Defining LDAP search filters for certificate authorization using the CLI

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Specify the LDAP search filter for certificate authorization.

hostname (config) # aaa authorization certificate map-ldap search-filter <filter_string>

The following example shows how to define an LDAP filter:

hostname (config) # aaa authorization certificate map-ldap search-filter "(!(cn=Test Cardholder))"

Verify the setting of the LDAP search filter.

hostname (config) # show aaa authorization certificate

Certificate based authorization settings:

  LDAP enabled               : yes

  LDAP Match Attribute       : uid

  Certificate field to match : x509-cert-subject

 LDAP Search Filter         : (!(cn=Test Cardholder))

  Username override          : no

Save your changes.

hostname (config) # write memory