mirror of
https://git.openldap.org/openldap/openldap.git
synced 2026-01-01 20:49:35 -05:00
Undocument LDAPv2 Kerberos options
This commit is contained in:
Kurt Zeilenga
parent
be097fc8cd
commit
2e39dd74b8
10 changed files with 12 additions and 171 deletions
|
|
@ -287,13 +287,12 @@ perform" error.
|
|||
H4: replica
|
||||
|
||||
> replica uri=ldap[s]://<hostname>[:<port>] | host=<hostname>[:<port>]
|
||||
> [bindmethod={simple|kerberos|sasl}]
|
||||
> [bindmethod={simple|sasl}]
|
||||
> ["binddn=<DN>"]
|
||||
> [saslmech=<mech>]
|
||||
> [authcid=<identity>]
|
||||
> [authzid=<identity>]
|
||||
> [credentials=<password>]
|
||||
> [srvtab=<filename>]
|
||||
|
||||
This directive specifies a replication site for this database. The
|
||||
{{EX:uri=}} parameter specifies a scheme, a host and optionally a port where
|
||||
|
|
@ -316,21 +315,15 @@ database. Since DNs are likely to contain embedded spaces, the
|
|||
entire {{EX:"binddn=<DN>"}} string should be enclosed in double
|
||||
quotes.
|
||||
|
||||
The {{EX:bindmethod}} is {{EX:simple}} or {{EX:kerberos}} or {{EX:sasl}},
|
||||
depending on whether simple password-based authentication or Kerberos
|
||||
authentication or {{TERM:SASL}} authentication is to be used when connecting
|
||||
to the slave slapd.
|
||||
The {{EX:bindmethod}} is {{EX:simple}} or {{EX:sasl}}, depending
|
||||
on whether simple password-based authentication or {{TERM:SASL}}
|
||||
authentication is to be used when connecting to the slave slapd.
|
||||
|
||||
Simple authentication should not be used unless adequate data
|
||||
integrity and confidentiality protections are in place (e.g. TLS
|
||||
or IPSEC). Simple authentication requires specification of
|
||||
{{EX:binddn}} and {{EX:credentials}} parameters.
|
||||
|
||||
Kerberos authentication is deprecated in favor of SASL authentication
|
||||
mechanisms, in particular the {{EX:KERBEROS_V4}} and {{EX:GSSAPI}}
|
||||
mechanisms. Kerberos authentication requires {{EX:binddn}} and
|
||||
{{EX:srvtab}} parameters.
|
||||
|
||||
SASL authentication is generally recommended. SASL authentication
|
||||
requires specification of a mechanism using the {{EX:saslmech}} parameter.
|
||||
Depending on the mechanism, an authentication identity and/or
|
||||
|
|
|
|||
|
|
@ -13,10 +13,6 @@ ldapcompare \- LDAP compare tool
|
|||
[\c
|
||||
.BR \-z ]
|
||||
[\c
|
||||
.BR \-k ]
|
||||
[\c
|
||||
.BR \-K ]
|
||||
[\c
|
||||
.BR \-M[M] ]
|
||||
[\c
|
||||
.BI \-d \ debuglevel\fR]
|
||||
|
|
@ -86,17 +82,6 @@ Run in verbose mode, with many diagnostics written to standard output.
|
|||
Run in quiet mode, no output is written. You must check the return
|
||||
status. Useful in shell scripts.
|
||||
.TP
|
||||
.B \-k
|
||||
Use Kerberos IV authentication instead of simple authentication. It is
|
||||
assumed that you already have a valid ticket granting ticket.
|
||||
.B ldapcompare
|
||||
must be compiled with Kerberos support for this option to have any effect.
|
||||
.TP
|
||||
.B \-K
|
||||
Same as \-k, but only does step 1 of the Kerberos IV bind. This is useful
|
||||
when connecting to a slapd and there is no x500dsa.hostname principal
|
||||
registered with your Kerberos Domain Controller(s).
