilege of an XSCF user account on SPARC M12/M10 systems are managed by the local master XSCF. However, by using LDAP, they can be managed by a directory service (LDAP server) on a network. In addition, if multiple SPARC M12/M10 systems are installed, the XSCF user account common to all systems can be used with LDAP.
To manage the XSCF user account settings, such as user authentication and user privileges, using LDAP, configure the XSCF as an LDAP client.
This section describes how to manage the XSCF user account settings through a directory service on a network using LDAP.
The available characters for a user account name for XSCF login are lowercase alphabetic characters, numbers, the hyphen (-), the underscore (_), and the period (.). The name is a combination of up to 31 characters. Uppercase alphabetic characters cannot be used. The first character of the name must be a lowercase alphabetic character.
Even though you can log in using a user account name not fitting the above description, your commands may not work normally. For this reason, use the above-described user account name.
Note - This section does not describe the configuration and management of the LDAP server. An administrator who is familiar with the LDAP server should design the LDAP server.
Note - For the XCP firmware version that supports LDAP, see the latest Product Notes for your server.
In the LDAP settings, items related to an LDAP client are set. The settings cover the LDAP Server, bind ID, password, search base, and so on. In the LDAP server, the XSCF user information is managed.

Table 3-11 lists terms related to the LDAP settings.
Table 3-11  Terms Related to LDAP
Term Description
LDAP Abbreviation for Lightweight Directory Access Protocol.
LDAP is a protocol used to access a directory service on a network.
baseDN Abbreviation for base Distinguished name.
Under LDAP, directory information is organized in a hierarchical structure. To perform a search, specify the subtree to be searched in the hierarchical structure. At this time, specify the distinguished name (DN) of the top of the target subtree. This DN is referred to as the search base (baseDN).
Certificate chain List of certificates, including a user certificate and certification authority certificate. OpenSSL and TLS certificates must be downloaded in advance.
TLS Abbreviation for Transport Layer Security.
This is a protocol for encrypting information for transmission/reception via the Internet.
LDAP setting flow
This section describes the flow to configure the XSCF as an LDAP client.
  1. Enable LDAP.
  2. Enter the configuration information of the LDAP server.
    - The IP address or the host name and port number of the primary LDAP directory

    - Option: Up to two IP addresses or the host name and port of alternate LDAP directories

    - The search base distinguished name (DN) for reference

    - Whether or not to use the Transport Layer Security (TLS)
  3. Check whether or not the LDAP operates normally.
Settings required on LDAP server
  1. Add descriptions related to user privileges to an LDAP schema file.
    To configure the XSCF as an LDAP client, create an LDAP schema related to the user privileges of the XSCF on an LDAP server. Add the following descriptions to the schema file.
attributetype ( 1.3.6.1.1.1.1.40 NAME 'spPrivileges'
    DESC 'Service Processor privileges'
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    SINGLE-VALUE )
objectclass ( 1.3.6.1.1.1.2.13 NAME 'serviceProcessorUser' SUP top
AUXILIARY
    DESC 'Service Processor user'
    MAY spPrivileges )
  1. Add attributes required for users to an LDIF file.
    Add the following attributes that are required for each user to an LDIF (LDAP Data Interchange Format) file on an LDAP server.
Table 3-12  Required Attributes for an LDIF File
Field Name Description
spPrivileges User privilege that is valid on the XSCF
uidNumber User ID number that is valid on the XSCF
uidNumber must be a numeric value larger than 100. Use the showuser command to display a UID.
  1. The following shows an input example of an LDAP schema file.
spPrivileges: platadm
uidNumber: 150
User authentication mechanism when configuring the XSCF as an LDAP client
If LDAP clients are configured on the XSCF and enabled, the user authentication is first performed locally and then on the LDAP server. If the setprivileges command is executed without specifying a privilege to the user, all local privilege data of the user is deleted. After that, if the privilege reference is enabled in LDAP, then the user privilege is referenced in LDAP. When none is specified for the user privilege, the user does not have user privilege even if there is privilege data on LDAP.
The following commands are used to manage LDAP on the XSCF.
- setlookup

- setldap

Unix crypt or MD5 encryption method is used for the passwords saved in the LDAP repository.
Once you have configured the XSCF to use LDAP, it requires no day-to-day management.
LDAP setting items and shell commands to be used
Table 3-13 lists the LDAP setting items and the corresponding shell commands.
Table 3-13  LDAP Setting Items and Commands to be Used
Setting Item Function Description Shell Command Remarks
LDAP usage display Displays the status regarding whether an LDAP server is used for authentication and user privilege lookup. showlookup  
LDAP usage enable/disable Enables or disables the use of an LDAP server for authentication and user privilege lookup. setlookup If this specifies that authentication data and user privilege data be placed on an LDAP server, the system first searches the local area. If the target data is not found locally, then it searches the LDAP server.
Client display Displays LDAP client setting information. showldap  
Bind ID Registers an ID for connecting to (bind: authenticate) an LDAP server. setldap The maximum length of a bind ID is 128 characters.
Password Sets a password used to connect to an LDAP server. A password can consist of 8 to 16 characters.
Search base Sets an LDAP tree search base (baseDN).
- If this item is omitted, the command searches the tree, beginning from the top.

