The following table summarizes the attributes of the Novell adapters:
GUI Name |
Class Name |
---|---|
NetWare NDS |
com.waveset.adapter.NDSResourceAdapter |
NetWare NDS with SecretStore |
com.waveset.adapter.NDSSecretStoreResourceAdapter |
This section provides instructions for configuring NetWare NDS resources for use with Waveset, including:
Instructions for installing the Gateway location
Instructions for configuring the Gateway service account
Instructions for configuring a SecretStore certificate
Install the Waveset Gateway on any NDS client that can connect to the domain to be managed. Multiple gateways should be installed if pass-through authentication is enabled.
By default, the Gateway service runs as the local System account. This is configurable through the Services MMC Snap-in.
If you run the Gateway as an account other than Local System, then the Gateway service account requires the “Act As Operating System” and “Bypass Traverse Checking” user rights. It uses these rights for pass-through authentication and for changing and resetting passwords in certain situations.
When performing before and after action scripts, the gateway may need the Replace a process level token right. This right is required if the gateway attempts to run the script subprocess as another user, such as the resource administrative user. In this case, the gateway process needs the right to replace the default token associated with that subprocess.
If this right is missing, the following error may be returned during subprocess creation:
"Error creating process: A required privilege is not held by the client"
The Replace a process level token right is defined in the Default Domain Controller Group Policy object and in the local security policy of workstations and servers. To set this right on a system, open the Local Security Policies application within the Administrative Tools folder, then navigate to Local Policies > User Rights Assignment > Replace a process level token.
To support SecretStore, a SSL certificate must be exported from the NDS system to the Waveset application server.
One possible way to obtain this certificate is to use ConsoleOne to export the public key. To do this, start ConsoleOne and navigate to the SSL CertificateDNS object. On the Properties dialog of the SSL CertificateDNS object, select Public Key Certificate from the Certificates tab. Press the Export button to begin the process of exporting the certificate. You do not need to export the private key. Store the file in DER format.
Copy the DER file to the Waveset application server. Then add the certificate to the jdk\jre\lib\security\cacerts keyfile using keytool or other certificate management tool. The keytool utility is shipped with the Java SDK. Refer to the Java documentation for more information about the keytool utility.
The NetWare NDS adapter does not require any additional installation procedures.
To add the NDS SecretStore resource to the resources list, perform the following procedure:
Add the following value in the Custom Resources section of the Configure Managed Resources page.
com.waveset.adapter.NDSSecretStoreResourceAdapter |
Copy the jsso.jar file to the InstallDir\idm\WEB-INF\lib directory. The jsso.jar file can be obtained from one of the following locations where the NDS client with either Novell SecretStore or Novell SecureLogin is installed:
NovellInstallDir\ConsoleOne\version\lib\SecretStore
NovellInstallDir\ConsoleOne\version\lib\security
This section provides information related to using the NetWare NDS resource adapter, which is organized into the following sections:
The NetWare NDS adapter in Active Sync mode does not detect account deletions. As a result, you must reconcile to detect these deletions.
The NDS adapters support template values, including user DS and FS rights, Home Directory rights, and Trustees of New Object.
To avoid display problems on the Resources page, set the “Waveset User Name Attribute” parameter to cn.
NDS uses periods instead of commas to mark segments of a name. Waveset will return an error message if you specify commas.
To configure an NDS resource so that you can create a user’s home directory, you must add two attributes to the account attributes:
Home Directory (String) The format of this attribute is
VolumeDN#NameSpaceType#DirectoryPath.
For example,
SERVER_SYS.MYORG#0#\Homes\bob_smith.
The NameSpaceType is one of:
0 indicates DOS name space
1 indicates Macintosh name space
2 indicates UNIX or NFS name space
3 indicates FTAM name space
4 indicates OS/2, Windows 95, or Windows NT name space
Create Home Directory (Boolean) This attribute acts as a flag to indicate whether the actual directory should be created. The directory is created when this flag is set to true.
