Cisco TelePresence Administrator's Manual page 266

User accounts
Field Description
Host name The way in which the server address is specified
and Domain depends on the FQDN address resolution setting:
or SRV record: only the Domain portion of the server
address is required.
Server
address Address record: enter the Host name and Domain.
These are then combined to provide the full server
address for the DNS address record lookup.
IP address: the Server address is entered directly
as an IP address.
Port The IP port to use on the LDAP server.
Encryption Determines whether the connection to the LDAP
server is encrypted using Transport Layer Security
(TLS).
TLS: uses TLS encryption for the connection to the
LDAP server.
Off: no encryption is used.
The default is TLS.
Certificate Specifies whether certificate revocation lists (CRLs)
revocation list are checked when forming a TLS connection with
(CRL) the LDAP server.
checking
None: no CRL checking is performed.
Peer: only the CRL associated with the CA that
issued the LDAP server's certificate is checked.
All: all CRLs in the trusted certificate chain of the CA
that issued the LDAP server's certificate are
checked.
The default is None.
Authentication configuration: this section specifies the VCS's authentication credentials to use when binding to
the LDAP server.
Bind DN The distinguished name (case insensitive) used by
the VCS when binding to the LDAP server.
It is important to specify the DN in the order cn=, then
ou=, then dc=
Bind The password (case sensitive) used by the VCS
password when binding to the LDAP server.
SASL The SASL (Simple Authentication and Security
Layer) mechanism to use when binding to the LDAP
server.
None: no mechanism is used.
DIGEST-MD5: the DIGEST-MD5 mechanism is used.
The default is DIGEST-MD5.
Cisco VCS Administrator Guide (X8.1.1)
Configuring remote account authentication using LDAP
Usage tips
If using TLS, the address entered here
must match the CN (common name)
contained within the certificate presented
by the LDAP server.
Typically, non-secure connections use
389 and secure connections use 636.
When TLS is enabled, the LDAP
server's certificate must be signed by an
authority within the VCS's trusted CA
certificates file.
Click Upload a CA certificate file for
TLS (in the Related tasks
to the Managing the trusted CA
certificate list [p.285] page.
If you are using revocation lists, any
required CRL data must also be included
within the CA certificate file.
Any special characters within a name
must be escaped with a backslash as
per the LDAP standard (RFC 4514). Do
not escape the separator character
between names.
The bind account is usually a read-only
account with no special privileges.
The maximum plaintext length is 60
characters, which is then encrypted.
Enable Simple Authentication and
Security Layer if it is company policy to
do so.
section) to go
Page 266 of 507