5.1 Configurations Using Web Console

To add a server:

1. Click CONFIGURATION > LDAP CONNECTIONS > ADD.

2. Specify the required details.

   • Specify the certificate file path to allow SSL connection

   • Specify the polling interval between 30 to 120 minutes to set the interval at which Change Guardian server synchronizes all objects and groups with AD

     NOTE:In Change Guardian 6.0 and earlier, the polling interval between Change Guardian server and AD servers was hourly, weekly, or daily. For Change Guardian 6.1, the previously configured AD servers have a default polling interval of 120 minutes.

   • (Conditional) If you want to synchronize AD user profiles with Change Guardian, specify the user container details.

To set up LDAP authentication:

1. In the web console, click ADMINISTRATION.

2. Click Users > LDAP Settings.

3. Specify the options to configure LDAP authentication:

   Host: Hostname or IP address for SSL connections.

   SSL: SSL connection to the LDAP server.

   Port: Port for the SSL connection. The default SSL port number is 636 and the default non-SSL port number is 389.

   Certificate File Path: The path of the CA certificate file for the LDAP server.

   Specify the certificate file path when you are using an SSL connection, and if the LDAP server certificate is not signed by a well-known CA and is not trusted by default.

   Anonymous Search: Option to perform anonymous searches or non-anonymous searches on the LDAP directory.

   Base DN: The root container to search for users.

   For example. set o=netiq for eDirectory.

   For anonymous search, specify the root container of the LDAP directory. This is optional for eDirectory, but mandatory for Active Directory. For eDirectory, if you do not specify the Base DN, Change Guardian searches the entire directory to locate the users.

   For non-anonymous search, specify the root container in the LDAP directory that contains users. This is mandatory if you are using Active Directory and if you set a domain name.

   Search Attribute: The LDAP attribute having the user name to search for users.

   For example, the search attribute for eDirectory is uid and for Active Directory it is sAMAccountName.

   Domain Name: The Active Directory domain.

   Change Guardian can perform anonymous search in Active Directory. Change Guardian uses the username@domainname (userPrincipalName) to authenticate the user before searching for the LDAP user object.

   NOTE:If Base DN is set and Domain Name is not set, the Base DN is appended to the relative user DN to construct the absolute user DN.

   For example, if the Base DN is set to o=netiq and the absolute user DN is cn=sentinel_ldap_user,o=netiq, Change Guardian uses the relative user DN cn=sentinel_ldap_user when you create an LDAP user account.

4. Click Test Connection to test the LDAP connection.

   • Specify the domain name and password if you did not specify earlier. The user DN can be relative to the Base DN.

   • According to LDAP standards, when you use reserved special characters as literals in a User DN, you must use \. eDirectory or Active Directory might require additional escape characters. You must use \ as the escape character for the following scenarios:

     • A space or # occurring at the beginning of the string

     • A space occurring at the end of the string

     • Any one of the following characters: +, ", \, <, >, or ;

       For example, if the User DN contains a comma as a literal, specify the User DN as follows:

       CN=Test\,User,CN=Users,DC=netiq,DC=com

   If there is an error, review the configuration details you provided and test the connection again. To learn about the errors, examine the /var/opt/novell/sentinel/log/server0.0.log file.

   NOTE:You must ensure that the test connection is successful before saving the LDAP settings.

5. Click Save to save the LDAP settings.

   Verify the configuration:

   • Check that the LdapLogin section in the /etc/opt/novell/sentinel/config/auth.login file is updated. For example:

     LdapLogin {
             com.sun.security.auth.module.LdapLoginModule required
     java.naming.ldap.factory.socket="com.esecurity.common.communication.ProxyLdapSSLSocketFactory"
             userProvider="ldap://10.0.0.1:636/o=netiq"
             userFilter="(&(uid={USERNAME})(objectclass=user))"
             useSSL=true;
     };

   • If you provided the LDAP server CA certificate, it is added to the /etc/opt/novell/sentinel/config/.ldapkeystore.jks keystore.

To create a role:

1. In the web console, click ADMINISTRATION.

2. Click Users > Users and Roles.

3. Under Roles, click Create.

4. Specify the required information.

   Review the following additional permissions that you can assign to the new role:

   • Edit knowledge base: Allows users to view and edit the knowledge base in the Alert Details page

   • Manage Tags: Allows all members to create, delete, and modify tags, and associate tags to different event sources

   • Manage roles and users: Allows non-administrative users to administer specific roles and users

   • Proxy for Authorized Data Requestors: Allows users to accept searches from remote data sources

   • Send events and attachments: Allows users to send events and attachments to the server

     NOTE:You can manually assign this permission to a user who needs to forward events to the server.

   • View and execute event actions: Allows members to view events and execute actions on the selected events

   • View detailed internal system state data: Allows members to view detailed internal system state data by using a JMX client

   • View knowledge base: Allows users to view the knowledge base in the Alert Details page

To create a user:

1. In the web console, click ADMINISTRATION.

2. Click Users > Users and Roles.

3. Under Users, click Create.

   You can use special characters to set the user name. However, the user name should be within 30 characters.

   NOTE:For local user password, ensure that the password adheres to the password complexity validation rules. For more information, see Understanding Password Complexity.

4. Select an authentication method:

   1. (Conditional) To authenticate the user against the internal database, click Local.

   2. (Conditional) To authenticate the user against an LDAP directory, select Directory.

      NOTE:Ensure that you have configured the Change Guardian server for LDAP authentication. For more information, see Configuring LDAP for Authentication.