HP 3PAR StoreServ 7200 2-node Administrator's Manual page 31

The example above corresponds to
joadmin is the user name of the NT Windows domain (NTDOM1) administrator searching for
group information for user 3PARuser (cn=3PARuser).
dn: CN=3PAR User,OU=Engineering,OU=Users,DC=3par,DC=com displays user
locations in the LDAP server directory information tree.
system1 cli% setauthparam -f accounts-dn OU=Users,DC=3par,DC=com
system1 cli% setauthparam -f account-obj user
system1 cli% setauthparam -f account-name-attr sAMAccountName
system1 cli% setauthparam -f memberof-attr memberOf
The example above corresponds to
on the group information gathered from running the ldapsearch command:
The Users group within the 3par group is set as the basis for any user search when
authenticating with the LDAP server.
The values user,SAMAccountName, and memberOf for the account-obj,
account-name-attr, and memberof-attr parameters are typical of Active Directory
configurations.
system1 cli% checkpassword 3PARuser
password:
+ attempting authentication and authorization using system-local data
+ authentication denied: unknown username
+ attempting authentication and authorization using LDAP
+ using Kerberos configuration file:
[domain_realm]
[realms]
+ temporarily setting name-to-address mapping: domaincontroller.3par.com ->
192.168.10.13
+ attempting to obtain credentials for 3PARuser@NTDOM1.3PAR.COM
+ connecting to LDAP server using URI: ldap://192.168.10.13
+ binding to user 3PARuser with SASL mechanism GSSAPI
+ searching LDAP using:
search base:
filter:
for attribute: memberOf
+ search result DN: CN=3PARuser,OU=Engineering,OU=Users,DC=3par,DC=com
+ search result:
+ search result:
+ search result:
+ authorization denied: no user groups match mapping rules
user 3PARuser is not authenticated or not authorized
The example above corresponds to
following hierarchy of groups:
◦
Engineering
◦
Software
Step 1, and displays the following:
Step 2 through
domaincontroller.3par.com = NTDOM1.3PAR.COM
NTDOM1.3PAR.COM = {
kdc = 192.168.10.13
}
OU=Users,DC=3par,DC=com
(&(objectClass=user)(sAMAccountName=3PARuser))
memberOf: CN=Software,CN=Users,DC=3par,DC=com
memberOf: CN=Eng,CN=Users,DC=3par,DC=com
memberOf: CN=Golfers,CN=Users,DC=3par,DC=com
Step 6, and displays that 3PARuser is a member of the
Step 5. The following can be surmised based
Configuring LDAP Connections 31