nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Adding LDAP Users as OS users in user_databases.xml

LooseKannon

Hi There,
Just wondering if anybody out there has been able to add LDAP users as OS users.

Typically in user_databases.xml this would be the first line:
< iwldap id="ldap_1" display_name="Ldap_directory" os="f" >

to add as non-OS users.

Has anybody been able to succesfully add LDAP users as OS users (i.e. < iwldap id="ldap_1" display_name="Ldap_directory" os="t" >

Basically the problem im having is after i set os=t, TeamSite does not pick up the user that i just added.

If i set os=f, it picks it up right away.

I am using TS 6.7.1 with SP1 on Linux REHL 4.5.

Any help you can provide is greatly appreciated.

Find more posts tagged with

Comments

Phanie

Hi There,
Just wondering if anybody out there has been able to add LDAP users as OS users.

Typically in user_databases.xml this would be the first line:
< iwldap id="ldap_1" display_name="Ldap_directory" os="f" >

to add as non-OS users.

Has anybody been able to succesfully add LDAP users as OS users (i.e. < iwldap id="ldap_1" display_name="Ldap_directory" os="t" >

Basically the problem im having is after i set os=t, TeamSite does not pick up the user that i just added.

If i set os=f, it picks it up right away.

I am using TS 6.7.1 with SP1 on Linux REHL 4.5.

Any help you can provide is greatly appreciated.

what are you trying to do here. are you trying to utilize non-os user functionality if so why do you want to again bring OS into consideration.

LooseCannon

Hi There,
Just wondering if anybody out there has been able to add LDAP users as OS users.

Typically in user_databases.xml this would be the first line:
< iwldap id="ldap_1" display_name="Ldap_directory" os="f" >

to add as non-OS users.

Has anybody been able to succesfully add LDAP users as OS users (i.e. < iwldap id="ldap_1" display_name="Ldap_directory" os="t" >

Basically the problem im having is after i set os=t, TeamSite does not pick up the user that i just added.

If i set os=f, it picks it up right away.

I am using TS 6.7.1 with SP1 on Linux REHL 4.5.

Any help you can provide is greatly appreciated.

Yes. My current implementation is TS 671 SP1 on Linux with TS users managed in Active Directory. Users in TS (tsusers.xml) are synchronized with AD using iwldapsync.

Have you enabled the sync attr in user_databases?

Something like...

[attr_sync name="UD-021" value="master,tsuser,ccpro,ccstd,ccpro_only,ccstd_only" /]

LooseKannon

Hey guys,
Thanks for the quick replies. With regards to attr_sync, i have actually commented that part out as there is no attribute LDAP to match it. I was also told that was not needed.

But looks like it wont work unless i use LDAP to authenticate the Linux box as well. Thats what i was told by support. This is a problem for us because the client is using Active Directory and they do not want to use AD to authenticate the Linux boxes.

My whole reasoning for this is to avoid using XSLT:

"Non-OS users cannot use the Perl compiler to compile presentation templates. The XSLT PT compiler must be used."

LooseCannon, have you been able to get LDAP users to be recognized as OS users by setting the attr_sync attribute? Sorry to ask before i try but its a hectic process here to make changes to the LDAP database. Its not something i have access to do myself.

Thanks!

LooseCannon

Hey guys,
LooseCannon, have you been able to get LDAP users to be recognized as OS users by setting the attr_sync attribute? Sorry to ask before i try but its a hectic process here to make changes to the LDAP database. Its not something i have access to do myself.

Thanks!

Yes. Our Linux machines are configured to authenticate against Active Directory. Security Architecture added a multi-valued attribute to the user schema to accommodate the TeamSite values: master,tsuser,ccpro,ccstd,ccpro_only,ccstd_only (only 2 of the possible values are used). Then attr_sync attribute was enabled in users_database to "look" for OS users in AD. ldapsync is run hourly, per setting in iw.cfg, to keep tsusers.xml synchronized with AD.

I don't blame you for not wanting to implement TS with non OS users. I wouldn't go that route either... too many drawbacks.

LooseKannon

For some reason our client does not want to use AD to authenticate users on the Linux box. They mentioned that they felt it was less secure. What has been your experience in terms of security with using AD to authenticate on the Linux box.

LooseCannon

For some reason our client does not want to use AD to authenticate users on the Linux box. They mentioned that they felt it was less secure. What has been your experience in terms of security with using AD to authenticate on the Linux box.

Sorry, I'm not up on the pros and cons of AD. I leave that up to Info Security and Security Architecture Smiley Happy

LooseKannon

No problem. Appreciate all the help. We actually have our Systems people looking into how they integrate Linux to use AD to authenticate users or use a seperate LDAP server to manage Linux boxes.

LooseKannon

Hey guys,
Just in case anybody is running into the same problem. This is what we were told by support regarding this issue.

In order to be able to add LDAP users as OS users in TeamSite the Linux OS itself must be authenticated using LDAP.

We were adding them as OS users to TeamSite, but NOT to the Linux box itself and that was causing the problem.

By using LDAP to authenticate the Linux box you are not adding users to that box (i.e. /etc/passwd).

By doing this you can avoid using XSLT for your presentation templates and also have users centralized.