sssd-ldap.5.xml revision 24c3186d01d8d1c11832baab24ab3f0de121c666
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce<?xml version="1.0" encoding="UTF-8"?>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce<!DOCTYPE reference PUBLIC "-//OASIS//DTD DocBook V4.4//EN"
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce<reference>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce<title>SSSD Manual pages</title>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce<refentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/upstream.xml" />
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refmeta>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refentrytitle>sssd-ldap</refentrytitle>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <manvolnum>5</manvolnum>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refmiscinfo class="manual">File Formats and Conventions</refmiscinfo>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </refmeta>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refnamediv id='name'>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refname>sssd-ldap</refname>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refpurpose>the configuration file for SSSD</refpurpose>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </refnamediv>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refsect1 id='description'>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <title>DESCRIPTION</title>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce This manual page describes the configuration of LDAP
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce domains for
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <citerefentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <refentrytitle>sssd</refentrytitle>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <manvolnum>8</manvolnum>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </citerefentry>.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce Refer to the <quote>FILE FORMAT</quote> section of the
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <citerefentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <refentrytitle>sssd.conf</refentrytitle>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <manvolnum>5</manvolnum>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </citerefentry> manual page for detailed syntax information.</para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce You can configure SSSD to use more than one LDAP domain.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce LDAP back end supports id, auth, access and chpass providers. If you want
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce to authenticate against an LDAP server either TLS/SSL or LDAPS
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce is required. <command>sssd</command> <emphasis>does
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce not</emphasis> support authentication over an unencrypted channel.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce If the LDAP server is used only as an identity provider, an encrypted
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce channel is not needed. Please refer to <quote>ldap_access_filter</quote>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce config option for more information about using LDAP as an access provider.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </refsect1>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <refsect1 id='file-format'>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <title>CONFIGURATION OPTIONS</title>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce All of the common configuration options that apply to SSSD domains also apply
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce to LDAP domains. Refer to the <quote>DOMAIN SECTIONS</quote> section of the
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <citerefentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <refentrytitle>sssd.conf</refentrytitle>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <manvolnum>5</manvolnum>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </citerefentry> manual page for full details.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <variablelist>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <term>ldap_uri, ldap_backup_uri (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce Specifies the comma-separated list of URIs of the LDAP servers to which
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce SSSD should connect in the order of preference. Refer to the
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <quote>FAILOVER</quote> section for more information on failover and server redundancy.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce If neither option is specified, service discovery is enabled. For more information,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce refer to the <quote>SERVICE DISCOVERY</quote> section.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce The format of the URI must match the format defined in RFC 2732:
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ldap[s]://&lt;host&gt;[:port]
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce For explicit IPv6 addresses, &lt;host&gt; must be enclosed in brackets []
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce example: ldap://[fc00::126:25]:389
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <term>ldap_chpass_uri, ldap_chpass_backup_uri (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce Specifies the comma-separated list of URIs of the LDAP servers to
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce which SSSD should connect in the order of preference
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce to change the password of a user. Refer to the
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <quote>FAILOVER</quote> section for more information
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce on failover and server redundancy.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce To enable service discovery
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ldap_chpass_dns_service_name must be set.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: empty, i.e. ldap_uri is used.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_search_base (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The default base DN to use for
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce performing LDAP user operations.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Starting with SSSD 1.7.0, SSSD supports multiple
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce search bases using the syntax:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce search_base[?scope?[filter][?search_base?scope?[filter]]*]
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The scope can be one of "base", "onelevel" or "subtree".
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The filter must be a valid LDAP search filter as
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce specified by http://www.ietf.org/rfc/rfc2254.txt
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Examples:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ldap_search_base = dc=example,dc=com
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce (which is equivalent to)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ldap_search_base = dc=example,dc=com?subtree?
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ldap_search_base = cn=host_specific,dc=example,dc=com?subtree?(host=thishost)?dc=example.com?subtree?
