Configuring an active directory server using the CLI

Because Active Directory (AD) supports the LDAP protocol, Trellix appliances can also authenticate through an AD server.

The binding user or bind-dn as seen in the Trellix configuration is a read-only user that is used to query the directory structure starting from the base-dn. The localUserNameFireEye attribute is an addition that needs to be made above other attributes used by default on Active Directory. Adding the localUserNameFireEye as an attribute to the AD schema is not without risks. Refer to the following resource for more information:

https://technet.microsoft.com/en-us/library/2008.05.schema.aspx?pr=blog

Important

The localUserNameFireEye attribute requires a non-administrator “binding user” for searching and browsing AD server records.

Prerequisites

Admin access

To configure Active Directory authentication:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Configure the host to send LDAP authentication requests. Use the following command:
```
ldap host <adServerHostnameIpaddress>
```
Configure the LDAP user search base. Use the following command:
```
ldap base-dn <ldapBaseDN>
```
Set the Distinguished Name used to bind to the server. Use the following command:
```
ldap bind-dn <searchUserDN>
```
Configure the credentials used to bind to the server. Use the following command:
```
ldap bind-password <searchUserPassword>
```
Configure which attribute holds the login name. Use the following command:
```
ldap login-attribute sAMAccountName
```
sAMAccountName is a fixed value that replaces the<uid>attribute defined for LDAP authentication.
Save your changes:
```
hostname (config) # write memory
```