Configuring communication with LDAP or Active Directory servers using SSL

For Control-M/EM installed on UNIX and Linux operating systems:

1. Obtain a .cer format certificate file from the directory server. Creating and exporting certificate files are different for each LDAP server vendor. Refer to your LDAP server administrator in order to obtain the correct certificate file.

   For an example on how to obtain a certificate from the Windows Active Directory, see Example.

2. Place the em_ldap_ssl.pem file into the <Control-M/EM_directory>\etc\keystore directory.
3. Verify that a randomness device is installed on the Control-M/EM computer as follows:
   1. Locate either the random or urandom file in the /dev directory. If you find the random file, verify that its path is part of the search path.
   2. If neither of these files exist, open the <Control-M/EM_directory>/etc/ldap.conf file in a text editor.
   3. Locate the #TLS_RANDFILE <Control-M/EM_directory>/ini/ssl/rnd.bin line and remove the # character.
   4. Save the modified file.
4. Set an environment variable named "LDAPCONF" with a value pointing to the "ldap.conf" file, which gets set by the EM UNIX account profile.

   EXAMPLE: setenv LDAPCONF <Control-M/EM_directory>/ctm_em/etc/ldap.conf

5. LDAP hosts must be resolvable in DNS. If not, add to file /etc/hosts a reference to IP address and hostname of the LDAP machine.

   EXAMPLE: 1.2.3.4 host1.bmc.com

   1.2.3.4 host1

6. Restart all EM components by applying stop_all and start_all commands.
7. Define an LDAP server that can communicate with Control-M/EM in SSL mode, as described in Defining LDAP system parameters.

   If you do not apply all of the above steps, LDAP authentication in SSL mode fails.

8. Recycle the GUI and CMS components.