- The maximum length allowed for the search base is 128 characters.
Certificate chain Imports the certificate chain of an LDAP server.
Imports the certificate chain from a remote file by using a secure copy (scp).
- The certificate chain must be in the PEM format. (*1)

- A password may need to be entered to import the certificate from a remote file by using scp.
LDAP server/port Specifies the IP addresses and port numbers of the primary and secondary LDAP servers.
Specifies IP addresses or host names for the addresses.
(e.g. ldap://foobar.east, ldaps://10.8.31.14:636)
The default LDAP port number is 636 for ldaps:// and 389 for ldap:// when the port number is not specified.
Timeout Sets the maximum time (seconds) allowed for an LDAP search.  
LDAP test Tests the connection to an LDAP server.  
*1 PEM: Abbreviation for Privacy Enhanced Mail. Mail to be sent is encrypted for increased privacy.
Enabling or Disabling the use of an LDAP Server
  1. Execute the showlookup command to display the lookup method of authentication and user privileges.
    In the following example, lookup is executed only for the XSCF server for user authentication, and XSCF and LDAP servers for user privileges.
XSCF> showlookup
Privileges lookup: Local only
Authentication lookup: Local and LDAP
  1. Execute the setlookup command to enable/disable the use of an LDAP server.
    In the following example, an LDAP server is enabled for both user authentication and user privileges.
XSCF> setlookup -a ldap
XSCF> setlookup -p ldap
  1. Execute the showlookup command, and confirm the lookup method.
XSCF> showlookup
Privileges lookup: Local and LDAP
Authentication lookup: Local and LDAP
Setting LDAP server, port number, bind ID, bind password, search base (baseDN), and search time (timeout period)
  1. Execute the showldap command to display LDAP client settings.
XSCF> showldap
Bind Name:               Not set
Base Distinguished Name: Not set
LDAP Search Timeout:     0
Bind Password:           Not set
LDAP Servers:            Not set
CERTS:                   None
  1. Execute the setldap command to configure LDAP client settings.
    In the following example, a bind ID and search base (baseDN) are specified.
XSCF> setldap -b "cn=Directory Manager" -B "ou=People,dc=users,dc=apl,dc=com,o=isp"
  1. In the following example, a bind password is specified.
XSCF> setldap -p
Password:xxxxxxxx
  1. In the following example, the primary and secondary LDAP servers and port numbers are specified.
XSCF> setldap -s ldap://onibamboo:389,ldaps://company2.com:636
  1. In the following example, the timeout time for the LDAP search is specified.
XSCF> setldap -T 60
  1. Execute the showldap command, and confirm the setting.
XSCF> showldap
Bind Name:               cn=Directory Manager
Base Distinguished Name: ou=People,dc=users,dc=apl,dc=com,o=isp
LDAP Search Timeout:     60
Bind Password:           Set
LDAP Servers:            ldap://onibamboo:389 ldaps://company2.com:636
CERTS:                   None
Installing the certificate chain of an LDAP server
  1. Execute the showldap command to display the LDAP settings.
XSCF> showldap
Bind Name:               cn=Directory Manager
Base Distinguished Name: ou=People,dc=users,dc=apl,dc=com,o=isp
LDAP Search Timeout:     60
Bind Password:           Set
LDAP Servers:            ldap://onibamboo:389 ldaps://company2.com:636
CERTS:                   None
  1. Execute the setldap command to import the certificate chain.
XSCF> setldap -c hhhh@example.com:Cert.pem
  1. Execute the showldap command, and confirm that the certificate chain has been imported.
XSCF> showldap
Bind Name:               cn=Directory Manager
Base Distinguished Name: ou=People,dc=users,dc=apl,dc=com,o=isp
LDAP Search Timeout:     60
Bind Password:           Set
LDAP Servers:            ldap://onibamboo:389 ldaps://company2.com:636
CERTS:                   Exists
Testing a connection to an LDAP server
  1. Execute the setldap command to perform the test.
XSCF> setldap -t sysadmin
onibamboo:389      PASSED
  1. Log in as the user registered to the LDAP server. Confirm the authentication using the entered password.
login: sysadmin
Password:xxxxxxxx
  1. Execute the showuser command, and check whether the displayed user privilege is the same as the one created in the LDAP server.
XSCF> showuser
User Name:    sysadmin (nonlocal)
UID:          110
Privileges:   platadm