ldap modify

--urls URI_LIST

If Active Directory domain auto-discovery is disabled, enter URIs of LDAP servers (domain controllers in the Active Directory joined domain). The order of listing defines the priority order. The URI with highest priority that has a good health status is used.

The domain controllers should all be in the same Active Directory domain which  VAST Cluster joins.

Specify URI_LIST as a comma-separated list of URIs in the format <scheme>://<address>.

Examples:

--enable-use-ldaps

Enables use of LDAPS for Active Directory domain auto-discovery.

When enabled, VAST Cluster connects to an alternative port (port 636 for the domain controller, port 3269 for the Global Catalog) and initiates a TLS handshake immediately afterwards.

--disable-use-ldaps

Disables use of LDAPS for Active Directory domain auto-discovery.

--port PORT

Sets the port of the remote LDAP server. Recommended values: 389 for LDAP (with or without TLS), 636 for LDAPS.

--binddn BIND_DN

Sets the bind DN for authenticating to the LDAP server. The bind DN specifies the user with which VAST Cluster authenticates to the LDAP directory.

You can specify any user account that has read access to the domain.

This bind DN must be set if --method simple is specified.

The format is a comma separated list of components. Each component is an attribute=value pair defining an object in the directory tree. The first component is a cn attribute component specifying the user object, the next component is its container and so on up the tree, with the last component representing the top level domain.

The following attributes can be specified:

For example, cn=admin,ou=users,dc=mydomain,dc=local specifies user 'admin' located in the 'users' container under the domain 'mydomain.local'.

If multi-forest authentication is enabled and/or SASL authentication method is used, specify the bind DN in one of the following formats:

--bindpw BIND_PASSWORD

Sets the password used with the bind DN to authenticate to the LDAP server.

This password must be set if --method simple is specified.

--basedn BASE_DN

If Active Directory domain auto-discovery is disabled, specifies the entry in the LDAP directory tree to use as a starting point for user queries. By default, this is also used as the starting point for group queries. Optionally, you can specify a different entry as the group base DN on --group-searchbase.

To maximize the speed of authentication queries, start the search in the lowest branch of the tree under which all users can be found. For example, if the entire directory must be queried, the search base must specify the root of the tree. However, if the search can be restricted to a specific organizational unit (OU), queries may be faster.

Specify BASE_DN as a comma separated list of components. Each component is an attribute=value pair defining an object in the directory tree. The first component defines the object at the lowest part of the tree that you want to use as the starting point of the search, the next component is its container and so on up the tree, with the last component representing the top level domain.

The following attributes can be specified:

For example, supposing your user accounts are all located in a container called 'users' under a domain 'mydomain.local'. If you want to set the users container as the starting point for search queries, you would enter: --basedn ou=users,dc=mydomain,dc=local

--group-basedn GROUP_BASE_DN

Sets the entry in the LDAP directory tree to use as a starting point for group queries. If not specified, the base DN is used.

--netgroup-basedn NETGROUP_BASE_DN

Sets the base DN for LDAP queries for netgroups. If not specified, the base DN is used for netgroup queries as well. Syntax is as for --basedn

--advanced-filter FILTER_STRING

Specify a search filter string to be to be appended to the search base DN in all user queries that VAST Cluster makes to this provider. Entries that do not match the filter string are filtered out from the query results.

--query-groups-mode COMPATIBLE|RFC2307BIS_ONLY|RFC2307_ONLY|NONE

The mode for querying a user's auxiliary group memberships, when the auth provider is set as the source for group membership in the view policy:

--method simple|anonymous|sasl

The authentication method the LDAP server uses to authenticate VAST Cluster as a client querying the LDAP database.

When multi-forest authentication is enabled, VAST Cluster uses SASL for the LDAP bind to domain controllers in other trusted forests, and this setting is only honored for the LDAP bind to domain controllers in the forest of the cluster's joined domain.

Set the method according to how the LDAP server is configured to authenticate clients:

--domain-name DOMAIN_NAME

Sets the fully qualified domain name (FQDN) of the domain to join.

For example: --domain-name company-ad.com

--use-tls

Enables TLS (StartTLS) to secure communication between VAST Cluster and the LDAP server.

When enabled,  VAST Cluster connects to the standard port (port 389 for the domain controller, port 3268 for the Global Catalog) and performs a StartTLS operation as defined in RFC 4513.

Important

Use VAST Web UI to provide a TLS certificate.

--no-tls

Disables TLS (STARTTLS) secure communication between VAST Cluster and the LDAP server.

--vms-auth

If this option is specified, the LDAP configuration being created will be the one used for VMS authentication.

--no-vms-auth

If this option is specified, the LDAP configuration being created will not be used for VMS authentication. This is the default setting.

--reverse-lookup

Enables use of DNS reverse lookup for the translation of a client IP address to a host name. When this option is specified, the server compares the host name to host names in netgroup entries. If not specified, the server queries DNS for each host name found in the netgroup entries.

--no-reverse-lookup

Disables use of reverse DNS lookup. This is the default setting.

--super-admin-groups GROUPS

Grants members of specified groups on the provider cluster admin manager access to VMS. Users in these groups can log into VMS. To grant permissions to these users, add the group name to roles. By default, they are assigned a read-only role.  

--monitor-action PING|BIND

Determines the type of periodic health check that VAST cluster performs for an Active Directory provider configured for the cluster: