210
1.877.877.2269
BLACKBOX.COM
NEED HELP?
LEAVE THE TECH TO US
LIVE 24/7
TECHNICAL
SUPPORT
1.877.877.2269
CHAPTER 10: AUTHENTICATION
OpenLDAP/POSIX method 2
Each group entry in the group tree of objectClass posixGroup may have multiple memberUid attributes. These represent secondary
groups (for example, mapping to the /etc/groups file). Each attribute would contain a username.
To cater for all these possibilities, the pam_ldap module has been modified to do group lookups for each of these three styles. This
allows us to have a relatively generic configuration, and not be concerned with how the LDAP directory is set up.
There are only two parameters that need to be configured, based on what the user wishes to look up: the LDAP username and
group membership attributes.
To clarify to the user what parameters to use, the descriptions for these fields have been updated to prompt the user for common
or likely attributes. For example, the two configuration fields have descriptions as follows:
LDAP Username Attribute: the LDAP attribute that corresponds to the login name of the user (commonly ‘sAMAccountName’ for
Active Directory, and ‘uid’ for OpenLDAP).
LDAP Group Membership Attribute: the LDAP attribute that indicates group membership in a user record (commonly ‘memberOf’
for Active Directory, and unused for OpenLDAP).
FIGURE 10-4.
NOTE: The libldap library is fussy about ensuring SSL connections are using certificates signed by a trusted CA. Consequently it is
often not easy to set up a connection to an LDAP server using SSL.
Perform the following procedure to configure the LDAP authentication method to be used whenever the console server or any of its
serial ports or hosts is accessed:
Navigate to Serial & Network > Authentication.
Check LDAP or LocalLDAP or LDAPLocal or LDAPDownLocal.
