slapd-ldap.5 15.3 KB
Newer Older
1
.TH SLAPD-LDAP 5 "RELEASEDATE" "OpenLDAP LDVERSION"
Kurt Zeilenga's avatar
Kurt Zeilenga committed
2
.\" Copyright 1998-2006 The OpenLDAP Foundation All Rights Reserved.
3
4
5
6
7
8
9
10
11
12
13
14
15
.\" Copying restrictions apply.  See COPYRIGHT/LICENSE.
.\" $OpenLDAP$
.SH NAME
slapd-ldap \- LDAP backend to slapd
.SH SYNOPSIS
ETCDIR/slapd.conf
.SH DESCRIPTION
The LDAP backend to
.BR slapd (8)
is not an actual database; instead it acts as a proxy to forward incoming
requests to another LDAP server. While processing requests it will also
chase referrals, so that referrals are fully processed instead of being
returned to the slapd client.
16
17
18
19
20
21
22
23
24

Sessions that explicitly Bind to the back-ldap database always create their
own private connection to the remote LDAP server. Anonymous sessions will
share a single anonymous connection to the remote server. For sessions bound
through other mechanisms, all sessions with the same DN will share the
same connection. This connection pooling strategy can enhance the proxy's
efficiency by reducing the overhead of repeatedly making/breaking multiple
connections.

Pierangelo Masarati's avatar
Pierangelo Masarati committed
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
The ldap database can also act as an information service, i.e. the identity
of locally authenticated clients is asserted to the remote server, possibly
in some modified form.
For this purpose, the proxy binds to the remote server with some 
administrative identity, and, if required, authorizes the asserted identity.
See the 
.IR idassert- *
rules below.
The administrative identity of the proxy, on the remote server, must be 
allowed to authorize by means of appropriate
.B authzTo
rules; see 
.BR slapd.conf (5)
for details.

40
41
42
43
44
45
.LP
Note: When looping back to the same instance of \fBslapd\fP(8), 
each connection requires a new thread; as a consequence, \fBslapd\fP(8)
must be compiled with thread support, and the \fBthreads\fP parameter 
may need some tuning; in those cases, one may consider using 
\fBslapd-relay\fP(5) instead, which performs the relayed operation 
Kurt Zeilenga's avatar
Kurt Zeilenga committed
46
internally and thus reuses the same connection.
47

48
49
50
51
52
53
54
55
56
.SH CONFIGURATION
These
.B slapd.conf
options apply to the LDAP backend database.
That is, they must follow a "database ldap" line and come before any
subsequent "backend" or "database" lines.
Other database options are described in the
.BR slapd.conf (5)
manual page.
57

58
.LP
59
Note: In early versions of back-ldap it was recommended to always set
60
.LP
61
.RS
62
.nf
63
lastmod  off
64
.fi
65
.RE
66
.LP
67
68
69
70
71
72
for every
.B ldap
and
.B meta
database.
This is because operational attributes related to entry creation and
73
74
75
76
77
modification should not be proxied, as they could be mistakenly written
to the target server(s), generating an error.
The current implementation automatically sets lastmod to off, so its use
is redundant and should be omitted, because the lastmod directive will
be deprecated in the future.
78

79
80
.TP
.B uri <ldapurl>
81
82
83
84
85
LDAP server to use.  Multiple URIs can be set in in a single
.B ldapurl
argument, resulting in the underlying library automatically 
call the first server of the list that responds, e.g. 

Kurt Zeilenga's avatar
Kurt Zeilenga committed
86
\fBuri "ldap://host/ ldap://backup-host/"\fP
87
88

The URI list is space- or comma-separated.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
89
.\"This statement is mandatory.
Pierangelo Masarati's avatar
cleanup    
Pierangelo Masarati committed
90
91
92
.\".TP
.\".B server <hostport>
.\"Obsolete option; same as `uri ldap://<hostport>/'.
93
94
.HP
.hy 0
95
.B acl-bind
96
97
98
99
100
101
.B bindmethod=simple|sasl [binddn=<simple DN>] [credentials=<simple password>]
.B [saslmech=<SASL mech>] [secprops=<properties>] [realm=<realm>]
.B [authcId=<authentication ID>] [authzId=<authorization ID>]
.RS
Allows to define the parameters of the authentication method that is 
internally used by the proxy to collect info related to access control.
102
The identity defined by this directive, according to the properties
103
104
105
106
associated to the authentication method, is supposed to have read access 
on the target server to attributes used on the proxy for ACL checking.
There is no risk of giving away such values; they are only used to
check permissions.
107
The default is to use
108
109
.BR simple 
bind, with empty \fIbinddn\fP and \fIcredentials\fP,
110
111
which means that the related operations will be performed anonymously.

