Not able to login with users short name

When i was trying to setup the Stand-alone LDAP Registry, i was able to setup the registry but i was not able to login into WAS with Users short name. Ex. I was able to login with uid=wasadmin,cn=users,dc=webspherenotes,dc=com but not with wasadmin as user name.

So i did some investigation it seems that the value of User Filter field on "Advanced Lightweight Directory Access Protocol(LDAP) user registry settings" page was not correct the value of objectclass was ePerson. When i changed it to inetOrgPerson it worked.

I think now i understand how to figure out what value to use for both User Filter, Group Filter and DN and how to verify those values.

Basic idea is that the value of DN should be equal to the context at which you want to start executing the search Ex. In my case i am using dc=webspherenotes,dc=com as base DN and (&(uid=%v)(objectclass=inetOrgPerson)) as User filter and as group filter.

Now when i try to login into WAS with say wasadmin user, WAS will take the DN and start search at that location, it will take the user name that i used for login replace the %v in the user filter with that and search for (&(uid=wasadmin)(objectclass=inetOrgPerson)). If the search is able to return one record then the password will be verified. You can try this manually using the LDAP browser like this.



You should be able to locate the wasadmin user record like this



Similarly when WAS wants to search for the groups it will take the group filter replace %v with the group name and search for it.

WebSphere Application Server - Setting up stand-alone LDAP registry

I wanted to try setting up Stand-alone LDAP registry. So i did install both WAS ND and IBM Tivoli directory server on my VMWare, then i did setup test data in my LDAP server

After that i followed these steps to setup the Standalone LDAP user registry

• Login into the WAS Admin Console and go to Security - Security Administration, application and infrastructure. I did select enable security while installing the WAS server, so by default is configured with federated file based repository, change the value of Available realm definitions to Standalone LDAP Registry and click on Configure
  
  
  


• On the next page configure the LDAP details. In my case the LDAP server is on same machine so host name is localhost, it is listening on 389 port so thats the port name and then i used WebSphereNotesUsers.ldif for setting up LDAP data so that takes care of the Base distinguished name, Binding distinguished name, Bind Password,...
  
  
  


• Go to Advanced Lightweight Directory Access protocol and change value of User Filter to use objectclass=inetOrgPerson, that is because if you check WebSphereNotesUsers.ldif, you will notice that all the users that we are creating have inetOrgPerson as object class
  
  
  


• Save your changes, come back to main page and make sure that Standalone LDAP Registry as Available realm choice, then click on Set as current.


• Save your changes, synchronize them to nodes, stop every thing and restart it.


• Once the server is restarted you should be able to login with wasadmin/wasadmin username and password. You should also be able to see the users from LDAP in Manage Users in WAS Admin Console

WAS -Setting up stand-alone LDAP Server

I tried setting up Stand-alone LDAP Server as user registry/repository on my WAS 6.1 Server. These are the steps that i followed for that

• I did install IBM's Tivoli Directory Server in my VMWare machine


• Next step is to setup the LDAP Server, with correct data. I used the idsxcfg tool for that.


• Add dc=webspherenotes,dc=com as suffix
  
  


• Download the WebSphereNotesUsers.ldif file, it has set of users and groups that will need in order to setup the LDAP server


• Import WebSphereNotesUsers.ldif file in the LDAP server using the idsxcfg tool
  
  


• Now start your LDAP server and LDAP Web Admin tool


• Login into the LDAP server and verify data that we imported from the WebSphereNotesUser.ldif file
  
  
  

What is custom user registry

The supported registries such as LDAP, Operating system, federated repositories are good enough for most of the requirements but there could be cases where you might want to implement custom user registry either for better control or because you have some special situation.

The UserRegistry interface is used to implement both the custom registry and the federated repository options for the user account repository. The interface is helpful in situations where the current user and group information exists in some other format. The UserRegistry interface is also used for LocalOS and LDAP registries, for example, all our registries.

WebSphere Application Server V6.1 also provides a plug-in to support any registry by using the custom registry feature. With the custom registry feature, you can configure any user registry that is not made available through the security configuration panels of the WebSphere Application Server V6.1

What is user registry/repository

In case of WebSphere Application server, the information related to users and groups reside in a user registry or repository. The WAS server will use this information for authenticating users and also for authorizing users.

WAS 6.1 supports following types of registries and and repositories

• Local operating system registry


• Stand-alone Lightweight directory access protocol registry


• Stand-alone custom registry


• Federated registry

Only one user registry can be active at a time.When a user registry or repository is not configured, the local operating system registry is used by default. If your choice of user registry is not the local operating system registry, you must first configure the registry or repository, which is typically done as part of enabling security

Custom registry: On occasion, although you might use supported registries,such as LDAP, you might want to implement your own custom registry for more control or when you have special situations. In general, you can use the custom registry if the default registry support is not enough.