Connecting to Your LDAP Server via VAST Web UI

  • Updated on Jan 30, 2026
  • Published on Jan 28, 2026
  • 9 minute(s) read
Prev Next

Note

Use this procedure to configure a connection to an LDAP-based directory server to use the server as an authorization provider for NFS access. This can be an Active Directory domain controller. However, if you are using this Active Directory domain controller to authenticate and authorize SMB users, the cluster needs to join the Active Directory domain. See Creating Active Directory Configuration via VAST Web UI.

  1. From the left navigation menu, select User Management and then LDAP.

  2. Click + Create LDAP to create an LDAP configuration or, to modify an existing configuration, open the Actions menu for an existing configuration and select Edit.

  3. In the General tab, enter details of your LDAP server:

    Field

    Description

    Auto discovery

    When creating a new LDAP configuration, this field is disabled.

    When updating an LDAP configuration that is used to connect to Active Directory, this field lets you disable Active Directory domain auto-discovery. When auto-discovery is disabled, the LDAP URI (URLs) and search base DN (Base DN) fields must be specified manually.

    Enable trusted domains on other forests

    When creating a new LDAP configuration, this field is not displayed.

    When updating an LDAP configuration that is used to connect to Active Directory, this option allows access for principals from trusted domains on other forests.

    When enabled, VAST Cluster automatically discovers all domains in other trusted forests, in addition to domains in the forest of the cluster's joined domain. For more information, see Active Directory Multi-Forest Authentication.

    This option can be enabled only if Auto discovery is on. If you are going to disable Auto discovery, set this option to off.

    Base DN

    The entry in the LDAP directory tree to use as a starting point for user queries. By default, this is also used as the starting point for group queries. Optionally, you can specify a different entry as the Group Base DN.

    To maximize the speed of authentication queries, start the search in the lowest branch of the tree under which all users can be found. For example, if the entire directory must be queried, the search base must specify the root of the tree. However, if the search can be restricted to a specific organizational unit (OU), queries may be faster.

    The format for base DN is a comma separated list of components. Each component is an attribute=value pair defining an object in the directory tree. The first component defines the object at the lowest part of the tree that you want to use as the starting point of the search, the next component is its container and so on up the tree, with the last component representing the top level domain.

    The following attributes can be specified:

    • cn: common name

    • ou: organizational unit

    • o: organization

    • c: country

    • dc: domain

    For example, supposing your user accounts are all located in a container called 'users' under a domain 'mydomain.local'. If you want to set the users container as the starting point for search queries, you would enter: ou=users,dc=mydomain,dc=local

    To specify the full domain as your search base, you would enter: dc=mydomain,dc=local

    URLs (required)

    Enter a comma-separated list of URIs of LDAP servers (domain controllers in the Active Directory joined domain). The order of listing defines the priority order. The URI with highest priority that has a good health status is used.

    Specify each URI in the format <scheme>://<address>. <address> can be either a DNS name or an IP address.

    Examples:

    • ldap://company-ad.com

    • ldaps://company-ad.com

    • ldap://company-ad.com,ldap://company-ad2.com

    • ldap://192.0.2.0,ldap://192.0.2.1,ldap://192.0.2.2

    Port (required)

    The port of the remote LDAP server.

    Recommended values: 389 for LDAP (with or without TLS), 636 for LDAPS.

    Note

    Setting non-recommended values may cause LDAP connectivity issues.

    Domain name (required)

    The fully qualified domain name (FQDN) of the domain to join.

    Example: company-ad.com

  4. In the Attribute mappings tab:

    1. Ensure that OpenLDAP is selected in the  Templates for advanced setting field. (This is the default setting when creating or editing a LDAP configuration.)

      When the OpenLDAP template is set, the tab displays RFC2307-compliant names for user and group attributes that can be used by a LDAP provider.

    2. Verify that the attribute names match the actual names used by your LDAP provider. If needed, edit an attribute name as appropriate by overtyping the field value.

      Tip

      To clear all fields, select Custom in the  Templates for advanced setting dropdown.

    Field

    Description

    Default (RFC2307)

    GID Number

    The attribute of a group entry that contains the GID number of a group.

    gidNumber

    UID

    The attribute of a user entry that contains the user name.

    uid

    Group login name

    The attribute used to query the provider for the group login name.

    For most environments, it is recommended to use the default value of cn.

    cn

    UID Number

    The attribute of a user entry that contains the UID number.

    uidNumber

    Member UID

    The attribute of the group entry that contains names of group members.

    memberUID

    Posix Account

    The object class that defines a user entry.

    posixAccount

    Posix Group

    The object class that defines a group entry.

    posixGroup

    Match User

    The attribute to use when querying a provider for a user that matches a user that was already retrieved from another provider. A user entry that contains a matching value in this attribute will be considered the same user as the user previously retrieved.

    uid

    Username Property Name

    The attribute to use when querying a provider for a user when the query is initiated by a VMS user.  

    cn

    User login name

    The attribute used to query the provider for the user login name.

    uid

    UID member value property name

    Specifies the attribute which represents the value of the group's member property.

    uid

    Mail property name

    The attribute to use for the user's email address.

    mail

  5. In the Encryption tab, set or modify these settings as necessary:

    Field

    Description

    Use LDAPS

    Enables or disables use of LDAPS if Auto discovery is enabled.

