nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

TeamSite authentication migration from AD to LDAP Urjent!

joe_pat

Hi all,

we want to change our authentication from AD to LDAP. Where our current users should be able to use same Id and PW to login to teamsite by selecting a different domain.

Security will need to be changed from a model based on OS users and groups to a model based on non-OS users and groups.

Questions :

1.What are the steps that i need to follow to migrate authorization and users (current users and groups) from current domain to LDAP?

2.What are the side effects we use the same LDAP attribute to store Authorization settings for DEV, UAT and PROD. Does this means a user with master rights on DEV also gets master rights on PROD ?

3. If above one is true .Then what i have to do if we want to have different Authorization settings for DEV, UAT and PROD ?

5. We are using Mediabin and ecm connector 2.0 also what changes do i need to make ecm connector connection settings?

4. Will there be any side effects on OpenDeploy and LiveSite ?

ENV:
TS:6.7.2
OD:6.2
LS:3.1
MB:4.6.2
ecm:2.0

Awaiting for response ..Thanks in advance.

Find more posts tagged with

Comments

nipper

You do not want too much now do you ?

I hope you have a *really* good TS guy on site.

You can add different authentication methods to TS easily. That will allow you to start using AD instead of LDAP.

Same login/passwd ? Well that depends on if AD and LDAP use the same DB, we do not know. You *may* need to use idmap to map the ID and permissions from the LDAP to AD if they are different.

TS roles are per server (DEV, UAT, PROD) so you do not need to worry about giving out too much on DEV.

MB, no clue.

LS should not be effected, OD could be, depending on how you use it (if people log into the OD GUI).

joe_pat

You do not want too much now do you ?

I hope you have a *really* good TS guy on site.

You can add different authentication methods to TS easily. That will allow you to start using AD instead of LDAP.

Same login/passwd ? Well that depends on if AD and LDAP use the same DB, we do not know. You *may* need to use idmap to map the ID and permissions from the LDAP to AD if they are different.

TS roles are per server (DEV, UAT, PROD) so you do not need to worry about giving out too much on DEV.

MB, no clue.

LS should not be effected, OD could be, depending on how you use it (if people log into the OD GUI).

Thanks for you reply

I want to migrate from AD to LDAP. Not from LDAP to AD. To mention you, I
have to do this and i never did this before.So, can you give me more input ? i went through guides and found some info like we should add a new LDAP DB to user_database.xml .And some config changes in iw.cfg. but few question:

1. How do i flag users in LDAP as TS users?
2. How do i sync existing users in iwusers.xml with new LDAP DB?

Thanks in advance.

joe_pat

Can you give me sequence of steps to be followed?

Thank you.

nipper

Configure user_database.xml as you have read

Add new users via the TS GUI.

If user names are identical from AD to LDAP then you *may* need to remove a user first, if they are different, then you can just add them.

You will probably need to use idmap to match old with new.

I also *really* hope you are using TeamSite Groups or you have to do the same thing.

Also, you *may* very well be on over your head. I do not know that you will find anyone on the board who has done this already so the questions are educated guesses. There will need to be a great deal of digging based on knowledge of the system and try this, then that.

joe_pat

Thank you so much for your response ..i really like DevNet ppl

Actually i am gonna do that on a new server windows 2003 R2 instead of doing manually adding users and roles as you said, Is there a way like copying the roles.xml and iwusers.xml in existing server to new server and using them?

And if we we are managing user like this using admin Tab do we need to use in user_database.xml?

Thank you.

nipper

I have never tried to just copy the roles.xml and ts_users.xml over, I doubt that will be sufficient, but it may work.

The user_database.xml is how you tell the GUI which server should be queried for authentication, so that definitely is required. You did not mention if you use TS Groups or not, that will be a big thing to worry about if you are not using them.

ISCBorisB

Thank you so much for your response ..i really like DevNet ppl

Actually i am gonna do that on a new server windows 2003 R2 instead of doing manually adding users and roles as you said, Is there a way like copying the roles.xml and iwusers.xml in existing server to new server and using them?

