--- title: "Configure AIM for LDAP" canonical: "https://docs.aryaka.com/space/KNOW/1090191369/Configure%20AIM%20for%20LDAP" format: markdown --- This topic describes the configuration required to integrate you organization's LDAP server with Aryaka Identity Management (AIM) to provide identity authentication. During configuration, you must provide details about your LDAP instance and which users and user groups you want to be included in the integration. To edit or delete an existing configuration, see the Manage LDAP topic. Complete the following procedure to configure AIM for LDAP: To configure identity authentication using LDAP Open the Aryaka Identity Management page if it is not already open: Log in to MyAryaka. The Home page appears. Click Global Settings in the left navigation pane. The Global Settings page appears and displays a series of tiles. Click Manage in the Identity Management tile. The Aryaka Identity Management page appears. Click Add on the Enterprise’s LDAP tile in the Available Identity Providers section. The Configure Enterprise’s LDAP page appears and displays the following panes: LDAP Details User Queries User Group Queries Enter the following information in the fields displayed in the LDAP Details pane: LDAP Name—Name for this LDAP instance. Note that you can create multiple LDAP instances. Host Name—URL or IP address of your LDAP server. Secure Connection—Indicate whether the LDAP connection is secure. Accept the default (Yes) or select No from the drop-down list. Port Number—The port your LDAP server uses to connect to AIM. Accept the default port number or enter a different value. Note that the default port is 636 if the Secure Connection field is set to Yes; it is 389 if it is set to No. Bind DN—Distinguished name (DN) of the administrator user to use when querying the LDAP server and requesting authentication. For example, cn=admin,dc=aryaka,dc=com . Bind Credential—Password that corresponds with the Bind DN user. (Optional) Click the Advanced tab to display additional settings. These settings have default values that are displayed after you click Submit (step 7). You can also enter new values as needed for your organization. The settings and their associated defaults are as follows: User Object Classes—inetOrgPerson, organizationalPerson Username LDAP Attribute—UID RDN LDAP Attribute—UID UUID LDAP Attribute—entryUUID Changed Sync Period—86400 (synchronization interval in seconds between LDAP and the AIM service) User Search Scope—Subtree (drop-down list allows you to switch this value to One Level) Enter the following information in the User Queries pane: Enter a comma-separated list of distinguished user names in the Users DN field. For example, the string: OU=Users,DC=corp,DC=aryaka,DC=com queries for organization units (OU) defined as Users , with a domain component (DC) defined as corp , a domain component defined as aryaka , and another domain component defined as com . Users returned by the query can be managed with AIM. (Optional) Click the Advanced tab to display additional configuration fields. The Include CN Members and Exclude CN Members panes appears. Click Add to enter user names that you want to either include or exclude from the user query. Enter the following information in the User Group Queries pane: Enter a comma-separated list of distinguished group names in the Groups DN field. For example the string: OU=Groups,DC=aryaka,DC=com queries for organizational units (OU) defined as Groups , with a domain component (DC) defined as aryaka , and another domain component defined as com (as in @aryaka.com). Groups returned by the query can be managed with AIM. (Optional) Click the Advanced tab to display the following additional configuration fields: Click Add on the Include CN Groups or Exclude CN Groups pane to enter user group names that you want to either include or exclude from the user query. Edit any of the following fields if your LDAP structure differs from the listed defaults: Groups Object Classes—groupOfNames Groups LDAP Attribute—cn Member Attribute Types—DN Member Attribute—member Member User Attribute—cn Delete imported groups during sync—Yes Click Submit . AIM queries LDAP and displays the results on the < IdPname > page. Note that you can click Resync on the Sync Status tile to perform the same query again. Related topics Manage LDAP Aryaka Identity Management Security engine rulesets