PowerScaleOneFS CLI Command Reference

Syntax

isi auth ldap create <name>
  [--base-dn <string>]
  [--server-uris <string>]
  [--alternate-security-identities-attribute <string>]
  [--authentication {yes | no}]
  [--balance-servers {yes | no}]
  [--bind-dn <string>]
  [--bind-timeout <integer>]
  [--certificate-authority-file <string>]
  [--check-online-interval <duration>]
  [--cn-attribute <string>]
  [--create-home-directory {yes | no}]
  [--crypt-password-attribute <string>]
  [--email-attribute <string>]
  [--enabled {yes | no}]
  [--enumerate-groups {yes | no}]
  [--enumerate-users {yes | no}]
  [--findable-groups <string>]
  [--findable-users <string>]
  [--gecos-attribute <string>]
  [--gid-attribute <string>]
  [--group-base-dn <string>]
  [--group-domain <string>]
  [--group-filter <string>]
  [--group-members-attribute <string>]
  [--group-search-scope <scope>]
  [--home-directory-template <string>]
  [--homedir-attribute <string>]
  [--ignore-tls-errors {yes | no}]
  [--listable-groups <string>]
  [--listable-users <string>]
  [--login-shell <string>]
  [--member-lookup-method {default |  rfc2307bis}
  [--member-of-attribute <string>]
  [--name-attribute <string>]
  [--netgroup-base-dn <string>]
  [--netgroup-filter <string>]
  [--netgroup-members-attribute <string>]
  [--netgroup-search-scope <scope>]
  [--netgroup-triple-attribute <string>]
  [--normalize-groups {yes | no}]
  [--normalize-users {yes | no}]
  [--nt-password-attribute <string>]
  [--ntlm-support {all | v2only | none}]
  [--ocsp-server-uris <uri-list>]
  [--provider-domain <string>]
  [--require-secure-connection {yes | no}]
  [--restrict-findable {yes | no}]
  [--restrict-listable {yes | no}]
  [--search-scope <scope>]
  [--search-timeout <integer>]
  [--shadow-user-filter <string>]
  [--shadow-expire-attribute <string>]
  [--shadow-flag-attribute <string>]
  [--shadow-inactive-attribute <string>]
  [--shadow-last-change-attribute <string>]
  [--shadow-max-attribute <string>]
  [--shadow-min-attribute <string>]
  [--shadow-warning-attribute <string>]
  [--shell-attribute <string>]
  [--ssh-public-key-attribute <string>]
  [--tls-revocation-check-level {strict | allowNoSrc | allowNoData | none}]
  [--uid-attribute <string>]
  [--unfindable-groups <string>]
  [--unfindable-users <string>]
  [--unique-group-members-attribute <string>]
  [--unlistable-groups <string>]
  [--unlistable-users <string>]
  [--user-base-dn <string>]
  [--user-domain <string>]
  [--user-filter <string>]
  [--user-search-scope <scope>]
  [--groupnet <groupnet>]
  [--template {default | rfc2307 | ad-idmu | ldapsam}
  [--bind-password <string>]
  [--set-bind-password]
  [--force | -f]
  [--verbose] | -v

Options

<name>

Sets the LDAP provider name.

--base-dn <string>

Sets the root of the tree in which to search for identities. For example, CN=Users,DC=mycompany,DC=com.

--server-uris <string>

Specifies a list of LDAP server URIs to be used when accessing the server. Repeat this option to specify multiple list items.

Specify the LDAP server URI in the format ldaps://<server>:<port> for secure LDAP or ldap://<server>:<port> for non-secure LDAP.

The server can be specified as an IPv4 address, an IPv6 address, or a hostname.

If you do not specify a port number, the default port is used; 389 for secure LDAP or 636 for non-secure LDAP.

NOTE: If you specify non-secure LDAP, the bind password is transmitted to the server in clear text.

--alternate-security-identities-attribute <string>

Specifies the name to be used when searching for alternate security identities. This name is used when OneFS attempts to resolve a Kerberos principal to a user.

