Managing LDAP user-mapping services

LDAP-based user-mapping services

You can use LDAP services to map between UNIX and Windows user accounts, instead of using NIS data or to adding entries to the usermap.cfg file. By default, Data ONTAP uses the same (one-to-one) user account resolution process in both directions: UNIX-to-Windows mapping and Windows-to-UNIX mapping.

For detailed information, see the following sections:

Converting to LDAP-based user-mapping

When converting to LDAP from file-based user-mapping, you must remove mapping entries (except for null session entries) from the usermap.cfg file. If mapping entries are present in that file, they will be used for user-mapping instead of LDAP records.

Note
If you've configured Data ONTAP for null sessions, make sure you leave the null session client entry in the usermap.cfg file. For more information about null session configuration, see Managing ACLs.

Configuring Data ONTAP for LDAP-based user-mapping

By default, LDAP-based user-mapping is disabled. (Data ONTAP retrieves user-mapping information from the etc/usermap.cfg file.)

Note
To allow Data ONTAP access to LDAP lookup services, if your UNIX user account information is stored in a non-Active Directory LDAP server, that LDAP server must be configured to allow either simple authentication or anonymous user searches.

To enable LDAP-based user-mapping, complete the following steps.

Step	Action
1	From the Data ONTAP command line, specify a value for the option `ldap.usermap.attribute.windowsaccount`. `options ldap.usermap.attribute.windowsaccount` account_name account_name is the user object attribute Data ONTAP will use for Windows account lookups.
2	Extend your LDAP schema to include the user object attribute you entered in Step 1.
3	From the Data ONTAP command line, specify a value for the option `ldap.usermap.attribute.unixaccount`. `options ldap.usermap.attribute.unixaccount` account_name account_name is the user object attribute Data ONTAP will use for UNIX account lookups.
4	Extend your LDAP schema to include the values you entered in Step 2 and Step 3.
5	Enter the following command: `options ldap.usermap.enable on` If you have a significant load on your LDAP server, you might want to improve performance by setting a separate search base or search base and scope for user-mapping, as described in the following section.

Specifying base and scope values for user-mapping

LDAP options allow you to set search base and scope, to limit attribute searches to the appropriate areas of your LDAP database. Setting these options will improve the speed of LDAP lookups.

Use the following syntax when specifying search base and scope. Base and scope values must correspond to the structure of your LDAP data.

options ldap.usermap.base "base[:scope][;base2[:scope2]]"

Example 1:

options ldap.usermap.base ou=People,dc=domain0"

Entering this command sets the search base for user-mapping lookups to ou=People,dc=domain0 and the (unspecified) search scope defaults to SUBTREE.

Example 2:

options ldap.usermap.base "(ou=People,dc=domain0):BASE;o=org"

The use of parentheses applies the specified search scope (BASE) to ou=People,dc=domain0. The unspecified search scope for the o ("org") object defaults to SUBTREE.

For more information about setting search base and scope values, see your LDAP documentation.