saslauthd.conf 5
saslauthd.conf saslauthd LDAP configuration file
`saslauthd` -a ldap `saslauthd` -a ldap -O /etc/saslauthd.conf

## Description

This document describes LDAP configuration options for the Cyrus SASL password verification service `saslauthd`.

By default `saslauthd` searches for LDAP configuration options in `/usr/local/etc/saslauthd.conf`. This location can be overridden if the additional command line option `-O` specifies an alternative path to the configuration file.

## Syntax

Do not use quotes (\"\') in the parameter values.

## Options

The following are available LDAP parameters. The defaults are probably adequate for most installations. Only ldap_servers may need to be specified.

ldap_auth_method (default: `bind`|`fastbind`)

  The bind method uses the LDAP bind facility to verify the password. The bind method is not available when ldap_use_sasl is turned on. In that case saslauthd will use fastbind.

  `bind`

    `bind` is the default auth method. When ldap_use_sasl is enabled, 'fastbind' is the default.

  `custom`

    The `custom` method uses userPassword attribute to verify the password. Supported hashes: `crypt`, `md5`, smd5, `sha` and `ssha`. `Cleartext` is supported as well.

  `fastbind`

    The `fastbind` method - when ldap_use_sasl is `no` - does away with the search and an extra anonymous bind in auth_bind, but makes two assumptions:

    1. Expanding the ldap_filter expression gives the user's fully-qualified DN

    2. There is no cost to staying bound as a named user

ldap_bind_dn (default: empty)

  Specify `DN` (distinguished name) to bind to the LDAP directory. Do not specify this parameter for the anonymous bind.

ldap_bind_pw (default: empty)

  An alias for `ldap_password`.

ldap_default_domain (default: empty)

  An alias for `ldap_default_realm`.

ldap_default_realm (default: empty)

  The default realm is assigned to the `%r` token when realm is not available. See ldap_filter for more.

ldap_deref (default: empty)

  Specify how aliases dereferencing is handled during search. Should be one of `never`, `always`, `search`, or `find` to specify that aliases are never dereferenced, always dereferenced, dereferenced when searching, or dereferenced only when locating the base object for the search.

ldap_filter (default: `uid=%u`)

  Specify a filter. The following tokens can be used in the filter string:

  `%%`

    This is replaced by a literal ’%’ character.

  `%u`

    `%u` is replaced by the complete user string.

  `%U`

    If the string is an address (`%u`), `%U` will be replaced by the local part of that address.

  `%d`

    If the string is an address (`%u`), `%d` will be replaced by the domain part of that address. Otherwise it will be the same as `%r`.

  `%1-9`

    If the input key is `user@mail.example.com`, then `%1` is `com`, `%2` is `example` and `%3` is `mail`.

  `%s`

    `%s` is replaced by the complete service string.

  `%r`

    `%r` is replaced by the complete realm string.

  `%D`

    `%D` is replaced by the complete user DN (available for group checks)

  The `%u` token has to be used at minimum for the filter to be useful. If ldap_auth_method is `bind`, the filter will search for the `DN` (distinguished name) attribute. Otherwise, the search will look for the ldap_password_attr attribute.

ldap_group_attr (default: `uniqueMember`)

  Specify what attribute to compare the user DN against in the group. If ldap_group_dn is not specified, this parameter is ignored. If ldap_group_match_method is not `attr`, this parameter is ignored.

ldap_group_dn (default: empty)

  If specified, the user has to be part of the group in order to authenticate successfully. Tokens described in ldap_filter can be used for substitution.

ldap_group_filter (default: empty)

  Specify a filter. If a filter match is found then the user is in the group. Tokens described in ldap_filter can be used for for substitution. If ldap_group_dn is not specified, this parameter is ignored. If ldap_group_match_method is not filter, this parameter is ignored.

ldap_group_match_method (default: `attr`)

  If `attr` is used the group match method uses ldap_group_attr and if `filter` is used ldap_group_search will be used as group match method. If ldap_group_dn is not specified, this parameter is ignored.

ldap_group_search_base (default: `ldap_search_base`)

  Specify a starting point for the group search: e.g. `dc=example,dc=com`. Tokens described in ldap_filter can be used for substitution.

ldap_group_scope (default: sub)

  Group search scope. Options are either `sub`, `one` or `base`.

ldap_password (default: empty)

  Specify the password for ldap_bind_dn or ldap_id if ldap_use_sasl is turned on. Do not specify this parameter for the anonymous bind.

ldap_password_attr (default: `userPassword`)

  Specify what password attribute to use for password verification.

ldap_referrals (default: `no`)

  Specify whether or not the client should follow referrals.

ldap_restart (default: `yes`)

  Specify whether or not LDAP I/O operations are automatically restarted if they abort prematurely.

ldap_id (default: empty)

  Specify the authentication ID for SASL bind.

ldap_authz_id (default: empty)

  Specify the proxy authorization ID for SASL bind.

ldap_mech (default: empty)

  Specify the authentication mechanism for SASL bind.

ldap_realm (default: empty)

  Specify the realm of authentication ID for SASL bind.

ldap_scope (default: `sub`)

  Search scope. Options are either `sub`, `one` or `base`.

ldap_search_base (default: empty)

  Specify a starting point for the search: e.g. `dc=example,dc=com`. Tokens described in ldap_filter can be used for substitution.

ldap_servers (default: `ldap://localhost/`)

  Specify one or more URI(s) referring to LDAP server(s), e.g. `ldaps://10.1.1.2:999/`. Multiple servers must be separated by space.

ldap_start_tls (default: `no`)

  Use StartTLS extended operation. Do not use ldaps: ldap_servers when this option is turned on.

ldap_time_limit (default: `5`)

  Specify a number of seconds for a search request to complete.

ldap_timeout (default: `5`)

  Specify a number of seconds a search can take before timing out.

ldap_tls_check_peer (default: `no`)

  Require and verify server certificate. If this option is `yes`, you must specify ldap_tls_cacert_file or ldap_tls_cacert_dir.

ldap_tls_cacert_file (default: empty)

  File containing CA (Certificate Authority) certificate(s).

ldap_tls_cacert_dir (default: empty)

  Path to directory with CA (Certificate Authority) certificates.

ldap_tls_ciphers (default: `DEFAULT`)

  List of SSL/TLS ciphers to allow. The format of the string is described in ciphers 1 .

ldap_tls_cert (default: empty)

  File containing the client certificate.

ldap_tls_key (default: empty)

  File containing the private client key.

ldap_use_sasl (default: `no`)

  Use SASL bind instead of simple bind when connecting to the LDAP server.

ldap_version (default: `3`)

  Specify the LDAP protocol version - either `2` or `3`. If ldap_start_tls and/or ldap_use_sasl are enabled, ldap_version will be automatically set to `3`.

## Example

## See also

authdaemond 5 , ldapdb 5 , libsasl 5 , saslauthd 8 , saslauthd.conf 5 , saslpasswd2 5 , sasldblistusers2 5 , sasldb 5 , sql 5

## Readme files

`README.Debian`

## Author(s)

This manual is based on notes in `LDAP_SASLAUTHD` from Igor Brezac.

    Igor Brezac
    Igor@ipass.net

It was edited and revised for the Debian distribution because the original program does not have a manual page.

    Patrick Ben Koetter
    p@state-of-mind.de