Subversion Repositories ALCASAR

# -*- text -*-
#
#  $Id: radius-ldap 378 2010-12-26 23:30:43Z franck $

# Lightweight Directory Access Protocol (LDAP)
#
#  This module definition allows you to use LDAP for
#  authorization and authentication.
#
#  See raddb/sites-available/default for reference to the
#  ldap module in the authorize and authenticate sections.
#
#  However, LDAP can be used for authentication ONLY when the
#  Access-Request packet contains a clear-text User-Password
#  attribute.  LDAP authentication will NOT work for any other
#  authentication method.
#
#  This means that LDAP servers don't understand EAP.  If you
#  force "Auth-Type = LDAP", and then send the server a
#  request containing EAP authentication, then authentication
#  WILL NOT WORK.
#
#  The solution is to use the default configuration, which does
#  work.
#
#  Setting "Auth-Type = LDAP" is ALMOST ALWAYS WRONG.  We
#  really can't emphasize this enough.
#       
ldap {
        #
        #  Note that this needs to match the name in the LDAP
        #  server certificate, if you're using ldaps.
server = ""
identity = ""
password = 
basedn = "dc=example,dc=com"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
base_filter = ""

        #  How many connections to keep open to the LDAP server.
        #  This saves time over opening a new LDAP socket for
        #  every authentication request.
        ldap_connections_number = 5

        # seconds to wait for LDAP query to finish. default: 20
        timeout = 4

        #  seconds LDAP server has to process the query (server-side
        #  time limit). default: 20
        #
        #  LDAP_OPT_TIMELIMIT is set to this value.
        timelimit = 3

        #
        #  seconds to wait for response of the server. (network
        #   failures) default: 10
        #
        #  LDAP_OPT_NETWORK_TIMEOUT is set to this value.
        net_timeout = 1

        #
        #  This subsection configures the tls related items
        #  that control how FreeRADIUS connects to an LDAP
        #  server.  It contains all of the "tls_*" configuration
        #  entries used in older versions of FreeRADIUS.  Those
        #  configuration entries can still be used, but we recommend
        #  using these.
        #
        tls {
                # Set this to 'yes' to use TLS encrypted connections
                # to the LDAP database by using the StartTLS extended
                # operation.
                #                       
                # The StartTLS operation is supposed to be
                # used with normal ldap connections instead of
                # using ldaps (port 689) connections
                start_tls = no

                # cacertfile    = /path/to/cacert.pem
                # cacertdir             = /path/to/ca/dir/
                # certfile              = /path/to/radius.crt
                # keyfile               = /path/to/radius.key
                # randfile              = /path/to/rnd

                #  Certificate Verification requirements.  Can be:
                #    "never" (don't even bother trying)
                #    "allow" (try, but don't fail if the cerificate
                #               can't be verified)
                #    "demand" (fail if the certificate doesn't verify.)
                #
                #       The default is "allow"
                # require_cert  = "demand"
        }

        # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
        # profile_attribute = "radiusProfileDn"
        # access_attr = "dialupAccess"

        # Mapping of RADIUS dictionary attributes to LDAP
        # directory attributes.
        dictionary_mapping = ${confdir}/ldap.attrmap

        #  Set password_attribute = nspmPassword to get the
        #  user's password from a Novell eDirectory
        #  backend. This will work ONLY IF FreeRADIUS has been
        #  built with the --with-edir configure option.
        #
        #  See also the following links:
        #
        #  http://www.novell.com/coolsolutions/appnote/16745.html
        #  https://secure-support.novell.com/KanisaPlatform/Publishing/558/3009668_f.SAL_Public.html
        #
        #  Novell may require TLS encrypted sessions before returning
        #  the user's password.
        #
        # password_attribute = userPassword

        #  Un-comment the following to disable Novell
        #  eDirectory account policy check and intruder
        #  detection. This will work *only if* FreeRADIUS is
        #  configured to build with --with-edir option.
        #
        edir_account_policy_check = no

        #
        #  Group membership checking.  Disabled by default.
        #
        # groupname_attribute = cn
        # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
        # groupmembership_attribute = radiusGroupName

        # compare_check_items = yes
        # do_xlat = yes
        # access_attr_used_for_allow = yes

        #
        #  By default, if the packet contains a User-Password,
        #  and no other module is configured to handle the
        #  authentication, the LDAP module sets itself to do
        #  LDAP bind for authentication.
        #
        #  THIS WILL ONLY WORK FOR PAP AUTHENTICATION.
        #
        #  THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). 
        #
        #  You can disable this behavior by setting the following
        #  configuration entry to "no".
        #
        #  allowed values: {no, yes}
        # set_auth_type = yes
        # set_auth_type = no

        #  ldap_debug: debug flag for LDAP SDK
        #  (see OpenLDAP documentation).  Set this to enable
        #  huge amounts of LDAP debugging on the screen.
        #  You should only use this if you are an LDAP expert.
        #
        #       default: 0x0000 (no debugging messages)
        #       Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS)
        #ldap_debug = 0x0028 
}