Authentication Plugins For SASL LDAP authentication, the absolute path of the certificate authority file. Specify this file if it is desired that the authentication plugin perform verification of the LDAP server certificate. In addition to setting the  authentication_ldap_sasl_ca_path  variable to the file name, you must add the appropriate certificate authority certificates to the file and enable the  authentication_ldap_sasl_tls  system variable. These variables can be set to override the default OpenLDAP TLS configuration; see LDAP Pluggable Authentication and ldap.conf For SASL LDAP authentication, the name of the attribute that specifies group names in LDAP directory entries. If  authentication_ldap_sasl_group_search_attr  has its default value of  cn , searches return the  cn  value as the group name. For example, if an LDAP entry with a  uid  value of  user1  has a cn  attribute of  mygroup , searches for  user1  return  mygroup  as the group name. This variable should be the empty string if you want no group or proxy authentication. If the group search attribute is  isMemberOf , LDAP authentication directly retrieves the user attribute  isMemberOf  value and assigns it as group information. If the group search attribute is not isMemberOf , LDAP authentication searches for all groups where the user is a member. (The latter is the default behavior.) This behavior is based on how LDAP group information can be stored two ways: 1) A group entry can have an attribute named  memberUid  or  member  with a value that is a user name; 2) A user entry can have an attribute named  isMemberOf  with values that are group names. 1364 • authentication_ldap_sasl_group_search_filter • authentication_ldap_sasl_group_search_attr SET_VAR  Hint Applies No Type String Default Value NULL Command-Line Format --authentication-ldap-sasl-group- search-attr=value System Variable Scope Global Dynamic Yes SET_VAR  Hint Applies No Type String Default Value cn Command-Line Format --authentication-ldap-sasl-group- search-filter=value System Variable Scope Global Dynamic Yes SET_VAR  Hint Applies No Type String Note