If you encounter the following error on the NDS adapter,
NWDSAddSecurityEquiv: 0xFFFFFD9B (-613): ERR_SYNTAX_VIOLATION
You might need to increase the following registry keys in HKEY_LOCAL_MACHINE\Software\Waveset\Lighthouse\Gateway
nds_method_retry_count (The default is 10.)
nds_method_retry_sleep_interval (The default is 1000 milliseconds.)
The NetWare API is not compatible with the searchFilter option of the getResourceObjects FormUtil method.
If the account that connects to the NDS resource is restricted by the NDS loginMaximumSimultaneous attribute, then set the Connection Limit resource parameter to a value less than or equal to the value specified by loginMaximumSimultaneous.
Before Waveset 8.0, implementing pass-through authentication required that you edit a registry key and create a separate resource adapter dedicated to performing pass-through authentication. This adapter communicated with the NetWare resource through its own gateway.
As of Waveset 8.0, pass-through authentication to a NetWare resource can be performed with a single resource and gateway. If you implemented pass-through authentication in a version prior to 8.0 and want to use a single resource and gateway, perform the following procedure.
Delete the pass-through authentication resource from your NDS login module group.
If you want to delete the pass-through authentication resource from Waveset, first delete or modify the common resources attribute of the System Configuration object.
<Attribute name=’common resources’> <Object> <Attribute name=’NDS Group’> <List> <String>NDS_Resource_Host</String> <String>NDS_Passthrough_Host</String> </List> </Attribute> </Object> </Attribute> |
If your NDS group contains only the NDS resource and pass-through authentication host, then delete the entire Attribute element. Otherwise, delete the string that defines the pass-through authentication host.
Delete the pass-through authentication resource from the Resources page.
If the gateway is no longer needed on the pass-through authentication host, you may disable the gateway service and remove the application.
The NetWare adapters allow you to use the RA_HANGTIMEOUT resource attribute to specify a timeout value, in seconds. This attribute controls how long before a request to the gateway times out and is considered hung.
You must manually add this attribute to the Resource object as follows:
<ResourceAttribute name=’Hang Timeout’ displayName=’com.waveset.adapter. RAMessages:RESATTR_HANGTIMEOUT’ type=’int’ description=’com.waveset.adapter.RAMessages: RESATTR_HANGTIMEOUT_HELP’ value=’NewValue’> </ResourceAttribute>
The default value for this attribute is 0, indicating that Waveset will not check for a hung connection.
When integration with GroupWise is enabled, the NDS adapter can manage the GroupWise attributes of NDS users. The NDS adapter supports adding and removing NDS users from a GroupWise Post Office. It also retrieves or modifies other GroupWise account attribute, including AccountID, GatewayAccess, and DistributionLists.
Enabling GroupWise Integration
To activate the integration with GroupWise, you must define a value in the GroupWise Domain DN resource attribute. This value specifies the DN of the GroupWise domain which will managed. An example value for this attribute is
CN=gw_dom.ou=GroupWise.o=MyCorp
The NDS Tree resource attribute defines the NDS tree under which the GroupWise domain is expected to reside is. That is, the GroupWise domain must be in the same tree as the NDS users managed by the adapter.
Managing a NDS User’s GroupWise Post Office
The account attribute GW_PostOffice represents the GroupWise Post Office.
To add an NDS user into a GroupWise Post Office, set the GW_PostOffice account attribute to the name of an existing Post Office that is associated with the GroupWise domain.
To move an NDS user to a different GroupWise Post Office, set the GW_PostOffice account attribute to the name of the new Post Office that is associated with the GroupWise domain.
To remove an NDS user from its Post Office, set the GW_PostOffice account attribute to the same value as the GroupWise Delete Pattern resource attribute. The default value for GroupWise Delete Pattern resource attribute is *TRASH*.
