Chapter 5: Using the Web Interface
112
Setting Up External User Authentication
For security purposes, users attempting to log in to the Dominion PX must
be authenticated. The Dominion PX supports the access using one of the
following authentication mechanisms:
Local database of user profiles on the Dominion PX device
Lightweight Directory Access Protocol (LDAP)
Remote Access Dial-In User Service (RADIUS) protocol
By default, the Dominion PX is configured for local authentication. If you
stay with this method, you do not need to do anything other than create
user profiles for each authorized user. If you prefer to use an external
LDAP or RADIUS server, you must:
Provide the Dominion PX with the information about the server.
Create user profiles for users who are authenticated externally
because a user profile determines the User Group to which the user
belongs, and determines the system and outlet permissions for the
user accordingly.
When users log in with external authentication, even though they are
authorized to perform outlet operations, they cannot perform operations
on Outlet Groups. Only local users can perform operations on Outlet
Groups so users must authenticate locally to do this.
Note: Setting the LDAP user attribute
rciusergroup
to admin allows an
Active Directory
®
user to log in to the Dominion PX with Administrator
privileges. This occurs even if the user is assigned to the Unknown user
group that normally has no access permissions.
When configured for LDAP authentication, all Dominion PX users must
have an account on the LDAP server. Local-authentication-only users will
have no access to the Dominion PX except for the admin, who always can
access the Dominion PX.
Gathering Information for LDAP Configuration
It requires knowledge of your LDAP server and directory settings to
configure the Dominion PX for LDAP authentication. If you are not familiar
with the settings, consult your LDAP administrator for help.
To configure LDAP authentication, you need to check:
The IP address or hostname of the LDAP server
The IP address of a backup or secondary LDAP server (optional)
Whether the Secure LDAP protocol (LDAP over SSL) is being used
If Secure LDAP is in use, consult your LDAP administrator for the
CA certificate file.