|
||||
.TP
|
||||
.B \-M[M]
|
||||
Enable manage DSA IT control.
|
||||
.B \-MM
|
||||
|
|
|
|||
|
|
@ -11,10 +11,6 @@ ldapdelete \- LDAP delete entry tool
|
|||
[\c
|
||||
.BR \-v ]
|
||||
[\c
|
||||
.BR \-k ]
|
||||
[\c
|
||||
.BR \-K ]
|
||||
[\c
|
||||
.BR \-c ]
|
||||
[\c
|
||||
.BR \-M[M] ]
|
||||
|
|
@ -83,18 +79,6 @@ debugging in conjunction with -v.
|
|||
.B \-v
|
||||
Use verbose mode, with many diagnostics written to standard output.
|
||||
.TP
|
||||
.B \-k
|
||||
Use Kerberos IV authentication instead of simple authentication. It is
|
||||
assumed that you already have a valid ticket granting ticket. This option
|
||||
only has effect if
|
||||
.B ldapdelete
|
||||
is compiled with Kerberos support.
|
||||
.TP
|
||||
.B \-K
|
||||
Same as \-k, but only does step 1 of the Kerberos IV bind. This is useful
|
||||
when connecting to a slapd and there is no x500dsa.hostname principal
|
||||
registered with your Kerberos Domain Controller(s).
|
||||
.TP
|
||||
.B \-c
|
||||
Continuous operation mode. Errors are reported, but
|
||||
.B ldapdelete
|
||||
|
|
|
|||
|
|
@ -17,10 +17,6 @@ ldapmodify, ldapadd \- LDAP modify entry and LDAP add entry tools
|
|||
[\c
|
||||
.BR \-v ]
|
||||
[\c
|
||||
.BR \-k ]
|
||||
[\c
|
||||
.BR \-K ]
|
||||
[\c
|
||||
.BR \-M[M] ]
|
||||
[\c
|
||||
.BI \-d \ debuglevel\fR]
|
||||
|
|
@ -71,10 +67,6 @@ ldapmodify, ldapadd \- LDAP modify entry and LDAP add entry tools
|
|||
[\c
|
||||
.BR \-v ]
|
||||
[\c
|
||||
.BR \-k ]
|
||||
[\c
|
||||
.BR \-K ]
|
||||
[\c
|
||||
.BR \-M[M] ]
|
||||
[\c
|
||||
.BI \-d \ debuglevel\fR]
|
||||
|
|
@ -155,16 +147,6 @@ debugging in conjunction with -v.
|
|||
.B \-v
|
||||
Use verbose mode, with many diagnostics written to standard output.
|
||||
.TP
|
||||
.B \-k
|
||||
Use Kerberos IV authentication instead of simple authentication. It is
|
||||
assumed that you already have a valid ticket granting ticket. You must
|
||||
compile with Kerberos support for this option to have any effect.
|
||||
.TP
|
||||
.B \-K
|
||||
Same as \-k, but only does step 1 of the Kerberos IV bind. This is useful
|
||||
when connecting to a slapd and there is no x500dsa.hostname principal
|
||||
registered with your Kerberos Domain Controller(s).
|
||||
.TP
|
||||
.B \-F
|
||||
Force application of all changes regardless of the contents of input
|
||||
lines that begin with
|
||||
|
|
|
|||
|
|
@ -13,10 +13,6 @@ ldapmodrdn \- LDAP rename entry tool
|
|||
[\c
|
||||
.BR \-v ]
|
||||
[\c
|
||||
.BR \-k ]
|
||||
[\c
|
||||
.BR \-K ]
|
||||
[\c
|
||||
.BR \-c ]
|
||||
[\c
|
||||
.BR \-M[M] ]
|
||||
|
|
@ -85,17 +81,6 @@ debugging in conjunction with -v.
|
|||
.B \-v
|
||||
Use verbose mode, with many diagnostics written to standard output.
