Configure your LR54 device to use an LDAP server

This section describes how to configure a LR54 device to use an LDAP server for authentication and authorization.

Required configuration items

Define the LDAP server IP address or domain name.
Add LDAP as an authentication method for your LR54 device.

Additional configuration items

Whether other user authentication methods should be used in addition to the LDAP server, or if the LDAP server should be considered the authoritative login method.
The LDAP server port. It is configured to 389 by default.
Whether to use Transport Layer Security (TLS) when communicating with the LDAP server.
The distinguished name (DN) and password used to communicate with the server.
The distinguished name used to search to user base.
The group attribute.
The number of seconds to wait to receive a message from the server.
Add additional LDAP servers in case the first LDAP server is unavailable.

 Web

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Click Authentication > LDAP > Servers.
Add LDAP servers:
1. For Add server, click .
2. For Hostname, type the hostname or IP address of the LDAP server.
3. (Optional) Change the default Port setting to the appropriate port. Normally this should be left at the default setting of port 389 for non-TLS and 636 for TLS.
4. (Optional) Click  again to add additional LDAP servers.
(Optional) Enable Authoritative to prevent other authentication methods from being attempted if LDAP login fails.
For TLS connection, select the type of TLS connection used by the server:
- Disable TLS: Uses a non-secure TCP connection on the LDAP standard port, 389.
- Enable TLS: Uses an SSL/TLS encrypted connection on port 636.
- Start TLS: Makes a non-secure TCP connection to the LDAP server on port 389, then sends a request to upgrade the connection to a secure TLS connection. This is the preferred method for LDAP.
If Enable TLS or Start TLS are selected for TLS connection:
- Leave Verify server certificate at the default setting of enabled to verify the server certificate with a known Certificate Authority.
- Disable Verify server certificate if the server is using a self-signed certificate.
(Optional) For Server login, type a distinguished name (DN) that is used to bind to the LDAP server and search for users, for example cn=user,dc=example,dc=com. Leave this field blank if the server allows anonymous connections.
(Optional) For Server password, type the password used to log into the LDAP server. Leave this field blank if the server allows anonymous connections.
For User search base, type the distinguished name (DN) on the server to search for users. This can be the root of the directory tree (for example, dc=example,dc=com) or a sub-tree (for example. ou=People,dc=example,dc=com).
For Login attribute, enter the user attribute containing the login of the authenticated user. For example, in the LDAP user configuration, the login attribute is uid. If this attribute is not set, the user will be denied access.
(Optional) For Group attribute, type the name of the user attribute that contains the list of LR54 authentication groups that the authenticated user has access to. See LDAP user configuration for further information about the group attribute.
For Timeout, type or select the amount of time in seconds to wait for the LDAP server to respond. Allowed value is between 3 and 60 seconds.
Add LDAP to the authentication methods:
1. Click Authentication > Methods.
2. For Add method, click .
3. Select LDAP for the new method from the Method drop-down.
Authentication methods are attempted in the order they are listed until an authentication response, either pass or fail, is received. If Authoritative is enabled (see above), non-authoritative methods are not attempted. See Rearrange the position of authentication methods for information about rearranging the position of the methods in the list.
Click Apply to save the configuration and apply the change.

 Command line

Select the device in Remote Manager and click Actions > Open Console, or log into the LR54 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```
(Optional) Prevent other authentication methods from being used if LDAP authentication fails. Other authentication methods will only be used if the LDAP server is unavailable.
```
(config)> auth ldap authoritative true
(config)>
```
Set the type of TLS connection used by the LDAP server:
```
(config)> auth ldap tls value
(config)> 
```
where value is one of:
- off: Uses a non-secure TCP connection on the LDAP standard port, 389.
- on: Uses an SSL/TLS encrypted connection on port 636.
- start_tls: Makes a non-secure TCP connection to the LDAP server on port 389, then sends a request to upgrade the connection to a secure TLS connection. This is the preferred method for LDAP.
The default is off.
If tls is set to on or start_tls, configure whether to verify the server certificate:
```
(config)> auth ldap verify_server_cert value
(config)> 
```
where value is either:
- true: Verifies the server certificate with a known Certificate Authority.
- false: Does not verify the certificate. Use this option if the server is using a self-signed certificate.
The default is true.
Set the distinguished name (DN) that is used to bind to the LDAP server and search for users. Leave this option unset if the server allows anonymous connections.
```
(config)> auth ldap bind_dn dn_value
(config)> 
```
For example:
```
(config)> auth ldap bind_dn cn=user,dc=example,dc=com
(config)>
```
Set the password used to log into the LDAP server. Leave this option unset if the server allows anonymous connections.
```
(config)> auth ldap bind_password password
(config)> 
```
Set the distinguished name (DN) on the server to search for users. This can be the root of the directory tree (for example, dc=example,dc=com) or a sub-tree (for example. ou=People,dc=example,dc=com).
```
(config)> auth ldap base_dn value
(config)> 
```
Set the login attribute:
```
(config)> auth ldap login_attribute value
(config)> 
```
where value is the user attribute containing the login of the authenticated user. For example, in the LDAP user configuration, the login attribute is uid. . If this attribute is not set, the user will be denied access.
(Optional) Set the name of the user attribute that contains the list of LR54 authentication groups that the authenticated user has access to. See LDAP user configuration for further information about the group attribute.
```
(config)> auth ldap group_attribute value
(config)> 
```
For example:
```
(config)> auth ldap group_attribute ou
(config)> 
```
Configure the amount of time in seconds to wait for the LDAP server to respond.
```
(config)> auth ldap timeout value
(config)> 
```
where value is any integer from 3 to 60. The default value is 3.

Add an LDAP server:

Add the server:

(config)> add auth ldap server end
(config auth ldap server 0)>

Enter the LDAP server's IP address or hostname:

(config auth ldap server 0)> hostname hostname|ip-address
(config auth ldap server 0)>

(Optional) Change the default port setting to the appropriate port:

(config auth ldap server 0)> port port
(config auth ldap server 0)>

(Optional) Repeat the above steps to add additional LDAP servers.

Add LDAP to the authentication methods. Authentication methods are attempted in the order they are listed until the first successful authentication result is returned. This example will add LDAP to the end of the list. See User authentication methods for information about adding methods to the beginning or middle of the list.
```
(config)> add auth method end ldap
(config)> 
```
Save the configuration and apply the change
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.