209
1.877.877.2269
BLACKBOX.COM
NEED HELP?
LEAVE THE TECH TO US
LIVE 24/7
TECHNICAL
SUPPORT
1.877.877.2269
CHAPTER 10: AUTHENTICATION
FIGURE 10-3.
In addition to multiple remote servers, you can also enter separate lists of Authentication and Authorization servers and Accounting
servers.
If no Accounting servers are specified, the Authentication and Authorization servers are used instead.
Enter the Server Password.
Click Apply.
RADIUS remote authentication will now be used for all user access to console server and serially or network attached devices.
10.1.4 LDAP AUTHENTICATION
The Lightweight Directory Access Protocol (LDAP) is based on the X.500 standard, but is significantly simpler and more readily
adapted to meet custom needs. The core LDAP specifications are all defined in RFCs. LDAP is a protocol used to access information
stored in an LDAP server.
With firmware v3.11 and later, LDAP authentication now supports OpenLDAP servers, using the POSIX -style schema for user and
group definitions.
Performing simple authentication against any LDAP server (AD or OpenLDAP) is straight forward, as they both follow the common
LDAP standards and protocols. The harder part is configuring how to get the extra data about the users (for example, the groups they
are in).
On an Black Box device, we may be configured to look at group information from an LDAP server for authentication and authorization.
This group information is potentially stored in a number of different ways. Active Directory has one method; OpenLDAP has two
others.
Active Directory method
Each entry for a user will have multiple memberOf attributes. Each memberOf value is the full DN of the group they belong to. (The
entry for the user will be of objectClass user.)
OpenLDAP/POSIX method 1
Each entry for a user must have a gidNumber attribute. This will be an integer value, which is the user’s primary group (for example,
mapping to the /etc/passwd file, with the group ID field).
To determine which group this is, search for an entry in the directory that has that group ID, which will give the group name. (The
users are of objectClass posixAccount, and the groups are of objectClass posixGroup.)
