H3C Technologies H3C WX3000E Series Wireless Switches - Manual (Page 60)

46
NOTE:
•
There may be many levels of directories on the LDAP server and a user DN search starting from the root
directory might take a long time. You can change the start point by specifying the search base DN to
improve search efficiency.
• If the usernames configured on the LDAP server do not contain domain names, configure the device to
remove domain names from the usernames to be sent to the LDAP server. Otherwise, configure the
device to send usernames containing domain names to the LDAP server.
• The Microsoft LDAP server defines a default user group attribute named memberOf. The IBM LDAP
server and Sun LDAP server have no default user group attribute, and you can configure a user group
attribute by modifying the schema on the LDAP server. If the Microsoft LDAP server is used, the device
obtains the user group by searching for the user DN. If the IBM server or Sun server is used and there is
no user-defined user group attribute, the device figures out the user group by checking each user group
to see whether it contains the user DN. For more information about user group attribute configuration,
see " Configuring LDAP group attributes ."
Configuring LDAP group attributes
User authorization is implemented by searching user groups and obtaining authorization information.
For user group search, you must specify the search method and criteria, that is, LDAP group attributes.
Because the user object class of Microsoft LDAP server contains user group attributes, specifying group
attributes is unnecessary for Microsoft LDAP server, but it is necessary for IBM and Sun LDAP servers.
Configurable LDAP group attributes are as follows:
• Group name attribute
• Group object class
• Member name attribute
• Search base DN
• Search scope
Generally, the group object class and member name attribute take the default values defined by the
server manufacturers. If no default values are specified or you want to customize them, you can use
commands to configure them.
To configure LDAP group attributes:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter LDAP scheme view. ldap scheme ldap-scheme-name N/A
3. Specify the search base
DN for group search.
group-parameters search-base-dn base-dn Not specified by default.
4. Specify the search scope
for group search.
group-parameters search-scope { all-level |
single-level }
Optional.
The default setting is
all-level.
5. Specify a user-defined
group object class for
group search.
group-parameters group-object-class
object-class-name Optional.
Not specified by default.
6. Specify the member name
attribute for group search. group-parameters member-name-attribute
attribute-name Optional.
Not specified by default.