HP UX LDAP-UX Integration Software manual Appendix a Setting a Proxy User’s Access Rights

Appendix A: Setting a Proxy User’s Access Rights

When using the LDAP-UX product to integrate HP-UX accounts into Active Directory, you need to configure a proxy user to retrieve user account information. The proxy user needs to be able to read all users' and groups' posix attributes. The following explains how you can grant the proxy user required access.

If you select the “Permissions compatible with pre-Windows 2000 services” as the default permissions for user and groups when you install Active Directory, then any authenticated user will be granted with "Read All Properties" and "Read Permissions" of user and group objects. As a result, any user can read all attributes of user and group objects, therefore, any domain user can be configured as a proxy user. However, for security reasons, this may not be your best choice.

If you select the “Permissions compatible only with Windows 2000 services” as the default permissions for user and groups when you install Active Directory, authenticated users will be granted the right to read all properties of their own objects, but limited properties of other objects. As a result, a user can read posix attributes of his own user and group objects, but not other users' posix attributes. There are two options which you, as an Windows 2000 server administrator, can grant the proxy user the permission to read all user's and group's posix attributes:

1)Configure the proxy user to be a member of "Pre-Windows 2000 Compatible Access" group. By doing this, you allow the proxy user to read all properties of user and group objects. Here is how to configure it:

a)Start Active Directory Users and Computers.

b)From the domain tree, click Builtin.

c)Click "Pre-Windows 2000 Compatible Access" and choose "Properties" from the Action menu.

d)From the "Pre-Windows 2000 Compatible Access Properties" dialog box, choose the "Members" tab.

e)Click "Add", from a list of all users and groups, choose the user name which you want to configure as a proxy user, or type in the proxy user name, then click "Add" (see the screen below).

f)Click "OK" to save the configuration.

2)Delegate the posix attribute read access to the proxy user. By doing this, you allow the proxy user to read only posix attributes of user and group objects:

a)Start Active Directory Users and Computers.

24