HP 3PAR Command Line Interface Administrator's Manual: HP 3PAR OS 3.1.2 (QR482-96525, September 2013)

3. Issue the checkpassword command to verify that the users have the roles you assigned for
the desired groups. Use a member of a specific group to verify the role.
Example:
system1 cli% setauthparam -f edit-map CN=Software,CN=Users,DC=3par,DC=com
system1 cli% setauthparam -f browse-map CN=Eng,CN=Users,DC=3par,DC=com
In the example above:
• Users belonging to the Software group are configured to have Edit rights within the
system.
• Users belonging the Eng group are configured to have Browse rights within the system.
system1 cli% checkpassword 3PARuser
...
+ search result: memberOf: CN=Software,CN=Users,DC=3par,DC=com
+ search result: memberOf: CN=Eng,CN=Users,DC=3par,DC=com
+ search result: memberOf: CN=Golfers,CN=Users,DC=3par,DC=com
+ mapping rule: edit mapped to by CN=Software,CN=Users,DC=3par,DC=com
+ rule match: edit mapped to by CN=Software,CN=Users,DC=3par,DC=com
+ mapping rule: browse mapped to by CN=Eng,CN=Users,DC=3par,DC=com
+ rule match: browse mapped to by CN=Eng,CN=Users,DC=3par,DC=com
user 3PARuser is authenticated and authorized
In the example above:
• 3PARuser is found to be a member of the Software group and is assigned Edit rights
within the system.
• Although 3PARuser is also a member of the Eng group, the Edit rights associated with
the Software group supersede the Browse rights associated with the Eng group.
• The mapping rules set for 3PARuser are applied to all members of the Software group
and Eng group; all Software group members have Edit rights within the system and all
Eng group members have Browse rights within the system.
OpenLDAP Configuration with Simple Binding Over SSL
To configure your system to use OpenLDAP with simple binding over SSL, the following process
must be performed (detailed instructions follow):
• Configure connection parameters using the following command:
setauthparam ldap-server <IP_address>◦
◦ setauthparam ldap-ssl 1
• Configure binding (authentication) parameters using the following commands:
setauthparam binding <binding_type>◦
◦ setauthparam user-dn-base <value>
◦ setauthparam user-attr <attribute>
• Configure group location parameters using the following commands:
setauthparam groups-dn <value>◦
◦ setauthparam group-object <group_object_class>
Configuring LDAP Connections 33