1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
|
.\" $OpenBSD: ypldap.conf.5,v 1.16 2010/06/03 16:10:21 ajacoutot Exp $
.\"
.\" Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
.\"
.\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.Dd $Mdocdate: June 3 2010 $
.Dt YPLDAP.CONF 5
.Os
.Sh NAME
.Nm ypldap.conf
.Nd LDAP YP map daemon configuration file
.Sh DESCRIPTION
The
.Xr ypldap 8
daemon provides YP maps using LDAP as a backend.
.Sh SECTIONS
The
.Nm
config file is divided into three main sections.
.Bl -tag -width xxxx
.It Sy Macros
User-defined variables may be defined and used later, simplifying the
configuration file.
.It Sy Global Configuration
Global settings for
.Xr ypldap 8 .
.It Sy Directories
LDAP Directory specific parameters.
.El
.Sh MACROS
Much like
.Xr cpp 1
or
.Xr m4 1 ,
macros can be defined that will later be expanded in context.
Macro names must start with a letter, and may contain letters, digits,
and underscores.
Macro names may not be reserved words (for example,
.Ic domain ) .
Macros are not expanded inside quotes.
.Pp
For example:
.Bd -literal -offset indent
fixed_gecos="Pulled from LDAP"
fixed attribute gecos $fixed_gecos
.Ed
.Sh GLOBAL CONFIGURATION
Global settings concern the main behaviour of the daemon.
.Pp
.Bl -tag -width Ds -compact
.It domain Ar string
Specify the name of the NIS domain
.Nm
will provide.
.It interval Ar seconds
Specify the interval in seconds at which the whole directory will be pulled
from LDAP.
.It provide map Ar string
Specify a map that should be provided by
.Nm
The currently implemented maps are: passwd.byname, passwd.byuid,
group.byname, group.bygid.
.El
.Sh DIRECTORIES
Directories are used to describe the LDAP schema and help
.Nm
convert LDAP entries to
.Xr passwd 5 ,
.Xr master.passwd 5 ,
and
.Xr group 5
lines.
A directory declaration is of the following form:
.Bd -literal -offset indent
directory "some.host" {
# directives
}
.Ed
.Pp
Valid directives for directories are:
.Bl -tag -width Ds
.It Xo
.Ic attribute Ar name Ic maps to Ar string
.Xc
Map the
.Xr passwd 5 ,
.Xr master.passwd 5 ,
or
.Xr group 5
attribute to the LDAP attribute name supplied.
.It Ic basedn Ar string
Use the supplied search base as starting point for the directory search.
.It Ic bindcred Ar string
Use the supplied credentials for simple authentication against the directory.
.It Ic binddn Ar string
Use the supplied Distinguished Name to bind to the directory.
.It Ic fixed attribute Ar attribute string
Do not retrieve the specified attribute from LDAP but
instead set it unconditionally to the supplied value for
every entry.
.It Ic group filter Ar string
Use the supplied LDAP filter to retrieve group entries.
.It Xo
.Ic list Ar name Ic maps to Ar string
.Xc
Map the
.Xr passwd 5 ,
.Xr master.passwd 5 ,
or
.Xr group 5
attribute to the LDAP attribute name supplied.
A list creates a comma separated list of all the LDAP attributes found.
.Pp
Valid attributes are:
.Pp
.Bl -tag -width groupmembers -offset indent -compact
.It Ic name
.It Ic passwd
.It Ic uid
.It Ic gid
.It Ic gecos
.It Ic home
.It Ic shell
.It Ic change
.It Ic expire
.It Ic class
.It Ic groupname
.It Ic grouppasswd
.It Ic groupgid
.It Ic groupmembers
.El
.It Ic passwd filter Ar string
Use the supplied LDAP filter to retrieve password entries.
.El
.Sh DIRECTORY EXAMPLE
This configuration searches the LDAP directory 127.0.0.1 for users and groups.
On the LDAP side the RFC 2307 object classes posixAccount and posixGroup
are used.
In this example the attributes are either mapped to
their corresponding LDAP attributes or a fixed value.
A list directive is used for the groupmembers attribute
because the ldap memberUid returns multiple group members.
.Bd -literal -offset indent
directory "127.0.0.1" {
# directory options
binddn "cn=Manager,dc=openbsd,dc=org"
bindcred "secret"
basedn "ou=Users,dc=openbsd,dc=org"
# passwd maps configuration
passwd filter "(objectClass=posixAccount)"
attribute name maps to "uid"
fixed attribute passwd "*"
attribute uid maps to "uidNumber"
attribute gid maps to "gidNumber"
attribute gecos maps to "cn"
attribute home maps to "homeDirectory"
attribute shell maps to "loginShell"
fixed attribute change "0"
fixed attribute expire "0"
fixed attribute class "ldap"
# group maps configuration
group filter "(objectClass=posixGroup)"
attribute groupname maps to "cn"
fixed attribute grouppasswd "*"
attribute groupgid maps to "gidNumber"
list groupmembers maps to "memberUid"
}
.Ed
.Sh FILES
.Bl -tag -width "/etc/ypldap.conf" -compact
.It Pa /etc/ypldap.conf
.Xr ypldap 8
configuration file.
.El
.Sh SEE ALSO
.Xr ypbind 8 ,
.Xr ypldap 8 ,
.Xr ypserv 8
.Sh HISTORY
The
.Nm
file format first appeared in
.Ox 4.4 .
|
