Setting

Description

Name

Enter a meaningful name to help you identify the LDAP directory server.

Examples:
Example Company Staff Directory
Example Company Corporate LDAP

Hostname

The hostname of your directory server.

Examples:
ad.example.com
ldap.example.com
opends.example.com

Port

The port on which your directory server is listening.

Examples:
389
10389
636 (for example, for SSL)

Encryption

Check this if the connection to the directory server is an SSL (Secure Sockets Layer) connection.

Note: You will need to configure an SSL certificate to use this setting.

None
TLS/SSL
TLS/SSL Without Certificate Verification
StartTLS
StartTLS Without Certificate Verification

Server Retries

The number of times an attempt will be made to contact the remote server. The default is set to 3.

Server Timeout

The number of seconds to wait for a response from the remote server. The default is set to 10 seconds.

Base Distinguished Name

The root of the directory tree from which to perform user and group searches.

Note: This value will be appended to the User Search Base and Group Search Base fields. If this field is empty, the full Base DN should be specified in User Search Base and Group Search Base.

Example:
DC=somedomain,DC=com

Bind Distinguished Name

The distinguished name of the user that the application will use when connecting to the directory server.

Note: This account needs permission to perform searches on the remote authentication server

Examples:
cn=administrator,cn=users,dc=ad,dc=example,dc=com
cn=user,dc=domain,dc=name
user@domain.name

Bind Password

The password of the user specified above.

Setting

Description

User Search Base

The location in the directory tree from which user searches are performed. If the Base Distinguished Name is empty, this entry should be the full directory path; otherwise, this is a relative path and is prepended to the Base Distinguished Name.

Examples:

CN=Users,DC=jwadtest,DC=somedomain,DC=com

User Search Filter

The LDAP search query to be used for finding the authenticating user. The authenticating username will be substituted for the placeholder string "{0}".

Examples:

samaccountname={0}

First Name Attribute

The attribute in the search results that contains the authenticating user's first name. The value for this attribute will be added to the user entry when it is created during the first successful authentication.

Examples:

givenName

Last Name Attribute

The attribute in the search results that contains the authenticating user's first name. The value for this attribute will be added to the user entry when it is created during the first successful authentication.

Examples:

sn

Email Attribute

The attribute in the search results that contains the authenticating user's email address. The value for this attribute will be added to the user entry when it is created during the first successful authentication.

Examples:

mail

Setting

Description

Group Search Base

The location in the directory tree from which user searches are performed. If the Base Distinguished Name is empty, this entry should be the full directory path; otherwise, this is a relative path and is prepended to the Base Distinguished Name.

Examples:

OU=Groups,DC=jwadtest,DC=somedomain,DC=com

Group Search Filter

The LDAP search query to be used for finding user groups. The returned user groups can then be mapped to Security Manager groups on the User Group administration screen. Additionally, if the Group Members Attribute is set, this filter is used to obtain the authenticating user's potential groups.

Examples:

(objectClass=group)

Search Subtree

Indicates whether group searches should be limited to a single level within the tree (unchecked) or if they should traverse completely down the hierarchy (checked). If there are a large number of groups and/or a deep hierarchy, subtree searches may not perform as efficiently as a single level search.

Setting

Description

Group Members Attribute

An optional attribute on the groups returned via the Group Search Filter that indicates the members of the group. It is recommended that when possible, the User Membership Attribute should be used instead of this for better performance.

Examples:

member

User Membership Attribute

An optional attribute on the user entry that indicates the group membership of the authenticating user. Not all LDAP servers support this, but when they do, it is recommended to use it rather than the Group Members Attribute for better performance.

Examples:

memberOf