ldap

base-dnstring

Configures the LDAP user search base specified as a string.

bind-dnstring

Sets the Distinguished Name that is to bind with the server, specified as a string.

bind-passwordstring

Configures the credentials with which a Distinguished Name binds to the LDAP server.

group-attribute { string | member | uniqueMember}

Sets the attribute name that will be used to check for group membership. The userʼs distinguished name must be listed as one of the values of this attribute, or the user will not be authorized to log in. The no form resets to the default, member.

group-dnstring

Sets the Distinguished Name of a group required for authorization.

host ipv4_or_ipv6_addressorder {last | order_number}

Configures hosts to which to send LDAP authentication requests. Optionally sets the order of the specified host, or specifies it as last.

login-attribute { string | uid | sAMAccountName}

Configures which attribute is to hold the LDAP login name specified as a custom string, or as a uid LDAP login name, or as an sAMAccountName Active Directory login name.

port port

Configures the LDAP server port number.

referrals

Enables LDAP referrals.

scope {one-level | subtree}

Configures the LDAP user search scope at either one-level, which searches the object’s immediate children, or at subtree, which searches the object and all of its descendants.

search-filterstring

Controls which users can log in using LDAP. For example, the filter could prevent users who are not part of a certain LDAP group from logging in. A negative response from the filter takes precedence over a remote authentication server that permits the user to log in. NOTE: If the string contains spaces, enclose the string with double quotation marks.

timeout-bindseconds

Configures the LDAP timeout (in seconds) for binding to a server.

timeout-searchseconds

Configures the LDAP timeout (in seconds) for searching for user information.

version {versionNumber | 2 | 3}

Configures the LDAP version to support. Specify a version number, version 2 (older servers), or version 3 (for current LDAP and Active Directory servers).