Using LDAP to maintain user information

About using LDAP

An LDAP server enables you to centrally maintain user information. As a result, you do not have to maintain the configuration files for each filer on your network. If you have several filers on your network, maintaining user information centrally saves you from updating these files on each filer every time you add or delete a user or a group.

If you store your UNIX user database on an LDAP server, you can configure your filer to look up user information in the LDAP database rather than using the /etc/password file or NIS.

About configuring LDAP

You can configure the filer to use one or more LDAP servers by setting Data ONTAP options at the command line.

To configure the filer for LDAP authentication, do the following:

Specify the LDAP base distinguished name using the ldap.base option.
Specify the LDAP servers to use for LDAP queries using the ldap.servers option.
Specify the preferred LDAP servers, if any, using the ldap.servers.preferred option.
Enable LDAP on the filer using the ldap.enable option.
Edit the password line of the /etc/nsswitch.conf file for LDAP.

In addition, you might need to do the following:

If anonymous authentication does not work in your environment, specify the administrative user name to use for queries for looking up user IDs (UIDs) and group IDs (GIDs) by using the ldap.name option.
If there is a password for the administrative user, specify the administrative password using the ldap.passwd option.
If your LDAP server has been set up to use a port for LDAP queries other than the default port 389, specify the LDAP port using the ldap.port option.

Types of LDAP servers supported

Data ONTAP supports the following types of LDAP servers:

Netscape®
iPlanet
OpenLDAP

Extending the RFC 2307 schema

RFC 2307 schema must be extended on the LDAP servers that you want to use for LDAP queries.

For more information refer to RFC 2307 or to documentation by third party directory integration vendors.

Specifying the LDAP base in the distinguished name format

The LDAP base is the name of the LDAP tree in which user information is stored.

To specify which LDAP base distinguished name to use for looking up user names, complete the following step.

Step	Action
1	Enter the following command: options ldap.base name name is the base distinguished name. Use quotes around names with embedded spaces. Example `options ldap.base "o=networkappliance,c=us"`

Specifying LDAP servers

To specify the LDAP servers to be used for LDAP queries, complete the following step.

Step	Action
1	Enter the following command: *options ldap.servers "name[,name...]"* name is the name of an LDAP server. You can enter multiple server names using a space-separated list enclosed in quotes. Example options ldap.servers "server1 server2"

Specifying preferred servers

You might want to specify LDAP servers that are on faster links as the preferred servers.

To specify the LDAP servers that you want the filer to check first, complete the following step.

Step	Action
1	Enter the following command: *options ldap.servers.preferred "name[,name...]"* name is the name of a preferred LDAP server. You can enter multiple server names using a space-separated list enclosed in quotes. Example options ldap.servers.preferred "server1,server2"

Enabling or disabling LDAP

To enable or disable LDAP on your filer, complete the following step.

Step	Action
1	Enter the following command: options ldap.enable {on\|off} Use `on` to enable and `off` to disable LDAP.

Editing the /etc/nsswitch.conf file for LDAP

To edit the /etc/nsswitch.conf file for LDAP, complete the following steps.

Step	Action
1	Open the /etc/nsswitch.conf file on the filer for editing. Note For instructions on accessing files in the /etc directory, see Accessing the configuration files.
2	Enter the following at the password line: ldap You can optionally add `files` and/or `nis` to the password line, but they must be entered after `ldap` if you want to use LDAP as the primary mechanism to retrieve user information. Example `passwd: ldap files nis`
3	Save the file.

Step

Action

Open the /etc/nsswitch.conf file on the filer for editing.

Note
For instructions on accessing files in the /etc directory, see Accessing the configuration files.

Enter the following at the password line:

ldap

You can optionally add files and/or nis to the password line, but they must be entered after ldap if you want to use LDAP as the primary mechanism to retrieve user information.

Example

passwd: ldap files nis

Save the file.

Specifying the admin user name

If anonymous authentication does not work in your environment, you need to specify an administrative user name.

To specify the user name to be used for administrative queries for looking up UIDs and GIDs, complete the following step.

Step	Action
1	Enter the following command: options ldap.name name name is the name to be used for administrative queries. The best practice is for this to be the name of a user with read-only access to the LDAP database. Use quotes around names with embedded spaces. Example `options ldap.name "cn=root,o=networkappliance,c=us"`

Step

Action

Enter the following command:

options ldap.name name

name is the name to be used for administrative queries. The best practice is for this to be the name of a user with read-only access to the LDAP database. Use quotes around names with embedded spaces.

Example

options ldap.name "cn=root,o=networkappliance,c=us"

Specifying the admin password

To specify a password for the administrative user, complete the following step.

Step	Action
1	Enter the following command: options ldap.passwd password password is the password for the administrative user. The password is displayed as a series of asterisks.

Specifying the LDAP port

You might need to specify the port to use for LDAP queries if the LDAP server has been set up to use a port other than the default for LDAP, port 389.

To specify the LDAP port, complete the following step.

Step	Action
1	Enter the following command: options ldap.port N N is the LDAP port number.

Note
Data ONTAP does not support using LDAP with the Secure Socket Layer (SSL) or Transport Layer Security (TLS) protocol, which is commonly called Secure LDAP or LDAPS. Configuring Data ONTAP to connect to an LDAPS server on port 636 does not provide secure LDAP access for filer queries and, in most cases, will cause all LDAP queries from the filer to fail.

Supporting LDAP authentication of UNIX clients

To support authentication of UNIX clients through an LDAP server make sure that ldap is the first protocol entered on the password line of the /etc/nsswitch.conf file as described in Editing the /etc/nsswitch.conf file for LDAP.

Supporting LDAP authentication of Windows clients

You can authenticate Windows clients through an LDAP server. To support authentication of Windows clients through an LDAP server, complete the following additional operations.

Run CIFS Setup on the filer to be accessed, and specify NIS/LDAP as the authentication method to be used for CIFS clients on that filer.
Configure the local security settings of each Windows client to use clear text password (unencrypted password) authentication rather than use Kerberos or other encrypted authentication methods.
Verify that your Windows clients have their userpassword attribute configured in the LDAP user database.

Supporting LDAP authorization of Windows client access to UNIX files

To support authorization of Windows client access to UNIX files on a filer that uses LDAP authentication, complete the following tasks:

On the filer to be accessed, verify that the /etc/nsswitch.conf file specifies ldap as one of the passwd entries. See Editing the /etc/nsswitch.conf file for LDAP.
On the filer to be accessed, verify that every CIFS user who needs to access UNIX files is mapped to an associated UNIX user name in the usermap.cfg file.
Verify that every associated UNIX username has an entry in the LDAP database.

Supporting LDAP authorization of UNIX client access to an NTFS or mixed file system

To support authorization of UNIX client access to an NTFS or mixed file system on a filer that uses LDAP authentication, complete the following tasks:

On the filer to be accessed, verify that the /etc/nsswitch.conf file specifies ldap as one of the passwd entries. See Editing the /etc/nsswitch.conf file for LDAP.
Verify that every UNIX user that needs to access an NTFS or mixed file system has an entry in the LDAP database.
On the filer to be accessed, verify that every UNIX user that needs to access an NTFS or mixed file system is mapped to an associated CIFS user name in the usermap.cfg file.