Configuring mldap_esm Security Manager for an LDAP

The default mldap_esm security manager settings are designed for the simple LDAP configuration using AD LDS and the Micro Focus user class. Before the mldap_esm security manager can update the information in an LDAP server, you need to set a number of configuration options.

• Set Connection Path to the IP address and port of the LDAP server (for example ad-host:389)
• Set Authorized ID to the DN of a user with appropriate permissions for the LDAP repository (for example CN=Administrator,CN=users,DC=somecorp,DC=com ). This user must have at least read access to the containers for user definitions, MSS user groups, and MSS resource access rules, and their contents. If you want to use the MFDS administration console to change user groups and resource access rules, this ID will also need update access to those portions of the repository.
• Set Password to the password for the user specified in Authorized ID.
• In Configuration Information, you will need to set a number of LDAP parameters:

  [LDAP]
  base=DN-suffix
  user class=user class
  user container=user-container
  group container=group-container
  resource container=resource-container

  DN-suffix	The common part of the DN for your user container, MSS group container, and MSS resource rules container. For example, if your users are in CN=users,DC=somecorp,DC=com, and your MSS containers are in CN=MF,DC=somecorp,DC=com, you could set base to DC=somecorp,DC=com.
  user class	The LDAP object class used for your users. The following options are available: microfocus-MFDS-User This is the default setting. user Microsoft standard users are used and you cannot add or modify users from the MFDS user interface.
  user-container	The DN of the container for user objects, without the "base" suffix, for example: CN=users
  group-container	The DN of the container for MSS user group objects, without the "base" suffix, for example: CN=Enterprise Server Groups,CN=MF
  resource-container	The DN of the container for resource access class containers (which in turn hold resource access definition objects), without the "base" suffix, for example CN=Enterprise Server Resources,CN=MF