1.\" $OpenBSD: ldapd.8,v 1.12 2014/08/11 08:21:55 jmc Exp $ 2.\" 3.\" Copyright (c) 2009, 2010 Martin Hedenfalk <martin@bzero.se> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.Dd $Mdocdate: August 11 2014 $ 18.Dt LDAPD 8 19.Os 20.Sh NAME 21.Nm ldapd 22.Nd Lightweight Directory Access Protocol daemon 23.Sh SYNOPSIS 24.Nm ldapd 25.Op Fl dnv 26.Oo 27.Fl D Ar macro Ns = Ns Ar value 28.Oc 29.Op Fl f Ar file 30.Op Fl s Ar file 31.Sh DESCRIPTION 32.Nm 33is a daemon which implements version 3 of the LDAP protocol. 34.Pp 35A running 36.Nm 37process can be controlled using the 38.Xr ldapctl 8 39utility. 40.Pp 41The options are as follows: 42.Bl -tag -width Ds 43.It Fl D Ar macro Ns = Ns Ar value 44Define 45.Ar macro 46to be set to 47.Ar value 48on the command line. 49Overrides the definition of 50.Ar macro 51in the configuration file. 52.It Fl d 53Do not daemonize and log to 54.Em stderr . 55.It Fl f Ar file 56Use 57.Ar file 58as the configuration file, instead of the default 59.Pa /etc/ldapd.conf . 60.It Fl n 61Configtest mode. 62Only check the configuration file for validity. 63.It Fl s Ar file 64Specify an alternative location for the socket file. 65.It Fl v 66Produce more verbose output. 67A second 68.Fl v 69together with the 70.Fl d 71flag produces debug traces of decoded BER messages on stderr. 72.El 73.Sh AUTHENTICATION 74.Nm 75can authenticate users via simple binds or SASL with the PLAIN 76mechanism. 77.Pp 78When using simple binds, the bind DN entry must exist in a namespace 79and have a 80.Ic userPassword 81attribute. 82The following formats of the 83.Ic userPassword 84attribute are recognized: 85.Bl -tag -width Ds 86.It Ic {SHA}digest 87Verify the password against the SHA-1 digest. 88.It Ic {SSHA}digest 89Verify the password against the salted SHA-1 digest. 90.It Ic {CRYPT}hash 91Verify the password against the 92.Xr crypt 3 93hash. 94.It Ic {BSDAUTH}username 95Use 96.Bx 97Authentication with the given username and authentication style 98.Dq auth-ldap . 99This is similar to using SASL PLAIN authentication with 100.Ar username 101as the authentication ID. 102.It Ic {BSDAUTH}username#class 103Same as above, but overrides the login class. 104.El 105.Pp 106Without a prefix, the 107.Ic userPassword 108attribute is compared literally with the provided plain text password. 109.Pp 110When using SASL binds, the authentication ID should be a valid 111username for 112.Bx 113Authentication. 114.Pp 115For plain text passwords to be accepted, the connection must be 116considered secure, either by using an encrypted connection, or by 117using the 118.Ic secure 119keyword in the configuration file. 120.Sh FILES 121.Bl -tag -width "/var/run/ldapd.sockXXXXXXX" -compact 122.It Pa /etc/ldapd.conf 123default 124.Nm 125configuration file 126.It Pa /var/run/ldapd.sock 127default 128.Nm 129control socket 130.It Pa /var/db/ldap/*.db 131.Nm 132database files 133.El 134.Sh SEE ALSO 135.Xr ldapd.conf 5 , 136.Xr login.conf 5 , 137.Xr ldapctl 8 138.Sh STANDARDS 139.Rs 140.%A J. Sermersheim 141.%D June 2006 142.%R RFC 4511 143.%T Lightweight Directory Access Protocol (LDAP): The Protocol 144.Re 145.Pp 146.Rs 147.%A K. Zeilenga 148.%D June 2006 149.%R RFC 4512 150.%T Lightweight Directory Access Protocol (LDAP): Directory Information Models 151.Re 152.Sh HISTORY 153The 154.Nm 155program first appeared in 156.Ox 4.8 . 157.Sh CAVEATS 158.Nm 159is not yet fully LDAPv3 compliant. 160.Pp 161Database files are not expected to work across architectures and may 162not work across versions. 163