Skip to main content

Contents

  1. Preface
  2. Chapter 1 Understanding an Overview of the SPARC M12/M10
    1.  1.1 Basics of the SPARC M12/M10
    2. Click 1.2 Basics of the XSCF Firmware
    3. Click 1.3 Network Configuration
    4.  1.4 Basics of Hypervisor
    5.  1.5 Basics of Oracle VM Server for SPARC
    6.  1.6 Basics of OpenBoot PROM
  3. Chapter 2 Logging In/Out of the XSCF
    1. Click 2.1 Connecting the System Management Terminal
    2. Click 2.2 Logging In to the XSCF Shell
    3.  2.3 Logging Out from the XSCF Shell
    4. Click 2.4 Logging In to XSCF Web
    5.  2.5 Logging Out From XSCF Web
    6.  2.6 Number of Connectable Users
  4. Chapter 3 Configuring the System
    1. Click 3.1 Preliminary Work for XSCF Setup
    2. Click 3.2 Understanding the Contents of the XSCF Firmware Settings
    3.  3.3 Setting Up From the XSCF Shell
    4.  3.4 Setting Up From XSCF Web
    5. Click 3.5 Creating/Managing XSCF Users
    6. Click 3.6 Setting the XSCF Time/Date
    7. Click 3.7 Configuring the SSH/Telnet Service for Login to the XSCF
    8. Click 3.8 Configuring the HTTPS Service for Login to the XSCF
    9. Click 3.9 Configuring the XSCF Network
    10. Click 3.10 Configuring Auditing to Strengthen XSCF Security
  5. Chapter 4 Configuring the System to Suit the Usage Type
    1. Click 4.1 Setting/Checking the System Altitude
    2. Click 4.2 Controlling System Start
    3. Click 4.3 Enabling/Disabling Dual Power Feed
    4. Click 4.4 Reducing Power Consumption
    5. Click 4.5 Connecting a DVD Drive
    6. Click 4.6 Using Remote Storage
  6. Chapter 5 CPU Activation
    1.  5.1 Basic Concepts of CPU Activation
    2.  5.2 CPU Activation Key
    3. Click 5.3 Adding CPU Core Resources
    4. Click 5.4 Deleting CPU Core Resources
    5. Click 5.5 Moving CPU Core Resources
    6. Click 5.6 Displaying CPU Activation Information
    7. Click 5.7 Saving/Restoring CPU Activation Keys
    8. Click 5.8 Troubleshooting CPU Activation Errors
    9.  5.9 Important Notes about CPU Activation
  7. Chapter 6 Starting/Stopping the System
    1. Click 6.1 Starting the System
    2. Click 6.2 Stopping the System
    3.  6.3 Rebooting the System
    4.  6.4 Suppressing Starting Oracle Solaris at Power-on
  8. Chapter 7 Controlling Physical Partitions
    1.  7.1 Configuring a Physical Partition
    2. Click 7.2 Setting the Physical Partition Operation Mode
    3.  7.3 Powering On a Physical Partition
    4.  7.4 Powering Off a Physical Partition
    5.  7.5 Changing the Configuration of a Physical Partition
  9. Chapter 8 Controlling Logical Domains
    1.  8.1 Configuring a Logical Domain
    2. Click 8.2 Configuring the Oracle Solaris Kernel Zone
    3. Click 8.3 Switching to the Control Domain Console From the XSCF Shell
    4. Click 8.4 Returning to the XSCF Shell From the Control Domain Console
    5.  8.5 Starting a Logical Domain
    6.  8.6 Shutting Down a Logical Domain
    7. Click 8.7 Ordered Shutdown of Logical Domains
    8.  8.8 Checking CPU Activation Information
    9. Click 8.9 Setting the OpenBoot PROM Environment Variables of the Control Domain
    10. Click 8.10 Domain Console Logging Function
    11.  8.11 Changing the Configuration of a Logical Domain
    12.  8.12 Setting the Logical Domain Time
    13. Click 8.13 Collecting a Hypervisor Dump File
    14. Click 8.14 Managing Logical Domain Resources Associated with CPU Sockets
    15. Click 8.15 Setting the Physical Partition Dynamic Reconfiguration Policy
    16. Click 8.16 Setting the Maximum Page Size of a Logical Domain
  10. Chapter 9 Managing the Systems Daily
  11. Chapter 10 Preparing/Taking Action for Failures
    1.  10.1 Learning about Troubleshooting and Related Functions
    2. Click 10.2 Receiving Notification by E-mail When a Failure Occurs
    3. Click 10.3 Monitoring/Managing the System Status With the SNMP Agent
    4. Click 10.4 Monitoring the System
    5.  10.5 Understanding the Failure Degradation Mechanism
    6. Click 10.6 Checking Failed Hardware Resources
    7. Click 10.7 Setting Automatic Replacement of Failed CPU Cores
    8.  10.8 Setting Recovery Mode
    9.  10.9 Setting Up a Redundant Component Configuration
    10. Click 10.10 Saving/Restoring XSCF Settings Information
    11. Click 10.11 Saving/Restoring Logical Domain Configuration Information in the XSCF
    12. Click 10.12 Saving/Restoring Logical Domain Configuration Information in an XML File
    13. Click 10.13 Saving/Restoring the OpenBoot PROM Environment Variables
    14.  10.14 Saving/Restoring the Contents of a Hard Disk
    15.  10.15 Resetting a Logical Domain
    16. Click 10.16 Causing a Panic in a Logical Domain
    17.  10.17 Resetting a Physical Partition
    18. Click 10.18 Returning the Server to the State at Factory Shipment
    19.  10.19 Collecting a Crash Dump File Using Deferred Dump
  12. Chapter 11 Checking the System Status
    1. Click 11.1 Checking the System Configuration/Status
    2. Click 11.2 Checking a Physical Partition
