From 0182d6f646997e486f56f847001ff74694bdd7da Mon Sep 17 00:00:00 2001 From: Magnus Hagander Date: Sat, 12 Dec 2009 21:35:21 +0000 Subject: Allow LDAP authentication to operate in search+bind mode, meaning it does a search for the user in the directory first, and then binds with the DN found for this user. This allows for LDAP logins in scenarios where the DN of the user cannot be determined simply by prefix and suffix, such as the case where different users are located in different containers. The old way of authentication can be significantly faster, so it's kept as an option. Robert Fleming and Magnus Hagander --- doc/src/sgml/client-auth.sgml | 80 ++++++++++++++++++++++++++++++++++++------- 1 file changed, 68 insertions(+), 12 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index 6442aa1efed..e1d8c9503b5 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -1,4 +1,4 @@ - + Client Authentication @@ -1202,7 +1202,8 @@ omicron bryanh guest1 - The server will bind to the distinguished name constructed as + LDAP authentication can operate in two modes. In the first mode, + the server will bind to the distinguished name constructed as prefix username suffix. Typically, the prefix parameter is used to specify cn=, or DOMAIN\ in an Active @@ -1210,6 +1211,23 @@ omicron bryanh guest1 remaining part of the DN in a non-Active Directory environment. + + In the second mode, the server first binds to the LDAP directory with + a fixed username and password, specified with ldapbinduser + and ldapbinddn, and performs a search for the user trying + to log in to the database. If no user and password is configured, an + anonymous bind will be attempted to the directory. The search will be + performed over the subtree at ldapbasedn, and will try to + do an exact match of the attribute specified in + ldapsearchattribute. If no attribute is specified, the + uid attribute will be used. Once the user has been found in + this search, the server disconnects and re-binds to the directory as + this user, using the password specified by the client, to verify that the + login is correct. This method allows for significantly more flexibility + in where the user objects are located in the directory, but will cause + two separate connections to the LDAP server to be made. + + The following configuration options are supported for LDAP: @@ -1221,11 +1239,32 @@ omicron bryanh guest1 + + ldapport + + + Port number on LDAP server to connect to. If no port is specified, + the default port in the LDAP library will be used. + + + + + ldaptls + + + Set to 1 to make the connection between PostgreSQL and the + LDAP server use TLS encryption. Note that this only encrypts + the traffic to the LDAP server — the connection to the client + will still be unencrypted unless SSL is used. + + + ldapprefix - String to prepend to the username when forming the DN to bind as. + String to prepend to the username when forming the DN to bind as, + when doing simple bind authentication. @@ -1233,30 +1272,47 @@ omicron bryanh guest1 ldapsuffix - String to append to the username when forming the DN to bind as. + String to append to the username when forming the DN to bind as, + when doing simple bind authentication. - ldapport + ldapbasedn - Port number on LDAP server to connect to. If no port is specified, - the default port in the LDAP library will be used. + DN to root the search for the user in, when doing search+bind + authentication. - ldaptls + ldapbinddn - Set to 1 to make the connection between PostgreSQL and the - LDAP server use TLS encryption. Note that this only encrypts - the traffic to the LDAP server — the connection to the client - will still be unencrypted unless SSL is used. + DN of user to bind to the directory with to perform the search when + doing search+bind authentication. + + ldapbindpasswd + + + Password for user to bind to the directory with to perform the search + when doing search+bind authentication. + + + + + ldapsearchattribute + + + Attribute to match against the username in the search when doing + search+bind authentication. + + + -- cgit v1.2.3