112
113
.B This identity is by no means implicitly used by the proxy 
.B when the client connects anonymously.
114
The
115
.B idassert-bind
116
117
feature, instead, in some cases can be crafted to implement that behavior,
which is \fIintrinsically unsafe and should be used with extreme care\fP.
118
This directive obsoletes
119
.BR acl-authcDN ,
120
121
122
and
.BR acl-passwd .
.RE
123

Kurt Zeilenga's avatar
Kurt Zeilenga committed
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
.TP
.B chase-referrals {YES|no}
enable/disable automatic referral chasing, which is delegated to the
underlying libldap, with rebinding eventually performed if the
\fBrebind-as-user\fP directive is used.  The default is to chase referrals.

.TP
.B conn-ttl <time>
This directive causes a cached connection to be dropped an recreated
after a given ttl, regardless of being idle or not.

.TP
.B idassert-authzFrom <authz-regexp>
if defined, selects what
.I local
identities are authorized to exploit the identity assertion feature.
The string
.B <authz-regexp>
follows the rules defined for the
.I authzFrom
attribute.
See 
.BR slapd.conf (5),
section related to
.BR authz-policy ,
for details on the syntax of this field.

151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
.HP
.hy 0
.B idassert-bind
.B bindmethod=none|simple|sasl [binddn=<simple DN>] [credentials=<simple password>]
.B [saslmech=<SASL mech>] [secprops=<properties>] [realm=<realm>]
.B [authcId=<authentication ID>] [authzId=<authorization ID>]
.B [authz={native|proxyauthz}] [mode=<mode>] [flags=<flags>]
.RS
Allows to define the parameters of the authentication method that is 
internally used by the proxy to authorize connections that are 
authenticated by other databases.
The identity defined by this directive, according to the properties
associated to the authentication method, is supposed to have auth access 
on the target server to attributes used on the proxy for authentication
and authorization, and to be allowed to authorize the users.
This requires to have
167
168
.B proxyAuthz
privileges on a wide set of DNs, e.g.
Pierangelo Masarati's avatar
Pierangelo Masarati committed
169
.BR authzTo=dn.subtree:"" ,
170
and the remote server to have
171
.B authz-policy
172
set to
173
.B to
174
or
175
.BR both .
176
See
177
178
179
.BR slapd.conf (5)
for details on these statements and for remarks and drawbacks about
their usage.
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
The supported bindmethods are

\fBnone|simple|sasl\fP

where
.B none
is the default, i.e. no \fIidentity assertion\fP is performed.

The authz parameter is used to instruct the SASL bind to exploit 
.B native 
SASL authorization, if available; since connections are cached,
this should only be used when authorizing with a fixed identity
(e.g. by means of the 
.B authzDN
or
.B authzID
parameters).
Otherwise, the default
.B proxyauthz
is used, i.e. the proxyAuthz control is added to all operations.

201
The supported modes are:
Pierangelo Masarati's avatar
cleanup    
Pierangelo Masarati committed
202

203
\fB<mode> := {legacy|anonymous|none|self}\fP
Pierangelo Masarati's avatar
cleanup    
Pierangelo Masarati committed
204

205
206
207
208
209
210
211
If 
.B <mode>
is not present, and 
.B authzId
is given, the proxy always authorizes that identity.
.B <authorization ID>
can be 
Pierangelo Masarati's avatar
cleanup    
Pierangelo Masarati committed
212

213
\fBu:<user>\fP
214

215
216
217
218
219
220
221
222
223
224
225
\fB[dn:]<DN>\fP

The former is supposed to be expanded by the remote server according 
to the authz rules; see
.BR slapd.conf (5)
for details.
In the latter case, whether or not the 
.B dn:
prefix is present, the string must pass DN validation and normalization.

The default mode is 
226
.BR legacy ,
227
228
229
230
which implies that the proxy will either perform a simple bind as the
.I authcDN
or a SASL bind as the
.I authcID
231
232
and assert the client's identity when it is not anonymous.
Direct binds are always proxied.
233
234
235
236
237
The other modes imply that the proxy will always either perform a simple bind 
as the
.IR authcDN
or a SASL bind as the
.IR authcID ,
238
unless restricted by
Pierangelo Masarati's avatar
Pierangelo Masarati committed
239
.BR idassert-authzFrom
240
241
242
243
rules (see below), in which case the operation will fail;
eventually, it will assert some other identity according to
.BR <mode> .
Other identity assertion modes are
244
245
246
.BR anonymous
and
.BR self ,
247
248
249
250
251
252
253
254
which respectively mean that the 
.I empty 
or the 
.IR client 's 
identity
will be asserted;
.BR none ,
which means that no proxyAuthz control will be used, so the
255
256
257
.I authcDN
or the
.I authcID
258
identity will be asserted.
259
260
261
262
263
264
265
266
For all modes that require the use of the
.I proxyAuthz 
control, on the remote server the proxy identity must have appropriate 
.I authzTo
permissions, or the asserted identities must have appropriate
.I authzFrom 
permissions.  Note, however, that the ID assertion feature is mostly 
useful when the asserted identities do not exist on the remote server.
267