  13. Chapter 12 Checking Logs and Messages
    1. Click 12.1 Checking a Log Saved by the XSCF
    2. Click 12.2 Checking Warning and Notification Messages
  14. Chapter 13 Switching to Locked Mode/Service Mode
    1.  13.1 Understanding the Differences Between Locked Mode and Service Mode
    2.  13.2 Switching the Operating Mode
  15. Chapter 14 Configuring a Highly Reliable System
    1. Click 14.1 Configuring Memory Mirroring
    2. Click 14.2 Configuring Hardware RAID
    3.  14.3 Using the LDAP Service
    4.  14.4 Using SAN Boot
    5.  14.5 Using iSCSI
    6. Click 14.6 Remote Power Management for the SPARC M12/M10 and I/O Devices
    7.  14.7 Using an Uninterruptible Power Supply
    8. Click 14.8 Using Verified Boot
  16. Chapter 15 Expanding the System Configuration
    1.  15.1 Changing the Virtual CPU Configuration
    2.  15.2 Changing the Memory Configuration
    3. Click 15.3 Dynamic Reconfiguration Function for PCIe Endpoint Devices
    4. Click 15.4 Using the PCI Expansion Unit
    5.  15.5 Expanding the SPARC M12-2S/M10-4S
  17. Chapter 16 Updating the XCP Firmware
    1. Click 16.1 Basics of Firmware Update
    2. Click 16.2 Before Updating Firmware
    3.  16.3 Update Flow
    4.  16.4 Preparing an XCP Image File
    5. Click 16.5 Updating Firmware
    6.  16.6 Updating Firmware From XSCF Web
    7. Click 16.7 Firmware Version Matching with Parts Addition/Replacement
    8.  16.8 Trouble During Firmware Update
    9.  16.9 FAQ Relating to Firmware Update
  18. Chapter 17 Updating Oracle Solaris and Oracle VM Server for SPARC
  19. Chapter 18 Troubleshooting
    1.  18.1 Troubleshooting for the XSCF
    2.  18.2 Precautions Concerning Using the RESET Switch
    3.  18.3 Frequently Asked Questions / FAQ
    4.  18.4 System Troubleshooting With the XSCF
  20. Appendix A Lists of SPARC M12/M10 System Device Paths
    1.  A.1 SPARC M12-1 Device Paths
    2. Click A.2 SPARC M12-2 Device Paths
    3. Click A.3 SPARC M12-2S Device Paths
    4.  A.4 SPARC M10-1 Device Paths
    5. Click A.5 SPARC M10-4 Device Paths
    6. Click A.6 SPARC M10-4S Device Paths
  21. Appendix B Identifying an SAS2 Device Based on a WWN
    1.  B.1 World Wide Name (WWN) Syntax
    2.  B.2 Overview of probe-scsi-all Command Output
    3. Click B.3 Identifying a Disk Slot by Using the probe-scsi-all Command
    4. Click B.4 Identifying Disk Slot
  22. Appendix C List of the XSCF Web Pages
    1.  C.1 Overview of the Pages
    2.  C.2 Understanding the Menu Configuration
    3. Click C.3 Available Pages
  23. Appendix D XSCF MIB Information
    1.  D.1 MIB Object Identification
    2.  D.2 Standard MIB
    3. Click D.3 Extended MIB
    4.  D.4 Traps
  24. Appendix E SPARC M12/M10 System-specific Functions of Oracle VM Server for SPARC
    1.  E.1 Ordered Shutdown of Logical Domains
    2.  E.2 CPU Activation Support
    3. Click E.3 Checking Failed Resources
    4.  E.4 Automatic Replacement of Failed CPUs
    5.  E.5 Hypervisor Dump
    6.  E.6 Domain Console Logging Function
    7.  E.7 CPU Socket Restrictions
  25. Appendix F SAS2IRCU Utility Command Examples
    1.  F.1 Displaying a List of SAS Controllers Recognized by sas2ircu
    2.  F.2 Displaying the Information of a Hardware RAID Volume
    3.  F.3 Adding a Hardware RAID Volume
    4.  F.4 Displaying the Configuration Status of a Hardware RAID Volume
    5.  F.5 Creating a Hot Spare of a Hardware RAID Volume
    6.  F.6 Deleting a Hot Spare of a Hardware RAID Volume
    7.  F.7 Deleting a Hardware RAID Volume
    8.  F.8 Identifying the Faulty Disk Drive of a Hardware RAID Volume
  26. Appendix G SPARC M12-1/M10-1 XSCF Startup Mode Function
    1. Click G.1 Function Overview
    2. Click G.2 Restrictions and Notes
    3.  G.3 Configuration Procedure
  27. Appendix H OpenBoot PROM Environment Variables and Commands
    1.  H.1 SCSI Device Display
    2.  H.2 Unsupported OpenBoot PROM Environment Variables
    3.  H.3 Unsupported OpenBoot PROM Commands
    4.  H.4 Behavior With the Security Mode Enabled
  28. Appendix I How to Specify the Boot Device
    1.  I.1 Device Path of the Internal Storage
    2.  I.2 Method of Specification With a PHY Number
    3.  I.3 Method of Specification With a Target ID
    4.  I.4 Method of Specification With an SAS Address
    5.  I.5 Method of Specification With a Volume Device Name
    6.  I.6 Notes About the Device Alias net of the SPARC M12 Without On-Board LAN
  29. Appendix J Lists of DVD Drive Aliases
    1. Click J.1 External DVD Drive Aliases
    2. Click J.2 Remote Storage DVD Drive Aliases
  30. Appendix K CPU Activation Interim Permit
    1.  K.1 What is the CPU Activation Interim Permit?
    2.  K.2 Terms of Use of the CPU Activation Interim Permit and Precautions
    3. Click K.3 Related Commands
    4. Click K.4 Flows and Procedures for Using a CPU Activation Interim Permit
    5. Click K.5 Event Notification of the CPU Activation Interim Permit
    6. Click K.6 Other Important Notes

