Complete Contents
Introduction
Chapter 1 Introducing Netscape Console
Chapter 2 The Netscape Server Family Setup Program
Chapter 3 Using Netscape Console
Chapter 4 User and Group Administration
Chapter 5 Using SSL
Chapter 6 Delegating Server Administration
Chapter 7 Using SNMP to Monitor Services
Chapter 8 Administration Server Basics
Chapter 9 Administration Server Configuration
Appendix A Distinguished Name Attributes and Syntax
Appendix B Administration Server Command Line Tools
Appendix C FORTEZZA
Appendix D Introduction to Public-Key Cryptography
Appendix E Introduction to SSL
Managing Servers with Netscape Console: User and Group Administration
Previous Next Contents Index


Chapter 4 User and Group Administration

Netscape Console provides you access to a consolidated, networkwide repository for application data about user accounts, group lists, access privileges, and other security information. Use Netscape Console to create or locate and manage records for users and groups on any node in your enterprise.

This chapter contains the following sections:


Interacting with the Directory Server
When you use Netscape Console to create or modify users or groups, you make changes in the user directory, a subtree in the Directory Server. See "The Directory Server" on page 13 for a brief overview of Netscape Console architecture.

Using Distinguished Names
The User and Group interface of Netscape Console helps you create or modify Distinguished Names (DNs). Each user and group in your enterprise is represented in the Directory Server by a distinguished name (DN). A DN is a text string that contains identifying attributes. You use DNs whenever you make changes in the directory's users and groups database. For example, you need to specify DN information each time you

See "Distinguished Name Attributes and Syntax" on page 151 for a brief summary of Distinguished Name syntax and frequently used attributes. For detailed information, see the Administrator's Guide to Directory Server 4.0.

Locating an Existing User or Group in the User Directory
The Users and Groups Search function works similarly to the basic Search function you find throughout Netscape Console. The search is performed against the default user directory. Any changes you make in the Users and Groups area of Netscape Console are made in the default user directory. You can manually change to a user directory other than the default. See "User Directory Settings" on page 144 for more information.

Figure 4.1    The Users and Groups area of Netscape Console.

 To locate users or groups in the directory:

  1. In Netscape Console, click Users and Groups.

  2. In the Search field, enter a user or group name that can be found in the user directory.

  3. (Optional) To specify more focused search criteria, click Advanced. In the Advanced Search dialog box, use the pull-down menus to first choose an attribute, then a search operator

    .

  4. Click Search. Results are displayed in the list box.
Choosing a Different Search Directory
When you use the Users and Groups Search function, the URL for the default user directory appears. All searches are performed against this user directory. You can choose a user directory other than the default.

To change the search directory:

  1. In Netscape Console, click Users and Groups.

  2. Click Directory.

  3. In the Change Directory dialog box, provide user directory information:

    4. User Directory Host. Enter the fully qualified host name where the user directory is installed.

    User Directory Port. Enter the port number you want to use to connect to the user directory.

    User Directory Subtree. Use the form o=airius.com to indicate where to find the user directory.

    Bind DN. Enter the distinguished name of a user authorized to change entries in the user directory.

    Bind Password. Enter the password of the user directory administrator.

  4. Click OK.
End-User Access to the User Directory
The end-user administration page is an HTML page designed to provide end users access to their own entries in the user directory. All users in the user directory are end users. For example, rank-and-file employees in your company might be given access to this page through a company phone book or directory. Using this page, shown in Figure 4.2, an employee can edit his own name, phone number, or other data that does not impact other directory entries. The changes made on this page are made in the default user directory.

To access the end-user administration page:

  1. Open a browser, then enter the qualified host name and port number for the Administration Server you want to access.
    Example: Venus.Airius.com:389

  2. In the Administration page, click Edit User Profile.

Figure 4.2    End users can modify, but not create, a user entry.
Creating New Directory Entries
Go to the Users and Groups section of Netscape Console when you want to add or modify a user, group, or organizational unit. The User and Group graphical interface helps you create a DN entry in the directory.

