Configuring The Search Filter For An Ldap Server Group - Cisco 4700M Configuration Manual

Chapter 2 Configuring Authentication and Accounting Services
Configuring the ACE as a Client of a RADIUS, TACACS+, or LDAP Server

Configuring the Search Filter for an LDAP Server Group

For an LDAP server group, the ACE transmits a search filter to the LDAP server
to look up a user in the database. Search filters enable you to define search criteria
and provide more efficient and effective searches. The search filter is used in the
search request sent by the LDAP client to the server to locate the user's node in
the DIT. Use the filter search-user command to configure the exact filter to use.
The $user and $contextid are substituted with actual values when sending the
request.
The search filter should follow the format defined in RFC 2254. The LDAP client
sends the search request with the configured search filter after replacing the
$userid and $contextid with the userid that the client is trying to authenticate and
the associated virtual context name.The ACE allows $userid and $contextid to be
used as placeholders for the user ID and the context name.
The search filter is a mandatory configuration for an LDAP server group. Without
Note
this setting, a user cannot be authenticated.
You configure the LDAP search filter at the subconfiguration level for the LDAP
server group (created as described in the "Configuring AAA Server Groups"
section).
The syntax of this command is as follows:
filter search-user text
The text argument is the search request. The search filter is a quoted text string of
a maximum of 63 alphanumeric characters without spaces.
For example, to configure a search request, enter:
host1/Admin(config)# aaa group server ldap LDAP_Server_Group1
host1/Admin(config-ldap)# filter search-user "(&(objectclass=person)
(&(cn=$userid)(cid=$contextid)))"
To delete the search request, enter:
host1/Admin(config-ldap)# no filter search-user
"(&(objectclass=person)(&(cn=$userid)(cid=$contextid)))"
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
2-45
OL-16202-01