LDAP

About LDAP

The Lightweight Directory Access Protocol (LDAP) allows for databases to be designed according to arbitrary, extensible schemas (ways of specifying data). There is no official schema regulating data definition for purposes of authentication. Therefore, LDAP databases are varied in design, and they can contain any kind of data.

LDAP and NetCache authentication

LDAP databases are commonly used as central repositories for employee directories. For example, LDAP can easily implement a directory of all employees in a company, including their phone numbers, mail stop numbers, addresses, passwords, HR information, as well as the management structure of the company.

When a client (user) begins to use a NetCache appliance configured to require LDAP authentication, NetCache carries out the process shown in the following table.

Stage	Description
1	The user is prompted for a user name and password at the outset of the session. Typically, the password is transmitted from the browser to the appliance through a clear-text credential (also referred to as a basic credential).
2	NetCache searches the LDAP directory for the user account.
3	NetCache sends the password to the LDAP server for verification.
4	NetCache searches the directory for the user's group memberships.
5	Given the user and group information, the appliance consults the ACLs to determine if any apply.
6	If the ACLs grant the user's request, the data is returned to the user, and the log is updated accordingly (whether the request is allowed or denied).

About LDAP database contents

An LDAP database contains objects, each referred to by its own name distinguishing it from other objects in the database, and each object can contain attributes and values. The object's name is referred to as a distinguished name (DN). The DN is normally shown on the first line of each object.

About the LDAP search

The tree analogy is commonly used to describe LDAP databases. In the case of NetCache requests, LDAP searches the directory for user authentication information. The location in the LDAP tree where the search begins is called the base. The base applies only to the DN. (This value is set in the Base Distinguished Name option on the Authentication - LDAP page.)

Requiring password renewal

If a NetCache user's LDAP password expires and requires manual renewal, you can use the Expired Password URL option on the Authentication - General page to specify a URL that displays the requirement to reset an expired password.

Preparing to configure

Before you begin to configure LDAP authentication in NetCache, verify the following information:

The LDAP server IP address is correct.
Your LDAP server and the appliance are positioned on your network so that NetCache can open a TCP connection.
The server port to which NetCache connects to the server; the LDAP default port number is 389.
A user name and password are configured in the LDAP database.

NetCache requirements specific to LDAP

NetCache must be configured with specific LDAP server information, which is listed in the following table. (You can set this information through the Setup > Authentication > LDAP page in the Appliance Manager.)

LDAP parameter	Description
Base Distinguished Name	This parameter specifies the directory on the LDAP server that NetCache is to search. For example: `o=domain.com`
NetCache LDAP Password Bind Distinguished Name	Password used to gain access to the bind distinguished name. This password authorizes the NetCache appliance to access and query the LDAP directory. This parameter specifies the bind DN that NetCache uses to identify itself to the LDAP server. For example: `cn=netcache, o=domain.com`
Protocol version	This parameter specifies which version of the LDAP protocol will be used by the appliance in communicating with the server.
User ID (UID) Field in the LDAP Directory	This parameter specifies which field in the LDAP directory contains the name that is entered by the user. For example: `uid`
Group ID (GID) Field in the LDAP Directory	This parameter specifies which field in the LDAP directory contains group membership information. For example: `gid`
GroupOfUniqueNames	If the LDAP users are included as members of a GroupOfUniqueNames object in the LDAP directory, this option allows you to assign NetCache group membership to them based on a specified attribute in that GroupOfUniqueNames object. If the GroupOfUniqueNames object in the LDAP directory includes the following attributes, you can set the value of this option to "cn" to assign the group to "Coders": DN: cn=Coders, ou=Groups, o=xyz_corp cn: Coders objectclass: GroupOfUniqueNames uniquemember: uid=diller, ou=development, o=xyz_corp uniquemember: uid=williams, ou=sales, o=xyz_corp NetCache will retrieve the value of the "cn" attribute from the GroupOfUniqueNames object and assign it as a group value to all the users listed as members in the GroupOfUniqueNames object. NetCache can then apply ACL rules, SmartFilter settings, or protocol associations to this group.
GroupOfUniqueNames Member

LDAP user configuration example

The following example provides a guideline for configuring an LDAP user file. This file is created and resides on the LDAP server. The example assumes that you have an existing LDAP server configuration and a working knowledge of UNIX.

Note
The attribute values (directories, user names, domain names, and so on) used in this example are invalid entries. Replace these entries with data specific to your configuration.

Excerpt from an LDAP user file

dn: o=domain.com

objectClass: organization

o: domain.com

dn: cn=tristan, o=domain.com

objectClass: inetOrgPerson

cn: tristan

sn: GDog

mail: tristan@domain.com

uid: tristan

userPassword: pass1

dn: cn=enrico, o=domain.com

objectClass: inetOrgPerson

cn: enrico

sn: DElephant

mail: enrico@domain.com

uid: enrico

userPassword: pass2