By default, you cannot use the NetWare NDS with SecretStore adapter to manage resource objects. To enable this functionality, you must edit the System Configuration Object.
Under the lines that read:
<!-- form mappings --> <Attribute name=’form’> <Object>
add the following:
<!-- NetWare NDS with SecretStore --> <Attribute name=’NetWare NDS with SecretStore Create Group Form’ value=’NetWare NDS Create Group Form’/> <Attribute name=’NetWare NDS with SecretStore Update Group Form’ value=’NetWare NDS Update Group Form’/> <Attribute name=’NetWare NDS with SecretStore Create Organization Form’ value=’NetWare NDS Create Organization Form’/> <Attribute name=’NetWare NDS with SecretStore Update Organization Form’ value=’NetWare NDS Update Organization Form’/> <Attribute name=’NetWare NDS with SecretStore Create Organizational Unit Form’ value=’NetWare NDS Create Organizational Unit Form’/> <Attribute name=’NetWare NDS with SecretStore Update Organizational Unit Form’ value=’NetWare NDS Update Organizational Unit Form’/> <Attribute name=’NetWare NDS with SecretStore Create User Form’ value=’NetWare NDS Create User Form’/> <Attribute name=’NetWare NDS with SecretStore Update User Form’ value=’NetWare NDS Update User Form’/>
This section provides information about supported connections and privilege requirements.
The Gateway service should be used to connect to a NetWare NDS resource. The Gateway service uses a TCP/IP socket connection (3 DES) for exchanging password information on the network.
You can also use standard LDAP or LDAP over SSLP to connect to the NetWare NDS server. In this scenario, use the LDAP resource adapter.
The Waveset administrator must have the proper NDS rights to create a NetWare user. By default, a NetWare administrator has all rights in the Directory and in the NetWare file system.
To perform password administration, an NDS administrator must have Compare, Read, and Write rights on the following properties:
Group Membership
Locked By Intruder
Login Intruder Attempts
Login Intruder Reset Time
Password Management
The Waveset administrator account performing functions with NDS SecretStore must be defined as a SecretStore administrator.
The following table summarizes the provisioning capabilities of this adapter.
This section provides information about the NetWare NDS account attribute support including:
The syntax (or type) of an attribute usually determines whether the attribute is supported. In general, Waveset supports Boolean, string, and integer syntaxes.
The values for attributes with SYN_CI_LIST (such as Language) and SYN_PO_ADDRESS (such as Postal Address) syntaxes should be a list of strings separated by $. The values for SYN_OCTET_STRING attributes should be Base 64 encoded strings of the bytes in the octet stream.
Information about attribute syntax support is provided in the following Supported Syntaxes and Unsupported Syntaxes sections.
The following table provides information about supported attribute syntaxes:
NDS Syntax |
Attr Type |
Object ID |
Syntax ID |
---|---|---|---|
Boolean |
Boolean |
1.3.6.1.4.1.1466.115.121.1.7 |
SYN_BOOLEAN |
Case Exact String |
String |
1.3.6.1.4.1.1466.115.121.1.26 2.16.840.1.113719.1.1.5.1.2 |
SYN_CE_STRING |
Case Ignore List |
String |
2.16.840.1.113719.1.1.5.1.6 |
SYN_CI_LIST |
Case Ignore String |
String |
1.3.6.1.4.1.1466.115.121.1.15 |
SYN_CI_STRING |
Class Name |
String |
1.3.6.1.4.1.1466.115.121.1.38 |
SYN_CLASS_NAME |
Counter |
Int |
2.16.840.1.113719.1.1.5.1.22 |
SYN_COUNTER |
Distinguished Name |
String |
1.3.6.1.4.1.1466.115.121.1.12 |
SYN_DIST_NAME |
Fax Number |
String |
1.3.6.1.4.1.1466.115.121.1.22 |
SYN_FAX_NUMBER |
Integer |
Int |
1.3.6.1.4.1.1466.115.121.1.27 |
SYN_INTEGER |
Interval |
Int |
1.3.6.1.4.1.1466.115.121.1.27 |
SYN_INTERVAL |
Numeric String |
