Using LDAP to authenticate multiprotocol file access

About using LDAP

LDAP enables multiprotocol users to be authenticated for accessing UNIX files on the filer. If you store your UNIX user database on an LDAP server, you can configure your filer to look up user information in the LDAP database rather than using the /etc/password file or NIS.

About configuring LDAP

You can configure the filer to use one or more LDAP servers only by using Data ONTAP options at the command line.

To configure LDAP, you need to do the following:

Specify the LDAP base distinguished name using the ldap.base option.
Specify the LDAP servers to use for LDAP queries using the ldap.servers option.
Specify the preferred LDAP servers, if any, using the ldap.servers.preferred option.
Enable LDAP on the filer using the ldap.enable option.
Edit the password line of the /etc/nsswitch.conf file for LDAP.

In addition, you might need to do the following:

If anonymous authentication does not work in your environment, specify the administrative user name to use for queries to look up user IDs (UIDs) and group IDs (GIDs) using the ldap.name option.
If there is a password for the administrative user, specify the administrative password using the ldap.passwd option.
If your LDAP server has been set up to use a port for LDAP queries other than the default port 389, specify the LDAP port using the ldap.port option.
If root does not appear in the /etc/password file, make an entry in the LDAP database for root.

Types of LDAP servers supported

Data ONTAP supports the following types of LDAP servers:

Netscape®
iPlanet
OpenLDAP

Enabling RFC 2307

RFC 2307 must be enabled on the LDAP servers to be used for LDAP queries. Netscape and iPlanet servers have RFC 2307 enabled by default.

If you are using an OpenLDAP server, you must enable RFC 2307 by including the following line in the slapd.conf file:

include .servers/slapd/schema/nis.schema

Specifying the LDAP base distinguished name

The LDAP base distinguished name is the name of the LDAP tree in which user information is stored.

To specify the LDAP base distinguished name to use to look up user names, complete the following step.

Step	Action
1	Enter the following command: options ldap.base name name is the base distinguished name. Use quotes around names with embedded spaces. Example `options ldap.base "o=network appliance, c=us"`

Specifying LDAP servers

To specify the LDAP servers to be used for LDAP queries, complete the following step.

Step	Action
1	Enter the following command: *options ldap.servers "name* [name...]"** name is the name of an LDAP server. You can enter multiple server names using a space-separated list enclosed in quotes. Example options ldap.servers "server1 server2"

Specifying preferred servers

You might want to specify LDAP servers that are on faster links as the preferred servers, if any of your LDAP servers are on a WAN link or are considered slower or less reliable.

To specify the LDAP servers that you want the filer to check first, complete the following step.

Step	Action
1	Enter the following command: *options ldap.servers.preferred "name* [name...]"** name is the name of a preferred LDAP server. You can enter multiple server names using a space-separated list enclosed in quotes. Example options ldap.servers.preferred "server1 server2"

Enabling or disabling LDAP

To enable or disable LDAP on your filer, complete the following step.

Step	Action
1	Enter the following command: options ldap.enable {on\|off} Use `on` to enable and `off` to disable LDAP.

Editing the /etc/nsswitch.conf file for LDAP

To edit the /etc/nsswitch.conf file for LDAP, complete the following steps.

Step	Action
1	Open the /etc/nsswitch.conf file on the filer for editing. Note If the /etc/nsswitch.conf file does not exist, see Changing the host name search order for instructions on how to create the file.
2	Enter the following at the beginning of the password line: ldap Note You can optionally add `files` and `nis` to the password line, but they must be entered after `ldap`. Example `passwd: ldap files nis`
3	Save the file.

Step

Action

Open the /etc/nsswitch.conf file on the filer for editing.

Note
If the /etc/nsswitch.conf file does not exist, see Changing the host name search order for instructions on how to create the file.

Enter the following at the beginning of the password line:

ldap

Note
You can optionally add files and nis to the password line, but they must be entered after ldap.

Example

passwd: ldap files nis

Save the file.

Specifying the admin user name

If anonymous authentication does not work in your environment, you need to specify an administrative user name.

To specify the user name to be used for administrative queries to look up UIDs and GIDs, complete the following step.

Step	Action
1	Enter the following command: options ldap.name name name is the name to be used for administrative queries. The best practice is for this to be the name of a user with read-only access to the LDAP database. Use quotes around names with embedded spaces. Example `options ldap.name "cn=root, o=network appliance, c=us"`

Step

Action

Enter the following command:

options ldap.name name

name is the name to be used for administrative queries. The best practice is for this to be the name of a user with read-only access to the LDAP database. Use quotes around names with embedded spaces.

Example

options ldap.name "cn=root, o=network appliance, c=us"

Specifying the admin password

To specify a password for the administrative user, complete the following step.

Step	Action
1	Enter the following command: options ldap.passwd password password is the password for the administrative user. The password is displayed as a series of asterisks (****** for example).

Specifying the LDAP port

You might need to specify the port to use for LDAP queries, if the LDAP server has been set up to use a port other than the default for LDAP, port 389.

To specify the LDAP port, complete the following step.

Step	Action
1	Enter the following command: options ldap.port N N is the LDAP port number.