3.5.14 Managing XSCF User Accounts Using LDAP over SSL


3.5.14 Managing XSCF User Accounts Using LDAP over SSL
In the LDAP over SSL settings, items related to an LDAP over SSL client are set. The settings cover the LDAP over SSL server, loading of server certificate, group name, user privilege, user domain, log, DNS locator query, and so on. In the LDAP over SSL server, the XSCF user information is managed.
The available characters for a user account name for XSCF login are lowercase alphabetic characters, numbers, the hyphen (-), the underscore (_), and the period (.). The name is a combination of up to 31 characters. Uppercase alphabetic characters cannot be used. The first character of the name must be a lowercase alphabetic character.
Even though you can log in using a user account name not fitting the above description, your commands may not work normally. For this reason, use the above-described user account name.
Note - This section does not describe the configuration and management of the LDAP over SSL server. An administrator who is familiar with the LDAP over SSL server should design the LDAP over SSL server.
Note - For the XCP firmware version that supports LDAP over SSL, see the latest Product Notes.
Table 3-16 lists terms related to the LDAP over SSL settings.
Table 3-16  Terms Related to LDAP over SSL
Term Description
LDAP over SSL LDAP over SSL is a distributed directory service like Active Directory. LDAP over SSL offers enhanced security to LDAP users by using Secure Socket Layer (SSL)/Transport Layer Security (TLS) technology. Like LDAP directory service, LDAP over SSL is used for user authentication.
LDAP over SSL provides both user certificate authentication and authorization of a user access level to network resources. LDAP over SSL uses the authentication to identify specific users before they access the system resources, and to grant specific access privileges to users in order to control their rights to access network resources.

