mirror of
https://github.com/apache/httpd.git
synced 2025-04-20 09:47:47 +03:00
01055edef2
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1907148 13f79535-47bb-0310-9956-ffa450edef68
882 lines
54 KiB
XML
882 lines
54 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
|
||
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type" />
|
||
<!--
|
||
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||
This file is generated from xml source: DO NOT EDIT
|
||
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||
-->
|
||
<title>mod_ldap - Apache HTTP Server Version 2.5</title>
|
||
<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
|
||
<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
|
||
<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" />
|
||
<script src="../style/scripts/prettify.min.js" type="text/javascript">
|
||
</script>
|
||
|
||
<link href="../images/favicon.ico" rel="shortcut icon" /></head>
|
||
<body>
|
||
<div id="page-header">
|
||
<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
|
||
<p class="apache">Apache HTTP Server Version 2.5</p>
|
||
<img alt="" src="../images/feather.png" /></div>
|
||
<div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div>
|
||
<div id="path">
|
||
<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.5</a> > <a href="./">Modules</a></div>
|
||
<div id="page-content">
|
||
<div id="preamble"><h1>Apache Module mod_ldap</h1>
|
||
<div class="toplang">
|
||
<p><span>Available Languages: </span><a href="../en/mod/mod_ldap.html" title="English"> en </a> |
|
||
<a href="../fr/mod/mod_ldap.html" hreflang="fr" rel="alternate" title="Français"> fr </a></p>
|
||
</div>
|
||
<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>LDAP connection pooling and result caching services for use
|
||
by other LDAP modules</td></tr>
|
||
<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>ldap_module</td></tr>
|
||
<tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>util_ldap.c</td></tr></table>
|
||
<h3>Summary</h3>
|
||
|
||
<p>This module was created to improve the performance of
|
||
websites relying on backend connections to LDAP servers. In
|
||
addition to the functions provided by the standard LDAP
|
||
libraries, this module adds an LDAP connection pool and an LDAP
|
||
shared memory cache.</p>
|
||
|
||
<p>To enable this module, LDAP support must be compiled into
|
||
apr-util. This is achieved by adding the <code>--with-ldap</code>
|
||
flag to the <code class="program"><a href="../programs/configure.html">configure</a></code> script when building
|
||
Apache.</p>
|
||
|
||
<p>SSL/TLS support is dependent on which LDAP toolkit has been
|
||
linked to <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a>. As of this writing, APR-util supports:
|
||
<a href="http://www.openldap.org/">OpenLDAP SDK</a> (2.x or later),
|
||
<a href="http://developer.novell.com/ndk/cldap.htm">Novell LDAP
|
||
SDK</a>, <a href="https://wiki.mozilla.org/LDAP_C_SDK">
|
||
Mozilla LDAP SDK</a>, native Solaris LDAP SDK (Mozilla based) or the
|
||
native Microsoft LDAP SDK. See the <a href="http://apr.apache.org">APR</a>
|
||
website for details.</p>
|
||
|
||
</div>
|
||
<div id="quickview"><h3>Topics</h3>
|
||
<ul id="topics">
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#exampleconfig">Example Configuration</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#pool">LDAP Connection Pool</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#cache">LDAP Cache</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#usingssltls">Using SSL/TLS</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#settingcerts">SSL/TLS Certificates</a></li>
|
||
</ul><h3 class="directives">Directives</h3>
|
||
<ul id="toc">
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapcacheentries">LDAPCacheEntries</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapcachettl">LDAPCacheTTL</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapconnectionpoolttl">LDAPConnectionPoolTTL</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapconnectiontimeout">LDAPConnectionTimeout</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldaplibrarydebug">LDAPLibraryDebug</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapopcacheentries">LDAPOpCacheEntries</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapopcachettl">LDAPOpCacheTTL</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapreferralhoplimit">LDAPReferralHopLimit</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapreferrals">LDAPReferrals</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapretries">LDAPRetries</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapretrydelay">LDAPRetryDelay</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapsharedcachefile">LDAPSharedCacheFile</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapsharedcachesize">LDAPSharedCacheSize</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldaptimeout">LDAPTimeout</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldaptrustedclientcert">LDAPTrustedClientCert</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldaptrustedglobalcert">LDAPTrustedGlobalCert</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldaptrustedmode">LDAPTrustedMode</a></li>
|
||
<li><img alt="" src="../images/down.gif" /> <a href="#ldapverifyservercert">LDAPVerifyServerCert</a></li>
|
||
</ul>
|
||
<h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&list_id=144532&product=Apache%20httpd-2&query_format=specific&order=changeddate%20DESC%2Cpriority%2Cbug_severity&component=mod_ldap">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&component=mod_ldap">Report a bug</a></li></ul><h3>See also</h3>
|
||
<ul class="seealso">
|
||
<li><a href="#comments_section">Comments</a></li></ul></div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="section">
|
||
<h2><a name="exampleconfig" id="exampleconfig">Example Configuration</a> <a title="Permanent link" href="#exampleconfig" class="permalink">¶</a></h2>
|
||
<p>The following is an example configuration that uses
|
||
<code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> to increase the performance of HTTP Basic
|
||
authentication provided by <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code>.</p>
|
||
|
||
<pre class="prettyprint lang-config"># Enable the LDAP connection pool and shared