 Note. You can also use the command line to perform any of the directory operations described here. For detailed information, see the Administrator's Guide to Directory Server 4.0.

Organizational Units
An organizational unit can include a number of groups, and it usually represents a division, department, or other discrete business group. A DN can be in more than one organizational unit (ou).

New organizational units are created using the organizational Unit object class. For example, if you create a new organization called Accounting within the organizational unit West Coast, and your Base DN is o=Ace Industry, c=US, then the new organization unit's DN is

ou=Accounting, ou=West Coast, o=Ace Industry, c=US

Creating a new organizational unit
To create an organizational unit:

  1. In Netscape Console, click Users and Groups.

  2. Use the drop-down list to choose New Organizational Unit, then click Create.

  3. In the Select Organizational Unit window, select the directory subtree (ou) to which the organizational unit will belong, then click OK.

  4. In the Create Organizational Unit dialog box, enter organizational unit information.

    5. Name. Enter the name of the organizational unit.

    Description. Enter a description of the organizational unit that's meaningful to you.

    Phone. Enter a phone number where one can reach a contact (such as an administrative assistant) for the organizational unit.

    Fax. Enter a fax number where one can reach a contact (such as an administrative assistant) for the organizational unit.

    Alias. Enter another name, such as a nickname or acronym, that you might use in place of the Name entered above.

  5. Click OK.
Groups
A group consists of all users who share a common attribute. For example, all users with DNs containing the attribute ou=Sales belong to the Sales group. Once you create a new group, you add users, or members, to it. You can use three types of groups in your directory: static, dynamic, and certificate groups.

Creating a New Static Group
Create a static group by specifying the same group attribute in the DNs of any number of users. A static group doesn't change unless you add a user to it or delete a user from it. For example, a number of users have the attribute department=marketing in their DN. But none of those users are members of the Marketing group until you explicitly add each one to the group.

To create a static group in the directory:

  1. In Netscape Console, click Users and Groups.

  2. Use the drop-down list to choose New Group, then click Create.

  3. In the Select Organizational Unit window, select the directory subtree (ou) to which the group will belong, then click OK.

  4. In the Create Group dialog box, enter group information, then click Members.

    5. Group Name. Enter a name for the group.

    Description. (Optional) Enter a description to help you identify this group.

  5. If you only want to create the group now, and plan to add group members later, click OK and skip the rest of this procedure.

  6. In the Members dialog box, click Add or Edit as appropriate, then use the Search dialog box to locate a user you want to add to the Members User ID list. Repeat this step until all the users you want to add to the group are displayed in the Member User ID list.
Creating a Dynamic Group
Create a dynamic group when you want users to be added automatically to a group based on their DN attributes. For example, you can create a group that automatically includes any DN that contains the attribute department=marketing. Whenever you apply a search filter for deparment=marketing, the search returns a group including all DNs containing the attribute department=marketing. The DNs are included automatically, without your having to add each individual to the group.

To create a dynamic group in the directory:

  1. In Netscape Console, click Users and Groups.

  2. Use the drop-down list to choose New Group, then click Create.

  3. In the Select Organizational Unit window, select the directory subtree (ou) to which the group will belong, then click OK.

  4. In the Create Group dialog box, enter general group information, then click Members.

    5. Group Name. Enter a name for the group.

    Description. (Optional) Enter a description to help you identify this group.

  5. Click Dynamic Group, then click Add.

  6. Use the Construct and Test LDAP URL dialog box to specify the criteria for including users in the dynamic group.

  7. In the Construct LDAP URL dialog box, provide search criteria:

    8. LDAP Server Host. Enter the fully qualified host name of the user directory you want to search. Example: <host>:<domain>

    Port. Enter port number for the Directory Server that contains the specified user directory.

