User Access Manager Help >> Operation Guide >> User Access Policy >> LDAP Service >> LDAP Parameters

Configure LDAP Parameters

Use this function to configure the LDAP service settings, including the user sync settings, paging of LDAP user query results, and the sync/backup task execution interval.

To configure the LDAP parameters, click the User tab, and then select User Access Policy > LDAP Service > LDAP Parameters from the navigation tree.

LDAP Parameters

• Delete Nonexistent LDAP Users in Synchronization: Select Enable to delete users that have been deleted from the LDAP server during synchronization. Select Disable to keep these users but set their status to Nonexistent. This parameter does not appear when CAMS is installed.
• Delete Nonexistent And Online LDAP Users in Synchronization: Select Enable to delete online users that have been deleted from the LDAP server during synchronization. Select Disable to keep these users. This parameter does not appear when CAMS is installed.
• LDAP User Move Between Sync Policies: Specifies whether LDAP users can be moved to the current synchronization policy when they are already bound to an LDAP synchronization policy. When this function is enabled, UAM moves LDAP users to the current LDAP synchronization policy in any of the following situations:
  The LDAP server no longer includes the DN that is specified for the other LDAP synchronization policy.
  On the LDAP server, users are already moved to the DN that is specified for the current LDAP synchronization policy.
  The current LDAP synchronization policy has the same priority as or a higher priority than the other LDAP synchronization policy.
• User Move Between Synchronization Policies with the Same Priority(Manual assignment): Select Disable to disallow LDAP users from moving between synchronization policies with the same priority. Select Enable to allow users to move between synchronization policies with the same priority. This parameter is configurable only when you select Enable for LDAP User Move between Synchronization Policy.This parameter is only effective for LDAP users whose service synchronization method is "manually specified".
• User Move Between Synchronization Policies with the Same Priority(Ad based group): Select Disable to disallow LDAP users from moving between synchronization policies with the same priority. Select Enable to allow users to move between synchronization policies with the same priority. This parameter is configurable only when you select Enable for LDAP User Move between Synchronization Policy.
• Move Access Services: Select whether to move services for which LDAP users apply during LDAP user synchronization. If you select Disable, the services for which LDAP users apply do not change during synchronization. If you select Enable, the system applies for services specified in the LDAP synchronization policy for LDAP users. This parameter takes effect only on LDAP users with Service Sync Type set to Manual Assignment.This parameter is only effective for LDAP users whose service synchronization method is "AD based group"
• Move Users between User Groups: If you select Enableto move a user to the user group where the user belongs according to the sync policy or LDAP user attribute information. If you select Disablea user's user group does not change during LDAP user synchronization.
• Move User Groups Across Sync Policies for Users Bound to Same Plat Account: Select whether to move a user group containing LDAP users bound to the same platform account as those of another user group in the target synchronization policy. By default, Enable is selected.
• LDAP Paging: Select this option to break the LDAP user query results into pages and specify the maximum number of LDAP users a page can display. If the LDAP server does not support paged results, do not select this option.
• LDAP User Sync Threshold: This parameter determines how to process inexistent LDAP users during LDAP user synchronization. If the number of inexistent LDAP users exceeds the threshold, this problem might be caused by data query failure due to exceptions. In this case, the system takes no action. If the number of inexistent LDAP users is equal to or smaller than this threshold, the system deregisters or set the state to inexistent for these users. The default setting is 100.
• LDAP On-Demand Authentication Mode: Select Local Backup or Real-Time Authentication from the list.
  Local Backup: Enables UAM to authenticate and create LDAP user accounts only when they are already backed up to the local system from the LDAP server. The periodic backup function is configured in LDAP synchronization of the UAM system settings. This mode applies to scenarios where multiple on-demand synchronization policies are used.
  Real-Time Authentication: Enables UAM to authenticate and create LDAP user accounts, regardless of whether or not they have been backed up to the local system. Although this mode is resource-consuming, it can authenticate new users in real time when they are added to the LDAP server. This mode applies to scenarios that have only a few on-demand synchronization policies but with high real-time requirements. To use this mode, make sure both the user group and service synchronization parameters are manually specified for the LDAP server. If real-time authentication is enabled, by default, the system does not apply the filter criteria in the LDAP on-demand synchronization policy when authenticating synchronized users. A user can pass authentication and have an account even though the user does not match the filter criteria in the synchronization policy.
• MSCHAPv2 Server Log Level: The level of logs recorded by the mschapv2server process, which can be: critical, error, warning, information, debugging, and trace. It is recommended that you set the log level to warning when the system runs normally. Setting the log level to information, debugging, or trace may degrade the system performance.
• Restart MSCHAPv2 Server Process: When you click OK, the system notifies the mschapv2server process of a process stop message. The monitor agent will automatically restart the mschapv2server process later.
• Re-establish Channel upon Unknown MSCHAPv2 AuthN Error: Select whether to re-establish the authentication channel when an unknown error occurs during MSCHAPv2 authentication. By default, Enable is selected. If you select Disable, the authentication channel will not be re-established when unknown errors occur during MSCHAPv2 authentication. In this case, the users who have passed authentication can come online correctly.
• Bypass Authentication for LDAP Server Failure: To permit LDAP user authentication requests upon LDAP server failures, enable this feature. To deny LDAP user authentication requests upon LDAP server failures, disable this feature. When this feature is enabled and a backup server is available, an LDAP user sends an authentication request to the backup server upon primary server failures. If the authentication request is denied, the user bypasses the authentication. MS-CHAPv2 authentication requires the server to respond to a client request with a challenge text generated based on the password. The bypass feature does not support MS-CHAPv2 authentication because the challenge text cannot be generated when a user bypasses the authentication.
• LDAP Server Anomaly Alarming: To send alarms when an LDAP server exception occurs, select this option. Then, the system sends alarms when the following events occur:
• Users are assigned to a critical segment (for example, critical VLAN, VSI, microsegment, or profile) to access limited resources without authentication if the primary LDAP server is unreachable during authentication.
• Users are assigned to a critical segment to access limited resources without authentication if the standby LDAP server becomes unreachable after a primary/standby switchover during authentication.
  The system does not send an alarm if the authentication access device does not assign users to a critical segment when no LDAP servers are reachable during authentication.
• Primary/standby LDAP server switchover succeeds.
• The system does not send alarms in other situations except the above mentioned situations.