User privileges are either configured on the XSCF or obtained from a server in a network domain based on each user's group membership. A user can belong to more than one group. User domain is the authentication domain used to authenticate a user. LDAP over SSL authenticates users in the order in which the user domains are configured.

Once authenticated, user privileges can be determined in the following ways:
  1. In the simplest case, user privileges are determined by the LDAP over SSL settings on the XSCF. There is a defaultrole parameter for the LDAP over SSL. If the defaultrole parameter is configured or set, all users that are authenticated via LDAP over SSL are assigned the user privileges set in the parameter. Users that are set on the LDAP over SSL server require only a password regardless of their group membership.
  2. If the defaultrole parameter is not configured or set, user privilege is obtained from the LDAP over SSL server based on the user's group membership. On the XSCF, the group parameter must correspond to the group name of an LDAP over SSL server. Each group has a user privilege that is configured on the XSCF and is associated with the group. Once a user is authenticated, the user's group membership is used to determine the user privilege.
LDAP over SSL setting items and shell commands to be used
Table 3-17 lists the setting items and the corresponding shell commands.
Table 3-17  LDAP over SSL Setting Items and Commands to be Used
Setting Item Function Description Shell Command Remarks
LDAP over SSL status display Displays the current status of LDAP over SSL, such as enable/disable of LDAP over SSL and usemapmode. showldapssl  
LDAP over SSL usage enable/disable Specifies whether to enable/disable the use of the LDAP over SSL server for managing authentication and user privileges. setldapssl It is disabled by default.
LDAP over SSL server display Displays the configuration of the primary LDAP over SSL server or up to five alternate LDAP over SSL servers. showldapssl A port number "0" indicates that the default port for LDAP over SSL is used.
LDAP over SSL server/port Specifies IP addresses and port numbers of the primary and up to five alternate LDAP over SSL servers.
Specifies IP addresses or host names for the addresses.
To specify host names for the LDAP over SSL servers, the server names must be resolvable by the DNS server.		 setldapssl When a port number is not specified, the default port is used.
Server certificate load/delete Loads or deletes the certificates of the primary and up to five alternate servers. setldapssl The strictcertmode must be in the disabled state for a certificate to be removed.
usermapmode enable/disable Enables/disables the usermapmode.
When enabled, user attributes specified with the usermap operand, rather than user domain, are used for user authentication.		 setldapssl It is disabled by default.
usermap display Displays the usermap setting. showldapssl  
usermap Configures the usermap.
The usermap is used for user authentication.		 setldapssl The usermapmode must be enabled to use the usermap.
strictcertmode enable/disable Enables or disables the strictcertmode.
If the strictcertmode is enabled, the certificate of a server must have already been uploaded to the server so that the certificate signatures can be validated when the server certificate is presented.		 setldapssl It is disabled by default.
Server certificate display Displays the following:
- Certificate information for the primary and up to five alternate servers.

