Enabled

Controls whether LDAP authentication is enabled.

Primary Server Address

The IP address and optional port of the primary LDAP server. If no port is specified, the default port is used. The default ports are 389 for non-secure/STARTTLS and 636 for SSL/TLS.

Secondary Server Address

(Optional) The IP address and optional port of the secondary LDAP server. If no port is specified, the default port is used. The default ports are 389 for non-secure/STARTTLS and 636 for SSL/TLS.

Secure Mode

Select one of the following options:

• None: No encryption (not recommended)

• SSL/TLS: Secure connection established via TLS handshake (highly recommended)

• STARTTLS: Secure connection established by unsecure connection and upgrading to secure connection (for legacy support, not recommended)

CA Certificate PEM File

The path to the Privacy Enhanced Mail (PEM) file on the EMS server that contains trust anchors for the certificate when connecting with SSL or TLS. You must create this file and put it on the EMS server. If a path is not specified, use the default path of:

/usr/local/ipcs/etc/cert/gui/ldap-auth.pem.

If a path is specified and the PEM file does exist, it is used to build a trust manager that is in turn used to verify the LDAP server certificate upon connection. If at least one certificate matches a CA certificate in the trust manager, the verification succeeds. Otherwise, the verification fails and the connection attempt fails.

If a path is specified but the PEM file does not exist, all certificates are trusted. That is, no certificate verification is done on the LDAP server and all certificates are accepted.

Bind DN

The distinguished name (DN) used when initially authenticating to the LDAP server to do a user lookup. This user name must have appropriate permissions to search and read users that need to authenticate.

Bind Password

The password to send with the Bind DN when initially authenticating to the LDAP server.

Base DN

The base DN to use when searching for users.

User Domain

(Optional) An optional domain to use in LDAP searches.

User Search Filter

A filter used to search for an LDAP user. Only the first entry that matches is retrieved, so this filter should be as specific as possible. The {username} and {domain} can be used as placeholders for the actual values when authentication takes place.

If no domain is specified, the filter defaults to (sAMAccountName={username}). If a domain is specified, the filter defaults to (userPrincipalName={username}@{domain}).

Timeout

The timeout, in seconds, before a connection attempt to the primary LDAP server is marked as failed and the next connection attempt is made (if a secondary LDAP server exists).

Use LDAP as Fall-through Authenticator

Select this option to enable a back end authentication server to handle authentication requests for users that are not defined in the EMS user list.

This is done by fetching a specified LDAP attribute when running the User Search Filter on the LDAP server to find a user matching the provided credentials as defined in the Role Name Attribute option.

If the attribute is present, it must match a predefined role in the EMS (that is, System Administrator, Security Administrator, and so on) or any authorization attempts for the user will fail and the user's login requests will be rejected. If the attribute is not present on the user, any authorization attempts for the user fail and the user's login requests are rejected.

Disabling fall-through authentication will log out all users logged in using that functionality. A new option has been added to the user's list to forcibly log out any logged in user. This option is only available to users with System Administrator level privileges.

Role Name Attribute

Enter a name you want to use as the role name attribute. By default, Role Name Attribute is set to Avaya-SBCE-Role-Name. This attribute is not defined in most LDAP schemas and must be defined to function correctly. Alternatively, any other LDAP attribute can be used as long as it is a string value.

For an example of how to define a custom attribute in Microsoft Active Directory, see:

https://social.technet.microsoft.com/wiki/contents/articles/20319.how-to-create-a-custom-attribute-in-active-directory.aspx