Configuring LDAP services

About this section

This section provides the following information to help you configure Data ONTAP to connect to your LDAP database:

Specifying the general search base and scope

The LDAP base is the distinguished name of the LDAP tree in which user information is stored. All lookup requests sent to the LDAP server will be limited to the search base and scope specified by the ldap.base option value, unless further restricted by a more specific base and scope lookup value, such as ldap.base.passwd, ldap.base.group, or ldap.base.passwd.

To specify which LDAP base distinguished name to use for looking up user names, complete the following step.

Step	Action
1	Enter the following command: options ldap.base name name is the base distinguished name. Use quotes around names with embedded spaces. Example `options ldap.base "o=networkappliance,c=us"`

Specifying the search base and scope values for user lookups

You can, though it is not required, specify base and scope values specifically for LDAP lookup requests, to limit user lookup queries to the user account branch of your LDAP database. Limiting the search base and scope of every query can significantly improve performance.

To specify base and scope values for all LDAP lookup services, complete the following steps.

Note
The values you assign using this procedure will apply to all LDAP lookups, unless you enter separate base and scope values for user-mapping.

Step	Action
1	Set the base and scope search values for password lookups, as they are defined in your LDAP database, by specifying a value for the `ldap.base.passwd` option. Example: options ldap.base.passwd "ou=People,dc=companydomain,dc=com"
2	Set the `ldap.base.group` base and scope search values for password lookups, as they are defined in your LDAP database. Example: `options ldap.base.group "ou=Groups,dc=companydomain,dc=com"`

Step

Action

Set the base and scope search values for password lookups, as they are defined in your LDAP database, by specifying a value for the ldap.base.passwd option.

Example:

options ldap.base.passwd 
"ou=People,dc=companydomain,dc=com"

Set the ldap.base.group base and scope search values for password lookups, as they are defined in your LDAP database.

Example:

options ldap.base.group "ou=Groups,dc=companydomain,dc=com"

Note
Once you specify the search base and scope values for ldap.base.passwd and ldap.base.group, these values take precedence over the search base and scope set for ldap.base, for password and group lookups.

Specifying LDAP servers

To specify the LDAP servers to be used for LDAP queries, complete the following step.

Step	Action
1	Enter the following command: *options ldap.servers "name[,name...]"* name is the name of an LDAP server. You can enter multiple server names using a comma-separated list enclosed in quotes. Data ONTAP attempts to establish connections in the order in which you specify these servers. Example options ldap.servers "server1,server2"

Step

Action

Enter the following command:

options ldap.servers "name[,name...]"

name is the name of an LDAP server. You can enter multiple server names using a comma-separated list enclosed in quotes. Data ONTAP attempts to establish connections in the order in which you specify these servers.

Example

options ldap.servers "server1,server2"

Specifying preferred servers

You might want to specify LDAP servers that are on faster links as the preferred servers.

To specify the LDAP servers that you want the storage system to attempt to connect to first, complete the following step.

Step	Action
1	Enter the following command: *options ldap.servers.preferred "name[,name...]"* name is the name of a preferred LDAP server. You can enter multiple server names using a comma-separated list enclosed in quotes. Example options ldap.servers.preferred "server1,server2"

Enabling or disabling LDAP

To enable or disable LDAP on your storage system, complete the following step.

Step	Action
1	Enter the following command: options ldap.enable {on \| off} Use `on` to enable and `off` to disable LDAP.

Enabling or disabling SSL for LDAP traffic

To enable or disable secure sockets layer (SSL) encrypting of LDAP traffic on your storage system, complete the following step.

Step	Action
1	Enter the following command: options ldap.ssl.enable {on \| off} Use `on` to enable and `off` to disable SSL for LDAP.

In addition to enabling SSL for LDAP, you must have a root authority-signed certificate installed on your storage system. For more information see Installing a root certificate for SSL for LDAP traffic.

