Users Guide

Pre-requisites/supported attributes for LDAP Integration
Table 27. OpenManage Enterprise Pre-requisites/supported attributes for LDAP Integration
Attribute of User Login Attribute of Group
Membership
Certificate Requirement
AD/LDAP Cn, sAMAccountName Member
● Subject to Domain
Controller Certificate needs
to have FQDN. SAN field
can have IPv4 and/or IPv6
or FQDN.
● Only Base64 certificate
format is supported
OpenLDAP uid, sn Uniquemember Only PEM certificate format is
supported
PHP LDAP uid MemberUid
User pre-requisites for directory service integration
You must ensure that the following user pre-requisites are met before you begin with the directory service integration:
1. BindDN user and user used for 'Test connection' should be the same.
2. If Attribute of User Login is provided, only the corresponding username value assigned to the attribute is allowed for
appliance login.
3. User used for Test connection should be part of any non-default group in LDAP
4. Attribute of Group Membership should have either the 'userDN' or the short name (used for logging in) of the user.
5. When MemberUid is used as 'Attribute of Group Membership,' the username used in appliance login will be considered case
sensitive in some LDAP configurations.
6. When search filter is used in LDAP configuration, user login is not allowed for those users who is not part of the search
criteria mentioned.
7. Group search will work only if the groups have users assigned under the provided Attribute of Group Membership .
NOTE:
If the OpenManage Enterprise is hosted on an IPv6 network, the SSL authentication against domain controller using
FQDN would fail if IPv4 is set as preferred address in DNS. To avoid this failure, do one of the following:
● DNS should be set to return IPv6 as preferred address when queried with FQDN.
● DC certificate needs to have IPv6 in SAN field.
To use the Directory Services:
● Add a directory connection. See Add or edit Active Directory groups to be used with Directory Services on page 138.
● Import directory groups and map all users in the group to a specific role. See Import AD and LDAP groups on page 137.
● For DM users, edit the directory group to add the groups the DM can manage. See Add and edit OpenManage Enterprise
users on page 136.
Import AD and LDAP groups
NOTE:
The users without Administrator rights cannot enable or disable the Active Directory (AD) and Lightweight Directory
Access Protocol (LDAP) users.
NOTE: Before importing AD groups in OpenManage Enterprise, you must include the user groups in a UNIVERSAL GROUP
while configuring the AD.
1. Click Import Directory Group.
2. In the Import Active Directory dialog box:
Managing OpenManage Enterprise appliance settings
137