268
269
270
271
Flags can be

\fBoverride,{prescriptive|non-prescriptive}\fP

Pierangelo Masarati's avatar
cleanup    
Pierangelo Masarati committed
272
273
274
275
276
277
278
When the 
.B override
flag is used, identity assertion takes place even when the database
is authorizing for the identity of the client, i.e. after binding
with the provided identity, and thus authenticating it, the proxy
performs the identity assertion using the configured identity and
authentication method.
279

280
281
282
283
284
285
286
287
288
289
290
291
292
293
When the
.B prescriptive
flag is used (the default), operations fail with
\fIinappropriateAuthentication\fP
for those identities whose assertion is not allowed by the
.B idassert-authzFrom
patterns.
If the 
.B non-prescriptive
flag is used, operations are performed anonymously for those identities 
whose assertion is not allowed by the
.B idassert-authzFrom
patterns.

294
295
296
297
298
299
This directive obsoletes
.BR idassert-authcDN ,
.BR idassert-passwd ,
.BR idassert-mode ,
and
.BR idassert-method .
Pierangelo Masarati's avatar
Pierangelo Masarati committed
300
.RE
301

302
.TP
Kurt Zeilenga's avatar
Kurt Zeilenga committed
303
304
305
.B idle-timeout <time>
This directive causes a cached connection to be dropped an recreated
after it has been idle for the specified time.
Pierangelo Masarati's avatar
cleanup    
Pierangelo Masarati committed
306

Pierangelo Masarati's avatar
Pierangelo Masarati committed
307
.TP
Kurt Zeilenga's avatar
Kurt Zeilenga committed
308
309
310
311
312
313
314
315
316
317
318
319
320
321
.B protocol\-version {0,2,3}
This directive indicates what protocol version must be used to contact
the remote server.
If set to 0 (the default), the proxy uses the same protocol version 
used by the client, otherwise the requested protocol is used.
The proxy returns \fIunwillingToPerform\fP if an operation that is 
incompatible with the requested protocol is attempted.

.TP
.B single\-conn {NO|yes}
Discards current cached connection when the client rebinds.

.TP
.B proxy\-whoami {NO|yes}
322
323
324
325
326
327
Turns on proxying of the WhoAmI extended operation. If this option is
given, back-ldap will replace slapd's original WhoAmI routine with its
own. On slapd sessions that were authenticated by back-ldap, the WhoAmI
request will be forwarded to the remote LDAP server. Other sessions will
be handled by the local slapd, as before. This option is mainly useful
in conjunction with Proxy Authorization.
328

329
.TP
330
.B rebind-as-user {NO|yes}
331
If this option is given, the client's bind credentials are remembered
332
for rebinds when chasing referrals.  Useful when
Hallvard Furuseth's avatar
Hallvard Furuseth committed
333
\fBchase-referrals\fP is set to \fByes\fP, useless otherwise.
334
335
336
337
338
339
340

.TP
.B t-f-support {NO|yes|discover}
enable if the remote server supports absolute filters
(see \fIdraft-zeilenga-ldap-t-f\fP for details).
If set to
.BR discover ,
Hallvard Furuseth's avatar
Hallvard Furuseth committed
341
support is detected by reading the remote server's root DSE.
342

343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
.TP
.B timeout [{add|delete|modify|modrdn}=]<val> [...]
This directive allows to set per-operation timeouts.
If no operation is specified, it affects all.
Currently, only write operations are addressed, because searches
can already be limited by means of the
.B limits
directive (see 
.BR slapd.conf (5)
for details), and other operations are not supposed to incur into the
need for timeouts.
Note: if the timelimit is exceeded, the operation is abandoned;
the protocol does not provide any means to rollback the operation,
so the client will not know if the operation eventually succeeded or not.

358
.TP
Kurt Zeilenga's avatar
Kurt Zeilenga committed
359
360
361
362
363
364
365
.B tls {[try-]start|[try-]propagate}
execute the StartTLS extended operation when the connection is initialized;
only works if the URI directive protocol scheme is not \fBldaps://\fP.
\fBpropagate\fP issues the StartTLS operation only if the original
connection did.
The \fBtry-\fP prefix instructs the proxy to continue operations
if the StartTLS operation failed; its use is highly deprecated.
366

367
368
369
.SH BACKWARD COMPATIBILITY
The LDAP backend has been heavily reworked between releases 2.2 and 2.3;
as a side-effect, some of the traditional directives have been
370
371
deprecated and should be no longer used, as they might disappear
in future releases.
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390

.TP
.B server <hostname[:port]>
this directive is no longer supported.  Use the 
.B uri
directive as described above.

