•”Step 1 — Configure the Management Server to Use AD or LDAP” on page 369

•”Step 2 — Restart the AppStorManager Service and Login as the Designated Admin Account” on page 376

•”Step 3 — Add Users to the Management Server” on page 377

•”Step 4 — Provide Login Information to Your Users” on page 377

Step 1 — Configure the Management Server to Use AD or LDAP

If you want to use AD/LDAP, you must modify the login-handler.xmlfile. How you modify the login-handler.xmlfile depends on whether you plan to use AD or LDAP.

To configure the management server:

•To use AD, see ”Configuring the Management Server to Use Active Directory” on page 369

•To use LDAP, see ”Configuring the Management Server to Use LDAP” on page 373

Configuring the Management Server to Use Active Directory

By default, AD allows connections with domain\username, instead of with the distinguished name (DN) used by a generic LDAP server. However, you can use the generic LDAP server setup to authenticate with AD, as described in ”Configuring the Management Server to Use LDAP” on page 373.

To specify the management server to use AD:

1.Before switching to AD authentication mode, the management server needs to be configured with a designated AD user and other AD-specific credentials. At startup, the designated AD user is mapped to the built-in Admin user and overrides it with the AD user information.

IMPORTANT: Make sure the administrator account has already been created in AD before you add it to the login-handler.xmlfile.

a.On the management server look in one of the following locations:

•Windows: %MGR_DIST%\Data\Configuration

•UNIX systems: $MGR_DIST/Data/Configuration

b.In the login-handler.xmlfile, change the value of the <AdminAccountName> tag to the name of a user account in AD, as shown in the following example:

<AdminAccountName>domain\PrimaryUser</AdminAccountName>

where PrimaryUser is the name of the user account that is designated as the primary user in AD.

For security reasons, it is recommended that the designated user not be the AD Domain Administrator

2.In the login-handler.xmlfile, comment out the section that contains com.appiq.security.server.BasicLoginhandler, which enables internal authentication mode. Only one login handler is allowed at a time.

<!--LoginHandlerClass>com.appiq.security.server.BasicLoginHandler</LoginHan dlerClass-->

370 Managing Security