--authentication {yes | no}

Enables or disables the use of the provider for authentication as well as identity. The default value is yes.

--balance-servers {yes | no}

Makes the provider connect to a random server on each request.

--bind-dn <string>

Specifies the distinguished name to use when binding to the LDAP server. For example, CN=myuser,CN=Users,DC=mycompany,DC=com.

--bind-timeout <integer>

Specifies the timeout in seconds when binding to the LDAP server.

--certificate-authority-file <path>

Specifies the path to the root certificates file for TLS connection. Required when --require-secure-connection is yes.

--check-online-interval <duration>

Specifies the time between provider online checks, in the format <integer>[{Y | M | W | D | H | m | s}].

--cn-attribute <string>

Specifies the LDAP attribute that contains common names. The default value is cn.

--create-home-directory {yes | no}

Specifies whether to automatically create a home directory the first time a user logs in, if a home directory does not already exist for the user.

--crypt-password-attribute <string>

Specifies the LDAP attribute that contains UNIX passwords. This setting has no default value.

--email-attribute <string>

Specifies the LDAP attribute that contains email addresses. The default value is mail.

--enabled {yes | no}

Enables or disables the provider.

--enumerate-groups {yes | no}

Specifies whether to allow the provider to enumerate groups.

--enumerate-users {yes | no}

Specifies whether to allow the provider to enumerate users.

--findable-groups <string>

Specifies a list of groups that can be found in this provider if --restrict-findable is enabled. Repeat this option to specify each additional findable group. If populated, groups that are not included in this list cannot be resolved.

--findable-users <string>

Specifies a list of users that can be found in this provider if --restrict-findable is enabled. Repeat this option to specify each additional findable user. If populated, users that are not included in this list cannot be resolved.

--gecos-attribute <string>

Specifies the LDAP attribute that contains GECOS fields. The default value is gecos.

--gid-attribute <string>

Specifies the LDAP attribute that contains GIDs. The default value is gidNumber.

--group-base-dn <string>

Specifies the distinguished name of the entry at which to start LDAP searches for groups.

--group-domain <string>

Specifies the domain that the provider will use to qualify groups. The default group domain is LDAP_GROUPS.

--group-filter <string>

Sets the LDAP filter for group objects.

--group-members-attribute <string>

Specifies the LDAP attribute that contains group members. The default value is memberUid.

--group-search-scope <scope>

Defines the default depth from the base distinguished name (DN) to perform LDAP searches for groups.

The following values are valid:

default

Applies the setting in --search-scope.

NOTE:You cannot specify --search-scope=default. For example, if you specify --group-search-scope=default, the search scope is set to the value of --search-scope.

base

Searches only the entry at the base DN.

onelevel

Searches all entries exactly one level below the base DN.

subtree

Searches the base DN and all entries below it.

children

Searches all entries below the base DN, excluding the base DN.

--home-directory-template <path>

Specifies the path to use as a template for naming home directories. The path must begin with /ifs and can include special character sequences that are dynamically replaced with strings at home directory creation time that represent specific variables. For example, %U, %D, and %Z are replaced with the user name, provider domain name, and zone name, respectively. For more information about home directory variables, see Home directories.

--homedir-attribute <string>

Specifies the LDAP attribute that contains home directories. The default value is homeDirectory.

--ignore-tls-errors {yes | no}

Specifies whether to continue secure connection when certificate errors occur. The default setting is no.

If TLS is enabled ( --require-secure-connection is set to yes) and --ignore-tls-errors is set to yes, the LDAP provider uses TLS regardless of errors. TLS may issue certificate verification errors but the LDAP provider continues to use the certificate and TLS communication. TLS logs the errors.

--listable-groups <string>

Specifies a list of groups that can be viewed in this provider if --restrict-listable is enabled. Repeat this option to specify multiple list items. If populated, groups that are not included in this list cannot be viewed.

--listable-users <string>

Specifies a list of users that can be viewed in this provider if --restrict-listable is enabled. Repeat this option to specify multiple list items. If populated, users that are not included in this list cannot be viewed.

