Overview
Connecting to an LDAP directory server is useful if users and groups are stored in a corporate directory such as Microsoft Active Directory. Within FireMon, we can utilize LDAP to authenticate and authorize users within FireMon. This integration is also beneficial as it allows user accounts to be automatically created which alleviates the extra steps a FireMon admin would have to go through to grant access.
Server Settings
Setting |
Description |
Name |
Enter a meaningful name to help you identify the LDAP directory server. Examples: |
Hostname |
The hostname of your directory server. Examples: |
Port |
The port on which your directory server is listening. Examples: |
Encryption |
Check this if the connection to the directory server is an SSL (Secure Sockets Layer) connection. Note: You will need to configure an SSL certificate to use this setting. None |
Server Retries |
The number of times an attempt will be made to contact the remote server. The default is set to 3. |
Server Timeout |
The number of seconds to wait for a response from the remote server. The default is set to 10 seconds. |
Base Distinguished Name |
The root of the directory tree from which to perform user and group searches. Note: This value will be appended to the User Search Base and Group Search Base fields. If this field is empty, the full Base DN should be specified in User Search Base and Group Search Base. Example: |
Bind Distinguished Name |
The distinguished name of the user that the application will use when connecting to the directory server. Note: This account needs permission to perform searches on the remote authentication server Examples: |
Bind Password |
The password of the user specified above. |
User Schema Settings
Setting |
Description |
User Search Base |
The location in the directory tree from which user searches are performed. If the Base Distinguished Name is empty, this entry should be the full directory path; otherwise, this is a relative path and is prepended to the Base Distinguished Name. Examples: CN=Users,DC=jwadtest,DC=somedomain,DC=com |
User Search Filter |
The LDAP search query to be used for finding the authenticating user. The authenticating username will be substituted for the placeholder string "{0}". Examples: samaccountname={0} |
First Name Attribute |
The attribute in the search results that contains the authenticating user's first name. The value for this attribute will be added to the user entry when it is created during the first successful authentication. Examples: givenName |
Last Name Attribute |
The attribute in the search results that contains the authenticating user's first name. The value for this attribute will be added to the user entry when it is created during the first successful authentication. Examples: sn |
Email Attribute |
The attribute in the search results that contains the authenticating user's email address. The value for this attribute will be added to the user entry when it is created during the first successful authentication. Examples: |
Group Schema Settings
Setting |
Description |
Group Search Base |
The location in the directory tree from which user searches are performed. If the Base Distinguished Name is empty, this entry should be the full directory path; otherwise, this is a relative path and is prepended to the Base Distinguished Name. Examples: OU=Groups,DC=jwadtest,DC=somedomain,DC=com |
Group Search Filter |
The LDAP search query to be used for finding user groups. The returned user groups can then be mapped to Security Manager groups on the User Group administration screen. Additionally, if the Group Members Attribute is set, this filter is used to obtain the authenticating user's potential groups. Examples: (objectClass=group) |
Search Subtree |
Indicates whether group searches should be limited to a single level within the tree (unchecked) or if they should traverse completely down the hierarchy (checked). If there are a large number of groups and/or a deep hierarchy, subtree searches may not perform as efficiently as a single level search. |
Group Membership Settings
Setting |
Description |
Group Members Attribute |
An optional attribute on the groups returned via the Group Search Filter that indicates the members of the group. It is recommended that when possible, the User Membership Attribute should be used instead of this for better performance. Examples: member |
User Membership Attribute |
An optional attribute on the user entry that indicates the group membership of the authenticating user. Not all LDAP servers support this, but when they do, it is recommended to use it rather than the Group Members Attribute for better performance. Examples: memberOf |
Troubleshooting LDAP
Bad bind username/password
Resolution: Check credentials and update as necessary
Incorrect user search base/group search base
Resolution: Check the base distinguished name/user search base/group search base
Incorrect certificate imported on AS for LDAPS
Resolution: Remove any unnecessary certs from /etc/pki/ca-trust/source/anchors that do not pertain to the LDAP server and then import the correct root certificate for the LDAP server with ‘fmos pki import-ca <certname>’
Comments
0 comments
Article is closed for comments.