02c335c23bf5fa225a467c19f2c063fb0dc7b8c3Timo Sirainen<?xml version="1.0" encoding="UTF-8"?>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen<!DOCTYPE reference PUBLIC "-//OASIS//DTD DocBook V4.4//EN"

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen<reference>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen<title>SSSD Manual pages</title>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen<refentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/upstream.xml" />

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <refmeta>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <refentrytitle>sssd-ldap</refentrytitle>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <manvolnum>5</manvolnum>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <refmiscinfo class="manual">File Formats and Conventions</refmiscinfo>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </refmeta>

e34d170f8f0e084bd94bfbc1a7085ece67e508dfTimo Sirainen

e34d170f8f0e084bd94bfbc1a7085ece67e508dfTimo Sirainen <refnamediv id='name'>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <refname>sssd-ldap</refname>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <refpurpose>the configuration file for SSSD</refpurpose>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </refnamediv>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <refsect1 id='description'>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <title>DESCRIPTION</title>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen This manual page describes the configuration of LDAP

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen domains for

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <citerefentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <refentrytitle>sssd</refentrytitle>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <manvolnum>8</manvolnum>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </citerefentry>.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Refer to the <quote>FILE FORMAT</quote> section of the

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <citerefentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <refentrytitle>sssd.conf</refentrytitle>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <manvolnum>5</manvolnum>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </citerefentry> manual page for detailed syntax information.</para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen You can configure SSSD to use more than one LDAP domain.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen LDAP back end supports id, auth, access and chpass providers. If you want

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen to authenticate against an LDAP server either TLS/SSL or LDAPS

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen is required. <command>sssd</command> <emphasis>does

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen not</emphasis> support authentication over an unencrypted channel.

45dda77a1e51970a06c82dd1b4c1ee5b0368cfe1Timo Sirainen If the LDAP server is used only as an identity provider, an encrypted

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen channel is not needed. Please refer to <quote>ldap_access_filter</quote>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen config option for more information about using LDAP as an access provider.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </refsect1>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen <refsect1 id='file-format'>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <title>CONFIGURATION OPTIONS</title>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen All of the common configuration options that apply to SSSD domains also apply

66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen to LDAP domains. Refer to the <quote>DOMAIN SECTIONS</quote> section of the

66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen <citerefentry>

66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen <refentrytitle>sssd.conf</refentrytitle>

66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen <manvolnum>5</manvolnum>

66fbbac231b0385273b11f9b4c43ad252330dea5Timo Sirainen </citerefentry> manual page for full details.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <variablelist>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_uri (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Specifies the comma-separated list of URIs of the LDAP servers to which

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen SSSD should connect in the order of preference. Refer to the

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <quote>FAILOVER</quote> section for more information on failover and server redundancy.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen If not specified, service discovery is enabled. For more information, refer

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen to the <quote>SERVICE DISCOVERY</quote> section.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The format of the URI must match the format defined in RFC 2732:

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi ldap[s]://&lt;host&gt;[:port]

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi For explicit IPv6 addresses, &lt;host&gt; must be enclosed in brackets []

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi example: ldap://[fc00::126:25]:389

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </listitem>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </varlistentry>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <varlistentry>

551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi <term>ldap_chpass_uri (string)</term>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <listitem>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi Specifies the comma-separated list of URIs of the LDAP servers to

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi which SSSD should connect in the order of preference

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi to change the password of a user. Refer to the

551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi <quote>FAILOVER</quote> section for more information

551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi on failover and server redundancy.

551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi To enable service discovery

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi ldap_chpass_dns_service_name must be set.

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi Default: empty, i.e. ldap_uri is used.

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </listitem>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </varlistentry>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <varlistentry>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <term>ldap_search_base (string)</term>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <listitem>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi The default base DN to use for

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi performing LDAP user operations.

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi Starting with SSSD 1.7.0, SSSD supports multiple

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi search bases using the syntax:

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi search_base[?scope?[filter][?search_base?scope?[filter]]*]

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi The scope can be one of "base", "onelevel" or "subtree".

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi The filter must be a valid LDAP search filter as

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi specified by http://www.ietf.org/rfc/rfc2254.txt

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi Examples:

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi ldap_search_base = dc=example,dc=com

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi (which is equivalent to)

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi ldap_search_base = dc=example,dc=com?subtree?

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi ldap_search_base = cn=host_specific,dc=example,dc=com?subtree?(host=thishost)?dc=example.com?subtree?

551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi </para>

551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi <para>

551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi Note: It is unsupported to have multiple search

551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi bases which reference identically-named objects

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi (for example, groups with the same name in two

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi different search bases). This will lead to

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi unpredictable behavior on client machines.

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi <para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi Default: If not set, the value of the

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi defaultNamingContext or namingContexts attribute

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi from the RootDSE of the LDAP server is

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi used. If defaultNamingContext does not exists or

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen has an empty value namingContexts is used.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The namingContexts attribute must have a

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen single value with the DN of the search base of the

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen LDAP server to make this work. Multiple values are

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen are not supported.

2ac5f36aa7c2e7a07ba8815d43a6d7483f62e74cTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

a545bcd54312b543ddc46a872ec79d0416032b0fTimo Sirainen </varlistentry>

a545bcd54312b543ddc46a872ec79d0416032b0fTimo Sirainen

a545bcd54312b543ddc46a872ec79d0416032b0fTimo Sirainen <varlistentry>

a545bcd54312b543ddc46a872ec79d0416032b0fTimo Sirainen <term>ldap_schema (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

a545bcd54312b543ddc46a872ec79d0416032b0fTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Specifies the Schema Type in use on the target LDAP

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen server.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Depending on the selected schema, the default

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen attribute names retrieved from the servers may vary.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The way that some attributes are handled may also differ.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Four schema types are currently supported:

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen rfc2307

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen rfc2307bis

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen IPA

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen AD

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The main difference between these schema types is

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen how group memberships are recorded in the server.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen With rfc2307, group members are listed by name in the

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <emphasis>memberUid</emphasis> attribute.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen With rfc2307bis and IPA, group members are listed by DN

bc85ab91357eaf47c789179362ee36f4f4f4abd7Timo Sirainen and stored in the <emphasis>member</emphasis> attribute.

bc85ab91357eaf47c789179362ee36f4f4f4abd7Timo Sirainen The AD schema type sets the attributes to correspond with

bc85ab91357eaf47c789179362ee36f4f4f4abd7Timo Sirainen Active Directory 2008r2 values.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: rfc2307

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

bc4cb06efd149ff759ad5462c6cd1a352f735034Timo Sirainen <term>ldap_default_bind_dn (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The default bind DN to use for

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen performing LDAP operations.

e4ff3c71af029c7e63852cffc59c2352610d73a9Timo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

bc4cb06efd149ff759ad5462c6cd1a352f735034Timo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_default_authtok_type (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

e4ff3c71af029c7e63852cffc59c2352610d73a9Timo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The type of the authentication token of the

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen default bind DN.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The two mechanisms currently supported are:

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen password

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen obfuscated_password

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: password

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen

e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen <varlistentry>

e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen <term>ldap_default_authtok (string)</term>

e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen <listitem>

e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen <para>

e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen The authentication token of the default bind DN.

e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen Only clear text passwords are currently supported.

e5c28185478ecab60d0dbd78f9daaab113d5c060Timo Sirainen </para>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </listitem>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi </varlistentry>

42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi

de84f428e20b57f98d2de9a3793e46e0e1560fb4Timo Sirainen <varlistentry>

de84f428e20b57f98d2de9a3793e46e0e1560fb4Timo Sirainen <term>ldap_user_object_class (string)</term>

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen <listitem>

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen <para>

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen The object class of a user entry in LDAP.

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen </para>

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen <para>

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen Default: posixAccount

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen </para>

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen </listitem>

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen </varlistentry>

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen <varlistentry>

ba8a3fbee3f8fca8e481ba929bce6b78296a7820Timo Sirainen <term>ldap_user_name (string)</term>

b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen <listitem>

b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen <para>

b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen The LDAP attribute that corresponds to the

b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen user's login name.

b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen </para>

b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen <para>

b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen Default: uid

b780aa272b742a43579cdb523cc79cc8d4521306Timo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen <term>ldap_user_uid_number (string)</term>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen <listitem>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen <para>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen The LDAP attribute that corresponds to the

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen user's id.

