User Guide
Chapter 6: Additional Fortify Software Security Center Configuration
for a given LDAP server configuration. Because the searches are performed across all the
servers, it is important that the searches return just a single result. Be sure to use username
attributes that result in unique search hits across all your configured LDAP servers. For
example, if you use multiple Active Directories, it may make sense to use
userPrincipalNameas the username attribute in your configurations instead of the default
sAMAccountName, which may not be unique across AD servers.
If this requirement is not satisfied…
In some circumstances, it may be difficult for administrators to avoid duplicate usernames. If
Fortify Software Security Center finds a given username in more than one LDAP server
during login, it tries to resolve this by using the password with all instances of the username,
and then uses the instance that the password authenticates first. In most cases, a user with a
non-unique username can successfully log in to Fortify Software Security Center and access
most of the user interface functionality. However, some functionality, including report
generation, token-based authentication, and DAST integration, is not supported for such
users.
l
Separate LDAP server configurations must manage completely independent
namespaces (trees)
This requirement ensures unique lookup of LDAP DNs by Fortify Software Security Center.
The simplest (and recommended) way to achieve this is to ensure that none of the configured
baseDNs is a suffix of any of the others.
In more complex cases, it may be possible to delegate a subtree to be managed by a second
LDAP server configuration. In that case, however, all transitive DN references (for example,
group member DNs) must also be managed by the second LDAP server. For example, if you
have one LDAP server configuration with the base DN DC=acme,DC=com, but the
OU=org,DC=acme,DC=comsubtree is managed by another LDAP server, you can set up a
second LDAP configuration to manage just the OU=org,DC=acme,DC=comLDAP subtree.
But you must ensure that none of the LDAP objects registered in Fortify Software Security
Center from the first LDAP server reference (directly or transitively) the
OU=org,DC=acme,DC=comsubtree, and vice versa.
If this requirement is not satisfied…
If an LDAP object DN matches the base DN of more than one LDAP server, Fortify Software
Security Center performs a lookup against the LDAP server whose base DN best matches
match the given LDAP object DN. This may lead to Fortify Software Security Center using the
data of unintended LDAP object in processing and result in unexpected behavior.
See Also
About the LDAP Server Referrals Feature
Some LDAP servers use a special feature called referrals. A referral is an entity that contains the
names and locations of other objects. A referral is used to redirect a client request to another
server. It is sent by the server to indicate that the information that the client has requested can
be found at another location (or locations), possibly at another server or several servers.
OpenText™ Fortify Software Security Center (24.2.0)
Page 106 of 459