Cisco Systems OL-15986-01 Security Camera User Manual


 
4-10
Cisco NAC Guest Server Installation and Configuration Guide
OL-15986-01
Chapter 4 Configuring Sponsor Authentication
Configuring LDAP Authentication
Base DN—This is the Distinguished Name of the container object where an LDAP search to find
the user begins, such as OU=Engineering,O=Cisco.
User Search Filter—The User Search Filter defines how user entries are named in the LDAP server.
For example, you can define them as uid (uid=%USERNAME%) or cn (cn=%USERNAME%).
Group Mapping—There are two main methods that LDAP servers use for assigning users to groups:
1. Storing the group membership in an attribute of the user object. With this method the user object
has one or more attributes that list the groups that the user is a member of. If your LDAP server
uses this method of storing group membership, you need to enter the name of the attribute which
holds the groups the user is a member of.
2. Storing the user membership in an attribute of the group object. With this method there is a
group object that contains a list of the users who are members of the group. If your LDAP server
uses this method, you need to specify the group to check under the LDAP mapping section of a
User Group you want to match the user to.
To determine which method to use, Cisco recommends checking the LDAP documentation for your
server or using an LDAP browser like the one available at
http://www.ldapbrowser.com/ to check
the attributes of the server.
Username—The user account that has permissions to search the LDAP server. This is needed so that
the Cisco NAC Guest Server can search for the user account and group mapping information.
Password—The password for the user account that has permissions to search the LDAP server.
To provide resilience in the event of an LDAP server failure, you can enter multiple entries for high
availability LDAP servers pointing to the same database. All that needs to be different in each entry is
the Server name and URL.
The Guest Server attempts to authenticate sponsors against each LDAP server entry in the order specified
by Authentication Order detailed in the
Configuring Sponsor Authentication Settings section.
To verify that you have the correct LDAP credentials for connecting to your LDAP server, Cisco
recommends testing an LDAP browser like the one available at
http://www.ldapbrowser.com/.