content_image/793828.jpg content_image/793832.jpg content_image/793829.jpg content_image/793830.jpg
<img src='content_image/793828.jpg'>

For SASL LDAP authentication, the absolute path of the certificate authority file. Specify this file if it is desired that the authentication plugin perform verification of the LDAP server certificate. 

<img src='content_image/793832.jpg'>

• authentication_ldap_sasl_group_search_attr 

## Note 

In addition to setting the authentication_ldap_sasl_ca_path  variable to the file name, you must add the appropriate certificate authority certificates to the file and enable the authentication_ldap_sasl_tls  system variable. These variables can be set to override the default OpenLDAP TLS configuration; see LDAP Pluggable Authentication and ldap.conf 

<img src='content_image/793829.jpg'>

For SASL LDAP authentication, the name of the attribute that specifies group names in LDAP directory entries. If authentication_ldap_sasl_group_search_attr  has its default value of cn , searches return the cn  value as the group name. For example, if an LDAP entry with a uid  value of user1  has a cn  attribute of mygroup , searches for user1  return mygroup  as the group name. 

This variable should be the empty string if you want no group or proxy authentication. 

If the group search attribute is isMemberOf , LDAP authentication directly retrieves the user attribute isMemberOf  value and assigns it as group information. If the group search attribute is not isMemberOf , LDAP authentication searches for all groups where the user is a member. (The latter is the default behavior.) This behavior is based on how LDAP group information can be stored two ways: 1) A group entry can have an attribute named memberUid  or member  with a value that is a user name; 2) A user entry can have an attribute named isMemberOf  with values that are group names. 

• authentication_ldap_sasl_group_search_filter 

<img src='content_image/793830.jpg'>

