ldapdb

5

ldapdb

auxiliary property plugin

Cyrus SASL auxprop plugin to access LDAP authentication backends.

## Description

This document describes configuration options for the Cyrus SASL auxiliary property plugin `ldapdb`.

This plugin reads all user data from an OpenLDAP server. It requires configuration of the `ldapdb` plugin and of the LDAP server. The `ldapdb` plugin must name a proxy user. The proxy user must (also) SASL authenticate at the LDAP server. The LDAP server must authorize the `ldapdb` proxy user to access the authenticating users `userPassword`.

## Options

The following configuration parameters are applicable in the context of the `ldapdb` plugin:

`ldapdb_uri` (default: empty)

- Specifies a whitespace-separated list of LDAP servers (authentication backends). Use `ldapi://`..., `ldap://`... or `ldaps://`... to specify how the servers should be contacted.

`ldapdb_id` (default: empty)

- Specifies the proxy user name (authentication id) who logs into the LDAP server in order to retrieve the authenticating users `userPassword`.

`ldapdb_mech` (default: empty)

- Sets the SASL mechanism the `ldapdb` plugin (client) should use when it SASL connects to the LDAP server.

`ldapdb_pw` (default: empty)

- Specifies the password used by `ldapdb_id`. The password must be written in cleartext.

`ldapdb_rc` (default: empty)

- Specifies a path to a file that contains configuration options to override system-wide defaults when running ldap clients (see also:

  ldap.conf

  5 ).

  The main purpose behind this option is to drop transmission of `ldapdb_pw` in favor of a client TLS certificate specified in `ldapdb_rc`, so that SASL/EXTERNAL may be used between the ldapdb plugin and the LDAP server.

  This is the most optimal way to use the ldapdb plugin when the servers are on separate machines - the connection is encrypted and password transmission is not necessary because the client is identified by its TLS client certificate.

`ldapdb_starttls` (default: empty)

- Enable encrypted communication using StartTLS. Valid options are:

  `try`

- StartTLS encrypted communication is attempted. If it fails the client communicates unencrypted.

`demand`

- StartTLS encrypted communication is required. If it fails the client aborts the connection.

## Example

The following example shows a typical `ldapdb` configuration.

    pwcheck_method: auxprop
    auxprop_plugin: ldapdb
    mech_list: PLAIN LOGIN NTLM CRAM-MD5 DIGEST-MD5
    ldapdb_uri: ldap://localhost ldaps://ldap.example.com
    ldapdb_id: proxyuser
    ldapdb_pw: proxypass
    ldapdb_mech: DIGEST-MD5

## See also

authdaemond

5 ,

ldapdb

5 ,

libsasl

5 ,

saslauthd

8 ,

saslauthd.conf

5 ,

saslpasswd2

5 ,

sasldblistusers2

5 ,

sasldb

5 ,

sql

5

## Readme files

`README.Debian`

## Author

This manual was written for the Debian distribution because the original program does not have a manual page. Parts of the documentation have been taken from the Cyrus SASL's `options.html`.

    Patrick Ben Koetter
    p@state-of-mind.de