Note
The same certificate-signing authority must issue both the certificate on the storage system and the certificate on the server.

Installing a root certificate for SSL for LDAP traffic

To install a root certificate for use for secure sockets layer (SSL) encrypting of LDAP traffic on your storage system, complete the following steps.

Step	Action
1	Download a certificate from your preferred trusted signing authority to the storage system. Remember the certificate's location on the storage system.
2	Enter the following command: keymgr install root certificate_filename certificate_filename is the complete file name for the certificate. After the `keymgr` command installs the certificate, you can remove the copy you placed on the storage system. Example keymgr install root /etc/my_cert
3	Set the LDAP port to port 636. For information on setting the LDAP port, see Specifying the LDAP port

Step

Action

Download a certificate from your preferred trusted signing authority to the storage system. Remember the certificate's location on the storage system.

Enter the following command:

keymgr install root certificate_filename

certificate_filename is the complete file name for the certificate.

After the keymgr command installs the certificate, you can remove the copy you placed on the storage system.

Example

keymgr install root /etc/my_cert

Set the LDAP port to port 636.

For information on setting the LDAP port, see Specifying the LDAP port

Note
The same certificate-signing authority must issue both the certificate on the storage system and the certificate on the server.

Editing the /etc/nsswitch.conf file for LDAP

To edit the /etc/nsswitch.conf file for LDAP, complete the following steps.

Step	Action
1	Open the /etc/nsswitch.conf file on the storage system for editing.
2	Enter the following at the password, group, and netgroup lines: ldap You can optionally add `files` and/or `nis` to the password line, but they must be entered after `ldap` if you want to use LDAP as the primary mechanism to retrieve user information. Example `passwd: ldap files nis`
3	Save the file.

Step

Action

Open the /etc/nsswitch.conf file on the storage system for editing.

Enter the following at the password, group, and netgroup lines:

ldap

You can optionally add files and/or nis to the password line, but they must be entered after ldap if you want to use LDAP as the primary mechanism to retrieve user information.

Example

passwd: ldap files nis

Save the file.

Specifying the administrative user name

If anonymous authentication does not work in your environment, you need to specify an administrative user name.

To specify the user name to be used for administrative queries for looking up UIDs and GIDs, complete the following step.

Step	Action
1	Enter the following command: options ldap.name name name is the LDAP distinguished name to be used for administrative queries. The best practice is for this to be the name of a user with read-only access to the LDAP database. Use quotes around names with embedded spaces. Example `options ldap.name "cn=root,o=networkappliance,c=us"`

Step

Action

Enter the following command:

options ldap.name name

name is the LDAP distinguished name to be used for administrative queries. The best practice is for this to be the name of a user with read-only access to the LDAP database. Use quotes around names with embedded spaces.

Example

options ldap.name "cn=root,o=networkappliance,c=us"

Specifying the administrative password

To specify a password for the administrative user, complete the following step.

Step	Action
1	Enter the following command: options ldap.passwd password password is the password for the administrative user. The password is displayed as a series of asterisks.

Specifying the LDAP port

You might need to specify the port to use for LDAP queries if the LDAP server has been set up to use a port other than the default for LDAP, port 389.

To specify the LDAP port, complete the following step.

Step	Action
1	Enter the following command: options ldap.port N N is the LDAP port number.

LDAP server option precedence

Data ONTAP chooses an LDAP server based on your LDAP server option settings, as described in the following table.

Server designation option	Server selection order
`ldap.preferred.servers`	When specified, servers listed in this option value will be tried first, according to list order.
ldap.servers	When no `ldap.preferred.servers` are specified, or specified servers are not available, servers designated in this option value will be tried, according to list order.
`ldap.ADdomain`	When no `ldap.preferred.servers` and no `ldap.servers` are specified or available, servers designated in this option value will be tried using domain controller selection methodology. For information about domain controller selection methodology, see Monitoring CIFS activity.