|
||
# memory cache. Enable the LDAP cache status
|
||
# handler. Requires that mod_ldap and mod_authnz_ldap
|
||
# be loaded. Change the "yourdomain.example.com" to
|
||
# match your domain.
|
||
|
||
LDAPSharedCacheSize 500000
|
||
LDAPCacheEntries 1024
|
||
LDAPCacheTTL 600
|
||
LDAPOpCacheEntries 1024
|
||
LDAPOpCacheTTL 600
|
||
|
||
<Location "/ldap-status">
|
||
SetHandler ldap-status
|
||
|
||
Require host yourdomain.example.com
|
||
|
||
Satisfy any
|
||
AuthType Basic
|
||
AuthName "LDAP Protected"
|
||
AuthBasicProvider ldap
|
||
AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one
|
||
Require valid-user
|
||
</Location></pre>
|
||
|
||
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="section">
|
||
<h2><a name="pool" id="pool">LDAP Connection Pool</a> <a title="Permanent link" href="#pool" class="permalink">¶</a></h2>
|
||
|
||
<p>LDAP connections are pooled from request to request. This
|
||
allows the LDAP server to remain connected and bound ready for
|
||
the next request, without the need to unbind/connect/rebind.
|
||
The performance advantages are similar to the effect of HTTP
|
||
keepalives.</p>
|
||
|
||
<p>On a busy server it is possible that many requests will try
|
||
and access the same LDAP server connection simultaneously.
|
||
Where an LDAP connection is in use, Apache will create a new
|
||
connection alongside the original one. This ensures that the
|
||
connection pool does not become a bottleneck.</p>
|
||
|
||
<p>There is no need to manually enable connection pooling in
|
||
the Apache configuration. Any module using this module for
|
||
access to LDAP services will share the connection pool.</p>
|
||
|
||
<p>LDAP connections can keep track of the ldap client
|
||
credentials used when binding to an LDAP server. These
|
||
credentials can be provided to LDAP servers that do not
|
||
allow anonymous binds during referral chasing. To control
|
||
this feature, see the
|
||
<code class="directive"><a href="#ldapreferrals">LDAPReferrals</a></code> and
|
||
<code class="directive"><a href="#ldapreferralhoplimit">LDAPReferralHopLimit</a></code>
|
||
directives. By default, this feature is enabled.</p>
|
||
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="section">
|
||
<h2><a name="cache" id="cache">LDAP Cache</a> <a title="Permanent link" href="#cache" class="permalink">¶</a></h2>
|
||
|
||
<p>For improved performance, <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> uses an aggressive
|
||
caching strategy to minimize the number of times that the LDAP
|
||
server must be contacted. Caching can easily double or triple
|
||
the throughput of Apache when it is serving pages protected
|
||
with <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code>. In addition, the load on the LDAP server
|
||
will be significantly decreased.</p>
|
||
|
||
<p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> supports two types of LDAP caching during
|
||
the search/bind phase with a <em>search/bind cache</em> and
|
||
during the compare phase with two <em>operation
|
||
caches</em>. Each LDAP URL that is used by the server has
|
||
its own set of these three caches.</p>
|
||
|
||
<h3><a name="search-bind" id="search-bind">The Search/Bind Cache</a></h3>
|
||
<p>The process of doing a search and then a bind is the
|
||
most time-consuming aspect of LDAP operation, especially if
|
||
the directory is large. The search/bind cache is used to
|
||
cache all searches that resulted in successful binds.
|
||
Negative results (<em>i.e.</em>, unsuccessful searches, or searches
|
||
that did not result in a successful bind) are not cached.
|
||
The rationale behind this decision is that connections with
|
||
invalid credentials are only a tiny percentage of the total
|
||
number of connections, so by not caching invalid
|
||
credentials, the size of the cache is reduced.</p>
|
||
|
||
<p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> stores the username, the DN
|
||
retrieved, the password used to bind, and the time of the bind
|
||
in the cache. Whenever a new connection is initiated with the
|
||
same username, <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> compares the password
|
||
of the new connection with the password in the cache. If the
|
||
passwords match, and if the cached entry is not too old,
|
||
<code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> bypasses the search/bind phase.</p>
|
||
|
||
<p>The search and bind cache is controlled with the <code class="directive"><a href="#ldapcacheentries">LDAPCacheEntries</a></code> and <code class="directive"><a href="#ldapcachettl">LDAPCacheTTL</a></code> directives.</p>
|
||
|
||
|
||
<h3><a name="opcaches" id="opcaches">Operation Caches</a></h3>
|
||
