TANDBERG Gatekeeper Manuel D’Utilisation
TANDBERG Gatekeeper User Guide
Page 96 of 105
18.1.3.
Securing with TLS
To enable Active Directory to use TLS, you must request and install a certificate on the Active Directory
server. The certificate must meet the following requirements:
Be located in the Local Computer's Personal certificate store. This can be seen using the
Certificates MMC snap-in.
Have the private details on how to obtain a key associated for use with it stored locally. When
viewing the certificate you should see a message saying "You have a private key that
corresponds to this certificate''.
Have a private key that does not have strong private key protection enabled. This is an attribute
that can be added to a key request.
The Enhanced Key Usage extension includes the Server Authentication object identifier, again
this forms part of the key request.
Issued by a CA that both the domain controller and the client trust.
Include the Active Directory fully qualified domain name of the domain controller in the common
name in the subject field and/or the DNS entry in the subject alternative name extension.
18.2.
OpenLDAP
18.2.1.
Prerequisites
These instructions assume that an OpenLDAP server has already been installed. For details on installing
OpenLDAP see the documentation at http://www.openldap.org.
The following examples use a standard OpenLDAP installation on the Linux platform. For installations on
The following examples use a standard OpenLDAP installation on the Linux platform. For installations on
other platforms the location of the OpenLDAP configuration files may be different. See the OpenLDAP
installation documentation for details.
18.2.2.
Installing the H.350 schemas
The following ITU specification describes the schemas which are required to be installed on the LDAP
server:
H.350
Directory services architecture for multimedia conferencing - An LDAP schema to
represent endpoints on the network.
H.350.1
Directory services architecture for H.323 - An LDAP schema to represent H.323
endpoints.
H.350.2
Directory services architecture for H.235 - An LDAP schema to represent H.235 elements.
The schemas can be downloaded in
ldif
format from the web interface on the Gatekeeper. To do this,
navigate to
Gatekeeper Configuration
>
Files
and click on the links for the LDAP schemas.
Copy the downloaded schemas to the OpenLDAP schema directory:
/etc/openldap/schemas/commobject.ldif
/etc/openldap/schemas/h323identity.ldif
/etc/openldap/schemas/h235identity.ldif
Edit
/etc/openldap/slapd.conf
to add the new schemas. You will need to add the following lines:
include /etc/openldap/schemas/commobject.ldif
include /etc/openldap/schemas/h323identity.ldif
include /etc/openldap/schemas/h235identity.ldif
The OpenLDAP daemon (slapd) must be restarted for the new schemas to take effect.