apm policy agent aaa-active-directory

apm policy agent aaa-active-directory(1)	  BIG-IP TMSH Manual	     apm policy agent aaa-active-directory(1)

NAME
       aaa-active-directory - Manages an AAA Active Directory(r) agent.

MODULE
       apm policy agent

SYNTAX
       Configure the aaa-active-directory component within the policy agent module using the following syntax.

   CREATE/MODIFY
	create aaa-active-directory [name]
	modify aaa-active-directory [name]
	  options
	    app-service [[string] | none]
	    auth-max-logon-attempt [integer]
	    fetch-nested-groups [true | false]
	    fetch-primary-groups [true | false]
	    hints [true | false]
	    query-attrname [[string] | none]
	    query-filter [[string] | none]
	    server [[string] | none]
	    trusted-domains [[string | none]]
	    show-extended-error [true | false]
	    type [query | auth | last]
	    upn [true | false]

   DISPLAY
	list aaa-ldap
	list aaa-ldap [ [ [name] | [glob] | [regex] ] ... ]
	show running-config aaa-ldap
	show running-config aaa-ldap [ [ [name] | [glob] | [regex] ] ... ]
	  options:
	    all
	    all-properties
	    current-module
	    non-default-properties
	    one-line
	    app-service
	    partition

   DELETE
	delete aaa-active-directory ([name] | all)

DESCRIPTION
       You can use the aaa-active-directory component to configure an AAA Active Directory agent.

EXAMPLES
       create aaa-active-directory MyADQueryagent {query-filter "(be sAMAccountName=%{session.logon.last.username})"
       type query server "companyAD" }
	    Creates the query type AAA Active Directory agent named MyADQueryagent that uses the (be
	    sAMAccountName=%{session.logon.last.username}) filter and the companyAD AAA AD Server.

       create agent aaa active MyADAuthagent { type auth server "companyAD" }
	    Creates the authorization type AAA Active Directory agent named MyADAuthagent that uses the companyAD AAA
	    AD server.

       list aaa-active-directory all
	    Displays a list of AAA Active Directory agents and their properties.

       delete aaa-active-directory MyADagent
	    Deletes the MyADagent AAA Active Directory agent.

OPTIONS
       app-service
	    Specifies the name of the application service to which the object belongs. The default value is none.
	    Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
	    modify or delete the object. Only the application service can modify or delete the object.

       auth-max-logon-attempt
	    Specifies the maximum number of opportunities that users have to re-enter credentials after their first
	    attempt to log in fails. If you set this value to a number from 2 to 5 inclusive, the system allows users
	    the specified number of opportunities to log in after the first attempt to log in fails. If you set the
	    value to 1, the system does not allow a second log in opportunity after a first log in attempt fails. The
	    default value is 3.

       fetch-nested-groups
	    When enabled, the system administrator can retrieve the full list of groups that user belongs to, even if
	    the retrieval privileges are nested through other groups to which the user belongs to directly. The
	    default value is false.

       fetch-primary-groups
	    When enabled, the system administrator can retrieve the primary group of a user, and use that name as a
	    group in access policy item rules. The default value is false.

       hints
	    When enabled, the system offers the user an option to create a hint that assists in remembering a
	    password.  The default value is false.

       query-attrname
	    Specifies the attribute name that you are adding or deleting for the agent.

       query-filter
	    Specifies the search criteria the system uses when querying an AAA Active Directory(r) server for
	    authentication information. The system supports session variables as part of search query string.

       [name]
	    Specifies the name of an AAA Active Directory agent. This setting is required.

       partition
	    Displays the partition within which the component resides.

       server
	    Specifies an AAA Active Directory server the system uses for Active Directory queries and authentication.

       server
	    Specifies an AAA Active Directory Trusted Domains object that the system uses for Active Directory
	    queries and authentication.  This option requires upn option to be enabled

       show-extended-error
	    Specifies to display a verbose error message. The default value is false.

       type Specifies the type of AAA Active Directory agent. The default value is last.

	    query
		 Specifies that the agent makes a query against the AAA Active Directory Server to retrieve
		 information in accordance with the query-filter and query-attributes options.

	    auth Specifies that the agent is an authentication agent only. It uses the AAA Active Directory Server,
		 but only for authentication purposes. APM does not get any information from the Domain.

	    last
       upn  When enabled, APM supports the user principal name (UPN) naming style and process cross-domain
	    authentication requests.  Some examples of UPNs are: user@fqdn.of.domain.com, user@upnsuffix.com, and
	    user@domain. The default value is false.

SEE ALSO
       tmsh

COPYRIGHT
       No part of this program may be reproduced or transmitted in any form or by any means, electronic or
       mechanical, including photocopying, recording, or information storage and retrieval systems, for any purpose
       other than the purchaser's personal use, without the express written permission of F5 Networks, Inc.

       F5 Networks and BIG-IP (c) Copyright 2011-2012. All rights reserved.

BIG-IP						      2013-11-15	     apm policy agent aaa-active-directory(1)