Installation Manual

ManualsBrandsHP ManualsSoftwareHP Storage Essentials Standard Edition SRM Software

391

392

393

394

395

396

397

398

399

400

Managing Security374

2. In the login-handler.xml file, comment out the section that contains

com.appiq.security.server.BasicLoginhandler, which enables internal

authentication mode. Only one login handler is allowed at a time.

<!--LoginHandlerClass>com.appiq.security.server.BasicLoginHandler</LoginHan

dlerClass-->

3. Comment out the <LoginHandlerType>Default</LoginHandlerType> tag as follows:

4. Uncomment the line containing the class name and login handler type so that it appears as

follows:

<LoginHandlerClass>com.appiq.security.server.LdapLoginHandler</Login-

HandlerClass>

5. Replace directory.hp.com with the IP address or the fully qualified name of your LDAP

server in the login-handler.xml file, as shown in the following example:

where

•

192.168.10.1 is the IP address of the server running LDAP.

• 389 is the port on which LDAP is running on the server.

6. If you want the password to be saved in the management server database, change the value of

the <ShadowPassword> tags to true, as shown in the following example:

Saving the passwords in the management server database allows a user to also log into the

management server if the management server is changed back to local mode. This, however, is

not recommended as it defeats the purpose of externalizing a user's credentials.

The login-handler.xml file contains two sets of <ShadowPassword> tags: one for AD

and one for LDAP. Make sure you change the value of the <ShadowPassword> tags that are

children of the <LDAP> tags.

7. If you want the user name to be case sensitive, change the value of the

<CaseSensitiveUserName> tag to true, as shown in the following example:

If you change the value of <CaseSensitiveUserName> to true, the management server

becomes case-sensitive to user names. For example, the management server sees MyUserName

and myusername as different users.

The login-handler.xml file contains two sets of <CaseSensitiveUserName> tags: one

for AD and one for LDAP. Make sure you also change the value of the

<CaseSensitiveUserName> tags that are children of the <LDAP> tags.

8. Provide the LDAP search base in which you want the management server to look up AD/LDAP

user attributes. Allow no spaces between commas and put in all components of fully qualified

domain name, for example, hds.usa.com would be DC=hds,DC=usa,DC=com.

The search base is used to specify the starting point for the search. It

points to a distinguished name of an entry in the directory hierarchy.

CN=$NAME$,dc=MyCompanyName,dc=COM</SearchBase>

or: