apm aaa active-directory
apm aaa active-directory(1) BIG-IP TMSH Manual apm aaa active-directory(1)
NAME
active-directory - Manages an authentication access policy (AAA) Active
Directory(r) server.
MODULE
apm aaa
SYNTAX
Configure the active-directory component within the aaa module using
the syntax shown in the following sections.
CREATE/MODIFY
create active-directory [name]
modify active-directory [name]
options:
admin-encrypted-password [[string] | none]
admin-name [[string] | none]
app-service [[string] | none]
cleanup-cache [pso | group | none]
description [[string] | none]
domain [[string] | none]
domain-controller [[string] | none]
domain-controllers [add | delete | modify | replace-all-with] {
[name] {
ip [ip address]
}
}
group-cache-ttl [integer]
domain-controllers none
location-specific [true | false]
pool [name]
pso-cache-ttl [integer]
padata [encryption type]
timeout [integer]
edit active-directory [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties
DISPLAY
list active-directory
list active-directory [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
app-service
non-default-properties
one-line
partition
DELETE
delete active-directory [name]
DESCRIPTION
You can use the active-directory component to manage an AAA Active
Directory server. The Active Directory is a network structure
supported by Windows(r) 2000, or later, that provides support for
tracking and locating any object on a network.
EXAMPLES
create active-directory MyADserver { domain-controller
"server01.company.com domain "company.com " admin-name "administrator"
admin-encrypted-password "!My123Password" }
Creates the AAA Active Directory server named MyADserver in the
company.dom domain, sets the administrator logon name to
administrator and the administrator password to !My123Password,
and sets the Key Distribution Center to company.com.
delete active-directory MyActiveDirectoryServer
Deletes the AAA Active Directory server named
MyActiveDirectoryServer from the system.
OPTIONS
admin-encrypted-password
Specifies the password associated with admin name. This option is
required only when you are using an Active Directory Query agent
with this Active Directory server object.
admin-name
Specifies the user name that has administrative permissions on an
AAA Active Directory server. This option is required only when you
are using an Active Directory Query agent with this Active
Directory server object.
app-service
Specifies the name of the application service to which the object
belongs. The default value is none. Note: If the strict-updates
option is enabled on the application service that owns the object,
you cannot modify or delete the object. Only the application
service can modify or delete the object.
cleanup-cache
Specifies if this is a cache cleanup request. You can cleanup
Group cache or PSO cache.
description
Specifies a description for the component. The default is none.
domain
Specifies the Active Directory domain name. This setting is
required.
[name]
Specifies the name of an AAA Active Directory server. This setting
is required.
domain-controller
Specifies the fully qualified domain name (FQDN) of the domain
controller for the domain specified in the domain option. The
default is none.
domain-controllers
Adds, deletes, or replaces a set of domain controllers, by
specifying an FQDN for each entry. You can configure the following
options for each domain controller:
ip An IP address for specified domain controller entry.
group-cache-ttl
Specifies group cache lifetime in days [0..1825]. The default
value is 30. If you specify group cache lifetime 0, that means
cache will be updated on every request.
pso-cache-ttl
Specifies password security objects (PSO) Cache lifetime in days
[0..1825]. The default value is 30. If you specify PSO cache
lifetime 0, that means cache will be updated on every request.
location-specific
Specifies whether or not this object contains one or more
attributes with values that are specific to the location where the
BIG-IP device resides. The location-specific attribute is either
true or false. When using policy sync, mark an object as location-
specific to prevent errors that can occur when policies reference
objects, such as authentication servers, that are specific to a
certain location.
pool Specifies the name of the pool with which the server is
associated. The default is none.
partition
Displays the partition within which the component resides. The
default is Common.
padata
Specifies a Kerberos preauthentication encryption type. If it is
specified, the BIG-IP system includes Kerberos preauthentication
data within the first AS-REQ. If you do not need to include
preauthentication data, set this option to "none". Supported
encryption types: none, des-cbc-crc, des-cbc-md5,
aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96, rc4-hmac. The
default is rc4-hmac.
timeout
Specifies a timeout interval (in seconds) after which an AAA
Active Directory server closes a connection. The default is 15.
SEE ALSO
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or
by any means, electronic or mechanical, including photocopying,
recording, or information storage and retrieval systems, for any
purpose other than the purchaser's personal use, without the express
written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2011-2013, 2015. All rights
reserved.
BIG-IP 2016-01-07 apm aaa active-directory(1)