The page displays this parameter only when the alarm component is installed.

• LDAP Sync/Backup Task: Set the execution interval and time for the LDAP sync/backup task. You can enter multiple time values separated by a comma for frequent execution. For example,0-3,23 indicates that the LDAP sync/backup task will be executed at 23:00, and the beginning of every hour of 0:00 through 3:00 at each interval.The default time for LDAP sync/backup task execution is 3:00. If you specify multiple time values, make sure the server does not process authentication requests at the specified time points. The execution interval does not apply to the first execution of the task. For example, suppose the current time is 10:00 on September 24, 2013. If you set the task to be executed at 11:00 every 3 days, the first execution time of the task will be 11:00 on the same day. Then, UAM executes the task 3 days later at 10:00, which will be September 27, 2013, and so forth. If you set the task to be executed at 9:00 every 3 days, the first execution time of the task will be 9:00 on the next day, which is September 25, 2013. Then, UAM executes the task another 3 days later at 9:00, which will be September 28, 2013, and so forth.
• Enable LDAP Incremental Sync/Backup Task: Select this option to back up users to UAM that have been added or modified since the last synchronization. The task is performed at specified intervals for all LDAP on-demand sync policies. The value of the interval must be a multiple of 5 in the range of 5 to 60, in minutes. For other LDAP sync policies, UAM first performs full synchronization, and then performs incremental synchronization. For example, when the LDAP Sync/Backup Task field is set to 3-11, UAM performs full synchronization at 3:00, and performs incremental synchronization at the beginning of every hour of 4:00 through 11:00.
  Incremental condition indicates the filter in the LDAP syntax query for incremental synchronization or backup. The default is whenChanged.
  Time format for the incremental condition. The default format is yyyyMMddHH mmss.sss, which is used by Windows Active Directory.
• When the full sync and incremental sync are enabled at the same time,if the time between them overlaps,the full sync will be executed in the first hour,and the incremental sync will be executed in other times,the differences between full sync and incremental sync are described in the following examples:
  1) If you enable the LDAP sync/backup task with the execution time set to 3:00 and disable the LDAP incremental sync/backup task, full sync is executed at 3:00.
  2) If you enable the LDAP sync/backup task with the execution time set to 3:00 to 10:00 and disable the LDAP incremental sync/backup task, full sync is executed at 3:00 and incremental sync is executed on each hour between 4:00 and 10:00.
  3) If you enable the LDAP sync/backup task with the execution time set to 3:00, enable the LDAP incremental sync/backup task, select At Time Point, and set the execution time to 3:00 to 10:00, full sync is executed at 3:00 and incremental sync is executed on each hour between 4:00 and 10:00.
  4) If you enable the LDAP sync/backup task with the execution time set to 3:00 to 6:00, enable the LDAP incremental sync/backup task, select At Time Point, and set the execution time to 3:00 to 10:00, full sync is executed at 3:00 and incremental sync is executed on each hour between 4:00 and 10:00.
  5) If you enable the LDAP sync/backup task with the execution time set to 3:00 to 6:00, enable the LDAP incremental sync/backup task, select At Time Point, and set the execution time to 9:00 to 12:00, full sync is executed at 3:00 and incremental sync is executed on each hour between 4:00 and 6:00 and each hour between 9:00 and 12:00.
  6) If you disable the LDAP sync/backup task, enable the LDAP incremental sync/backup task, select At Time Point, and set the execution time to 3:00 to 10:00, incremental sync is executed on each hour between 3:00 and 10:00.
  7) If you disable the LDAP sync/backup task and disable the LDAP incremental sync/backup task, neither full sync nor incremental sync is executed.
• Next LDAP Sync/Back Time: This field is automatically populated after you set the LDAP sync/backup task execution interval and time.
• The script to modify the computer password: Modifies the password for the virtual computer. Follow these steps to modify the password for the virtual computer by using the script: 1) Download the script to the local computer and open the script with a text editor. 2) Replace "CN=testAccount,CN=Computers,DC=CONTOSO,DC=COM" with the computer account DN and replace default password with the password you want to configure for the virtual computer. 3) Copy the script to the domain controller. 4) Execute cscript ModifyComputerAccountPass.vbs in the command prompt window on the domain controller.
• Ignore Password Expiration Policy: To allow LDAP users to log in with expired passwords, enable this option. If you disable this option, LDAP users must change their passwords to authenticate to the system if the passwords have expired. If centralized password control from the LDAP server is desirable, enable this option.