What parameters do I need to set on the SLP to work with Windows Active Directory?

The minimum setup for LDAP on the SLP includes:

1. Primary host - IP address or host name of the AD server

2. At least one DNS server configured on the SLP that can resolve the LDAP/AD server's IP address

3. Search Bind DN

4. Search Bind Password

5. User Search Base DN

6. User Search Filter

7. Group Membership Attribute

8. At least one LDAP group configured on the SLP that matches an AD group

9. Authenticated users on the AD server that are members of that group

This configuration example assumes that the following is true of the AD environment:

1. IP address = 192.168.10.10

2. DNS server = 192.168.10.10

3. Domain = support.mycompany.com

4. User container = Users

5. You will use an account called "test" with a password of "testpasswd" for binds

6. Usernames that I want to authenticate to SLP = slpuser01, slpuser02, slpadmin01

7. Passwords for the above users = slpuser01passwd, slpuser02passwd, slpadmin01passwd

8. Group that the above users belong to = slpgroup

The following actions are required:

On the AD server:

1. Create the users listed above with the passwords listed above

2. Create a group called slpgroup

3. Add the above users as members of that group (except the user called test)

On the SLP (web interface):

1. Under Configuration/Network, configure the DNS server as 192.168.10.10

2. Under Configuration/LDAP

   1. Set LDAP to "Enabled"

   2. Set Primary Host to: 192.168.10.10 or the host name of the AD server

   3. Leave the port as 389 for simple binds

   4. Leave the bind type as simple

   5. Set the Search Bind DN to: cn=test,cn=Users,dc=support,dc=mycompany,dc=com

   6. Set the Search Bind Password to: testpasswd

   7. Set the User Search Base DN to: dc=support,dc=mycompany,dc=com

   8. Set the User Search Filter to: (samaccountname=%s)

   9. Set the Group Membership Attribute to: memberof

   10. Leave the Group Membership Value Type as: DN

   11. Leave the Authentication Order as: Remote->Local (at least until you confirm LDAP functions)

3. Click on the LDAP Groups link

   1. Type in the group name: slpgroup

   2. Click on Apply

   3. Edit access rights for Outlets, Groups (outlet groups, not LDAP groups), and Ports by clicking on each link

   4. Edit Environmental Monitor access and User Access level by clicking on the Edit link

You should now be able to log into the SLP using one of the group member accounts. You will be given rights defined by the LDAP group configured on the SLP.

[Originally Published On: 08/19/2009 11:57 AM]