Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

Use the Test Query button on the LDAP page (or the 

ldaptest

 command) to verify that your queries 

return the expected results. For more information, see 

.

To authenticate external users, AsyncOS uses a query to search for the user record in the LDAP directory 
and the attribute that contains the user’s full name. Depending on the server type you select, AsyncOS 
enters a default query and a default attribute. You can choose to have your appliance deny users with 
expired accounts if you have attributes defined in RFC 2307 in your LDAP user records 
(

shadowLastChange

, 

shadowMax

, and 

shadowExpire

). The base DN is required for the domain level 

where user records reside.

 shows the default query string and full username attribute that AsyncOS uses when it 

searches for a user account on an Active Directory server.

 shows the default query string and full username attribute that AsyncOS uses when it 

searches for a user account on an OpenLDAP server.

AsyncOS also uses a query to determine if a user is a member of a directory group. Membership in a 
directory group membership determines the user’s permissions within the system. When you enable 
external authentication on the System Administration > Users page in the GUI (or 

userconfig

 in the 

Active Directory

[blank] (You need to use a specific base DN to find the user 
records.)

(&(objectClass=user)(sAMAccountName={u}))

displayName

OpenLDAP

[blank] (You need to use a specific base DN to find the user 
records.)

(&(objectClass=posixAccount)(uid={u}))

gecos