Colleagues, good evening.
Today we want to share with you the case from our professional practice.
Our user encountered a problem when configuring LDAP for MM910 on the E9000 chassis.
[Description of the problem]
The initiator of the application wanted to configure LDAP for HMM (Hyper Management Module). He has already configured LDAP in iBMC for blade servers using his configuration, but when trying to apply it to HMM I encountered a mistake.
According to the instructions, the user needs to log in to System Management > Account Management > LDAP.
Next enable LDAP, do not use the certificate, use the LDAPS protocol, then specify the port and IP address of DC.In the "User Domain" field, specify CN=users, and two settings DC - DC=orgname and DC=ru. The settings were successfully applied.
Next, when adding role in the LDAP group, an error occurred, which is indicated invalid parameter value
(CN = ORG_ADM, OR = ..., OR = ..., DC = orgname, DC = ru)- data has been changed to preserve the confidentiality of user data.
The user asked us to help solve this problem.
[ Analysis Problems]
We asked the initiator of the application to view the user and group properties, as well as to take screenshots. Our task was to define the path to the containers of users and groups respectively.
From the data received from the user, we found that the path contains Cyrillic letters, not only Latin but also gaps in the path to the containers.
Provided path (changed to preserve data confidentiality):
CN= SrvAdmins, OU=IT_Admins, OU=Admins Accounts, OU=New Vasuki, OU=OUname, DC=SOMEorg, DC=en.
To determine the location of the problem, you need to know exactly the location of objects in the AD server (Active Directory), in AD only "built-in" folders can act as CN (Common Name), created folders can only be OU ( Organization Unit). In our example, it is clear that SrvAdmins should be a group and the container should be IT_Admins.
AD Path
The structure should look like this:
Since the first image has been edited, you do not see that the group name does not match the group name of the CN segment. It shouldn't be like this.
In principle, CN - ORG_ADM, can be deleted.
Another important point: the date, time and time zone should be the same on the LDAP server and in iBMC\HMM and should be the same as the current ones.If this condition is not fulfilled, LDAP authentication will not work.
[Solution]
An algorithm for further action was developed for the initiator of the break:
1. Remove the Russian letters, spaces from the AD path.
2. Correct the path to AD according to the recommendations provided above.
3. Display the correct date \ time in HMM and on the LDAP server.
HMM and iBMC blade servers have different mechanisms to work with LDAP, which explains why the same configuration is not suitable for HMM.
Reference to the instruction on how to work with LDAP:
https://support.huawei.com/enterprise/en/doc/EDOC1000015900/50fd510b/optional-configuring-ldap
After the user has followed all our recommendations, LDAP in HMM started working properly.
Thank you.