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Note: It is unsupported to have multiple search
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce bases which reference identically-named objects
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce (for example, groups with the same name in two
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce different search bases). This will lead to
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce unpredictable behavior on client machines.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: If not set, the value of the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce defaultNamingContext or namingContexts attribute
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce from the RootDSE of the LDAP server is
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce used. If defaultNamingContext does not exist or
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce has an empty value namingContexts is used.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The namingContexts attribute must have a
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce single value with the DN of the search base of the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce LDAP server to make this work. Multiple values are
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce are not supported.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_schema (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Specifies the Schema Type in use on the target LDAP
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce server.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Depending on the selected schema, the default
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce attribute names retrieved from the servers may vary.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The way that some attributes are handled may also differ.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Four schema types are currently supported:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <itemizedlist>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce rfc2307
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce rfc2307bis
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce IPA
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce AD
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </itemizedlist>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The main difference between these schema types is
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce how group memberships are recorded in the server.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce With rfc2307, group members are listed by name in the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <emphasis>memberUid</emphasis> attribute.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce With rfc2307bis and IPA, group members are listed by DN
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce and stored in the <emphasis>member</emphasis> attribute.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The AD schema type sets the attributes to correspond with
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Active Directory 2008r2 values.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: rfc2307
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_default_bind_dn (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The default bind DN to use for
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce performing LDAP operations.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <term>ldap_default_authtok_type (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The type of the authentication token of the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce default bind DN.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The two mechanisms currently supported are:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce password
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce obfuscated_password
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: password
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_default_authtok (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The authentication token of the default bind DN.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce Only clear text passwords are currently supported.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_object_class (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The object class of a user entry in LDAP.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: posixAccount
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_name (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce The LDAP attribute that corresponds to the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce user's login name.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: uid
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_uid_number (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The LDAP attribute that corresponds to the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce user's id.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: uidNumber
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <term>ldap_user_gid_number (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The LDAP attribute that corresponds to the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce user's primary group id.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: gidNumber
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <term>ldap_user_gecos (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The LDAP attribute that corresponds to the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce user's gecos field.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: gecos
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_home_directory (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The LDAP attribute that contains the name of the user's
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce home directory.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: homeDirectory
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_shell (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce The LDAP attribute that contains the path to the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce user's default shell.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: loginShell
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_uuid (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The LDAP attribute that contains the UUID/GUID of
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce an LDAP user object.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: nsUniqueId
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_objectsid (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The LDAP attribute that contains the objectSID of
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce an LDAP user object. This is usually only
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce necessary for ActiveDirectory servers.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: objectSid for ActiveDirectory, not set
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce for other servers.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_modify_timestamp (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce The LDAP attribute that contains timestamp of the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce last modification of the parent object.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: modifyTimestamp
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_shadow_last_change (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce When using ldap_pwd_policy=shadow, this parameter
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce contains the name of an LDAP attribute corresponding
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce to its
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <citerefentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refentrytitle>shadow</refentrytitle>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <manvolnum>5</manvolnum>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </citerefentry> counterpart (date of the last
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce password change).
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: shadowLastChange
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_shadow_min (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce When using ldap_pwd_policy=shadow, this parameter
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce contains the name of an LDAP attribute corresponding
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce to its
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <citerefentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refentrytitle>shadow</refentrytitle>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <manvolnum>5</manvolnum>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </citerefentry> counterpart (minimum password age).
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: shadowMin
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_shadow_max (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce When using ldap_pwd_policy=shadow, this parameter
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce contains the name of an LDAP attribute corresponding
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce to its
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <citerefentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refentrytitle>shadow</refentrytitle>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <manvolnum>5</manvolnum>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </citerefentry> counterpart (maximum password age).
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: shadowMax
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_shadow_warning (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce When using ldap_pwd_policy=shadow, this parameter
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce contains the name of an LDAP attribute corresponding
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce to its
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <citerefentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refentrytitle>shadow</refentrytitle>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <manvolnum>5</manvolnum>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </citerefentry> counterpart (password warning
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce period).
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce Default: shadowWarning
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_shadow_inactive (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce When using ldap_pwd_policy=shadow, this parameter
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce contains the name of an LDAP attribute corresponding
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce to its
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <citerefentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refentrytitle>shadow</refentrytitle>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <manvolnum>5</manvolnum>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </citerefentry> counterpart (password inactivity
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce period).
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: shadowInactive
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_shadow_expire (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce When using ldap_pwd_policy=shadow or
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ldap_account_expire_policy=shadow, this parameter
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce contains the name of an LDAP attribute corresponding
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce to its
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <citerefentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <refentrytitle>shadow</refentrytitle>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <manvolnum>5</manvolnum>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </citerefentry> counterpart (account expiration date).
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce Default: shadowExpire
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <term>ldap_user_krb_last_pwd_change (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce When using ldap_pwd_policy=mit_kerberos, this
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce parameter contains the name of an LDAP attribute
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce storing the date and time of last password change
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce in kerberos.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce Default: krbLastPwdChange
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <term>ldap_user_krb_password_expiration (string)</term>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce When using ldap_pwd_policy=mit_kerberos, this
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce parameter contains the name of an LDAP attribute
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce storing the date and time when current password
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce expires.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce Default: krbPasswordExpiration
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <term>ldap_user_ad_account_expires (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce When using ldap_account_expire_policy=ad, this
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce parameter contains the name of an LDAP attribute
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce storing the expiration time of the account.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce Default: accountExpires
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </listitem>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </varlistentry>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <term>ldap_user_ad_user_account_control (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce When using ldap_account_expire_policy=ad, this
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce parameter contains the name of an LDAP attribute
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce storing the user account control bit field.
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce Default: userAccountControl
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce </varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <varlistentry>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <term>ldap_ns_account_lock (string)</term>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <listitem>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce <para>
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce When using ldap_account_expire_policy=rhds or
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce equivalent, this parameter determines if access is
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce allowed or not.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce <para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Default: nsAccountLock
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </para>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce </listitem>
</varlistentry>
<varlistentry>
<term>ldap_user_nds_login_disabled (string)</term>
<listitem>
<para>
When using ldap_account_expire_policy=nds, this
attribute determines if access is allowed or not.
