Preparing Policy Manager for LDAP and SQL Authentication Sources

Enter the name of the LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. authentication source.

Provide the additional information that helps to identify the LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. authentication source.

Select Generic LDAP.

When Use for Authorization is enabled, Policy Manager can use this authentication source to fetch role-mapping attributes. This option is enabled by default.

To add a backup server in the event the main server goes down, click Add Backup.

NOTE: Aruba recommends setting up one or more backup servers.

Specifies additional sources from which role-mapping attributes may be fetched.

1. Select a previously configured authentication source from the drop-down list.

2. To add authentication source to the list of authorization sources, click Add.

To remove the authentication source from the list, click Remove.

If Policy Manager authenticates the user or device from this authentication source, it also fetches role mapping attributes from these additional authorization sources.

Policy Manager caches attributes fetched for an authenticating entity. This parameter controls the duration in number of seconds for which the attributes are cached. The default is 36000 seconds (one hour).

Enter the name or IP address of the LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. server you’re going to use for authentication.

Note that most domain controllers are also LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. servers. Policy Manager uses LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. to talk to the domain controller.

Set Connection Security to: LDAP over SSL.

This enables the secure sockets layer (SSL Secure Sockets Layer. SSL is a computer networking protocol for securing connections between network application clients and servers over the Internet.) cryptographic protocol to connect to your Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed.. Selecting LDAP over SSL automatically populates the Port field to 636.

NOTE: In a production environment, security is a concern because when Policy Manager binds to an LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. server, it submits the username and password for that account over the network under clear text unless you protect it using Connection Security and set the port to 636.

NOTE: To ensure successful authentication, be sure to add the CA Certificate Authority or Certification Authority. Entity in a public key infrastructure system that issues certificates to clients. A certificate signing request received by the CA is converted into a certificate when the CA adds a signature generated with a private key. See digital certificate. certificate of the LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. server to the Certificate Trust List.

Specify the TCP Transmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. port at which the LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. server is listening for connections.

For a single domain LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. Domain Service:

Default port for LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network.: 389

Default port for LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. over SSL Secure Sockets Layer. SSL is a computer networking protocol for securing connections between network application clients and servers over the Internet.: 636

When you set the Connection Security field to AD over SSL, this port is automatically set to 636.

For a multi-domain LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. Domain Service forest, the default ports for the global catalog are:

Default port without SSL Secure Sockets Layer. SSL is a computer networking protocol for securing connections between network application clients and servers over the Internet.: 3268

Default port with SSL Secure Sockets Layer. SSL is a computer networking protocol for securing connections between network application clients and servers over the Internet.: 3269

Enable this option to verify the Server Certificate for a secure connection.

Enter the Distinguished Name of the node in your directory tree from which to start searching for records.

The Bind DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. text box specifies the full distinguished name (DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate.), including common name (CN Common Name. CN is the primary name used to identify a certificate. ), of an LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. user account that has privileges to search for users (usually the Administrator account). For example: CN=Administrator,CN=Users,DC=mycompany,DC=com

This user account must have at least domain user privileges.

The Bind DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. user, such as Administrator, is the username associated with the Bind DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. user account.

For a single domain LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. Domain Service, the Bind DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. entry must be located in the same branch and below the Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate..

For a multi-domain LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. Domain Service forest, because you leave the Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. text box empty, the restrictions that apply for a single domain do not apply for a multi-domain forest.

Policy Manager fills in the domain portion of the Bind DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate.. Policy Manager also populates the Base DN, and the NetBIOS Domain Name fields.

For related information, see Preparing Policy Manager for LDAP and SQL Authentication Sources.

NOTE: You may need to get the Bind DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. from the LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. administrator.

This is the text box for the Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. password for the account that can search for users.

Enter the Bind password.

NOTE: The Bind password is the same password used in association with the Bind DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. user account.

Specify the DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. (Distinguised Name) of the administrator account. Policy Manager uses this account to access all other records in the directory.

NOTE: For Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed., the bind DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. can also be in the administrator@domain format (for example, administrator@acme.com).

For a single domain Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. Domain Service, this is the text box for the Distinguished Name (DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate.) of the starting point for directory server searches. For example:DC=mycompany,DC=com.

The LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. server starts from this DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. to create master lists from which you can later filter out individual users and groups.

NOTE: The Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. value that is automatically populated in this instance is not the best practice Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. value.

