Filter
Top Products
Enabling and Setting up LDAP Support
There are a few configuration requirements for properly enabling and setting up LDAP support. Below
is an overview of the minimum requirements.
Directory Services server configuration requirements:
1. Define at least one LDAP group.
2. Assign users to that LDAP group.
Sentry configuration requirements:
1. Enable LDAP support.
2. Define the IP address and domain component of at least one Directory Services server.
3. Set the LDAP bind request method being utilized by the Directory Services server.
4. Define the IP address of at least one DNS server.
5. Test DNS server configuration using Sentry ‘ping’ support.
6. Define at least one LDAP group and assign access rights for that group.
NOTE: LDAP group names on the Directory Service server and the Sentry must match.
Enabling and disabling LDAP support
The Set LDAP command is used to enable or disable LDAP support.
To enable or disable LDAP support:
At the Sentry: prompt, type set ldap, followed by enabled or disabled and press Enter.
Setting the LDAP host IP address
The Set LDAP HostIP command sets the TCP/IP address of the Directory Services server.
To set the LDAP host IP address:
At the Sentry: prompt, type set ldap, followed by hostip1 or hostip2 and the Directory Services
server’s IP address. Press Enter.
Example
The following command sets the primary Directory Services server IP address to 98.76.54.32:
Sentry: set ldap hostip1 98.76.54.32<Enter>
Changing the LDAP server port
The Set LDAP port command sets the port to which the Sentry sends LDAP requests to on the
previously defined LDAP server. The default port is 389.
To change the LDAP server port:
At the Sentry: prompt, type set ldap port, followed by the port number and press Enter.
Example
The following command sets the LDAP server port number to 8888:
Sentry: set ldap port 8888<Enter>
Setting the LDAP bind password type
The Set LDAP Bind command sets the password type used in the bind requests. The Sentry supports
two LDAP bind methods – Simple and MD5.
The Simple method utilizes unencrypted delivery of a username-password over the network to the
Active Directory server for authentication.
The MD5 digest method provides much stronger protection utilizing one-way encoded hash numbers,
never placing the username-password on the network. For more information on MD5, see Setting the
HTTP authentication method: on page 14.
NOTE: Windows 2000 is known only to support Simple binding. Windows 2003 supports both Simple and MD5 binding.
To set the bind password type:
At the Sentry: prompt, type set ldap bind, followed by simple or md5 and press Enter.
Sentry PT22 Advanced Operations • 55
Installation and Operations Manual