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen </para>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen <para>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen Default: uidNumber

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen </para>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen </listitem>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen </varlistentry>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen <varlistentry>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen <term>ldap_user_gid_number (string)</term>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen <listitem>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen <para>

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen The LDAP attribute that corresponds to the

d461a91e5eb2270e77f4276f0268ba1eede6a08dTimo Sirainen user's primary group id.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: gidNumber

5fb3f13537dffd15a31e997da133a721c0728af8Timo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_gecos (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The LDAP attribute that corresponds to the

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen user's gecos field.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: gecos

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_home_directory (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The LDAP attribute that contains the name of the user's

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen home directory.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: homeDirectory

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_shell (string)</term>

358f356749078ed2ae69fc48ced375761c877b61Timo Sirainen <listitem>

358f356749078ed2ae69fc48ced375761c877b61Timo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The LDAP attribute that contains the path to the

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen user's default shell.

358f356749078ed2ae69fc48ced375761c877b61Timo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: loginShell

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_uuid (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The LDAP attribute that contains the UUID/GUID of

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen an LDAP user object.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: nsUniqueId

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_objectsid (string)</term>

358f356749078ed2ae69fc48ced375761c877b61Timo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The LDAP attribute that contains the objectSID of

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen an LDAP user object. This is usually only

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen necessary for ActiveDirectory servers.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: objectSid for ActiveDirectory, not set

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen for other servers.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen <varlistentry>

417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen <term>ldap_user_modify_timestamp (string)</term>

8bb360f9e5de1c25e4f875205bb06e8bf15dae14Timo Sirainen <listitem>

417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen <para>

8bb360f9e5de1c25e4f875205bb06e8bf15dae14Timo Sirainen The LDAP attribute that contains timestamp of the

417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen last modification of the parent object.

417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen </para>

3402c71658e8c440941d50a66aba777849b3b89fTimo Sirainen <para>

3402c71658e8c440941d50a66aba777849b3b89fTimo Sirainen Default: modifyTimestamp

e7a81e78fb5d8078d32ec05257f75095b28eb9e8Timo Sirainen </para>

e7a81e78fb5d8078d32ec05257f75095b28eb9e8Timo Sirainen </listitem>

8eeced2d681741d4071e6b145fe26232186af34aTimo Sirainen </varlistentry>

e7a81e78fb5d8078d32ec05257f75095b28eb9e8Timo Sirainen

e7a81e78fb5d8078d32ec05257f75095b28eb9e8Timo Sirainen <varlistentry>

3402c71658e8c440941d50a66aba777849b3b89fTimo Sirainen <term>ldap_user_shadow_last_change (string)</term>

3402c71658e8c440941d50a66aba777849b3b89fTimo Sirainen <listitem>

3402c71658e8c440941d50a66aba777849b3b89fTimo Sirainen <para>

417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen When using ldap_pwd_policy=shadow, this parameter

417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen contains the name of an LDAP attribute corresponding

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen to its

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <citerefentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <refentrytitle>shadow</refentrytitle>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <manvolnum>5</manvolnum>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </citerefentry> counterpart (date of the last

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen password change).

5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: shadowLastChange

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_shadow_min (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

417d2a64eba7d8c395b6c8a18d845f7ff2471637Timo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_pwd_policy=shadow, this parameter

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen contains the name of an LDAP attribute corresponding

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen to its

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <citerefentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <refentrytitle>shadow</refentrytitle>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <manvolnum>5</manvolnum>

9accc087160a4a485df40276daf7f6d1aa23d9b6Timo Sirainen </citerefentry> counterpart (minimum password age).

3f780bf67ec3047194ab89e2ec1ffc8da8698775Timo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: shadowMin

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_shadow_max (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_pwd_policy=shadow, this parameter

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen contains the name of an LDAP attribute corresponding

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen to its

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <citerefentry>

358f356749078ed2ae69fc48ced375761c877b61Timo Sirainen <refentrytitle>shadow</refentrytitle>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <manvolnum>5</manvolnum>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </citerefentry> counterpart (maximum password age).

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: shadowMax

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_shadow_warning (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_pwd_policy=shadow, this parameter

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen contains the name of an LDAP attribute corresponding

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen to its

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <citerefentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <refentrytitle>shadow</refentrytitle>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <manvolnum>5</manvolnum>

358f356749078ed2ae69fc48ced375761c877b61Timo Sirainen </citerefentry> counterpart (password warning

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen period).

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: shadowWarning

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_shadow_inactive (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_pwd_policy=shadow, this parameter

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen contains the name of an LDAP attribute corresponding

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen to its

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <citerefentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <refentrytitle>shadow</refentrytitle>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <manvolnum>5</manvolnum>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </citerefentry> counterpart (password inactivity

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen period).

