ldapdb 5
ldapdb auxiliary property plugin

Cyrus SASL auxprop plugin to access LDAP authentication backends.

## Description

This document describes configuration options for the Cyrus SASL auxiliary property plugin `ldapdb`.

This plugin reads all user data from an OpenLDAP server. It requires configuration of the `ldapdb` plugin and of the LDAP server. The `ldapdb` plugin must name a proxy user. The proxy user must (also) SASL authenticate at the LDAP server. The LDAP server must authorize the `ldapdb` proxy user to access the authenticating users userPassword.

## Options

The following configuration parameters are applicable in the context of the `ldapdb` plugin:

`ldapdb_uri` (default: empty)

  Specifies a whitespace-separated list of LDAP servers (authentication backends). Use `ldapi://`..., `ldap://`... or `ldaps://`... to specify how the servers should be contacted.

`ldapdb_id` (default: empty)

  Specifies the proxy user name (authentication id) who logs into the LDAP server in order to retrieve the authenticating users userPassword.

`ldapdb_mech` (default: empty)

  Sets the SASL mechanism the `ldapdb` plugin (client) should use when it SASL connects to the LDAP server.

`ldapdb_pw` (default: empty)

  Specifies the password used by ldapdb_id. The password must be written in cleartext.

`ldapdb_rc` (default: empty)

  Specifies a path to a file that contains configuration options to override system-wide defaults when running ldap clients (see also: ldap.conf 5 ).

  The main purpose behind this option is to drop transmission of ldapdb_pw in favor of a client TLS certificate specified in ldapdb_rc, so that SASL/EXTERNAL may be used between the ldapdb plugin and the LDAP server.

  This is the most optimal way to use the ldapdb plugin when the servers are on separate machines - the connection is encrypted and password transmission is not necessary because the client is identified by its TLS client certificate.

`ldapdb_starttls` (default: empty)

  Enable encrypted communication using StartTLS. Valid options are:

  `try`

    StartTLS encrypted communication is attempted. If it fails the client communicates unencrypted.

  `demand`

    StartTLS encrypted communication is required. If it fails the client aborts the connection.

## Example

The following example shows a typical `ldapdb` configuration.

    pwcheck_method: auxprop
    auxprop_plugin: ldapdb
    mech_list: PLAIN LOGIN NTLM CRAM-MD5 DIGEST-MD5
    ldapdb_uri: ldap://localhost ldaps://ldap.example.com
    ldapdb_id: proxyuser
    ldapdb_pw: proxypass
    ldapdb_mech: DIGEST-MD5

## See also

authdaemond 5 , ldapdb 5 , libsasl 5 , saslauthd 8 , saslauthd.conf 5 , saslpasswd2 5 , sasldblistusers2 5 , sasldb 5 , sql 5

## Readme files

`README.Debian`

## Author

This manual was written for the Debian distribution because the original program does not have a manual page. Parts of the documentation have been taken from the Cyrus SASL's `options.html`.

    Patrick Ben Koetter
    p@state-of-mind.de