<p>During attribute and distinguished name comparison
|
||
functions, <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> uses two operation caches
|
||
to cache the compare operations. The first compare cache is
|
||
used to cache the results of compares done to test for LDAP
|
||
group membership. The second compare cache is used to cache
|
||
the results of comparisons done between distinguished
|
||
names.</p>
|
||
|
||
<p>Note that, when group membership is being checked, any sub-group
|
||
comparison results are cached to speed future sub-group comparisons.</p>
|
||
|
||
<p>The behavior of both of these caches is controlled with
|
||
the <code class="directive"><a href="#ldapopcacheentries">LDAPOpCacheEntries</a></code>
|
||
and <code class="directive"><a href="#ldapopcachettl">LDAPOpCacheTTL</a></code>
|
||
directives.</p>
|
||
|
||
|
||
<h3><a name="monitoring" id="monitoring">Monitoring the Cache</a></h3>
|
||
<p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> has a content handler that allows
|
||
administrators to monitor the cache performance. The name of
|
||
the content handler is <code>ldap-status</code>, so the
|
||
following directives could be used to access the
|
||
<code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> cache information:</p>
|
||
|
||
<pre class="prettyprint lang-config"><Location "/server/cache-info">
|
||
SetHandler ldap-status
|
||
</Location></pre>
|
||
|
||
|
||
<p>By fetching the URL <code>http://servername/cache-info</code>,
|
||
the administrator can get a status report of every cache that is used
|
||
by <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> cache. Note that if Apache does not
|
||
support shared memory, then each <code class="program"><a href="../programs/httpd.html">httpd</a></code> instance has its
|
||
own cache, so reloading the URL will result in different
|
||
information each time, depending on which <code class="program"><a href="../programs/httpd.html">httpd</a></code>
|
||
instance processes the request.</p>
|
||
|
||
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="section">
|
||
<h2><a name="usingssltls" id="usingssltls">Using SSL/TLS</a> <a title="Permanent link" href="#usingssltls" class="permalink">¶</a></h2>
|
||
|
||
<p>The ability to create an SSL and TLS connections to an LDAP server
|
||
is defined by the directives
|
||
<code class="directive"><a href="#ldaptrustedglobalcert">LDAPTrustedGlobalCert</a></code>,
|
||
<code class="directive"><a href="#ldaptrustedclientcert">LDAPTrustedClientCert</a></code>
|
||
and <code class="directive"><a href="#ldaptrustedmode">LDAPTrustedMode</a></code>.
|
||
These directives specify the CA and optional client certificates to be used,
|
||
as well as the type of encryption to be used on the connection (none, SSL or
|
||
TLS/STARTTLS).</p>
|
||
|
||
<pre class="prettyprint lang-config"># Establish an SSL LDAP connection on port 636. Requires that
|
||
# mod_ldap and mod_authnz_ldap be loaded. Change the
|
||
# "yourdomain.example.com" to match your domain.
|
||
|
||
LDAPTrustedGlobalCert CA_DER /certs/certfile.der
|
||
|
||
<Location "/ldap-status">
|
||
SetHandler ldap-status
|
||
|
||
Require host yourdomain.example.com
|
||
|
||
Satisfy any
|
||
AuthType Basic
|
||
AuthName "LDAP Protected"
|
||
AuthBasicProvider ldap
|
||
AuthLDAPURL ldaps://127.0.0.1/dc=example,dc=com?uid?one
|
||
Require valid-user
|
||
</Location></pre>
|
||
|
||
|
||
<pre class="prettyprint lang-config"># Establish a TLS LDAP connection on port 389. Requires that
|
||
# mod_ldap and mod_authnz_ldap be loaded. Change the
|
||
# "yourdomain.example.com" to match your domain.
|
||
|
||
LDAPTrustedGlobalCert CA_DER /certs/certfile.der
|
||
|
||
<Location "/ldap-status">
|
||
SetHandler ldap-status
|
||
|
||
Require host yourdomain.example.com
|
||
|
||
Satisfy any
|
||
AuthType Basic
|
||
AuthName "LDAP Protected"
|
||
AuthBasicProvider ldap
|
||
AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one TLS
|
||
Require valid-user
|
||
</Location></pre>
|
||
|
||
|
||
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="section">
|
||
<h2><a name="settingcerts" id="settingcerts">SSL/TLS Certificates</a> <a title="Permanent link" href="#settingcerts" class="permalink">¶</a></h2>
|
||
|
||
<p>The different LDAP SDKs have widely different methods of setting
|
||
and handling both CA and client side certificates.</p>
|
||
|
||
<p>If you intend to use SSL or TLS, read this section CAREFULLY so as to
|
||
understand the differences between configurations on the different LDAP
|
||
toolkits supported.</p>
|
||
|
||
<h3><a name="settingcerts-netscape" id="settingcerts-netscape">Netscape/Mozilla/iPlanet SDK</a></h3>
|
||
<p>CA certificates are specified within a file called cert7.db.