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen Default: shadowInactive

a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_shadow_expire (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_pwd_policy=shadow or

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ldap_account_expire_policy=shadow, this parameter

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen contains the name of an LDAP attribute corresponding

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen to its

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <citerefentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <refentrytitle>shadow</refentrytitle>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <manvolnum>5</manvolnum>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </citerefentry> counterpart (account expiration date).

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: shadowExpire

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen </varlistentry>

a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_krb_last_pwd_change (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_pwd_policy=mit_kerberos, this

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen parameter contains the name of an LDAP attribute

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen storing the date and time of last password change

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen in kerberos.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: krbLastPwdChange

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen </listitem>

a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_krb_password_expiration (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_pwd_policy=mit_kerberos, this

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen parameter contains the name of an LDAP attribute

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen storing the date and time when current password

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen expires.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: krbPasswordExpiration

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen <term>ldap_user_ad_account_expires (string)</term>

a37c2c1ad645b6d8ea73e6d38695efdde4f3f928Timo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_account_expire_policy=ad, this

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen parameter contains the name of an LDAP attribute

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen storing the expiration time of the account.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: accountExpires

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen

6bd263caf006edc75205f446fa0283c6f364941bTimo Sirainen <varlistentry>

5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen <term>ldap_user_ad_user_account_control (string)</term>

5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen <listitem>

5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen <para>

5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen When using ldap_account_expire_policy=ad, this

5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen parameter contains the name of an LDAP attribute

5ce40a7370a19a98caeca5d2e27b3d6c77c90ea9Timo Sirainen storing the user account control bit field.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: userAccountControl

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_ns_account_lock (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_account_expire_policy=rhds or

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen equivalent, this parameter determines if access is

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen allowed or not.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: nsAccountLock

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_nds_login_disabled (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_account_expire_policy=nds, this

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen attribute determines if access is allowed or not.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: loginDisabled

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_nds_login_expiration_time (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_account_expire_policy=nds, this

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen attribute determines until which date access is

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen granted.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: loginDisabled

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_nds_login_allowed_time_map (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen When using ldap_account_expire_policy=nds, this

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen attribute determines the hours of a day in a week

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen when access is granted.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: loginAllowedTimeMap

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_principal (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The LDAP attribute that contains the user's Kerberos

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen User Principal Name (UPN).

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: krbPrincipalName

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

2ac5f36aa7c2e7a07ba8815d43a6d7483f62e74cTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry condition="with_ssh">

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_ssh_public_key (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The LDAP attribute that contains the user's SSH

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen public keys.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_force_upper_case_realm (boolean)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Some directory servers, for example Active Directory,

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen might deliver the realm part of the UPN in lower case,

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen which might cause the authentication to fail. Set this

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen option to a non-zero value if you want to use an

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen upper-case realm.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: false

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_enumeration_refresh_timeout (integer)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Specifies how many seconds SSSD has to wait

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen before refreshing its cache of enumerated

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen records.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: 300

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_purge_cache_timeout (integer)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Determine how often to check the cache for

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen inactive entries (such as groups with no

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen members and users who have never logged in) and

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen remove them to save space.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

0fa40bfd73cedc311ff2e0ae90707836382bfc8cTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Setting this option to zero will disable the

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen cache cleanup operation.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: 10800 (12 hours)

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_fullname (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The LDAP attribute that corresponds to the

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen user's full name.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: cn

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_member_of (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen The LDAP attribute that lists the user's

cb06054f863550b766950fe2949b69b7047bcd81Timo Sirainen group memberships.

ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen </para>

ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen <para>

ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen Default: memberOf

ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen </para>

ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen </listitem>

ec1823d289727d53fc74073e6cdda61d64fc0761Timo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <term>ldap_user_authorized_service (string)</term>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen If access_provider=ldap and

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen ldap_access_order=authorized_service, SSSD will

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen use the presence of the authorizedService

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen attribute in the user's LDAP entry to determine

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen access privilege.

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen An explicit deny (!svc) is resolved first. Second,

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen SSSD searches for explicit allow (svc) and finally

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen for allow_all (*).

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen <para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen Default: authorizedService

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </para>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </listitem>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen </varlistentry>

b28a1c61a5d262fd16b46bebe47dbfb90ac9c5fcTimo Sirainen

<varlistentry>

<term>ldap_user_authorized_host (string)</term>

<listitem>

<para>

If access_provider=ldap and

ldap_access_order=host, SSSD will use the presence

of the host attribute in the user's LDAP entry to

determine access privilege.

