Use the InterMapper Authentication Server to authenticate InterMapper users through an external authentication directory.
The InterMapper Authentication Server (IMAuth) is a component of the InterMapper DataCenter (IMDC) add-on package. It lets an InterMapper server authenticate users against an external authentication directory. IMAuth supports LDAP, RADIUS, ActiveDirectory, IAS, Kerberos, and DND directories.
IMAuth acts as an intermediary between an InterMapper server and the directory. If an authentication request comes in from a user whose password is not in InterMapper’s local user database, the InterMapper server forwards that request to IMAuth. IMAuth translates and passes the request to the directory server, and forwards any responses it receives back to the InterMapper server. In addition, a new user entry is created in the local database, configured for external authentication and assigned to a default group you will have specified for users created this way.
IMAuth is not a replacement for InterMapper's local user database. You may continue to keep some user passwords in InterMapper's local user database for local authentication while requiring others to be authenticated via IMAuth. For each user, you must choose one method or the other.
Select the "Use External Authentication" check box in the Edit User or Create User dialog to indicate that the user should be authenticated via IMAuth, in which case you should not supply a password. For more information on creating and editing users, see Users and Groups.
InterMapper Authentication Server runs as a component of InterMapper DataCenter and is installed automatically when you install InterMapper. On Windows and MacOS X, IMDC is installed automatically alongside InterMapper. On other platforms, you need to download and install IMDC separately.
You need to configure the InterMapper Authentication Server to talk to your directory server. This is done from InterMapper DataCenter's web administration page. To do this, start IMAuth Server as described above, then open a web browser and navigate to: https://localhost:8182. You can also click Configure... in the Reports Server pane of the Server Settings window.
IMAuth acts as a RADIUS client, and so it must be added to the clients section of your RADIUS configuration file or, for Microsoft IAS, the clients section of the IAS configuration pane. You are asked to specify a secret, and must then enter exactly the same secret in the IMAuth RADIUS settings.
If you encounter any problems, first try un-checking the Use SSL option, or choose Whenever Necessary for the Use Plaintext option in the IMAuth LDAP settings. If this works, it means your server wasn't built to include SSL or SASL DIGEST-MD5 password encryption. You'll need to either stay with the lower IMAuth security settings, or upgrade your LDAP server.
Another thing to look at is the LDAP Base DN specified in the IMAuth LDAP settings. This tells IMAuth where in your LDAP directory the user entries are located. This depends on how your directory was set up, but usually takes the form: ou=people,dc=example,dc=com, where example and com correspond to the domain name your directory was set up with. IMAuth takes the Base DN and attaches the user's name; for example: cn=Jane,cn=Smith,ou=people,dc=example,dc=com.
ActiveDirectory is based on LDAP, but differs slightly in its default configuration. If you are encountering problems with these ActiveDirectory versions, try un-checking the Use SSL option or choosing Whenever Necessary for the Use Plaintext option in the IMAuth LDAP settings.The Base DN for an ActiveDirectory server will almost always be: cn=Users,dc=example,dc=com where example and com are replaced by the name of the Windows Domain that ActiveDirectory is serving.
Since ActiveDirectory is built around the idea of domains rather than single servers, the username you use to authenticate must have your domain name attached to it. For example, if your normal Windows logon name is janesmith and your domain is example.com, the username you give when accessing a map with InterMapper or InterMapper RemoteAccess is janesmith@example.com.
Almost all ActiveDirectory versions support SSL. If you have provided your own certificate, choosing the Whenever Necessary option for the Use Plaintext field in the IMAuth LDAP settings doesn't have much impact on your security. If you really do need the additional encryption, you must perform these steps:
In this case you might again need to use a different username. Instead of the usual login name, you may need to use the user's full name. For example, instead of janesmith you would use Jane M. Smith.
When setting up IMAuth, it's a good idea to try the normal login name, the login name with your domain attached, and the user's full name, to see which login your ActiveDirectory server accepts.
For a good introduction to Kerberos, see the following Knowledgebase article:
Problems encountered when using Kerberos are usually caused by misconfiguring the InterMapper Authentication Server, or by the values used when creating the imauth service account.