LDAP
LDAP allows your DiskStation to join an existing directory service as an LDAP client, and then retrieve user or group information from an LDAP server (or "directory server"). You can manage LDAP users' or groups' access privileges to DSM applications and shared folders, just as you would with DSM local users or groups. For more information about LDAP, refer to here.
Note: The supported LDAP standard is LDAP version 3 (RFC2251).
To Join DiskStation to a directory service:
- Tick Enable LDAP Client.
- Enter the IP address or domain name of the LDAP server in the LDAP Server address field.
- Choose an encryption type from the Encryption drop-down menu to encrypt LDAP connection to the LDAP server.
- Enter the Base DN of the LDAP server in the Base DN field.
- To allow LDAP users to access DiskStation files via CIFS, tick Enable Windows CIFS support. See the section below to ensure LDAP users can use their computers to successfully access DiskStation files via CIFS.
- Click Apply.
-
Enter the Bind DN (or LDAP administrator account) and the password in the fields, and then click OK.
About CIFS Support and Client Computer's Settings
After CIFS support is enabled, LDAP users might need to modify their computers' settings to be able to access DiskStation files via CIFS:
-
If your DiskStation joins to the directory service provided by a Synology LDAP server (or another DiskStation that has installed and run the Directory Server package), LDAP users can access your DiskStation files via CIFS without modifying their computers' settings.
-
If your DiskStation binds to a non-Synology LDAP server, LDAP users will need to enable their computer's PAM support to be able to access DiskStation files via CIFS. However, doing so will transfer LDAP users' password to DiskStation in plain text (without encryption), thus lowering the security level.
To modify Windows's settings:
- Go to Start > Run, type regedit in the field, and then click OK to open Registry Editor.
-
Depending on your Windows version, find or create the following registry:
-
Windows 2000, XP, Vista, and Windows 7:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkStation\Parameters]
-
Windows NT:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rdr\Parameters]
-
Windows 95 (SP1), 98 and Me:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VNETSUP]
-
Create or modify the DWORD value EnablePlainTextPassword and change its value data from 0 to 1.
-
Restart Windows for the change to take effect.
To modify Mac OS X's settings:
- Go to Applications > Utilities to open Terminal.
-
Create an empty file /etc/nsmb.conf:
sudo touch /etc/nsmb.conf
-
Open /etc/nsmb.conf with vi:
sudo vi /etc/nsmb.conf
-
Type "i" to insert text, and paste the following:
[Default]
minauth=none
-
Press the Esc key and then type "ZZ" to save the changes and exit vi.
To modify Linux's settings:
Add the following keys in the [global] section of smb.conf:
encrypt passwords = no
client plaintext auth = yes
client lanman auth = yes