HowtodisableauthenticationonanLDAPserveranduseitonlyforgroup
extraction
IfyouwanttouseLDAPforgroupextractionbutnotforauthentication,youcansettheNetScaler
appliancetodisableauthenticationontheLDAPserver.
Caution:Ifauthenticationisdisabled,anyLDAPauthenticationattemptissuccessfuliftheuserisfoundon
LDAP.DonotdisableauthenticationunlessLDAPisusedonlyforgroupextractionandauthentication
methodsotherthanLDAPareeitherboundtoaprimarylistorflaggedassecondary.
Prerequisites:
BeforedisablingLDAPauthentication,makesurethat:
• ThebasicActiveDirectoryauthenticationisconfigured.SeeCTX108876-HowtoConfigureLDAP
AuthenticationonaNetScalerAppliance.
• ANetScalerGatewayvirtualserverisconfiguredandboundtotheLDAPpolicy.
• YouunderstandtheActiveDirectoryandLDAPprotocols.
TodisableLDAPauthenticationbyusingtheNetScalerGUI
OntheConfigurationtab,dooneofthefollowing:
NavigatetoSystem>Authentication>LDAP>Servers,selecttheserver,clickEdit,andgotostep3ofthe
followingprocedure.
OR
NavigatetoNetScalerGateway>VirtualServers,selecttheVPNvirtualserverforwhichLDAP
authenticationneedstobedisabled,andtakethefollowingsteps.
1. IntheBasicAuthenticationsection,clickLDAPPolicy.
2. SelecttheLDAPPolicythatyouwanttoedit,and,fromtheSelectActionlist,selectEditServer.
3. CleartheAuthenticationcheckboxandclickOK.
TodisableLDAPauthenticationbyusingthecommandline
1. EnterthefollowingcommandtodisableauthenticationontheLDAPserver:
> set authentication ldapaction <LDAPServerName> authentication DISABLED
2. Entertheshowauthenticationcommandandverifythatauthenticationhasbeendisabledforthe
chosenLDAPserver.
Example
> sh authentication ldapaction ldapabhishek
1)
Name: ldapabhishek
Server Name: 10.105.157.116
Port: 389
Server Type: AD
Timeout: 3 secs BindDn: [email protected]
Login: sAMAccountName Base: dc=ctxnssfb,dc=com
Secure Type: PLAINTEXT
Password Change: DISABLED
Group Attribute Name: memberOf
Sub Attribute Name: CN
Authentication Disabled, User required
Success: 23
Failures: 61
Validate LDAP Server Certificate: NO
LDAP Host Name:
Nested Group Extraction: ON
Maximum Nesting Level: 2
Group Name Identifier: cn Group Search Attribute: memberOf
LDAP Referrals: OFF
LDAP Referral DNSLookup : A-REC
Attribute1 Name: lastLogon
Nowthatauthenticationisdisabled,anyLDAPauthenticationattemptwillreturnanauthentication
successiftheuserisfound.
">
