openldap plugin¶

See this section in the full configuration reference

To use the openldap plugin you first need to configure the OpenLDAP server correctly. The backend database monitor needs to be loaded and working. See slapd-monitor(5) for the details.

The configuration of the openldap plugin consists of one or more Instance blocks. Each block requires one string argument as the instance name. For example:

<Plugin "openldap">
  <Instance "foo">
    URL "ldap://localhost/"
  </Instance>
  <Instance "bar">
    URL "ldaps://localhost/"
  </Instance>
</Plugin>

The instance name will be used as the plugin instance. To emulate the old (versionE<nbsp>4) behavior, you can use an empty string (""). In order for the plugin to work correctly, each instance name must be unique. This is not enforced by the plugin and it is your responsibility to ensure it is.

The following options are accepted within each Instance block:

URL ldap://host/binddn

Sets the URL to use to connect to the OpenLDAP server. This option is mandatory.

BindDN BindDN

Name in the form of an LDAP distinguished name intended to be used for authentication. Defaults to empty string to establish an anonymous authorization.

Password Password

Password for simple bind authentication. If this option is not set, unauthenticated bind operation is used.

StartTLS true|false

Defines whether TLS must be used when connecting to the OpenLDAP server. Disabled by default.

VerifyHost true|false

Enables or disables peer host name verification. If enabled, the plugin checks if the Common Name or a Subject Alternate Name field of the SSL certificate matches the host name provided by the URL option. If this identity check fails, the connection is aborted. Enabled by default.

CACert File

File that holds one or more SSL certificates. If you want to use TLS/SSL you may possibly need this option. What CA certificates are checked by default depends on the distribution you use and can be changed with the usual ldap client configuration mechanisms. See ldap.conf(5) for the details.

Timeout Seconds

Sets the timeout value for ldap operations, in seconds. By default, the configured Interval is used to set the timeout. Use -1 to disable (infinite timeout).

Version Version

An integer which sets the LDAP protocol version number to use when connecting to the OpenLDAP server. Defaults to 3 for using LDAPv3.