PowerProtect Data Manager 19.10 Security Configuration Guide

Configure an external identity provider

Only the Administrator and the Security Administrator roles can configure an external identity provider.

1. From the left navigation pane, select Administration > Access Control.
   The Access Control window appears.
2. Click the Directory Settings tab.
   PowerProtect Data Manager displays a list of configured identity providers.
3. Click Add.
   The Add Directory window appears.
4. Configure the following attributes:

   Table 1. Identity provider attributesIdentity provider attributes

   Attribute	Description
   Server Type	Select a supported identity provider type.
   Server Address	Type the hostname or IP address of the identity provider. A protocol prefix is not required.
   Secure Connection	Select this attribute if the identity provider uses a secure connection method such as LDAPS or AD over SSL. Selecting this attribute enables the certificate validation controls.
   Port	Type the port number for the identity provider.
   Domain	Type the domain for which this identity provider authenticates users. For example, ldap.example.com.
   User Name	Type a user account that has full read access to the directory. A domain is not required.
   Password	Type the password for the specified user account.
   Group Search Attribute	Type the attribute name that the identity provider should use to validate the group name in the hierarchy.
   Group Member Attribute	Type the attribute name that the identity provider should use to validate the group member in the hierarchy.
   Group Search Base	If searches should not start from the default base, type the name of a base from which searches should start. For example, if the domain is ldap.example.com, type admin to start searches from admin.ldap.example.com. Otherwise, leave this attribute empty. Only a single search base is supported.

   Populate the default values from this table into the appropriate fields when indicated:

   Table 2. Default attribute valuesDefault attribute values

   Attribute	Value or format
   	AD and AD over SSL	LDAP and LDAPS
   Port	For unsecure connections, the default port number is 389. For secure connections, the default port number is 636.
   Group Search Attribute	sAMAccountName	cn
   Group Member Attribute	member	memberUid

5. If you selected a secure connection method:
   1. Click Verify.
   2. In the Verify Certificate window, verify the details of the identity provider TLS certificate and then click Accept.
   NOTE When you specify the LDAPS protocol, PowerProtect Data Manager automatically downloads the certificates required to connect to the identity provider. Once downloaded, the Certificate Validation field appears. Click Verify to compare the displayed certificate information with the expected certificate information. If the certificates match, click Accept to continue with the setup. Otherwise, click Cancel to cancel the setup.
6. Click Save.