apm aaa crldp

apm aaa crldp(1)					BIG-IP TMSH Manual					  apm aaa crldp(1)

NAME
       crldp - Configure a Certificate Revocation List Distribution Point (CRDLP) server object for implementing a CRLDP
       authentication module.

MODULE
       apm aaa

SYNTAX
       Configure the crldp component within the aaa module using the syntax shown in the following sections.

   CREATE/MODIFY
	create crldp [name]
	modify crldp [name]
	  options:
	    address [ip addr]
	    allow-nullcrl [true | false]
	    app-service [[string] | none]
	    base-dn [[string> | none]
	    cache-expire [[integer] | none]
	    connection-timeout [[integer] | none]
	    description [[string> | none]
	    location-specific [true | false]
	    pool [name]
	    port [[integer] | none]
	    reverse-dn [true | false]
	    use-issuer [true | false]
	    use-pool [enabled | disabled]
	    verify-sig [true | false]

	edit crldp | [glob] | [regex] ] ... ]
	  options:
	    all-properties
	    non-default-properties

   DISPLAY
	list crldp
	list crldp [ [ [name] | [glob] | [regex] ] ... ]
	  options:
	    all-properties
	    app-service
	    non-default-properties
	    one-line
	    partition

   DELETE
	delete crldp [name]

DESCRIPTION
       Configure a CRLDP authentication server, and then assign the server to the CRLDP auth agent in your access policy.

EXAMPLES
       create crldp aaa-ldap-2027 { address 172.27.32.60 allow-nullcrl false base-dn DC=net,DC=aina,DC=test cache-expire 1000
       connection-timeout 15 description none partition Common pool aaa-ldap-2027-pool port ldap reverse-dn true use-issuer false
       use-pool disabled verify-sig true }
	    Creates a CRLDP server named aaa-ldap-2027.

       delete crldp server my_crldp_server
	    Deletes the CRLDP server named my_crldp_server.

OPTIONS
       address
	    Specifies the IP address of the server. This option is required.

       allow-nullcrl
	    Specifies whether to consider a null CRL from the CRLDP server a successful authentication. The default is false.

       app-service
	    Specifies the name of the application service to which the object belongs. The default value is none. Note: If the
	    strict-updates option is enabled on the application service that owns the object, you cannot modify or delete the
	    object. Only the application service can modify or delete the object.

       base-dn
	    Specifies the LDAP base directory name for certificates that specify the CRL distribution point in directory name
	    (dirName) format. Used when the value of the X509v3 attribute crlDistributionPoints is of type dirName. In this case,
	    the BIG-IP system attempts to match the value of the crlDistributionPoints attribute to the Base DN value. An example
	    of a Base DN value is cn=lxxx,dc=f5,dc=com.

       cache-expire
	    Specifies (in seconds) an update interval for CRL distribution points. The update interval for distribution points
	    ensures that CRL status is checked at regular intervals, regardless of the CRL timeout value. This helps prevent CRL
	    information from becoming outdated before the Access Policy Manager checks the status of a certificate.

       connection-timeout
	    Specifies the number of seconds of inactivity the system allows before the connection times out. The default is 15.

       description
	    Specifies a unique description for the server. The default is none.

       partition
	    Displays the partition within which the component resides.

       location-specific
	    Specifies whether or not this object contains one or more attributes with values that are specific to the location
	    where the BIG-IP device resides. The location-specific attribute is either true or false. When using policy sync, mark
	    an object as location-specific to prevent errors that can occur when policies reference objects, such as
	    authentication servers, that are specific to a certain location.

       pool Specifies the name of the pool with which the server is associated.

       port Specifies the CRLDP service port. The default is 389.

       reverse-dn
	    Specifies in which order the system is to attempt to match the Base DN value to the value of the X509v3 attribute
	    crlDistributionPoints. Possible values are enabled and disabled. When set to enabled, the system matches the base DN
	    from left to right, or from the beginning of the DN string, to accomodate dirName strings in certificates such as
	    C=US,ST=WA,L=SEA,OU=F5,CN=xxx. The default value is false.

       use-issuer
	    Specifies whether the CRL distribution point is extracted from the certificate of the client certificate issuer. The
	    default is false.

       use-pool
	    Enables or disables high availability between CRLDP servers. When enabled, Access Policy Manager sends CRLDP
	    authentication requests for the associated CRLDP auth agent to the virtual server, and standard pool behavior is used
	    to implement high availability for CRDLP.

       verify-sig
	    Specifies whether the signature on the received CRL is verified. The default if true.

SEE ALSO
COPYRIGHT
       No part of this program may be reproduced or transmitted in any form or by any means, electronic or mechanical, including
       photocopying, recording, or information storage and retrieval systems, for any purpose other than the purchaser's personal
       use, without the express written permission of F5 Networks, Inc.

       F5 Networks and BIG-IP (c) Copyright 2011-2013, 2016. All rights reserved.

BIG-IP							    2016-03-14						  apm aaa crldp(1)