LDAP Servers
Managing Authentication Servers
page 29-24
OmniSwitch AOS Release 7 Network Configuration Guide
June 2013
Dynamic Logging
Dynamic logging can be performed by an LDAP-enabled directory server if an LDAP server is config-
ured
first
in the list of authentication servers configured through the
command.
Any other servers configured are used for accounting (storing history records) only. For example:
-> aaa accounting session ldap2 rad1 rad2
In this example, server
ldap2
is used for dynamic logging, and servers
rad1
and
rad2
is used for
accounting.
If you specify a RADIUS server first, all of the servers specified is used for recording history records (not
logging). For example:
-> aaa accounting session rad1 ldap2
In this example, both the
rad1
and
ldap2
servers is used for history only. Dynamic logging does not take
place on the LDAP server.
Dynamic entries are stored in the LDAP-enabled directory server database from the time the user
successfully logs in until the user logs out. The entries are removed when the user logs out.
•
Entries are associated with the switch the user is logged into.
•
Each dynamic entry contains information about the user connection. The related attribute in the server
is bop-loggedusers.
A specific object class called
alcatelBopSwitchLogging
contains three attributes as follows:
Each switch that is connected to the LDAP-enabled directory server has a DN starting with
bop-basemac-
xxxxx
, ou=bop-logging. If the organizational unit ou=bop.logging exists somewhere in the
tree under searchbase, logging records are written on the server. See the documentation of the server
manufacturer for more information about setting up the server.
Attribute
Description
bop-basemac
MAC range, which uniquely identifies the switch.
bop-switchname
Host name of the switch.
bop-loggedusers
Current activity records for every user logged
onto the switch identified by bop-basemac.