|
||||
.TP
|
||||
.B \-k
|
||||
Use Kerberos IV authentication instead of simple authentication. It is
|
||||
assumed that you already have a valid ticket granting ticket.
|
||||
.B ldapmodrdn
|
||||
must be compiled with Kerberos support for this option to have effect.
|
||||
.TP
|
||||
.B \-K
|
||||
Same as \-k, but only does step 1 of the Kerberos IV bind. This is useful
|
||||
when connecting to a slapd and there is no x500dsa.hostname principal
|
||||
registered with your Kerberos Domain Controller(s).
|
||||
.TP
|
||||
.B \-c
|
||||
Continuous operation mode. Errors are reported, but ldapmodrdn
|
||||
will continue with modifications. The default is to exit after
|
||||
|
|
|
|||
|
|
@ -13,10 +13,6 @@ ldapsearch \- LDAP search tool
|
|||
[\c
|
||||
.BR \-v ]
|
||||
[\c
|
||||
.BR \-k ]
|
||||
[\c
|
||||
.BR \-K ]
|
||||
[\c
|
||||
.BR \-t ]
|
||||
[\c
|
||||
.BR \-A ]
|
||||
|
|
@ -106,17 +102,6 @@ in the output.
|
|||
.B \-v
|
||||
Run in verbose mode, with many diagnostics written to standard output.
|
||||
.TP
|
||||
.B \-k
|
||||
Use Kerberos IV authentication instead of simple authentication. It is
|
||||
assumed that you already have a valid ticket granting ticket.
|
||||
.B ldapsearch
|
||||
must be compiled with Kerberos support for this option to have any effect.
|
||||
.TP
|
||||
.B \-K
|
||||
Same as \-k, but only does step 1 of the Kerberos IV bind. This is useful
|
||||
when connecting to a slapd and there is no x500dsa.hostname principal
|
||||
registered with your Kerberos Domain Controller(s).
|
||||
.TP
|
||||
.B \-t
|
||||
Write retrieved non-printable values to a set of temporary files. This
|
||||
is useful for dealing with values containing non-character data such as
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
.\" Copyright 1998-2005 The OpenLDAP Foundation All Rights Reserved.
|
||||
.\" Copying restrictions apply. See COPYRIGHT/LICENSE.
|
||||
.SH NAME
|
||||
ldap_bind, ldap_bind_s, ldap_simple_bind, ldap_simple_bind_s, ldap_kerberos_bind_s, ldap_kerberos_bind1, ldap_kerberos_bind1_s, ldap_kerberos_bind2, ldap_kerberos_bind2_s, ldap_sasl_bind, ldap_sasl_bind_s, ldap_sasl_interactive_bind_s, ldap_parse_sasl_bind_result, ldap_unbind, ldap_unbind_s \- LDAP bind routines
|
||||
ldap_bind, ldap_bind_s, ldap_simple_bind, ldap_simple_bind_s, ldap_sasl_bind, ldap_sasl_bind_s, ldap_sasl_interactive_bind_s, ldap_parse_sasl_bind_result, ldap_unbind, ldap_unbind_s \- LDAP bind routines
|
||||
.SH LIBRARY
|
||||
OpenLDAP LDAP (libldap, -lldap)
|
||||
.SH SYNOPSIS
|
||||
|
|
@ -24,16 +24,6 @@ OpenLDAP LDAP (libldap, -lldap)
|
|||
.LP
|
||||
.BI "int ldap_simple_bind_s(LDAP *" ld ", const char *" who ", const char *" passwd ");"
|
||||
.LP
|
||||
.BI "int ldap_kerberos_bind_s(LDAP *" ld ", const char *" who ");"
|
||||
.LP
|
||||
.BI "int ldap_kerberos_bind1(LDAP *" ld ", const char *" who ");"
|
||||
.LP
|
||||
.BI "int ldap_kerberos_bind1_s(LDAP *" ld ", const char *" who ");"
|
||||
.LP
|
||||
.BI "int ldap_kerberos_bind2(LDAP *" ld ", const char *" who ");"
|
||||
.LP
|
||||
.BI "int ldap_kerberos_bind2_s(LDAP *" ld ", const char *" who ");"
|
||||
.LP
|
||||
.BI "int ldap_sasl_bind(LDAP *" ld ", const char *" dn ", const char *" mechanism ","
|
||||
.RS
|
||||
.BI "struct berval *" cred ", LDAPControl *" sctrls "[],"
|
||||
|
|
@ -78,9 +68,10 @@ attempted over the connection. An LDAP bind is required when using
|
|||
Version 2 of the LDAP protocol; it is optional for Version 3 but is
|
||||
usually needed due to security considerations.
