Configuring direct authentication with LDAP by using the command line

Use the command line to configure the appliance to pass user credentials to the LDAP server and use them as the bind credentials.

Before you begin

CAUTION:

Read the topic Important: avoiding user lock out when configuring role based management before you attempt to set up authentication with LDAP

About this task

You can use commands to configure role based management such that the appliance uses user credentials directly to bind the LDAP server. If the bind is successful, the user who is attempting to log in to the appliance is successfully authenticated. See User authentication with LDAP for a description of this method of authentication.

Procedure

Connect to the IBM MQ Appliance as described in Command line access. Log in as an administrative user.
Type config to enter global configuration mode.
Type the following command to configure role based management:
```
rbm
```
Enter the following command to specify the LDAP authentication method:
```
au-method ldap
```
Specify the host name of the LDAP server (you can use a host alias if you have defined one):
```
au-server-host host
```
Specify the port to use when connecting to the LDAP server:
```
au-server-port port
```
The usual port for an LDAP server is 389, or 636 for an SSL connection.
Specify the LDAP version that is used to access the LDAP server for RBM authentication:
```
ldap-version version
```
Where version is v2 or v3. The default value is v2.
Optionally specify a load balancer group. (See Creating a load balancer group profile by using the command line for details of how to create a load balancer group):
```
loadbalancer-group name 
```
Specify the string that is used to prefix the user name, for example, cn=.
```
ldap-prefix prefix
```
Specify the string that is used to suffix user names, for example, dc=appliance123, dc=com.
```
ldap-suffix suffix
```
Specify the time that RBM authentication waits for a response from the LDAP server. The default value is 60. A value of 0 indicates that the wait never times out:
```
au-ldap-readtimeout seconds
```
If you need a secure connection with your LDAP server, you must specify an SSL client type of client, and the name of your SSL client profile (see Creating a TLS client profile by using the command line for details of how to create an SSL client profile):
```
ssl-client-type client
ssl-client name
```
Optionally specify fallback users who can log in to the appliance if the LDAP server is not available. Fallback users must already have been added as local users to the appliance. You can specify that all local users are fallback users by entering the following command:
```
fallback-login local
```
Alternatively, you can specify one or more particular users by entering the following commands:
```
fallback-login restricted
fallback-user localuser1
fallback-user localuser2
...
fallback-user localuserN
```
Alter the default LDAP cache settings, if required. By default, the appliance caches results of authentication attempts for 600 seconds, but you can change the mode of caching, and the caching duration by entering the following commands:
```
au-cache-mode mode
au-cache-ttl seconds
```
Where mode is one of:

absolute

Caches the results of user authentications for a period of time specified by the au-cache-ttl command (the explicit time-to-live). This is the default setting.

disabled

Disables caching. The appliance will not cache any results and instead always authenticates every time a user requests access.

maximum

Compares the explicit TTL to the TTL contained in the response (if any) and cache authentication results for the maximum of the two values.

minimum

Compares the explicit TTL to the TTL contained in the response (if any) and cache authentication results for the minimum of the two values.

Example

The following example configures the appliance to use an LDAP server that is identified by the host alias ldap_host for user authentication. If a user attempts to log in with the user name Robin Dalemain, the string cn=Robin Dalemain, dc=appliance123, dc=com is passed to the LDAP server and used as the bind ID. Robin's password is used as the bind password. If the LDAP server is unavailable, any local appliance user can log in to the appliance.

mqa# config
Global configuration mode
mqa(config)# rbm
Modify RBM Settings configuration

mqa(config rbm)# au-method ldap
mqa(config rbm)# au-server-host ldap_host
mqa(config rbm)# au-server-port 389
mqa(config rbm)# ldap-version v3
mqa(config rbm)# ldap-prefix "cn="
mqa(config rbm)# ldap-suffix "dc=appliance123,dc=com"
mqa(config rbm)# fallback-login local
mqa(config rbm)# exit
mqa(config)# write memory
Overwrite previously saved configuration? Yes/No [y/n]: y
Configuration saved successfully.

What to do next

After you specify the user authentication method, you must next configure credential mapping.