Case Requirement A client has an EnterpriseLink application and wishes to utilize their Linux LDAP server to validate Users against, then use the EnterpriseLink feature of pooled logons to the mainframe. This will provide a single verification point using the Linux OpenLDAP, then an automatic logon via EnterpriseLink to the mainframe application once validated. The Solution The diagram below shows how the EnterpriseLink Server can connect with the Linux OpenLDAP service through Microsoft Active Directory Server for validation. Once this has been achieved and the user is validated, EnterpriseLink can then get an ID from the user pool database to logon to the Mainframe. Also shown below is an example, using a Student ID, of passing an extra variable from the LDAP info to EnterpriseLink. LDAP Authentication and Student ID Variable passing Installing an Active Directory Server to Talk with the Linux OpenLDAP Server Window 2000 Server comes complete with an Active Directory Server that can be configured to use an external LDAP server. The process to start this installation is shown below. NOTE: A Systems Administrator must be present since installing this on a machine connected to a Network means it can actually take over as the Primary domain control, thus disabling the entire Network. 1. Start Programs 2. Go to Settings 3. Go to Control Panel 4. 5. Select Administrative Tools 6. Configure Your Server 7. Go to Active Directory (3rd Link on left panel) 8. Start Active Directory Wizard Set the Microsoft Active Directory to authenticate using an External LDAP server, i.e., the OpenLDAP on the Linux box. Page 1 of 6
Once this has been installed and configured all authentication will be done by the OpenLDAP server on the Linux box. OpenLDAP The OpenLDAP may be downloaded from openldap.org for free (since it is part of opensource organization) and installed either on a Linux or a UNIX system. Setting up a User Pool on EnterpriseLink for Pooled Logons to the Mainframe User Pooling Setup within EnterpriseLink - there is an example in the default database when the product is installed. This may be found in the TimeCard auto Logon app. 1. Open the EnterpriseLink default website and click Administrative Site. 2. Click Projects, then in the project list click EDIT on the project you wish to add user pooling. 3. The screen below will appear, in the Security Mapping selectlist choose 'Web User to Host Logon Mapping & Host Logon ID Pooling.' This will add user pooling to the application. Page 2 of 6
4. Open the EnterpriseLink Builder and the desired Project. 5. A New Folder appears called Certificate Features. Open this folder and click on Certificate Fields. The blue popup Certificates Fields window will open as shown. 6. Open the web page where the Mainframe expects the Username and Password to be entered. Drag the Username from the Blue window above on to the Username on the web page to make the association. Do the same for the Password field from the blue screen. 7. Save and Close Builder. 8. Setup the user pool database as described below. Configuration of a User Pool Database for EnterpriseLink Applications Once the OpenLDAP Linux server has authenticated the user, the Active Directory Server has the green light. This activates the IIS web server to initiate the Enterpriselink application. The application references the Logon page and goes to the User Pool for a UserID and Pwd to connect to the Mainframe. A username and password database must be populated by an Administrator. Setting up username and password database for the Mainframe Pool of users 1. Go to Remote admin in the Default EnterprsieLink web page and click on Security Mapping Here you will see the ability to Add Delete Update and View all the entries of the User Pool. Page 3 of 6
2. Add each user to the User Pool database via the webpage pictured below. NOTE: This could be done via a command line or export the list from the mainframe with a written script to populate each entry. Once this has been done the process is complete. Through this page, users may also be viewed and updated. Page 4 of 6
3. View all User Pool entries - each user entered may be viewed via this webpage interface. Passing an extra variable from the LDAP server to EnterpriseLink In this case study, an extra field/variable from the LDAP server was required. The Username and Password, as we have already seen, are passed via the Active Directory Server using the security features of each. In order to pass the extra variable - the example used is a StudentID, another way had to be selected. This can be achieved in two ways. 1. Using Python to interact with the OpenLDAP API A Python script could be written that will access the OpenLDAP's API. This requires Page 5 of 6
knowledge of the API code and the ability to write Python to interact with it. The Python code will access the OpenLDAP API, read the Student ID and pass this to the EnterpriseLink web page via Python Variable substitution. 2. Using the new feature of EnterpriseLink 4.0 to pass name and value pairs This feature of EnterpriseLink v4.0 allows extra CGI parameters to be passed on the URL in Name and Value pairs, i.e., 'StudentID' is the Name and 'mark' is the Value. For example, 'http://localhost/stscripts/run.stn/timecard/nmlogon?studentid=mark' More name value pairs can be added simply by placing & between them. For example,. 'http://localhost/stscripts/run.stn/hollis/nlogon?studentid=mark&quest=yes' Again the diagram below shows the two solutions - this was cut form the main diagram. 3. Once the Student ID number is retrieved, it can then be placed into a field on the Enterpriselink Logon web page and submitted to the Mainframe. The mainframe app will use the value sent and be able to return records based upon this ID number, thus giving the user a point of authentication and the return of their personalized information. Glossary of Terms LDAP (Lightweight Directory Access Protocol) http://ask.yahoo.com/ask/20000414.html LDAP lets you "locate organizations, individuals, and other resources such as files and devices in a network, whether on the Internet or on a corporate intranet," and whether or not you know the domain name, IP address, or geographic whereabouts. An LDAP directory can be distributed among many servers on a network, then replicated and synchronized regularly. An LDAP server is also known as a Directory System Agent (DSA). Thus in the School Board case they are using LDAP to verify Username/Pwds. Open Source http://www.opensource.org/ Open source is, basically, volunteer Programmers working together over the Internet to create free software., Organized teams are able to improve software and maintain and fix bugs quickly. Examples of open source projects are Linux, Python, etc. ( Netscape also released the source code for the Netscape Browser about two years ago.) The School Board is using the LDAP server from openldap.org which is just another site dedicated to creating free software. Active Directory Server http://www.microsoft.com/windows2000/technologies/directory/ad/default.asp Active Directory is an essential component of the Windows 2000 architecture. It presents organizations with a directory service designed for distributed computing environments. Active Directory allows organizations to centrally manage and share information on network resources and users while acting as the central authority for network security. In addition to providing comprehensive directory services to a Windows environment, Active Directory is designed to be a consolidation point for isolating, migrating, centrally managing and reducing the number of directories that companies require.api (Application Programmers Interface)http://www.webopedia.com/TERM/A/API.htmlAn API enables the functionality of one product to integrate and interact seamlessly with the functionality of another product. It provides Programmers with a common interface between two or more applications. Page 6 of 6