Configuring NetIQ eDirectory Integration

Configuring PAM to enable Logins from NetIQ eDirectory.

PAM supports the ability to integrate with NetIQ eDirectory (formerly Novell Directory Services (NDS) or NetWare Directory Services) in order to provide login and authentication services for the application.

Configuring NetIQ eDirectory connections

To configure NetIQ eDirectory connections in PAM:

If you are using eDirectory as your only Directory Service for PAM, skip the AD Integration option during installation.

The following eDirectory integration process is performed post installation only.

1. Login to the server where PAM is deployed as an Administrator.
2. Open a command line and navigate to the folder where PAM is installed ($PAM_HOME) and issue the following command:

   1. For Windows, substitute the below placeholders with your connection information and then issue the command:

      • {ldap.name} which is used by PAM as an internal reference.
      • {ldap.server} which is your server name. For example, ldaps://host:636
      • {ldap.user} which is your ldap user. For example, cn=admin,o=org
      • {ldap.password} which is the password for your user.
      Copy

      1
      bin\PamDirectory.cmd LdapConnect web {ldap.name} {ldap.server} {ldap.user} {ldap.password}

   2. For Unix or Linux, substitute the below placeholders with your connection information and then issue the command:

      • {ldap.name} which is used by PAM as an internal reference
      • {ldap.server} which is your server name. For example, ldaps://host:636
      • {ldap.user} which is your ldap user. For example, cn=admin,o=org
      • {ldap.password} which is the password for your user.
      Copy

      1
      bin/PamDirectory.sh LdapConnect web {ldap.name} {ldap.server} {ldap.user} {ldap.password}

Please note if your password contains any of the following characters & \ < > ^ | then they must be properly escaped when executing the command by placing a ^ before each like this for ampersand ^&. Alternatively, you can issue the command using a dash – rather than the password in which case you will be prompted to enter the password during execution and in this approach, those special characters do not have to be escaped.

Copy

1
bin\PamDirectory.cmd LdapConnect web {ldap.name} {ldap.server} {ldap.user} -

Copy

1
bin/PamDirectory.sh LdapConnect web {ldap.name} {ldap.server} {ldap.user} -

 

3. If the command returns an OK response, then the connection has been made. You may add another connection following this same procedure. If the command returns a Fail response, then double check your user and password values.
4. Once all the connections have been created successfully, please restart the service by issuing the following command:

   1. For Windows:

      Copy

      1
      2
      net stop PamManagement
      net start PamManagement

   2. For Unix or Linux:

      Copy

      1
      service pammanager restart

5. NetIQ eDirectory integration is now complete.

Disabling an Existing Connection

1. Login to the server where PAM is deployed as an Administrator.
2. Open a command line and navigate to the folder where PAM is installed ($PAM_HOME) and issue the following command:

   1. For Windows, substitute your {ldap.name} which was supplied when creating the initial connection and issue:

      Copy

      1
      bin\PamDirectory.cmd LdapConnect web {ldap.name} DISABLE

   2. For Unix or Linux, substitute your {ldap.name} which was supplied when creating the initial connection and issue:

      Copy

      1
      bin/PamDirectory.sh LdapConnect web {ldap.name} DISABLE

   3. When successfully disabled, the command will return an OK response.