apm aaa active-directory
apm aaa active-directory(1) BIG-IP TMSH Manual apm aaa active-directory(1)
NAME
active-directory - Manages an authentication access policy (AAA) Active Directory(r) server.
MODULE
apm aaa
SYNTAX
Configure the active-directory component within the aaa module using the syntax shown in the following
sections.
CREATE/MODIFY
create active-directory [name]
modify active-directory [name]
options:
admin-encrypted-password [[string] | none]
admin-name [[string] | none]
app-service [[string] | none]
cleanup-cache [pso | group | kerberos | none]
description [[string] | none]
domain [[string] | none]
domain-controller [[string] | none]
domain-controllers [add | delete | modify | replace-all-with] {
[name] {
ip [ip address]
}
}
group-cache-ttl [integer]
domain-controllers none
location-specific [true | false]
pool [name]
pso-cache-ttl [integer]
padata [encryption type]
timeout [integer]
edit active-directory [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties
DISPLAY
list active-directory
list active-directory [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
app-service
non-default-properties
one-line
partition
DELETE
delete active-directory [name]
DESCRIPTION
You can use the active-directory component to manage an AAA Active Directory server. The Active Directory is
a network structure supported by Windows(r) 2000, or later, that provides support for tracking and locating
any object on a network.
EXAMPLES
create active-directory MyADserver { domain-controller "server01.company.com domain "company.com " admin-name
"administrator" admin-encrypted-password "!My123Password" }
Creates the AAA Active Directory server named MyADserver in the company.dom domain, sets the
administrator logon name to administrator and the administrator password to !My123Password, and sets the
Key Distribution Center to company.com.
delete active-directory MyActiveDirectoryServer
Deletes the AAA Active Directory server named MyActiveDirectoryServer from the system.
OPTIONS
admin-encrypted-password
Specifies the password associated with admin name. This option is required only when you are using an
Active Directory Query agent with this Active Directory server object.
admin-name
Specifies the user name that has administrative permissions on an AAA Active Directory server. This
option is required only when you are using an Active Directory Query agent with this Active Directory
server object.
app-service
Specifies the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
cleanup-cache
Specifies whether this is a cache cleanup request. You can clean up the group, PSO or Kerberos cache. The
default value is none.
description
Specifies a description for the component. The default is none.
domain
Specifies the Active Directory domain name. This setting is required.
[name]
Specifies the name of an AAA Active Directory server. This setting is required.
domain-controller
Specifies the fully qualified domain name (FQDN) of the domain controller for the domain specified in the
domain option. The default is none.
domain-controllers
Adds, deletes, or replaces a set of domain controllers, by specifying an FQDN for each entry. You can
configure the following options for each domain controller:
ip An IP address for specified domain controller entry.
group-cache-ttl
Specifies group cache lifetime in days [0..1825]. The default value is 30. If you specify group cache
lifetime 0, that means cache will be updated on every request.
pso-cache-ttl
Specifies password security objects (PSO) Cache lifetime in days [0..1825]. The default value is 30. If
you specify PSO cache lifetime 0, that means cache will be updated on every request.
location-specific
Specifies whether or not this object contains one or more attributes with values that are specific to the
location where the BIG-IP device resides. The location-specific attribute is either true or false. When
using policy sync, mark an object as location-specific to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specific to a certain location.
pool Specifies the name of the pool with which the server is associated. The default is none.
partition
Displays the partition within which the component resides. The default is Common.
padata
Specifies a Kerberos preauthentication encryption type. If it is specified, the BIG-IP system includes
Kerberos preauthentication data within the first AS-REQ. If you do not need to include preauthentication
data, set this option to "none". Supported encryption types: none, des-cbc-crc, des-cbc-md5,
aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96, rc4-hmac. The default is rc4-hmac.
timeout
Specifies a timeout interval (in seconds) after which an AAA Active Directory server closes a connection.
The default is 15.
SEE ALSO
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or information storage and retrieval systems, for any purpose
other than the purchaser's personal use, without the express written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2011-2013, 2015. All rights reserved.
BIG-IP 2017-07-13 apm aaa active-directory(1)