Made "chase_referrals" and "rebind" to "yes" by default.

[freeradius.git] / raddb / mods-available / ldap

# -*- text -*-
#
#  $Id$

#
# Lightweight Directory Access Protocol (LDAP)
#
ldap {
        #
        #  Note that this needs to match the name in the LDAP
        #  server certificate, if you're using ldaps.
        server = "ldap.example.org"

        #  Port to connect on, defaults to 389. Setting this to
        #  636 will enable LDAPS if start_tls (see below) is not
        #  able to be used.
#       port = 389

        # Read-only administrator account for initial binding and searching
#       identity = "cn=admin,dc=example,dc=org"
#       password = mypass


#       basedn = "ou=people,dc=example,dc=org"
#       filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"

        #
        #  Mapping of RADIUS dictionary attributes to LDAP directory attributes.
        #
        #  WARNING: Although this format is almost identical to the unlang 
        #  update section format, it does *NOT* mean that you can use other
        #  unlang constructs in module configuration files.
        #
        #  Configuration items are in the format:
        #       <radius attr> <op> <ldap attr>
        # 
        #  Where:
        #       <radius attr>:  The destination RADIUS attribute
        #                       with any valid list and request qualifiers.
        #       <op>:           Is any assignment attribute (=, :=, +=, -=).
        #       <ldap attr>:    The attribute in the associated with user or
        #                       profile objects in the LDAP. 
        #                       directory. If the attribute name is wrapped in 
        #                       double quotes it will be xlat expanded.
        # 
        #  Request and list qualifiers may also be placed after the section
        #  name to set defaults for unqualified RADIUS attributes.
        #
        #  Note: LDAP attribute names should be single quoted unless you want
        #  the name value to be derived from an xlat expansion, or an
        #  attribute ref.
        #
        update reply {
#               control:NT-Password     := 'ntPassword'
#               Reply-Message           := 'radiusReplyMessage'
#               Tunnel-Type             := 'radiusTunnelType'
#               Tunnel-Medium-Type      := 'radiusTunnelMediumType'
#               Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId'
        }

        # Set to "no" to disable the 'no "known good" password' warning,
        # if you're not using LDAP to retrieve password values.
#       expect_password = yes

        # Set to yes if you have eDirectory and want to use the universal
        # password mechanism.
#       edir = no

        # Set to yes if you want to bind as the user after retrieving the
        # Cleartext-Password. This will consume the login grace, and
        # verify user authorization.
#       edir_autz = no

        #
        #  Profile related attributes.
        #
        profiles {
                #  Control whether or not "access_attr" is used to
                #  determine authorization.  If set to "yes", then
                #  "access_attr" existing means "allow access".
                #  "access_attr" not existing means "deny access"
                #
                #   If set to "no", then
                #  "access_attr" existing means "deny access".
                #  "access_attr" not existing means "allow access"
#               positive_access_attr = yes

                #  If this is undefined, anyone is authorized.
                #  If it is defined, the contents of this attribute
                #  determine whether or not the user is authorized
#               access_attr = "dialupAccess"

                # Base filter for the following profiles.
#               base_filter = "(objectclass=radiusprofile)"

                #  The default profile applied to all users.
#               default_profile = "cn=radprofile,dc=example,dc=org"

                #  The list of profiles which are applied (after the default)
                #  to all users.
                #  The "User-Profile" attribute in the control list
                #  will over-ride this setting at run-time.
#               profile_attribute = "radiusProfileDn"
        }

        #
        #  Group membership checking.  Disabled by default.
        #
        #  When doing checks for LDAP-Group = foo"
        #
        group {
                # Check for "cn=foo"
#               name_attribute = cn

                # Filter to get the list of groups that a user belongs to.
#               membership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))"

                # If the filter returns nothing
                membership_attribute = radiusGroupName
        }
        
        #
        #  Modify user object on receiving Accounting-Request
        #
        #  Useful for recording things like the last time the user logged
        #  in, or the Acct-Session-ID for CoA/DM.
        #
        #  LDAP modification items are in the format:
        #       <ldap attr> <op> <value>
        # 
        #  Where:
        #       <ldap attr>:    The LDAP attribute to add modify or delete.
        #       <op>:           One of the assignment operators:
        #                       (:=, +=, -=, ++).
        #                       Note: '=' is *not* supported.
        #       <value>:        The value to add modify or delete.
        #
        #  WARNING: If using the ':=' operator with a multivalued LDAP 
        #  attribute, all instances of the attribute will be removed and
        #  replaced with a single attribute.
        # 
        accounting {
                reference = "%{tolower:type.%{Acct-Status-Type}}"
                
                type {
                        start {
                                update {
                                        description := "Online at %S"
                                }
                        }
                        
