Chapter 8:
Authentication
184
8.1.8 Remote groups with LDAP authentication
Unlike RADIUS, LDAP has built in support for group provisioning, which makes setting up remote groups
easier. The console server will retrieve a list of all the remote groups that the user is a direct member of
and compare their names with local groups on the console server. Spaces in group name will be
converted to underscores.
For example, in an existing Active Directory setup, a group of users may be part of the
UPS Admin
and
Router Admin
groups. On the console server, these users will be required to have access to a group
Router_Admin
, with access to port 1 (connected to the router), and another group
UPS_Admin
, with access
to port 2 (connected to the UPS). Once LDAP is setup, users that are members of each group will have the
appropriate permissions to access the router and UPS.
Currently, the only LDAP directory service that supports group provisioning is Microsoft Active Directory.
Support is planned for OpenLDAP at a later time.
To enable group information to be used with an LDAP server:
1.
Complete the fields for standard LDAP authentication including LDAP Server Address, Server
Password, LDAP Base DN, LDAP Bind DN and LDAP User Name Attribute
2.
Enter memberOf for
LDAP Group Membership Attribute
as group membership is currently only
supported on Active Directory servers
3.
If required, enter the group information for
LDAP Console Server Group DN
and/or
LDAP
Administration Group DN
