RS: Improve role-based LDAP guide with how-it-works, terminology, and validation steps

[kaitlynmichael]

Summary

Rewrites the Redis Software Enable role-based LDAP page from a field reference into a self-service operator guide, so a customer can understand each setting and validate it before saving.

Tickets

Delivers three related tickets in one page:

• DOC-5246 — Review and improve role-based LDAP guide
• DOC-6712 — self-service rewrite (how-it-works, terminology, validation)
• DOC-2434 — Trusted CA certificate guidance

What changed

• How role-based LDAP works overview (bind → authenticate → authorize), each step linked to its config section
• LDAP terminology table (DN, Bind DN, Base, Filter, Scope, %u, %D)
• Template vs Query (authentication) and Attribute vs Query (authorization) guidance
• Validate your LDAP configuration — a copy-paste ldapsearch check per setting, plus an end-to-end check
• Exact-match mapping warning for the group-DN mismatch that silently fails authorization
• Expanded Trusted CA certificate guidance (root CA, PEM, layered on system CAs, hostname verification)
• Minor fixes: cd=admin → cn=admin; group filter (members=%D) → (member=%D)

Behavior verified against the Redis Software 8.2.1-2 source.

Review notes

Security SME review requested from @aharonblitzer. Two points to confirm:

1. The documented bind → authenticate → authorize flow and the Template/Query + Attribute/Query behavior.
2. The Trusted CA certificate section — DOC-2434's older "we don't support CA certificate bundles" claim looks stale. In 8.2.1-2 the LDAP cert loader appends the configured cert with Go's AppendCertsFromPEM, which parses multiple concatenated PEM certs, so a bundle appears to be accepted. No "no bundles" limitation was documented; please confirm current behavior before resolving DOC-2434.

---

Note

Low Risk
Documentation-only changes to LDAP configuration guidance; no product code or runtime behavior is modified.

Overview
Expands the Redis Software Enable role-based LDAP page from a short UI walkthrough into a fuller operator guide.

The page now explains the bind → authenticate → authorize flow, adds an LDAP terminology table (DN, %u, %D, scope, and related terms), and clarifies when to use Template vs Query for authentication and Attribute vs Query for authorization. LDAP server, trusted CA, and bind credentials sections are rewritten with clearer semantics (including PEM CA guidance and hostname verification).

A major addition is Validate your LDAP configuration: step-by-step ldapsearch examples for protocol/host/TLS, bind user, auth query, authz query, and LDAP mapping DN matching, plus an end-to-end sign-in check. The front matter description now mentions validation; setup steps point readers to validate before Save & Enable.

Minor doc fixes: bind DN example cd=admin → cn=admin, group filter example (members=%D) → (member=%D).

[github-actions]

Staging links:
https://redis.io/docs/staging/DOC-5246/operate/rs/security/access-control/ldap/enable-role-based-ldap/

[github-actions]

DOC-5246

[github-actions]

🧠 Redis Memory

No related prior context found — this looks new to the repository's memory.

Memory updated at 3b85038