</para>

<para>

An explicit deny (!host) is resolved first. Second,

SSSD searches for explicit allow (host) and finally

for allow_all (*).

</para>

<para>

Default: host

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_group_object_class (string)</term>

<listitem>

<para>

The object class of a group entry in LDAP.

</para>

<para>

Default: posixGroup

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_group_name (string)</term>

<listitem>

<para>

The LDAP attribute that corresponds to

the group name.

</para>

<para>

Default: cn

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_group_gid_number (string)</term>

<listitem>

<para>

The LDAP attribute that corresponds to the

group's id.

</para>

<para>

Default: gidNumber

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_group_member (string)</term>

<listitem>

<para>

The LDAP attribute that contains the names of

the group's members.

</para>

<para>

Default: memberuid (rfc2307) / member (rfc2307bis)

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_group_uuid (string)</term>

<listitem>

<para>

The LDAP attribute that contains the UUID/GUID of

an LDAP group object.

</para>

<para>

Default: nsUniqueId

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_group_objectsid (string)</term>

<listitem>

<para>

The LDAP attribute that contains the objectSID of

an LDAP group object. This is usually only

necessary for ActiveDirectory servers.

</para>

<para>

Default: objectSid for ActiveDirectory, not set

for other servers.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_group_modify_timestamp (string)</term>

<listitem>

<para>

The LDAP attribute that contains timestamp of the

last modification of the parent object.

</para>

<para>

Default: modifyTimestamp

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_group_nesting_level (integer)</term>

<listitem>

<para>

If ldap_schema is set to a schema format that

supports nested groups (e.g. RFC2307bis), then

this option controls how many levels of nesting

SSSD will follow. This option has no effect on the

RFC2307 schema.

</para>

<para>

Default: 2

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_groups_use_matching_rule_in_chain</term>

<listitem>

<para>

This option tells SSSD to take advantage of an

Active Directory-specific feature which may speed

up group lookup operations on deployments with

complex or deep nested groups.

</para>

<para>

In most common cases, it is best to leave this

option disabled. It generally only provides a

performance increase on very complex nestings.

</para>

<para>

If this option is enabled, SSSD will use it if it

detects that the server supports it during initial

connection. So "True" here essentially means

"auto-detect".

</para>

<para>

Note: This feature is currently known to work only

with Active Directory 2008 R1 and later. See

<ulink url="http://msdn.microsoft.com/en-us/library/windows/desktop/aa746475%28v=vs.85%29.aspx">

MSDN(TM) documentation</ulink> for more details.

</para>

<para>

Default: False

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_initgroups_use_matching_rule_in_chain</term>

<listitem>

<para>

This option tells SSSD to take advantage of an

Active Directory-specific feature which will speed

up initgroups operations (most notably when

dealing with complex or deep nested groups).

</para>

<para>

If this option is enabled, SSSD will use it if it

detects that the server supports it during initial

connection. So "True" here essentially means

"auto-detect".

</para>

<para>

Note: This feature is currently known to work only

with Active Directory 2008 R1 and later. See

<ulink url="http://msdn.microsoft.com/en-us/library/windows/desktop/aa746475%28v=vs.85%29.aspx">

MSDN(TM) documentation</ulink> for more details.

</para>

<para>

Default: True

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_netgroup_object_class (string)</term>

<listitem>

<para>

The object class of a netgroup entry in LDAP.

</para>

<para>

In IPA provider, ipa_netgroup_object_class should

be used instead.

</para>

<para>

Default: nisNetgroup

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_netgroup_name (string)</term>

<listitem>

<para>

The LDAP attribute that corresponds to

the netgroup name.

</para>

<para>

In IPA provider, ipa_netgroup_name should

be used instead.

</para>

<para>

Default: cn

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_netgroup_member (string)</term>

<listitem>

<para>

The LDAP attribute that contains the names of

the netgroup's members.

</para>

<para>

In IPA provider, ipa_netgroup_member should

be used instead.

</para>

<para>

Default: memberNisNetgroup

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_netgroup_triple (string)</term>

<listitem>

<para>

The LDAP attribute that contains the (host, user,

domain) netgroup triples.

</para>

<para>

This option is not available in IPA provider.

</para>

<para>

Default: nisNetgroupTriple

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_netgroup_uuid (string)</term>

<listitem>

<para>

The LDAP attribute that contains the UUID/GUID of

an LDAP netgroup object.

