LOGIN_LDAP(8)           OpenBSD System Manager's Manual          LOGIN_LDAP(8)

NAME
     login_ldap - contact ldap directory server for authentication

SYNOPSIS
     login_ldap [-s service] [-v name=value] user [class]

DESCRIPTION
     The login_ldap utility contacts the slapd(8) daemon to authenticate a
     user.  If no class is specified, the login class will be obtained from
     the password database.

     When executed as the name login_style, login_ldap will request slapd(8)
     use the authentication specified by style.

     Available options are:

     -s      Specify the service.  Currently only login and response are sup-
             ported.  The challenge service is not supported, but it is not an
             error to specify this service. If this happens login_ldap will
             request the response service.

     -v      This option and its value are ignored.

     The login_ldap utility will perform up to two searches on the LDAP server
     to authenticate the user. The first pass occurs for all users to be au-
     thenticated with this utility, and searches for the given username in the
     section given by the specified basedn (see below).  The second pass oc-
     curs only if values for x-ldap-groupdn and x-ldap-groupfilter are present
     in login.conf. This second pass will check that the user is present in
     the section of the directory represented by x-ldap-groupdn, according to
     the specification of x-ldap-groupfilter.

LOGIN.CONF VARIABLES
     The login_ldap utility requires the following ldap-specific login.conf(5)
     variables:

     x-ldap-server  Hostname or IP Adress of the primary server to contact for
                    authorization requests.

     x-ldap-basedn  Point in the ldap servers Directory Information Tree
                    login_ldap should begin searching for user objects.

     x-ldap-binddn  DN used by login_ldap to bind to the ldap server. Can be
                    "" (NULL) for anonymous bind.

     x-ldap-bindpw  Password used by login_ldap to bind to the ldap server.
                    Can be "" (NULL) for anonymous bind.

     x-ldap-filter  LDAP search filter (in accordance with RFC 1558) which
                    identifies the objectclass(s) and attribute(s) necessary
                    for login_ldap to locate the user object. See the FILTER
                    FORMATS section for details.

     The following entries to login.conf are also recognised by login_ldap and
     are optional:

     x-ldap-use-tls      If present, login_ldap should attempt to use Trans-
                         port Layer Security (TLS) as defined in RFC 2246.

     x-ldap-noreferrals  If present, login_ldap will turn off LDAP referrals.

     x-ldap-server-alt   Hostname of an alternate ldap server to use when the
                         primary is not responding.

     x-ldap-timeout      Time in seconds to wait for the ldap server to re-
                         spond to a query.  The default is 60 per query, with
                         up to four queries occuring.  There is a hard limit
                         of 5 minutes (300 seconds) for any login session to
                         take place.

     x-ldap-port         Port number of the ldap server's slapd process
                         login_ldap should contact, the default is 389.

     x-ldap-groupdn      DN of the group object in which membership of is a
                         pre-requisite for authorization. If this is set be
                         sure to specify a value for x-ldap-groupfilter.

     x-ldap-groupfilter  LDAP search filter (in accordance with RFC 1558)
                         which identifies the objectclass(s) and attribute(s)
                         necessary for login_ldap to determine group member-
                         ship in the DN defined by x-ldap-groupdn.

     x-ldap-uscope       The directory scope when performing the user lookup
                         (first pass) search.  Acceptable values are:

                         base      Base object search

                         onelevel  One level search

                         subtree   Full subtree search

                         The default is onelevel if x-ldap-uscope is unspeci-
                         fied.

     x-ldap-gscope       The directory scope when performing the group lookup
                         search (second pass).  See the entry for x-ldap-us-
                         cope for details of values.  The default is 'base' if
                         x-ldap-gscope is unspecified.

FILTER FORMATS
     The following format specifiers are valid for the x-ldap-filter and x-
     ldap-groupfilter login.conf(5) variables:

     %u   Username. The username of the user to be authenticated as specified
          by the user argument.

     %h   Hostname. The hostname of the host the user is trying to authenti-
          cate on, as returned by gethostname(3) and displayed by hostname(1).

     The following filter format is only valid for the x-ldap-groupfilter lo-
     gin.conf variable

     %d   The dn of the user attempting authentication as returned from the
          first pass of the search.

EXAMPLES
     /usr/local/share/login_ldap/login_ldap.conf
     /usr/local/share/login_ldap/active-directory.login_ldap.conf

FILES
     /etc/login.conf     login configuration database

SEE ALSO
     login.conf(5), login(8)

AUTHORS
     James Phillips <jamesp@webdaemons.org>

     Peter Werner <peterw@ifost.org.au>

CAVEATS
     OpenBSD does not ship with an ldap server in the default install, however
     OpenLDAP is available via packages(7).

     Until OpenBSD gets an nsswitch implementation or something similar, every
     user in the LDAP server will need to have a valid passwd file entry. This
     can be achieved by using the useradd(8) utility with similar arguments to
     this: useradd -m -d /home/peterw -s /bin/sh -L ldap peterw

     As of version 3.3 login_ldap no longer installs setuid root.  It is be-
     lieved that elevated priveledges are not neccessary in most cases, but
     potentially this could cause a problem.  Making the login_ldap binary se-
     tuid root should be tried as part of site installation debugging if
     things aren't working.  If you find you do need the setuid bit set,
     please let the authors know.

OpenBSD 3.7                      May 18, 2002                                3
