Configuring Ldap Server Groups - Cisco MDS 9000 Series Configuration Manual

Configuring LDAP Server Groups

Procedure
Step 1
switch# configure terminal
switch(config)#
Enters global configuration mode.
Step 2 switch(config)# ldap-server host 10.10.1.1 rootDN cn=manager,dc=acme,dc=com password Ur2Gd2BH
timeout 60
Specifies the rootDN for the LDAP server database and the bind password for the root.
Optionally specifies the TCP port to use for LDAP messages to the server. The range is from 1 to 65535, and
the default TCP port is the global value or 389 if a global value is not configured. Also specifies the timeout
interval for the server. The range is from 1 to 60 seconds, and the default timeout is the global value or 5
seconds if a global value is not configured.
Step 3
switch(config)# exit
switch#
Exits configuration mode.
Step 4 switch# show ldap-server
(Optional) Displays the LDAP server configuration.
Step 5
switch# copy running-config startup-config
(Optional) Copies the running configuration to the startup configuration.
Configuring LDAP Server Groups
You can specify one or more remote AAA servers to authenticate users using server groups. All members of
a group must be configured to use LDAP. The servers are tried in the same order in which you configure
them.
You can configure these server groups at any time, but they take effect only when you apply them to an AAA
service.
Starting from Cisco MDS NX-OS Release 6.2(1), Cisco MDS 9000 Series switches support group-based user
roles. You can create a group on the LDAP servers and also create a group with the exact same name on the
Cisco MDS switch and then add users to the group. The user role attribute is inherited by the user from the
group that is configured. This can be accomplished using the Microsoft LDAP Server's built-in memberOf
attribute. If you wish to use the memberOf attribute, ensure that you create a role name on the switch. The
role name must be the same as the group name on the LDAP server.
Note
• A user can be part of only one group that is available on the switch.
• A user can be part of multiple groups, but only one group should be part of the switch role.
• A group name cannot have a space.
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
46
Configuring Security Features on an External AAA Server