|
||
The SDK will not talk to any LDAP server whose certificate was
|
||
not signed by a CA specified in this file. If
|
||
client certificates are required, an optional key3.db file may
|
||
be specified with an optional password. The secmod file can be
|
||
specified if required. These files are in the same format as
|
||
used by the Netscape Communicator or Mozilla web browsers. The easiest
|
||
way to obtain these files is to grab them from your browser
|
||
installation.</p>
|
||
|
||
<p>Client certificates are specified per connection using the
|
||
<code class="directive"><a href="#ldaptrustedclientcert">LDAPTrustedClientCert</a></code>
|
||
directive by referring
|
||
to the certificate "nickname". An optional password may be
|
||
specified to unlock the certificate's private key.</p>
|
||
|
||
<p>The SDK supports SSL only. An attempt to use STARTTLS will cause
|
||
an error when an attempt is made to contact the LDAP server at
|
||
runtime.</p>
|
||
|
||
<pre class="prettyprint lang-config"># Specify a Netscape CA certificate file
|
||
LDAPTrustedGlobalCert CA_CERT7_DB /certs/cert7.db
|
||
# Specify an optional key3.db file for client certificate support
|
||
LDAPTrustedGlobalCert CERT_KEY3_DB /certs/key3.db
|
||
# Specify the secmod file if required
|
||
LDAPTrustedGlobalCert CA_SECMOD /certs/secmod
|
||
<Location "/ldap-status">
|
||
SetHandler ldap-status
|
||
|
||
Require host yourdomain.example.com
|
||
|
||
Satisfy any
|
||
AuthType Basic
|
||
AuthName "LDAP Protected"
|
||
AuthBasicProvider ldap
|
||
LDAPTrustedClientCert CERT_NICKNAME <nickname> [password]
|
||
AuthLDAPURL ldaps://127.0.0.1/dc=example,dc=com?uid?one
|
||
Require valid-user
|
||
</Location></pre>
|
||
|
||
|
||
|
||
|
||
<h3><a name="settingcerts-novell" id="settingcerts-novell">Novell SDK</a></h3>
|
||
|
||
<p>One or more CA certificates must be specified for the Novell
|
||
SDK to work correctly. These certificates can be specified as
|
||
binary DER or Base64 (PEM) encoded files.</p>
|
||
|
||
<p>Note: Client certificates are specified globally rather than per
|
||
connection, and so must be specified with the <code class="directive"><a href="#ldaptrustedglobalcert">LDAPTrustedGlobalCert</a></code>
|
||
directive as below. Trying to set client certificates via the
|
||
<code class="directive"><a href="#ldaptrustedclientcert">LDAPTrustedClientCert</a></code>
|
||
directive will cause an error to be logged
|
||
when an attempt is made to connect to the LDAP server.</p>
|
||
|
||
<p>The SDK supports both SSL and STARTTLS, set using the
|
||
<code class="directive"><a href="#ldaptrustedmode">LDAPTrustedMode</a></code> parameter.
|
||
If an ldaps:// URL is specified,
|
||
SSL mode is forced, override this directive.</p>
|
||
|
||
<pre class="prettyprint lang-config"># Specify two CA certificate files
|
||
LDAPTrustedGlobalCert CA_DER /certs/cacert1.der
|
||
LDAPTrustedGlobalCert CA_BASE64 /certs/cacert2.pem
|
||
# Specify a client certificate file and key
|
||
LDAPTrustedGlobalCert CERT_BASE64 /certs/cert1.pem
|
||
LDAPTrustedGlobalCert KEY_BASE64 /certs/key1.pem [password]
|
||
# Do not use this directive, as it will throw an error
|
||
#LDAPTrustedClientCert CERT_BASE64 /certs/cert1.pem</pre>
|
||
|
||
|
||
|
||
|
||
<h3><a name="settingcerts-openldap" id="settingcerts-openldap">OpenLDAP SDK</a></h3>
|
||
|
||
<p>One or more CA certificates must be specified for the OpenLDAP
|
||
SDK to work correctly. These certificates can be specified as
|
||
binary DER or Base64 (PEM) encoded files.</p>
|
||
|
||
<p>Both CA and client certificates may be specified globally
|
||
(<code class="directive"><a href="#ldaptrustedglobalcert">LDAPTrustedGlobalCert</a></code>) or
|
||
per-connection (<code class="directive"><a href="#ldaptrustedclientcert">LDAPTrustedClientCert</a></code>).
|
||
When any settings are specified per-connection, the global
|
||
settings are superseded.</p>
|
||
|
||
<p>The documentation for the SDK claims to support both SSL and
|
||
STARTTLS, however STARTTLS does not seem to work on all versions
|
||
of the SDK. The SSL/TLS mode can be set using the
|
||
LDAPTrustedMode parameter. If an ldaps:// URL is specified,
|
||
SSL mode is forced. The OpenLDAP documentation notes that SSL
|
||
(ldaps://) support has been deprecated to be replaced with TLS,
|
||
although the SSL functionality still works.</p>
|
||
|
||
<pre class="prettyprint lang-config"># Specify two CA certificate files
|
||
LDAPTrustedGlobalCert CA_DER /certs/cacert1.der
|
||
LDAPTrustedGlobalCert CA_BASE64 /certs/cacert2.pem
|
||
<Location "/ldap-status">
|
||
SetHandler ldap-status
|
||
|
||
Require host yourdomain.example.com
|
||
|
||
LDAPTrustedClientCert CERT_BASE64 /certs/cert1.pem
|
||
LDAPTrustedClientCert KEY_BASE64 /certs/key1.pem
|
||
# CA certs respecified due to per-directory client certs
|
||
LDAPTrustedClientCert CA_DER /certs/cacert1.der
|
||
LDAPTrustedClientCert CA_BASE64 /certs/cacert2.pem
|
||
Satisfy any
|
||
AuthType Basic
|
||
AuthName "LDAP Protected"
|
||
AuthBasicProvider ldap
|
||
AuthLDAPURL ldaps://127.0.0.1/dc=example,dc=com?uid?one
|
||
Require valid-user
|
||
</Location></pre>
|
||
|
||
|
||
|
||
|
||
<h3><a name="settingcerts-solaris" id="settingcerts-solaris">Solaris SDK</a></h3>
|
||
|
||
<p>SSL/TLS for the native Solaris LDAP libraries is not yet
|
||
supported. If required, install and use the OpenLDAP libraries
