qumulo_ldap_settings (Resource)¶

Manages LDAP server settings on a Qumulo cluster.

This is a singleton resource (one per cluster). It configures the LDAP server settings for user and group lookups.

Example Usage¶

Installation¶

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

Basic RFC2307 Configuration¶

resource "qumulo_ldap_settings" "main" {
  connection_profile = "prod"

  use_ldap                 = true
  bind_uri                 = "ldap://ldap.example.com"
  base_distinguished_names = "dc=example,dc=com"
  ldap_schema              = "RFC2307"
  encrypt_connection       = true
}

With Bind Credentials¶

resource "qumulo_ldap_settings" "main" {
  connection_profile = "prod"

  use_ldap                 = true
  bind_uri                 = "ldap://ldap.example.com,ldap://ldap2.example.com"
  user                     = "cn=admin,dc=example,dc=com"
  password                 = var.ldap_bind_password
  base_distinguished_names = "dc=users,dc=example,dc=com;dc=groups,dc=example,dc=com"
  ldap_schema              = "RFC2307"
  encrypt_connection       = true
}

Custom Schema Configuration¶

resource "qumulo_ldap_settings" "custom" {
  connection_profile = "prod"

  use_ldap                 = true
  bind_uri                 = "ldap://ldap.example.com"
  user                     = "cn=admin,dc=example,dc=com"
  password                 = var.ldap_bind_password
  base_distinguished_names = "dc=example,dc=com"
  ldap_schema              = "CUSTOM"
  encrypt_connection       = true

  ldap_schema_description {
    group_member_attribute           = "member"
    user_group_identifier_attribute  = "gidNumber"
    login_name_attribute             = "uid"
    group_name_attribute             = "cn"
    user_object_class                = "posixAccount"
    group_object_class               = "posixGroup"
    uid_number_attribute             = "uidNumber"
    gid_number_attribute             = "gidNumber"
  }
}

Multi-Cluster with for_each¶

variable "clusters" {
  type = set(string)
  default = ["prod", "dr"]
}

resource "qumulo_ldap_settings" "main" {
  for_each = var.clusters

  connection_profile = each.value

  use_ldap                 = true
  bind_uri                 = "ldap://ldap.example.com"
  base_distinguished_names = "dc=example,dc=com"
  ldap_schema              = "RFC2307"
}

Import¶

using the connection profile name:

terraform import qumulo_ldap_settings.main "prod"

Schema¶

Required¶

base_distinguished_names (String) Base distinguished name(s) for LDAP searches. Separate multiple DNs with semicolons. Example: dc=users,dc=example,dc=com;dc=groups,dc=example,dc=com
bind_uri (String) LDAP server URI(s). Separate multiple URIs with commas. Example: ldap://ldap.example.com,ldap://ldap2.example.com
connection_profile (String) Name of a connection profile defined in the provider block.

Connection profiles centralize cluster credentials at the provider level. Define profiles in the provider block:

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://cluster.example.com:8000"
      username             = "admin"
      password             = var.cluster_password
      insecure_skip_verify = true  # For self-signed certificates
    }
  ]
}

- ldap_schema (String) LDAP schema to use: RFC2307 or CUSTOM. - use_ldap (Boolean) Enable or disable LDAP authentication.

Optional¶

encrypt_connection (Boolean) Require encrypted connection to LDAP server. Defaults to true.
ldap_schema_description (Block, Optional) Custom LDAP schema configuration. Required when ldap_schema is CUSTOM.

This block specifies the attribute names used in your LDAP directory for user and group lookups. (see below for nested schema) - password (String, Sensitive) Binding password for LDAP authentication. This is write-only. - user (String) Binding user's distinguished name for LDAP authentication. Leave empty for anonymous binding.

Nested Schema for `ldap_schema_description`¶

Required:

gid_number_attribute (String) LDAP attribute for GID number (e.g., gidNumber).
group_member_attribute (String) LDAP attribute for group membership (e.g., member, memberUid).
group_name_attribute (String) LDAP attribute for group name (e.g., cn).
group_object_class (String) LDAP object class for groups (e.g., posixGroup, group).
login_name_attribute (String) LDAP attribute for login name (e.g., uid, sAMAccountName).
uid_number_attribute (String) LDAP attribute for UID number (e.g., uidNumber).
user_group_identifier_attribute (String) LDAP attribute linking users to groups (e.g., gidNumber).
user_object_class (String) LDAP object class for users (e.g., posixAccount, user).