4. Click OK  to complete the operation. If you must abandon the operation, click Cancel  to return to the Security Settings window. 

When the authentication policy test completes, the Test Authentication Policy results window opens to display results for each selected cluster. The results include a statement that indicates whether the test succeeded or failed, and the reason for the failure if it failed. The Test Authentication Policy results window also displays the Policy Users table. Information that is shown on that table includes the following fields: 

GLYPH<SM590000> Username: The name of a user who is authorized by the selected authentication policy. 

GLYPH<SM590000> Role: The role that is assigned to the user under the selected authentication policy. 

GLYPH<SM590000> Cluster Access: A list of all the clusters in the grid for which the user and user role are authorized by the selected authentication policy. 

To return to the Test Authentication Policy window, click Close Window . To return to the Security Settings window, click Back  at the top of the Test Authentication Policy results window. 

## Adding a Direct LDAP policy 

A Direct LDAP Policy is an external policy that maps user, group, and role relationships. Users are authenticated and authorized through a direct communication with an LDAP server. This section highlights the various windows that are required to manage a Direct LDAP policy. 

Important:  When a Direct LDAP policy is enabled for a cluster, service personnel are required to log in with the setup user or group. Before enabling LDAP authentication, create an account that can be used by service personnel. Also, the user can enable an IBM SSR to connect to the TS7700 through physical access or remotely by selecting those options in the DIRECT LDAP POLICY window. 

To add a Direct LDAP Policy for a TS7700 grid, complete the following steps: 

1. In the TS7700 MI, click Access →  Security Settings  from the left navigation window. 

2. From the menu, select Add Direct LDAP Policy and click  GO. 

3. Select the check boxes to grant local or remote access to the TS7700 to the IBM SSR so that the SSR can perform service support. 

Note:  LDAP external authentication policies are not available for backup or recovery through the backup or restore settings operations. Record it, keep it safe, and have it available for a manual recovery as dictated by the security standards. 

The values in the following fields are required if secure authentication is used or anonymous connections are disabled on the LDAP server: 

GLYPH<SM590000> User Distinguished Name: The user distinguished name is used to authenticate to the LDAP authentication service. This field supports a maximum length of 254 Unicode characters, for example: 

CN=Administrator,CN=users,DC=mycompany,DC=com 

GLYPH<SM590000> Password: The password is used to authenticate to the LDAP authentication service. This field supports a maximum length of 254 Unicode characters. 