Aruba recommends that you narrow down the Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. as far as possible to reduce the load on the Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. server. For example, if all your users are in the AD Users and Computer Users folder, then set the Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. to search in the Users folder.

1. To browse the LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. directory hierarchy, click Search Base DN.The LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. Browser opens.

2. Navigate to the DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. you want to use as the Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate..

3. To select a node as a Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate., click the appropriate node in the tree structure. For a multi-domain Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. Domain Service (AD DS Differentiated Services. The DS specification aims to provide uninterrupted quality of service by managing and controlling the network traffic, so that certain types of traffic get precedence. ) forest, the appropriate action is to leave the Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate. text box blank.

NOTE: This is also one way to test the connectivity to your LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. directory. If the values entered for the primary server attributes are correct, you should be able to browse the directory hierarchy by clicking Search Base DN.

Search scope is related to the Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate.. The search scope defines how LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. will search for your objects.

Select one of the foloiwng Search Scope types.

Subtree Search: Searches every object and sub-object in the LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. directory.

One-Level Search: Looks directly under the Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate..

Base Object: Searches any object under the Base DN Distinguished Name. A series of fields in a digital certificate that, taken together, constitute the unique identity of the person or device that owns the digital certificate. Common fields in a DN include country, state, locality, organization, organizational unit, and the “common name”, which is the primary name used to identify the certificate..

Aruba does not recommend enabling the "Follow Referrals" check box.

This function directs the LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. server to find a specific user in its tree, but it’s possible for the user to be included on another LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. server, which can cause a search loop.

Enable this option to allow a bind operation using the user password.

For clients to be authenticated by using the LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. bind method, Policy Manager must receive the password in clear text.

Enter the name of the attribute in the user record from which the user password can be retrieved.

Specify the password type: Cleartext, NT Hash, LM Hash, SHA1, SHA256, MD5.

Oracle's LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. implementation prepends a header to a hashed password string.

If you are using Oracle LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network., enter the header in this field so the hashed password can be correctly identified and read.

Leave the value that is automatically populated in this field as the default unless your LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. administrator has a different attribute for storing the user certificate.

Enter the name of the SQL authentication source.

Provide the additional information that helps to identify the authentication source.

Select Generic SQL DB.

Leave the Use for Authorization setting enabled.

When Use for Authorization is enabled, Policy Manager can use this authentication source to fetch role-mapping attributes. This option is enabled by default.

To add a backup server in the event the main server goes down, click Add Backup.

NOTE: Aruba recommends setting up one or more backup servers.

Specify additional sources from which role-mapping attributes can be fetched.

Select a previously configured authentication source from the drop-down list.

To add authentication source to the list of authorization sources, click Add.

To remove the authentication source from the list, click Remove.

If Policy Manager authenticates the user or device from this authentication source, it also fetches role mapping attributes from these additional authorization sources.

Specify the number of seconds for the Cache Timeout.

Policy Manager caches attributes fetched for an authenticating entity. This parameter controls the duration in number of seconds for which the attributes are cached.

Enter the name or IP address of the Generic SQL server you’re going to use for authentication.

Optionally, you can specify a port value to override the default port.

Enter the name of the database from which records can be retrieved.

Enter the name of the user used to log into the database. This account must have read access to all the attributes that need to be retrieved by the specified filters.

Enter the password for the user account entered in the Login Username field.

Enter the duration in seconds that Policy Manager waits before attempting to fail over from the primary to the backup servers (in the order in which they are configured).

Select the ODBC driver to connect to the database.

PostgreSQL

Oracle 11g

MariaDB

MSSQL

NOTE: MySQL is no longer supported for ClearPass 6.7.x and later. MySQL has been replaced by Maria-DB Connector (MariaDB).

If you connect to a Microsoft SQL server using Integrated Authentication, the login username in the authentication source, formatted as either domain/username or UPN (User Principal Name), the following characters are supported:

Backslash ( \ )

At-sign (@)

Hyphen

Underscore

Displays the name of the filter.

Specifies the name of the SQL database attributes defined for this filter.

Specifies an alias name for each attribute name selected for the filter.

Optionally, indicates whether the filter is enabled as a role or an attribute type. This option can also be blank.

Enter the name of the new filter.

Specify an SQL query to fetch the attributes from the user or device record in the database.

Select Click to add to specify the name of the attribute.

Specify the alias name for the attribute. By default, this is the same value as the attribute name.

Specify the data type for this attribute, such as String, Integer, or Boolean.