CardAccess 3000 LDAP Configuration Guide

Transcription

1 CardAccess 3000 LDAP Configuration Guide DATE: 7 AUGUST 2013 DOCUMENT PERTAINS TO : CARDACCESS 3000 LDAP CONFIGUR A- TION GUIDE REVISION: A Continental 2013 CardAccess 3000 LDAP Configuration 1

2 DISCLAIMER Continental Instruments LLC makes no representations or warranties with respect to the contents hereof and specifically disclaims any implied warranties of merchantability or fitness for any particular purpose. Further, Continental Instruments LLC reserves the right to revise this publication and to make changes from time to time in the content hereof without obligation of Continental Instruments LLC to notify any person of such revision or changes. Copyright 2013 by Continental Instruments LLC. All rights reserved. No part of this publication may be reproduced, transmitted, transcribed, or stored in a retrieval system, without the prior written permission of Continental Instruments LLC, 355 Bayview Avenue, Amityville, NY Telephone: FAX: GSA# GS-07F-0039H. This document contains proprietary information of NAPCO Security Technologies. Unauthorized reproduction of any portion of this manual without the written authorization of NAPCO Security Technologies is prohibited. The information in this manual is for informational purposes only. It is subject to change without notice. Companies, names and data used in examples herein are fictitious unless otherwise noted. NAPCO Security Technologies assumes no responsibility for incorrect information this manual may contain. A NAPCO SECURITY TECHNOLOGIES COMPANY Publicly traded on NASDAQ Symbol: NSSC Visit our websites at CardAccess 3000 LDAP Configuration 2

3 Table of Contents Overview... 4 Configuring LDAP... 5 CardAccess 3000 LDAP Configuration 3

4 Overview OVERVIEW This document provides an overview of configuring LDAP in the CardAccess 3000 V2.9.x software. LDAP provides the ability for a single sign-on to Windows and the CardAccess 3000 software. It does not provide the ability to import personnel records from an Active Directory Database. There are two modes associated with LDAP. They are AD Authentication and AD Authorization. CardAccess 3000 LDAP Configuration 4

5 Configuring LDAP Configuring LDAP (Lightweight Directory Access Protocol) Figure 1. 1) The Active Directory settings are located in the System Settings screen of Card Access Click System>System Settings>General (refer to Figure 1). CardAccess 3000 LDAP Configuration 5

6 Configuring LDAP (Con t.) Verify the LDAP Path Figure 2. 2) You must enter the Network path of the Active Directory computer. After entering the path, click Verify Path. This will verify the Network Path for LDAP. Verify there are no errors and a dialog box displays The LDAP path has been confirmed (refer to figure 2). 3) Click OK. CardAccess 3000 LDAP Configuration 6

7 Configuring LDAP (Con t.) Active Directory Authentication - (LDAP logon) NOTE: REFER TO THE FOLLOWING EXAMPLE FOR CONFIGURING THE AD AUTHENTICATION MODE. Figure 3. 4) Select only the Use AD Authentication checkbox (Refer to figure 3). CardAccess 3000 LDAP Configuration 7

8 Active Directory Authentication Con t. Configuring LDAP (Con t.) 5) For the AD Authentication Mode, the current logged on Windows user MUST exist in the CardAccess 3000 operator definitions (refer to figure 4). Figure 4. 6) For this example, the current logged on Windows user is aanderson. The user aanderson must manually be added to the CardAccess 3000 Operators screen (Refer to figure 4). Note : If you do not know the name of the current Windows logged on user, you can use the WHOAMI command using the command prompt (Refer to figure 5). If the WHOAMI command is not supported by the operating system, you can click CTL ALT DEL, and the logon information screen will display. Figure 5. CardAccess 3000 LDAP Configuration 8

9 Active Directory Authentication Con t Configuring LDAP (Con t.) Launching CardAccess ) Launch the CardAccess 3000 software. The CardAccess 3000 login screen should not display, and the CardAccess 3000 software should log in automatically. Note : This mode will verify that the current logged in Windows user (aanderson), is in the Active Directory Database and also in the CardAccess 3000 Operators definitions. CardAccess 3000 LDAP Configuration 9

10 Active Directory Authorization Configuring LDAP (Con t.) NOTE: REFER TO THE FOLLOWING EXAMPLE FOR CONFIGURING THE AD AUTHORIZATION MODE. Figure 6. 8) Select the Use AD Authentication and Use AD Authorization check boxes Verify both checkmarks are selected (Refer to figure 6).. CardAccess 3000 LDAP Configuration 10

11 Active Directory Authorization (Con t) Configuring LDAP (Con t.) 9) For AD Authorization, the Active Directory Group which the user belongs to must be added to CardAccess 3000 Operator Privileges definitions. For this example, the current Windows user belongs to the CA3000 Operators group in Active Directory (refer to figure 7). Figure 7. CardAccess 3000 LDAP Configuration 11

12 Active Directory Authorization Configuring LDAP (Con t.) 10) When a user runs CardAccess 3000 for the first time, and there is no Operator record found, then one will be created (with the default settings). The screen name will become the users Window s Logon name. The operator name on the Operators screen will be Auto Assign. The Operators screen may be edited, but there will be no password assigned. In the Operator screen below, aanderson was Auto Assigned (refer to figure 8). Figure 8. Launching CardAccess ) Launch the CardAccess 3000 software. The CardAccess 3000 login screen should not display, and the CardAccess 3000 software should log in automatically. Note : This mode will verify that there is a match of a Privilege Name in the CardAccess3000 Operator Privileges screen with a group name assigned in the users Active Directory database. Once this is confirmed, the CardAccess 3000 will automatically log in. CardAccess 3000 LDAP Configuration 12

13 Configuring LDAP (Con t.) CardAccess 3000 GUI LogOn /LogOut options Figure 9. 12) With LDAP enabled, there is no LogOn or Logout option. The Logout is replaced with Shutdown (refer to figure 9). 13) If a Shutdown is performed under these circumstances, HostNT continues to run when the GUI application is shut down. Also, if Auto-Logoff timeout occurs, the CardAccess 3000 GUI will shut down. CardAccess 3000 LDAP Configuration 13

14 Configuring LDAP (Con t.) Resetting The Active Directory Settings Very Important: Improper configuration of the LDAP settings might cause a user to get locked out of the CardAccess 3000 software. If this occurs, it will require resetting the Active Directory settings in the CardAccess 3000 Database utilities. 14) If the Active Directory settings need to be reset, open up the CardAccess 3000 Database Utilities. Click Reset AD Settings (Refer to figure 10). Figure ) A dialog box will display Do you want to reset Active Directory settings for all workstations?. Click Yes (Refer to figure 10). CardAccess 3000 LDAP Configuration 14