Filter
Top Products
APPENDIX B: UPDATING THE LDAP SCHEMA 141
Appendix B: Updating the LDAP Schema
Note: The procedures in this chapter should be attempted only by experienced users.
Returning User Group Information
Use the information in this chapter to return User Group information (and assist with
authorization) once authentication is successful.
From LDAP
When an LDAP authentication is successful, Dominion KX II determines the permissions for a
given user based on the permissions of the user’s group. Your remote LDAP server can provide
these user group names by returning an attribute named as follows:
rciusergroup attribute type: string
This may require a schema extension on your LDAP server. Consult your authentication server
administrator to enable this attribute.
In addition, the standard LDAP
memberOf is used.
From Microsoft Active Directory
Note: This should be attempted only by an experienced Active Directory administrator.
Returning user group information from Microsoft’s Active Directory for Windows 2000 Server
requires updating the LDAP schema. Refer to your Microsoft documentation for more detail.
1. Install the schema plug-in for Active Directory – refer to Microsoft Active Directory
documentation for instructions.
2. Run Active Directory Console and select Active Directory Schema.
Setting the Registry to Permit Write Operations to the
Schema
To allow a domain controller to write to the schema, you must set a registry entry that permits
schema updates.
1. Right-click the Active Directory Schema root node in the left pane of the window, and then
click Operations Master.
2. Check the checkbox before The Schema may be modified on this Domain Controller.
3. Click OK.
Creating a New Attribute
To create new attributes for the rciusergroup class:
1. Click the + symbol before Active Directory Schema in the left pane of the window.
2. Right-click Attributes in the left pane.
3. Click New, and then select Attribute. When the warning message appears, click Continue
and the Create New Attribute window appears.