    Base DN. Enter the base DN for from which to begin the search. Example: ou=Marketing, o=Klondike Corp, c=US

    Search. Indicate the user directory subtree you want to search against.

    for. Indicate whether you want to search users, groups, or both.

    where. Use the pull-down menus to first choose an attribute, then a search operator. Choices are described in the table below. In the last input field, enter a search string, then click Search.

    More. Provides additional fields for specifying more attributes against which to search.

  8. Click OK.

  9. (Optional) In the Construct and Test LDAP URL dialog box, to see a list of users and groups included in the dynamic group, click Test.

  10. Click Account, then select the accounts the group will use.

  11. Click OK.
Creating a Certificate Group
Create a certificate group when you want to group all users who have a certificate containing a common attribute. For example, you can create a certificate for all users who share these attributes: ou=Sales, ou=West, ou=CA. When an individual user logs on to a server, if all of these attributes are found in his certificate, the user is automatically recognized as belonging to the Western Sales group located in California. If the user's certificate does not contain these matching attributes, he is not recognized as a member of the group and does not receive the same access, privileges, or permissions as group members.

To create a certificate group in the directory:

  1. In Netscape Console, click Users and Groups.

  2. Use the drop-down list to choose New Group, then click Create.

  3. In the Select Organizational Unit window, select the directory subtree (ou) to which the group will belong, then click OK.

  4. In the Create Group dialog box, enter group information, then click Members.

    5. Group Name. Enter a name for the group.

    Description. (Optional) You can enter a description to help you identify this group.

  5. Click Certificate Group, then click Add or Edit as appropriate.

  6. In the Certificate Group dialog box, provide the following information:

    7. Common Name. Enter the full name of the group. Example: cn=Database Administrators

    Organization. Enter the name of the organization the group belongs to. Example: o=Operations Group

    Mail. Enter the street address of the groups' business.

    Country. Enter the country code for the group's business.

    Locality. Enter the city name for the group's business.

    State/Province. enter the state or province name for the group's business.

    Unit. Enter the name of the unit within an organization that the group belongs to. Example: ou=IS Department

  7. Click Account. Select the accounts the group will use.

  8. Click OK.
Users
A user entry contains information about an individual person or object in the directory.

Creating a New User
To create a new user entry in the directory:

  1. In Netscape Console, click Users and Groups.

  2. Use the drop-down list to choose New User, then click Create.

  3. In the Select Organizational Unit, select the directory subtree (ou) to which the user will belong, then click OK.

  4. In the Create User window, enter user information.

    5. First Name. Enter the user's full given name.

    Last Name. Enter the user's full surname.

    Full Name(s). This is equivalent to the common name (cn) in the directory and is automatically generated based on the First Name and Last Name entered above. You can edit this name as necessary.

    User ID. When you enter a first and last name, the user ID is automatically generated. You can replace this user ID with one of your choosing. The userID must be unique from all other user ID's in the directory.

    Password. (Optional) Enter the user's password.

    Confirm Password. Enter the user's password again to confirm it.

    E-Mail. (Optional) Enter the user's email address.

    Phone. (Optional) Enter the user's telephone number.

    Access Permissions Help. Provides information about setting access controls that apply to users and groups.

  5. Click Licenses. Select the servers this user is licensed to use, then click OK.

  6. Click Account. Select the accounts the user will use, than then click OK.

  7. (Optional) Click Languages. Use the drop-down list to select the user's preferred language. Select (highlight) a language to see the Pronunciation field when appropriate.

  8. (Optional) Enter language-related information:

    9. First Name. Enter the user's given name.

    Last Name. Enter the user's surname.

    Full Name(s). Enter the user's name as it should appear on official documents.

    Phone. Enter the user's telephone number.

    Pronunciation. If the selected language is commonly represented phonetically, additional fields are displayed. Enter the phonetic representation for the user's first, last, and full names.

