Procedure

1. Click Next.
   The LDAP Settings screen appears.
2. Complete the following to enable LDAP settings:
   1. For LDAP server type, select one of the following:
      • Domino
      • Microsoft Active Directory
      • Microsoft AD Global Catalog
      • Open LDAP
      • Sun iPlanet Directory
   2. To enable one or both LDAP servers, select the check boxes next to Enable LDAP 1 or Enable LDAP 2.
   3. Specify the names of the LDAP servers and the port numbers they listen on.
   4. Under LDAP cache expiration for policy services and EUQ services, specify a number that represents the time to live next to the Time to Live in minutes field.
   5. Under LDAP admin, specify the administrator account, its corresponding password, and the base-distinguished name. See the following table for a guide on what to specify for the LDAP admin settings.

      LDAP Server Types

      LDAP Server	LDAP Admin Account (examples)	Base Distinguished Name (examples)	Authentication Method
      Active Directory™	Without Kerberos: user1@domain.com (UPN) or domain\user1 With Kerberos: user1@domain.com	dc=domain, dc=com	Simple Advanced (with Kerberos)
      Active Directory Global Catalog	Without Kerberos: user1@domain.com (UPN) or domain\user1 With Kerberos: user1@domain.com	dc=domain, dc=com dc=domain1,dc=com (if mutiple unique domains exist)	Simple Advanced (with Kerberos)
      OpenLDAP	cn=manager, dc=test1, dc=com	dc=test1, dc=com	Simple
      Lotus Domino™	user1/domain	Not applicable	Simple
      Sun™ iPlanet Directory	uid=user1, ou=people, dc=domain, dc=com	uid=user1, ou=people, dc=domain, dc=com	Simple

   6. For Authentication method, click Simple or Advanced authentication. For Active Directory advanced authentication, configure the Kerberos authentication default realm, Default domain, KDC and admin server, and KDC port number.
   7. Select the Enable encrypted communication between IMSS and LDAP check box and click Browse to upload a CA certificate file to verify the certificate used by the LDAP server.