> Source: [sk183461](https://support.checkpoint.com/results/sk/sk183461)

# sk183461 - How to configure the Management Server to use credentials when it sends queries to an LDAP Server

| Property | Value |
|----------|-------|
| Solution ID | sk183461 |
| Date Created | 2025-05-14 |
| Last Modified | 2025-12-21 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20, R82.10, R81.10 (EOS), R81.10 (EOS), R81.20, R82 |
| OS | Gaia |

## Solution

### Background

If it is necessary to configure security policy that is based on users that are configured on an LDAP server, you must configure an LDAP Account Unit object.

By default, the connection from the Management Server (from the LDAP Account Unit) to the LDAP Server (the Domain Controller) is performed anonymously, although you configure the credentials in the LDAP Account Unit object.

Check Point can provide a hotfix package for the Management Server, so it connects to the LDAP Server (the Domain Controller) with the credentials you configured in the LDAP Account Unit object.

**WARNING - The Management Server does not encrypt the credentials it sends to the LDAP Server. To prevent a possible leak of the LDAP credentials, install this hotfix only if the communication is secured between the Management Server and the LDAP Server in your environment.**

### Procedure to Enable the New Behavior

1. This problem was fixed. The fix is included in:

   * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 183

   If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
   A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
   For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

   **Hotfix installation instructions:**   
   Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).
2. Enable the new behavior:

   **Note** - On a Multi-Domain Security Management Server, this applies to all configured Domain Management Servers.
   1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server.

   2. Log in.

   3. If your default shell is Gaia Clish, then go to the Expert mode:

      `expert`
   4. Temporarily set the environment variable `FWM_ENABLE_LDAP_CREDENTIALS` with the value `1` (digit "one") in the current session:

      1. Temporarily set the environment variable:

         `$MDS_FWDIR/scripts/reload_env_vars.sh -e "FWM_ENABLE_LDAP_CREDENTIALS=1"`
      2. Make sure this environment variable was set:

         `grep -a 'FWM_ENABLE_LDAP_CREDENTIALS' /proc/$(pidof 'fwm')/environ`
   5. Permanently set the environment variable `FWM_ENABLE_LDAP_CREDENTIALS` with the value `1` (digit "one"):

      1. Permanently set the environment variable:

         `$MDS_FWDIR/scripts/override_server_setting.sh -e FWM_ENABLE_LDAP_CREDENTIALS 1`
      2. When possible, restart the Check Point services:

         * On a Security Management Server:

           `cpstop ; sleep 5 ; cpstart`
         * On a Multi-Domain Security Management Server:

           `mdsstop ; sleep 5 ; mdsstart`
      3. Make sure this environment variable was set:

         `grep -a 'FWM_ENABLE_LDAP_CREDENTIALS' /proc/$(pidof 'fwm')/environ`

### Procedure to Disable the New Behavior

1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server.

2. Log in.

3. If your default shell is Gaia Clish, then go to the Expert mode:

   `expert`
4. Unset set the environment variable `FWM_ENABLE_LDAP_CREDENTIALS` (see [sk165938](https://support.checkpoint.com/results/sk/sk165938)):

   1. `$MDS_FWDIR/scripts/reload_env_vars.sh -u FWM_ENABLE_LDAP_CREDENTIALS`

   2. `$MDS_FWDIR/scripts/override_server_setting.sh -u FWM_ENABLE_LDAP_CREDENTIALS`

5. When possible, restart the Check Point services:

   * On a Security Management Server:

     `cpstop ; sleep 5 ; cpstart`
   * On a Multi-Domain Security Management Server:

     `mdsstop ; sleep 5 ; mdsstart`
6. Make sure this environment variable is **not** set:

   `grep -a 'FWM_ENABLE_LDAP_CREDENTIALS' /proc/$(pidof 'fwm')/environ`

   You should just get a new shell prompt line.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content