- Entire contents of the certificate
 showldapssl  
User domain display Displays user domains. showldapssl  
User domain Configures up to five specified user domains. User domain is specified in the Distinguished Name (DN) format. setldapssl  
defaultrole display Displays the defaultrole setting. showldapssl  
defaultrole Specifies the user privilege assigned to all users that are authenticated via LDAP over SSL. setldapssl  
Group display Displays the configuration of administrator group, operator group, and custom group. showldapssl  
Administrator group Assigns group names for up to five administrator groups. The administrator group has platadm, useradm, and auditadm privileges. These privileges cannot be changed. setldapssl  
Operator group Assigns group names for up to five operator groups. The operator group has platop and auditop privileges. These privileges cannot be changed. setldapssl  
Custom group Assigns group names and user privileges for up to five groups. setldapssl  
Timeout Configures transaction timeout in seconds.
You can specify a numeric value from 1 to 20.		 setldapssl The default value is 4 seconds. If a specified timeout is too short for the configuration, the login process or retrieval of the user privilege setting could fail.
Log enable/disable Enables/disables the logs of LDAP over SSL authentication and authorization diagnosis messages. setldapssl This log is cleared when the XSCF is rebooted.
Log display Displays LDAP over SSL authentication and authorization diagnosis messages. showldapssl  
Log clear Clears the logs of LDAP over SSL authentication and authorization diagnosis messages. setldapssl  
Default Resets the LDAP over SSL settings to their factory defaults. setldapssl  
Before Configuring the LDAP over SSL Settings
Note the following before configuring the LDAP over SSL settings.
  1. Confirm that the XCP version that supports LDAP over SSL is used. For the XCP that supports LDAP over SSL, see the latest Product Notes.
  2. The useradm privilege is required for the LDAP over SSL settings.
  3. If the XSCF is configured to use LDAP, Active Directory, or LDAP over SSL for user account data, then the user account name and user identifier (if specified) must not already be in use in the XSCF, LDAP, Active Directory, or LDAP over SSL.
  4. To use a host name for the LDAP over SSL server, DNS settings need to be configured properly before setting LDAP over SSL.
  5. In LDAP over SSL, the system account called proxyuser is used. Verify that no user account with that name already exists. If a user account with the name proxyuser exists, then delete the account with the deleteuser command. After deleting the account, reboot the XSCF before using LDAP over SSL.
  6. If the value set by the timeout operand is small, and you log in to the XSCF, user privilege may not be assigned to you. In this case, increase the timeout setting value and try again.
  7. LDAP over SSL users cannot upload a user public key to the XSCF. LDAP over SSL users can login by connecting to the XSCF via SSH using password authentication.
Enabling/Disabling the Use of the LDAP over SSL Server
  1. Execute the showldapssl command to display the usage of the LDAP over SSL server.
XSCF> showldapssl
usermapmode: disabled
state: disabled
strictcertmode: disabled
timeout: 4
logdetail: none
  1. Execute the setldapssl command to enable/disable the use of the LDAP over SSL server.
    In the following example, the use of the LDAP over SSL server is enabled.
XSCF> setldapssl enable
  1. In the following example, the use of the LDAP over SSL server is disabled.
XSCF> setldapssl disable
  1. Execute the showldapssl command, and check whether LDAP over SSL is enabled or disabled.
    In the following example, the LDAP over SSL is enabled.
XSCF> showldapssl
usermapmode: disabled
state: enabled
strictcertmode: disabled
timeout: 4
logdetail: none
Setting LDAP over SSL Servers and Port Numbers
  1. Execute the showldapssl command to display the LDAP over SSL server settings.
XSCF> showldapssl server
Primary Server
address: (none)
port: 0
XSCF> showldapssl server -i
Alternate Server 1
address: (none)
port: 0
Alternate Server 2
address: (none)
port: 0
Alternate Server 3
address: (none)
port: 0
Alternate Server 4
address: (none)
port: 0
Alternate Server 5
address: (none)
port: 0
  1. Execute the setldapssl command to set LDAP over SSL servers.
    In the following example, the primary server and port number are specified.
XSCF> setldapssl server 10.18.76.230:4041
  1. In the following example, alternate servers are specified.
XSCF> setldapssl server -i 1 10.18.76.231
  1. Execute the showldapssl command, and confirm the LDAP over SSL server settings.
XSCF> showldapssl server
Primary Server
address: 10.18.76.230
port: 4041

XSCF> showldapssl server -i
Alternate Server 1
address: 10.18.76.231
port: 0
Alternate Server 2
address: (none)
port: 0
Alternate Server 3
address: (none)
port: 0
Alternate Server 4
address: (none)
port: 0
Alternate Server 5
address: (none)
port: 0
Loading/Deleting the Server Certificate
  1. Execute the showldapssl command to display the server certificate information.
XSCF> showldapssl cert
Primary Server:
certstatus = certificate not present
issuer = (none)
serial number = (none)
subject = (none)
valid from = (none)
valid until = (none)
version = (none)

XSCF> showldapssl cert -i
Alternate Server 1:
certstatus = certificate not present
issuer = (none)
serial number = (none)
subject = (none)
valid from = (none)
valid until = (none)
version = (none)

