LDAP Settings Example

This example demonstrates how to configure LDAP authentication on a Qumulo cluster.

Overview

The qumulo_ldap_settings resource manages the LDAP server settings for user and group lookups. This is a singleton resource (one per cluster).

Features

• RFC2307 Schema: Standard POSIX LDAP schema used by most Linux/UNIX directories
• Custom Schema: Support for non-standard attribute names and object classes
• Multiple Servers: Comma-separated URIs for redundancy
• Multiple Base DNs: Semicolon-separated for searching multiple directory locations
• Encrypted Connections: StartTLS support for secure communication
• Anonymous or Authenticated: Support for both binding methods

Usage

Basic RFC2307 Configuration

resource "qumulo_ldap_settings" "main" {
  connection_profile = "cluster1"

  use_ldap                 = true
  bind_uri                 = "ldap://ldap.example.com"
  base_distinguished_names = "dc=example,dc=com"
  ldap_schema              = "RFC2307"
  encrypt_connection       = true
}

With Bind Credentials

resource "qumulo_ldap_settings" "main" {
  connection_profile = "cluster1"

  use_ldap                 = true
  bind_uri                 = "ldap://ldap.example.com,ldap://ldap2.example.com"
  user                     = "cn=qumulo,ou=services,dc=example,dc=com"
  password                 = var.ldap_bind_password
  base_distinguished_names = "dc=example,dc=com"
  ldap_schema              = "RFC2307"
  encrypt_connection       = true
}

Custom Schema

resource "qumulo_ldap_settings" "main" {
  connection_profile = "cluster1"

  use_ldap                 = true
  bind_uri                 = "ldap://ldap.example.com"
  user                     = "cn=admin,dc=example,dc=com"
  password                 = var.ldap_bind_password
  base_distinguished_names = "dc=example,dc=com"
  ldap_schema              = "CUSTOM"
  encrypt_connection       = true

  ldap_schema_description {
    group_member_attribute          = "member"
    user_group_identifier_attribute = "gidNumber"
    login_name_attribute            = "uid"
    group_name_attribute            = "cn"
    user_object_class               = "posixAccount"
    group_object_class              = "posixGroup"
    uid_number_attribute            = "uidNumber"
    gid_number_attribute            = "gidNumber"
  }
}

Variables

Name	Description	Type	Default
cluster_endpoint	Qumulo cluster REST API endpoint	string	-
cluster_username	Qumulo cluster admin username	string	"admin"
cluster_password	Qumulo cluster admin password	string	-
ldap_server	Primary LDAP server URI	string	-
ldap_server_secondary	Secondary LDAP server URI	string	""
ldap_base_dn	Base DN for searches	string	-
ldap_bind_user	DN for LDAP binding	string	""
ldap_bind_password	Password for LDAP binding	string	""
use_custom_schema	Use custom schema instead of RFC2307	bool	false
encrypt_connection	Require encrypted connection	bool	true

Usage

1. Create a terraform.tfvars file:

cluster_endpoint   = "https://your-cluster:8000"
cluster_password   = "your-cluster-password"
ldap_server        = "ldap://ldap.example.com"
ldap_base_dn       = "dc=example,dc=com"
ldap_bind_user     = "cn=qumulo,ou=services,dc=example,dc=com"
ldap_bind_password = "your-ldap-bind-password"

1. Initialize and apply:

terraform init -upgrade
terraform plan
terraform apply

Import

To import existing LDAP settings:

terraform import qumulo_ldap_settings.main "prod"

Delete Behavior

When the resource is destroyed, LDAP is disabled on the cluster (use_ldap = false). The cluster returns to a clean state without LDAP authentication.

Notes

• The password attribute (LDAP bind password) is write-only and not stored in state
• External changes to the LDAP bind password will not be detected by Terraform
• When using CUSTOM schema, the ldap_schema_description block is required
• For RFC2307 schema, the ldap_schema_description block is ignored if provided

Full Configuration

# Example: Managing LDAP Settings on a Qumulo Cluster
#
# This example demonstrates how to configure LDAP authentication
# on a Qumulo cluster using the qumulo_ldap_settings resource.
#
# The resource supports:
# - RFC2307 and custom LDAP schemas
# - Anonymous or authenticated binding
# - Multiple LDAP server URIs for redundancy
# - Multiple base DNs for user/group searches
# - Encrypted connections (StartTLS)
#
# Note: This is a singleton resource - there is only one LDAP
# configuration per cluster.