  9. Click OK.
The User's Preferred Language

Sometimes a user's name can be more accurately represented in characters of a language other than the default language. For example, Noriko's name is Japanese, and she has indicated on her hiring forms that she prefers that her name be represented by Japanese characters when possible. You can select Japanese as her preferred language so that her name will display in Japanese characters, even when the default language English.

To indicate a user's preferred language, follow the instructions in the section "Creating a New User""Creating a New User" beginning on page 52.


Modifying Existing Directory Entries
Before you can modify user or group data, you must first use the User and Groups Search function to locate the user or group entry in the user directory. See "Locating an Existing User or Group in the User Directory" on page 46. Then you can select operations from the menu bar to change the entry. The operations you perform apply to all in the Search list.

Editing a User's or Group's Directory Entry
To edit a directory entry:

  1. In the User and Group section of Netscape Console, use the Search function to locate the user or group.

  2. Once the user or group name appears in the Search list, click it to select it, then click Edit.

  3. Modify user or group information as necessary, then click OK.
Changing a User Password
To change a user password:

  1. In the User and Group section of Netscape Console, use the Search function to locate and highlight the user.

  2. Click Change Password.

  3. Enter password as prompted, then click OK.

    4. New Password. Enter a password string. Alphanumeric characters, spaces, and punctuation marks are all acceptable.

    Confirmed Password. Enter the password again to confirm. The changes take effect immediately.

Removing a User, Group, or Organizational Unit from the Directory
Before you can remove an organizational unit, you must first remove all users or groups belonging to it.

To delete a user, group, or organizational unit from the directory:

  1. In the User and Group section of Netscape Console, use the Search function to locate and highlight the user or group you want to delete.

  2. Click Delete, and when prompted to confirm the deletion, click OK.
Tracking User Licenses
You can track which Netscape server products your users are licensed to use. This is useful when you need to report compliance with the software licensing agreement.

To view the number of users licensed to use Netscape products:

  1. Go to Netscape Console.

  2. From the File menu, choose License Tracking.

  3. Select the servers you want to count licenses for, then click Refresh at the bottom of the dialog box.
The License Count column displays the number of licenses you have for each selected server.


Users and Groups
This is a multipurpose dialog box you can use to

Search Users, Groups, and Organizational Units for. To locate a user, group, or organizational unit in the directory, enter a unique string that can be found in its directory entry. You can enter an asterisk (*) to see all the entries currently stored in your directory.

Users and Groups Search Directory. Displays the URL of the current user directory. When you perform a search, Netscape Console locates users and groups in this directory.

Directory. Displays dialog box for changing to a different user directory.

Search. Starts searching the selected user directory for the unique string you've entered.

Advanced. Displays input fields for focusing your search criteria.

Edit. Displays forms for modifying existing user or group entries.

Delete. Deletes the selected user or group entry.

Use the drop-down list to indicate whether you're creating a new user, group, or organizational unit.

Create. Displays dialog boxes for selecting an base organizational unit and creating a new user, group, or organizational unit.


Advanced Search
This dialog box provides additional fields for focusing your search. Use the pull-down menus to first choose an attribute and then a search operator. Choices are described in the table below. In the last input field, enter a search string, and then click Search.


Change Directory
Use this dialog box to search a different user directory.

LDAP Host. Enter the fully qualified host name where the user directory is installed.

LDAP Port. Enter the port number you want to use to connect to the user directory.

SSL Enabled. Mark this checkbox if the LDAP port is SSL enabled.

BaseDN . Use the form o=airius.com to indicate where to find the user directory.

User DN. Enter the distinguished name of a user authorized to change entries in the user directory.

Password. Enter the password of the user directory administrator.


Create or Edit a User - Licenses
You can track which Netscape server products your users are licensed to use.

Select the SuiteSpot servers that you want this user to be able to use, and then click OK.

To view a comprehensive list of all servers installed in your enterprise and the number of users licensed for each server, go the Network Nodes window. From the File menu, choose License Tracking.


Change Password

New Password. Enter a password string. Alpha or numeric characters and spaces are all acceptable.

