To add the plugin, you must access the ZMI (Zope Management Interface). This allows raw access to the Zope application server and its configured objects. These steps show how to add the ActiveDirectory Multi Plugin with its default settings.
Browse to this URL:
http://
YourZenossInstallation:8080/zport/acl_users/manageChoose the ActiveDirectory Multi Plugin plugin, and then click .
Complete the form with your credentials and paths:
Table 37.2. Active Directory Multi Plugin Configuration
Name Description ID
Enter
adPlugin.Title
Enter a title, or leave blank.
LDAP Server[:port]
Specify the address of the global catalog server from the prerequisites section. It should either be the resolvable hostname or IP address of the global catalog server followed by :3268 Example: ad1.zenoss.com:3268
If using SSL, the name must be specified.
Read-only
Select this option.
Users Base DN
Use the value obtained from your AD administrator.
Group storage
Groups not stored on LDAP server.
Groups Base DN
Use the value obtained from your AD administrator.
Manager DN
Use the value obtained from your AD administrator.
Password
Use the value obtained from your AD administrator.
Click to save your changes.
The default plugin settings need some customizations.
Browse to this URL:
http://
yourzenossinstallation:8080/zport/acl_users/adPlugin/manageCheck the following boxes:
Authentication
Properties
User_Enumeration
Roles ([Select only if a default role other than Anonymous is desired.])
Role_Enumeration ([Select only if a default role other than Anonymous is desired.])
Click to save your changes.
Click tab.
Click folder.
Set the following:
Table 37.3. Active Directory Folder Customizations
Name Description User ID Attribute
Windows Login Name (sAMAccountName)RDN Attribute
Windows Login Name (sAMAccountName)Click to save your changes.
Click tab.
In the section, set the following:
Table 37.4. Active Directory Schema Item Configuration
Name Description LDAP Attribute Name
mail
Friendly Name
Email Address
Multi-valued
No
Map to Name
email
Click to save your changes.
Click to save your changes.
You can optionally control your users' roles within Zenoss by using the Active Directory groups. If you choose not to do this, you can control their access by setting their roles within the user management section of the Zenoss Web interface. If you choose to use Active Directory groups, you should use the following steps.
Browse to one of the following URLs:
Put a check in Roles and click .
Click tab.
Change the groupid_attr to:
cn.Click to save your changes.
Click tab.
Click folder.
Set the following:
Table 37.5. Active Directory Group to Role Configuration
Name Description Group storage
Groups stored on LDAP server
Group mapping
Manually map LDAP groups to Zope roles
Click to save your changes.
Click tab.
Scroll to the bottom of the page and in the mapping section:
Choose Zenoss Managers on the left and Manager on the right.
Click .
Choose Zenoss Users on the left and ZenUser on the right.
Click .
Click to save your changes.
Verify your credential information is valid from the Zenoss server by using the ldapsearch command. To install this command, use the following for RPM-based systems:
# yum -y install openldap-clients
For the appliance, use the command:
# conary update openldap-clients
as the zenoss user on the Zenoss server:
ldapsearch -LLL -x -b 'BaseDN' -D 'Bind DN' -W -H ldap://LDAP_server-name\ "sAMAccountName=*" member