String |
1.3.6.1.4.1.1466.115.121.1.36 |
SYN_NU_STRING |
Octet String |
String |
1.3.6.1.4.1.1466.115.121.1.40 |
SYN_OCTET_STRING |
Path |
String |
2.16.840.1.113719.1.1.5.1.15 |
SYN_PATH |
Postal Address |
String |
1.3.6.1.4.1.1466.115.121.1.41 |
SYN_PO_ADDRESS |
Printable String |
String |
1.3.6.1.4.1.1466.115.121.1.44 |
SYN_PR_STRING |
Stream |
String |
1.3.6.1.4.1.1466.115.121.1.5 |
SYN_STREAM |
Telephone Number |
String |
1.3.6.1.4.1.1466.115.121.1.50 |
SYN_TEL_NUMBER |
Time |
Int |
1.3.6.1.4.1.1466.115.121.1.24 |
SYN_TIME |
The following table provides information about unsupported syntaxes:
NDS Syntax |
Object ID |
Syntax ID |
---|---|---|
Back Link |
2.16.840.1.113719.1.1.5.1.23 |
SYN_BACK_LINK |
EMail Address |
2.16.840.1.113719.1.1.5.1.14 |
SYN_EMAIL_ADDRESS |
Hold |
2.16.840.1.113719.1.1.5.1.26 |
SYN_HOLD |
Net Address |
2.16.840.1.113719.1.1.5.1.12 |
SYN_NET_ADDRESS |
Object ACL |
2.16.840.1.113719.1.1.5.1.17 |
SYN_OBJECT_ACL |
Octet List |
2.16.840.1.113719.1.1.5.1.13 |
SYN_OCTET_LIST |
Replica Pointer |
2.16.840.1.113719.1.1.5.1.16 |
SYN_REPLICA_POINTER |
Timestamp |
2.16.840.1.113719.1.1.5.1.19 |
SYN_TIMESTAMP |
Typed Name |
2.16.840.1.113719.1.1.5.1.25 |
SYN_TYPED_NAME |
Unknown |
2.16.840.1.113719.1.1.5.1.0 |
SYN_UNKNOWN |
Information about attribute support is provided in the following Supported Account Attributes and Unsupported Account Attributes sections.
The following attributes are displayed on the Account Attributes page for the NDS resource adapters.
Resource User Attribute |
NDS Syntax |
Attribute Type |
Description |
---|---|---|---|
Create Home Directory |
Boolean |
Boolean |
Indicates whether to create a home directory for the user. The Home Directory Parameter must be set. |
Description |
Case Ignore String |
String |
Text that describes the user. |
Facsimile Telephone Number |
Facsimile Telephone Number |
String |
The telephone number and, optionally, the parameters for a facsimile terminal associated with a user. |
Full Name |
Case Ignore String |
String |
The full name of a user. |
Generational Qualifier |
Case Ignore String |
String |
Indicates a person’s generation. For example, Jr. or II. |
Given Name |
Case Ignore String |
String |
The given (first) name of a user. |
Group Membership |
Distinguished Name |
String |
A list of the groups to which the user belongs. |
GW_AccountID |
Not applicable |
String |
Account ID specified in the User Information field for GroupWise accounting. |
GW_DistributionLists |
Not applicable |
String |
Distribution lists of which the user is a member. The values must be valid distribution list distinguished names (DNs). |
GW_GatewayAccess |
Not applicable |
String |
Restricts access to GroupWise gateways. See your gateway documentation to determine if this field is applicable. |
GW_Name |
Not applicable |
String |
The GroupWise mailbox name. |
GW_PostOffice |
Not applicable |
String |
The name of an existing Post Office that is associated with the GroupWise domain. |
Home Directory |
Path |
String |
The location of a client’s current working directory. See the “Usage Notes” for more information. |
Initials |
Case Ignore String |
String |
The user’s middle initial. |
Internet EMail Address |
Case Ignore String |
String |
Specifies an Internet e-mail address. |
L |
Case Ignore String |
String |
A physical or geographical location. |
Locked By Intruder |
Boolean |
Boolean |
Indicates an account has been locked due to excessive failing login attempts. |
Login Grace Limit |
Integer |
Int |
The total number of times an old password can be used (after the old password has expired) to access the account. |
Login Maximum Simultaneous |
Integer |
Int |
The number of authenticated login sessions a user can initiate simultaneously. |
ou |
Case Ignore String |
