ldap create

This command configures a connection to an LDAP-based directory server.

Usage

ldap create --urls URI_LIST
            --port PORT
            --basedn BASE_DN
            --method anonymous|simple|sasl
            --domain-name DOMAIN_NAME
            [--binddn BIND_DN]
            [--bindpw BIND_PASSWORD]
            [--group-basedn GROUP_BASE_DN]
            [--netgroup-basedn NETGROUP_BASE_DN]
            [--advanced-filter FILTER_STRING]
            [--query-groups-mode COMPATIBLE|RFC2307BIS_ONLY|RFC2307_ONLY|NONE]
            [--use-tls|--no-tls]
            [--vms-auth|--no-vms-auth]
            [--reverse-lookup|--no-reverse-lookup]
            [--gid-number ATTRIBUTE_NAME]
            [--uid ATTRIBUTE_NAME]
            [--uid-number ATTRIBUTE_NAME]
            [--member-uid ATTRIBUTE_NAME]
            [--posix-account ATTRIBUTE_NAME]
            [--posix-group ATTRIBUTE_NAME]
            [--match-user ATTRIBUTE_NAME]
            [--username-property-name ATTRIBUTE_NAME]
            [--user-login-name ATTRIBUTE_NAME]
            [--group-login-name ATTRIBUTE_NAME]
            [--mail-property-name ATTRIBUTE_NAME]
            [--uid-member-value-property-name ATTRIBUTE_NAME]
            [--super-admin-groups GROUPS]
            [--monitor-action PING|BIND]

Required Parameters

`--urls URI_LIST`	Enter URIs of LDAP servers. The order of listing defines the priority order. The URI with highest priority that has a good health status is used. Specify `URI_LIST` as a comma-separated list of URIs in the format `<scheme>://<address>`. Example: `--urls ldap://192.0.2.0,ldap://192.0.2.1,ldap://192.0.2.2`
`--port PORT`	Sets the port of the remote LDAP server. Recommended values: `389` for LDAP (with or without TLS), `636` for LDAPS.
`--basedn BASE_DN`	Specifies the entry in the LDAP directory tree to use as a starting point for user queries. By default, this is also used as the starting point for group queries. Optionally, you can specify a different entry as the group base DN on `--group-searchbase`. To maximize the speed of authentication queries, start the search in the lowest branch of the tree under which all users can be found. For example, if the entire directory must be queried, the search base must specify the root of the tree. However, if the search can be restricted to a specific organizational unit (OU), queries may be faster. Specify `BASE_DN` as a comma separated list of components. Each component is an attribute=value pair defining an object in the directory tree. The first component defines the object at the lowest part of the tree that you want to use as the starting point of the search, the next component is its container and so on up the tree, with the last component representing the top level domain. The following attributes can be specified: cn: common name ou: organizational unit o: organization c: country dc: domain
`--method anonymous\|simple\|sasl`	The authentication method the LDAP server uses to authenticate VAST Cluster as a client querying the LDAP database. Set the method according to how the LDAP server is configured to authenticate clients: `anonymous`. The LDAP server accepts queries without any authentication. `simple`. The LDAP server attempts to bind a specified user name to a matching LDAP user. If the LDAP bind succeeds, VAST Cluster is allowed to perform the query. If this method is specified, you have to set the bind DN on `--binddn` and password on `--bindpw`. `sasl`. The LDAP server performs the Simple Authentication and Security Layer (SASL) authentication process. If the SASL bind succeeds, VAST Cluster is allowed to perform the query. If this method is specified, you have to set the bind DN on `--binddn` and password on `--bindpw`, with the bind DN in the `username@domain` or `DOMAIN\username` format.
`--domain-name DOMAIN_NAME`	Sets the fully qualified domain name (FQDN) of the domain to join. For example: -`-domain-name company-ad.com`

