Configure LDAP or Active Directory authentication

Log in to the system as npadmin using the system's IP address or FQDN. For example:

$ ssh npadmin@10.1.0.1

Or,

$ ssh npadmin@exampleFQDN

Enter privileged mode:

npadmin@hostname > enable

Enter the admin password.

[sudo] password for npadmin: <password>

Enter configuration mode:

npadmin@hostname# configure system

Open the authentication configuration:

npadmin@hostname(config)# authentication
1: Authentication Method = pam
2: Configure Current Authentication Method
----------------------------------------
        
Q: Save changes and exit
C: Cancel changes and exit
        
Select which option you would like to change
using the index number:

Type 1 to open the authentication mechanism menu. Enter 2 for LDAP or 5 for Active Directory.

Authentication Mechanisms:
1: PAM
2: LDAP
3: RADIUS
4: TACACS+
5: Active Directory
6: PKI
7: PKI w/ LDAP
8: PKI w/ Active Directory

C: Cancel changes and exit

Select the authentication method to use:

When you have selected LDAP or AD as the authentication method, the following options appear on the CLI:

1: Authentication Method = ldap or active-directory
2: Configure Current Authentication Method
3: Flush AD/LDAP passwd and group cache
----------------------------------------

Q: Save changes and exit
C: Cancel changes and exit

Select which option you would like to change
using the index number:

Press 2 to select Configure Current Authentication Method. When the configuration menu appears, make changes to the following fields, as required:

1. LDAP or AD Server(s): Type 1 to enter hostname (FQDN) or IP address of the Active Directory/LDAP server(s) to connect to. For IP address, you can provide space-separated list of servers in <IP address><port> format.

2. Base DN: Type 2 to set the Root Distinguished Name (DN) in the LDAP directory tree under which user and group searches begin. You can mention nodes within the directory as required, such as CN=common name, OU=organization unit, DC=domain controller, C=country, and O=organization. Press Enter.

3. Bind DN: Type 3 to set the Distinguished Name of the service account used to bind to the server and authenticate LDAP queries (for example, CN=common name, OU=organization unit, DC=domain name). Press Enter.

4. Bind Password: Type 4 to enter the password for the Bind DN account used in LDAP authentication. Press Enter.

5. Base Password: Type 5 to enter the default password applied to the base DN account.

6. Base Group: Type 6 to specify the default or root LDAP/ AD group which it tells the system where in the directory tree to search for group objects (for example, [DC=testad, DC=eng, DC=trellix, DC=com]). Press Enter.

7. LDAP/AD UIAPI Group: Type 7 to specify the LDAP or AD group granting access to application UI or API interfaces. Press Enter.

8. LDAP/AD Sudo Group: Type 8 to specify LDAP or AD group whose members are granted sudo/root privileges.

9. LDAP/AD SSH Group: Type 9 to specify the LDAP or AD group authorized for SSH login access.

10. LDAP Domain SID: Type 10 to enter Security Identifier (SID) of the LDAP or AD domain used for identity mapping.

11. LDAP USE SSL: Type 11 to enable LDAPS (LDAP over SSL/TLS) for secure connections on port 636. It is set to false (0) by default. Type 1 to enable it and press Enter.

12. LDAP USE STARTTLS: Type 12 if you want to upgrade a plain LDAP connection to a secure TLS session to communicate with the server. It is set to false (0) by default. Type 1 to enable it and press Enter.

13. Ignore Constraints: Enabling this instructs the device to not check that certificates have the appropriate ExtKeyUsage attributes for TLS auth. Type 13 and enter true to enable it. Press Enter.

14. Enable LDAP Group Traversal: Type 14 if you want to Enable LDAP queries to search through the nested LDAP groups to find users/groups. It is set to false (0) by default. Type 1 to enable it and press Enter.

    After the configuration, it might look like the following:

    1: AD Server(s) = 10.x.x.x:3xx
    2: Base DN = CN=Users,DC=piblr,DC=quality
    3: Bind DN = CN=administrator,CN=Users,DC=piblr,DC=quality
    4: Bind Password = **********
    5: Base Password = **********
    6: Base Group = CN=Users,DC=piblr,DC=qa
    7: LDAP/AD UIAPI Group = uiapigrp
    8: LDAP/AD Sudo Group = sudogrp
    9: LDAP/AD SSH Group = sshgrp
    10: LDAP Domain SID = None
    11: LDAP USE SSL = False
    12: LDAP USE STARTTLS = False
    13: Ignore Constraints = false
    14: Enable LDAP Group Traversal = False

15. Press Q to save the changes and exit the LDAP or Active Directory authentication configuration menu, Press C to cancel.

Optionally, if you want to clear any cached credentials or group information previously configured, press 3 (Flush AD/LDAP passwd and group cache).