|
||
instead.</p>
|
||
|
||
|
||
|
||
<h3><a name="settingcerts-microsoft" id="settingcerts-microsoft">Microsoft SDK</a></h3>
|
||
|
||
<p>SSL/TLS certificate configuration for the native Microsoft
|
||
LDAP libraries is done inside the system registry, and no
|
||
configuration directives are required.</p>
|
||
|
||
<p>Both SSL and TLS are supported by using the ldaps:// URL
|
||
format, or by using the <code class="directive"><a href="#ldaptrustedmode">LDAPTrustedMode</a></code> directive accordingly.</p>
|
||
|
||
<p>Note: The status of support for client certificates is not yet known
|
||
for this toolkit.</p>
|
||
|
||
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPCacheEntries" id="LDAPCacheEntries">LDAPCacheEntries</a> <a name="ldapcacheentries" id="ldapcacheentries">Directive</a> <a title="Permanent link" href="#ldapcacheentries" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Maximum number of entries in the primary LDAP cache</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPCacheEntries <var>number</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPCacheEntries 1024</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>Specifies the maximum size of the primary LDAP cache. This
|
||
cache contains successful search/binds. Set it to 0 to turn off
|
||
search/bind caching. The default size is 1024 cached
|
||
searches.</p>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPCacheTTL" id="LDAPCacheTTL">LDAPCacheTTL</a> <a name="ldapcachettl" id="ldapcachettl">Directive</a> <a title="Permanent link" href="#ldapcachettl" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Time that cached items remain valid</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPCacheTTL <var>seconds</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPCacheTTL 600</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>Specifies the time (in seconds) that an item in the
|
||
search/bind cache remains valid. The default is 600 seconds (10
|
||
minutes).</p>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPConnectionPoolTTL" id="LDAPConnectionPoolTTL">LDAPConnectionPoolTTL</a> <a name="ldapconnectionpoolttl" id="ldapconnectionpoolttl">Directive</a> <a title="Permanent link" href="#ldapconnectionpoolttl" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Discard backend connections that have been sitting in the connection pool too long</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPConnectionPoolTTL <var>n</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPConnectionPoolTTL -1</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.3.12 and later</td></tr>
|
||
</table>
|
||
<p>Specifies the maximum age, in seconds, that a pooled LDAP connection can remain idle
|
||
and still be available for use. Connections are cleaned up when they are next needed,
|
||
not asynchronously.</p>
|
||
|
||
<p>A setting of 0 causes connections to never be saved in the backend
|
||
connection pool. The default value of -1, and any other negative value,
|
||
allows connections of any age to be reused.</p>
|
||
|
||
<p>For performance reasons, the reference time used by this directive is
|
||
based on when the LDAP connection is returned to the pool, not the time
|
||
of the last successful I/O with the LDAP server. </p>
|
||
|
||
<p>Since 2.4.10, new measures are in place to avoid the reference time
|
||
from being inflated by cache hits or slow requests. First, the reference
|
||
time is not updated if no backend LDAP conncetions were needed. Second,
|
||
the reference time uses the time the HTTP request was received instead
|
||
of the time the request is completed.</p>
|
||
|
||
<div class="note"><p>This timeout defaults to units of seconds, but accepts
|
||
suffixes for milliseconds (ms), minutes (min), and hours (h).
|
||
</p></div>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPConnectionTimeout" id="LDAPConnectionTimeout">LDAPConnectionTimeout</a> <a name="ldapconnectiontimeout" id="ldapconnectiontimeout">Directive</a> <a title="Permanent link" href="#ldapconnectiontimeout" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the socket connection timeout in seconds</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPConnectionTimeout <var>seconds</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>This directive configures the LDAP_OPT_NETWORK_TIMEOUT (or LDAP_OPT_CONNECT_TIMEOUT)
|
||
option in the underlying LDAP client library, when available. This value
|
||
typically controls how long the LDAP client library will wait for the TCP
|
||
connection to the LDAP server to complete.</p>
|
||
|
||
<p> If a connection is not successful with the timeout period, either an error will be
|
||
returned or the LDAP client library will attempt to connect to a secondary LDAP
|
||
server if one is specified (via a space-separated list of hostnames in the
|
||
<code class="directive"><a href="../mod/mod_authnz_ldap.html#authldapurl">AuthLDAPURL</a></code>).</p>
|
||
|
||
<p>The default is 10 seconds, if the LDAP client library linked with the
|
||
server supports the LDAP_OPT_NETWORK_TIMEOUT option.</p>
|
||
|
||
<div class="note">LDAPConnectionTimeout is only available when the LDAP client library linked
|
||
with the server supports the LDAP_OPT_NETWORK_TIMEOUT
|
||
(or LDAP_OPT_CONNECT_TIMEOUT) option, and the ultimate behavior is
|
||
dictated entirely by the LDAP client library.