</para>
<para>
Default: loginDisabled
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_user_nds_login_expiration_time (string)</term>
<listitem>
<para>
When using ldap_account_expire_policy=nds, this
attribute determines until which date access is
granted.
</para>
<para>
Default: loginDisabled
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_user_nds_login_allowed_time_map (string)</term>
<listitem>
<para>
When using ldap_account_expire_policy=nds, this
attribute determines the hours of a day in a week
when access is granted.
</para>
<para>
Default: loginAllowedTimeMap
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_user_principal (string)</term>
<listitem>
<para>
The LDAP attribute that contains the user's Kerberos
User Principal Name (UPN).
</para>
<para>
Default: krbPrincipalName
</para>
</listitem>
</varlistentry>
<varlistentry condition="with_ssh">
<term>ldap_user_ssh_public_key (string)</term>
<listitem>
<para>
The LDAP attribute that contains the user's SSH
public keys.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_force_upper_case_realm (boolean)</term>
<listitem>
<para>
Some directory servers, for example Active Directory,
might deliver the realm part of the UPN in lower case,
which might cause the authentication to fail. Set this
option to a non-zero value if you want to use an
upper-case realm.
</para>
<para>
Default: false
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_enumeration_refresh_timeout (integer)</term>
<listitem>
<para>
Specifies how many seconds SSSD has to wait
before refreshing its cache of enumerated
records.
</para>
<para>
Default: 300
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_purge_cache_timeout (integer)</term>
<listitem>
<para>
Determine how often to check the cache for
inactive entries (such as groups with no
members and users who have never logged in) and
remove them to save space.
</para>
<para>
Setting this option to zero will disable the
cache cleanup operation.
</para>
<para>
Default: 10800 (12 hours)
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_user_fullname (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to the
user's full name.
</para>
<para>
Default: cn
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_user_member_of (string)</term>
<listitem>
<para>
The LDAP attribute that lists the user's
group memberships.
</para>
<para>
Default: memberOf
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_user_authorized_service (string)</term>
<listitem>
<para>
If access_provider=ldap and
ldap_access_order=authorized_service, SSSD will
use the presence of the authorizedService
attribute in the user's LDAP entry to determine
access privilege.
</para>
<para>
An explicit deny (!svc) is resolved first. Second,
SSSD searches for explicit allow (svc) and finally
for allow_all (*).
</para>
<para>
Default: authorizedService
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_user_authorized_host (string)</term>
<listitem>
<para>
If access_provider=ldap and
ldap_access_order=host, SSSD will use the presence
of the host attribute in the user's LDAP entry to
determine access privilege.
</para>
<para>
An explicit deny (!host) is resolved first. Second,
SSSD searches for explicit allow (host) and finally
for allow_all (*).
</para>
<para>
Default: host
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_group_object_class (string)</term>
<listitem>
<para>
The object class of a group entry in LDAP.
</para>
<para>
Default: posixGroup
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_group_name (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to
the group name.
</para>
<para>
Default: cn
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_group_gid_number (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to the
group's id.
</para>
<para>
Default: gidNumber
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_group_member (string)</term>
<listitem>
<para>
The LDAP attribute that contains the names of
the group's members.
</para>
<para>
Default: memberuid (rfc2307) / member (rfc2307bis)
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_group_uuid (string)</term>
<listitem>
<para>
The LDAP attribute that contains the UUID/GUID of
an LDAP group object.
</para>
<para>
Default: nsUniqueId
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_group_objectsid (string)</term>
<listitem>
<para>
The LDAP attribute that contains the objectSID of
an LDAP group object. This is usually only
necessary for ActiveDirectory servers.
</para>
<para>
Default: objectSid for ActiveDirectory, not set
for other servers.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_group_modify_timestamp (string)</term>
<listitem>
<para>
The LDAP attribute that contains timestamp of the
last modification of the parent object.
</para>
<para>
Default: modifyTimestamp
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_group_nesting_level (integer)</term>
<listitem>
<para>
If ldap_schema is set to a schema format that
supports nested groups (e.g. RFC2307bis), then
this option controls how many levels of nesting
SSSD will follow. This option has no effect on the
RFC2307 schema.
</para>
<para>
Default: 2
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_groups_use_matching_rule_in_chain</term>
<listitem>
<para>
This option tells SSSD to take advantage of an
Active Directory-specific feature which may speed
up group lookup operations on deployments with
complex or deep nested groups.
</para>
<para>
In most common cases, it is best to leave this
option disabled. It generally only provides a
performance increase on very complex nestings.
</para>
<para>
If this option is enabled, SSSD will use it if it
detects that the server supports it during initial
connection. So "True" here essentially means
"auto-detect".
</para>
<para>
Note: This feature is currently known to work only
with Active Directory 2008 R1 and later. See
<ulink url="http://msdn.microsoft.com/en-us/library/windows/desktop/aa746475%28v=vs.85%29.aspx">
MSDN(TM) documentation</ulink> for more details.
</para>
<para>
Default: False
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_initgroups_use_matching_rule_in_chain</term>
<listitem>
<para>
This option tells SSSD to take advantage of an
Active Directory-specific feature which might speed
up initgroups operations (most notably when
dealing with complex or deep nested groups).
