---
title: "LDAP Authentication Service Configuration"
canonical: "https://docs.infoblox.com/space/netmri754/105942088/LDAP%20Authentication%20Service%20Configuration"
format: markdown
---
Configuring LDAP authentication services requires knowledge of the following key values:

- Base distinguished name (Base DN)
- The *User attribute.*
- The *Group attribute.*
- Whether to use **anonymous** or verified (**Authenticated**) authentication between NetMRI and the LDAP service.
- *Bind User DN* and *Bind Password* (if known; otherwise anonymous).
- The *Search Level* (**One Level**, **Base**, or **Subtree**. **Subtree** is the default).
- The names of the remote groups on the LDAP server containing the users intended to log in to the NetMRI appliance.

To configure an LDAP authentication service for NetMRI, complete the following:

1. Go to the** Settings** icon > **General Settings** section > **Authentication** **Services** page.
2. Enter the **Name** and **Description**.
3. Set the **Priority** and **Timeout** of the LDAP service.
4. Choose **LDAP** as the **Service** **Type**. The Service Specific Information pane updates to show the required LDAP settings.
5. Enter the **Base** **DN** value for the new LDAP service (example:` ou=management, dc=corp100, dc=local`). Users' definitions may be split between two or more Base DNs, so be aware of how the directory service is structured.
6. Enter the **User** **Attribute. **This will typically be *cn* for 'common name,' which is one of the components of the LDAP Distinguished Name attribute.
7. Enter the **Group** **Attribute**, which will typically be specified as *memberOf* for NetMRI. This defines the group membership in the LDAP tree for individual user accounts in LDAP. NetMRI uses this attribute to retrieve the LDAP group name to which the users belong. The LDAP group will be mapped to NetMRI users group (see the **Remote Groups** tab).  
Example:  
`ldapsearch -x -LLL -H ldap:/// -b uid=myuser,ou=people,dc=qanet,dc=local dn memberof`  
`dn: uid=myuser,ou=people,dc=qanet,dc=local`  
`memberof: cn=mygroup,ou=groups,dc=qanet,dc=local`  
You must use the *memberOf* overlay or a similarly behaving overlay to define the membership.
8. Choose the **Search Level**, which determines how far the LDAP service searches in the directory tree. The **Subtree** value is the default and can be retained for most applications. Other options are as follows:
  - **One Level**: Searches the directory entries immediately below the base object.
  - **Base**: Searches only the base object.
  - **Subtree**: Search the whole directory tree below and including the base object. This is the default.
9. Choose the **Authentication**, which can either be **Anonymous** or **Authenticated**. For more information, see *[Anonymous vs. Authenticated Server Authentication](https://infoblox-docs.atlassian.net/wiki/spaces/netmri754/pages/105942124)*.
  1. If the setting is Authenticated, enter the **Bind User DN** (this is a core value defined on the LDAP server).
  2. Enter the **Bind Password**, which is associated with the Bind user for the server.  
Many LDAP services may not allow the use of the **Bind** **User** **DN** and **Bind** **Password** values, requiring the use of anonymous authentication for LDAP queries.
10. Click **Save**.
11. If desired, click **Disable service** (this completely disables the service but does not change or delete any settings) or **Disable authorization** (this disables the new service from performing any group searches but allows basic authentication of user accounts from the LDAP server).

To configure the authentication service's LDAP servers, complete the following:

1. Click the **Servers** tab.
  1. Click **Add** to add LDAP servers to the service. The Add Authentication Server dialog opens.
  2. Enter the **Host/IP Address**.
  3. Choose the **Encryption Type**: **None** or **SSL**. For more information, see the *[Using a Certificate File for an LDAP or AD Service](https://infoblox-docs.atlassian.net/wiki/spaces/netmri754/pages/105942108)*.
  4. If using SSL, choose the certificate from the **Certificate** drop-down list. The certificate must be loaded into NetMRI.
  5. Choose the **Priority** for the new server in the authentication service. In this context, the priority value determines the order of which servers in the services are queried by NetMRI.
  6. If necessary, enter the **Port** value. LDAP's default TCP application port is 389.
  7. If necessary, choose the **LDAP version**. The default is **V3.** You may choose **V2** if the LDAP server supports only that version.
  8. Click **Save** to save your configuration.
  9. Click **Cancel** to close the dialog.

To assign the LDAP service's remote groups with NetMRI's local roles, perform the following:

1. Click the **Remote Groups** tab.
  1. In the **Remote Group** field, enter the name of a new remote group for the authentication service. In these steps, you are mapping this group name to the NetMRI Role(s) and device group(s).
  2. Choose the **Role** for the new remote group. For more information, see *[Defining and Editing Roles](https://infoblox-docs.atlassian.net/wiki/spaces/netmri754/pages/105941880)*.
  3. Select the checkboxes for the device groups you want to allow for the remote group. Note that the SysAdmin role applies to all device groups. Other roles allow the selection of individual device groups.
  4. Click **OK** to complete the configuration.
  5. When finished with the remote group configuration, click **Save** and then **Close**. Note that you can add multiple Roles for the remote group.
2. Click **Test** to test the server settings. Enter a valid username and password. A successful test returns the list of groups to which the test user belongs.