A retail chain is moving 80 stores to 802.1X wired access using its Linux OpenLDAP directory as the identity source. The directory policy disables anonymous binds, the security standard requires that directory traffic and the bind password stay encrypted, and group membership must resolve from the staff subtree. The directory uses standard RFC 2307 POSIX group attributes. Which LDAP identity source settings meet the store chain's requirements?
Select an answer to reveal the explanation.
Short Explanation
You’ll want a dedicated read-only bind account, RFC 2307, and user and group search bases limited to the staff subtree. LDAPS encrypts the directory conversation, including the bind password, while RFC 2307 matches the directory’s POSIX group attributes.
Full Explanation
The configuration that meets the requirements uses a dedicated read-only account for authenticated searches, RFC 2307 to match the directory’s POSIX group attributes, staff-subtree bases for both users and groups, and LDAPS to encrypt directory traffic and the bind password. Using RFC 2307bis instead selects a different group model, commonly based on distinguished-name membership, and may not interpret this directory’s POSIX group memberships correctly. Keeping the user base in the staff subtree but setting the group base at the directory root can find groups outside the required scope, so it does not meet the group-search requirement. Anonymous binding may be used for read-only discovery in some LDAP deployments, and LDAPS would encrypt that connection, but it violates this directory’s explicit prohibition on anonymous binds. Exam caveat: encryption is the requirement; correctly configured StartTLS can also provide it, so LDAPS is not universally the only secure LDAP transport. Practical check: test an authenticated lookup and group-membership resolution for a staff user, confirm results are limited to the staff subtree, and verify the negotiated TLS connection and certificate.