3.3. Setting up LDAP Authentication

The way it works There's not one way of doing LDAP authentication, and you will need to know how LDAP is configured on your server to be able to configure it for TUTOS. The sheme is always the same, you send the user name and password to the server, and it will accept or reject the connection. But here's 3 differents ways of doing that with a LDAP server :

How to configure it

After reading the first part, the config options should be easy to set up. So here are the parts of the config file to edit :

Example 3-1. config.pinc : enable the LDAP authentication

# LDAP configuration

#

# 0 = check standard database

# 1 = check ldauthserver for password verification 

$tutos[ldapauth] = 0;

Example 3-2. config.pinc : say if the passwords are encrypted or not

# encrypted passwords 

# 1 = yes

$tutos[ldapauth_pw_enc] = 1;

Example 3-3. config.pinc : The server host and port parameters...

$tutos[ldapauthserver]['host'] = "scd2ldap.siemens.net";
$tutos[ldapauthserver]['port'] = 389;

Example 3-4. config.pinc : LDAP paths

$tutos[ldapauthserver]['basedn'] =  "ou=mail,ou=user,o=cvf";
$tutos[ldapauthserver]['userdn'] = "uid";

LDAP paths, without such an info you can't find the user infos on the server. If you don't know those values, just ask your LDAP admin. Here the userdn is the last part of the DN, in the example given we would find : uid=username,ou=mail,ou=user,o=cvf We still have to separate those values because of the way LDAP search and binding works.

Example 3-5. config.pinc : LDAP auth for server connection

# use given user/passwd pair to bind the LDAP server 
# 0 = no
# 1 = yes

$tutos[ldapauth_user] = 0;

If you set this option, we will use the user name and password to connect to the LDAP tree.

Example 3-6. config.pinc : LDAP anonymous server connection

# do anonymous bind to ldpauthserver
# 1 = yes
# 0 = use tutos[ldapauthserver]['binddn']
#     and tutos[ldapauthserver]['passwd']
$tutos[ldapauth_anonymous] = 1;

Here you can choose to make an anonymous bind to the LDAP server...

Example 3-7. config.pinc : LDAP anonymous server connection

$tutos[ldapauthserver]['binddn'] = "ou=adminprs,ou=ldap,ou=user,o=cvf";
$tutos[ldapauthserver]['passwd'] = "Psyche";

In the case you would have to bind the LDAP server as an admin, you will have to provide another LDAP path, wich correspond to the admin (or say, privileged user) username. Then there is his password.