|
||
</div>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPLibraryDebug" id="LDAPLibraryDebug">LDAPLibraryDebug</a> <a name="ldaplibrarydebug" id="ldaplibrarydebug">Directive</a> <a title="Permanent link" href="#ldaplibrarydebug" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable debugging in the LDAP SDK</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPLibraryDebug <var>7</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>disabled</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>Turns on SDK-specific LDAP debug options that generally cause the LDAP
|
||
SDK to log verbose trace information to the main Apache error log.
|
||
The trace messages from the LDAP SDK provide gory details that
|
||
can be useful during debugging of connectivity problems with backend LDAP servers</p>
|
||
|
||
<p>This option is only configurable when Apache HTTP Server is linked with
|
||
an LDAP SDK that implements <code>LDAP_OPT_DEBUG</code> or
|
||
<code>LDAP_OPT_DEBUG_LEVEL</code>, such as OpenLDAP (a value of 7 is verbose)
|
||
or Tivoli Directory Server (a value of 65535 is verbose).</p>
|
||
|
||
<div class="warning">
|
||
<p>The logged information will likely contain plaintext credentials being used or
|
||
validated by LDAP authentication, so care should be taken in protecting and purging
|
||
the error log when this directive is used.</p>
|
||
</div>
|
||
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPOpCacheEntries" id="LDAPOpCacheEntries">LDAPOpCacheEntries</a> <a name="ldapopcacheentries" id="ldapopcacheentries">Directive</a> <a title="Permanent link" href="#ldapopcacheentries" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Number of entries used to cache LDAP compare
|
||
operations</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPOpCacheEntries <var>number</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPOpCacheEntries 1024</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>This specifies the number of entries <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code>
|
||
will use to cache LDAP compare operations. The default is 1024
|
||
entries. Setting it to 0 disables operation caching.</p>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPOpCacheTTL" id="LDAPOpCacheTTL">LDAPOpCacheTTL</a> <a name="ldapopcachettl" id="ldapopcachettl">Directive</a> <a title="Permanent link" href="#ldapopcachettl" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Time that entries in the operation cache remain
|
||
valid</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPOpCacheTTL <var>seconds</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPOpCacheTTL 600</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>Specifies the time (in seconds) that entries in the
|
||
operation cache remain valid. The default is 600 seconds.</p>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPReferralHopLimit" id="LDAPReferralHopLimit">LDAPReferralHopLimit</a> <a name="ldapreferralhoplimit" id="ldapreferralhoplimit">Directive</a> <a title="Permanent link" href="#ldapreferralhoplimit" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The maximum number of referral hops to chase before terminating an LDAP query.</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPReferralHopLimit <var>number</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SDK dependent, typically between 5 and 10</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
|
||
<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>This directive, if enabled by the <code class="directive"><a href="#ldapreferrals">LDAPReferrals</a></code> directive,
|
||
limits the number of referral hops that are followed before terminating an
|
||
LDAP query.</p>
|
||
|
||
<div class="warning">
|
||
<p> Support for this tunable is uncommon in LDAP SDKs.</p>
|
||
</div>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPReferrals" id="LDAPReferrals">LDAPReferrals</a> <a name="ldapreferrals" id="ldapreferrals">Directive</a> <a title="Permanent link" href="#ldapreferrals" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable referral chasing during queries to the LDAP server.</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPReferrals On|Off|default</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPReferrals On</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
|
||
<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>The <var>default</var> parameter is available in Apache 2.4.7 and later</td></tr>
|
||
</table>
|
||
<p>Some LDAP servers divide their directory among multiple domains and use referrals
|
||
to direct a client when a domain boundary is crossed. This is similar to a HTTP redirect.
|
||
LDAP client libraries may or may not chase referrals by default. This directive
|
||
explicitly configures the referral chasing in the underlying SDK.</p>
|
||
|
||
|
||
<p><code class="directive">LDAPReferrals</code> takes the following values:</p>
|
||
<dl>
|
||
<dt>"on"</dt>
|
||
<dd> <p> When set to "on", the underlying SDK's referral chasing state
|
||
is enabled, <code class="directive"><a href="#ldapreferralhoplimit">LDAPReferralHopLimit</a></code> is used to
|
||
override the SDK's hop limit, and an LDAP rebind callback is
|
||
registered.</p></dd>
|
||
<dt>"off"</dt>
|
||
<dd> <p> When set to "off", the underlying SDK's referral chasing state
|
||
is disabled completely.</p></dd>
|
||
<dt>"default"</dt>
|
||
<dd> <p> When set to "default", the underlying SDK's referral chasing state
|
||
is not changed, <code class="directive"><a href="#ldapreferralhoplimit">LDAPReferralHopLimit</a></code> is not
|
||
used to override the SDK's hop limit, and no LDAP rebind callback is
|
||
registered.</p></dd>
|
||
</dl>
|
||
|
||
<p>The directive <code class="directive"><a href="#ldapreferralhoplimit">LDAPReferralHopLimit</a></code> works in conjunction with
|
||
this directive to limit the number of referral hops to follow before terminating the LDAP query.