Alternate Server 2:
... <snip>

Alternate Server 5:
certstatus = certificate not present
issuer = (none)
serial number = (none)
subject = (none)
valid from = (none)
valid until = (none)
version = (none)
  1. Execute the setldapssl command to load the serve certificate to the XSCF.
    In the following example, the server certificate of the primary server is loaded using the user name and password.
XSCF> setldapssl loadcert -u yoshi http://domain_3/UID_2333/testcert
Warning: About to load certificate for Primary Server.
Continue? [y|n]: y
Password:
  1. In the following example, the content of the certificate is copied and pasted on the screen, and then the certificate for the alternate server 1 is loaded from a console. After pressing the [Enter] key, press the [Ctrl] and [D] keys to complete loading.
XSCF> setldapssl loadcert console
Warning: About to load certificate for Alternate Server 1:
Continue? [y|n]: y
Please enter the certificate:
-----BEGIN CERTIFICATE-----

MIIETjCCAzagAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJVUzET
MBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJU2FuIERpZWdvMRkwFwYDVQQK
ExBTdW4gTWljcm9zeXN0ZW1zMRUwEwYDVQQLEwxTeXN0ZW0gR3JvdXAxEjAQBgNV
:
-----END CERTIFICATE-----

[Enter]
[Ctrl]+[D]
  1. Execute the showldapssl command, and confirm that the server certificate has been loaded.
XSCF> showldapssl cert
Primary Server:
certstatus = certificate present
issuer = DC = local, DC = xscf, CN = apl
serial number = 55:1f:ff:c4:73:f7:5a:b9:4e:16:3c:fc:e5:66:5e:5a
subject = DC = local, DC = xscf, CN = apl
valid from = Mar 9 11:46:21 2010 GMT
valid until = Mar 9 11:46:21 2015 GMT
version = 3 (0x02)