--login-shell <path>

Specifies the pathname of the user's login shell for users who access the file system through SSH.

--member-lookup-method {default | rfc2307bis}

Sets the method by which group member lookups are performed. Use caution when changing this option directly.

--member-of-attribute <string>

Sets the attribute to be used when searching LDAP for reverse memberships. This LDAP value should be an attribute of the user type posixAccount that describes the groups in which the POSIX user is a member.

--name-attribute <string>

Specifies the LDAP attribute that contains UIDs, which are used as login names. The default value is uid.

--netgroup-base-dn <string>

Specifies the distinguished name of the entry at which to start LDAP searches for netgroups.

--netgroup-filter <string>

Sets the LDAP filter for netgroup objects.

--netgroup-members-attribute <string>

Specifies the LDAP attribute that contains netgroup members. The default value is memberNisNetgroup.

--netgroup-search-scope <scope>

Defines the depth from the base distinguished name (DN) to perform LDAP searches for netgroups.

The following values are valid:

default

Applies the setting in --search-scope.

NOTE:You cannot specify --search-scope=default. For example, if you specify --group-search-scope=default, the search scope is set to the value of --search-scope.

base

Searches only the entry at the base DN.

onelevel

Searches all entries exactly one level below the base DN.

subtree

Searches the base DN and all entries below it.

children

Searches all entries below the base DN, excluding the base DN.

--netgroup-triple-attribute <string>

Specifies the LDAP attribute that contains netgroup triples. The default value is nisNetgroupTriple.

--normalize-groups {yes | no}

Normalizes group names to lowercase before lookup.

--normalize-users {yes | no}

Normalizes user names to lowercase before lookup.

--nt-password-attribute <string>

Specifies the LDAP attribute that contains Windows passwords. A commonly used value is ntpasswdhash.

--ntlm-support {all | v2only | none}

For users with NTLM-compatible credentials, specifies which NTLM versions to support.

--ocsp-server-uris <uri-list>

Specifies the location of revocation information for TLS certificates. This is an optional parameter to use with --tls-revocation-check-level. Revocation information is contained in Online Certificate Status Protocol (OCSP) responder URIs. If this option is not set, then the LDAP provider looks for the OCSP responder URI within the certificates.

The <uri-list> is a comma-separated list of URIs.

--provider-domain <string>

Specifies the domain that the provider will use to qualify user and group names.

--require-secure-connection {yes | no}

Specifies whether to require a TLS connection. If set to yes, --certificate-authority-file is required.

--restrict-findable {yes | no}

Specifies whether to check the provider for filtered lists of findable and unfindable users and groups.

--restrict-listable {yes | no}

Specifies whether to check the provider for filtered lists of listable and unlistable users and groups.

--search-scope <scope>

Defines the default depth from the base distinguished name (DN) to perform LDAP searches.

The following values are valid:

base

Searches only the entry at the base DN.

onelevel

Searches all entries exactly one level below the base DN.

subtree

Searches the base DN and all entries below it.

children

Searches all entries below the base DN, excluding the base DN itself.

--search-timeout <integer>

Specifies the number of seconds after which to stop retrying and fail a search. The default value is 100.

--shadow-user-filter <string>

Sets the LDAP filter for shadow user objects.

--shadow-expire-attribute <string>

Sets the attribute name that indicates the absolute date to expire the account.

--shadow-flag-attribute <string>

Sets the attribute name that indicates the section of the shadow map that is used to store the flag value.

--shadow-inactive-attribute <string>

Sets the attribute name that indicates the number of days of inactivity that is allowed for the user.

--shadow-last-change-attribute <string>

Sets the attribute name that indicates the last change of the shadow information.

--shadow-max-attribute <string>

Sets the attribute name that indicates the maximum number of days that a password can be valid.

--shadow-min-attribute <string>

Sets the attribute name that indicates the minimum number of days between shadow changes.

