KACE Systems Management Appliance 14.1 Common Documents - Administration Guide

Import user information manually

Import user information manually

You can import user information manually by specifying criteria to identify the users you want to import.

NOTE: Use the LDAP Browser to specify the Search Base DN and Search Filter. See Use the LDAP Browser.

Option	Description
Server	The IP address or the hostname of the LDAP server. If the IP address is not valid, the appliance waits to timeout, resulting in login delays during LDAP authentication.   NOTE: To connect through SSL, use an IP address or hostname. For example: ldaps://hostname.
Port	The LDAP port number, which is usually 389 (LDAP) or 636 (secure LDAP).
Base DN	The criteria used to search for accounts. This criteria specifies a location or container in the LDAP or Active Directory structure, and the criteria should include all the users that you want to authenticate. Enter the most specific combination of OUs, DCs, or CNs that match your criteria, ranging from left (most specific) to right (most general). For example, this path leads to the container with users that you need to authenticate: OU=end_users,DC=company,DC=com.   NOTE: Use the LDAP Browser to specify the Search Base DN and Search Filter. Use the LDAP Browser.
Advanced Search	The search filter. For example: (&(sAMAccountName=KBOX_USERNAME)(memberOf=CN=financial,DC=example,DC=com))
Login	The credentials of the account the appliance uses to log in to the LDAP server to read accounts. For example: LDAP Login:CN=service_account,CN=Users, DC=company,DC=com. If user name and password are not provided, the tree lookup is not performed. Each LDAP Label can connect to a different LDAP or Active Directory server.
Password	The password of the account the appliance uses to log in to the LDAP server.

Option	Description
Attributes to retrieve	Specify the LDAP attributes to retrieve. For example: sAMAccountName, objectguid, mail, memberof, displayname, sn, cn, userPrincipalName, name, description, manager The LDAP attributes specified in this field can be mapped to appliance User attributes on the next page. If this field is blank, the appliance retrieves all LDAP attributes. Leaving this field blank increases the time required to import attributes and is not recommended.   IMPORTANT: To retrieve the manager object associated with the user, you must add the manager attribute to the list, and to specify this mapping in a later step.
Label Attribute	Enter a label attribute. For example: memberof. This setting returns a list of groups this user is a member of. The union of all the label attributes forms the list of labels you can import. If the search filter contains both the label names and user names, the label attribute is not required.
Label Prefix	Enter the label prefix. For example: ldap_ The label prefix is a string that is added to the beginning of all the labels.
Binary Attributes	Enter the binary attributes. For example: objectsid. Binary attributes indicates which attributes should be treated as binary for purposes of storage.
Maximum Number of Rows	Enter the maximum number of rows to retrieve. This limits the result set that is returned in the next step.
Debug Output	Select the check box to view the debug output.

Option	Description
Ldap Uid	The identifier for the user. Recommended value: objectguid.
User Name	The name of the user. Recommended value: name.
Email	The email address for the user. Recommended value: mail.
Manager	The manager of the user. This mapping is mandatory only if you want to retrieve the manager information. Recommended value: manager.   IMPORTANT: To retrieve the manager object associated with the user, you must also add the manager attribute to the Attributes to retrieve box.

The Users page appears, and the imported users appear on the list. The imported users can access the features of the Administrator Console, User Console based on the role to which they are assigned.

Import user information according to a schedule

Import user information according to a schedule

To keep user data current, schedule regular user data imports from your LDAP server.

2.	Select LDAP Authentication, then click the Schedule button next to the server name in the list of servers to schedule a user import:

The following Read Only Administrator Server Details are displayed:

Option	Description
Server	The IP address or the hostname of the LDAP server. If the IP address is not valid, the appliance waits to timeout, resulting in login delays during LDAP authentication.   NOTE: To connect through SSL, use an IP address or hostname. For example: ldaps://hostname.
Port	The LDAP port number, which is usually 389 (LDAP) or 636 (secure LDAP).
Base DN	The criteria used to search for accounts. This criteria specifies a location or container in the LDAP or Active Directory structure, and the criteria should include all the users that you want to authenticate. Enter the most specific combination of OUs, DCs, or CNs that match your criteria, ranging from left (most specific) to right (most general). For example, this path leads to the container with users that you need to authenticate: OU=end_users,DC=company,DC=com.   NOTE: Use the LDAP Browser to specify the Search Base DN and Search Filter. Use the LDAP Browser.
Advanced Search	The search filter. For example: (&(sAMAccountName=KBOX_USERNAME)(memberOf=CN=financial,DC=example,DC=com))
Login	The credentials of the account the appliance uses to log in to the LDAP server to read accounts. For example: LDAP Login:CN=service_account,CN=Users, DC=company,DC=com. If user name and password are not provided, the tree lookup is not performed. Each LDAP Label can connect to a different LDAP or Active Directory server.
Password	The password of the account the appliance uses to log in to the LDAP server.

Option	Description
Attributes to retrieve	Specify the LDAP attributes to retrieve. For example: sAMAccountName, objectguid, mail, memberof, displayname, sn, cn, userPrincipalName, name, description, manager The LDAP attributes specified in this field can be mapped to appliance User attributes on the next page. If this field is blank, the appliance retrieves all LDAP attributes. Leaving this field blank increases the time required to import attributes and is not recommended.   IMPORTANT: To retrieve the manager object associated with the user, you must add the manager attribute to the list, and to specify this mapping in a later step.
Label Attribute	Enter a label attribute. For example: memberof. This setting returns a list of groups this user is a member of. The union of all the label attributes forms the list of labels you can import. If the search filter contains both the label names and user names, the label attribute is not required.
Label Prefix	Enter the label prefix. For example: ldap_ The label prefix is a string that is added to the beginning of all the labels.
Binary Attributes	Enter the binary attributes. For example: objectsid. Binary attributes indicates which attributes should be treated as binary for purposes of storage.
Maximum Number of Rows	Enter the maximum number of rows to retrieve. This limits the result set that is returned in the next step.
Debug Output	Select the check box to view the debug output.

4.	In the Email Recipients section, click the Edit button to enter the recipient’s email address .

Option	Description
Ldap Uid	The identifier for the user. Recommended value: objectguid.
User Name	The name of the user. Recommended value: name.
Email	The email address for the user. Recommended value: mail.
Manager	The manager of the user. This mapping is mandatory only if you want to retrieve the manager information. Recommended value: manager.   IMPORTANT: To retrieve the manager object associated with the user, you must also add the manager attribute to the Attributes to retrieve box.

About single sign on (SSO)

About single sign on (SSO)

Single sign on enables users who are logged on to the domain, or authenticated through a third-party, to access the appliance Administrator Console and User Console without having to re-enter their credentials on the appliance login page.

You can use Active Directory for single sign on.

Single sign on is available for:

Using external LDAP or Active Directory servers for single sign on

Using external LDAP or Active Directory servers for single sign on

When using Active Directory for authentication for single sign on, the external LDAP or Active Directory server must have the same entries as the Active Directory server specified for single sign on. The appliance matches user credentials on the joined domain, and then it uses the external LDAP configuration to determine user roles and privileges.

To authenticate users by using local accounts on the appliance, you need to either import accounts from an LDAP or Active Directory server to the appliance, or manually create accounts on the appliance. See: