Sun Java System Federation Manager 7.0 User's Guide

Changing the Default Authentication Module from Flat File to Active Directory

Although Microsoft Active Directory is an LDAPv3–compliant directory, the procedure to change the default authentication module from Flat File to Active Directory is different from the procedure described in Changing the Default Authentication Module from Flat File to LDAP. The following sections describe the procedures:

ProcedureTo Set Active Directory as the Default Authentication Module for an Organization

  1. Use ldapsearch in the following format to find values that begin with iplanet-am-auth-org-config.

    /usr/bin/ldapsearch -b OU=default,OU=OrganizationConfig,OU=1.0,
    -D admin-dn -w admin-password 
    -s base -h AD-host -p AD-port 
    "(objectclass=*)" sunkeyvalue

    The search result would look like this:


    Save the search result as it will be used in the following step as the value for the Delete entry.

  2. Save the following text as an Lightweight Directory Interchange Format (LDIF) file.

    dn: OU=default,OU=OrganizationConfig,OU=1.0,
    dn: OU=default,OU=OrganizationConfig,OU=1.0,
  3. Type the found values from the previous step into the Delete section of the saved LDIF file.

  4. Type the new values into the Add section of the saved LDIF file.

  5. Run ldapmodify using the LDIF file as input.

    /usr/bin/ldapmodify -h AD-host -p AD-port -D adminDN -w admin-password -f name-of-LDIF-file

ProcedureTo Enable an Organization to Use the Active Directory Authentication Module

  1. In the Federation Manager Console, select the Organization tab.

  2. Under Organization, select the Authentication tab.

  3. Click Add.

    A list of Authentication Modules is displayed.

  4. Select Active Directory from the list and click Next.

  5. Configure the attributes for the Active Directory authentication module and click Assign.

  6. Under Organization, select the Authentication tab.

  7. Click the Edit button next to the Core authentication service.

    The Core attributes are displayed.

  8. Add Active Directory to the Organization Authentication Modules attribute by holding down the Control key and selecting Active Directory.

  9. Click Save.

    Active Directory is now enabled as an authentication module for the organization. To authenticate to Federation Manager through the Active Directory module, use a URL in the format protocol://host:port/deploy_URI/something?module=AD.