Migrate portal users with LDAP authentication and authorization configured
To enable authentication as well as authorization of portal users using AD/LDAP, the portal user's LDAP_ID present in the PTL_USER table must match with the value of the ldap.loginAttribute for the user in AD/ldap. If the values fail to match, you must update the user ID in the portal database. Also for user authorization, you must create user groups in the portal which match with at least one AD group that includes the user name.
For example: Assume Joe has joe.smith as LDAP_ID in the portal database. If ldap.loginAttribute is set to sAMAccountName on the LDAP screen and on AD/LDAP, the value of sAMAccountName must be joe.smith for the user to login successfully. If the value of sAMAccountName is other than joe.smith, you must change the LDAP_ID of the user in the PTL_USER table of the portal database to joe.smith to match the user name present in AD/LDAP.
To update the LDAP_ID in the portal database:
- Login to the NetBackup IT Analytics Portal before configuraing AD for authentication and create the required user groups with appropriate privileges. The user group name must match with that of the AD/LDAP group name. This user group is used to authorize the user once AD/LDAP is configured.
- Login to the Oracle database server of the NetBackup IT Analytics Portal.
On Linux: Login as aptare user. If you have already logged in as root, use su -aptare.
On Windows: Login using user credentials of the ORA_DBA group.
- Identify the USER_ID that corresponds to the LDAP_ID using:
select LDAP_ID, USER_ID from PTL_USER where LDAP_ID='<user_name>';
For example:
select LDAP_ID, USER_ID from PTL_USER where LDAP_ID='joe.smith';
- Update the LDAP_ID with the user ID obtained from the above step.
update PTL_USER set LDAP_ID = '<user_name>' where USER_ID = <user_ID_from_previous_step>;
For example:
update PTL_USER set LDAP_ID = 'smith.joe' where USER_ID = <user_ID_from_previous_step>;
- Repeat steps 3 and 4 for all the users having mismatch in their user IDs.
Note:
Use LDAP_ID mentioned in step 4 (above) to login to AD/LDAP. Avoid using user name aptare as aptare (user_id=100) is an internal bootstrap user required to maintain referential integrity amongst the database tables. Hence you must not change aptare or use it for external LDAP integration.