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

variable "cluster_endpoint" {
  description = "Qumulo cluster REST API endpoint (e.g., https://cluster:8000)"
  type        = string
}

variable "cluster_username" {
  description = "Qumulo cluster admin username"
  type        = string
  default     = "admin"
}

variable "cluster_password" {
  description = "Qumulo cluster admin password"
  type        = string
  sensitive   = true
}

# Variables for LDAP configuration
variable "ldap_server" {
  description = "Primary LDAP server URI (e.g., ldap://ldap.example.com)"
  type        = string
}

variable "ldap_server_secondary" {
  description = "Secondary LDAP server URI for redundancy (optional)"
  type        = string
  default     = ""
}

variable "ldap_base_dn" {
  description = "Base distinguished name for LDAP searches (e.g., dc=example,dc=com)"
  type        = string
}

variable "ldap_bind_user" {
  description = "DN of user for LDAP binding (leave empty for anonymous bind)"
  type        = string
  default     = ""
}

variable "ldap_bind_password" {
  description = "Password for LDAP bind user"
  type        = string
  sensitive   = true
  default     = ""
}

variable "use_custom_schema" {
  description = "Use custom LDAP schema instead of RFC2307"
  type        = bool
  default     = false
}

variable "encrypt_connection" {
  description = "Require encrypted connection to LDAP server"
  type        = bool
  default     = true
}

# Define connection profile for the cluster
provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = var.cluster_endpoint
      username             = var.cluster_username
      password             = var.cluster_password
      insecure_skip_verify = true # Required for clusters with self-signed certificates
    }
  ]
}

locals {
  # Build LDAP URI list (comma-separated)
  ldap_uris = var.ldap_server_secondary != "" ? "${var.ldap_server},${var.ldap_server_secondary}" : var.ldap_server
}

# ------------------------------------------------------------------------------
# Example 1: Basic RFC2307 LDAP Configuration
# ------------------------------------------------------------------------------
# This is the simplest configuration using standard RFC2307 schema.
# Most Linux/UNIX LDAP directories use this schema.

resource "qumulo_ldap_settings" "rfc2307" {
  count = var.use_custom_schema ? 0 : 1

  connection_profile = "cluster1"

  # Enable LDAP
  use_ldap = true

  # LDAP server(s) - comma-separated for multiple servers
  bind_uri = local.ldap_uris

  # Optional: Bind credentials for authenticated lookups
  # Leave empty for anonymous binding
  user     = var.ldap_bind_user
  password = var.ldap_bind_password

  # Base DN(s) for searches - semicolon-separated for multiple
  base_distinguished_names = var.ldap_base_dn

  # Use standard RFC2307 schema
  ldap_schema = "RFC2307"

  # Require encrypted connection (recommended)
  encrypt_connection = var.encrypt_connection

  # RFC2307 schema attributes (standard LDAP attribute names)
  ldap_schema_description {
    group_member_attribute          = "memberUid"
    user_group_identifier_attribute = "gidNumber"
    login_name_attribute            = "uid"
    group_name_attribute            = "cn"
    user_object_class               = "posixAccount"
    group_object_class              = "posixGroup"
    uid_number_attribute            = "uidNumber"
    gid_number_attribute            = "gidNumber"
  }
}

# ------------------------------------------------------------------------------
# Example 2: Custom LDAP Schema Configuration
# ------------------------------------------------------------------------------
# Use this when your LDAP directory uses non-standard attribute names
# or object classes (e.g., some Active Directory configurations).

resource "qumulo_ldap_settings" "custom" {
  count = var.use_custom_schema ? 1 : 0

  connection_profile = "cluster1"

  # Enable LDAP
  use_ldap = true

  # LDAP server(s)
  bind_uri = local.ldap_uris

  # Bind credentials
  user     = var.ldap_bind_user
  password = var.ldap_bind_password

  # Base DN(s) for searches
  base_distinguished_names = var.ldap_base_dn

  # Use custom schema
  ldap_schema = "CUSTOM"

  # Require encrypted connection
  encrypt_connection = var.encrypt_connection

  # Custom schema attribute mappings
  # Adjust these values to match your LDAP directory
  ldap_schema_description {
    # Attribute that lists members of a group
    group_member_attribute = "member"

    # Attribute on user objects that identifies their primary group
    user_group_identifier_attribute = "gidNumber"

    # Attribute for login name (username)
    login_name_attribute = "uid"

    # Attribute for group name
    group_name_attribute = "cn"

    # Object class for user entries
    user_object_class = "posixAccount"

    # Object class for group entries
    group_object_class = "posixGroup"

    # Attribute for numeric user ID
    uid_number_attribute = "uidNumber"

    # Attribute for numeric group ID
    gid_number_attribute = "gidNumber"
  }
}

# Outputs
output "ldap_enabled" {
  description = "Whether LDAP authentication is enabled"
  value       = var.use_custom_schema ? qumulo_ldap_settings.custom[0].use_ldap : qumulo_ldap_settings.rfc2307[0].use_ldap
}

output "ldap_schema" {
  description = "LDAP schema in use"
  value       = var.use_custom_schema ? qumulo_ldap_settings.custom[0].ldap_schema : qumulo_ldap_settings.rfc2307[0].ldap_schema
}

output "ldap_bind_uri" {
  description = "LDAP server URI(s)"
  value       = var.use_custom_schema ? qumulo_ldap_settings.custom[0].bind_uri : qumulo_ldap_settings.rfc2307[0].bind_uri
}

output "ldap_encrypted" {
  description = "Whether LDAP connection is encrypted"
  value       = var.use_custom_schema ? qumulo_ldap_settings.custom[0].encrypt_connection : qumulo_ldap_settings.rfc2307[0].encrypt_connection
}