Confirmed Password. Enter the password again to confirm. The changes take effect immediately.


Create or Edit a User
Use this dialog box to enter or edit a user's information. The data you enter here will be added to or modified in the designated user directory.

First Name. Enter the user's full given name.

Last Name. Enter the user's full surname.

Full Name(s). This is equivalent to the common name (cn) in the directory and is automatically generated based on the First Name and Last Name entered above. You can edit this name as necessary.

User ID. When you enter a first and last name, the user ID is automatically generated. You can replace this user ID with one of your choosing. The user ID must be unique from all other user ID's in the directory.

Password. (Optional) Enter the user's password.

Confirm Password. Enter the user's password again to confirm it.

E-Mail. (Optional) Enter the user's email address.

Telephone. (Optional) Enter the user's telephone number.

Fax. (Optional) Enter the user's fax number.

Access Permissions Help. Provides information on setting access controls that apply to users and groups.


Access Permissions Help
To set access permissions, you must first select a server or task you want to allow or deny access to. Then you select the users or groups who are allow or denied access. See "Access to Network Resources" for detailed information.


Create or Edit a User - Account
This list displays the installed servers, components, or plug-ins that can be enabled for the selected user. Select an item in the list to enable it. Depending upon the item, additional fields for user information may display.


Create or Edit a User - Languages
Use this dialog box when a user's name and other information can be represented more accurately using characters in a language other than the default language. For example, Noriko's name is Japanese, and she has indicated on her hiring forms that she prefers that her name be represented by Japanese characters when possible. You can select Japanese as her preferred language so that her name will display in Japanese characters, even when the default language English.

Preference Languages. Use the drop-down list to select a user's preferred language.

Available Languages. Select a language from the list box when you want to enter a user's data using that language.

First Name. Enter the user's given name.

Last Name. Enter the user's surname.

Full Name(s). Enter the user's name as it should appear on official documents.

Telephone. Enter the user's telephone number.

Pronunciation. Additional fields display when the user's name can be represented phonetically in the selected language. Enter the phonetic representations for the user's first, last, and full names.


Select Organizational Unit
An organizational unit is a unique character string representing a user's or group's entry in the directory. The organizational unit you select is where the new user or group will be located in the directory.

See Also

Appendix A, "Distinguished Name Attributes and Syntax,"

Create or Edit a Group - General

Group Name. Enter a name for the group.

Description. (Optional) You can enter a description to help you identify this group.


Group Members - Static Group
You can organize users into static groups based on common attribute values such as department or country.

Add User. Displays the Search form. Use the Search form to locate and select the user you want to add to this group, and then click OK. The user is added to the group, and the change takes effect immediately.

Remove. Deletes the selected user from a group.

See Also

"Creating a New Static Group"

Group Members - Dynamic Group
Dynamic Group Members are users who are automatically grouped together based on their common attributes. Use the Internet standard query format for building dynamic groups.

Add. Displays the Building Dynamic Query form for locating users who share a common attribute value.

Remove. Deletes the selected user from the specified dynamic group.

Edit. Displays the Building Dynamic Query form for changing the query that locates dynamic group members.

See Also

"Creating a Dynamic Group"

Construct and Test LDAP URL
Use this dialog box to specify a user directory subtree and search criteria for determining the users in a dynamic group.

  1. Enter or build a new URL for the User Directory you want to search. The LDAP URL will take the form
    ldap:///o=mcom.com??sub?(department=marketing)
    If you know the URL, then enter it and skip to Step 3.
    If you want to construct a new URL, click Construct.

  2. In the Construct LDAP URL dialog box, provide search criteria, and then click OK

  3. (Optional) In the Construct and Test LDAP URL dialog box, to see a list of users and groups included in the dynamic group, click Test.
Construct LDAP URL
Use this dialog box to specify the search location and criteria for determining the users and groups in this dynamic group.