</para>

<para>

In IPA provider, ipa_netgroup_uuid should

be used instead.

</para>

<para>

Default: nsUniqueId

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_netgroup_modify_timestamp (string)</term>

<listitem>

<para>

The LDAP attribute that contains timestamp of the

last modification of the parent object.

</para>

<para>

This option is not available in IPA provider.

</para>

<para>

Default: modifyTimestamp

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_service_object_class (string)</term>

<listitem>

<para>

The object class of a service entry in LDAP.

</para>

<para>

Default: ipService

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_service_name (string)</term>

<listitem>

<para>

The LDAP attribute that contains the name of

service attributes and their aliases.

</para>

<para>

Default: cn

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_service_port (string)</term>

<listitem>

<para>

The LDAP attribute that contains the port managed

by this service.

</para>

<para>

Default: ipServicePort

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_service_proto (string)</term>

<listitem>

<para>

The LDAP attribute that contains the protocols

understood by this service.

</para>

<para>

Default: ipServiceProtocol

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_service_search_base (string)</term>

<listitem>

<para>

An optional base DN to restrict service searches

to a specific subtree.

</para>

<para>

See <quote>ldap_search_base</quote> for

information about configuring multiple search

bases.

</para>

<para>

Default: the value of

<emphasis>ldap_search_base</emphasis>

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_search_timeout (integer)</term>

<listitem>

<para>

Specifies the timeout (in seconds) that ldap

searches are allowed to run before they are

cancelled and cached results are returned (and

offline mode is entered)

</para>

<para>

Note: this option is subject to change in future

versions of the SSSD. It will likely be replaced at

some point by a series of timeouts for specific

lookup types.

</para>

<para>

Default: 6

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_enumeration_search_timeout (integer)</term>

<listitem>

<para>

Specifies the timeout (in seconds) that ldap

searches for user and group enumerations

are allowed to run before they are cancelled and

cached results are returned (and offline mode is

entered)

</para>

<para>

Default: 60

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_network_timeout (integer)</term>

<listitem>

<para>

Specifies the timeout (in seconds) after which

the

<citerefentry>

<refentrytitle>poll</refentrytitle>

<manvolnum>2</manvolnum>

</citerefentry>/<citerefentry>

<refentrytitle>select</refentrytitle>

<manvolnum>2</manvolnum>

</citerefentry>

following a

<citerefentry>

<refentrytitle>connect</refentrytitle>

<manvolnum>2</manvolnum>

</citerefentry>

returns in case of no activity.

</para>

<para>

Default: 6

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_opt_timeout (integer)</term>

<listitem>

<para>

Specifies a timeout (in seconds) after which

calls to synchronous LDAP APIs will abort if no

response is received. Also controls the timeout

when communicating with the KDC in case of SASL bind.

</para>

<para>

Default: 6

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_connection_expire_timeout (integer)</term>

<listitem>

<para>

Specifies a timeout (in seconds) that a connection

to an LDAP server will be maintained. After this

time, the connection will be re-established. If

used in parallel with SASL/GSSAPI, the sooner of

the two values (this value vs. the TGT lifetime)

will be used.

</para>

<para>

Default: 900 (15 minutes)

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_page_size (integer)</term>

<listitem>

<para>

Specify the number of records to retrieve from

LDAP in a single request. Some LDAP servers

enforce a maximum limit per-request.

</para>

<para>

Default: 1000

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_disable_paging (boolean)</term>

<listitem>

<para>

Disable the LDAP paging control. This option

should be used if the LDAP server reports that it

supports the LDAP paging control in its RootDSE

but it is not enabled or does not behave properly.

</para>

<para>

Example: OpenLDAP servers with the paging control

module installed on the server but not enabled

will report it in the RootDSE but be unable to use

it.

</para>

<para>

Example: 389 DS has a bug where it can only

support a one paging control at a time on a single

connection. On busy clients, this can result in

some requests being denied.

</para>

<para>

Default: False

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_sasl_minssf (integer)</term>

<listitem>

<para>

When communicating with an LDAP server using SASL,

specify the minimum security level necessary to

establish the connection. The values of this

option are defined by OpenLDAP.

</para>

<para>

Default: Use the system default (usually specified

by ldap.conf)

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_deref_threshold (integer)</term>

<listitem>

<para>

Specify the number of group members that must be

missing from the internal cache in order to trigger

a dereference lookup. If less members are missing,

they are looked up individually.

