Administration Console

9.2.4.6
- 9.2.6
- 9.2.5

Back Next

LDAP Identity Service

If you are using an identity service that makes use of LDAP, select it from the Provider Type picklist. Here is what you will see:

Identity Service: Connection Settings for LDAP

In your identity service, be sure to map the Process Central security role,

abTaskClient

, to each user that will login to Process Central.

View and update identity service settings as shown in the following table. If desired, you can import and export your LDAP configuration.

Enter the provider-specific connection settings used to establish connectivity to your identity store.

Provider Configuration
Enable	Add a checkmark to use the identity service. Initially the service is disabled since it is not configured and ready for use. Configure the remaining settings, enable the service, and select Update .
Provider Type	Select LDAP from the drop-down list:
Host	Enter the LDAP server’s DNS name such as ldap1.my-domain-name.com or IP address such as 192.168.1.1.
Port	Enter the port to use for communications between the Process Server and the LDAP server. The default value is 389.
Use SSL	(Optional) Enable this checkbox to provide encrypted transport communication between Process Server and the LDAP service. If you enable this, you must enter a trusted keystore file location in the next field.
Trusted keystore file location on the server	(Optional) Enter the full path to the a eTrustedCA.ks file for the Trusted Keystore Path. This file must be accessible by all instances of the server when deployed in a clustered environment. This path is required if SSL is enabled. This is discussed following this table.
User DN	Enter the user distinguished name. Most directory servers do not allow anonymous access, therefore the username and password is required. The username should be the distinguished name of the user. For Microsoft Active Directory, an example of a user distinguished name is: CN=Administrator, CN=Users, DC=domainname, DC=com (or local) For an open LDAP service, an example of the DN is: uid=admin, ou=system
Password	Enter the administrator password for access to the directory service, and confirm it.

Creating a Trusted Keystore File

To ensure that the Process Server can trust the SSL certificate presented by the LDAP server, the LDAP server's certificate, or its CA's certificate such as VeriSign, must be installed in a Java key store file which is designated as the store keeping a list of trusted certificates. This trust key store file must be accessible by the Process Server engine.

Example

Assuming your LDAP server is Apache DS running SSL using a self-signed certificate, here's how you could create a trusted keystore file.

Export the Apache DS SSL certificate as a DER-formatted file using the Java/Sun

keytool

. For example:

c:> keytool -export -keystore apacheds.ks -alias apacheDsAlias 
           -file aeldap.cer

where

apacheds.ks

is the key store database in which the Apache DS SSL certificate is stored,

apacheDsAlias

is the alias within that key store, and

aeldap.cer

is the name of the file where the certificate is exported to.

When you run the command in Step 1, you will be prompted for the keystore password. Add the password for the

apacheds.ks

file.

Create a new keystore file, such as

aeTrustedCA.ks

, on the same machine as the Process Server engine. This key store will contain trusted certificates. Also in the same command, import the certificate. For example:

c:> keytool -import -file aeldap.cer -alias apacheDsAlias 
           -keystore aeTrustedCA.ks -storepass secret

where

aeldap.cer

is the file that was exported from the Apache DS server

aeTrustedCA.ks

is the name of the new key store file on machine that is running the Process Server engine, and secret
is the password for the

apacheds.ks

file.

When you run the command in Step 3, you will be asked whether to trust this certificate. Type yes
to add the certificate.

From the Identity Service Page of the Process Console, enter the full path to the

aeTrustedCA.ks

file for the Trusted Keystore Path, as described rarlier in this topic.

Identity Service

Download Guide

Watch

Comments

Communities

Knowledge Base

Success Portal

0 COMMENTS

We’d like to hear from you! Log in to comment.

Rename Saved Search

Table of Contents

Administration Console

Administration Console

LDAP Identity Service

LDAP Identity Service