# Even if AuthLDAPURL is defined in AuthnProviderAlias in ../conf.d/00-ldap.conf and processed earlier
LDAPTrustedGlobalCert CA_BASE64 /etc/ipa/ca.crt
# AuthnProviderAlias must be defined here, it cannot be in VirtualHost
# because ../access/ldap.conf is VirtualHost level
# ldap-mail is tried last (after ldap-uid)
<AuthnProviderAlias ldap ldap-mail>
# this one (last) must be authoritative
# AuthLDAPBindAuthoritative off
AuthLDAPInitialBindAsUser On
AuthLDAPSearchAsUser On
AuthLDAPCompareAsUser On
AuthLDAPInitialBindPattern (.+)\@(.+) uid=$1,cn=users,cn=accounts,dc=example,dc=com
</AuthnProviderAlias>
# ldap-uid is tried first
<AuthnProviderAlias ldap ldap-uid>
# first one is NOT authoritative
AuthLDAPBindAuthoritative off
AuthLDAPInitialBindAsUser On
AuthLDAPSearchAsUser On
AuthLDAPCompareAsUser On
AuthLDAPInitialBindPattern (.+) uid=$1,cn=users,cn=accounts,dc=example,dc=com
</AuthnProviderAlias>