TACACS+ Authentication Manager Help >> Operation Guide >> Device User Policy >> LDAP Service >> LDAP Servers

LDAP Servers

Use LDAP Servers to manage the LDAP servers and LDAP user information.

Features

• Add/Modify LDAP Server
  
  Perform this task to add or modify associations with LDAP servers in INC.

  Procedure

  1. Click the User tab, and then select Device User Policy > LDAP Service > LDAP Servers from the navigation tree.
  2. Click Add, or click the icon of the LDAP server you want to modify.
  3. Configure the following basic parameters:
  • Server Name: Name of the LDAP server. It is required and cannot be the same as any existing LDAP server name.
  • Version: Version of the LDAP protocol running on the LDAP server. Currently, the mainstream versions v2 and v3 are supported.
  • Address: Address of the LDAP server. The combination of this parameter and base DN must be unique.
  • Port: Listening port of the LDAP server. It defaults to 389 and cannot be null.
  • Server Type: Type of the LDAP server, general LDAP server or Microsoft Active Directory. The former refers to all servers compliant with the LDAP standards. The latter represents only Microsoft Active Directory.
  • Real Time AuthN: With real time authentication, bound users are authenticated on the LDAP server. Without real time authentication, bound users are authenticated on INC. For details about bound users, see LDAP Users.
  • Reconnect Interval: If INC fails to establish a connection to the LDAP server, it will retry after this interval. During this interval, INC does not try to connect to the LDAP server and will refuse all LDAP user authentication requests.
  • Connection Wait Timeout: If INC tries to establish a connection to the LDAP server but fails to establish it during this period, the operations of LDAP server detection, synchronization, and user export cannot be performed normally.
  • Sync Wait Timeout: If INC connects to the LDAP server and performs user synchronization but the synchronization operation is not complete after this period of time, INC will not continue to synchronize the users not synchronized yet. It is an integer in the range of 0 to 10000. 0 means no limit.
  • Enable SSL: Enable TAM to communicate with LDAP servers through SSL.
  4. Configure the following server parameters:
  • Base DN: Name of the root node that stores user data in the LDAP server. Absolute path is required.
  • Admin DN: Administrator Distinguished Name (DN) of the LDAP server, for managing user data in the LDAP server.
  • Admin Password: Administrator password of the LDAP server. The system uses this password when establishing a connection to the LDAP server.
  • User Attribute Name: Name of the attribute on the LDAP server that stores the username. The value of the attribute is an access account name.
  • Password Attribute: Name of the attribute on the LDAP server that stores the user password. It is not required when the server type is Microsoft Active Directory.
  5. Configure the following backup server parameters:
  • Address: Address of the backup LDAP server. With a backup server configured, INC will automatically turn to the backup server for authentication when the primary server is not available. The switchover process is as follows: 1) INC sends authentication requests to the primary server continually. If it receives no response, it considers the primary server unavailable. 2) INC tests connectivity to the backup server. If INC successfully connects to the backup server, it sets the backup server as the authentication server. The entire switchover process takes about 1 minute and users trying to be authenticated during this period will receive an error message. A switchover does not affect any online user.
  • Server In Use: Select Primary to use the primary server as the current authentication server. Select Backup to use the backup server as the current authentication server.
  • Auto Back to Primary: When INC fails to connect to the primary server, it turns to the backup server and regularly checks whether the primary server has come up. If it finds that the primary server has come up, it will wait for a period specified by the Interval field and then back to the primary server if the Auto Back to Primary box is selected.
  • Interval: Period that INC waits after it finds that the primary server has come up and before it switches back to the primary server.
  6. Click OK.
• Delete LDAP Server
  
  Perform this task to delete an LDAP server from INC.

  Procedure

  1. Click the User tab, and then select Device User Policy > LDAP Service > LDAP Servers from the navigation tree.
  2. Click the icon of the LDAP server you want to delete.
     A confirmation dialog box appears.
  3. Click OK.
• Test LDAP Server
  
  Perform this task to check the availability of an LDAP server. You can check the availability of an LDAP server when adding/modifying or using an LDAP server.

  Procedure

  1. Click the User tab, and then select Device User Policy > LDAP Service > LDAP Servers from the navigation tree.
  2. To test the availability of an LDAP server in use, click the Test link of the LDAP server on the LDAP server list.
  3. Click Add to open the page for adding LDAP servers.
  4. After completing LDAP server configuration, click Test to check whether the LDAP server that you are configuring is available.
• Certificate
  
  This function allows you to configure a root certificate.

  Procedure

  1. Click the User tab, and then select Device User Policy > LDAP Service > LDAP Servers from the navigation tree.
  2. Click corresponding to a certificate to enter the root certificate page.
  3. Select a root certificate file.
  4. Click Next to enter the certificate preview page.
  5. Click OK.

Parameters

• Status: When the Connectivity parameter is enabled, TAM forwards user authentication requests to the LDAP server for processing. If the LDAP server cannot be reached, TAM automatically disables the parameter. When the Connectivity parameter is disabled, TAM denies authentication requests of LDAP users. The Reconnect Interval parameter specifies how long TAM waits before it re-enables the Connectivity parameter for the LDAP server. Operators can manually enable the Connectivity parameter for connecting the LDAP server at any time.
• Root Certificate File: CA certificate file, which is used to verify the server certificate when TAM establishes an SSL channel to an LDAP server. Make sure the server certificate installed on the LDAP server matches the root certificate.

Remarks

• The name of the LDAP server cannot be modified during LDAP server modification.
• The combination of the LDAP server's IP address and base DN must be unique.
• During user authentication, if the primary LDAP server is not working normally and there is a backup LDAP server configured, INC will automatically turn to the backup server. Switchover from primary to backup occurs only in this case.
• If real-time authentication has been specified for the LDAP server, bound users are authenticated on the LDAP server. If real-time authentication has not been specified for the LDAP server, bound users are authenticated on INC. However, when INC cannot synchronize passwords (user passwords are null on INC) from some LDAP server (for example, the Microsoft Active Directory), bound users are authenticated on the LDAP server even if real-time authentication is not specified for the LDAP server.
• INC supports these root certificate file formats: PEM (Base64 encoded, .pem or .cer), DER (DER encoded, .der or .cer), and PKCS12 (PKCS 12 encoded, .pfx, or .p12). If the certificate file has an extension of .pfx, the private key file cannot be in PVK format.
• On the LDAP server list, entries that contain the same IP address use the same certificate. If you configure or remove the certificate for any of the entries, the same operation applies to the remaining entries.
• If you do not enter the administrator DN or password, users access the LDAP server as anonymous users. Make sure the LDAP server supports anonymous access.