apm aaa active-directory
apm aaa active-directory(1) BIG-IP TMSH Manual apm aaa active-directory(1)
NAME
active-directory - Manages an authentication access policy (AAA) Active Directory(r) server.
MODULE
apm aaa
SYNTAX
Configure the active-directory component within the aaa module using the syntax shown in the following sections.
CREATE/MODIFY
create active-directory [name]
modify active-directory [name]
options:
admin-encrypted-password [[string] | none]
admin-name [[string] | none]
app-service [[string] | none]
cleanup-cache [pso | group | kerberos | none]
description [[string] | none]
domain [[string] | none]
domain-controller [[string] | none]
domain-controllers [add | delete | modify | replace-all-with] {
[name] {
ip [ip address]
}
}
group-cache-ttl [integer]
domain-controllers none
location-specific [true | false]
pool [name]
pso-cache-ttl [integer]
padata [encryption type]
timeout [integer]
edit active-directory [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties
DISPLAY
list active-directory
list active-directory [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
app-service
non-default-properties
one-line
partition
DELETE
delete active-directory [name]
DESCRIPTION
You can use the active-directory component to manage an AAA Active Directory server. The Active Directory is a network
structure supported by Windows(r) 2000, or later, that provides support for tracking and locating any object on a network.
EXAMPLES
create active-directory MyADserver { domain-controller "server01.company.com domain "company.com " admin-name
"administrator" admin-encrypted-password "!My123Password" }
Creates the AAA Active Directory server named MyADserver in the company.dom domain, sets the administrator logon name
to administrator and the administrator password to !My123Password, and sets the Key Distribution Center to
company.com.
delete active-directory MyActiveDirectoryServer
Deletes the AAA Active Directory server named MyActiveDirectoryServer from the system.
OPTIONS
admin-encrypted-password
Specifies the password associated with admin name. This option is required only when you are using an Active Directory
Query agent with this Active Directory server object.
admin-name
Specifies the user name that has administrative permissions on an AAA Active Directory server. This option is required
only when you are using an Active Directory Query agent with this Active Directory server object.
app-service
Specifies the name of the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the application service that owns the object, you cannot modify or delete the
object. Only the application service can modify or delete the object.
cleanup-cache
Specifies whether this is a cache cleanup request. You can clean up the group, PSO or Kerberos cache. The default
value is none.
description
Specifies a description for the component. The default is none.
domain
Specifies the Active Directory domain name. This setting is required.
[name]
Specifies the name of an AAA Active Directory server. This setting is required.
domain-controller
Specifies the fully qualified domain name (FQDN) of the domain controller for the domain specified in the domain
option. The default is none.
domain-controllers
Adds, deletes, or replaces a set of domain controllers, by specifying an FQDN for each entry. You can configure the
following options for each domain controller:
ip An IP address for specified domain controller entry.
group-cache-ttl
Specifies group cache lifetime in days [0..1825]. The default value is 30. If you specify group cache lifetime 0,
that means cache will be updated on every request.
pso-cache-ttl
Specifies password security objects (PSO) Cache lifetime in days [0..1825]. The default value is 30. If you specify
PSO cache lifetime 0, that means cache will be updated on every request.
location-specific
Specifies whether or not this object contains one or more attributes with values that are specific to the location
where the BIG-IP device resides. The location-specific attribute is either true or false. When using policy sync, mark
an object as location-specific to prevent errors that can occur when policies reference objects, such as
authentication servers, that are specific to a certain location.
pool Specifies the name of the pool with which the server is associated. The default is none.
partition
Displays the partition within which the component resides. The default is Common.
padata
Specifies a Kerberos preauthentication encryption type. If it is specified, the BIG-IP system includes Kerberos
preauthentication data within the first AS-REQ. If you do not need to include preauthentication data, set this option
to "none". Supported encryption types: none, des-cbc-crc, des-cbc-md5, aes128-cts-hmac-sha1-96,
aes256-cts-hmac-sha1-96, rc4-hmac. The default is rc4-hmac.
timeout
Specifies a timeout interval (in seconds) after which an AAA Active Directory server closes a connection. The default
is 15.
SEE ALSO
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or by any means, electronic or mechanical, including
photocopying, recording, or information storage and retrieval systems, for any purpose other than the purchaser's personal
use, without the express written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2011-2013, 2015. All rights reserved.
BIG-IP 2017-07-13 apm aaa active-directory(1)