</para>
<para>
If this option is enabled, SSSD will use it if it
detects that the server supports it during initial
connection. So "True" here essentially means
"auto-detect".
</para>
<para>
Note: This feature is currently known to work only
with Active Directory 2008 R1 and later. See
<ulink url="http://msdn.microsoft.com/en-us/library/windows/desktop/aa746475%28v=vs.85%29.aspx">
MSDN(TM) documentation</ulink> for more details.
</para>
<para>
Default: False
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_netgroup_object_class (string)</term>
<listitem>
<para>
The object class of a netgroup entry in LDAP.
</para>
<para>
In IPA provider, ipa_netgroup_object_class should
be used instead.
</para>
<para>
Default: nisNetgroup
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_netgroup_name (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to
the netgroup name.
</para>
<para>
In IPA provider, ipa_netgroup_name should
be used instead.
</para>
<para>
Default: cn
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_netgroup_member (string)</term>
<listitem>
<para>
The LDAP attribute that contains the names of
the netgroup's members.
</para>
<para>
In IPA provider, ipa_netgroup_member should
be used instead.
</para>
<para>
Default: memberNisNetgroup
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_netgroup_triple (string)</term>
<listitem>
<para>
The LDAP attribute that contains the (host, user,
domain) netgroup triples.
</para>
<para>
This option is not available in IPA provider.
</para>
<para>
Default: nisNetgroupTriple
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_netgroup_uuid (string)</term>
<listitem>
<para>
The LDAP attribute that contains the UUID/GUID of
an LDAP netgroup object.
</para>
<para>
In IPA provider, ipa_netgroup_uuid should
be used instead.
</para>
<para>
Default: nsUniqueId
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_netgroup_modify_timestamp (string)</term>
<listitem>
<para>
The LDAP attribute that contains timestamp of the
last modification of the parent object.
</para>
<para>
This option is not available in IPA provider.
</para>
<para>
Default: modifyTimestamp
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_service_object_class (string)</term>
<listitem>
<para>
The object class of a service entry in LDAP.
</para>
<para>
Default: ipService
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_service_name (string)</term>
<listitem>
<para>
The LDAP attribute that contains the name of
service attributes and their aliases.
</para>
<para>
Default: cn
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_service_port (string)</term>
<listitem>
<para>
The LDAP attribute that contains the port managed
by this service.
</para>
<para>
Default: ipServicePort
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_service_proto (string)</term>
<listitem>
<para>
The LDAP attribute that contains the protocols
understood by this service.
</para>
<para>
Default: ipServiceProtocol
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_service_search_base (string)</term>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
</varlistentry>
<varlistentry>
<term>ldap_search_timeout (integer)</term>
<listitem>
<para>
Specifies the timeout (in seconds) that ldap
searches are allowed to run before they are
cancelled and cached results are returned (and
offline mode is entered)
</para>
<para>
Note: this option is subject to change in future
versions of the SSSD. It will likely be replaced at
some point by a series of timeouts for specific
lookup types.
</para>
<para>
Default: 6
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_enumeration_search_timeout (integer)</term>
<listitem>
<para>
Specifies the timeout (in seconds) that ldap
searches for user and group enumerations
are allowed to run before they are cancelled and
cached results are returned (and offline mode is
entered)
</para>
<para>
Default: 60
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_network_timeout (integer)</term>
<listitem>
<para>
Specifies the timeout (in seconds) after which
the
<citerefentry>
<refentrytitle>poll</refentrytitle>
<manvolnum>2</manvolnum>
</citerefentry>/<citerefentry>
<refentrytitle>select</refentrytitle>
<manvolnum>2</manvolnum>
</citerefentry>
following a
<citerefentry>
<refentrytitle>connect</refentrytitle>
<manvolnum>2</manvolnum>
</citerefentry>
returns in case of no activity.
</para>
<para>
Default: 6
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_opt_timeout (integer)</term>
<listitem>
<para>
Specifies a timeout (in seconds) after which
calls to synchronous LDAP APIs will abort if no
response is received. Also controls the timeout
when communicating with the KDC in case of SASL bind.
</para>
<para>
Default: 6
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_connection_expire_timeout (integer)</term>
<listitem>
<para>
Specifies a timeout (in seconds) that a connection
to an LDAP server will be maintained. After this
time, the connection will be re-established. If
used in parallel with SASL/GSSAPI, the sooner of
the two values (this value vs. the TGT lifetime)
will be used.
</para>
<para>
Default: 900 (15 minutes)
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_page_size (integer)</term>
<listitem>
<para>
Specify the number of records to retrieve from
LDAP in a single request. Some LDAP servers
enforce a maximum limit per-request.
</para>
<para>
Default: 1000
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_disable_paging (boolean)</term>
<listitem>
<para>
Disable the LDAP paging control. This option
should be used if the LDAP server reports that it
supports the LDAP paging control in its RootDSE
but it is not enabled or does not behave properly.
</para>
<para>
Example: OpenLDAP servers with the paging control
module installed on the server but not enabled
will report it in the RootDSE but be unable to use
it.
</para>
<para>
Example: 389 DS has a bug where it can only
support a one paging control at a time on a single
connection. On busy clients, this can result in
some requests being denied.
