{"id":3550,"date":"2023-12-19T20:20:28","date_gmt":"2023-12-19T11:20:28","guid":{"rendered":"http:\/\/192.168.20.1\/?p=3550"},"modified":"2024-01-09T20:04:53","modified_gmt":"2024-01-09T11:04:53","slug":"truenas-scale-ldap","status":"publish","type":"post","link":"https:\/\/rlab.cavtime.net\/?p=3550","title":{"rendered":"[TrueNAS Scale] LDAP"},"content":{"rendered":"<h2>Overview<\/h2>\n<p>Directory Service LDAP \u306e\u8a2d\u5b9a\u9805\u76ee\u3092\u78ba\u8a8d\u3059\u308b\u3002<\/p>\n<h2>Reference<\/h2>\n<h2>Environment<\/h2>\n<p><span>TrueNAS Scale 23.10.0.1<\/span><\/p>\n<h2>Summary Configuration<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/rlab.cavtime.net\/wp-content\/uploads\/2023\/12\/Credentials_DirectoryService_LDAP_01s.png\" alt=\"\" width=\"900\" height=\"988\" class=\"img-responsive right-block\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/rlab.cavtime.net\/wp-content\/uploads\/2023\/12\/Credentials_DirectoryService_LDAP_02s.png\" alt=\"\" width=\"900\" height=\"707\" class=\"img-responsive right-block\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/rlab.cavtime.net\/wp-content\/uploads\/2023\/12\/Credentials_DirectoryService_LDAP_04s.png\" alt=\"\" width=\"900\" height=\"836\" class=\"img-responsive right-block\" \/><\/p>\n<h3>LDAP<\/h3>\n<p><strong>Hostname<\/strong><\/p>\n<blockquote><p>The hostname or IP address of the LDAP server. Separate entries by pressing Enter.<\/p><\/blockquote>\n<p><strong>Base DN<\/strong><\/p>\n<blockquote><p>Top level of the LDAP directory tree to be used when searching for resources. Example: dc=test,dc=org.<\/p><\/blockquote>\n<p><strong>Bind DN<\/strong><\/p>\n<blockquote><p>Administrative account name on the LDAP server. Example: cn=Manager,dc=test,dc=org.<\/p><\/blockquote>\n<p><strong>Bind Password<\/strong><\/p>\n<blockquote><p>Password for the Bind DN.<\/p><\/blockquote>\n<p><strong>Enable<\/strong><\/p>\n<blockquote><p>Activates the configuration. Unset to disable the configuration without deleting it.<\/p><\/blockquote>\n<ul>\n<li>Unchecked \/ default<\/li>\n<\/ul>\n<p><strong>Allow Anonymous Binding<\/strong><\/p>\n<blockquote><p>Set for the LDAP server to disable authentication and allow read and write access to any client.<\/p><\/blockquote>\n<ul>\n<li>Unchecked \/ default<\/li>\n<\/ul>\n<p><strong>Encryption Mode<\/strong><\/p>\n<blockquote>\n<ul>\n<li>OFF: do not encrypt the LDAP connection.<\/li>\n<li>ON: encrypt the LDAP connection with SSL on port 636.<\/li>\n<li>START_TLS: encrypt the LDAP connection with STARTTLS on the default LDAP port 389.<\/li>\n<\/ul>\n<\/blockquote>\n<ul>\n<li>OFF<\/li>\n<li>ON<\/li>\n<li>START_TLS<\/li>\n<\/ul>\n<p><strong>Certificate<\/strong><\/p>\n<blockquote><p>Certificate to use when performing LDAP certificate-based authentication. To configure LDAP certificate-based authentication, create a Certificate Signing Request for the LDAP provider to sign. A certificate is not required when using username\/password or Kerberos authentication.<\/p><\/blockquote>\n<ul>\n<li>&#8212;<\/li>\n<li>truenas_default<\/li>\n<\/ul>\n<p><strong>Validate Certificates<\/strong><\/p>\n<blockquote><p>Verify certificate authenticity.<\/p><\/blockquote>\n<ul>\n<li>Checked \/ default<\/li>\n<\/ul>\n<p><strong>Disable LDAP User\/Group Cache<\/strong><\/p>\n<blockquote><p>Disable caching LDAP users and groups in large LDAP environments. When caching is disabled, LDAP users and groups do not appear in dropdown menus, but are still accepted when manually entered.