XSCF> showldapssl cert -i 1
Alternate Server 1:
certstatus = certificate present
issuer = DC = local, DC = aplle, CN = aplle.local
serial number = 0b:1d:43:39:ee:4b:38:ab:46:47:de:0a:b4:a9:ea:04
subject = DC = local, DC = aplle, CN = aplle.local
valid from = Aug 25 02:38:15 2009 GMT
valid until = Aug 25 02:44:48 2014 GMT
version = 3 (0x02)
  1. Execute the setldapssl command to delete the primary server certificate.
XSCF> setldapssl rmcert
Warning: About to delete certificate for Primary Server.
Continue? [y|n]: y
  1. Execute the showldapssl command, and confirm that the server certificate has been deleted.
XSCF> showldapssl cert
Primary Server:
certstatus = certificate not present
issuer = (none)
serial number = (none)
subject = (none)
valid from = (none)
valid until = (none)
version = (none)
  1. The strictcertmode must be in the disabled state for a certificate to be removed.
Enabling/Disabling the usermapmode
  1. Execute the showldapssl command to display whether the usermapmode is enabled or disabled.
XSCF> showldapssl
usermapmode: disabled
state: enabled
strictcertmode: disabled
timeout: 4
logdetail: none
  1. Execute the setldapssl command to enable/disable the usermapmode.
    In the following example, the usermapmode is enabled.
XSCF> setldapssl usermapmode enable
  1. In the following example, the usermapmode is disabled.
XSCF> setldapssl usermapmode disable
  1. Execute the showldapssl command to confirm that the usermapmode is enabled/disabled.
    In the following example, the usermapmode is enabled.
XSCF> showldapssl
usermapmode: enabled
state: enabled
strictcertmode: disabled
timeout: 4
logdetail: none
Setting or Clearing the usermap
  1. Execute the showldapssl command to display the configuration of the usermap.
XSCF> showldapssl usermap
attributeInfo: (none)
binddn: (none)
bindpw: (none)
searchbase: (none)
  1. Execute the setldapssl command to configure the usermap.
    In the following example, attribute information is set.
XSCF> setldapssl usermap attributeInfo '(&(objectclass=person)(uid=))'
  1. In the following example, the bind DN is set.
XSCF> setldapssl usermap binddn CN=SuperAdmin,DC=aCompany,DC=com
  1. In the following example, the bind password is set.
XSCF> setldapssl usermap bindpw b.e9s#n
  1. In the following example, the search base is set.
XSCF> setldapssl usermap searchbase OU=yoshi,DC=aCompany,DC=com
  1. Execute the showldapssl command, and confirm the usermap.
XSCF> showldapssl usermap
attributeInfo: (&(objectclass=person)(uid=))
binddn: CN=SuperAdmin,DC=aCompany,DC=com
bindpw: Set
searchbase: OU=yoshi,DC=aCompany,DC=com
  1. Execute the setldapssl command to clear the usermap.
    In the following example, attribute information is cleared.
XSCF> setldapssl usermap attributeInfo
  1. In the following example, the bind DN is cleared.
XSCF> setldapssl usermap binddn
  1. In the following example, the bind password is cleared.
XSCF> setldapssl usermap bindpw
  1. In the following example, the search base is cleared.
XSCF> setldapssl usermap searchbase
  1. Execute the showldapssl command, and confirm that the usermap has been cleared.
XSCF> showldapssl usermap
attributeInfo: (none)
binddn: (none)
bindpw: (none)
searchbase: (none)
  1. The usermapmode must be enabled to use the usermap.
Enabling/Disabling the strictcertmode
  1. Execute the showldapssl command to display whether the strictcertmode is enabled or disabled.
XSCF> showldapssl
usermapmode: enabled
state: enabled
strictcertmode: disabled
timeout: 4
logdetail: none
  1. Execute the setldapssl command to enable/disable the strictcertmode.
    In the following example, the strictcertmode is enabled.
XSCF> setldapssl strictcertmode enable
  1. In the following example, the strictcertmode is disabled.
XSCF> setsetldapssl strictcertmode disable
  1. Execute the showldapssl command, and confirm that the strictcertmode is enabled/disabled.
    In the following example, the strictcertmode is enabled.
XSCF> showldapssl
usermapmode: enabled
state: enabled
strictcertmode: enabled
timeout: 4
logdetail: none
  1. To enable the strictcertmode, the server certificate must have already been loaded to the XSCF.
Setting a User Domain
  1. Execute the showldapssl command to display user domains.
XSCF> showldapssl userdomain
domain 1: (none)
domain 2: (none)
domain 3: (none)
domain 4: (none)
domain 5: (none)
  1. Execute the setldapssl command to set user domains.
    In the following example, user domain 1 is set.
XSCF> setldapssl userdomain -i 1 '@davidc.example.aCompany.com'
  1. In the following example, user domain 2 is set.
XSCF> setldapssl userdomain -i 2 'CN=<USERNAME>,CN=Users,DC=davidc,DC=example,DC=aCompany,DC=com'
  1. Execute the showldapssl command, and confirm the user domains.
XSCF> showldapssl userdomain
domain 1: <USERNAME>@davidc.example.aCompany.com
domain 2: CN=<USERNAME>,CN=Users,DC=davidc,DC=example,DC=aCompany,DC=com
domain 3: (none)
domain 4: (none)
domain 5: (none)
Setting the Default Privilege
  1. Execute the showldapssl command to display the default privilege.
XSCF> showldapssl defaultrole
Default role: (none)
  1. Execute the setldapssl command to set a default privilege.
XSCF> setldapssl defaultrole platadm platop
  1. Execute the showldapssl command, and confirm the default privilege.
XSCF> showldapssl defaultrole
Default role: platadm platop
Setting Group Names and Privileges
  1. Execute the showldapssl command to display group names.
    The following example shows administrator groups.
XSCF> showldapssl group administrator
