apm aaa ldap
apm aaa ldap(1) BIG-IP TMSH Manual apm aaa ldap(1)
NAME
ldap - Manages an AAA LDAP server.
MODULE
apm aaa
SYNTAX
Configure the ldap component within the aaa module using the syntax
shown in the following sections.
CREATE/MODIFY
create ldap [name]
modify ldap [name]
options:
address [[ip addr] | none]
admin-dn [[string] | none]
admin-encrypted-password [[string] | none]
app-service [[string] | none]
base-dn [string]
description [[string] | none]
is-ldaps [false | true]
location-specific [true | false]
pool [name]
port [[service] | none]
schema-attr {
group-member [[string] | none]
group-member-value [[string] | none]
group-memberof [[string] | none]
group-object-class [[string]]
user-memberof [[string] | none]
user-object-class [string]
}
serverssl-profile [none | serverssl | serverssl-insecure-compatible | wom-default-serverssl]
timeout [integer]
use-pool [enabled | disabled]
edit ldap [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties
DISPLAY
list ldap
list ldap [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
app-service
non-default-properties
one-line
partition
DELETE
delete ldap [name]
DESCRIPTION
You can use the ldap component to create and manage an AAA LDAP server.
EXAMPLES
create ldap MyLDAPserver { address 172.30.6.144 admin-dn
"cn=administrator,cn=users,dc=company,dc=companynet,dc=com" admin-
encrypted-password "!MyPassword" }
Creates the AAA LDAP server named MyLDAPserver that is assigned
the IP address 172.30.6.144 and the
cn=administrator,cn=users,dc=company,dc=companynet,dc=com admin dn
with a password of !MyPassword.
delete ldap MyLDAPServer
Deletes the AAA LDAP server named MyLDAPServer from the system.
OPTIONS
address
Specifies the IP address of an AAA LDAP server. This option is
required.
admin-dn
Specifies the Container Distinguished Name (DN) to use for
authentication. This option is required.
admin-encrypted-password
Specifies the password for admin name. This option is required.
app-service
Specifies the name of the application service to which the object
belongs. The default value is none. Note: If the strict-updates
option is enabled on the application service that owns the object,
you cannot modify or delete the object. Only the application
service can modify or delete the object.
base-dn
Specifies the base DN from which to search. This search DN is used
to search groups across a whole directory.
group-cache-ttl
Specifies a lifetime for the group cache (days).
cleanup-cache
Specifies whether cache invalidation is required. The default is
none. The options are:
none
group
description
Specifies a unique description for the server. The default is
none.
is-ldaps
Specifies whether to use the LDAPS protocol during authentication.
If true, you must also specify the option serverssl-profile.
location-specific
Specifies whether or not this object contains one or more
attributes with values that are specific to the location where the
BIG-IP device resides. The location-specific attribute is either
true or false. When using policy sync, mark an object as location-
specific to prevent errors that can occur when policies reference
objects, such as authentication servers, that are specific to a
certain location.
[name]
Specifies the name of the AAA server. This option is required.
partition
Displays the partition within which the component resides.
pool Specifies the name of the pool with which the server is
associated. The default is none.
port Specifies the port number of the AAA LDAP server. The default is
ldap. This option is required.
schema-attr
Specifies LDAP schema-specific attribute names.
user-object-class The value of the objectClass attribute for a
user object. The default is "user".
user-memberof If the user object maintains a group membership, you
should specify the membership attribute name here. The default is
"memberOf".
group-object-class The value of the objectClass attribute for a
group object. The default is "group".
group-memberof If the group object maintains a group membership in
other groups, you should specify a membership attribute name here.
The default is "memberOf".
group-member If the group object maintains a list of users that
belong to the group, you should specify the attribute here. The
default is "member".
group-member-value If the "group-member" attribute is specified,
you should specify the attribute that is used to add users into a
group. The default is "dn".
serverssl-profile
Specifies the server side SSL profile. LDAPS is achieved by
directing LDAP traffic over a virtual server that uses a server
side SSL to communicate with the LDAP server.
The options are:
serverssl
serverssl-insecure-compatible
wom-default-serverssl
timeout
Specifies a timeout interval (in seconds) for the AAA server after
which the server closes a connection. The default is 15.
use-pool
Enables or disables high availability between pool members. When
enabled, the Access Policy Manager sends AAA requests for the
associated policy item to the virtual server, and standard pool
behavior is used to implement high availability for CRDLP.
SEE ALSO
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or
by any means, electronic or mechanical, including photocopying,
recording, or information storage and retrieval systems, for any
purpose other than the purchaser's personal use, without the express
written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2011-2012. All rights reserved.
BIG-IP 2014-10-27 apm aaa ldap(1)