Configuring Realms for Authentication using an External Server

From the navigation tree, click Local Realms.

On the Local Realms screen, click New Local Realm to open the Local Realm Attributes screen.

In the Name field, enter the name of the realm for which the user profiles are stored in a database and accessed using the SQL Access feature.

The name does not have to be a DNS host name. However, HP recommends that you set the realm name to correspond with the domain name. This enables the user@realm syntax to resemble the e-mail address for all the users in the domain.

In the User Profile Storage field, select Database Access via SQL.

The user storage parameters for Database Access via SQL are displayed as shown in.

Figure 8-4 User Storage Parameters for Database Access via SQL

In the User Storage Parameters Field, select one of the following options:

	IMPORTANT: Ensure that the appropriate SQL action is selected from the drop-down list. Selecting an incorrect SQL action can result in an authentication failure or unintentional changes to the database records.

Complete any remaining optional fields as necessary for your configuration.

Click Create. If the realm is successfully created, the Local Realms screen will list the new realm.

From the navigation tree, click Save Configuration

If you have multiple remote servers, you will be prompted to select and confirm the servers where the realm configuration will be applied.

From the navigation tree, click Local Realms.

On the Local Realms screen, click New Local Realm to open the Local Realm Attributes screen.

In the Name field, enter the name of the realm to map to the defined LDAP location. This name does not have to be a DNS host name. However HP recommends that the realm name corresponds with the domain name. This way, the user recognizes the user@realm syntax which resembles their e-mail address.

In the User Authentication Field, select the authentication methods to authenticate users for the realm. If you are using TTLS-PAP, TTLS-MSCHAP, or TTLS-CHAP, select Enable RADIUS Standard. For all other methods, select Enable EAP and choose at least one EAP method from the drop-down list.

In the User Profile Storage field, select LDAP.

The user storage parameters for LDAP appear when you select LDAP from the User Profile Storage drop-down list. These parameters identify a section of the directory tree on one or more LDAP servers where the HP-UX AAA software will attempt to retrieve user profiles.

In the User Storage Parameters Field, select New LDAP Directory or the name of an existing LDAP Directory.

In the LDAP screen that appears, configure the LDAP directory using the information described in Table 8-3.

Table 8-3 Values for Configuring Realms for LDAP

Value	Description
Directory Name	Start of a directory configuration. Give a name to the directory, which can be an arbitrary string. If the name contains spaces or tabs, the string must be enclosed in single or double quotes.
Host	Name of the host on which the LDAP directory server runs. The value must be a fully qualified DNS name, although an IP address also works. Both traditional IP (IPv4) and IPv6 address formats are supported. The HP-UX AAA Server can resolve DNS name format entries to IPv4 and IPv6 addresses. Enter an IPv4 address in dotted-quad notation. Enter an IPv6 address in IPv6 Literal format notation. For example: IPv4 address — 192.0.2.0 IPv6 address — fedc:ba98:7654:3210:fedc:ba98:7654:3210
Port (Optional)	Port number on which the directory server is running. Default value is 389.
Use SSL	Enables or disables SSL connections between the HP-UX AAA Server and the LDAP directory. If you are enabling SSL, you must specify the server's CA certificate path or fully qualified file name in the Server Properties -> ProLDAP Properties window.
Administrator	Special user ID used when an authenticated search is allowed on the LDAP directory server. This administrator does not need to be a real administrator of the LDAP directory server, but must have read access to all the users (and their passwords). Intended to be authenticated by the AAA server.
Password	Password for Administrator to bind (authenticate) itself to the LDAP directory server.
Search Base	Pointer into the directory where the search for users in a realm starts. Specifying a search base improves server performance by limiting the scope of search operations on user information for a particular realm. A search base contains a list of A-V pairs that trace a path from a location in the directory's schema to the top of the directory. For example, a search base of o=hp, c=US represents a search for one of the users on the following tree: c=US ____________|_______ | o=hp ____________|____________________ | | | | uid=Joe uid=Bob uid=Dawn uid=Maria The A-V pairs used depend on the schema of your particular directory server. NOTE: It is more efficient to start your search lower in the directory structure rather than higher. HP recommends that you eliminate spaces between Search Base components (i.e., instead of ou=abc,o=cde, c=us, use ou=abc,o=cde,c=us).
Filter	Filter flag allows authentication to be based either on the LDAP uid attribute, which normally is CIS, or on the AAA Server User-Id attribute, which is normally BIN. User-Id is a AAA Server-specific RADIUS attribute. This optional flag defaults to uid. IMPORTANT: With multiple LDAP directory servers, the Filter used for lookups must be consistent across all directories specified for a particular realm. Potential filters are uid, User-Id or some other key that uniquely identifies a subject to be authenticated on the system. Currently, the LDAP module does not enforce the use of consistent filters, but using inconsistent filters may produce unpredictable authentication failures.
Authentication Type	AUTO performs a search as the configured Administrator (searches anonymously if no administrator is configured), anticipating the password is in the result. It binds as the user if the password is not available. This mode makes the AAA server flexible in accommodating LDAP directories. If directories are configured to return passwords with search, AUTO is equivalent to SEARCH. BIND binds as the user for authentication. SEARCH performs a search as the configured Administrator and expects the user's password in the search result.

In the LDAP screen, click Save.

Repeat steps 6 and 7 for each redundant directory you wish to use for failover.

Complete any remaining optional fields as necessary for your configuration.

Click Create.

From the navigation tree, click Save Configuration

If you have multiple remote servers you will be prompted to select and confirm which servers you wish to add the entry to.

From the navigation tree, click Local Realms.

In the Local Realms screen that appears, click the New Local Realm link. The Realm Attributes screen appears.

In the Name field, enter the name of the realm to map to the defined SecurID location.

From the Realm Type drop-down list, select Authentication.

From the User Storage Parameters field, select SecurID/ACE server.

The Password Authentication option is preselected because only PAP authentication is supported with the SecurID authentication type.

Complete any of the remaining optional fields as necessary for your configuration.

Click Create.

Repeat these steps as many times as necessary for your configuration.

From the navigation tree, click Save Configuration.

	CAUTION: Save Configuration will save the entire server configuration (access devices, proxies, local realms, users, and server properties) to the servers you specify.