Configuring LDAP user attributes
About LDAP user attributes
To authenticate a user, an LDAP client must complete the following operations:
Establish a connection to the LDAP server.
Obtain the user DN from the LDAP server.
Use the user DN and the user's password to bind with the LDAP server.
LDAP provides a DN search mechanism for obtaining the user DN. According to the mechanism, an LDAP client sends search requests to the server based on the search policy determined by the LDAP user attributes of the LDAP client.
The LDAP user attributes include:
Search base DN.
Search scope.
Username attribute.
Username format.
User object class.
Restrictions and guidelines
If the LDAP server contains many directory levels, a user DN search starting from the root directory can take a long time. To improve efficiency, you can change the start point by specifying the search base DN.
Procedure
Enter system view.
system-view
Enter LDAP server view.
ldap server server-name
Specify the user search base DN.
search-base-dn base-dn
By default, no user search base DN is specified.
(Optional.) Specify the user search scope.
search-scope { all-level | single-level }
By default, the user search scope is all-level.
(Optional.) Specify the username attribute.
user-parameters user-name-attribute { name-attribute | cn | uid }
By default, the username attribute is cn.
(Optional.) Specify the username format.
user-parameters user-name-format { with-domain | without-domain }
By default, the username format is without-domain.
(Optional.) Specify the user object class.
user-parameters user-object-class object-class-name
By default, no user object class is specified, and the default user object class on the LDAP server is used. The default user object class for this command varies by server model.