</para>

<para>

You can turn off dereference lookups completely by

setting the value to 0.

</para>

<para>

A dereference lookup is a means of fetching all

group members in a single LDAP call.

Different LDAP servers may implement different

dereference methods. The currently supported

servers are 389/RHDS, OpenLDAP and Active

Directory.

</para>

<para>

<emphasis>Note:</emphasis>

If any of the search bases specifies a search

filter, then the dereference lookup performance

enhancement will be disabled regardless of this

setting.

</para>

<para>

Default: 10

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_tls_reqcert (string)</term>

<listitem>

<para>

Specifies what checks to perform on server

certificates in a TLS session, if any. It

can be specified as one of the following

values:

</para>

<para>

<emphasis>never</emphasis> = The client will

not request or check any server certificate.

</para>

<para>

<emphasis>allow</emphasis> = The server

certificate is requested. If no certificate is

provided, the session proceeds normally. If a

bad certificate is provided, it will be ignored

and the session proceeds normally.

</para>

<para>

<emphasis>try</emphasis> = The server certificate

is requested. If no certificate is provided, the

session proceeds normally. If a bad certificate

is provided, the session is immediately terminated.

</para>

<para>

<emphasis>demand</emphasis> = The server

certificate is requested. If no certificate

is provided, or a bad certificate is provided,

the session is immediately terminated.

</para>

<para>

<emphasis>hard</emphasis> = Same as

<quote>demand</quote>

</para>

<para>

Default: hard

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_tls_cacert (string)</term>

<listitem>

<para>

Specifies the file that contains certificates for

all of the Certificate Authorities that

<command>sssd</command> will recognize.

</para>

<para>

Default: use OpenLDAP defaults, typically in

<filename>/etc/openldap/ldap.conf</filename>

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_tls_cacertdir (string)</term>

<listitem>

<para>

Specifies the path of a directory that contains

Certificate Authority certificates in separate

individual files. Typically the file names need to

be the hash of the certificate followed by '.0'.

If available, <command>cacertdir_rehash</command>

can be used to create the correct names.

</para>

<para>

Default: use OpenLDAP defaults, typically in

<filename>/etc/openldap/ldap.conf</filename>

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_tls_cert (string)</term>

<listitem>

<para>

Specifies the file that contains the certificate

for the client's key.

</para>

<para>

Default: not set

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_tls_key (string)</term>

<listitem>

<para>

Specifies the file that contains the client's key.

</para>

<para>

Default: not set

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_tls_cipher_suite (string)</term>

<listitem>

<para>

Specifies acceptable cipher suites. Typically this

is a colon sperated list. See

<citerefentry><refentrytitle>ldap.conf</refentrytitle>

<manvolnum>5</manvolnum></citerefentry> for format.

</para>

<para>

Default: use OpenLDAP defaults, typically in

<filename>/etc/openldap/ldap.conf</filename>

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_id_use_start_tls (boolean)</term>

<listitem>

<para>

Specifies that the id_provider connection must also

use <systemitem class="protocol">tls</systemitem> to protect the channel.

</para>

<para>

Default: false

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_id_mapping (boolean)</term>

<listitem>

<para>

Specifies that SSSD should attempt to map user and

group IDs from the ldap_user_objectsid and

ldap_group_objectsid attributes instead of relying

on ldap_user_uid_number and ldap_group_gid_number.

</para>

<para>

Currently this feature supports only

ActiveDirectory objectSID mapping.

</para>

<para>

Default: false

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_sasl_mech (string)</term>

<listitem>

<para>

Specify the SASL mechanism to use.

Currently only GSSAPI is tested and supported.

</para>

<para>

Default: not set

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_sasl_authid (string)</term>

<listitem>

<para>

Specify the SASL authorization id to use.

When GSSAPI is used, this represents the Kerberos

principal used for authentication to the directory.

</para>

<para>

Default: host/machine.fqdn@REALM

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_sasl_canonicalize (boolean)</term>

<listitem>

<para>

If set to true, the LDAP library would perform

a reverse lookup to canonicalize the host name

during a SASL bind.

</para>

<para>

Default: false;

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_krb5_keytab (string)</term>

<listitem>

<para>

Specify the keytab to use when using SASL/GSSAPI.

