Articles in this section

ldap create

Sara Levy
Follow

This command configures a connection to an LDAP based directory server.

Usage
ldap create --urls URI_LIST
            --port PORT
            [--binddn BINDDN]
            --bindpw BINDPW
            --basedn BASE_DN
            [--group-searchbase GROUP_BASE_DN]
            --method simple|anonymous
            --domain-name DOMAIN_NAME
            [--gid-number ATTRIBUTE_NAME]
            [--uid ATTRIBUTE_NAME]
            [--uid-number ATTRIBUTE_NAME]
            [--member-uid ATTRIBUTE_NAME]
            [--posix-account ATTRIBUTE_NAME]
            [--posix-group ATTRIBUTE_NAME]
            [--use-tls]
            [--no-tls]
            [--query-groups-mode COMPATIBLE|RFC2307BIS_ONLY|RFC2307_ONLY|NONE]
            [--username-property-name ATTRIBUTE_NAME]
            [--user-login-name ATTRIBUTE_NAME]
            [--group-login-name ATTRIBUTE_NAME]
            [--posix-templates AD|Open_LDAP]
Required Parameters

--urls URI_LIST

Sets the URIs of the remote LDAP server's domain controllers (DCs) and their priority order.

Specify URI_LIST as a comma separated list of URIs in the format <scheme>://<address>. The order of listing defines the priority order. The DC with highest priority that has a good health status is used.

Examples:

  • --urls ldap://company-ad.com

  • --urls ldap://company-ad.com,ldap://company-ad2.com

  • --urls ldap://192.0.2.0,ldap://192.0.2.1,ldap://192.0.2.2

--port PORT

Sets the port of the remote LDAP server. Typical value: 389.

--bindpw BINDPW

Sets the password used with the Bind DN to authenticate to the LDAP server.

Required if method is set to simple.

--basedn BASE_DN

Specifies the entry in the LDAP directory tree to use as a starting point for user queries.

To maximize the speed of authentication queries, start the search in the lowest branch of the tree under which all users can be found. For example, if the entire directory must be queried, the search base must specify the root of the tree. However, if the search can be restricted to a specific organizational unit (OU), queries may be faster.

Specify BASE_DN as a comma separated list of components. Each component is an attribute=value pair defining an object in the directory tree. The first component defines the object at the lowest part of the tree that you want to use as the starting point of the search, the next component is its container and so on up the tree, with the last component representing the top level domain.

The following attributes can be specified:

  • cn: common name

  • ou: organizational unit

  • o: organization

  • c: country

  • dc: domain

--method simple|anonymous

The authentication method the LDAP server uses to authenticate VAST Cluster as a client querying the LDAP database. Set the method according to how the LDAP server is configured to authenticate clients. The following options are available:

  • anonymous. The LDAP server accepts queries without any authentication.

  • simple. The LDAP server attempts to bind a specified user name to a matching LDAP user. If the LDAP bind succeeds, VAST Cluster is allowed access to perform the query. Set also Bind DN and Bind password.

--domain-name DOMAIN_NAME

Sets the fully qualified domain name (FQDN) of the domain to join.

For example: company.com
Options

--binddn BINDDN

Sets the bind DN for authenticating to the LDAP server. The bind DN specifies the user with which VAST Cluster authenticates to the LDAP directory.

The format is a comma separated list of components. Each component is an attribute=value pair defining an object in the directory tree. The first component is a cn attribute component specifying the user object, the next component is its container and so on up the tree, with the last component representing the top level domain.

The following attributes can be specified:

  • cn: common name

  • ou: organizational unit

  • o: organization

  • c: country

  • dc: domain

For example, cn=admin,ou=users,dc=mydomain,dc=local specifies user 'admin' located in the 'users' container under the domain 'mydomain.local'.

--group-searchbase GROUP_BASE_DN

Sets the entry in the LDAP directory tree to use as a starting point for group queries. See Base DN.

--gid-number ATTRIBUTE_NAME

--uid ATTRIBUTE_NAME

--uid-number ATTRIBUTE_NAME

--member-uid ATTRIBUTE_NAME

--posix-account ATTRIBUTE_NAME

--posix-group ATTRIBUTE_NAME

If your LDAP server uses attributes that differ from the default RFC2307-compliant attribute set that is used to query the LDAP server, these options map those attributes to the attribute names used on the server you are connecting the cluster to. This is typically needed for Active Directory.

Example: uid=cn --posix-account user --posix-group group

use-tls

Enables TLS to secure communication between VAST Cluster and the LDAP server.

Important

The VAST Cluster TLS client is configured with the TLS_REQCERT configuration parameter set to never, which means it does not request the server's TLS certificate and ignores any certificate received. On the TLS server, make sure that TLS_REQCERT is not set to demand since VAST Cluster cannot connect to a server with TLS_REQCERT set to demand.

Verification of the server's TLS certificate will be added in a future release.

no-tls

Disables TLS secure communication between VAST Cluster and the LDAP server.

--query-groups-mode COMPATIBLE|RFC2307BIS_ONLY|RFC2307_ONLY|NONE

The mode for querying a user's auxiliary group memberships, when the auth provider is set as the source for group membership in the view policy:

  • COMPATIBLE (default). Groups are queried using an aggregate of the RFC2307BIS and RFC2307 compliant group membership queries (see the other options). You can use this default option unless you are using an authentication provider which is incompatible with this aggregated query mode.

  • RFC2307BIS only. Auxiliary group memberships are queried according to the RFC2307BIS standard, in which the group has a members attribute that contains the Distinguished Name (DN) of the member user and the user has a memberOf attribute which contains the DNs of the groups to which the user belongs. This standard is used by Active Directory and may be used with other LDAP-based authorization providers with LDAP schema extensions.

  • RFC2307 only. Auxiliary group memberships are queried according to the RFC2307 standard, in which the group object has a memberUid attribute for each user object that is a member of the group, specifying the name of the user object. This standard may be used by openLDAP, freeIPA and other LDAP-based authorization providers.

  • NONE. If this option is selected, auxiliary group memberships are not queried at all. In the event that the relevant view's view policy cites the authorization provider as the group membership source and the user tries to access a file or directory within that view to which the user only has permission as a member of a the owning user's group, permission will not be granted.

--username-property-name ATTRIBUTE

Overrides 'name' as the attribute to use for querying users in VMS user-initated user queries.

--domain-name FQDN

Fully qualified domain name (FQDN) of the domain to join

For example: --domain-name company-ad.com

--user-login-name ATTRIBUTE_NAME

Specifies the attribute used to query AD for the user login name in NFS ID mapping. Applicable only with AD and NFSv4.1.

For example: --user-login-name sAMAccountname

--group-login-name ATTRIBUTE_NAME

Specifies the attribute used to query AD for the group login name in NFS ID mapping. Applicable only with AD and NFSv4.1.

For example: --group-login-name sAMAccountname

--posix-templates AD|Open_LDAP

Sets the object classes that define user and group entries to a preset template for Active Directory or Open LDAP standard.
Example
vcli: admin> ldap create --url ldap://mydomain.local --port 389 --binddn admin@mydomain.local --bindpw !@WE56yt --searchbase ou=users,dc=mydomain,dc=local --group searchbase ou=groups,dc=mydomain,dc=local --method simple --domain-name company-ad.com uid=distinguishedName uid-member member --posix-account user --posix-group group use-tls

Related articles

Comments

0 comments

Article is closed for comments.