[SSSD] Configuring a native LDAP domain: example config
David O'Brien
davido at redhat.com
Fri May 28 02:35:22 UTC 2010
I'd like to get my example config (below) in sync with latest
recommendations and what the man page has to say. In the process we
might even find some things that need review or update.
1. I've already changed enumerate to false
2. I'm curious about tls_reqcert: I know there are several options
(never, allow, try, etc.), but wonder if in this particular config
demand (hard) is required due to the encrypted channel requirements of
authentication against an LDAP server. Educate me?
3. ldap_tls_cacert value: the man page says the default is use OpenLDAP
defaults, typically in /etc/openldap/ldap.conf. Should I update my
example with the default value?
Again, any suggestions on a better example very welcome.
# A native LDAP domain
[domain/LDAP]
enumerate = false
cache_credentials = TRUE
id_provider = ldap
auth_provider = ldap
ldap_schema = rfc2307
chpass_provider = ldap
ldap_uri = ldap://ldap.mydomain.org
ldap_user_search_base = dc=mydomain,dc=org
tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
thanks a lot
--
David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.
More information about the sssd-devel
mailing list