Hints and tips

Special considerations with server IDs

To use Lightweight Directory Access Protocol (LDAP) as the user registry, you need to know a valid user name (ID), the user password, the server host and port, the base distinguished name (DN) and,if necessary, the bind DN and the bind password. You can choose any valid user in the user registry that is searchable. In some LDAP servers, the administrative users are not searchable and cannot be used. For example, cn=root in SecureWay is not searchable. This user is referred to as WebSphere Application Server security server ID, server ID, or server user ID in the documentation. Being a server ID means a user has special privileges when calling some protected internal methods. Normally, this ID and password are used to log into the administrative console after you turn on security. You can use other users to log in if those users are part of the administrative roles.

If security is enabled, this server ID and password are authenticated with the user registry when the server starts. If authentication fails, the server does not start. It is important you you choose an ID and password that does not expire or change often. If the product server user ID or password need to change in the user registry, make sure that the changes are performed when all of the product servers are up and running.

Single signon between Version 6.0.x, 5.0.x, and 4.0.x application servers.

If you are using single signon between a WebSphere Application Server Version 5.0.x server and a WebSphere Application Server Version 4.0.x application server, you must specify an LDAP server port number. You must set the LDAP port numbers to the same numerical value because for WebSphere Application Server Versions 6.0.x and 5.0.x the default value is 0. For WebSphere Application Server Version 4.0.x, the default value for the port is not 0.