[SSSD] Configuring a native LDAP domain: example config

David O'Brien davido at redhat.com
Fri May 28 02:35:22 UTC 2010


I'd like to get my example config (below) in sync with latest 
recommendations and what the man page has to say. In the process we 
might even find some things that need review or update.

1. I've already changed enumerate to false
2. I'm curious about tls_reqcert: I know there are several options 
(never, allow, try, etc.), but wonder if in this particular config 
demand (hard) is required due to the encrypted channel requirements of 
authentication against an LDAP server. Educate me?
3. ldap_tls_cacert value: the man page says the default is use OpenLDAP 
defaults, typically in /etc/openldap/ldap.conf. Should I update my 
example with the default value?

Again, any suggestions on a better example very welcome.

# A native LDAP domain
[domain/LDAP]
enumerate = false
cache_credentials = TRUE

id_provider = ldap
auth_provider = ldap
ldap_schema = rfc2307
chpass_provider = ldap

ldap_uri = ldap://ldap.mydomain.org
ldap_user_search_base = dc=mydomain,dc=org
tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt

thanks a lot
-- 

David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane

"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.



More information about the sssd-devel mailing list