Setting up LDAPS on a Master
Table of Contents
Setting up LDAPS on a Master:
Introduction
There are several things to take into consideration when setting up a secure LDAP connection between a master and your user authentication system. This document will discuss those considerations, but we will not be going into the specifics of the LDAP configuration itself. Please see the other Technical Support guide for setting up the LDAP configuration itself.
LDAP Certificate:
Before starting the configuration process, you will need to obtain a certificate for the LDAP server. The certificate needs to be from a CA trusted by both the master and the LDAP server. The certificate must be in a .pem format.
Additionally, it is important to take note of the hostname and domain contained in the certificate. It may not necessarily match the exact hostname of the LDAP server, but the hostname on the certificate must be the name it checks against. The important thing is that this information will be provided by the local IT department, and it is not something you will be able to change after the fact.
IP Configuration:
If your master receives its IP address via DHCP on the same network as your LDAP server these things shouldn't be an issue, but you may want to check them all the same.
The first thing to check are your DNS entries on the master, when using a secure LDAP connection you cannot connect via IP address, you must use the hostname of the server. Without proper DNS entries you can't connect to the LDAP server. Depending on the network/settings, one way you can test this is to Telnet to the master and try to ping the hostname of the server. This may not always work if the network/server do not allow ping communication, so it is not an end all be all test.
The next thing to check in the master configuration is the Domain name. The domain name must be the same as the domain name in the fully qualified domain name of the LDAP server.
Configuration Steps:
The following steps will complete the configuration for LDAPS:
- Setup IP information on the master, and allow the master to reboot.
- Connect to the master with Netlinx Studio.
- Click on Tools -> Certificate Manager.
- Click the Certificate Transfers tab.
- Choose Trusted CA under Certificate Type.
- Send the certificate provided for the LDAP server, and allow the master to reboot.
- Enter in the proper LDAP configuration to the master.
At this point the master should be able to connect to the LDAP server.