HP 2x1Ex16 HP IP Console Viewer User Guide - Page 291

LDAP client behavior overview UID masks (simple and complex) The client application login dialog enables you to enter two fields, labeled User name and Password. Before the HP IP Console Viewer was enhanced with support for directory services integration (LDAP), the product supported only one form of authentication, which used an internal database. Therefore, there was no ambiguity about the use of these two fields because the internal database supports only one form of user name. However, Active Directory supports many types of attributes that could sensibly be used as credentials for the purposes of authenticating the user of the client application. After an administrator chooses which Active Directory attributes to use as credentials, the choice is implemented using a feature of the HP IP Console Switch called the UID Mask. This flexibility engenders several questions: • What are the Active Directory attributes that could sensibly be used as credentials? • How does the value of each of those attributes get set in Active Directory? • How is the UID mask in the Manage Console Switch window used to implement a customer's choice of credentials? These questions are addressed in the following subsections. Active Directory attributes that can be used as credentials Several attributes that are candidates for use as credentials are defined when a new user account is initialized in Active Directory. Other candidates are found in the Properties dialog for user objects in Active Directory. In addition, other candidates are available but not readily accessible in the default Properties dialog for user objects. For these attributes, it is necessary to use an Active Directory tool, such as ADSI Editor, to access the attribute and set its value. Attributes initialized during creation of a new user object When a new object is created in Active Directory to represent a user, the dialog presented by Active Directory enables values to be set for the following attribute types: • First Name • Initials • Last Name • Full Name • User Logon Name • User Principal Name NOTE: This attribute is not explicitly labeled in the dialog used to create a new user object. • User Logon Name (pre-Windows® 2000) LDAP client behavior overview 291