|
||||
.LP
|
||||
There are many types of bind calls, providing simple authentication, Kerberos
|
||||
version 4 authentication, and general routines to do either one, as
|
||||
well as calls using
|
||||
There are three types of bind calls, ones providing simple authentication,
|
||||
ones providing SASL authentication, and general routines capable of doing
|
||||
either simple or SASL authentication.
|
||||
.LP
|
||||
.B SASL
|
||||
(Simple Authentication and Security Layer)
|
||||
that can negotiate one of many different kinds of authentication.
|
||||
|
|
@ -89,12 +80,6 @@ call are provided. All routines
|
|||
take \fIld\fP as their first parameter, as returned from
|
||||
.BR ldap_init (3).
|
||||
.LP
|
||||
Kerberos version 4 has been superseded by Kerberos version 5, and the
|
||||
Kerberos version 4 support is only provided for backward compatibility. The
|
||||
SASL interfaces should be used for new applications. SASL provides
|
||||
a general interface for using Kerberos versions 4 and 5 and many other
|
||||
security systems.
|
||||
.LP
|
||||
.SH SIMPLE AUTHENTICATION
|
||||
The simplest form of the bind call is
|
||||
.BR ldap_simple_bind_s() .
|
||||
|
|
@ -109,41 +94,6 @@ taking the same parameters but only initiating the bind operation and
|
|||
returning the message id of the request it sent. The result of the
|
||||
operation can be obtained by a subsequent call to
|
||||
.BR ldap_result (3).
|
||||
.SH KERBEROS AUTHENTICATION
|
||||
If the LDAP library and LDAP server being contacted have been
|
||||
compiled with the KERBEROS option defined,
|
||||
Kerberos version 4 authentication can be performed. As mentioned above,
|
||||
these Kerberos routines are provided only for backward compatibility.
|
||||
.LP
|
||||
These routines assume the user already
|
||||
has obtained a ticket granting ticket. The routines take \fIwho\fP, the DN
|
||||
of the entry to bind as. The
|
||||
.B ldap_kerberos_bind_s()
|
||||
routine does both steps of the Kerberos binding process synchronously. The
|
||||
.B ldap_kerberos_bind1_s()
|
||||
and
|
||||
.B ldap_kerberos_bind2_s()
|
||||
routines allow synchronous access to the
|
||||
individual steps, authenticating to the LDAP server and X.500 DSA, respectively.
|
||||
The
|
||||
.B ldap_kerberos_bind1()
|
||||
and
|
||||
.B ldap_kerberos_bind2()
|
||||
routines provide equivalent asynchronous access.
|
||||
.LP
|
||||
The
|
||||
.B ldap_kerberos_bind_s()
|
||||
routine is used to perform both authentication steps when contacting
|
||||
an LDAP server that is a gateway to an X.500 DSA. This kind of server
|
||||
configuration is only supported in the (very old) University of Michigan LDAP
|
||||
release. The OpenLDAP package no longer provides this gateway server.
|
||||
The standalone LDAP server provided in OpenLDAP may still be configured
|
||||
with Kerberos version 4 support, but it only requires one authentication
|
||||
step, and will return an error if the second step is attempted. Therefore,
|
||||
only the
|
||||
.B ldap_kerberos_bind1()
|
||||
routine or its synchronous equivalent may be used when contacting an
|
||||
OpenLDAP server.