.TP
.B acl-authcDN "<administrative DN for access control purposes>"
DN which is used to query the target server for acl checking; it
is supposed to have read access on the target server to attributes used
on the proxy for acl checking.
There is no risk of giving away such values; they are only used to
check permissions.
.B The acl-authcDN identity is by no means implicitly used by the proxy 
.B when the client connects anonymously.
See the
.B idassert-*
feature instead.
391
392
393
394
395
This directive is obsoleted by the
.B binddn
arg of
.B acl-bind
when \fIbindmethod\fP=\fBsimple\fP, and will be dismissed in the future.
396
397
398

.TP
.B acl-passwd <password>
399
400
401
402
403
404
405
406
Password used with the above
.B acl-authcDN
directive.
This directive is obsoleted by the
.B binddn
arg of
.B acl-bind
when \fIbindmethod\fP=\fBsimple\fP, and will be dismissed in the future.
407
408
409
410
411

.TP
.B idassert-authcDN "<administrative DN for proxyAuthz purposes>"
DN which is used to propagate the client's identity to the target
by means of the proxyAuthz control when the client does not
Hallvard Furuseth's avatar
Hallvard Furuseth committed
412
belong to the DIT fragment that is being proxied by back-ldap.
413
414
415
416
417
This directive is obsoleted by the
.B binddn
arg of
.BR idassert-bind
when \fIbindmethod\fP=\fBsimple\fP, and will be dismissed in the future.
418
419
420
421
422
423

.TP
.B idassert-passwd <password>
Password used with the
.B idassert-authcDN
above.
424
425
426
427
428
This directive is obsoleted by the
.B crendentials
of
.B idassert-bind
when \fIbindmethod\fP=\fBsimple\fP, and will be dismissed in the future.
429
430
431
432
433
434

.TP
.B idassert-mode <mode> [<flags>]
defines what type of
.I identity assertion
is used.
435
436
437
This directive is obsoleted by the
.B mode
arg of 
438
.BR idassert-bind ,
439
and will be dismissed in the future.
440
441
442

.TP
.B idassert-method <method> [<saslargs>]
443
444
445
This directive is obsoleted by the
.B bindmethod
arg of
446
.BR idassert-bind ,
447
and will be dismissed in the future.
448

449
.TP
Pierangelo Masarati's avatar
cleanup    
Pierangelo Masarati committed
450
451
452
453
.B suffixmassage, map, rewrite*
These directives are no longer supported by back-ldap; their 
functionality is now delegated to the
.B rwm
454
455
456
457
458
459
460
461
overlay.  Essentially, add a statement

.B overlay rwm

first, and prefix all rewrite/map statements with
.B rwm-
to obtain the original behavior.
See
Pierangelo Masarati's avatar
cleanup    
Pierangelo Masarati committed
462
463
.BR slapo-rwm (5)
for details.
464
465
466
467
468
.\" However, to ease update from existing configurations, back-ldap still 
.\" recognizes them and automatically instantiates the
.\" .B rwm
.\" overlay if available and not instantiated yet.
.\" This behavior may change in the future.
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484

.SH ACCESS CONTROL
The
.B ldap
backend does not honor all ACL semantics as described in
.BR slapd.access (5).
In general, access checking is delegated to the remote server(s).
Only
.B read (=r)
access to the
.B entry
pseudo-attribute and to the other attribute values of the entries
returned by the
.B search
operation is honored, which is performed by the frontend.

485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
.SH OVERLAYS
The LDAP backend provides basic proxying functionalities to many overlays.
The 
.B chain
overlay, described in
.BR slapo\-chain (5),
and the
.B translucent
overlay, described in
.BR slapo\-translucent (5),
deserve a special mention.

Conversely, there are many overlays that are best used in conjunction
with the LDAP backend.
The
.B proxycache 
overlay allows caching of LDAP search requests (queries) 
in a local database.
See 
.BR slapo\-pcache (5)
for details.
The
.B rwm
overlay provides DN rewrite and attribute/objectClass mapping
capabilities to the underlying database.
510
See 
511
.BR slapo\-rwm (5)
512
for details.
513

514
.SH FILES
515
.TP
516
ETCDIR/slapd.conf
517
default slapd configuration file
518
519
.SH SEE ALSO
.BR slapd.conf (5),
520
.BR slapd\-meta (5),
521
.BR slapo\-chain (5),
522
.BR slapo\-pcache (5),
Pierangelo Masarati's avatar
cleanup    
Pierangelo Masarati committed
523
.BR slapo\-rwm (5),
524
.BR slapo\-translucent (5),
525
526
.BR slapd (8),
.BR ldap (3).
Howard Chu's avatar
Howard Chu committed
527
528
.SH AUTHOR
Howard Chu, with enhancements by Pierangelo Masarati