LDAP AP9641 network management card

[soycory]

I have been going over the configuration steps from the manual but cannot get the settings to take.  I would like to only approve the Users base and not use groups.  I am not sure if all settings are required to be filled out or not.  When I try to authenticate, it wipes my settings and makes me start over which is frustrating of course.  Anyone successfully do this?

[KarimEissa · Accepted solution]

Hello,

in order to use a specific LDAP server, I think the customer is going to need to get more specific with what they setup as their LDAP URI field. There are a few examples of setup in page 35 of the guide here:
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-BDYD7K_EN&p_enDocType=Quick+start+g...

and page 50 in the below guide

https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-AYCEFJ_EN&p_enDocType=User+guide&p_...

including AP9631/41, can utilize RADIUS (Remote Authentication Dial In User Service) as a centralized authentication mechanism.

Relevant section here:

View and configure LDAP settings. You can set up the device to use an LDAP server to
authenticate remote users. Two common examples of this are Microsoft Active Directory and OpenLDAP.
Authentication is always performed using a simple bind request over a TLS connection. Ensure that the LDAP
server's CA certificate is installed in order for the TLS connection to the LDAP server to complete.

the most common schemas are supported by default,
including Active Directory users and groups, the POSIX schema defined in RFC2307, the User Schema
defined in RFC4519, and the inetOrgPerson user class defined in RFC2798. If configuring a new server, it is
recommended that one of these schemas is chosen. Ensure that groups are created for each NMC user type
that you wish to support, and that users are added to them accordingly.

This LDAP URI may include the address of the LDAP server and optionally the port number. The DN of the search user object follows. If the search user DN ends with DC components, then a DNS lookup of the SRV record for the LDAP service at this domain is performed. If the SRV record is found, then it is used instead of the host specified in the URI. If the SRV record is not found, then the host specified in the URI is used. The host component of the URI may be omitted if the SRV record for LDAP is known to exist.

Regards,

Karim