WAS or LDAP as an external source
3 answers
I don't get the WAS or LDAP.
If you configure WAS with LDAP and Jazz with LDAP you can use the Import users feature to import users that qualify in LDAP. Search the help for 'import' to find the help topic. There is also a Synchronize LDAP feature in repotools. Please search the help for 'Synchronize LDAP'.
I am ot sure what happens if you configure WAS with a local realm. With Tomcat the local realm is writable. Therefore you can create the users in JTS and they are created in the tomcat-users.xml.
If you configure WAS with LDAP and Jazz with LDAP you can use the Import users feature to import users that qualify in LDAP. Search the help for 'import' to find the help topic. There is also a Synchronize LDAP feature in repotools. Please search the help for 'Synchronize LDAP'.
I am ot sure what happens if you configure WAS with a local realm. With Tomcat the local realm is writable. Therefore you can create the users in JTS and they are created in the tomcat-users.xml.
Hey Sterling,
I will link the 2 questions.
LDAP is like a database, or a file. Inside LDAP there are users, userid, passwords.
In Tomcat, you have the tomcat-users.xml which also contains userid/password
So in Tomcat you can either use tomcat-users.xml or LDAP to validate the userid/password.
Once validated, Tomcat calls Jazz with the userid.
Jazz looks into its own database and verifies the same userid exists.
in WAS, you do not have a tomcat-users.xml by default. WAS provides no default place for user, userid, password
WAS allows you to connect to LDAP OR to create your own file which contains user. But you have to manually create it.
Then the same thing happens. Once the userid/password is validated, WAS calls JAZZ and passes the userid. The userid must exist in the Jazz Database
To have a userid exist in the database you can do it in 2 ways
1) you synchronize with the same LDAP server if youwant
AND/OR
2) You create the user manually in the database
Does it help ?
Comments
Only users residing in LDAP can be synchronized, all other directory types require that you create the users manually either in both places when using WAS File Based Registry or via Jazz for the tomcat-users.xml example. Keep in mind that the LDAP Adv Properties is the *only* place where synchronization takes place so only users that can be accessed via those LDAP settings will be selected by the sync and not any or all users that can login via the current configuration of the Servlet Container. Those are two distinct configurations, that normally should overlap.
One specific example that they might not, you can only synchronize from the current LDAP server configured in Jazz Adv Properties, if you have multiple LDAP servers you must change your configuration between syncs. Even if you have federated registry in WAS across them and they can all login, the sync jobs can only be pointing at one directory at a time.
-Sean
One specific example that they might not, you can only synchronize from the current LDAP server configured in Jazz Adv Properties, if you have multiple LDAP servers you must change your configuration between syncs. Even if you have federated registry in WAS across them and they can all login, the sync jobs can only be pointing at one directory at a time.
-Sean
Comments