</para>
<para>
Default: False
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sasl_minssf (integer)</term>
<listitem>
<para>
When communicating with an LDAP server using SASL,
specify the minimum security level necessary to
establish the connection. The values of this
option are defined by OpenLDAP.
</para>
<para>
Default: Use the system default (usually specified
by ldap.conf)
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_deref_threshold (integer)</term>
<listitem>
<para>
Specify the number of group members that must be
missing from the internal cache in order to trigger
a dereference lookup. If less members are missing,
they are looked up individually.
</para>
<para>
You can turn off dereference lookups completely by
setting the value to 0.
</para>
<para>
A dereference lookup is a means of fetching all
group members in a single LDAP call.
Different LDAP servers may implement different
dereference methods. The currently supported
servers are 389/RHDS, OpenLDAP and Active
Directory.
</para>
<para>
<emphasis>Note:</emphasis>
If any of the search bases specifies a search
filter, then the dereference lookup performance
enhancement will be disabled regardless of this
setting.
</para>
<para>
Default: 10
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_tls_reqcert (string)</term>
<listitem>
<para>
Specifies what checks to perform on server
certificates in a TLS session, if any. It
can be specified as one of the following
values:
</para>
<para>
<emphasis>never</emphasis> = The client will
not request or check any server certificate.
</para>
<para>
<emphasis>allow</emphasis> = The server
certificate is requested. If no certificate is
provided, the session proceeds normally. If a
bad certificate is provided, it will be ignored
and the session proceeds normally.
</para>
<para>
<emphasis>try</emphasis> = The server certificate
is requested. If no certificate is provided, the
session proceeds normally. If a bad certificate
is provided, the session is immediately terminated.
</para>
<para>
<emphasis>demand</emphasis> = The server
certificate is requested. If no certificate
is provided, or a bad certificate is provided,
the session is immediately terminated.
</para>
<para>
<emphasis>hard</emphasis> = Same as
<quote>demand</quote>
</para>
<para>
Default: hard
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_tls_cacert (string)</term>
<listitem>
<para>
Specifies the file that contains certificates for
all of the Certificate Authorities that
<command>sssd</command> will recognize.
</para>
<para>
Default: use OpenLDAP defaults, typically in
<filename>/etc/openldap/ldap.conf</filename>
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_tls_cacertdir (string)</term>
<listitem>
<para>
Specifies the path of a directory that contains
Certificate Authority certificates in separate
individual files. Typically the file names need to
be the hash of the certificate followed by '.0'.
If available, <command>cacertdir_rehash</command>
can be used to create the correct names.
</para>
<para>
Default: use OpenLDAP defaults, typically in
<filename>/etc/openldap/ldap.conf</filename>
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_tls_cert (string)</term>
<listitem>
<para>
Specifies the file that contains the certificate
for the client's key.
</para>
<para>
Default: not set
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_tls_key (string)</term>
<listitem>
<para>
Specifies the file that contains the client's key.
</para>
<para>
Default: not set
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_tls_cipher_suite (string)</term>
<listitem>
<para>
Specifies acceptable cipher suites. Typically this
is a colon sperated list. See
<citerefentry><refentrytitle>ldap.conf</refentrytitle>
<manvolnum>5</manvolnum></citerefentry> for format.
</para>
<para>
Default: use OpenLDAP defaults, typically in
<filename>/etc/openldap/ldap.conf</filename>
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_id_use_start_tls (boolean)</term>
<listitem>
<para>
Specifies that the id_provider connection must also
use <systemitem class="protocol">tls</systemitem> to protect the channel.
</para>
<para>
Default: false
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_id_mapping (boolean)</term>
<listitem>
<para>
Specifies that SSSD should attempt to map user and
group IDs from the ldap_user_objectsid and
ldap_group_objectsid attributes instead of relying
on ldap_user_uid_number and ldap_group_gid_number.
</para>
<para>
Currently this feature supports only
ActiveDirectory objectSID mapping.
</para>
<para>
Default: false
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sasl_mech (string)</term>
<listitem>
<para>
Specify the SASL mechanism to use.
Currently only GSSAPI is tested and supported.
</para>
<para>
Default: not set
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sasl_authid (string)</term>
<listitem>
<para>
Specify the SASL authorization id to use.
When GSSAPI is used, this represents the Kerberos
principal used for authentication to the directory.
This option can either contain the full principal (for
example host/myhost@EXAMPLE.COM) or just the principal name
(for example host/myhost).
</para>
<para>
Default: host/hostname@REALM
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sasl_realm (string)</term>
<listitem>
<para>
Specify the SASL realm to use. When not specified,
this option defaults to the value of krb5_realm.
If the ldap_sasl_authid contains the realm as well,
this option is ignored.
</para>
<para>
Default: the value of krb5_realm.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sasl_canonicalize (boolean)</term>
<listitem>
<para>
If set to true, the LDAP library would perform
a reverse lookup to canonicalize the host name
during a SASL bind.
</para>
<para>
Default: false;
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_krb5_keytab (string)</term>
<listitem>
<para>
Specify the keytab to use when using SASL/GSSAPI.