    When enabled, VAST Cluster connects to an alternative port (port 636 for the domain controller, port 3269 for the Global Catalog) and initiates a TLS handshake immediately afterwards.

    Secure LDAP communication using StartTLS

    Enable the use of TLS (StartTLS) to secure communication between VAST Cluster and the LDAP server.

    When enabled,  VAST Cluster connects to the standard port (port 389 for the domain controller, port 3268 for the Global Catalog) and performs a StartTLS operation as defined in RFC 4513.

    Upload TLS certificate

    Paste a valid TLS certificate here.

    If you choose to leave this field blank, the VAST Cluster's TLS client will not request the LDAP server's TLS certificate and will ignore any certificate received.

    Important

    Regardless of this field's value, ensure that the LDAP server is not configured to request client certificates (TLSVerifyClient should be set to never). Otherwise, connections will fail.

  6. In the Advanced settings tab, set or modify these settings as necessary:

    Field

    Description

    VMS Auth Provider

    When enabled, this LDAP configuration is the one that is used for VMS authentication.

    Netgroup DNS operation mode

    Determines whether DNS reverse lookup is used for the translation of a client IP address to a host name:

    • Normal (default): The server queries DNS for each host name found in the netgroup entries.

    • Reverse lookup: The server compares the host name to host names in netgroup entries.

    Authentication method (required)

    The authentication method the LDAP server uses to authenticate VAST Cluster as a client querying the LDAP database.

    When multi-forest authentication is enabled, VAST Cluster uses SASL for the LDAP bind to domain controllers in other trusted forests, and this setting is only honored for the LDAP bind to domain controllers in the forest of the cluster's joined domain.

    Set the method according to how the LDAP server is configured to authenticate clients:

    • Anonymous. The LDAP server accepts queries without any authentication.

    • Simple. The LDAP server attempts to bind a specified user name to a matching LDAP user. If the LDAP bind succeeds, VAST Cluster is allowed access to perform the query. If this method is selected, you have to set Bind DN and Bind password.

    • SASL. The LDAP server performs the Simple Authentication and Security Layer (SASL) authentication process. If the SASL bind succeeds, VAST Cluster is allowed to perform the query. If this method is specified, you have to set Bind DN and Bind password, with the bind DN in the username@domain or DOMAIN\username format.

    Bind DN (required if Authentication method is set to Simple or SASL)

    Format is as described for Base DN beginning with a cn attribute component specifying the user object.

    If  multi-forest authentication is enabled and/or SASL authentication method is used, specify the bind DN in one of the following formats:

    • username@domain

    • DOMAIN\username

    Bind password (required if Authentication method is set to Simple or SASL)

    This field appears if Simple is selected in the Authentication method field. This is the password used with the Bind DN to authenticate to the LDAP server.

    Query group mode

    Sets the mode for querying a users' auxiliary group memberships, where applicable:

    Note

    Group memberships may or may not be queried during access checks depending on the Group Membership Source setting in the view policy.

    • Compatible (default). Groups are queried using an aggregate of the RFC2307BIS and RFC2307 compliant group membership queries (see the other options).  You can use this default option unless you are using an authentication provider which is incompatible with this aggregated query mode.  

    • RFC2307BIS only. Auxiliary group memberships are queried according to the RFC2307BIS standard, in which the group has a member attribute that contains the Distinguished Name (DN) of the member user and the user has a memberOf attribute which contains the DNs of the groups to which the user belongs.  This standard is used by Active Directory and may be used with other LDAP-based authorization providers with LDAP schema extensions.  

    • RFC2307 only. Auxiliary group memberships are queried according to the RFC2307 standard, in which the group object has a memberUid attribute for each user object that is a member of the group, specifying the name of the user object. This standard may be used by openLDAP, freeIPA and other LDAP-based authorization providers.

    • None. If this option is selected, auxiliary group memberships are not queried at all. In the event that the relevant view's view policy cites the authorization provider as the group membership source and the user tries to access a file or directory within that view to which the user only has permission as a member of a the owning user's group, permission will not be granted.

    Group base DN

    The base DN for group queries within the joined domain. When Auto discovery is enabled, group queries outside the joined domain use base DNs that are auto-discovered.

    Posix attributes source

    Determines domains from which VAST Cluster queries POSIX attributes. Options include:

    • Joined domain. The domain which VAST Cluster has joined.

    • All domains in the joined forest. All domains in the Active Directory forest of the cluster's joined domain and, if  multi-forest authentication is enabled, from other trusted forests.

    • Specific domains. One or more domains specified in Domains with posix attributes.

    • Global catalog. All domains included in the Active Directory global catalog of the cluster's joined domain forest. When this option is chosen, the global catalog must be configured with POSIX attributes.

    Note

    This option is available when modifying an existing LDAP configuration. It cannot be set when creating a LDAP configuration.

    Domains with posix attributes

    After you set  Posix attributes source to Specific domains, use this option to list the specific domains. The listed domains can be in the forest of the cluster's joined domain, and also in other trusted forests which have a two-way trust with the cluster's forest.

    Note

    This option is available when modifying an existing LDAP configuration. It cannot be set when creating a LDAP configuration.

  7. Click Create or Update.

    The LDAP client configuration is created/updated. For a new configuration, the State will initially indicate Not Connected, and then change to Connected.

Related articles