AudioCodes Mediant 4000 SBC - Configuring the LDAP Search Filter Attribute

CHAPTER16 Services
Mediant 4000 SBC | User's Manual
4. Configure an LDAP DN base path according to the parameters described in the table below.
5. Click Apply, and then save your settings to flash memory.
Table 16-10:LDAP Server Search Base DN Table Parameter Descriptions
Parameter Description
'Index'
set internal-index
[LdapServersSearchDNs_
Index]
Defines an index number for the new table row.
Note: Each row must be configured with a unique index.
'Base DN'
set base-path
[LdapServersSearchDNs_
Base_Path]
Defines the full path (DN) to the objects in the AD where the
query is done.
The valid value is a string of up to 256 characters.
For example: OU=NY,DC=OCSR2,DC=local. In this example,
the DN path is defined by the LDAP names, OU (organizational
unit) and DC (domain component).
Configuring the LDAP Search Filter Attribute
When the LDAP-based login username-password authentication succeeds, the device searches
the LDAP server for all groups of which the user is a member. The LDAP query is based on the
following LDAP data structure:
■ Search base object (distinguished name or DN, e.g.,
"ou=ABC,dc=corp,dc=abc,dc=com"): The DN defines the location in the directory from
which the LDAP search begins and is configured in Configuring LDAP DNs (Base Paths) per
LDAP Server.
■ Filter (e.g., "(&(objectClass=person)(sAMAccountName=johnd))"): This filters the search
in the subtree to include only the login username (and excludes others). This is configured by
the 'LDAP Authentication Filter' parameter, as described in the following procedure. You can
use the dollar ($) sign to represent the username. For example, the filter can be configured as "
(sAMAccountName=$)", where if the user attempts to log in with the username "SueM", the
LDAP search is done only for the attribute sAMAccountName that equals "SueM".
■ Attribute (e.g., "memberOf") to return from objects that match the filter criteria: The
attribute is configured by the 'Management Attribute' parameter in the LDAP Servers table (see
Configuring LDAP Servers).
Therefore, the LDAP response includes only the groups of which the specific user is a member.
- 225 -