--shadow-warning-attribute <string>

Sets the attribute name that indicates the number of days before the password expires to warn the user.

--shell-attribute <string>

Specifies the LDAP attribute that contains a user's UNIX login shell. The default value is loginShell.

--ssh-public-key-attribute <string>

Sets the attribute name that contains the user's SSH Public Key.

--tls-revocation-check-level {strict | allowNoSrc | allowNoData | none}

When TLS is enabled, enforces additional verifications of certificates received from the LDAP server in the TLS handshake. Valid values are:

strict

Requires valid and current revocation information for all certificates received from the LDAP server in the TLS handshake. If any certificates do not comply, the LDAP provider ends the TLS session.

allowNoSrc

Accepts certificates from the LDAP server if no revocation retrieval information is available for them. A warning is logged for such certificates. Otherwise, the LDAP provider ends the TLS session if either of the following is true for any certificate:

• It is not possible to retrieve the revocation information
• The revocation state indicates that the certificate is not valid and current

allowNoData

Accepts certificates from the LDAP server if it is not possible to retrieve the revocation state. A warning is logged for such certificates. If revocation state is successfully retrieved, then it must indicate that the certificate is valid and current. Otherwise the LDAP provider ends the TLS session.

none

No revocation checking is performed. This is the default setting.

Also see --ocsp-server-uris.

--uid-attribute <string>

Specifies the LDAP attribute that contains UID numbers. The default value is uidNumber.

--unfindable-groups <string>

If --restrict-findable is enabled and the findable groups list is empty, specifies a list of groups that cannot be resolved by this provider. Repeat this option to specify multiple list items.

--unfindable-users <string>

If --restrict-findable is enabled and the findable users list is empty, specifies a list of users that cannot be resolved by this provider. Repeat this option to specify multiple list items.

--unique-group-members-attribute <string>

Specifies the LDAP attribute that contains unique group members. This attribute is used to determine which groups a user belongs to if the LDAP server is queried by the user’s DN instead of the user’s name. This setting has no default value.

--unlistable-groups <string>

If --restrict-listable is enabled and the listable groups list is empty, specifies a list of groups that cannot be listed by this provider that cannot be viewed. Repeat this option to specify multiple list items.

--unlistable-users <string>

If --restrict-listable is enabled and the listable users list is empty, specifies a list of users that cannot be listed by this provider that cannot be viewed. Repeat this option to specify multiple list items.

--user-base-dn <string>

Specifies the distinguished name of the entry at which to start LDAP searches for users.

--user-domain <string>

Specifies the domain that the provider will use to qualify users. The default user domain is LDAP_USERS.

--user-filter <string>

Sets the LDAP filter for user objects.

--user-search-scope <scope>

Defines the depth from the base distinguished name (DN) to perform LDAP searches for users.

The following values are valid:

default

Applies the search scope that is defined in the default query settings.

base

Searches only the entry at the base DN.

onelevel

Searches all entries exactly one level below the base DN.

subtree

Searches the base DN and all entries below it.

children

Searches all entries below the base DN, excluding the base DN itself.

--groupnet <groupnet>

Specifies the groupnet referenced by the LDAP provider. The groupnet is a top-level networking container that manages hostname resolution against DNS nameservers and contains subnets and IP address pools. The groupnet specifies which networking properties the LDAP provider will use when communicating with external servers.

--template {default | rfc-2307 | ad-idmu | ldapsam}

Specifies a template to be used to configure the LDAP provider. The templates provide pre-selected attributes. The templates are: RFC 2307, Active Directory Identity Management for UNIX (ad-idmu), and LDAP for Samba (ldapsam).

--bind-password <string>

Sets the password for the distinguished name that is used when binding to the LDAP server. To set the password interactively, use the --set-bind-password option instead.

--set-bind-password

Interactively sets the password for the distinguished name that is used when binding to the LDAP server. This option cannot be used with --bind-password.

[--force | -f

Specifies to ignore warnings when creating or modifying an LDAP provider.

{--verbose | -v}

Displays the results of running the command.