Re: Configuring H_TEMS LDAP

Hi,

You can use the following setup if you want to setup TEMS LDAP 
authentication using SSL to a non trusted LDAP server.

- Have the customersrootca.cer available. The customersrootca can be the 
public key of LDAP server itself or the public key of the Root CA which 
was used to sign the LDAP server certificate.
- Create a new keystore ; $CANDLEHOME/<platform>/gs/bin/gsk7cmd -create 
-db $CANDLEHOME/keyfiles/customer.kdb -type -cms -pw Tivoli01 -stash
- Add rootca : $CANDLEHOME/<platform>/gs/bin/gsk7cmd -cert -add -db 
$CANDLEHOME/keyfiles/customer.kdb -pw Tivoli01 -type -cms -label 
Customer_root -file customersrootca.cer
- Configure the TEMS to use LDAP with SSL (for example Windows AD)

LDAP User Filter: 
(&(objectCategory=person)(objectClass=user)(sAMAccountName=%v))
LDAP base: <ldap base DN>
LDAP bind ID: <DN of windows userid>
LDAP bind pw: <password>
LDAP host: <windows AD server>
LDAP port:636
LDAP keystore file: <$CANDLEHOME/keyfiles/customer.kdb>  (Use full path, 
not $CANDLEHOME)
LDAP keystore stash: <$CANDLEHOME/keyfiles/customer.sth>
LDAP keystore label: Customer_root
LDAP keystore password: Tivoli01

Note: I have had issues with different versions of the gsk7cmd therefore I 
use the one in $CANDLEHOME/<platform>/gs/bin




Regards,
Marcel Booms
Sr. IT Specialist
Software Services for Tivoli


Phone: +31-(0)20-5134922 | Mobile: +31-(0)6-21112016
E-mail: marcel.booms-lBZW/[email protected]


J. Huizingalaan 765
Amsterdam, 1066 VH
Netherlands


IBM Nederland B.V.
Gevestigd te Amsterdam
Inschrijving Handelsregister Amsterdam Nr. 33054214



From:   Gregory Mendes <[email protected]>
To:     <[email protected]>, 
Date:   20/03/2013 18:40
Subject:        [TME10] Configuring H_TEMS LDAP
Sent by:        [email protected]



Hello All,
 
I'm trying desperately to install a CA cert into the trust store for my 
HTEMS.  I have the certification but what is the command or ikeyman key 
data base type?  JKS, JCEKS, CMS Cryptographic token, PKCS12S2 or PKCS12?
 
Regards,
 


Gregory R. Mendes
770-317-8593
_______________________________________________
TME10 mailing list
[email protected]
Unsubscribe:[email protected]



Tenzij hierboven anders aangegeven: / Unless stated otherwise above:
IBM Nederland B.V.
Gevestigd te Amsterdam
Inschrijving Handelsregister Amsterdam Nr. 33054214

_______________________________________________
TME10 mailing list
[email protected]
Unsubscribe:[email protected]