1. How To Setup LDAP Authentication for SiteScope Users
Joe Berant Senior Technical Consultant
August 23, 2013

2. Disclaimer:
This is an informal technical discussion created by HP support engineers.  If you have any questions, please be sure to call HP support pursuant to an active HP support contract.
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.
Created September 2013

3. How To Setup LDAP Authentication for SiteScope Users
Introduction:
Introduction:
In these next slides you will see how to set up and configure LDAP authentication for SiteScope. This presentation will show you how to leverage your existing LDAP or Active Directory server to authenticate requests to access the SiteScope application. The benefits of doing this is that it will allow you to use an existing Active Directory or LDAP server to handle authentication requests instead of manually having to create new accounts within SiteScope. It also allows you more security and auditing for authenticating users.

4. How To Setup LDAP Authentication for SiteScope Users
The first step in setting LDAP authentication up if you have not already done so already create a username and password for the built in SiteScope administrators account under Preferences --> User Management Preferences. You will need to log off and log back into the SiteScope UI once this is done. This is a requirement and you will be prompted to create a login and password if this steps is missed.

5. How To Setup LDAP Authentication for SiteScope Users
On the same screen under User Management Preferences where you enabled authentication for the built in SiteScope administrator account go to "Default Settings“ button at the top of the page and click on the edit selection.

6. How To Setup LDAP Authentication for SiteScope Users
On the LDAP user Management Settings page that will pop up select the "Enable LDAP Authentication" check box and fill out the fields for "LDAP Server URL", "LDAP Credentials" and "LDAP Context“
Note: LDAP authentication is in addition to the local users that may have been created in SiteScope. By enabling LDAP authentication you do not turn off local SiteScope authentication. So if you wanted to have only LDAP users able to authenticate to SiteScope you would remove all local SiteScope accounts except for the built in administrator account which is required.

7. How To Setup LDAP Authentication for SiteScope Users
After you have filled out the information for the “LDAP User Management Settings” expand the “LDAP User Management Advanced Settings” and fill out the LDAP user objectClass, LDAP user identical attribute and LDAP group objectClass. The defaults that work for most customers is user, sAMAccountName and group in that order.

8. How To Setup LDAP Authentication for SiteScope Users
If you have trouble filling out the LDAP User Management Settings there are some tools that can help out. You can use a third party tool like Softerra's LDAP browser that will allow you to get the available Base Distinguished Name or base DN for your LDAP server. This will assist you with filling out the correct information in the SiteScope fields.

9. How To Setup LDAP Authentication for SiteScope Users
In addition to showing you the correct base DN to put into the LDAP Context field and validating your connection information that you are providing. You can also use the Softerra LDAP Browser to check and make sure that the user or group that you are trying to allow access for LDAP authentication is under the base DN that you have selected.

10. How To Setup LDAP Authentication for SiteScope Users
Once you have filled out all of the fields under the "LDAP User Management Settings" sections select "OK" and then click on the "Default Settings" again but this time select the "Test" option. This will test out the connection to the LDAP server and the information you have entered.

11. How To Setup LDAP Authentication for SiteScope Users
The test will also tell you how many users are seen by SiteScope based off of the base DN in the LDAP context you had provided.

12. How To Setup LDAP Authentication for SiteScope Users
You can also see what specific users are allowed access to authenticate to SiteScope by going back to the “default settings” and click on the "Save allowed LDAP users to CSV" and specify an excel spread sheet to export the allowed users to a file to make sure that the people you want to have access are listed.

13. How To Setup LDAP Authentication for SiteScope Users
You will see that currently with the information that we have provided to SiteScope no users were saved to the CSV file and currently no one has access to authenticate to SiteScope via LDAP. This is because we have not specified who or what groups are allowed to login yet. This is done by creating User Roles.

14. How To Setup LDAP Authentication for SiteScope Users
To define a user role you will need to go back to Preferences--> User Management Preferences and click on New User Role. You need to specify a group that exists within your LDAP server. In this slide we are going to allow users from the Administrators group within LDAP to authenticate to SiteScope. Click "OK" once you are done. You need to specify the name of the group you are allowing as it is seen in your LDAP server.

15. How To Setup LDAP Authentication for SiteScope Users
Now that we have created the User Role allowing the Administrators group in LDAP to authenticate to SiteScope we can go back to the User Management settings and click on “Default settings” and then "Save allowed LDAP users to CSV". You will see in our CSV file that the users from that Administrators User Role that was defined are allowed to authenticate.

16. How To Setup LDAP Authentication for SiteScope Users
You can now log off from SiteScope and try to log into the SiteScope UI as a user from your LDAP server in the Administrators group shown in the CSV file.

17. How To Setup LDAP Authentication for SiteScope Users
If the logon attempt to SiteScope fails with the LDAP account you are providing a good first trouble shooting step would be to log back into the SiteScope UI using the built-in Administrator account and create an LDAP monitor with the account information you tried to log onto the SiteScope UI with and make sure that it is successful. This will validate the username and password and can sometimes give helpful information as to what is going on if the monitor fails.

18. How To Setup LDAP Authentication for SiteScope Users
You can also turn on debug for LDAP authentication by going to the /SiteScope/conf/core/Tools/log4j/PlainJava/ and open the log4j.properties.debug and find the “Authentication (LDAP/Security) section of the debug file and copy the highlighted section in the slide and paste it into the end of the log4j.properties files and save. You should not need to restart the SiteScope service, just log off and try to log back on as the user you were having problems with. Once the logon attempt fails open the /SiteScope/logs folder and look for the authentication.log. This should have the failed attempt and give some more information as to why the attempt had failed.

19. Thank you