|
||
When referral processing is enabled by a value of "On", client credentials will be provided,
|
||
via a rebind callback, for any LDAP server requiring them.</p>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPRetries" id="LDAPRetries">LDAPRetries</a> <a name="ldapretries" id="ldapretries">Directive</a> <a title="Permanent link" href="#ldapretries" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configures the number of LDAP server retries.</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPRetries <var>number-of-retries</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPRetries 3</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>The server will retry failed LDAP requests up to
|
||
<code class="directive">LDAPRetries</code> times. Setting this
|
||
directive to 0 disables retries.</p>
|
||
<p>LDAP errors such as timeouts and refused connections are retryable.</p>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPRetryDelay" id="LDAPRetryDelay">LDAPRetryDelay</a> <a name="ldapretrydelay" id="ldapretrydelay">Directive</a> <a title="Permanent link" href="#ldapretrydelay" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configures the delay between LDAP server retries.</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPRetryDelay <var>seconds</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPRetryDelay 0</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>If <code class="directive">LDAPRetryDelay</code> is set to a non-zero
|
||
value, the server will delay retrying an LDAP request for the
|
||
specified amount of time. Setting this directive to 0 will
|
||
result in any retry to occur without delay.</p>
|
||
|
||
<p>LDAP errors such as timeouts and refused connections are retryable.</p>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPSharedCacheFile" id="LDAPSharedCacheFile">LDAPSharedCacheFile</a> <a name="ldapsharedcachefile" id="ldapsharedcachefile">Directive</a> <a title="Permanent link" href="#ldapsharedcachefile" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the shared memory cache file</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPSharedCacheFile <var>file-path</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>Specifies the path of the shared memory cache file. If not set,
|
||
anonymous shared memory will be used if the platform supports it.</p>
|
||
|
||
<p>If <var>file-path</var> is not an absolute path, the location specified
|
||
will be relative to the value of
|
||
<code class="directive"><a href="../mod/core.html#defaultruntimedir">DefaultRuntimeDir</a></code>.</p>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPSharedCacheSize" id="LDAPSharedCacheSize">LDAPSharedCacheSize</a> <a name="ldapsharedcachesize" id="ldapsharedcachesize">Directive</a> <a title="Permanent link" href="#ldapsharedcachesize" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Size in bytes of the shared-memory cache</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPSharedCacheSize <var>bytes</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPSharedCacheSize 500000</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>Specifies the number of bytes to allocate for the shared
|
||
memory cache. The default is 500kb. If set to 0, shared memory
|
||
caching will not be used and every HTTPD process will create its
|
||
own cache.</p>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPTimeout" id="LDAPTimeout">LDAPTimeout</a> <a name="ldaptimeout" id="ldaptimeout">Directive</a> <a title="Permanent link" href="#ldaptimeout" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the timeout for LDAP search and bind operations, in seconds</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTimeout <var>seconds</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPTimeout 60</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.3.5 and later</td></tr>
|
||
</table>
|
||
<p>This directive configures the timeout for bind and search operations, as well as
|
||
the LDAP_OPT_TIMEOUT option in the underlying LDAP client library, when available.</p>
|
||
|
||
<p> If the timeout expires, httpd will retry in case an existing connection has
|
||
been silently dropped by a firewall. However, performance will be much better if
|
||
the firewall is configured to send TCP RST packets instead of silently dropping
|
||
packets.</p>
|
||
|
||
<div class="note">
|
||
<p>Timeouts for ldap compare operations requires an SDK with LDAP_OPT_TIMEOUT, such as OpenLDAP >= 2.4.4.</p>
|
||
</div>
|
||
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPTrustedClientCert" id="LDAPTrustedClientCert">LDAPTrustedClientCert</a> <a name="ldaptrustedclientcert" id="ldaptrustedclientcert">Directive</a> <a title="Permanent link" href="#ldaptrustedclientcert" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the file containing or nickname referring to a per
|
||
connection client certificate. Not all LDAP toolkits support per
|
||
connection client certificates.</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTrustedClientCert <var>type</var> <var>directory-path/filename/nickname</var> <var>[password]</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
|
||
<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>It specifies the directory path, file name or nickname of a
|
||
per connection client certificate used when establishing an SSL
|
||
or TLS connection to an LDAP server. Different locations or
|
||
directories may have their own independent client certificate
|
||
settings. Some LDAP toolkits (notably Novell)
|
||
do not support per connection client certificates, and will throw an
|
||
error on LDAP server connection if you try to use this directive
|
||
(Use the <code class="directive"><a href="#ldaptrustedglobalcert">LDAPTrustedGlobalCert</a></code>
|
||
directive instead for Novell client
|
||
certificates - See the SSL/TLS certificate guide above for details).
