Configuring Active Directory Users as ES Administrators
Copyright © 2007 Micro Focus (IP) Limited. All rights reserved.
Revision 1.2 2007-04-02.

This document guides you through the process of configuring users defined in Microsoft Active Directory (AD) as administrators for Micro Focus Enterprise Server (ES). It shows you how to grant the necessary permissions to users defined in AD (which generally means Windows users), and how to configure ES to use AD as its security manager.
The Courier New font is used for filenames and commands. Items in italics are placeholders for values you supply.
The Arial font is used for menu items that you will select and buttons you will click.
WS02 appears in red at the start of a paragraph that applies to performing the procedure using Net Express 5.0 Websync 02 (rather than Websync 03 or later). These paragraphs are also shaded, to indicate that WS03 users can skip over them. Sometimes where procedures differ for the two releases, the WS03 text starts with WS03 for clarity.
1. Prerequisites - Software
•	ADAM-ADSIEdit.msc, the Microsoft AD management console that is shipped with ADAM. You can run this from the Start menu or from the command line.
•	An NX5.0 WS03 or SX5.0 WS03 environment.
WS02 You can use an NX5.0 WS02 installation, with some changes, which are noted in individual steps below. The main difference is that you will have to use the OS ESM as well as the MLDAP ESM.
2. Prerequisites - Information
You will need to know:
•	A user account authorized to make AD schema changes (shown as AD-admin and AD-password below).
•	The user account in the domain controlled by your AD server that you will be granting ES administrative authority.
	To simplify the process we recommend that this account have a name that's no more than eight characters, ASCII, and has no spaces; and that the account's "Common name" (the name that appears in the list of users on the domain controller, in the Active Directory Users and Computers console) be the same as its "Logon name" (shown in the Account tab of the user's Properties in Users and Computers). Also, you may run into problems if this account exists both on the domain and the local computer, with the same name but with different passwords.
	This account is shown as ES-admin and ES-password below.
•	The location of the AD server (shown as servername below).
•	The DN of the AD domain (shown as domain-DN below). Normally, this will be the fully-qualified domain name of the AD host, minus the hostname, with each segment of the name listed as a separate DC element, so for example server.dept.mydom.com would use DC=dept,DC=mydom,DC=com. 
3. Prerequisites - Preparation
This procedure assumes that you have already:
•	Followed the process described in Configuring Active Directory for Enterprise Server Security (LDAP-Setup-Instructions.rtf) to configure your Active Directory schema and repository for ES LDAP-based security. You only need to complete steps 1-5 in that document; this one takes you through the necessary parts of 6 ("Final User Tasks") and 7 ("Configure ES Security").
•	Installed Net Express 5.0 WS02 or WS03, or Server Express 5.0 WS03, on at least one system.
4. Giving a User ES Administration Authority
Start ADSIEdit
The ADAM-ADSIEdit management console lets you modify objects in the AD repository. You can use other LDAP tools to make these changes—for example, you can create LDIF files and use the ldifde utility to import them, which is useful for making changes in bulk—but we'll use ADSIEdit in this example.
Run Start → All Programs → ADAM → ADAM ADSI Edit.
Connect to Active Directory
1.	In the left pane, select "ADAM ADSI Edit".
2.	Action → Connect to...
3.	Enter servername (the hostname of your AD server) for the connection name and server name. Select "Distinguished name (DN) or naming context" and enter domain-DN (something like "DC=dept,DC=mydom,DC=com"). Set the authorized user name and password to AD-admin and AD-password if you're not already logged on as that user.
Make the User an MTO System Administrator
4.	In the left pane, open your new connection and the folder inside it, then select the CN=Users folder, which contains your domain's users.
5.	In the right pane, select the user you want to modify (CN=ES-Admin).
6.	Action → Properties
7.	Widen the "Attribute" column so you can read the full name of each attribute. Scroll down to find the microfocus-MFDS-User-DefaultGroup attribute and double-click it.
8.	Set the attribute's value to SYSADM. This sets the MTO default group for the user; the SYSADM group has permission to start ES and so forth in the default ES LDAP security configuration. Click OK and close the Properties window.
Make the User an MFDS Administrator
9.	In the left pane, open the CN=Program Data folder and then the CN=Micro Focus folder. Select the CN=Enterprise Server User Groups folder.
10.	In the right pane, select the CN=#DSAdmin group.
11.	Action → Properties
12.	Find the microfocus-MFDS-Group-Member attribute and double-click it.
13.	Enter ES-admin (the logon name of your user) and Add it. This gives your user administrative rights for MFDS (if MFDS is using LDAP security). Close the dialog and the Properties window.
5. Create ES Security Managers
MFDS Security Configuration Screen
Open a browser window and connect to http://es-host:86, where es-host is the hostname of the system running NX5 or SX5.
On the left-side menu, click on Security.
LDAP Security Manager
You will need to create a security manager to get security rules from AD over LDAP, using the MLDAP ESM Module:
1.	Select the Security tab and click Add.
2.	Enter the following information:

