ldap-server authentication
Function
The ldap-server authentication command configures an LDAP authentication server.
The undo ldap-server authentication command deletes an LDAP authentication server.
By default, no LDAP authentication server is configured.
Format
ldap-server authentication ip-address [ port-number ] [ secondary | third ] [ ssl ]
undo ldap-server authentication [ secondary | third ]
Parameters
| Parameter | Description | Value |
|---|---|---|
| ip-address | Specifies the IP address of an LDAP authentication server. | The value is in dotted decimal notation. |
| port-number | Specifies the port number of an LDAP authentication server. | The value is an integer that ranges from 1 to 65535. The default value is 389. If the ssl parameter is specified, the default value is 636. The port number must be the same as that on the LDAP server. NOTE:
If the ssl parameter is specified, the default value 636 is used if the configured port number is 389. |
| secondary | Indicates the secondary LDAP authentication server. | - |
| third | Indicates the third LDAP authentication server. | - |
| ssl | This parameter must be specified when the LDAP authentication between the device and LDAP server uses LDAP over SSL. The device uses a CA certificate to authenticate the LDAP server. | - |
Usage Guidelines
During LDAP authentication, LDAP is used in interaction between the device and LDAP server. The LDAP data transmission is not encrypted. For security, you can use LDAP based on SSL for encrypted transmission. LDAP server certificates need to be imported into the device to authenticate the LDAP server.
When the LDAPS server is used for authentication, you need to run the certificate-check none command in the default PKI realm view to disable the function of checking whether a certificate is revoked.
Example
# Configure the primary LDAP authentication server.
<AC6605> system-view [AC6605] ldap-server template temp1 [AC6605-ldap-temp1] ldap-server authentication 10.1.1.1 389
<AC6605> system-view [AC6605] ldap-server template temp1 [AC6605-ldap-temp1] ldap-server authentication 10.1.1.1 636 ssl
