D-Link NetDefendOS User Manual page 619

determines the correct ID to use.
• Retrieve Group Membership
This option specifies if the groups that a user belongs to should be retrieved from the LDAP
server. The group name is often used when granting user access to a service after a successful
login.
If the Retrieve Group Membership option is enabled then the Membership Attribute option,
described next can also be set.
• Membership Attribute
The Membership Attribute defines which groups a user is a member of. This is similar to the
way a user belongs to either the admin or audit database group in NetDefendOS. This is
another tuple defined by the server's database schema and the default ID is MemberOf.
In Microsoft Active Directory, the groups a user belongs to can be found by looking at a user's
details under the MemberOf tab.
• Use Domain Name
Some servers require the domain name in combination with a username for performing
successful authentication. The domain name is the host name of the LDAP server, for
example myldapserver. The choices for this parameter are:
i. Do Not Use - This will not modify the username in any way. For example, testuser.
ii. Username Prefix - When authenticating, this will put <domain name>\ in front of the
username. For example, myldapserver/testuser.
iii. Username Postfix - When authenticating, this will add @<domain name> after the
username. For example, testuser@myldapserver.
If the choice is other than Do Not Use, the Domain Name parameter option described below
should be specified.
Different LDAP servers could handle the domain name differently so the server's
requirements should be checked. Most versions of Windows Active Directory require the
Postfix option to be used.
When using the OpenLDAP server and with most non-Microsoft LDAP servers, this property
should be set to Do not use and the next property Combined User Name should be enabled.
• Combined User Name
When using the OpenLDAP server, the Use Domain Name property should be set to Do not
use and this property should be enabled. Other non-Microsoft LDAP servers will probably also
require that this option be enabled.
• Optional Attribute
If the Combined User Name property is enabled, it is also possible to use this property to
specify an optional text attribute to be sent to the server. For example, if this property is set
619
Chapter 8: User Authentication