10.3 Changing the directory service access configuration to support the NNMi security model

This section describes how to revise an ldap.properties file from NNMi version 09-50 to support multiple NNMi user groups per user. This revision is necessary under both of the following conditions:

The ldap.properties file currently enables all NNMi user information to be saved in the directory service.

For details about how to save all NNMi user information in the directory service, see 10.1.3 External mode: Storing all NNMi user information in a directory service.
NNMi has been or will be configured with custom security groups.

In NNMi version 09-50, NNMi users were assigned to one of the predefined NNMi roles. Each user had access to all objects in the NNMi topology.

In NNMi version 10, the predefined NNMi user groups replace NNMi roles. Each NNMi user must belong to at least one predefined NNMi user group, which defines what an NNMi user can do in the NNMi console. Additional user groups, if they exist, limit access to NNMi topology objects as follows:

If no custom user groups exist, all NNMi console users can access all topology objects.
If one or more custom user groups exist, each of these user groups provides access to a subset of objects in the NNMi topology.

NNMi version 09-50 required each directory service group definition to include a group attribute that named the NNMi role. In the ldap.properties file, the following parameters specified this group attribute:

roleAttributeID
roleAttributeIsDN
roleNameAttributeID

NNMi version 10 deprecates these parameters. Each user group must be defined in the NNMi console.

The user group definition includes an external name, which is the distinguished name of the group in the directory service.

To change the directory service access configuration to support the NNMi security model, follow these steps:

Back up the user information in the NNMi database:

nnmconfigexport.ovpl -c account -u user \
-p password -f NNMi_database_accounts.xml

Back up the ldap.properties file, and then open the file in any text editor.

For details about the ldap.properties file, see 10.7 ldap.properties configuration file reference.
Comment out or delete the following parameters (if they exist):
- roleAttributeID
- roleAttributeIsDN
- roleNameAttributeID
If you have edited the ldap.properties files, execute the following command to re-import the LDAP configuration to NNMi:
```
nnmldap.ovpl -reload
```
In the NNMi console, map the predefined NNMi user groups to their counterparts in the directory service:

a. Open the User Groups view.

In the Configuration workspace, expand Security, and then click User Groups.

b. Double-click the admin row.

c. In the Directory Service Name field, enter the full distinguished name of the directory service group for NNMi administrators.

d. Click Save and Close.

e. Repeat steps b through d for each of the guest, level1, and level2 rows.

These mappings provide NNMi console access. Every user who will access the NNMi console must be in a directory service group that is mapped to one of the predefined NNMi user groups named in this step.
In the directory service, identify additional groups of NNMi users. Define new groups as needed.
For each new group added in step 6, create a new user group in the NNMi console:

a. Open the User Groups view.

In the Configuration workspace, expand Security, and then click User Groups.

b. Click New, and then enter the information for the group:

- Set Name to any unique value. Short names are recommended.

- Set Display Name to the value users see.

- Set Directory Service Name to the full distinguished name of the directory service group.

- Set Description to text that describes the purpose of this NNMi user group.

c. Click Save and Close.

d. Repeat step b and step c for each new directory service group of NNMi users.

These mappings provide topology object access in the NNMi console. Each directory service group can be mapped to multiple NNMi user groups.
(Optional) Map the user groups to security groups.

For details, see Configuring Security in NNMi Help.

To Page Top