                        interim-update {
                                update {
                                        description := "Last seen at %S"
                                }
                        }
                        
                        stop {
                                update {
                                        description := "Offline at %S"
                                }
                        }
                }
        }
        
        #
        #  Post-Auth can modify LDAP objects too
        #
        #  For eDir users this is performed *after* the post-auth login checks
        #
        post-auth {
                update {
                        description := "Authenticated at %S"
                }
        }

        #  LDAP connection-specific options.
        #
        #  These options set timeouts, keepalives, etc. for the connections.
        #
        options {
                #
                #  The following two configuration items are for Active Directory
                #  compatibility.  If you set these to "no", then searches
                #  will likely return "operations error", instead of a
                #  useful resuly.
                #
                chase_referrals = yes
                rebind = yes

                # seconds to wait for LDAP query to finish. default: 20
                timeout = 10

                #  seconds LDAP server has to process the query (server-side
                #  time limit). default: 20
                #
                #  LDAP_OPT_TIMELIMIT is set to this value.
                timelimit = 3

                #
                #  seconds to wait for response of the server. (network
                #   failures) default: 10
                #
                #  LDAP_OPT_NETWORK_TIMEOUT is set to this value.
                net_timeout = 1

                # LDAP_OPT_X_KEEPALIVE_IDLE
                idle = 60

                # LDAP_OPT_X_KEEPALIVE_PROBES
                probes = 3

                # LDAP_OPT_X_KEEPALIVE_INTERVAL
                interval = 3

                #  ldap_debug: debug flag for LDAP SDK
                #  (see OpenLDAP documentation).  Set this to enable
                #  huge amounts of LDAP debugging on the screen.
                #  You should only use this if you are an LDAP expert.
                #
                #       default: 0x0000 (no debugging messages)
                #       Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS)
                ldap_debug = 0x0028
        }

        #
        #  This subsection configures the tls related items
        #  that control how FreeRADIUS connects to an LDAP
        #  server.  It contains all of the "tls_*" configuration
        #  entries used in older versions of FreeRADIUS.  Those
        #  configuration entries can still be used, but we recommend
        #  using these.
        #
        tls {
                # Set this to 'yes' to use TLS encrypted connections
                # to the LDAP database by using the StartTLS extended
                # operation.
                #                       
                # The StartTLS operation is supposed to be
                # used with normal ldap connections instead of
                # using ldaps (port 636) connections
#               start_tls = yes

#               cacertfile      = ${certdir}/cacert.pem

#               cacertdir       = ${certdir}
#               certfile        = /path/to/radius.crt
#               keyfile         = /path/to/radius.key
#               randfile        = ${certdir}/random

                #  Certificate Verification requirements.  Can be:
                #    "never" (don't even bother trying)
                #    "allow" (try, but don't fail if the cerificate
                #               can't be verified)
                #    "demand" (fail if the certificate doesn't verify.)
                #
                #       The default is "allow"
#               require_cert    = "demand"
        }


        #  As of version 3.0, the "pool" section has replaced the
        #  following configuration items:
        #
        #  ldap_connections_number

        #  The connection pool is new for 3.0, and will be used in many
        #  modules, for all kinds of connection-related activity.
        #
        pool {
                # Number of connections to start
                start = 5

                # Minimum number of connections to keep open
                min = 4

                # Maximum number of connections
                #
                # If these connections are all in use and a new one
                # is requested, the request will NOT get a connection.
                max = 10

                # Spare connections to be left idle
                #
                # NOTE: Idle connections WILL be closed if "idle_timeout"
                # is set.
                spare = 3

                # Number of uses before the connection is closed
                #
                # 0 means "infinite"
                uses = 0

                # The lifetime (in seconds) of the connection
                lifetime = 0

                # idle timeout (in seconds).  A connection which is
                # unused for this length of time will be closed.
                idle_timeout = 60

                # NOTE: All configuration settings are enforced.  If a
                # connection is closed because of "idle_timeout",
                # "uses", or "lifetime", then the total number of
                # connections MAY fall below "min".  When that
                # happens, it will open a new connection.  It will
                # also log a WARNING message.
                #
                # The solution is to either lower the "min" connections,
                # or increase lifetime/idle_timeout.
        }

}