Field Name	Contents	
Name	LDAP	
Module Name	mldap_esm	
Connection Path	servername	
Authorized ID	cn=AD-admin,cn=users,domain-DN
(eg "cn=administrator,cn=users,DC=dept,DC=mydom,DC=com")	
Password	AD-password	

3.	In the Configuration Information text box, enter the following:
[LDAP]
base=[domain DN]
user class=user
user container=CN=Users
group container=CN=Enterprise Server User Groups,CN=Micro Focus,CN=Program Data
resource container=CN=Enterprise Server Resources,CN=Micro Focus,CN=Program Data

[Verify]
mode=bind
password type=AD
4.	Add
WS02 In WS02, the [Verify] section of the configuration shown above is not supported, but the module will ignore it, so it's safe to put it in for future use when you upgrade to WS03.
Note that in a production environment you would not want to use your AD administrative ID for the security manager, since that would be a security risk. We only do that for convenience here.
In production, you would use an ID that had only the necessary permission for the repository, based on your intended use. (Basic ES security functions only need read access to the user information and the folders under cn=Micro Focus,cn=Program Data. If you want to use MFDS to administer ES groups and resources under LDAP, you have to use an account that also has write permission to the MF program data objects.)
WS02 OS Security Manager
For WS02 installations only, you will also need to create a security manager that can verify users via Windows logon, using the OS ESM Module.
This configuration is also supported in WS03 (on Windows systems only), but it is generally not necessary. See the description of the [Verify] configuration section in the documentation for the MLDAP ESM Module for more information.
1.	Select the Security tab and click Add.
2.	Enter the following information:

Field Name	Contents	
Name	Windows	
Module Name	osesm	

3.	Add
6. Set the Default ES and MFDS Security Configuration
Default ES Security Configuration
Now you will set the Default ES Security Configuration to use your new security manager(s), so you can use your ES administrative ID to perform CAS functions such as starting and stopping an ES region.
1.	Select the Default ES Security tab.
2.	Click Add to add a security manager.
3.	Add your new security manager(s):
•	WS02
1.	Select Windows and click Add.
2.	Back on the Default ES Security tab, click Add again.
3.	Select LDAP and click Add. The Default ES Security tab should now show Windows and LDAP, in that order.
•	WS03
1.	Select LDAP and click Add.
2.	The Default ES Security tab should now show LDAP.
4.	Click Apply.
MFDS Security Configuration
Next, configure MFDS to use the same security configuration. If you don't do this, you'll probably get an error trying to start ES, because the Windows user account you've configured for starting ES isn't known to the default MFDS security configuration. If you don't want to change the MFDS security configuration now, you can add that user to MFDS directly by editing the MFDS Internal Security security manager and clicking on Properties.
Here, though, we'll assume that you want to use the same security configuration for ES regions and MFDS, so we'll set that now:
5.	Return to the MFDS Security Options page if necessary, and select the MF Directory Server tab.
6.	Check the Use default ES Security Manager List checkbox.
7.	Click Apply. The MF Directory Server tab should now show the same security manager(s) as Default ES Security.
7. Verify the Security Configuration
ESDEMO Startup
Go to the command line (use a Net Express Command Prompt window on Windows) and try to start ESDEMO:
casstart /uES-admin /pES-password
where ES-admin and ES-password are the username and password of the user you edited in step 4 to grant ES administration permissions. (You can also start ESDEMO from MFDS and supply a username and password in the Use Enterprise Server credentials form, but this is easier to run again if you need to correct a typo or other problem.)
ESDEMO should start successfully. If it does not, here are some things to check:
•	ES-admin and ES-password are spelled correctly.
•	The ESDEMO console log (console.log) shows the MLDAP ESM module (and the OS ESM module, for WS02) being loaded and initialized successfully.
•	If the MLDAP ESM module fails to initialize because it can't connect to the server, check the Connection Path setting in the LDAP security manager in MFDS. Also check firewall configurations on both systems.
•	If the MLDAP ESM module cannot bind to the server, check the Authorized ID and Password settings in the LDAP security manager in MFDS.
•	If the MLDAP ESM module is logging other errors, check the text in the Configuration Information area in the LDAP security manager in MFDS, such as the DNs of the various containers. Errors here will prevent the ESM module from finding its data in AD.
•	The user's "common name" does not match the user's "logon name". A user in Active Directory has multiple names, which can be confusing. Users log on to Windows using the "logon name", which is normally a fairly short nickname (such as the user's initials). If you look at a user's properties in Active Directory, this name is shown on the Account tab.
	LDAP clients, such as the MLDAP ESM module, use a user's Distinguished Name (DN), which is formed using the user's Common Name (CN), and the Common Name is set by Windows when the user is created. By default, Windows sets the common name to the user's first name, middle initial, and last name.
	WS02 The OS ESM uses the logon name, and the MLDAP ESM uses the common name. Those names have to be the same for security to work properly.
	WS03 Since the MLDAP ESM only uses the common name, it doesn't matter if the logon name is different, but users might be confused if they can log on using their common name but not their logon name. Also, if the common name is longer than 8 characters or contains spaces, that may cause difficulties with the current version of ES. (Future ES versions will support long names better.)
	You can change a user's common name by renaming the user in Active Directory Users and Computers. After you rename the user, you can go back and reset the user's first and last name and display name (under the General tab of the Properties dialog), if you wish.
•	WS02 The local system belongs to the domain that the AD server controls, so that the OS ESM can verify your user credentials. (It's possible to do cross-domain authentication if AD trust relationships have been configured, but that's an advanced Windows networking procedure.) Open the System control panel and check the domain displayed in the Computer Name tab.
	If you are using a test AD server, you may also want to check that you have not inadvertently removed the computer from the domain by resetting your AD directory. On the AD server, open the Active Directory Users and Computers management console, expand the domain tree, and open the Computers folder. Your system should be listed there.
•	WS02 The user is only defined in the correct domain. If you have a local computer account with the same username and a different password, OS ESM will try to verify against the local account, and fail. Get rid of the local account or set the passwords to be the same.
MFDS Restricted Access
Once ESDEMO will start successfully, you can also try enabling restricted access in MFDS to validate your security configuration there. Return to your MFDS browser session and:
1.	On the left-side menu, click on Security.
2.	Select the MF Directory Server tab.
3.	Check the Restrict administration access checkbox.
4.	Click Apply.
5.	MFDS will prompt you to supply a username and password that are authorized under the existing security configuration (to authorize the change to a new security configuration). If you still have the predefined security configuration that's installed with the product, you can use schemaadmin here for the username and password.
6.	MFDS will prompt you to supply a username and password that are authorized under the new security configuration (to prevent you from locking yourself out). Enter your ES-admin user ID and its password.
7.	If this works, you'll be sent to the MFDS restricted-functionality home page. Click on Log On and try your ES-admin ID.