Question Setting Up LDAP & SSL Authentication for Windows Clients on CMOD V10.5

[JeanineJ]

Has anyone set up LDAP/AD authentication through SSL for the Windows Client only on a MultiPlatorm installation?
I'm a mainframer with 17 years experience supporting CMOD in our environment and I'm tasked with authenticating the few users, less than 1k, that retrieve documents using the Windows (Thick) Client. (It was never intended but....)
I have to run the GSKit commands to set up the Key DB and Stash files. I assume I'll have to run them as root but root does not own CMOD. We changed that years ago. Will the resulting files have to be owned by the CMOD owner OR will I have to change permissions? If so what should I look for.
I open a case with IBM but they say that they can't answer that type of question (which I consider a how-to question but okay)  and I have to likely pay for Lab Services help. Not going to happen.
Any suggestions would be helpful.
Also I found that I am missing ARSLDAP.INI in my installation, likely because this server has been upgraded from the original install of 9.5 to 10.1 and now 10.5. I'm waiting to see what IBM says about this missing INI file. Does anyone know if I really need this INI?

[Justin Derrick]

Hi Janine.

You don't need root to create or manage the key database or stash files.  CMOD just needs to know where they are, and have permission to read them.

As for the ARSLDAP.INI file, it appears that you only need that if you want to create custom error messages, everything else is configured in ars.cfg.

You can find more information on LDAP-specific parameters here:
https://cmod.wiki/index.php?title=ars.cfg#IBM_CMOD_LDAP_Configuration

Good luck.

-JD.