<\/p><\/blockquote>\n<ul>\n<li>Unchecked \/ default<\/li>\n<\/ul>\n<p><strong>Kerberos Realm<\/strong><\/p>\n<blockquote><p>Select an existing realm that was added in Directory Services &gt; Kerberos Realms.<\/p><\/blockquote>\n<p><strong>Kerberos Principal<\/strong><\/p>\n<blockquote><p>Select the location of the principal in the keytab created in Directory Services &gt; Kerberos Keytabs.<\/p><\/blockquote>\n<p><strong>LDAP Timeout<\/strong><\/p>\n<blockquote><p>LDAP timeout in seconds. Increase this value if a Kerberos ticket timeout occurs.<\/p><\/blockquote>\n<ul>\n<li>10 \/ default<\/li>\n<\/ul>\n<p><strong>DNS Timeout<\/strong><\/p>\n<blockquote><p>DNS timeout in seconds. Increase this value if DNS queries timeout.<\/p><\/blockquote>\n<ul>\n<li>10 \/ default<\/li>\n<\/ul>\n<p><strong>Samba Schema (DEPRECATED &#8211; see help text)<\/strong><\/p>\n<blockquote><p>Use Samba LDAP schema extensions to provide support for LDAP authentication with SMB shares. DEPRECATED: Support for legacy samba schema for LDAP has been deprecated and will be removed in a future TrueNAS version.<\/p><\/blockquote>\n<ul>\n<li>Unchecked \/ default<\/li>\n<\/ul>\n<p><strong>Auxiliary Parameters<\/strong><\/p>\n<blockquote><p><span>Additional options for\u00a0<\/span><a href=\"https:\/\/arthurdejong.org\/nss-pam-ldapd\/nslcd.conf.5\" target=\"_blank\" rel=\"noopener\">nslcd.conf<\/a><span>.<\/span><\/p><\/blockquote>\n<p><strong>Schema<\/strong><\/p>\n<blockquote><p>Select a schema when Samba Schema is set.<\/p><\/blockquote>\n<ul>\n<li>RFC2307<\/li>\n<li>RFC2307BIS<\/li>\n<\/ul>\n<h2>nslcd.conf<\/h2>\n<p>\u4e0a\u8a18\u306e\u8a2d\u5b9a\u306f \/etc\/nslcd.conf \u306b\u53cd\u6620\u3055\u308c\u308b\u3002<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism undefined-numbers lang-bash\" data-lang=\"Bash\"><code>root@NAS003[\/etc]# cat nslcd.conf\r\n#\r\n# NSLCD.CONF(5)         The configuration file for LDAP nameservice daemon\r\n#\r\n\r\n    uri         ldap:\/\/ldap.cavtime.com:389\r\n    base        dc=cavtime,dc=com\r\n    binddn      cn=admin,dc=cavtime,dc=com\r\n    bindpw      Password\r\n    scope       sub\r\n    timelimit   10\r\n    bind_timelimit 10\r\n    nss_nested_groups yes\r\n    nss_min_uid 1000\r\n    nss_initgroups_ignoreusers ALLLOCAL\r\nroot@NAS003[\/etc]#\r\n<\/code><\/pre>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Overview Directory Service LDAP \u306e\u8a2d\u5b9a\u9805\u76ee\u3092\u78ba\u8a8d\u3059\u308b\u3002 Reference Environment TrueNAS Scale 23.10.0.1 Summary Configuratio [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[74],"tags":[],"class_list":["post-3550","post","type-post","status-publish","format-standard","hentry","category-nas"],"_links":{"self":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/3550","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3550"}],"version-history":[{"count":4,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/3550\/revisions"}],"predecessor-version":[{"id":3708,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/3550\/revisions\/3708"}],"wp:attachment":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3550"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3550"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3550"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}