Creating and Maintaining Authentication Configurations
Pre-requisites:
To configure the user authentication settings through the CentraSite Command Line Interface, you must have the CentraSite Administrator role.
The authentication in the CentraSite Registry or Repository is configured with default settings during installation. You can define additional authentication configurations, and you can change the default configuration to be one of the additional configurations.
The default authentication configuration determines the user repository that is used to authenticate users who log on to CentraSite. Initially, the default user repository is CentraSite's own user repository, which has the domain name INTERNAL. You might want to define additional configurations that define for example an LDAP user repository.
CentraSite provides a set of command tools for this purpose.
You can use these tools to perform the following tasks:
Create an authentication configuration
Modify an authentication configuration
Delete an authentication configuration
Keep the following points in mind:
If you do not require a particular authentication configuration any more, you can delete it from the list of available configurations.
You cannot remove the pre-installed domain
INTERNAL.
If you remove a configuration that is the current default configuration, the configuration is removed and the default reverts to the INTERNAL configuration.
To delete an existing authentication configuration, use the command named
remove Authentication.
Note:
When you delete an authentication configuration, CentraSite does not delete the user objects that are associated with this configuration. Thus, these users are displayed in the list of users in CentraSite Control, even though the domain to which they belong is no longer accessible to CentraSite.
Set a default authentication configuration
Keep the following points in mind:
If you have defined more than one authentication configuration, you can change the current default configuration to one of the other configurations.
The user domain of the new default configuration must include at least one user who is defined in
CentraSite with the
CentraSite Administrator role, otherwise you are prompted to enter a user who is defined as administrator in that configuration.
To set a new default authentication configuration, use the command named
set DefaultDomain.
If the user domain of the configuration that you wish to set to the default does not contain any user who is defined in
CentraSite with the
CentraSite Administrator role, a dialog appears, asking you to provide the user name and password of a domain user who has granted this role in
CentraSite.
If the user already exists in
CentraSite, but does not have the
CentraSite Administrator role, the role is granted to the user. If the user does not exist in
CentraSite, a user with the given user name is created in
CentraSite and is granted the
CentraSite Administrator role.
The dialog also allows you to specify an organization for the user, in cases where the user did not already exist in
CentraSite. The newly created
CentraSite user is assigned to this organization. If you do not specify an organization, the user is assigned to the default organization.
Users who are in the default domain can log in without having to specify the domain name, but they can specify the domain name if they wish. Users who are not in the current default domain always have to specify the domain name when logging in.
If your default authentication configuration contains only one user who has the
CentraSite Administrator role in
CentraSite, it is not possible to delete this user from
CentraSite, or to remove the
CentraSite Administrator role from the user. This is because the default configuration must always contain at least one user who is defined in
CentraSite with the
CentraSite Administrator role.
If you try to log in to a
CentraSite component (for example,
CentraSite Control) by supplying a user name and password but no domain name, the authentication mechanism assumes that you belong to the domain of the default configuration and authenticates you against this domain. If you change the default configuration as described above and subsequently try to log in to a
CentraSite component, you must supply your domain name in addition to your user name, so that the authentication mechanism knows which domain to use to check your credentials.
When you set a new default authentication configuration, you might want to change the association between
CentraSite users (that is,
CentraSite registry objects representing users) and users in the external user repository.
List the names of all defined authentication configurations
List details of a specific authentication configurations
Validate that an authentication configuration is correctly specified
Listing Names of Existing Authentication Configurations: Run the command list Authentication. The syntax is of the format: C:\SoftwareAG\CentraSite\utilities>CentraSiteCommand.cmd list Authentication
Note:
The list also indicates the default configuration.
