Defining LDAP search filters

An administrator can define an LDAP search filter in the local configuration that controls which users can log in using LDAP. For example, the filter could prevent users who are not part of a certain LDAP group from logging in. A negative response from the filter takes precedence over a remote authentication server that permits the user to log in.

Prerequisites

Admin access

To specify or remove an LDAP search filter:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

To configure the LDAP search filter, use the following command:
```
ldap search-filter <filterString>
```
Important
If the <filterString> contains spaces, enclose the string with double quotation marks.
The following example defines a filter that allows "operator" role users in the Acme IT network group to log in using LDAP.
```
hostname (config) # ldap search-filter "(|(memberOf=cn=Operators2,ou=Network Group,dc=acmeit,dc=com)"
```

Remove a search filter:

hostname (config) # no ldap search-filter

Save your changes:
```
hostname (config) # write memory
```

For command usage and parameters, see the CLI Reference.