Syntax and Parameters for the LDAP Server Configuration Object URL

The URL identifies the host (by name or by IP address), port number, and search to be performed when executing a secure distinguished name (DN) lookup to the LDAP server.

While the syntax of the URL can take one of two forms depending on how the secure connection to the LDAP server is to be made, the underlying parameters of the URL are the same for each form.

ldaps:// – on the LDAP server configuration object, use ldaps:// when defining the SEARCH DN URL or AUTHENTICATION URL attributes and set the TLS attribute to OFF.
```
ldapurl::=ldaps://host:[port]/[node]?[attributes]? [base | one | sub]? [filter] 
```

TLS parameter – on the LDAP server configuration object, use ldap:// when defining the SEARCH DN URL attribute and set the TLS attribute to ON.
```
ldapurl::=ldap://host:[port]/[node]?[attributes]? [base | one | sub]? [filter] 
```

Parameter	Description
host	The host name of the LDAP server.
port	The port number of the LDAP server.
node	The node in the object hierarchy at which to start the search.
attributes	A list of attributes returned in the result set. Each LDAP server may support a different attribute based on the schemas used by the LDAP server. However, for each LDAP server, only the first attribute is used and should return the distinguished name (DN) of the user.
base \| one \| sub	Qualifies the search criteria. base – Specifies a search of the base node. one – Specifies a search of node and one sublevel. sub – Specifies a search of node and all sublevels.
filter	Specifies the attribute or attributes used to search for a database user's distinguished name (DN). The filter can be simple, such as “uid=,” or compound, such as “(uid=)(ou=group).” The attributes in the filter are dependent on the LDAP server schema. LDAP user authentication replaces each wildcard character (*) with the database user ID when searching for a DN.

The URL is initially defined as one of the server attributes when creating an LDAP server configuration object and can be changed at any time. There are no default values for these parameters. Creating or modifying the LDAP server configuration object requires the MANAGE ANY LDAP SERVER system privilege.

Note: Current versions of Active Directory (AD), Tivoli, SunONE Oracle DS, and OpenLDAP support both options. Older versions may only support one option. For compatibility with all versions, both options are supported by SAP Sybase IQ.