Qpsmtpd:auth/auth ldap bind

Qpsmtpd#Plugins

NAME

auth_ldap_bind - Authenticate user via an LDAP bind

DESCRIPTION

This plugin authenticates users against an LDAP Directory. The plugin first performs a lookup for an entry matching the connecting user. This lookup uses the 'ldap_auth_filter_attr' attribute to match the connecting user to their LDAP DN. Once the plugin has found the user's DN, the plugin will attempt to bind to the Directory as that DN with the password that has been supplied.

CONFIGURATION

Configuration items can be held in either the 'ldap' configuration file, or as arguments to the plugin.

Configuration items in the 'ldap' configuration file are set one per line, starting the line with the configuration item key, followed by a space, then the values associated with the configuration item.

Configuration items given as arguments to the plugin are keys and values separated by spaces. Be sure to quote any values that have spaces in them.

The only configuration item which is required is 'ldap_base'. This tells the plugin what your base DN is. The plugin will not work until it has been configured.

The configuration items 'ldap_host' and 'ldap_port' specify the host and port at which your Directory server may be contacted. If these are not specified, the plugin will use port '389' on 'localhost'.

The configuration item 'ldap_timeout' specifies how long the plugin should wait for a response from your Directory server. By default, the value is 5 seconds.

The configuration item 'ldap_auth_filter_attr' specifies how the plugin should find the user in your Directory. By default, the plugin will look up the user based on the 'uid' attribute.

NOTES

Each auth requires an initial lookup to find the user's DN. Ideally, the plugin would simply bind as the user without the need for this lookup (see FUTURE DIRECTION below).

This plugin requires that the Directory allow anonymous bind (see FUTURE DIRECTION below).

FUTURE DIRECTION

A configurable LDAP filter should be made available, to account for users who are over quota, have had their accounts disabled, or whatever other arbitrary requirements.

A configurable DN template (uid=$USER,ou=$DOMAIN,$BASE). This would prevent the need of the initial user lookup, as the DN is created from the template.

A configurable bind DN, for Directories that do not allow anonymous bind.

Another plugin ('ldap_auth_cleartext'?), to allow retrieval of plain-text passwords from the Directory, permitting CRAM-MD5 or other hash algorithm authentication.

AUTHOR

Elliot Foster <elliotf@gratuitous.net>

COPYRIGHT AND LICENSE

Copyright (c) 2005 Elliot Foster

This plugin is licensed under the same terms as the qpsmtpd package itself. Please see the LICENSE file included with qpsmtpd for details.

---