LDAP Directories

Bravura Security Fabric uses a designated account on the LDAP Directory Service target system to create and manage objects.

The target system administrator must be a member of the configuration administrators group. Ensure that you set and note the account’s password. You will be required to enter the login ID and password when you add the LDAP target system to Bravura Security Fabric .

You must use a fully qualified name for the administrator ID.

For example, on Netscape Directory Server, the built-in administrator account’s fully qualified name is:

uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot

If you want to communicate with an LDAP server configured for SSL encryption, you must obtain the necessary certificate file from the LDAP server and install it into a trusted certificate store on your instance server.

Before you start, ensure that the LDAP server is configured for SSL and has a server authentication certificate to deploy onto the instance server.

It is important to ensure that the Network Service account on the LDAP server has read permissions for the server authentication certificate.

Please refer to the following link for more information on setting up LDAP over SSL:

https://msdn.microsoft.com/en-us/library/cc725767(v=ws.10).aspx\#BKMK\_1

To obtain the SSL certificate from the LDAP server, follow the steps below:

If you cannot or prefer not to use a private key, you can use one of the following methods:

Request from their LDAP administrator to request .cer files for the LDAP Server from an LDAP administrator in your organization.

To install the SSL certificate onto the instance server, follow the steps below:

You can restrict Bravura Security Fabric to list only those user and group objects that exist in one or more named containers; for example, if your LDAP Directory Service server is divided into organizational units. To do this, on the Target system address configuration page, specify:

These fields allow multiple values. To fill in multiple values, select List from the drop-down list box displaying in front of these fields, and use More button to add additional input box(es) when more than one value is given. Value in each input box is treated as a single value, for examples,

You can also exclude OUs to further restrict the listing of users. This option will remove all users and groups that match the OU listed. To do this, specify:

When the exclude OUs option and any of the list OUs options are used together, the listing process will list OUs first and then remove objects that match the exclude criteria.

If there are many OUs to list, there is an option to include all OUs in a file. To use the file, select the File option from the drop-down list and specify file name in the field.

These files must be located in the <Program Files path>\Bravura Security\Bravura Security Fabric\<instance>\ script\ directory and contain a list of OUs to list or exclude users from. They cannot be combined into one file and must be separate.

For listing users from OUs:

# KVGROUP-V2.0
   listOUs = {
     "OU=people,OU=it,DC=example,DC=com";
     "OU=people,OU=hr,DC=example,DC=com";
   }

For listing groups from OUs:

# KVGROUP-V2.0
   listGroupOUs = {
     "OU=Groups,OU=it,DC=example,DC=com";
     "OU=Groups,OU=hr,DC=example,DC=com";
   }

For excluding OUs:

# KVGROUP-V2.0
   excludeOUs = {
     "OU=disabled,OU=it,DC=example,DC=com";
     "OU=disabled,OU=hr,DC=example,DC=com";
   }

The connector will not list any OU if an OU file is empty.

You can configure Bravura Security Fabric to use a profile/request attribute to prompt users for the destination container when creating or moving accounts on a target system that supports contexts.

When the Profile/request attribute to use as the container DN option is configured on the Target system information page, users can:

To allow users to select a container for a create account or move context operation:

Group attributes may be mapped for the _container_dn pseudo-attribute on the LDAP Directory Service server so that users can move a group to a different container to move contexts.

The _container_dn group attribute is mapped to the GROUP_OU resource attribute by default. The group attribute may be overridden to allow for a new container to be specified when updating the group by setting the value for ’Action when updating group’ from ’None’ to ’Set to specified value when mapped profile attribute changes’.

The GROUP_OU resource attribute is then added as a member for the GROUP_INFO_UPDATE resource attribute group. A user may then specify a new container for the group when making a request to update attributes for a group.

Group attributes may also be mapped for an attribute on the LDAP target system such as cn so that users can rename a group id. In this case, a new resource attribute may be added for the custom attribute and added as a member to the GROUP_INFO_UPDATE resource attribute group. A custom cn group attribute is then added for the LDAP Directory Service target and mapped to the resource attribute along with the value for ’Action when updating group’ being set to ’Set to specified value when mapped profile attribute changes’.

A user may then specify a new group id for the group when making a request to update attributes for a group.