HP 3PAR StoreServ 7400 2-node HP 3PAR Command Line Interface Reference (OS 3.1 - Page 275

Table 3 Values for setauthparam Specifiers (continued) ldap-ssl-cacert Indicates the path name of the file containing the certificate of the Certificate Authority that has issued the LDAP server's certificate, or a "- " to prompt you to enter the certificate text. ldap-StartTLS Set this parameter to one of the following: • no - to not request the server use StartTLS . Default. • try - to request the server use StartTLS but does not require it to proceed. • require - requests that the server uses StartTLS and continues only when it succeeds. binding The LDAP binding type must be one of the following: • simple - use simple binding with the server. • SASL - use a SASL mechanism that is expected by the server, with the mechanism set by the sasl-mechanism variable. user-dn-base When using simple binding, the authentication process attempts to bind the user to an entry in the server's Directory Information Tree (DIT). The Distinguished Name (DN) of the entry is a concatenation of the value of user-attr, " = ", the username, " , ", and the value of user-dn-base . If group-obj is set to posixGroup, the value of user-dn-base is also used as the base for searching for the user's posixAccount entry, regardless of binding type. user-attr Indicates the attribute used to form a DN for simple binding. When the attribute ends with a back slash, the DN is the concatenation of the value of the user-attr variable and the username . When the attribute does not end with a back slash, it is as described for the user-dn-base variable. sasl-mechanism When the binding is SASL, the SASL mechanism must be one supported by the LDAP server. The system allows the mechanisms of PLAIN, DIGEST-MD5, and GSSAPI. kerberos-server kerberos-realm allow-ssh-key Indicates the numeric IP address of the Kerberos server if different from the LDAP server. The Kerberos realm. Set this value to 1 to allow LDAP users to set a public SSH key with the setsshkey command (default 0). Clearing or setting the variable to 0 disables the setting of new keys for LDAP users but any existing keys remain until they are removed with the removesshkey variable. This parameter only affects LDAP users, not local users. groups-dn Indicates the base of the subtree in the DIT in which to search for objects that hold group information. It is mutually exclusively with the accounts-dn variable. group-obj Indicates the objectClass attribute of a group object. group-name-attr The attribute in the group object that holds the group's name. member-attr The attribute that holds the names of users in the group. accounts-dn Indicates the base of the subtree in the DIT in which to search for objects that hold account information. It is mutually exclusively with the groups-dn variable. setauthparam 275