|
||||
.SH GENERAL AUTHENTICATION
|
||||
The
|
||||
.B ldap_bind()
|
||||
|
|
@ -152,10 +102,8 @@ and
|
|||
routines can be used when the
|
||||
authentication method to use needs to be selected at runtime. They
|
||||
both take an extra \fImethod\fP parameter selecting the authentication
|
||||
method to use. It should be set to one of LDAP_AUTH_SIMPLE,
|
||||
LDAP_AUTH_KRBV41, or LDAP_AUTH_KRBV42, to select simple authentication,
|
||||
Kerberos authentication to the LDAP server, or Kerberos authentication
|
||||
to the X.500 DSA, respectively.
|
||||
method to use. It should be set to LDAP_AUTH_SIMPLE
|
||||
to select simple authentication.
|
||||
.B ldap_bind()
|
||||
returns the message id of the request it initiates.
|
||||
.B ldap_bind_s()
|
||||
|
|
|
|||
|
|
@ -3,11 +3,6 @@ ldap_simple_bind.3
|
|||
ldap_simple_bind_s.3
|
||||
ldap_sasl_bind.3
|
||||
ldap_sasl_bind_s.3
|
||||
ldap_kerberos_bind_s.3
|
||||
ldap_kerberos_bind1.3
|
||||
ldap_kerberos_bind1_s.3
|
||||
ldap_kerberos_bind2.3
|
||||
ldap_kerberos_bind2_s.3
|
||||
ldap_unbind.3
|
||||
ldap_unbind_ext.3
|
||||
ldap_unbind_s.3
|
||||
|
|
|
|||
|
|
@ -409,8 +409,6 @@ disallow (default none).
|
|||
disables acceptance of anonymous bind requests.
|
||||
.B bind_simple
|
||||
disables simple (bind) authentication.
|
||||
.B bind_krbv4
|
||||
disables Kerberos V4 (bind) authentication.
|
||||
.B tls_2_anon
|
||||
disables Start TLS from forcing session to anonymous status (see also
|
||||
.BR tls_authc ).
|
||||
|
|
@ -842,11 +840,6 @@ The default is 262143.
|
|||
Specify the maximum incoming LDAP PDU size for authenticated sessions.
|
||||
The default is 4194303.
|
||||
.TP
|
||||
.B srvtab <filename>
|
||||
Specify the srvtab file in which the kerberos keys necessary for
|
||||
authenticating clients using kerberos can be found. This option is only
|
||||
meaningful if you are using Kerberos authentication.
|
||||
.TP
|
||||
.B threads <integer>
|
||||
Specify the maximum size of the primary thread pool.
|
||||
The default is 16.
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ slurpd \- Standalone LDAP Update Replication Daemon
|
|||
.SH SYNOPSIS
|
||||
.B LIBEXECDIR/slurpd [\-d debug\-level]
|
||||
.B [\-f slapd\-config\-file] [\-r slapd\-replog\-file]
|
||||
.B [\-t temp\-dir] [\-o] [\-k srvtab\-file]
|
||||
.B [\-t temp\-dir] [\-o]
|
||||
.B
|
||||
.SH DESCRIPTION
|
||||
.LP
|
||||
|
|
@ -121,15 +121,6 @@ temporary files may contain sensitive information.
|
|||
This option allows you to specify the location of these temporary files.
|
||||
The default is
|
||||
.BR LOCALSTATEDIR/openldap-slurp .
|
||||
.TP
|
||||
.BI \-k " srvtab\-file"
|
||||
Specify the location of the kerberos srvtab file which contains keys
|
||||
for the replica
|
||||
.I slapd
|
||||
instances. Overrides the srvtab argument to the
|
||||
replica directive in the
|
||||
.I slapd
|
||||
configuration file.
|
||||
.SH EXAMPLES
|
||||
To start
|
||||
.I slurpd
|
||||
|
|
|
|||
Loading…
Reference in a new issue