ILLiad and Active Directory

1
ILLiad and Active Directory

• Active Directory is Microsoft's own proprietary
  implementation of LDAP.
• Can ILLiad authenticate against AD?
• Yes, ILLiad can authenticate against AD if
  properly configured.

2
What is a Domain?

• A Windows domain is an organizational unit that
  contains various resources.
• User Accounts
• Computer Accounts
• Groups
• Printers

3
Global Catalogue Server

• A Global Catalogue Server (GC) can be thought of
  as server that maintains a master index of all
  the resources in AD.

4
Authentication Methods

• Single Domain Authentication
• Authentication against one Windows domain.
• ILLiad authenticates against a Domain Controller.
• Multiple Domain Authentication
• Authentication against multiple Windows domains.
• ILLiad authenticates against a Global Catalogue
  Server.

5
Customization Manager
LDAP Keys
6
Single Domain Example

• Username Password are for a generic user in the
  library domain.
• LDAPBindStye Two Step
• LDAPInitialBindDN cnUsername, dclibrary,
  dcsomedomain, cnedu
• LDAPInitalBindPassword Password
• LDAPPortNo 389
• LDAPSearchFilter userprincipalnameuid_at_library.s
  omedomain.edu
• LDAPSearchPrefix cn
• LDAPSearchScope SubTree
• LDAPSearchSuffix dnsomedomain, dnedu
• LDAPSecureSSL Yes
• LDAPSecureSSLPort 636
• LDAPServerName library.somedomain.edu
• LDAPSupport Yes

7
Multiple Domain Example

• Username Password are for a generic user in the
  library domain.
• LDAPBindStye Two Step
• LDAPInitialBindDN cnUsername, cnusers,
  dclibrary, dcsomedomain, cnedu
• LDAPInitalBindPassword Password
• LDAPPortNo 3268
• LDAPSearchFilter
• ((samaccountnameuid)((descriptionONID
  User)(descriptionILLiad User)))
• LDAPSearchPrefix cn
• LDAPSearchScope SubTree
• LDAPSearchSuffix dnsomedomain, dnedu
• LDAPSecureSSL Yes
• LDAPSecureSSLPort 3269
• LDAPServerName global_catalogue.somedomain.edu
• LDAPSupport Yes

8
Active Directory User Attributes

• Label in AD Users and Computers

• LDAP provider property name

User logon name pre-Windows 2000 logon
name Account disabled? Logon Hours Logon On To
(Logon Workstations) User must change password at
next logon User cannot change password Password
never expires Store password using reversible
encryption Account expires end of (date)
userPrincipalName sAMAccountName userAccountContro
l logonHours userWorkstations pwdLastSet userAccou
ntControl userAccountControl userAccountControl ac
countExpires
9
Resources

• Active Directory Attributes
• http//www.rlmueller.net/UserAttributes.htm
• ILLiad Customization
• http//a4567.bates.edu/wiki/ILLiadCustomization
• Windows 2000 LDAP Authentication
• http//www.stbernard.com/products/docs/ip_technot
  es/ldapwin2k.pdf