OpenMake Meister

Enabling and Modifying LDAP Configurations Using ompw

If you intend to enable LDAP or modify LDAP parameters for your server, you will need to use ompw, since you will need to use the password encryption functions built into ompw.

The relevant flags for changing enabling and modifying LDAP configuration are:

--ldapURL, --ldapAuthType, --ldapID, --ldapPassword, --ldapSync, --ldapAdminGroupDN.

Each flag corresponds to a parameter in the web.xml configuration file for your Knowledge Base server and takes as an argument the value to which that parameter will be changed.

--ldapURL  corresponds to the URL that the Knowledge Base Server will use to contact your LDAP server. The LDAP URL should be in the format of :

ldap://<LDAP SERVER>:<LDAP PORT>/<DISTINGUISHED NAME FOR LDAP ROOT NODE>

Example: --ldapURL ldap://catalyst:389/dc=catalyst,dc=com

 

--ldapAuthType denotes the LDAP authorization type that you want to use. This field accepts values of simple, heavy, or none.

--ldapID corresponds to the Distinguished Name of the the user with LDAP write privileges for the Group. This user does not have to be a Knowledge Base server administrator, but they must have add and edit privileges for the LDAP node structure, and they must have read privileges for Users and Groups under the LDAP node.

Note:  This user will only be editing the LDAP node, and will not be changing LDAP privileges for users and groups within the LDAP node.

 

--ldapPassword supplies the password that will be used when contacting the LDAP server. The password will be encrypted on web.xml file using the Blowfish algorithm that uses a key varying in length from 32 bits to 56 bits.

--ldapSync sets how often the Knowledge Base server syncronizes with the LDAP server. The value added for this flag is the number of minutes between syncronization cycles. If you do not wish to automatically syncronize your Knowledge Base and LDAP servers, set this value to 0.

--ldapAdminGroupDN is the Distinguished Name for the group that will be associated with admin privileges on the Knowledge Base server. Since, by default, there needs to be an administrators group on the Knowledge Base server, this group must exist on your LDAP server before you enable LDAP for the Knoweldge Base Server.

 

If you updated all LDAP parameters using ompw, your command may look like this:

ompw –-kbHome C:\meister7\tomcat\webapps\openmake.ear –-ldapURL ldap://catalyst:389/cn=catalyst,cn=com -–ldapAuthType simple -–ldapID cn=Manager,dc=catalyst,dc=com –-ldapPassword password --ldapSync 60 –-ldapAdminGroupDN CN=admins,OU=groups,DC=catalyst,DC=com

 

After you have successfully updated the web.xml file on the Knowledge Base server, you will need to set up the node on the LDAP server. This is accomplished  by using the ConfigLDAPServer class that exists in the bin directory in your Knowledge Base server install location. This class will take the values that are entered in your web.xml file and configure the  node on LDAP according to the values. The structure of the command to invoke the ConfigLDAPServer class is as follows:

java –cp "<KB INSTALL DIR>/tomcat/webapps/openmake.ear/openmake.war/WEB-INF/lib/omserver.jar;." ConfigLDAPServer "<KB INSTALL DIR>"

 

Once you have successfully updated the LDAP server to include the node, you can restart the Knowledge Base server, and LDAP functionality should be in place for any user that logs on .