Managing LDAP security for InfoPrint Manager for AIX

InfoPrint Manager provides an extension to the FST security that allows you to use an LDAP/Active Directory server for user authentication and access rights. When enabling LDAP security, the FST security continues to work as before. Use the AIX SMIT utility to configure, enable, or disable the LDAP security of your print system. Open the SMIT interface, and go to InfoPrint Printing SystenSecurityLDAP Security.

Enable/Disable LDAP Security
To enable the LDAP security:
  1. Click the Enable/Disable LDAP option.
  2. Choose the Enable LDAP Security option.
To disable the LDAP security:
  1. Click the Enable/Disable LDAP option.
  2. Choose the Disable LDAP Security option.
Add/Change LDAP Connection
To add an LDAP connection:
  1. Click the LDAP Connections option.
  2. Choose the Add LDAP Connection option.
  3. Fill in these fields with the required information:

    Connection Name
    Enter the connection name of the LDAP server.
    IP Address or Host Name
    Enter the host name or IP address of the LDAP server.
    Port
    Enter the port number that is used for communication.
    Encryption Method
    Enter an encryption method for the LDAP Server. Select the Use Start TLS Extension or the Use SSL Encryption option if you want to use the Start TLS or the SSL protocols.
    Description
    Enter an optional description.
    Test Connection
    If the information you enter is valid, you receive a confirmation message. If you enter incorrect settings, you receive an error message.

To edit an LDAP connection:
  1. Click the LDAP Connections option.
  2. Choose the Edit LDAP Connection option.
  3. Select the LDAP connection and make the necessary changes.
To delete an LDAP connection:
  1. Click the LDAP Connections option.
  2. Choose the Delete LDAP Connection option.
  3. Select the LDAP connection that you want to delete.
LDAP Authentication
Specify how InfoPrint Manager authenticates to the Lightweight Directory Access Protocol Server (LDAP). This information is used as authentication data for all existing LDAP connections. InfoPrint Manager uses the information to authenticate to the LDAP Server to retrieve specific data (for example, group membership and login attributes) about the entries.

To change the LDAP authentication:

  1. Click the LDAP Authentication option.
  2. Fill in these fields with the required information:

    Test Authentication against LDAP Connection
    Select one of the available LDAP connections to validates settings. If you enter incorrect settings, you receive an error message.
    Important: If you have multiple LDAP servers defined, the server information is common for all.
    Authentication Method
    Select the method of authentication: No Authentication, Simple, or Digest.
    Bind DN or User
    Enter the distinguished name (DN) of the account.
    Bind Password
    Enter your password.
    Note: When you use the Anonymous login, it is not necessary to specify a value for: Bind DN/ user or Bind Password.
    SASL Realm
    Enter the name of the SASL Realm. This option is available when you use the Digest method.

LDAP Search options
Specify the settings used by InfoPrint Manager when searching for LDAP users. This information is used as search options for all existing LDAP connections.

To change the LDAP search options:

  1. Click the LDAP Search Options.
  2. Fill in these fields with the required information:
    Validate Search Options against LDAP Connection
    Select one of the available LDAP connections to validates settings. If you enter incorrect settings, you receive an error message.
    Important: If you have multiple LDAP servers defined, the search information is common for all.
    Users:
    User Search Base
    Specifies the distinguished name (DN) of the branch in the LDAP directory tree where the users are located.
    Login Login Attributes
    Specifies the user attributes for the login in the LDAP server.
    User Filter Type
    Specifies one or more object classes to filter when InfoPrint Manager searches for users.
    User Filter Value
    Specifies a custom filter that InfoPrint Manager uses when it searches users.
    Groups:
    Group Search Base
    Specifies the distinguished name (DN) of the branch in the LDAP directory tree where the groups are located.
    Group Name Attributes
    Specifies an attribute that identifies the group name (for example, cn).
    Group Member Attribute
    Specifies the attribute of a user group (for example, member).
    Group Filter Type
    Specifies one or more object classes to filter when InfoPrint Manager searches for groups.
    Group Filter Value
    Specifies a custom filter that InfoPrint Manager uses when searching for groups.
    Performance Search Option
    Use “memberOf” capability
    Informs InfoPrint Manger that the group membership can be determined directly from the memberOf field.
    Note: Make sure that this property is supported on your LDAP server.
    Traverse Nested Groups
    Applies only to the Microsoft Active Directory and it is used to check if a user is an indirect member of a group.
    Use “ibm-allGroups” Capability
    Applies only to IBM Tivoli Directory Server and it is used to determine the group membership directly from the attribute ibm-allgropups .
    Note: Make sure that this option is supported on your LDAP server.

LDAP Security Status
This option lets you check if the LDAP security status of the InforPrint Manager system is enabled or disabled.
To check the LDAP security status, click the LDAP Security Status option.
TLS/SSL Keystore Database
This option lets you set a Keystore Database password. You need a TSL/SSL Keystore Database password when you use Use SSL Encryption as encryption method for an LDAP connection.

You must create a CMS key database files: pdldap.kdb (key database itself) , pdldap.rdb (store certificate requests), pdldap.crl (certificate revocation list) to access the LDAP server via SSL/TLS. The CSM database file must be placed within /var/pddir/default_cell/ldap. If the default path /var/pddir/default_cell/ldapis not suitable for you, you can change the location for the CSM database using the environment variable PD_LDAP_KDB_PATH . The environment variable PD_LDAP_KDB_PATH must point to the custom CSM database directory. The password for the CSM key database must be configured in SMIT.

See the documentation for your operating system for information on the packages that you need to install.