diff options
| author | Simo Sorce <ssorce@redhat.com> | 2009-09-25 09:46:30 -0400 |
|---|---|---|
| committer | Stephen Gallagher <sgallagh@redhat.com> | 2009-10-01 08:42:36 -0400 |
| commit | bc58f5892d3a8f6b28e2148c5a0cca34b63ef354 (patch) | |
| tree | e7db3c657227adb86f49abd84ca4fa426e929621 /server/man | |
| parent | d4341d654beb1f6c87d7f70ef0142f23aadac957 (diff) | |
| download | sssd2-bc58f5892d3a8f6b28e2148c5a0cca34b63ef354.tar.gz sssd2-bc58f5892d3a8f6b28e2148c5a0cca34b63ef354.tar.xz sssd2-bc58f5892d3a8f6b28e2148c5a0cca34b63ef354.zip | |
Initial implementation of sasl bind support
Inits krb5 credentials, if sasl mech is GSSAPI.
Tested with GSSAPI and host keytab as well as user credentials.
Updates also manpages with the new options.
Diffstat (limited to 'server/man')
| -rw-r--r-- | server/man/sssd-ldap.5.xml | 79 |
1 files changed, 79 insertions, 0 deletions
diff --git a/server/man/sssd-ldap.5.xml b/server/man/sssd-ldap.5.xml index b5efb11d..7a86c7a3 100644 --- a/server/man/sssd-ldap.5.xml +++ b/server/man/sssd-ldap.5.xml @@ -485,6 +485,85 @@ </listitem> </varlistentry> + <varlistentry> + <term>ldap_id_use_start_tls (boolean)</term> + <listitem> + <para> + Specifies that the id_provider connection must also + use tls to protect the channel. + </para> + <para> + Default: false + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>ldap_sasl_mech (string)</term> + <listitem> + <para> + Specify the sasl mechanism to use. + Currently only GSSAPI is tested and supported. + </para> + <para> + Default: none + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>ldap_sasl_authid (string)</term> + <listitem> + <para> + Specify the sasl authorization id to use. + When GSSAPI is used, this represents the kerberos + principal used for authentication to the directory. + </para> + <para> + Default: host/machine.fqdn@REALM + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>ldap_krb5_keytab (string)</term> + <listitem> + <para> + Specify keytab to use when using SASL/GSSAPI. + </para> + <para> + Default: System keytab, normally /etc/krb5.keytab + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>ldap_krb5_init_creds (boolean)</term> + <listitem> + <para> + Specifies that the id_provider should init + kerberos credentials (TGT). + This action is perfromed only if SASL is used and + the mechanism selected is GSSAPI. + </para> + <para> + Default: true + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>krb5_realm (string)</term> + <listitem> + <para> + Specify the kerberos REALM (for SASL/GSSAPI auth). + </para> + <para> + Default: System defaults, see /etc/krb5.conf + </para> + </listitem> + </varlistentry> + </variablelist> </para> </refsect1> |