</para>

<para>

Default: System keytab, normally <filename>/etc/krb5.keytab</filename>

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_krb5_init_creds (boolean)</term>

<listitem>

<para>

Specifies that the id_provider should init

Kerberos credentials (TGT).

This action is performed only if SASL is used and

the mechanism selected is GSSAPI.

</para>

<para>

Default: true

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_krb5_ticket_lifetime (integer)</term>

<listitem>

<para>

Specifies the lifetime in seconds of the TGT if

GSSAPI is used.

</para>

<para>

Default: 86400 (24 hours)

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>krb5_server (string)</term>

<listitem>

<para>

Specifies the comma-separated list of IP addresses or hostnames

of the Kerberos servers to which SSSD should

connect in the order of preference. For more

information on failover and server redundancy,

see the <quote>FAILOVER</quote> section. An optional

port number (preceded by a colon) may be appended to

the addresses or hostnames.

If empty, service discovery is enabled -

for more information, refer to the

<quote>SERVICE DISCOVERY</quote> section.

</para>

<para>

When using service discovery for KDC or kpasswd servers,

SSSD first searches for DNS entries that specify _udp as

the protocol and falls back to _tcp if none are found.

</para>

<para>

This option was named <quote>krb5_kdcip</quote> in

earlier releases of SSSD. While the legacy name is recognized

for the time being, users are advised to migrate their config

files to use <quote>krb5_server</quote> instead.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>krb5_realm (string)</term>

<listitem>

<para>

Specify the Kerberos REALM (for SASL/GSSAPI auth).

</para>

<para>

Default: System defaults, see <filename>/etc/krb5.conf</filename>

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>krb5_canonicalize (boolean)</term>

<listitem>

<para>

Specifies if the host principal should be canonicalized

when connecting to LDAP server. This feature is

available with MIT Kerberos >= 1.7

</para>

<para>

Default: false

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_pwd_policy (string)</term>

<listitem>

<para>

Select the policy to evaluate the password

expiration on the client side. The following values

are allowed:

</para>

<para>

<emphasis>none</emphasis> - No evaluation on the

client side. This option cannot disable server-side

password policies.

</para>

<para>

<emphasis>shadow</emphasis> - Use

<citerefentry><refentrytitle>shadow</refentrytitle>

<manvolnum>5</manvolnum></citerefentry> style

attributes to evaluate if the password has expired.

</para>

<para>

<emphasis>mit_kerberos</emphasis> - Use the attributes

used by MIT Kerberos to determine if the password has

expired. Use chpass_provider=krb5 to update these

attributes when the password is changed.

</para>

<para>

Default: none

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_referrals (boolean)</term>

<listitem>

<para>

Specifies whether automatic referral chasing should

be enabled.

</para>

<para>

Please note that sssd only supports referral chasing

when it is compiled with OpenLDAP version 2.4.13 or

higher.

</para>

<para>

Chasing referrals may incur a performance penalty

in environments that use them heavily, a notable

example is Microsoft Active Directory. If

your setup does not in fact require the use

of referrals, setting this option to false

might bring a noticeable performance improvement.

</para>

<para>

Default: true

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_dns_service_name (string)</term>

<listitem>

<para>

Specifies the service name to use when service

discovery is enabled.

</para>

<para>

Default: ldap

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_chpass_dns_service_name (string)</term>

<listitem>

<para>

Specifies the service name to use to find an LDAP

server which allows password changes when service

discovery is enabled.

</para>

<para>

Default: not set, i.e. service discovery is disabled

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_access_filter (string)</term>

<listitem>

<para>

If using access_provider = ldap, this option is

mandatory. It specifies an LDAP search filter

criteria that must be met for the user to be

granted access on this host. If

access_provider = ldap and this option is

not set, it will result in all users being

denied access. Use access_provider = permit to

change this default behavior.

</para>

<para>

Example:

</para>

<programlisting>

access_provider = ldap

ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com

</programlisting>

<para>

This example means that access to this host is

restricted to members of the "allowedusers" group

in ldap.

</para>

<para>

Offline caching for this feature is limited to

determining whether the user's last online login

was granted access permission. If they were

granted access during their last login, they will

continue to be granted access while offline and

vice-versa.

</para>

<para>

Default: Empty

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>ldap_account_expire_policy (string)</term>

<listitem>

<para>

With this option a client side evaluation of

access control attributes can be enabled.

</para>

<para>

Please note that it is always recommended to

use server side access control, i.e. the LDAP

server should deny the bind request with a