Edit system LDAP configuration

Edit online

Allows the Manager to the ability to authenticate with an external LDAP / AD server. The Manager Administration Guide has detailed information, including troubleshooting.

Request

Edit online

Security

Edit online
Table 1. Roles capable of executing the Edit System LDAP Configuration API method
Any Super User System Admin Security Admin Operator
  superUser systemAdmin    

HTTP method

Edit online

POST /manager/api/{apiResponseType}/1.0/editSystemLdapConfiguration.adm HTTP/1.1 Host:{manager.dsnet} enabled={true|false}&ldapType={ldapType}&domain={ldapDomain}&providerUrl={ldapUrl}

Curl method

Edit online

curl -u {admin}:{password} -k ”https://{manager.dsnet}/manager/api/{apiResponseType}/1.0/editSystemLdapConfiguration.adm“ -d ”enabled={true|false}&ldapType={ldapType}&domain={ldapDomain}&providerUrl={ldapUrl}“

Parameters

Edit online
Table 2. Request parameters for Edit System LDAP Configuration (editSystemLdapConfiguration) API method
Parameter Type Usage Default Description
enabled Boolean Optional false

Enable or disable Active Directory.

  • true - Domain is needed.
  • false - No other parameters are received and LDAP is disabled.
ldapType String Optional  

LDAP enabled for AD or LDAP. Value must be either activeDirectory or other.
domain String Optional  

Domain for AD or LDAP server.
providerUrl String Optional  

LDAP URL.
searchBase String Optional  

LDAP search base.
accountClass String ldapType=other  

An objectClass that identifies entries.
searchUsernameAttribute String ldapType=other  

User name search attribute.
searchUsernameAttributeHasDomain String Optional  

Specifies whether searchUsernameAttribute includes a domain.
bindWithUsername String Optional  

Specifies whether to bind with the user name or bind with the account DN and search for DN using user name.
searchAuthenticated Boolean Optional  

true when bindWithUsername=false and search requires authentication.
searchBindUsername String searchAuthenticated=true  

Search bind user name.
searchBindPassword String searchAuthenticated=true  

Search bind password.
groupEnabled Boolean Optional  

True when groups are enabled.

If true, the parameters that are listed can be received. Ignored if false.
displayNameAttribute String Optional  

Account display name attribute.
emailAttribute String groupEnabled=true  

Account email attribute.
groupsOnAttribute Boolean Optional  

true when group DNs are available directly from an account attribute.
groupsAttributeName String groupsOnAttribute=true  

Groups attribute name.
groupClass String groupsOnAttribute=false    
groupSearchBase String Optional  

Group search base. Ignored if groupsOnAttribute=true
groupMemberAttribute String groupsOnAttribute=false  

Group member attribute.
groupMemberValueDN Boolean    

Set to false if groupMemberAttribute is bare user name.
certificatePem String Optional  

Self-signed certificates in PEM format.
dynamic Boolean   false

Indicates whether dynamic LDAP service location should be enabled.
dnsDomainName String    

Base DNS domain name to use for LDAP service location (Needed when dynamic is true).
dynamicProviderUrl String Optional ldaps://$host:636 

A template for building an LDAP URL when given an LDAP service host name, where the special string $host is replaced with the host name.

Note:

When setting up Active Directory, the parameters enabled, ldapType, domain, and providerUrl are needed. For LDAP, the above are needed and (at a minimum), searchUsernameAttribute and accountClass.

For ldapType, activeDirectory: The user name and password that is entered by the user serves as the bind authentication credentials against the Active Directory / LDAP server. The user name that is entered by the user is used to search for the user’s DN. The found DN along with the password that is entered by the user serves as the bind authentication credentials against the Active Directory / LDAP server.