Type a name (such as LDAP-query) that can be referenced by other parts of the configuration. Do not use spaces or special characters. The maximum length is 35 characters.

Type the fully qualified domain name (FQDN) or IP address of the LDAP or Active Directory server that will be queried when an account referencing this profile attempts to authenticate.

Type the fully qualified domain name (FQDN) or IP address of a secondary LDAP or Active Directory server, if any, that can be queried if the primary server fails to respond according to the threshold configured in “Timeout” on page 64.

Type the port number on which the authentication server listens for queries.

The IANA standard port number for LDAP is 389. LDAPS (SSL/TLS-secured LDAP) is 636.

If your directory server uses SSL to encrypt query connections, select SSL then upload the certificate of the CA that signed the LDAP server’s certificate (see “Uploading trusted CAs’ certificates”).

Enable to perform the query without authenticating.

Disable to authenticate when querying. Also configure Bind DN, Bind password, and User Authentication Options.

Many LDAP servers require LDAP queries to be authenticated (“bound”) by supplying a bind DN and password to determine the scope of permissions for the directory search. However, if your LDAP server does not require binding, you can enable this option to improve performance.

If your LDAP directory’s user objects uses one of these common schema style:

select the schema style. This automatically configures the query string to match that schema style.

Otherwise, select User Defined, then manually configure the query string in LDAP user query.

Enter the distinguished name (DN) of the part of the LDAP directory tree within which FortiRecorder will search for user objects, such as ou=People,dc=example,dc=com.

User objects should be child nodes of this location.

Enter the bind DN, such as cn=FortiRecorderA,dc=example,dc=com, of an LDAP user account with permissions to query the Base DN.

Leave this field blank if you have enabled Allow unauthenticated bind.

Enter the password of the Bind DN.

Click Browse to locate the LDAP directory from the location that you specified in Base DN, or, if you have not yet entered a Base DN, beginning from the root of the LDAP directory tree.

Browsing the LDAP tree can be useful if you need to locate your Base DN, or need to look up attribute names. For example, if the Base DN is unknown, browsing can help you to locate it.

Before using, first configure Server name/IP, Use secure connection, Bind DN, Bind password, and , then click Create or OK. These fields provide minimum information required to establish the directory browsing connection.

Enter an LDAP query filter that selects a set of user objects from the LDAP directory.

The query string filters the result set, and should be based upon any attributes that are common to all user objects but also exclude non-user objects.

For example, if user objects in your directory have two distinguishing characteristics, their objectClass and mail attributes, the query filter might be:

where $m is the FortiRecorder variable for a user's email address.

This option is preconfigured and read-only if you have selected from Schema any schema style other than User Defined.

For details on query syntax, refer to any standard LDAP query filter reference manual.

Select which level of depth to query, starting from Base DN.

Select when, if ever, to dereference attributes whose values are references.

Select how, if the query requires authentication, the FortiRecorder appliance will form the bind DN. The default setting is the third option: Search user and try bind DN.

Select this option to define the user’s type.

Valid entries for this field are: admin, operator, and viewer.

Select this option to define the user’s profile.

The entry for this field must match the profile name configured in FortiRecorder.

The access profile attribute can only be set if the user is an administrator.

Selecting this option will set the administrator user’s access profile.

The entry for this field must match the name of an access profile configured in FortiRecorder.

Select the “Allow notification attributes” option to enable notifications.

FortiRecorder supports the following notifications:

Type the number of seconds that the FortiRecorder appliance will wait for a reply to the query before assuming that the primary LDAP server has failed, and will therefore query the secondary LDAP server.

The default value is 20.

Enable to cache LDAP query results.

Caching LDAP queries can introduce a delay between when you update LDAP directory information and when the FortiRecorder appliance begins using that new information, but also has the benefit of reducing the amount of LDAP network traffic associated with frequent queries for information that does not change frequently.

If this option is enabled but queries are not being cached, inspect the value of TTL. Entering a TTL value of 0 effectively disables caching.

Enter the amount of time, in minutes, that the FortiRecorder unit will cache query results. After the TTL has elapsed, cached results expire, and any subsequent request for that information causes the FortiRecorder appliance to query the LDAP server, refreshing the cache.

The default TTL value is 1440 minutes (one day). The maximum value is 10080 minutes (one week). Entering a value of 0 effectively disables caching.

This option is applicable only if is enabled.