Confirming New AD/LDAP Server Entry In user_databases.xml

I've created an LDAP entry for my firm's ActiveDirectory server in user_databases.xml (didn't use this file for anything previously) and refreshed the TeamSite server configs.

How can I confirm that TeamSite can now access the new LDAP server? We've always been able to log in using domain accounts against AD without this entry. We've had iw.cfg set up as follows for quite some time:

[iwcgi]
launchpad_hostname=our_host
domain_list=OUR_DMN

[iwserver]
use_adsi=yes
enable_user_group_disk_cache=false
domain_local_groups=yes
domain_list=OUR_DMN

You may ask why I've added an LDAP entry if I can already gain access to AD via iw.cfg as shown above. I'm asking the same question:

If I can already gain access to AD via iw.cfg, why would I add an LDAP entry for it? What's the difference?

Thanks.

Find more posts tagged with

Comments

nipper

Go to the admin UI and try to add a user. It should give you search or browse for LDAP and that will show.

JRomeo

Before adding this entry, I was able to add a user in the Admin UI by doing an OS search against AD, but the LDAP Browse tab was greyed out. Adding the LDAP entry and refreshing the TeamSite configs didn't change that. Can you think of anything else? I can open a support incident with HP, but folks like you often have good answers fast. Thanks.

nipper

If you cannot browse then LDAP is not configured correctly.

Did you verify your changes to .../TeamSite/conf/roles/user_databases.xml

JRomeo

I was hoping to confirm that LDAP entry was correct when the Browse feature showed up. I didn't see any errors in the log files. Thanks anyway.

itsamb

Hi All,

Just wanted to extend the thread.
I have the same confusion. I am able to search the domain user without LDAP entry.

Then, when shall we use LDAP entry in user_database.xml?

Thanks,

Amit

Adam Stoller

You didn't mention what OS you are on.

If you're on Windows - and using AD - then there is no need to configure the user_databases.xml - and all users are considered "OS Users"
If you're on Unix and using LDAP - then you either need to configure the user_databases.xml - and those users are considered "Non-OS Users", or you can try to setup PAM modules such that the OS itself is authenticating against the LDAP server - in which case, I believe (don't recall precisely right now) that the users may be considered "OS Users".
When you are working with "Non-OS Users", you basically cannot use Perl for customizations, as there is no ability to invoke shell processes owned by those users (a.k.a. "impersonation") and must use Java / CSSDK for your customizations.

itsamb

Thanks Adam for the clarification.

Sorry, missed env detail. I am working on Windows.

Thanks,

Amit