And if we we are managing user like this using admin Tab do we need to use in user_database.xml?

Thank you.

TS always relied on the external Authentication mechanisms, be it OS, DAS, LDAP, Kerberos and whatnot.

To configure LDAP Authentication you absolutely must use user_database.xml. Internal User management
is for the Authorization only (directly and through Groups/FlexRoles)

joe_pat

TS always relied on the external Authentication mechanisms, be it OS, DAS, LDAP, Kerberos and whatnot.

To configure LDAP Authentication you absolutely must use user_database.xml. Internal User management
is for the Authorization only (directly and through Groups/FlexRoles)

ISCBorisB,

Went through guides and figured out the following steps ....Correct me if i am wrong

Authentication part & Authorization part
Method 1:

1.Checking if LDAP is connected to Teamsite
2.Making the following changes to iw.cfg


        authenticate_by=ldap
        ldap_server=ldap-server
        ldap_port=ldap-port
        ldap_dnbase=search-base-location
        ldap_key=key

3.Making following changes to user_databases.xml as mentioned in guide if i want to mange users and roles through ADMIN UI
[html]

[/html]
4. Start the server (doubt.. will it creat new iwusers.xml?)
5. Create all the users ,groups and permissions using Admin UI.

*here authorization is at teamsite level

method 2: LDAP synchronization

1.If we want to manage user and roles through ldapsync.exe then
my iw.cfg will have additional information like


[authentication]
ldapcache_thread_delay=1440
log_ldap_sync=yes
ldap_sync_retry=12

2. Add additional element in user_databases.xml
[html]

value="master,tsuser,ccpro,ccstd,ccpro_only,ccstd_only" />
[/html]

3.Modifying LDAP Schemas to Store TeamSite User Interface Information as mentioned in guide .

*using this method we cannot manage user using teamsite Admin UI.
*Authorization is done at LDAP .
Question: how do we manage roles in this case?

Thanks in advance.

nipper

I don't know if you still need the LDAP changes in iw.cfg, I think the user_database.xml supersedes it.

RE: roles, you can put the roles in LDAP and manage things that way with respect to choice #3.

I tend to do #1, but then I have had installs with 100-200 users and ones that do not change quite often.

joe_pat

I don't know if you still need the LDAP changes in iw.cfg, I think the user_database.xml supersedes it.

RE: roles, you can put the roles in LDAP and manage things that way with respect to choice #3.

I tend to do #1, but then I have had installs with 100-200 users and ones that do not change quite often.

Nipper,

I also like the method 1 as we have very limited users mostly 40 and 2 groups .

Thank you.

Konidala

Compatibility and Limitations of LDAP Authentication:

- Perl presentation templates do not support non-OS users. You must use XSLT presentation templates.
- External tasks written in Perl do not support non-OS users. You must use Java for your external tasks

ISCBorisB

Compatibility and Limitations of LDAP Authentication:

- Perl presentation templates do not support non-OS users. You must use XSLT presentation templates.
- External tasks written in Perl do not support non-OS users. You must use Java for your external tasks

These are strictly speaking some limitations for the non-OS users, not LDAP per se.
With LDAP, you can configure OS Users, non-OS Users or a mix.

joe_pat

Compatibility and Limitations of LDAP Authentication:

- Perl presentation templates do not support non-OS users. You must use XSLT presentation templates.
- External tasks written in Perl do not support non-OS users. You must use Java for your external tasks

We are not using any Perl presentation templates and We are using WFM and not WFT.

joe_pat

These are strictly speaking some limitations for the non-OS users, not LDAP per se.
With LDAP, you can configure OS Users, non-OS Users or a mix.

So, Mix means u r saying both OS and non-OS user in same DB? My assumption is we can configure Two different LDAP servers where we use one for OS and one for Non OS .Correct me if i am wrong.

