12.4.4 User identification
User identification applies to the mixed mode and the external mode.
The distinguished name for user identification is the fully-qualified method of locating one user in the directory service. NNMi passes the user distinguished name in an LDAP request to the directory service.
In the LDAP configuration file, the user distinguished name is the concatenation of the <base> and <baseContextDN> elements in the nms-auth-config.xml file (the baseFilter value and the baseCtxDN value in the ldap.properties file). If the password returned by the directory service matches the sign-in password the user entered into the NNMi console, user sign in continues.
When configuring user identification for the mixed mode, the following information applies:
-
For NNMi console access, NNMi examines the following information and grants the user the highest possible privileges:
- The value of the defaultRole parameter in the LDAP configuration file
- This user's membership in the predefined NNMi user groups in the NNMi console
-
For NNMi topology object access, NNMi grants access according to the security group mappings for the NNMi user groups in the NNMi console to which this user belongs.
When configuring user identification for the external mode, the following information applies:
-
For NNMi console access, NNMi examines the following information and grants the user the highest possible privileges:
- The value of the defaultRole parameter in the LDAP configuration file
- This user's membership in the directory service groups that are mapped (with the Directory Service Name field) to the predefined NNMi user groups in the NNMi console
-
For NNMi topology object access, NNMi grants access according to the security group mappings for the groups in the directory service to which this user belongs (as mapped to NNMi user groups in the NNMi console).
- Active Directory user identification example
-
-
In the nms-auth-config.xml file
If the nms-auth-config.xml file contains <base>CN={0}</base><baseContextDN>OU=Users,OU=Accounts,DC=example,DC=com</baseContextDN>, and a user signs in to NNMi as john.doe, the string passed to the directory service is:
CN=john.doe,OU=Users,OU=Accounts,DC=example,DC=com
-
In the ldap.properties file
If baseFilter is set to CN={0}, baseCtxDN is set to OU=Users,OU=Accounts,DC=example,DC=com, and a user signs in to NNMi as john.doe, the string passed to the directory service is:
CN=john.doe,OU=Users,OU=Accounts,DC=example,DC=com
-
- Other directory services user identification example
-
-
In the nms-auth-config.xml file
If the nms-auth-config.xml file contains <base>uid={0}@example.com</base><baseContextDN>ou=People,o=example.com</baseContextDN>, and a user signs in to NNMi as john.doe, the string passed to the directory service is:
uid=john.doe@example.com,ou=People,o=example.com
-
In the ldap.properties file
If baseFilter is set to uid={0}@example.com, baseCtxDN is set to ou=People,o=example.com, and a user signs in to NNMi as john.doe, the string passed to the directory service is:
uid=john.doe@example.com,ou=People,o=example.com
-