Options

`--binddn BIND_DN` (required if `--method simple` or `--method sasl` is specified)	Sets the bind DN for authenticating to the LDAP server. The bind DN specifies the user with which VAST Cluster authenticates to the LDAP directory. Enter the bind DN for authenticating to the LDAP domain. The bind DN specifies the user with which VAST Cluster authenticates to the LDAP directory. You can specify any user account that has read access to the domain. The format is a comma separated list of components. Each component is an attribute=value pair defining an object in the directory tree. The first component is a cn attribute component specifying the user object, the next component is its container and so on up the tree, with the last component representing the top level domain. The following attributes can be specified: cn: common name ou: organizational unit o: organization c: country dc: domain For example, `cn=admin,ou=users,dc=mydomain,dc=local` specifies user 'admin' located in the 'users' container under the domain 'mydomain.local'.
`--bindpw BIND_PASSWORD` (required if `--method simple` or `--method sasl` is specified)	Sets the password used with the bind DN to authenticate to the LDAP server.
`--group-basedn GROUP_BASE_DN`	Sets the entry in the LDAP directory tree to use as a starting point for group queries. If not specified, the base DN is used.
--netgroup-basedn NETGROUP_BASE_DN	Sets the base DN for LDAP queries for netgroups. If not specified, the base DN is used for netgroup queries as well.
`--advanced-filter FILTER_STRING`	Specify a search filter string to be to be appended to the search base DN in all user queries that VAST Cluster makes to this provider. Entries that do not match the filter string are filtered out from the query results.
`--query-groups-mode COMPATIBLE\|RFC2307BIS_ONLY\|RFC2307_ONLY\|NONE`	The mode for querying a user's auxiliary group memberships, when the auth provider is set as the source for group membership in the view policy: COMPATIBLE (default). Groups are queried using an aggregate of the RFC2307BIS and RFC2307 compliant group membership queries (see the other options). You can use this default option unless you are using an authentication provider which is incompatible with this aggregated query mode. RFC2307BIS_ONLY. Auxiliary group memberships are queried according to the RFC2307BIS standard, in which the group has a members attribute that contains the Distinguished Name (DN) of the member user and the user has a memberOf attribute which contains the DNs of the groups to which the user belongs. This standard is used by Active Directory and may be used with other LDAP-based authorization providers with LDAP schema extensions. RFC2307_ONLY. Auxiliary group memberships are queried according to the RFC2307 standard, in which the group object has a memberUid attribute for each user object that is a member of the group, specifying the name of the user object. This standard may be used by openLDAP, freeIPA and other LDAP-based authorization providers. NONE. If this option is selected, auxiliary group memberships are not queried at all. In the event that the relevant view's view policy cites the authorization provider as the group membership source and the user tries to access a file or directory within that view to which the user only has permission as a member of a the owning user's group, permission will not be granted.
`--use-tls`	Enables TLS (StartTLS) to secure communication between VAST Cluster and the LDAP server. When enabled, VAST Cluster connects to the standard port (port 389 for the domain controller, port 3268 for the Global Catalog) and performs a StartTLS operation as defined in RFC 4513. Important Use VAST Web UI to provide a TLS certificate.
`--no-tls`	Disables TLS (STARTTLS) secure communication between VAST Cluster and the LDAP server.
`--vms-auth`	If this option is specified, the LDAP configuration being created will be the one used for VMS authentication.
`--no-vms-auth`	If this option is specified, the LDAP configuration being created will not be used for VMS authentication. This is the default setting.
`--reverse-lookup`	Enables use of DNS reverse lookup for the translation of a client IP address to a host name. When this option is specified, the server compares the host name to host names in netgroup entries. If not specified, the server queries DNS for each host name found in the netgroup entries.
`--no-reverse-lookup`	Disables use of reverse DNS lookup. This is the default setting.
`--super-admin-groups GROUPS`	Grants members of specified groups on the provider cluster admin manager access to VMS. Users in these groups can log into VMS. To grant permissions to these users, add the group name to roles. By default, they are assigned a read-only role.
`--monitor-action PING\|BIND`	Determines the type of periodic health check that VAST cluster performs for an Active Directory provider configured for the cluster: `PING` (default): Ping the provider. This option creates less overhead and reduces impact on the provider. `BIND`: Bind to the provider.

Attribute Mapping Options

If your LDAP server uses attributes that differ from the default RFC2307-compliant attribute set that is used to query the LDAP server, these options map those attributes to the attribute names used on the server you are connecting the cluster to. This is typically needed for Active Directory.

Example: uid=cn --posix-account user --posix-group group

`--gid-number ATTRIBUTE_NAME`	The attribute of a group entry that contains the GID number of a group. Default: gidNumber Example for Active Directory: `--gid-number gidNnumber`
`--uid ATTRIBUTE_NAME`	The attribute of a user entry that contains the user name. Default: uid Example for Active Directory: `--uid sAMAccountName`
`--uid-number ATTRIBUTE_NAME`	The attribute of a user entry that contains the UID number. Default: uidNumber
`--member-uid ATTRIBUTE_NAME`	The attribute of the group entry that contains names of group members. Example for Active Directory: `--member-uid member`
`--posix-account ATTRIBUTE_NAME`	The object class that defines a user entry.
`--posix-group ATTRIBUTE_NAME`	The object class that defines a group entry.
`--match-user ATTRIBUTE_NAME`	Use this option to specify which attribute to use for matching users across providers during user refresh and user authentication. When querying a provider for a user that matches a user that was already retrieved from another provider, a user entry that contains a matching value in this attribute will be considered the same user as the user previously retrieved. Example: `--match-user sAMAccountName`
`--username-property-name ATTRIBUTE_NAME`	Overrides 'name' as the attribute to use for querying users in VMS user-initiated user queries.
`--user-login-name ATTRIBUTE_NAME`	Specifies the attribute used to query the provider for the user's login name. For example: `--user-login-name sAMAccountName`
`--group-login-name ATTRIBUTE_NAME`	Specifies the attribute used to query the provider for the group's login name. For most environments, it is recommended to use the default value of `cn`.
`--mail-property-name ATTRIBUTE_NAME`	Specifies the attribute to use for the user's email address.
`--uid-member-value-property-name ATTRIBUTE_NAME`	Specifies the attribute which represents the value of the LDAP group's `member` property.

Example

vcli: admin> ldap create --url ldap://mydomain.local --port 389 --binddn admin@mydomain.local --bindpw !@WE56yt -group searchbase ou=groups,dc=mydomain,dc=local --method simple --domain-name company-ad.com --uid=distinguishedName --member-uid member --posix-account user --posix-group group --use-tls

This example sets the base DN, group DN and netgroup DN:

vcli: admin> ldap modify --id 6 --basedn OU=People,DC=ab,DC=abc,DC=com --group-basedn OU=groups,DC=ab,DC=abc,DC=com --netgroup-basedn OU=netgroups,OU=system,DC=ab,DC=abc,DC=com