Problem: Need to create service account for directory services (LDAP) connection.
Cause: Unified Workspace uses a "proxy" style account to be able to integrate into your directory. This proxy account is the only user that accesses the LDAP server on behalf of the user. Because Unified Workspace integrates into your directory we have to have the proper rights to be able to modify objects in the tree. It's also important to have a separate account that is only connected to our product.
Prerequisite(s):
- Ability to create a new account in directory
- Ability to modify user permissions/group membership
- Find distinguishedName (DN) attribute of new user account
Solution(s): Here are some basic guidelines about rights to account.
Basics:
- Installation requires admin-level rights and schema rights
- Specifically, rights to extend schema, create objects and modify objects
- Day-to-day operations can be run at this level or can be run at lower-level privileges
- Recommended to make a specific "workspace" service account that will be separate from any other admin level accounts
- Verify service account password does not expire and does not change
- Program service account in Server Management console (https://127.0.0.1:8090) Directory Services
Minimum rights:
- Full access to Stoneware OU (and child objects)
- Ability to modify all the swareXXX attributes on any OU, Group, and User that will access software
- Ability to add/modify/remove group membership for users and groups
- Read rights to schema
Reference(s):