Connect a cluster to LDAP¶

When you finish, the cluster looks up users and groups in your LDAP directory over an encrypted connection.

Before you start¶

A Qumulo cluster whose REST API on port 8000 you can reach from this machine
An admin account on the cluster for the connection profile
Terraform 1.11 or later
An LDAP server the cluster can reach, plus the DN and password of a bind account unless the directory allows anonymous binds

1. Copy the configuration¶

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = "https://cluster.example.com:8000" # <-- Replace with your cluster's REST API endpoint
      username             = "admin"
      password             = "YourClusterPassword123!" # <-- Replace with your admin password
      insecure_skip_verify = true
    },
  ]
}

resource "qumulo_ldap_settings" "main" {
  connection_profile = "cluster1"

  use_ldap                 = true
  bind_uri                 = "ldap://ldap.example.com"                 # <-- Replace with your LDAP server URI
  base_distinguished_names = "dc=example,dc=com"                       # <-- Replace with your base DN
  user                     = "cn=qumulo,ou=services,dc=example,dc=com" # <-- Replace with your bind DN
  password                 = "LdapBindPassword123!"                    # <-- Replace with the bind password
  ldap_schema              = "RFC2307"
  encrypt_connection       = true

  ldap_schema_description {
    group_member_attribute          = "memberUid"
    user_group_identifier_attribute = "gidNumber"
    login_name_attribute            = "uid"
    group_name_attribute            = "cn"
    user_object_class               = "posixAccount"
    group_object_class              = "posixGroup"
    uid_number_attribute            = "uidNumber"
    gid_number_attribute            = "gidNumber"
  }
}

Replace the six values marked <-- Replace, and leave the rest as written. Delete insecure_skip_verify if the cluster's certificate is signed by a CA your machine trusts.

For anonymous binding, delete the user and password lines.
To list several LDAP servers, separate the URIs in bind_uri with commas.
To search several parts of the directory, separate the DNs in base_distinguished_names with semicolons.

2. Map a custom schema¶

Skip this step if your directory uses the standard RFC 2307 names, such as uid and posixAccount. Otherwise, set ldap_schema = "CUSTOM" and change each value in the ldap_schema_description block to your directory's attribute and object class names.

The plan in step 3 shows ldap_schema = "CUSTOM" and your names.

3. Apply¶

terraform init -upgrade
terraform plan
terraform apply

With ldap_schema = "RFC2307", the plan warns Ignored configuration for ldap_schema_description. The provider still requires the block, so leave it in place.

The plan ends with Plan: 1 to add, 0 to change, 0 to destroy., and the apply ends with Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Note

The bind password is write-only. Terraform never reads it back, so it cannot notice a password changed outside Terraform.

4. Check the cluster¶

Run terraform plan again. It reports No changes. Your infrastructure matches the configuration., which means the cluster now uses the directory you described.

Next¶

LDAP concepts, including how the cluster maps directory identities, are in Qumulo's documentation. Windows domains have their own guide in Join a cluster to Active Directory, and the qumulo_ldap_settings reference lists every attribute.