How To
Summary
You can configure Windows Active Directory to authenticate administrator and node passwords for the IBM Spectrum Protect server. In this configuration, Active Directory is used as a Lightweight Directory Access Protocol (LDAP) server.
Steps
For general instructions about configuring IBM Spectrum Protect to use an Active Directory database, see Authenticating users by using an Active Directory database.
This technote provides links to Microsoft® documents that might be useful during the configuration process.
Links for Configuring your LDAP Server
General Windows Server 2008
Active Directory Domain Services
http://technet.microsoft.com/en-us/library/cc770946(v=ws.10).aspx
Active Directory Certificate Services
http://technet.microsoft.com/en-us/library/cc770357(v=ws.10).aspx
General Windows Server 2003
Designing and Deploying Directory and Security Services
http://technet.microsoft.com/en-us/library/cc787010(v=ws.10).aspx
Active Directory Operations Guide
http://technet.microsoft.com/en-us/library/cc781707(v=ws.10).aspx
Designing a Public Key Infrastructure
http://technet.microsoft.com/en-us/library/cc773138(v=ws.10).aspx
Windows Server 2003 PKI Operations Guide
http://technet.microsoft.com/en-us/library/cc787594(v=ws.10).aspx
Synchronizing the IBM Spectrum Protect server and Active Directory server clocks
For Windows:
w32tm /config /update /manualpeerlist:<ntp server> /syncfromflags:MANUAL /reliable:YES
Enabling Secure Sockets Layer (SSL) and Transport Layer Security (TLS) for LDAP
- You need a signed server authentication certificate in the certificate store for Active Directory.
- The easiest way is to set up a Microsoft Certificate Services Enterprise Root certificate authority (CA) in the domain. The Domain Controller should automatically enroll and be issued a certificate. You can check the Microsoft CA type by using the following command:
certutil –cainfo - You can also create a certificate request and have it signed by any CA. For more information, see the following articles:
Get the root CA certificate used to sign the domain controller certificate from the CA
- Verify that the Domain Controller “Server Authentication” certificate was issued under "Certificates (Local Computer)" -> Personal -> Certificates.
- Verify that the “Issued by”/"Issuer" and “Issued to”/subject are the same and match the CA name.
- For Microsoft Certificate Services CAs, take one of the following actions:
- Export the root certificate from the "Certificates (Local Computer)" MMC snap-in (mmc.exe):
- Copy the certificate from C:\Windows\system32\certsrv\CertEnroll\*.crt. This file is in binary DER encoded X.509 format.
- Download from the Certificate Enrollment Web Services web interface http://<CA hostname>/certsrv/:
http://technet.microsoft.com/en-us/library/cc782732(v=ws.10).aspx
http://technet.microsoft.com/en-us/library/dd759243.aspx
http://support.microsoft.com/kb/555252
- If an internet connection to Windows Update is not available, disable automatic root certificates updates with Windows Update:
Setting TLS/SSL (Schannel) cryptographic algorithms and protocols
Creating a user, or using an existing user for the Bind DN (LDAPUSER)
- http://technet.microsoft.com/en-us/library/cc732336.aspx
- http://technet.microsoft.com/en-us/library/cc784390(v=WS.10).aspx
Considerations:
- A User or InetOrgPerson object can be used.
- You can use the dsquery user command to get the DN for SET LDAPUSER:
dsquery user -name tsmuser
Creating an Organizational Unit (OU) to be used as the subtree (Base DN) for IBM Spectrum Protect
- Containers cannot be used, as they cannot contain an OU:
http://technet.microsoft.com/en-us/library/cc771564.aspx http://technet.microsoft.com/en-us/library/cc785077(v=WS.10).aspx - Use the dsquery ou command to get a list of DNs of all the OUs that can be used as the Base DN in the LDAPURL.
Delegate control of the new OU to the LDAPUSER
- http://technet.microsoft.com/en-us/library/cc732524.aspx
- http://technet.microsoft.com/en-us/library/cc775585(v=WS.10).aspx
- http://technet.microsoft.com/en-us/library/cc785913(v=WS.10).aspx
- Select Create a custom task to delegate.
- Delegate “Full Control” of all the objects in the OU.
Active Directory password policy
The policy supports the following settings:
- Enforce password history
- Maximum password age
- Minimum password age
- Minimum password length
- Complexity requirements
- Storage of passwords by using reversible encryption
- Account lockout duration
- Account lockout threshold
- Reset account lockout
Related articles:
- http://technet.microsoft.com/en-us/library/cc781633(WS.10).aspx
- http://technet.microsoft.com/en-us/library/cc875814.aspx
- http://technet.microsoft.com/en-us/library/ee617251.aspx
Active Directory 2008 fine-grained password policy for users and groups
Previous password still works after you change passwords
Windows Active Directory users who change passwords when the "Enforce password history" policy is enabled can authenticate with the previous password for one hour. For more information, see the Microsoft site.
Troubleshooting Links and Instructions
Troubleshooting SSL/TLS or certificate issues
- http://support.microsoft.com/kb/938703
- Setting Schannel event logging level by using regedit:
http://support.microsoft.com/kb/260729
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL]
"EventLogging"=dword:00000007
7 for full logging or 3 for warnings and errors
Value Description
0x0000 Do not log
0x0001 Log error messages
0x0002 Log warnings
0x0004 Log informational and success events
7 for full logging or 3 for warnings and errors
Value Description
0x0000 Do not log
0x0001 Log error messages
0x0002 Log warnings
0x0004 Log informational and success events
Troubleshooting TLS/SSL certificate or cryptography issues
Windows Active Directory cryptoAPI/capi2 operational event logging:
- Open Event Viewer.
- In the console tree, expand Event Viewer, expand Applications and Services Logs, expand Microsoft, expand Windows, and then expand CAPI2.
- Right-click Operational, and click Enable Log.
Document Location
Worldwide
[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSEQVQ","label":"IBM Spectrum Protect"},"Component":"","Platform":[{"code":"PF033","label":"Windows"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB26","label":"Storage"}}]
Was this topic helpful?
Document Information
Modified date:
13 March 2020
UID
ibm15691674