GNU Mailutils

3.2.21 The ldap Statement

Syntax

ldap {
  # Enable LDAP lookups.
  enable bool;
  # Set URL of the LDAP server.
  url url;
  # Base DN for LDAP lookups.
  base string;
  # DN for accessing LDAP database.
  binddn string;
  # Password for use with binddn.
  passwd string;
  # Use TLS encryption.
  tls bool;
  # Set LDAP debugging level.
  debug number;
  # Set a field-map for parsing LDAP replies.
  field-map list;
  # LDAP filter to use for getpwnam requests.
  getpwnam string;
  # LDAP filter to use for getpwuid requests.
  getpwuid filter;
}

Description

The ldap statement configures the use of LDAP for authentication.

Configuration: enable bool ¶

Enables LDAP lookups. If absent, ‘enable On’ is assumed.

Configuration: url url ¶

Sets the URL of the LDAP server.

Configuration: base string ¶

Defines base DN for LDAP lookups.

Configuration: binddn string ¶

Defines the DN for accessing LDAP database.

Configuration: passwd string ¶

Password for use when binding to the database.

Configuration: tls bool ¶

Enable the use of TLS when connecting to the server.

Configuration: debug number ¶

Set LDAP debug level. Please refer to the OpenLDAP documentation, for allowed number values and their meaning.

Configuration: field-map map ¶

Defines a map for parsing LDAP replies. The map is a list of mappings¹. Each mapping is ‘field=value’, where field denotes a piece of authentication information and value describes how to obtain it.

Valid values for field are:

name

User name.

passwd

User password.

uid

UID of the user.

gid

GID of the primary group.

gecos

Textual description of the user.

dir

User’s home directory

shell

User’s shell program.

If value starts with a latin alphabet letter, it is taken to be the name of an LDAP attribute whose value is to supply the piece of information in question. For example, the default mapping is:

  ("name=uid",
   "passwd=userPassword",
   "uid=uidNumber",
   "gid=gidNumber",
   "gecos=gecos",
   "dir=homeDirectory",
   "shell=loginShell")

If value does not begin with a letter, it is a immediate value that supplies the needed piece of information. Prior to use, such values undergo quote removal, variable expansion and command substitution. These operations are described in detail in Configuration Variables. Any name of field can be used as a variable, provided that it refers to an LDAP attribute.²

The following example shows a field map that declares dir and mailbox fields as immediate value, that are computed using the value of the name field obtained from LDAP attribute uid:

  field-map (
     "name=uid",
     "passwd=userPassword",
     "uid=uidNumber",
     "gid=gidNumber",
     "gecos=gecos",
     "dir=/usr/home/$name",
     "shell=loginShell",
     "mailbox=\"maildir:/var/spool/mail/$name\""
  );

Configuration: getpwnam string ¶

Defines the LDAP filter to use for ‘getpwnam’ requests. The default is:

  (&(objectClass=posixAccount) (uid=$user))

Configuration: getpwuid string ¶

Defines the LDAP filter to use for ‘getpwuid’ requests. The default filter is:

  (&(objectClass=posixAccount) (uidNumber=$user))