About directory service authentication

You can use an external authentication directory service (also called an enterprise directory or authentication login domain) to provide a single sign-on for groups of users instead of maintaining individual local login accounts. Each user in a group is assigned the same role (for example, Infrastructure administrator). An example of an authentication directory service is a corporate directory that uses LDAP (Lightweight Directory Access Protocol).

After the directory service is configured, any user in the group can log in to the appliance. On the login window, a user:

Enters their user name (typically, the Common-Name attribute, CN).

The format for the user name depends on the Directory type.
Enters their password.
Selects the authentication directory service.

In the Session control, () the user is identified by their name preceded by the authentication directory service. For example:

CorpDir\pat

IMPORTANT:

Unlike local users, if a user is deleted from an authentication directory, their active sessions remain active until that user logs out.

If there is a change in the group-to-role assignment (including a deletion) for an authentication directory group while a user from that group is logged in, their current active session is not affected until they log out. Local users’ sessions are ended when such modifications are made.

Authenticating users

When you add an authentication directory service to the appliance, you provide location criteria so that the appliance can find the group.

For more information on the search criteria, see Add/Edit Directory screen details.

Adding a directory server

If you replicate the authentication directory service for high availability or disaster tolerance, add the replicated directory service as a separate directory service.

After configuring and adding a directory server, you can designate it as the default directory service.

After you add an authentication directory service and server

You can:

Add a group, which had already been defined in the directory service, so that all its members can login on the appliance.
Allow local logins only, which is the default.
Allow both local logins and logins for user accounts authenticated by the directory service.
Disable local logins so that only users whose accounts are authenticated by the directory service can log in. Local accounts are prevented from logging in.

Considerations for configuring a Microsoft Active Directory directory service

The following maps the Active Directory attribute to the LDAP property:

LDAP property Active Directory attribute

cn

Common-Name

uid

UID

userPrincipalName

User-Principal-Name

sAMAccountName

SAM-Account-Name

If the user name does not contain either an @ character (to denote a UPN) or a \ character (to denote a domain\login), then these logins are attempted in this order:
1. The user name is treated as the sAMAccountName and directory-name gets prepended (directory-name\user-name)
2. The user name is treated as a UID.
3. The user name is treated as a CN.
If a user object is created in the Active Directory Users and Computers Microsoft Management Console, the names default as follows.

Specify the following components of the user’s name, displayed here with the corresponding attribute:

User name component Attribute

First Name

givenName

Intials

initial

Last Name

sn

The field labeled Full Name defaults to this format and this string is assigned to the cn attribute (Common Name).
```
givenName.initials.

givenName.

initial.

sn
```
In the New Object – user dialog box, you are also required to specify a User logon name. This, in combination with the DNS domain name, becomes the userPrincipalName.

The userPrincipalName is an alternative name that the user can use for logging in. It is in the form:
```
LogonName@

DNSDomain
```
For example:
```
JoeUser@exampledomain.example.com
```
Finally, as you enter the User logon name, the first twenty characters are automatically filled in in the pre-Windows 2000 logon name field, which becomes the sAMAccountName attribute.
CN-logins for built-in Active Directory user accounts, like Administrator, are not accepted. Other login formats are acceptable if their respective attributes (sAMAccountName, userPrincipalName, and UID) are set properly.

LDAP property	Active Directory attribute
`cn`	Common-Name
`uid`	UID
`userPrincipalName`	User-Principal-Name
`sAMAccountName`	SAM-Account-Name

User name component	Attribute
First Name	givenName
Intials	initial
Last Name	sn

See also

Settings: Security

prev	up	next
About security settings	home	Security panel screen details