String |
The name of an organizational unit. |
Password Allow Change |
Boolean |
Boolean |
Determines whether the person logged in under an account can change the password for that account. |
Password Expiration Interval |
Interval |
Int |
The time interval a password can remain active. |
Password Required |
Boolean |
Boolean |
Establishes that a password is required for the user to log in. |
Password Unique Required |
Boolean |
Boolean |
Establishes that when a user password is changed, it must be different from those in the Passwords Used attribute. |
Surname |
Case Ignore String |
String |
Required. The name an individual inherits from a parent (or assumes by marriage) and by which the individual is commonly known. |
Telephone Number |
Telephone Number |
String |
The user’s telephone number. |
Title |
Case Ignore String |
String |
The designated position or function of a user within an organization. |
userPassword |
N/A |
Encrypted |
Required. The user’s password. |
The following table lists additional supported attributes that are defined in the NDS User object class.
Resource User Attribute |
NDS Syntax |
Attribute Type |
Description |
---|---|---|---|
Account Balance |
Counter |
Int |
The amount of credit the user has to buy network services, such as connection time. |
Allow Unlimited Credit |
Boolean |
Boolean |
Indicates whether the user account has unlimited credit for using network services. |
audio |
Octet String |
String |
An audio file in binary format. |
businessCategory |
Case Ignore String |
String |
Describes the kind of business performed by an organization. |
carLicense |
Case Ignore String |
String |
Vehicle license or registration plate |
departmentNumber |
Case Ignore String |
String |
Identifies a department within an organization |
displayName |
Case Ignore String |
String |
The name to be displayed on admin screens. |
Employee ID |
Case Ignore String |
String |
Numerically identifies an employee within an organization |
employeeType |
Case Ignore String |
String |
Type of employment, such as Employee or Contractor |
Entrust:User |
Case Exact String |
String |
Specifies an Entrust user. |
Higher Privileges |
Distinguished Name |
String |
An alternative set of security access privileges. |
homePhone |
Telephone Number |
String |
The user’s home telephone number. |
homePostalAddress |
Postal Address |
String |
The user’s home address. |
jpegPhoto |
Octet String |
String |
A JPEG file containing a photo of the user |
labeledUri |
Case Ignore String |
String |
The user’s Uniform Resource Identifier (URI). |
Language |
Case Ignore List |
String |
An ordered list of languages |
Last Login Time |
Time |
String |
The login time of the session previous to the current session. |
ldapPhoto |
Octet String |
String |
A photo of the object in binary format. |
Login Allowed Time Map |
Octet String |
String |
The allowed login time periods for an account for each day of the week to a precision of one-half hour. |
Login Disabled |
Boolean |
Int |
Informs the user that the account has been disabled. |
Login Expiration Time |
Time |
String |
A date and time after which a client cannot log in. |
Login Grace Remaining |
Counter |
Int |
The number of grace logins are left before the account is locked. |
Login Intruder Attempts |
Counter |
Int |
The number of failed login attempts that have occurred in the current interval. |
Login Intruder Reset Time |
Time |
String |
The next time that the intruder attempts variable will be reset. |
Login Script |
Stream |
String |
The user’s login script. |
Login Time |
Time |
String |
The login time of the current session. |
manager |
Distinguished Name |
String |
The user’s supervisor. |
Minimum Account Balance |
Integer |
Int |
The minimum amount of credit (or money) a user must have in his or her account to access specified services. |