The response to this command could be:
Executing the command : list Authentication
Successfully executed the command : list Authentication
Obtaining Details of an Authentication Configuration: To fetch the details of an existing authentication configuration, run the command get Authentication. The syntax is of the format: C:\SoftwareAG\CentraSite\utilities>CentraSiteCommand.cmd get Authentication -domain <DOMAIN>
The input parameters are:
Parameter | Description |
DOMAIN | The domain name of the user repository associated with the configuration. |
Example (all in one line):
C:\SoftwareAG\CentraSite\utilities>CentraSiteCommand.cmd get Authentication -domain LDAPDomain
The response to this command could be:
Executing the command : get Authentication
Domain Name Domain Type
--------------------------------------
LDAPDomain LDAP
Properties:
useaf: "false"
userrootdn: "ou=people,ou=gdm,o=sag"
personobjclass: "inetOrgPerson"
uidprop: "cn"
url: "ldap://daeqarh01:10389"
noPrinIsAnonymous: "false"
groupobjclass: "groupOfUniqueNames"
usecaching: "false"
applyDomain: "true"
gidprop: "cn"
createGroupProperties: "true"
alias: "LDAPDomain"
memberinfoingroups: "true"
creategroups: "true"
createUserProperties: "true"
mattr: "uniqueMember"
grouprootdn: "ou=groups,ou=gdm,o=sag"
User Mappings:
displayName: "personName:fullName"
mail: "emailAddresses:emailAddress:address"
sn: "personName:lastName"
Group Mappings:
description: "description"
Successfully executed the command : get Authentication
Setting a Default Authentication Configuration: To set the default authentication configuration in CentraSite, run the command set DefaultDomain. The syntax is of the format: C:\SoftwareAG\CentraSite\utilities>CentraSiteCommand.cmd set DefaultDomain -domain <DOMAIN>
The input parameters are:
Parameter | Description |
DOMAIN | The domain name of the user repository associated with the configuration. |
Important:
An authentication configuration containing the specified domain must already exist in CentraSite.
Note:
If you have set up multiple CentraSite instances in cluster mode, ensure that you execute the set DefaultDomain command individually in each of these CentraSite instances in the cluster.
Example (all in one line):
C:\SoftwareAG\CentraSite\utilities>CentraSiteCommand.cmd set DefaultDomain -domain LDAPdomain
The response to this command could be:
Executing the command : set DefaultDomain
Successfully executed the command : set DefaultDomain
Adding an Authentication Configuration: To add a new authentication configuration to CentraSite, run the command set Authentication. The syntax is of the format: C:\SoftwareAG\CentraSite\utilities>CentraSiteCommand.cmd set Authentication -domain <DOMAIN>
The input parameters are:
Parameter | Description |
DOMAIN | The domain name of the user repository associated with the configuration. |
When adding a LDAP configuration, the values you entered for the command parameters are evaluated against the specified LDAP server. Make sure that the corresponding LDAP server is available and running.
Example (all in one line):
C:\SoftwareAG\CentraSite\utilities>CentraSiteCommand.cmd set Authentication -domain LDAPdomain
The response to this command could be:
Executing the command : set Authentication
Successfully executed the command : set Authentication
Modifying an Authentication Configuration: To modify an existing authentication configuration, run the command set Authentication. The syntax is of the format: C:\SoftwareAG\CentraSite\utilities>CentraSiteCommand.cmd set Authentication -domain <DOMAIN>
The input parameters are:
Parameter | Description |
DOMAIN | The domain name of the user repository associated with the configuration. |
When modifying a LDAP configuration, the values you entered for the command parameters are evaluated against the specified LDAP server. Ensure that the corresponding LDAP server is available and running.
Example (all in one line):
C:\SoftwareAG\CentraSite\utilities>CentraSiteCommand.cmd set Authentication -domain LDAPdomain
The response to this command could be:
Executing the command : set Authentication
Successfully executed the command : set Authentication
Removing an Authentication Configuration: To remove an existing authentication configuration, run the command remove Authentication. The syntax is of the format: C:\SoftwareAG\CentraSite\utilities>CentraSiteCommand.cmd remove Authentication -domain <DOMAIN>
The input parameters are:
Parameter | Description |
DOMAIN | The domain name of the user repository associated with the configuration. |
Note:
Keep the following points in mind:
You cannot remove the pre-installed domain
INTERNAL.
You also cannot remove a configuration that is the current default configuration. If you want to delete such a configuration, you must first change the default configuration to another configuration.
Example (all in one line):
C:\SoftwareAG\CentraSite\utilities>CentraSiteCommand.cmd remove Authentication -domain LDAPdomain
The response to this command could be:
Executing the command : remove Authentication
Successfully executed the command : remove Authentication