# OpenAM Administration Guide
2.2. Configuring Authentication Modules

Sidebar | Prev | Up | Next

### 2.2.1. Hints For the Active Directory Authentication Module

OpenAM connects to Active Directory over Lightweight Directory Access Protocol (LDAP). OpenAM provides separate Active Directory and LDAP modules to support the use of both Active Directory and another directory service in an authentication chain.

ssoadm service name: `sunAMAuthADService`

Primary Active Directory Server, Secondary Active Directory Server

  The default port for LDAP is 389. If you are connecting to Active Directory over SSL, the default port for LDAP/SSL is 636.

  To allow users to change passwords through OpenAM, Active Directory requires that you connect over SSL.

  If you want to use SSL or TLS for security, then scroll down to enable SSL/TLS Access to Active Directory Server. Make sure that OpenAM can trust the Active Directory certificate when using this option.

  OpenAM first attempts to contact primary servers. If no primary server is available, then OpenAM attempts to contact secondaries.

  When authenticating users from a directory server that is remote from OpenAM, set both the primary and secondary server values.

  ssoadm attributes: primary is `iplanet-am-auth-ldap-server`; secondary is `iplanet-am-auth-ldap-server2`

DN to Start User Search

  LDAP data is organized hierarchically, a bit like a file system on Windows or UNIX. More specific DNs likely result in better performance. When configuring the module for a particular part of the organization, you can perhaps start searches from a specific organizational unit such as `OU=sales,DC=example,DC=com`.

  If multiple entries exist with identical search attribute values, make this value specific enough to return only one entry.

  ssoadm attribute: `iplanet-am-auth-ldap-base-dn`

Bind User DN, Bind User Password

  If OpenAM stores attributes in Active Directory, for example to manage account lockout, or if Active Directory requires that OpenAM authenticate in order to read users' attributes, then OpenAM needs the DN and password to authenticate to Active Directory.

  The default is `amldapuser`. If the administrator authentication chain (default: `ldapService`) has been configured to include only the Active Directory module, then make sure that the password is correct before you logout. If it is incorrect, you will be locked out. If you do get locked out, you can login with the super user DN, which by default is `uid=amAdmin,ou=People,`OpenAM-deploy-base``, where `OpenAM-deploy-base` was set during OpenAM configuration.

  ssoadm attributes: `iplanet-am-auth-ldap-bind-dn` and `iplanet-am-auth-ldap-bind-passwd`

Attributes Used to Retrieve User Profile, Attributes Used to Search for a User to be Authenticated, User Search Filter, Search Scope

  LDAP searches for user entries return entries with attribute values matching the filter you provide. For example if you search under `CN=Users,DC=example,DC=com` with a filter `"(MAIL=bjensen@example.com)"`, then the directory returns the entry that has `MAIL=bjensen@example.com`. In this example the attribute used to search for a user is `mail`. Multiple attribute values mean the user can authenticate with any one of the values. For example, if you have both `uid` and `mail`, then Barbara Jensen can authenticate with either `bjensen` or `bjensen@example.com`.

  The User Search Filter text box provides a more complex filter. For example, if you search on `mail` and add User Search Filter `(objectClass=inetOrgPerson)`, then OpenAM uses the resulting search filter `(&(mail=`address`) (objectClass=inetOrgPerson))`, where `address` is the mail address provided by the user.

  This controls how and the level of the directory that will be searched. You can set the search to run at a high level or against a specific area.

  - OBJECT will search only for the entry specified as the DN to Start User Search.

  - ONELEVEL will search only the entries that are directly children of that object.

  - SUBTREE will search the entry specified and every entry under it.

  ssoadm attributes: `iplanet-am-auth-ldap-user-naming-attribute`, `iplanet-am-auth-ldap-user-search-attributes`, `iplanet-am-auth-ldap-search-filter`, and `iplanet-am-auth-ldap-search-scope`

SSL/TLS Access to Active Directory Server

  If you enable SSL/TLS, OpenAM must be able to trust Active Directory certificates, either because the Active Directory certificates were signed by a CA whose certificate is already included in the trust store used by the container where OpenAM runs, or because you imported the certificates into the trust store.

  ssoadm attribute: `iplanet-am-auth-ldap-ssl-enabled`

Return User DN to DataStore

  When enabled, and OpenAM uses Active Directory as the user store, the module returns the DN rather than the User ID, so the bind for authentication can be completed without a search to retrieve the DN.

  ssoadm attribute: `iplanet-am-auth-ldap-return-user-dn`

User Creation Attributes

  This list lets you map (external) attribute names from Active Directory to (internal) attribute names used by OpenAM.

  ssoadm attribute: `iplanet-am-ldap-user-creation-attr-list`

LDAP Connection Heartbeat Interval

  Specifies how often OpenAM should send a heartbeat request to the directory server to ensure that the connection does not remain idle. Some network administrators configure firewalls and load balancers to drop connections that are idle for too long. You can turn this off by setting the value to 0 or to a negative number. To set the units for the interval use LDAP Connection Heartbeat Time Unit.

  Default: 1

  ssoadm attribute: `openam-auth-ldap-heartbeat-interval`

LDAP Connection Heartbeat Time Unit

  Specifies the time unit corresponding to LDAP Connection Heartbeat Interval.

  Default: minute

  ssoadm attribute: `openam-auth-ldap-heartbeat-interval`

Authentication Level

  Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

  ssoadm attribute: `sunAMAuthADAuthLevel`