LDAP Server Host. Enter the fully qualified host name of the user directory you want to search. Example: airius.mcom.com.

Port. Enter port number for the Directory Server that contains the specified user directory.

Base DN. Enter the base DN for from which to begin the search. Example: ou=Marketing, o=Klondike Corp, c=US

Search. Indicate the user directory subtree you want to search against.

for. Indicate whether you want to search users, groups, or both.

where. Use the pull-down menus to first choose an attribute, and then a search operator. Choices are described in the table below. In the last input field, enter a search string, and then click Search.

More. Provides additional fields for specifying more attributes against which to search.


Group Members - Certificates Group
A user can be automatically included in a Group of Certificates based on the certificate attributes stored in the user's directory entry. This list displays the search criteria used to determine the users and groups that belong to certificate groups in your enterprise.

Add. Displays a dialog box for entering Certificate Group information.

Edit.

Displays a dialog box for modifying Certificate Group information..

Remove. Deletes the selected query from the list.


Certificates Group
Use this dialog box to enter the base DN for the certificate group you're creating.

Common Name. Enter the full name of the group. Example: cn=Database Administrators

Organization. Enter the name of the organization the group belongs to. Example: o=Operations Group

Mail. Enter the street address of the group's business.

Country. Enter the country code for the group's business.

Locality. Enter the city name for the group's business.

State/Province. enter the state or province name for the group's business.

Organizational Unit. Enter the name of the unit within an organization that the group belongs to. Example: ou=IS Department


Create or Edit a Group - Languages
Use this dialog box when a group's name is more accurately represented using characters of a language other than the default language.

Language. Click a language to select it.

Group Name. Enter a name for the group.

Description. (Optional) Enter a description for the group.

Pronunciation-Group Name. (Optional) When appropriate, enter the phonetic equivalent of the group name.


Create or Edit a Group - Account
This list displays the installed servers, components, or plug-ins that can be enabled for the selected group. Select an item in the list to enable it. Depending upon the item, additional fields for group information may display.


Create or Edit an Organizational Unit
Use this dialog box to enter information about a unit within an organization.

Name. Enter the name of the organizational unit.

Description. Enter a description of the organizational unit that's meaningful to you.

Phone. Enter a phone number where one can reach a contact (such as an administrative assistant) for the organizational unit.

Fax. Enter a fax number where one can reach a contact (such as an administrative assistant) for the organizational unit.

Alias. Enter another name such as a nickname or acronym that you might use in place of the name you entered above.

New organizational units are created using the organizational unit object class. The distinguished name for new organizational units is

ou=new organization, ou=parent organization, o=base organization, c=country

For example, if you create a new organization called Accounting within the organizational unit West Coast, and your Base DN is o=Ace Industry, c=US, then the new organizational unit's DN is

ou=Accounting, ou=West Coast, o=Ace Industry, c=US


Organizational Unit - Languages
Use this dialog box when an organizational unit's information is more accurately represented using characters of a language other than the default language.

Language. Click a language to select it.

Name. Enter a name for the organizational unit.

Description. (Optional) Enter a description for the organizational unit.

Phone. Enter a phone number for the organizational unit.

Fax. Enter a fax number for the organizational unit.

Alias. Enter another name, such as a nickname or acronym, that you might use in place of the name you entered above.

Pronunciation-Group Name. (Optional) When appropriate, enter the phonetic equivalent of the group name.

Pronunciation-Address. (Optional) When appropriate, enter the phonetic equivalent of the group address.


Search Users and Groups

Search. Use the pull-down menu to indicate which part of the directory you want to search.

For. Enter a unique string that can be found in a directory entry.

Where. Use the pull-down menus to first choose an attribute, and then a search operator. Choices are described in the table below. In the last input field, enter a search string, and then click Search.

Advanced. this field displays when appropriate, and provides input fields for focusing your search criteria.

More. Provides additional fields for specifying more attributes against which to search.

 

©Copyright 1999 Netscape Communications Corporation