IBM Systems Magazine, Power Systems --- IBM i digital edition, January 2009 - 45

The Directory Server is included in, and is automatically installed with, the IBM i base operating system. Directory Servers as back-end servers in our distributeddirectory example. Global Administration Group Client requests need to modify directory entries in the back-end servers, however, binding to the proxy server as the local administrator (cn=root for ITDS) gives full access to the proxy server’s configuration but only anonymous access to the directory entries. Thus, applications or administrators should use the global administration group to communicate with the proxy server using administrative credentials. Use the global administration group member in place of the local administrator (cn=root) when directory entries are modified through the proxy server. The global administration group is a way for directory administrators to delegate administrative rights in a distributed environment to the database back end. Global administrative group members are users with the same set of privileges as the administrative group with regard to access entries in the database back end and have complete access to the Directory Server back end. Figure 1 Global administrative group members have no privileges or access rights to the ITDS for i Server A configuration back end and schema data. Global administrative group members also don’t have access to the audit log. Local o=sample administrators, therefore, can use the audit cn=manager, cn=ibmpolicies log to monitor global administrative group member activity for security purposes. Part two of this article presents the detailed process to monitor the global administrative group member activity using the IBM i audit log. Creating Global Administration Group Members Use the ITDS Web Administration tool to create a user as a member of the global administration group. The aforementioned Information Center link provides detailed information. You can name a user entry (e.g., use cn=manager here) and specify the attribute objectclass as “person.” You only need to create the user once on one back-end server for a distributed directory. For our example, we’ll create it on one ITDS for i. Log on to the Web Admin tool of the ITDS for i. From the navigation area, expand the Directory management topic. Click “Add an entry.” From the Structural object class drop-down menu, select “person.” Input the necessary attributes: cn=manager for the Relative DN (distinguished name) field, cn=ibmpolicies for the Parent DN field, and a password for the userPassword field in the next attributes page. After you click “Finish,” the entr y cn=manager,cn= ibmpolicies will be successfully added. Now, add cn=manager into the global administration group by expanding cn=ibmpolicies under “Manage entries.” Select the radio button for globalGroupName=GlobalAdminGroup and from the Select action drop-down menu, select “Manage members” and click “Go.” ITDS for i Server B ITDS Server C on Linux o=sample o=sample ITDS Proxy Server DN Hash Plug-in Proxy Conﬁguration cn=manager,cn=ibmpolicies JANUARY 2009 ibmsystemsmag.com 45
http://www.ibmsystemsmag.com
IBM Systems Magazine, Power Systems --- IBM i digital edition, January 2009

Table of Contents for the Digital Edition of IBM Systems Magazine, Power Systems --- IBM i digital edition, January 2009
