LDAPDB(5)

NAME
ldapdb - auxiliary property plugin

SYNOPSIS

Cyrus SASL auxprop plugin to access LDAP authentication backends.

DESCRIPTION

This document describes configuration options for the Cyrus SASL auxiliary property plugin ldapdb.

This plugin reads all user data from an OpenLDAP server. It requires configuration of the ldapdb plugin and of the LDAP server. The ldapdb plugin must name a proxy user. The proxy user must (also) SASL authenticate at the LDAP server. The LDAP server must authorize the ldapdb proxy user to access the authenticating users userPassword.

OPTIONS

The following configuration parameters are applicable in the context of the ldapdb plugin:

ldapdb_uri (default: empty)
    Specifies a whitespace-separated list of LDAP servers (authentication backends). Use ldapi://..., ldap://... or ldaps://... to specify how the servers should be contacted.

ldapdb_id (default: empty)
    Specifies the proxy user name (authentication id) who logs into the LDAP server in order to retrieve the authenticating users userPassword.

ldapdb_mech (default: empty)
    Sets the SASL mechanism the ldapdb plugin (client) should use when it SASL connects to the LDAP server.

ldapdb_pw (default: empty)
    Specifies the password used by ldapdb_id. The password must be written in cleartext.

ldapdb_rc (default: empty)
    Specifies a path to a file that contains configuration options to override system-wide defaults when running ldap clients (see also: ldap.conf(5)).

    The main purpose behind this option is to drop transmission of ldapdb_pw in favor of a client TLS certificate specified in ldapdb_rc, so that SASL/EXTERNAL may be used between the ldapdb plugin and the LDAP server.

    Note This is the most optimal way to use the ldapdb plugin when the servers are on separate machines - the connection is encrypted and password transmission is not necessary because the client is identified by its TLS client certificate.

ldapdb_starttls (default: empty)
    Enable encrypted communication using StartTLS. Valid options are:

    try
        StartTLS encrypted communication is attempted. If it fails the client communicates unencrypted.

    demand
        StartTLS encrypted communication is required. If it fails the client aborts the connection.

EXAMPLE

The following example shows a typical ldapdb configuration.

    pwcheck_method: auxprop
    auxprop_plugin: ldapdb
    mech_list: PLAIN LOGIN NTLM CRAM-MD5 DIGEST-MD5
    ldapdb_uri: ldap://localhost ldaps://ldap.example.com
    ldapdb_id: proxyuser
    ldapdb_pw: proxypass
    ldapdb_mech: DIGEST-MD5

SEE ALSO

authdaemond(5), ldapdb(5), libsasl(5), saslauthd(8), saslauthd.conf(5), saslpasswd2(5), sasldblistusers2(5), sasldb(5), sql(5)

README FILES

README.Debian

AUTHOR

This manual was written for the Debian distribution because the original program does not have a manual page. Parts of the documentation have been taken from the Cyrus SASL's options.html.

    Patrick Ben Koetter
    <p@state-of-mind.de>