</para>
<para>
Default: System keytab, normally <filename>/etc/krb5.keytab</filename>
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_krb5_init_creds (boolean)</term>
<listitem>
<para>
Specifies that the id_provider should init
Kerberos credentials (TGT).
This action is performed only if SASL is used and
the mechanism selected is GSSAPI.
</para>
<para>
Default: true
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_krb5_ticket_lifetime (integer)</term>
<listitem>
<para>
Specifies the lifetime in seconds of the TGT if
GSSAPI is used.
</para>
<para>
Default: 86400 (24 hours)
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>krb5_server, krb5_backup_server (string)</term>
<listitem>
<para>
Specifies the comma-separated list of IP addresses or hostnames
of the Kerberos servers to which SSSD should
connect in the order of preference. For more
information on failover and server redundancy,
see the <quote>FAILOVER</quote> section. An optional
port number (preceded by a colon) may be appended to
the addresses or hostnames.
If empty, service discovery is enabled -
for more information, refer to the
<quote>SERVICE DISCOVERY</quote> section.
</para>
<para>
When using service discovery for KDC or kpasswd servers,
SSSD first searches for DNS entries that specify _udp as
the protocol and falls back to _tcp if none are found.
</para>
<para>
This option was named <quote>krb5_kdcip</quote> in
earlier releases of SSSD. While the legacy name is recognized
for the time being, users are advised to migrate their config
files to use <quote>krb5_server</quote> instead.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>krb5_realm (string)</term>
<listitem>
<para>
Specify the Kerberos REALM (for SASL/GSSAPI auth).
</para>
<para>
Default: System defaults, see <filename>/etc/krb5.conf</filename>
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>krb5_canonicalize (boolean)</term>
<listitem>
<para>
Specifies if the host principal should be canonicalized
when connecting to LDAP server. This feature is
available with MIT Kerberos >= 1.7
</para>
<para>
Default: false
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_pwd_policy (string)</term>
<listitem>
<para>
Select the policy to evaluate the password
expiration on the client side. The following values
are allowed:
</para>
<para>
<emphasis>none</emphasis> - No evaluation on the
client side. This option cannot disable server-side
password policies.
</para>
<para>
<emphasis>shadow</emphasis> - Use
<citerefentry><refentrytitle>shadow</refentrytitle>
<manvolnum>5</manvolnum></citerefentry> style
attributes to evaluate if the password has expired.
</para>
<para>
<emphasis>mit_kerberos</emphasis> - Use the attributes
used by MIT Kerberos to determine if the password has
expired. Use chpass_provider=krb5 to update these
attributes when the password is changed.
</para>
<para>
Default: none
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_referrals (boolean)</term>
<listitem>
<para>
Specifies whether automatic referral chasing should
be enabled.
</para>
<para>
Please note that sssd only supports referral chasing
when it is compiled with OpenLDAP version 2.4.13 or
higher.
</para>
<para>
Chasing referrals may incur a performance penalty
in environments that use them heavily, a notable
example is Microsoft Active Directory. If
your setup does not in fact require the use
of referrals, setting this option to false
might bring a noticeable performance improvement.
</para>
<para>
Default: true
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_dns_service_name (string)</term>
<listitem>
<para>
Specifies the service name to use when service
discovery is enabled.
</para>
<para>
Default: ldap
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_chpass_dns_service_name (string)</term>
<listitem>
<para>
Specifies the service name to use to find an LDAP
server which allows password changes when service
discovery is enabled.
</para>
<para>
Default: not set, i.e. service discovery is disabled
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_chpass_update_last_change (bool)</term>
<listitem>
<para>
Specifies whether to update the
ldap_user_shadow_last_change attribute with
days since the Epoch after a password change
operation.
</para>
<para>
Default: False
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_access_filter (string)</term>
<listitem>
<para>
If using access_provider = ldap and
ldap_access_order = filter (default), this option is
mandatory. It specifies an LDAP search filter
criteria that must be met for the user to be
granted access on this host. If
access_provider = ldap, ldap_access_order = filter
and this option is not set, it will result in all
users being denied access.
Use access_provider = permit to change this default
behavior.
</para>
<para>
Example:
</para>
<programlisting>
access_provider = ldap
ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
</programlisting>
<para>
This example means that access to this host is
restricted to members of the "allowedusers" group
in ldap.
</para>
<para>
Offline caching for this feature is limited to
determining whether the user's last online login
was granted access permission. If they were
granted access during their last login, they will
continue to be granted access while offline and
vice-versa.
</para>
<para>
Default: Empty
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_account_expire_policy (string)</term>
<listitem>
<para>
With this option a client side evaluation of
access control attributes can be enabled.
</para>
<para>
Please note that it is always recommended to
use server side access control, i.e. the LDAP
server should deny the bind request with a
suitable error code even if the password is
correct.
</para>
<para>
The following values are allowed:
</para>
<para>
<emphasis>shadow</emphasis>: use the value of
ldap_user_shadow_expire to determine if the account
is expired.
</para>
<para>
<emphasis>ad</emphasis>: use the value of the 32bit
field ldap_user_ad_user_account_control and allow
access if the second bit is not set. If the
attribute is missing access is granted. Also the
expiration time of the account is checked.
</para>
<para>
<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>,
<emphasis>389ds</emphasis>:
use the value of ldap_ns_account_lock to check if
access is allowed or not.