mobile |
Telephone Number |
String |
The user’s cell phone number. |
NDSPKI:Keystore |
Octet String |
String |
Contains wrapped private keys. |
NRD:Registry Data |
Stream |
String |
NetWare Registry Database |
NRD:Registry Index |
Stream |
String |
The index of the NetWare Registry Database |
pager |
Telephone Number |
String |
The user’s pager number. |
Password Expiration Time |
Time |
String |
Specifies when the password will expire. |
preferredLanguage |
Case Ignore String |
String |
The user’s preference for written or spoken language. |
Print Job Configuration |
Stream |
String |
Contains information on the specified print job configuration. |
Printer Control |
Stream |
String |
The NDS counterpart of the DOS printer definition file, NET$PRN.DAT. |
Profile |
Distinguished Name |
String |
The login profile to be used if the user does not specify one at login time. |
Profile Membership |
Distinguished Name |
String |
A list of profiles that the object can use. |
Public Key |
Octet String |
String |
A certified RSA public key |
roomNumber |
Case Ignore String |
String |
The user’s office or room number. |
secretary |
Distinguished Name |
String |
The user’s administrative assistant. |
Security Equals |
Distinguished Name |
String |
Specifies group membership and security equivalences of a user. |
Security Flags |
Integer |
Int |
The NCP Packet Signature level of the object. |
Timezone |
Octet String |
String |
The time zone offset for a user. |
UID (User ID) |
Integer |
Int |
A unique user ID for use by UNIX clients. |
userCertificate |
Octet String |
String |
A certificate for certificate management. |
userSMIMECertificate |
Octet String |
String |
The user’s certificate for Netscape Communicator for S/MIME. |
x500UniqueIdentifier |
Octet String |
String |
An identifier to use in distinguishing between users when a DN has been reused. |
The following account attributes are not supported:
Login Intruder Address
Network Address
Network Address Restriction
Passwords Used
Print Job Configuration
Printer Control
Private Key
Server Holds
Type Creator Map
Waveset supports the following NetWare NDS objects by default. Any string, integer, or Boolean-based attributes can also be managed.
Resource Object |
Features Supported |
Attributes Managed |
---|---|---|
Group |
Create, update, delete |
L, OU, O, CN, Description, Member, Owner |
Organizational Unit |
Create, update, delete |
OU, Description, L, Facsimile Telephone Number, Telephone Number |
Organization |
Create, update, delete |
dn, O, Description, L, Facsimile Telephone Number, Telephone Number |
The default identity template is
CN=$accountId$.O=MYORG
You must replace the default template with a valid value.
This section lists the sample forms that are available for this resource adapter.
These forms are built into Waveset:
NDS Group Create Form
NDS Group Update Form
NDS Create Organizational Unit Form
NDS Update Organizational Unit Form
NDS Create Organization Form
NDS Update Organization Form
The NDSUserForm.xml form is also available.
Use the Waveset debug pages to set trace options on the following classes:
com.waveset.adapter.NDSResourceAdapter
com.waveset.adapter.NDSSecretStoreResourceAdapter
com.waveset.adapter.AgentResourceAdapter
To make access to NDS through the Waveset Gateway single-threaded or serialized, set the following registry key and value in the HKEY_LOCAL_MACHINE\SOFTWARE\Waveset\Lighthouse\Gateway node on the Gateway machine:
Name |
Type |
Data |
---|---|---|
ExclusiveNDSContext |
REG_DWORD |
|
Tracing can also be enabled on the following methods to diagnose problems connecting to the gateway:
com.waveset.adapter.AgentResourceAdapter#sendRequest
com.waveset.adapter.AgentResourceAdapter#getResponse