One Identity Safeguard for Privileged Sessions 6.0.4 - Duo Multi-Factor Authentication - Tutorial

[ldap]

This section contains the settings you configure when you need to use an LDAP query to map the usernames from your audited sessions to the usernames in Duo.

To look up the Duo username of the user from an LDAP/Active Directory database, configure the [ldap] section of the SPS Duo plugin. Typically, the SPS plugin queries the email address corresponding to the username from your LDAP or Active Directory database. For details on LDAP parameters, see [ldap].

If you configure both the append_domain parameter and the [ldap] section of the SPS Duo plugin, SPS appends the @ character and the value of the append_domain parameter to the value retrieved from the LDAP database.

For other methods of mapping gateway usernames to Duo usernames, see Mapping SPS usernames to Duo identities.

[ldap]
ldap_server_config=<SPS-LDAP-server-policy-name>
filter=(&(cn={})(objectClass=inetOrgPerson))
user_attribute=CN

ldap_server_config

Description: The name of a configured LDAP server policy in SPS. For details on configuring LDAP policies, see "Authenticating users to an LDAP server" in the Administration Guide.

filter

Description: The LDAP filter query that locates the user based on the gateway username. The plugin automatically replaces the {} characters with the gateway username from the session.

filter=(&(cn={})(objectClass=inetOrgPerson))

user_attribute

Description: The name of the LDAP attribute that contains the Duo username.