</para>
<para>
<emphasis>nds</emphasis>: the values of
ldap_user_nds_login_allowed_time_map,
ldap_user_nds_login_disabled and
ldap_user_nds_login_expiration_time are used to
check if access is allowed. If both attributes are
missing access is granted.
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/experimental.xml" />
</para>
<para>
Default: Empty
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_access_order (string)</term>
<listitem>
<para>
Comma separated list of access control options.
Allowed values are:
</para>
<para>
<emphasis>filter</emphasis>: use ldap_access_filter
</para>
<para>
<emphasis>expire</emphasis>: use
ldap_account_expire_policy
</para>
<para>
<emphasis>authorized_service</emphasis>: use
the authorizedService attribute to determine
access
</para>
<para>
<emphasis>host</emphasis>: use the host attribute
to determine access
</para>
<para>
Default: filter
</para>
<para>
Please note that it is a configuration error if a
value is used more than once.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_deref (string)</term>
<listitem>
<para>
Specifies how alias dereferencing is done when
performing a search. The following options are
allowed:
</para>
<para>
<emphasis>never</emphasis>: Aliases are never
dereferenced.
</para>
<para>
<emphasis>searching</emphasis>: Aliases are
dereferenced in subordinates of the base object,
but not in locating the base object of the search.
</para>
<para>
<emphasis>finding</emphasis>: Aliases are only
dereferenced when locating the base object of the
search.
</para>
<para>
<emphasis>always</emphasis>: Aliases are
dereferenced both in searching and in locating the
base object of the search.
</para>
<para>
Default: Empty (this is handled as
<emphasis>never</emphasis> by the LDAP client
libraries)
</para>
</listitem>
</varlistentry>
</variablelist>
</para>
</refsect1>
<refsect1 id='sudo-options' condition="with_sudo">
<title>SUDO OPTIONS</title>
<para>
<variablelist>
<varlistentry>
<term>ldap_sudorule_object_class (string)</term>
<listitem>
<para>
The object class of a sudo rule entry in LDAP.
</para>
<para>
Default: sudoRole
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudorule_name (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to
the sudo rule name.
</para>
<para>
Default: cn
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudorule_command (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to the
command name.
</para>
<para>
Default: sudoCommand
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudorule_host (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to the
host name (or host IP address, host IP network,
or host netgroup)
</para>
<para>
Default: sudoHost
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudorule_user (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to the
user name (or UID, group name or user's netgroup)
</para>
<para>
Default: sudoUser
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudorule_option (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to the
sudo options.
</para>
<para>
Default: sudoOption
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudorule_runasuser (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to the
user name that commands may be run as.
</para>
<para>
Default: sudoRunAsUser
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudorule_runasgroup (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to the group
name or group GID that commands may be run as.
</para>
<para>
Default: sudoRunAsGroup
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudorule_notbefore (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to the
start date/time for when the sudo rule is valid.
</para>
<para>
Default: sudoNotBefore
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudorule_notafter (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to the
expiration date/time, after which the sudo rule
will no longer be valid.
</para>
<para>
Default: sudoNotAfter
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudorule_order (string)</term>
<listitem>
<para>
The LDAP attribute that corresponds to the
ordering index of the rule.
</para>
<para>
Default: sudoOrder
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudo_full_refresh_interval (integer)</term>
<listitem>
<para>
How many seconds SSSD will wait between executing
a full refresh of sudo rules (which downloads all
rules that are stored on the server).
</para>
<para>
The value must be greater than
<emphasis>ldap_sudo_smart_refresh_interval
</emphasis>
</para>
<para>
Default: 21600 (6 hours)
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudo_smart_refresh_interval (integer)</term>
<listitem>
<para>
How many seconds SSSD has to wait before executing
a smart refresh of sudo rules (which downloads all
rules that have USN higher than the highest USN of
cached rules).
</para>
<para>
If USN attributes are not supported by the server,
the modifyTimestamp attribute is used instead.
</para>
<para>
Default: 900 (15 minutes)
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudo_use_host_filter (boolean)</term>
<listitem>
<para>
If true, SSSD will download only rules that are
applicable to this machine (using the IPv4 or IPv6
host/network addresses and hostnames).
</para>
<para>
Default: true
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudo_hostnames (string)</term>
<listitem>
<para>
Space separated list of hostnames or fully qualified
domain names that should be used to filter
the rules.
</para>
<para>
If this option is empty, SSSD will try to discover
the hostname and the fully qualified domain name
automatically.
</para>
<para>
If <emphasis>ldap_sudo_use_host_filter</emphasis>
is <emphasis>false</emphasis> then this option
has no effect.
</para>
<para>
Default: not specified
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudo_ip (string)</term>
<listitem>
<para>
Space separated list of IPv4 or IPv6
host/network addresses that should be used to filter
the rules.
</para>
<para>
If this option is empty, SSSD will try to
discover the addresses automatically.
</para>
<para>
If <emphasis>ldap_sudo_use_host_filter</emphasis>
is <emphasis>false</emphasis> then this option
has no effect.
</para>
<para>
Default: not specified
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudo_include_netgroups (boolean)</term>
<listitem>
<para>
If true then SSSD will download every rule that
contains a netgroup in sudoHost attribute.