|
||
The type specifies the kind of certificate parameter being
|
||
set, depending on the LDAP toolkit being used. Supported types are:</p>
|
||
<ul>
|
||
<li>CA_DER - binary DER encoded CA certificate</li>
|
||
<li>CA_BASE64 - PEM encoded CA certificate</li>
|
||
<li>CERT_DER - binary DER encoded client certificate</li>
|
||
<li>CERT_BASE64 - PEM encoded client certificate</li>
|
||
<li>CERT_NICKNAME - Client certificate "nickname" (Netscape SDK)</li>
|
||
<li>KEY_DER - binary DER encoded private key</li>
|
||
<li>KEY_BASE64 - PEM encoded private key</li>
|
||
</ul>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPTrustedGlobalCert" id="LDAPTrustedGlobalCert">LDAPTrustedGlobalCert</a> <a name="ldaptrustedglobalcert" id="ldaptrustedglobalcert">Directive</a> <a title="Permanent link" href="#ldaptrustedglobalcert" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the file or database containing global trusted
|
||
Certificate Authority or global client certificates</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTrustedGlobalCert <var>type</var> <var>directory-path/filename</var> <var>[password]</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>It specifies the directory path and file name of the trusted CA
|
||
certificates and/or system wide client certificates <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code>
|
||
should use when establishing an SSL or TLS connection to an LDAP
|
||
server. Note that all certificate information specified using this directive
|
||
is applied globally to the entire server installation. Some LDAP toolkits
|
||
(notably Novell) require all client certificates to be set globally using
|
||
this directive. Most other toolkits require clients certificates to be set
|
||
per Directory or per Location using <code class="directive"><a href="#ldaptrustedclientcert">LDAPTrustedClientCert</a></code>. If you get this
|
||
wrong, an error may be logged when an attempt is made to contact the LDAP
|
||
server, or the connection may silently fail (See the SSL/TLS certificate
|
||
guide above for details).
|
||
The type specifies the kind of certificate parameter being
|
||
set, depending on the LDAP toolkit being used. Supported types are:</p>
|
||
<ul>
|
||
<li>CA_DER - binary DER encoded CA certificate</li>
|
||
<li>CA_BASE64 - PEM encoded CA certificate</li>
|
||
<li>CA_CERT7_DB - Netscape cert7.db CA certificate database file</li>
|
||
<li>CA_SECMOD - Netscape secmod database file</li>
|
||
<li>CERT_DER - binary DER encoded client certificate</li>
|
||
<li>CERT_BASE64 - PEM encoded client certificate</li>
|
||
<li>CERT_KEY3_DB - Netscape key3.db client certificate database file</li>
|
||
<li>CERT_NICKNAME - Client certificate "nickname" (Netscape SDK)</li>
|
||
<li>CERT_PFX - PKCS#12 encoded client certificate (Novell SDK)</li>
|
||
<li>KEY_DER - binary DER encoded private key</li>
|
||
<li>KEY_BASE64 - PEM encoded private key</li>
|
||
<li>KEY_PFX - PKCS#12 encoded private key (Novell SDK)</li>
|
||
</ul>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPTrustedMode" id="LDAPTrustedMode">LDAPTrustedMode</a> <a name="ldaptrustedmode" id="ldaptrustedmode">Directive</a> <a title="Permanent link" href="#ldaptrustedmode" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the SSL/TLS mode to be used when connecting to an LDAP server.</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTrustedMode <var>type</var></code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>The following modes are supported:</p>
|
||
<ul>
|
||
<li>NONE - no encryption</li>
|
||
<li>SSL - ldaps:// encryption on default port 636</li>
|
||
<li>TLS - STARTTLS encryption on default port 389</li>
|
||
</ul>
|
||
|
||
<p>Not all LDAP toolkits support all the above modes. An error message
|
||
will be logged at runtime if a mode is not supported, and the
|
||
connection to the LDAP server will fail.
|
||
</p>
|
||
|
||
<p>If an ldaps:// URL is specified, the mode becomes SSL and the setting
|
||
of <code class="directive">LDAPTrustedMode</code> is ignored.</p>
|
||
|
||
</div>
|
||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||
<div class="directive-section"><h2><a name="LDAPVerifyServerCert" id="LDAPVerifyServerCert">LDAPVerifyServerCert</a> <a name="ldapverifyservercert" id="ldapverifyservercert">Directive</a> <a title="Permanent link" href="#ldapverifyservercert" class="permalink">¶</a></h2>
|
||
<table class="directive">
|
||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Force server certificate verification</td></tr>
|
||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPVerifyServerCert On|Off</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPVerifyServerCert On</code></td></tr>
|
||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
|
||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
|
||
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
|
||
</table>
|
||
<p>Specifies whether to force the verification of a
|
||
server certificate when establishing an SSL connection to the
|
||
LDAP server.</p>
|
||
|
||
</div>
|
||
</div>
|
||
<div class="bottomlang">
|
||
<p><span>Available Languages: </span><a href="../en/mod/mod_ldap.html" title="English"> en </a> |
|
||
<a href="../fr/mod/mod_ldap.html" hreflang="fr" rel="alternate" title="Français"> fr </a></p>
|
||
</div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Libera.chat, or sent to our <a href="https://httpd.apache.org/lists.html">mailing lists</a>.</div>
|
||
<script type="text/javascript"><!--//--><![CDATA[//><!--
|
||
var comments_shortname = 'httpd';
|
||
var comments_identifier = 'http://httpd.apache.org/docs/trunk/mod/mod_ldap.html';
|
||
(function(w, d) {
|
||
if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
|
||
d.write('<div id="comments_thread"><\/div>');
|
||
var s = d.createElement('script');
|
||
s.type = 'text/javascript';
|
||
s.async = true;
|
||
s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
|
||
(d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
|
||
}
|
||
else {
|
||
d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
|
||
}
|
||
})(window, document);
|
||
//--><!]]></script></div><div id="footer">
|
||
<p class="apache">Copyright 2023 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
|
||
<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
|
||
if (typeof(prettyPrint) !== 'undefined') {
|
||
prettyPrint();
|
||
}
|
||
//--><!]]></script>
|
||
</body></html> |