settings ldap

The settings ldap command configures the verification of the users over a directory server when signing in to the management interface and to the WEB-CLI. The same setting also provides for the e-mail and telephone information of the users to be read from the directory.

Command Summary

TR7 WEB-CLI · settings ldap

# Tab after the command

admin@TR7LBWAF01> settings ldap

show update

 

admin@TR7LBWAF01> settings ldap show # show the settings

admin@TR7LBWAF01> settings ldap update … # change

admin@TR7LBWAF01>  

The Server Fields

This resource is a single setting: no identifier is written, update is run directly and only the fields to be changed are given.

Field	What it does	What is written after it
--host	Determines the directory server the verification will be done on	The server name or IP address. According to the explanation in the schema, the port is not written in this field
--port	Determines the port of the server	A port number
--isTls	Turns on connecting to the server encrypted	true · false (the default is false)
--baseDn	Determines which branch the search will start under	A directory path (Base DN)

The Binding Method

Field	What it does	What is written after it
--bindMethod	Selects how the user will connect to the directory	pattern — the sign-in name is produced from a pattern, the typical method for Active Directory (the default) · searchFirst — the user is first searched for in the directory and the sign-in is done with the record found; for directories such as OpenLDAP where the sign-in name is not part of the DN of the record
--principalPattern	Determines which pattern the sign-in name will be produced from in the pattern method	The pattern in which $USERNAME is written in place of the user name, for example $USERNAME@companyX.com
--bindRestrictionFilter	Applies a filter so that only certain users can sign in	A directory filter, for example (memberOf=CN=AppUsers,CN=Groups,DC=company,DC=com). When it is left empty, no restriction is applied

The Query User

A separate account can be used for searching in the directory. When a query user is given, the password and the search branch become required.

Field	What it does	What is written after it
--queryUsername	Determines the account that will search in the directory	A user name. When it is left empty, the search is done anonymously
queryUserPassword	Determines the password of that account	It is not written on the command line. When --queryUsername is written, it is asked after the command on the LDAP query user password: line, without appearing on the screen
--querySearchBase	Determines which branch the search will be done under	A directory path, for example CN=users,.... It is required in the schema while --queryUsername is filled
--queryMailField	Determines which directory attribute the e-mail address of the user will be read from	An attribute name; more than one attribute is separated by a semicolon
--queryPhoneField	Determines which directory attribute the telephone number of the user will be read from	An attribute name; its default is telephoneNumber;Mobile;homePhone

Examples

TR7 WEB-CLI · A) Active Directory

admin@TR7LBWAF01> settings ldap update --host dc.kurum.local --port 636 --isTls true \

--bindMethod pattern --principalPattern '$USERNAME@kurum.local' \

--baseDn "DC=kurum,DC=local"

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) Search first, then bind

admin@TR7LBWAF01> settings ldap update --host ldap.kurum.local --port 389 \

--bindMethod searchFirst --baseDn "dc=kurum,dc=local" \

--queryUsername "cn=tr7,ou=servis,dc=kurum,dc=local" \

--querySearchBase "ou=kullanicilar,dc=kurum,dc=local"

LDAP query user password: # the characters typed do not appear on the screen

 

# only the users in one group should be able to sign in

admin@TR7LBWAF01> settings ldap update \

--bindRestrictionFilter "(memberOf=CN=AppUsers,CN=Groups,DC=kurum,DC=local)"

admin@TR7LBWAF01>  

Things to Know

• The binding method is selected according to the type of the directory. In the pattern method the sign-in name is produced from a pattern; this is the typical behavior of Active Directory setups. In the searchFirst method the user is first searched for in the directory and the sign-in is done with the record found — this method is needed in directories such as OpenLDAP where the sign-in name is not part of the DN of the record.
• $USERNAME is written in the pattern in place of the user name. In the --principalPattern value, $USERNAME is replaced with the name of the user signing in. So that the shell does not interpret it as a variable, the value is written inside single quotation marks.
• The password of the query user is asked hidden. When --queryUsername is written, the CLI asks for the password of the account after the command is run, without it appearing on the screen; the password is not written on the command line. In the same situation --querySearchBase also becomes required in the schema. When the account is not given, the search is done anonymously.
• The restriction filter is optional. When --bindRestrictionFilter is left empty, all the users in the directory can sign in; when a filter is given, only those that match the filter can connect.
• The attribute fields are for the contact information. The values read with --queryMailField and --queryPhoneField are needed so that the two-factor authentication can reach the user; the related setting is in the settings access command.
• The opening of the users is a separate setting. Whether the user verified with the directory will be opened by itself on the device is determined in the settings user-management command; ldap must be added to the source list there.
• The directory paths require quotation marks. DN values that carry a space or a comma are written inside double quotation marks.