</para>
<para>
If <emphasis>ldap_sudo_use_host_filter</emphasis>
is <emphasis>false</emphasis> then this option
has no effect.
</para>
<para>
Default: true
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_sudo_include_regexp (boolean)</term>
<listitem>
<para>
If true then SSSD will download every rule that
contains a regular expression in sudoHost attribute.
</para>
<para>
If <emphasis>ldap_sudo_use_host_filter</emphasis>
is <emphasis>false</emphasis> then this option
has no effect.
</para>
<para>
Default: true
</para>
</listitem>
</varlistentry>
</variablelist>
</para>
<para>
This manual page only describes attribute name mapping.
For detailed explanation of sudo related attribute semantics,
see
<citerefentry>
<refentrytitle>sudoers.ldap</refentrytitle><manvolnum>5</manvolnum>
</citerefentry>
</para>
</refsect1>
<refsect1 id='autofs-options' condition="with_autofs">
<title>AUTOFS OPTIONS</title>
<para>
Please note that the default values correspond to the default
schema which is RFC2307.
</para>
<para>
<variablelist>
<varlistentry>
<term>ldap_autofs_map_object_class (string)</term>
<listitem>
<para>
The object class of an automount map entry in LDAP.
</para>
<para>
Default: automountMap
</para>
</listitem>
</varlistentry>
</variablelist>
<variablelist>
<varlistentry>
<term>ldap_autofs_map_name (string)</term>
<listitem>
<para>
The name of an automount map entry in LDAP.
</para>
<para>
Default: ou
</para>
</listitem>
</varlistentry>
</variablelist>
<variablelist>
<varlistentry>
<term>ldap_autofs_entry_object_class (string)</term>
<listitem>
<para>
The object class of an automount map entry
in LDAP.
</para>
<para>
Default: automountMap
</para>
</listitem>
</varlistentry>
</variablelist>
<variablelist>
<varlistentry>
<term>ldap_autofs_entry_key (string)</term>
<listitem>
<para>
The key of an automount entry in LDAP. The
entry usually corresponds to a mount point.
</para>
<para>
Default: cn
</para>
</listitem>
</varlistentry>
</variablelist>
<variablelist>
<varlistentry>
<term>ldap_autofs_entry_value (string)</term>
<listitem>
<para>
The key of an automount entry in LDAP. The
entry usually corresponds to a mount point.
</para>
<para>
Default: automountInformation
</para>
</listitem>
</varlistentry>
</variablelist>
</para>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/autofs_restart.xml" />
</refsect1>
<refsect1 id='advanced-options'>
<title>ADVANCED OPTIONS</title>
<para>
These options are supported by LDAP domains, but they should be used
with caution. Please include them in your configuration only if you
know what you are doing.
<variablelist>
<varlistentry>
<term>ldap_netgroup_search_base (string)</term>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
</varlistentry>
<varlistentry>
<term>ldap_user_search_base (string)</term>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
</varlistentry>
<varlistentry>
<term>ldap_group_search_base (string)</term>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
</varlistentry>
<varlistentry>
<term>ldap_user_search_filter (string)</term>
<listitem>
<para>
This option specifies an additional LDAP search
filter criteria that restrict user searches.
</para>
<para>
This option is <emphasis>deprecated</emphasis> in
favor of the syntax used by ldap_user_search_base.
</para>
<para>
Default: not set
</para>
<para>
Example:
</para>
<programlisting>
ldap_user_search_filter = (loginShell=/bin/tcsh)
</programlisting>
<para>
This filter would restrict user searches to users
that have their shell set to /bin/tcsh.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>ldap_group_search_filter (string)</term>
<listitem>
<para>
This option specifies an additional LDAP search
filter criteria that restrict group searches.
</para>
<para>
This option is <emphasis>deprecated</emphasis> in
favor of the syntax used by ldap_group_search_base.
</para>
<para>
Default: not set
</para>
</listitem>
</varlistentry>
<varlistentry condition="with_sudo">
<term>ldap_sudo_search_base (string)</term>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
</varlistentry>
<varlistentry condition="with_autofs">
<term>ldap_autofs_search_base (string)</term>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
</varlistentry>
</variablelist>
</para>
</refsect1>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/failover.xml" />
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/service_discovery.xml" />
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_id_mapping.xml" />
<refsect1 id='example'>
<title>EXAMPLE</title>
<para>
The following example assumes that SSSD is correctly
configured and LDAP is set to one of the domains in the
<replaceable>[domains]</replaceable> section.
</para>
<para>
<programlisting>
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
ldap_uri = ldap://ldap.mydomain.org
ldap_search_base = dc=mydomain,dc=org
ldap_tls_reqcert = demand
cache_credentials = true
enumerate = true
</programlisting>
</para>
</refsect1>
<refsect1 id='notes'>
<title>NOTES</title>
<para>
The descriptions of some of the configuration options in this manual
page are based on the <citerefentry>
<refentrytitle>ldap.conf</refentrytitle>
<manvolnum>5</manvolnum>
</citerefentry> manual page from the OpenLDAP 2.4 distribution.
</para>
</refsect1>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/seealso.xml" />
</refentry>
</reference>