Configuring an LDAP attribute to match a certificate authorization field using the CLI

Use the CLI commands in this section to configure an LDAP attribute to match the certificate authorization field that was specified with the aaa authorization certificate map-ldap match-cert-field command.

Note

Use the no aaa authorization certificate map-ldap match-ldap-attribute command to reset the attribute of the LDAP account to use the default sAMAccountName attribute.

To configure an LDAP attribute to match a certificate authorization field:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Specify the LDAP user schema name for LDAP to match the configured certificate authorization field.
```
hostname (config) # aaa authorization certificate map-ldap match-ldap-attribute uid
```
Specify which attribute holds the login name to match the configured certificate authorization field.
```
hostname (config) # aaa authorization certificate map-ldap match-ldap-attribute sAMAccountName
```
Note
The sAMAccountName attribute is the default.
Specify which attribute holds an email address to match the configured certificate authorization field.
```
hostname (config) # aaa authorization certificate map-ldap match-ldap-attribute mail
```

Verify the setting of the LDAP attribute.

hostname (config) # show aaa authorization certificate

Certificate based authorization settings:

  LDAP enabled               : yes

  LDAP Match Attribute       : uid

...

Save your changes.
```
hostname (config) # write memory
```