Question:
I am killing the existing AD and configuring user_databse.xml to support LDAP which have non-OS Users only. And plan is to create freshly all users, roles and groups using ADMIN TAB as we have very less number of users and groups.

Will this create new tsuser.xml , roles.xml and tsgroups? If so what about the existing files. Do i have to delete them? or iwreset.exe will overwrite the existing files?

My another concern is we are using OD GUI how this new LDAP configuration will effect OD? I also want his Up and running.

Thanks in advance.

ISCBorisB

So, Mix means u r saying both OS and non-OS user in same DB? My assumption is we can configure Two different LDAP servers where we use one for OS and one for Non OS .Correct me if i am wrong.

Question:
I am killing the existing AD and configuring user_databse.xml to support LDAP which have non-OS Users only. And plan is to create freshly all users, roles and groups using ADMIN TAB as we have very less number of users and groups.

Will this create new tsuser.xml , roles.xml and tsgroups? If so what about the existing files. Do i have to delete them? or iwreset.exe will overwrite the existing files?

My another concern is we are using OD GUI how this new LDAP configuration will effect OD? I also want his Up and running.

Thanks in advance.

I think that separating OS and non-OS Users is the right approach. That said, I have not tried these settings personally

joe_pat

Ok. I did get answer for my other questions Smiley Sad

I am killing the existing AD and configuring user_databse.xml to support LDAP which have non-OS Users only. And plan is to create freshly all users, roles and groups using ADMIN TAB as we have very less number of users and groups.

Will this create new tsuser.xml , roles.xml and tsgroups? If so what about the existing files. Do i have to delete them? or iwreset.exe will overwrite the existing files?

My another concern is we are using OD GUI how this new LDAP configuration will effect OD? I also want his Up and running.

Thanks in advance.

nipper

Ok. I did get answer for my other questions

I am killing the existing AD and configuring user_databse.xml to support LDAP which have non-OS Users only. And plan is to create freshly all users, roles and groups using ADMIN TAB as we have very less number of users and groups.

Will this create new tsuser.xml , roles.xml and tsgroups? If so what about the existing files. Do i have to delete them? or iwreset.exe will overwrite the existing files?

My another concern is we are using OD GUI how this new LDAP configuration will effect OD? I also want his Up and running.

Thanks in advance.

OK, as I said before, you *likely* will need to remove the AD users and create new LDAP users. I do not believe TS will be smart enough to know Andy on AD and Andy on LDAP are the same. You will need to associate Andy to the correct groups again.

You may also need to use iwidmap to map Andy AD to Andy LDAP depending on the permissions.

Not certain about OD, I would get TS working first then do OD. This is going to be an iterative process, you will not get all the steps ahead of time, but get moving to the goal and fix problems as they arise.

AakarshC

Hi all,

we want to change our authentication from AD to LDAP. Where our current users should be able to use same Id and PW to login to teamsite by selecting a different domain.

Security will need to be changed from a model based on OS users and groups to a model based on non-OS users and groups.

Questions :

1.What are the steps that i need to follow to migrate authorization and users (current users and groups) from current domain to LDAP?

2.What are the side effects we use the same LDAP attribute to store Authorization settings for DEV, UAT and PROD. Does this means a user with master rights on DEV also gets master rights on PROD ?

3. If above one is true .Then what i have to do if we want to have different Authorization settings for DEV, UAT and PROD ?

5. We are using Mediabin and ecm connector 2.0 also what changes do i need to make ecm connector connection settings?

4. Will there be any side effects on OpenDeploy and LiveSite ?

ENV:
TS:6.7.2
OD:6.2
LS:3.1
MB:4.6.2
ecm:2.0

Awaiting for response ..Thanks in advance.

The Support Article #: 60790 mentions the step required to move Mediabin from AD to LDAP and LDAP to AD.

Migrateduser

The Support Article #: 60790 mentions the step required to move Mediabin from AD to LDAP and LDAP to AD.

You're only 2 years late, but thanks for playing.