Applications Systems

Import certificates to DPA for directory service integration

Information about importing certificates to DPA while using the AD/LDAP wizard.

First published date

11/21/2018 11:21 PM

Last published date

12/9/2019 8:35 PM

Overview

You can configure DPA with your company's directory service by clicking Options > Administration > Configure AD/LDAP.

If you configure DPA to communicate over SSL with the AD/LDAP server, and the certificate provided by the server is not trusted by DPA, the configuration wizard offers to import the root certificate authority (CA) certificate or the server certificate as trusted:

Root CA certificate is the trust anchor of the trust chain provided by a server. If you import the root CA certificate as trusted, all server certificates whose trust chain is rooted at the root CA certificate will be trusted.
Server certificate is a certificate of the AD/LDAP server DPA is connecting to. The certificate may be self-signed or at the bottom of a trust chain that consists of multiple certificates.

Import the root CA certificate if you have multiple AD/LDAP servers in your domain, and DPA is configured to connect to the domain, rather than to a specific server. If you import the server certificate in this scenario, DPA can only establish SSL connections with one of your LDAP servers. Subsequent logins to DPA with LDAP accounts may seem to intermittently fail.

Product section

Database Performance Analyzer

Resolution

Obtain the root CA certificate

DPA attempts to resolve the root CA certificate by analyzing certificates provided in the SSL handshake with the AD/LDAP server. If the root CA certificate is not present, DPA issues an LDAP query to the LDAP server using the credentials specified in the wizard. The query searches for objects with the CACertificate attribute.

You can configure the query parameters with the following properties in the <DPA_dir>/iwc/tomcat/webapps/iwc/WEB-INF/classes/properties/idc-security.properties file:

com.confio.security.ldap.certificates.search.baseDns
com.confio.security.ldap.certificates.search.filter

Note: You must restart DPA for the new property values to take effect.

Import the certificates manually

You can import certificates manually into the custom DPA trust store. See these articles for more information:

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.