apm policy agent aaa-ldap
apm policy agent aaa-ldap(1) BIG-IP TMSH Manual apm policy agent aaa-ldap(1)
NAME
aaa-ldap - Manages an AAA LDAP(r) agent.
MODULE
apm policy agent
SYNTAX
Configure the aaa-ldap component within the policy agent module using the following syntax.
CREATE/MODIFY
create aaa-ldap [name]
modify aaa-ldap [name]
options:
app-service [[string] | none]
attr-name ( | none) [add | delete]
filter [[string] | none]
group-member-scope [none | direct | all]
group-membership-scope [none | direct | all]
max-logon-attempt [integer]
search-dn [[string] | none]
server [[string] | none]
show-extended-error [true | false]
type [query | auth | modify | last]
user-dn [[string] | none]
modify-type [add | modify | delete | modify-last]
ldapmod-attributes ( | none) [add | delete]
DISPLAY
list aaa-ldap
list aaa-ldap [ [ [name] | [glob] | [regex] ] ... ]
show running-config aaa-ldap
show running-config aaa-ldap [ [ [name] | [glob] | [regex] ] ... ]
options:
all
all-properties
current-module
non-default-properties
one-line
app-service
partition
DELETE
delete aaa-ldap [name]
DESCRIPTION
Use this component to create, modify, display, or delete an AAA LDAP agent.
EXAMPLES
create aaa-ldap MyLDAPagent { user-dn "cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=com" type auth server
"companyLDAP" } aaa-ldap MyLDAPagent { search-dn "cn=users,dc=lab,dc=fp,dc=com" filter
"(SAMAccountName=%{{session.logon.last.username})" type auth server "companyLDAP" }
Creates the authorization type AAA LDAP agent named MyLDAPagent that is associated with the companyLDAP server that
uses the cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=f5net,dc=com user domain name, the
cn=users,dc=lab,dc=fp,dc=com search domain, and the (SAMAccountName=%{{session.logon.last.username}) filter.
create aaa-ldap MyLDAPagent { search-dn "cn=users,dc=lab,dc=fp,dc=com" filter
"(sAMAccountName=%{{session.logon.last.username})" type query server "companyLDAP" }
Creates the query type AAA LDAP agent named MyLDAPagent that is associated with the companyLDAP server that uses the
cn=users,dc=lab,dc=fp,dc=com search domain and the (SAMAccountName=%{{session.logon.last.username}) filter.
create aaa-ldap MyLDAPagent { user-dn "cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=com" type modify modify-
type add server "companyLDAP" ldapmod-attributes add { objectClass { mod-op add mod-values add { top person
organizationalPerson user } } cn { mod-op add mod-values add { demo } } } }
Creates the modify type AAA LDAP agent named MyLDAPagent that is associated with the companyLDAP server that uses the
cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=f5net,dc=com user domain name, the add modify type, and the
ldapmod attributes
create aaa-ldap MyLDAPagent { user-dn "cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=com" type modify modify-
type modify server "companyLDAP" ldapmod-attributes add { givenName { mod-op replace mod-values add { demo } } } }
Creates the modify type AAA LDAP agent named MyLDAPagent that is associated with the companyLDAP server that uses the
cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=f5net,dc=com user domain name, the modify modify type, and
the ldapmod attributes which uses givenName modify attribute replace mod operation and the demo mod values
create aaa-ldap MyLDAPagent { user-dn "cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=com" type modify modify-
type delete server "companyLDAP" }
Creates the modify type AAA LDAP agent named MyLDAPagent that is associated with the companyLDAP server that uses the
cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=f5net,dc=com user domain name, the delete modify type
list aaa-ldap
Displays a list of AAA LDAP agents.
delete aaa-ldap MyLDAPagent
Deletes the MyLDAPagent AAA LDAP agent.
OPTIONS
app-service
Specifies the name of the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the application service that owns the object, you cannot modify or delete the
object. Only the application service can modify or delete the object.
attr-name
Adds an attribute name to the agent or deletes an attribute name from the agent.
group-member-scope
Specifies the scope of user lookup for a group. When the search returns a group, this attribute specifies whether to
also look up the members of the group. The options are:
none No members required.
direct Only direct members required.
all All members required. This includes those that derive membership in this group through membership in other groups
and those that are direct members.
group-membership-scope
Specifies the scope of group lookup for a user or a group. When the search returns a user or a group, this attribute
specifies whether to also look up the groups to which this user or group belong. The options are:
none No groups required.
direct Only the groups to which the current user or group belong directly are required.
all All groups required. This includes the groups to which the user or the group belong directly and the groups to
which the user or group belong indirectly (through membership in another group).
filter
Specifies the LDAP filter that APM uses when querying an AAA LDAP server for authentication information. You must use
the filter option with the search-dn option.
max-logon-attempt
Specifies the maximum number of opportunities that users have to re-enter credentials after their first attempt to log
in fails. If you set this value to a number from 2 to 5 inclusive, the system allows users the specified number of
opportunities to log in after the first attempt to log in fails. If you set the value to 1, the system does not allow
a second log in opportunity after a first log in attempt fails. The default value is 3.
[name]
Specifies the name of an AAA LDAP agent. This setting is required.
partition
Displays the partition within which the component resides.
search-dn
Specifies the base domain name that APM uses for internal LDAP search operations. You must use the search-dn option
with the filter option.
server
Specifies the AAA LDAP server that the system uses for LDAP queries and authentication.
show-extended-error
Specifies to display a verbose error message. The default value is false.
type Specifies a type of AAA LDAP agent. This setting is required. The default is last.
user-dn
Specifies the fully qualified domain name of the Access Policy Manager. F5 Networks recommends that you specify this
value in lower case and without spaces for compatibility with some specific LDAP servers. The specific content of this
string depends on your directory layout.
SEE ALSO
tmsh
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or by any means, electronic or mechanical, including
photocopying, recording, or information storage and retrieval systems, for any purpose other than the purchaser's personal
use, without the express written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2011-2014, 2016. All rights reserved.
BIG-IP 2016-03-14 apm policy agent aaa-ldap(1)