Administrator Group 1
name: (none)
Administrator Group 2
name: (none)
Administrator Group 3
name: (none)
Administrator Group 4
name: (none)
Administrator Group 5
name: (none)
  1. The following example shows operator groups.
XSCF> showldapssl group operator
Operator Group 1
name: (none)
Operator Group 2
name: (none)
Operator Group 3
name: (none)
Operator Group 4
name: (none)
Operator Group 5
name: (none)
  1. The following example shows custom groups.
XSCF> showldapssl group custom
Custom Group 1
name: (none)
roles: (none)
Custom Group 2
name: (none)
roles: (none)
Custom Group 3
name: (none)
roles: (none)
Custom Group 4
name: (none)
roles: (none)
Custom Group 5
name: (none)
roles: (none)
  1. Execute the setldapssl command to set group names and privileges.
    In the following example, administrator group 1 is set.
XSCF> setldapssl group administrator -i 1 name CN=SpSuperAdmin,OU=Groups,DC=davidc,DC=example,DC=aCompany,DC=com
  1. In the following example, operator group 1 is set.
XSCF> setldapssl group operator -i 1 name CN=OpGroup1,OU=SCFTEST,DC=aplle,DC=local
  1. In the following example, custom group 1 is set.
XSCF> setldapssl group custom -i 1 name CN=CtmGroup1,OU=SCFTEST,DC=aplle,DC=local
  1. In the following example, the privilege of the custom group 1 is set.
XSCF> setldapssl group custom -i 1 roles platadm,platop
  1. Execute the showldapssl command, and confirm the group names and privileges.
    In the following example, the administrator groups are confirmed.
XSCF> showldapssl group administrator
Administrator Group 1
name: CN=<USERNAME>,CN=SpSuperAdmin,OU=Groups,DC=davidc,DC=example,DC=aCompany,DC=com
Administrator Group 2
name: (none)
Administrator Group 3
name: (none)
Administrator Group 4
name: (none)
Administrator Group 5
name: (none)
  1. In the following example, the operator groups are confirmed.
XSCF> showldapssl group operator
Operator Group 1
name: CN=OpGroup1,OU=SCFTEST,DC=aplle,DC=local
Operator Group 2
name: (none)
Operator Group 3
name: (none)
Operator Group 4
name: (none)
Operator Group 5
name: (none)
  1. In the following example, the custom groups are confirmed.
XSCF> showldapssl group custom
Custom Group 1
name: CN=CtmGroup1,OU=SCFTEST,DC=aplle,DC=local
roles: platadm platop
Custom Group 2
name: (none)
roles: (none)
Custom Group 3
name: (none)
roles: (none)
Custom Group 4
name: (none)
roles: (none)
Custom Group 5
name: (none)
roles: (none)
  1. The administrator group has platadm, useradm, and auditadm privileges. These privileges cannot be changed. The operator group also has platop and auditop privileges. These privileges cannot be changed.
Setting a Timeout
  1. Execute the showldapssl command to display the timeout time.
XSCF> showldapssl
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 4
logdetail: none
  1. Execute the setldapssl command to set the timeout time.
    In the following example, the timeout time is set to 10 seconds.
XSCF> setldapssl timeout 10
  1. Execute the showldapssl command, and confirm the timeout time.
XSCF> showldapssl
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 10
logdetail: none
Enabling or Disabling the Logs of LDAP over SSL Authentication and Authorization Diagnosis Messages
  1. Execute the showldapssl command to display the log detail level.
XSCF> showldapssl
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 10
logdetail: none
  1. Execute the setldapssl command to set the log detail level.
    In the following example, the log is enabled and the log detail level is set to trace.
XSCF> setldapssl logdetail trace
  1. In the following example, the log is disabled.
XSCF> setldapssl logdetail none
  1. Execute the showldapssl command, and confirm the log detail level.
    In the following example, the log detail level is set to trace.
XSCF> showldapssl
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 10
logdetail: trace
Displaying the Log of Diagnosis Messages and Clearing the Log File
  1. Execute the showldapssl command to display the log detail level.
XSCF> showldapssl
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 10
logdetail: trace
  1. Execute the showldapssl command to display the diagnosis messages.
    In the following example, diagnosis messages are displayed in real time.
XSCF> showldapssl log -f
Mon Nov 16 14:47:53 2009 (LdapSSL): module loaded, OPL
Mon Nov 16 14:47:53 2009 (LdapSSL): --error-- authentication status:
auth-ERROR
Mon Nov 16 14:48:18 2009 (LdapSSL): module loaded, OPL
:
  1. Execute the setldapssl command to clear the log file of diagnosis messages.
XSCF> setldapssl log clear
Warning: About to clear log file.
Continue? [y|n]: y
Resetting the LDAP over SSL Settings to Their Defaults
  1. Execute the showldapssl command to display the status of the LDAP over SSL settings.
XSCF> showldapssl
dnslocatormode: enabled
expsearchmode: enabled
state: enabled
strictcertmode: enabled
timeout: 10
logdetail: trace
  1. Execute the setldapssl command to reset the LDAP over SSL settings to their defaults.
XSCF> setldapssl default -y
Warning: About to reset settings to default.
Continue? [y|n]: y
  1. Execute the showldapssl command, and confirm that the LDAP over SSL settings have been reset to their defaults.
XSCF> showldapssl
dnslocatormode: disabled
expsearchmode: disabled
state: disabled
strictcertmode: disabled
timeout: 4
logdetail: none
Logging In With the LDAP over SSL User Account
After completing each setting, confirm whether login with the user account of LDAP over SSL is possible.

Top of Page