1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
|
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE reference PUBLIC "-//OASIS//DTD DocBook V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<reference>
<title>SSSD Manual pages</title>
<refentry>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/upstream.xml" />
<refmeta>
<refentrytitle>sssd-ldap</refentrytitle>
<manvolnum>5</manvolnum>
<refmiscinfo class="manual">File Formats and Conventions</refmiscinfo>
</refmeta>
<refnamediv id='name'>
<refname>sssd-ldap</refname>
<refpurpose>the configuration file for SSSD</refpurpose>
</refnamediv>
<refsect1 id='description'>
<title>DESCRIPTION</title>
<para>
This manual page describes the configuration of LDAP
domains for
<citerefentry>
<refentrytitle>sssd</refentrytitle>
<manvolnum>8</manvolnum>
</citerefentry>.
For detailed syntax reference, please refer to
<citerefentry>
<refentrytitle>sssd.conf</refentrytitle>
<manvolnum>5</manvolnum>
</citerefentry> manual page, section <quote>FILE FORMAT</quote>
</para>
<para>
There can be more than one LDAP domain configured with SSSD.
</para>
</refsect1>
<refsect1 id='file-format'>
<title>CONFIGURATION OPTIONS</title>
<para>
All the common configuration options for SSSD domains apply
for LDAP domains, too. See the
<citerefentry>
<refentrytitle>sssd.conf</refentrytitle>
<manvolnum>5</manvolnum>
</citerefentry> manual page, section <quote>DOMAIN SECTIONS</quote>
<variablelist>
<varlistentry>
<term>ldapUri (string)</term>
<listitem>
<para>
Specifies the URI of the LDAP server to which
SSSD should connect.
</para>
<para>
Default: ldap://localhost
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>defaultBindDn (string)</term>
<listitem>
<para>
The default bind DN to use for
performing LDAP operations.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>defaultAuthtokType (string)</term>
<listitem>
<para>
The type of the authentication token of the
default bind DN. So far "password" is the only
supported value.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>defaultAuthtok (string)</term>
<listitem>
<para>
The authentication token of the default bind DN.
So far only a clear text password is supported.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>userSearchBase (string)</term>
<listitem>
<para>
The default base DN to use for
performing LDAP operations.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>userNameAttribute (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to
user's login name.
</para>
<para>
Default: uid
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>userObjectClass (string)</term>
<listitem>
<para>
The object class of a user entry in LDAP.
</para>
<para>
Default: posixAccount
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>network_timeout (integer)</term>
<listitem>
<para>
Specifies the timeout (in seconds) after which
the
<citerefentry>
<refentrytitle>poll</refentrytitle>
<manvolnum>2</manvolnum>
</citerefentry>/<citerefentry>
<refentrytitle>select</refentrytitle>
<manvolnum>2</manvolnum>
</citerefentry>
following a
<citerefentry>
<refentrytitle>connect</refentrytitle>
<manvolnum>2</manvolnum>
</citerefentry>
returns in case of no activity.
</para>
<para>
Default: 5
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>opt_timeout (integer)</term>
<listitem>
<para>
Specifies a timeout (in seconds) after which
calls to synchronous LDAP APIs will abort if no
response is received.
</para>
<para>
Default: 5
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>tls_reqcert (string)</term>
<listitem>
<para>
Specifies what checks to perform on server
certificates in a TLS session, if any. It
can be specified as one of the following
values:
</para>
<para>
<emphasis>never</emphasis> = The client will
not request or check any server certificate.
</para>
<para>
<emphasis>allow</emphasis> = The server
certificate is requested. If no certificate is
provided, the session proceeds normally. If a
bad certificate is provided, it will be ignored
and the session proceeds normally.
</para>
<para>
<emphasis>try</emphasis> = The server certificate
is requested. If no certificate is provided, the
session proceeds normally. If a bad certificate
is provided, the session is immediately terminated.
</para>
<para>
<emphasis>demand</emphasis> = The server
certificate is requested. If no certificate
is provided, or a bad certificate is provided,
the session is immediately terminated.
</para>
<para>
<emphasis>hard</emphasis> = Same as
<quote>demand</quote>
</para>
</listitem>
</varlistentry>
</variablelist>
</para>
</refsect1>
<refsect1 id='example'>
<title>EXAMPLE</title>
<para>
The following example assumes that SSSD is correctly
configured and LDAP is set set one of the domains in the
<replaceable>[domains]</replaceable> section.
</para>
<para>
<programlisting>
[domains/LDAP]
auth-module = ldap
ldapUri = ldap://ldap.mydomain.org
userSearchBase = dc=mydomain,dc=org
</programlisting>
</para>
</refsect1>
<refsect1 id='notes'>
<title>NOTES</title>
<para>
Description of some of the configuration options in this manual
page is based on <citerefentry>
<refentrytitle>ldap.conf</refentrytitle>
<manvolnum>5</manvolnum>
</citerefentry> manual page from the OpenLDAP 2.4 distribution.
</para>
</refsect1>
<refsect1 id='see_also'>
<title>SEE ALSO</title>
<para>
<citerefentry>
<refentrytitle>sssd.conf</refentrytitle><manvolnum>5</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>sssd</refentrytitle><manvolnum>8</manvolnum>
</citerefentry>
</para>
</refsect1>
</refentry>
</reference>
|
