Sorry, my OCD is kicking in. Here are some additional notes after lots of upgrades, WinDU cleanup, and user account management.
- With WindchillDS or a locally installed OpenDJ, there is no reason to change the base DN from PTC's default "o=ptc" to any other name like "o=wind". No one outside of Windchill administrators see it and you have to remember to change the value with every upgrade. Not a huge deal.
- As of Windchill 12.0, I recommend to drop the "_12.0" from the DN structure. We don't include the Windchill version in Active Directory user and group DNs, why should we with OpenDJ? Also, these DNs will never change in future upgrades and we don't want to see DN references to "cn=Windchill_12.0,o=ptc" when we are upgrading to Windchill 15.0.
- The examples above are legacy Windchill DN structures. We could use any structure provided it separates our user accounts the way we want. For example, we could drop cn=Windchill and be more direct in our org/site DN names:
o=ptc
cn=org
ou=users
cn=site
ou=groups
ou=users
Additional nuance...
When we create users from Windchill in a read-write LDAP, we should pay attention to where we create them: Site or Org. In the Windchill training, the reasoning for creating users at the organization was it is easier to let the org automatically assign the domain to the users. However, there is more going on than automatically assigning org-level users to the current organization. WinDU also complains when we create a user at the Site and manually associate them to the Organization. Or, when we only set up one JNDI Adapter and hard set the organization for all users (including the Site Administrator). The "Verify Principal Domain External Users" check reports something like this.
User wcadmin is not in default domain
Current domain: [/wt.inf.container.OrgContainer=PTC]/PTC
Default domain: [/]/User/Unaffiliated
Because user was created from the Site context
Or (depending on how the JNDI Adapter was defined)
User j.doe is not in default domain
Current domain: [/]/User/Unaffiliated
Default domain: [/wt.inf.container.OrgContainer=PTC]/PTC
Because user was created from the Organization context
Does it really matter? Probably not, but if WinDU bothers to report it, I prefer to clean it up.
OOTB Windchill_11.x and earlier using WindchillDS defaults to two adapters to address this WinDU issue.
The first adapter (e.g. com.ptc.LDAP) is for Site Administrator and other Site level accounts.
It is configured with a search base: ou=people,cn=AdministrativeLDAP,cn=Windchill,o=ptc.
By excluding the organization mapping attribute, all users under this search base become Site level "Unaffiliated" users.
The second adapter (e.g. com.ptc.EnterpriseLdap) is for organization level users.
It is configured with a search base: ou=people,cn=EnterpriseLDAP,cn=Windchill,o=ptc.
By including the organization mapping attribute in the JNDI Adapter, all users under this search base are automatically assigned to the named Organization.
"com.ptc.EnterpriseLdap.windchill.mapping.usersOrganizationName=PTC",
or (if there is an LDAP user attribute "o" with the value of the Windchill organization name)
"com.ptc.EnterpriseLdap.windchill.mapping.user.o=o",
This level of LDAP configuration will eliminate the reported "Verify Principal Domain External Users" complaints and works equally well for read-write and read-only LDAP configurations.
You do not need to do all of this to get logged into your Windchill system. Windchill will run with all users under one JNDI Adapter provided a slightly more complex search base than "uid=wcadmin,o=ptc".
