1.\" $OpenBSD: ldapd.8,v 1.16 2023/03/02 17:09:53 jmc Exp $ 2.\" 3.\" Copyright (c) 2009, 2010 Martin Hedenfalk <martin@bzero.se> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.Dd $Mdocdate: March 2 2023 $ 18.Dt LDAPD 8 19.Os 20.Sh NAME 21.Nm ldapd 22.Nd Lightweight Directory Access Protocol (LDAP) daemon 23.Sh SYNOPSIS 24.Nm ldapd 25.Op Fl dnv 26.Oo 27.Fl D Ar macro Ns = Ns Ar value 28.Oc 29.Op Fl f Ar file 30.Op Fl r Ar directory 31.Op Fl s Ar file 32.Sh DESCRIPTION 33.Nm 34is a daemon which implements version 3 of the LDAP protocol. 35.Pp 36A running 37.Nm 38process can be controlled using the 39.Xr ldapctl 8 40utility. 41.Pp 42The options are as follows: 43.Bl -tag -width Ds 44.It Fl D Ar macro Ns = Ns Ar value 45Define 46.Ar macro 47to be set to 48.Ar value 49on the command line. 50Overrides the definition of 51.Ar macro 52in the configuration file. 53.It Fl d 54Do not daemonize and log to 55.Em stderr . 56.It Fl f Ar file 57Use 58.Ar file 59as the configuration file, instead of the default 60.Pa /etc/ldapd.conf . 61.It Fl n 62Configtest mode. 63Only check the configuration file for validity. 64.It Fl r Ar directory 65Store and read database files in 66.Ar directory , 67instead of the default 68.Pa /var/db/ldap . 69.It Fl s Ar file 70Specify an alternative location for the socket file. 71.It Fl v 72Produce more verbose output. 73A second 74.Fl v 75together with the 76.Fl d 77flag produces debug traces of decoded BER messages on stderr. 78.El 79.Sh AUTHENTICATION 80.Nm 81can authenticate users via simple binds or SASL with the PLAIN 82mechanism. 83.Pp 84When using simple binds, the bind DN entry must exist in a namespace 85and have a 86.Ic userPassword 87attribute. 88The following formats of the 89.Ic userPassword 90attribute are recognized: 91.Bl -tag -width Ds 92.It Ic {SHA}digest 93Verify the password against the SHA-1 digest. 94.It Ic {SSHA}digest 95Verify the password against the salted SHA-1 digest. 96.It Ic {CRYPT}hash 97Verify the password against the 98.Xr crypt 3 99hash. 100.It Ic {BSDAUTH}username 101Use 102.Bx 103Authentication with the given username and authentication style 104.Dq auth-ldap . 105This is similar to using SASL PLAIN authentication with 106.Ar username 107as the authentication ID. 108.It Ic {BSDAUTH}username#class 109Same as above, but overrides the login class. 110.El 111.Pp 112Without a prefix, the 113.Ic userPassword 114attribute is compared literally with the provided plain text password. 115.Pp 116When using SASL binds, the authentication ID should be a valid 117username for 118.Bx 119Authentication. 120.Pp 121For plain text passwords to be accepted, the connection must be 122considered secure, either by using an encrypted connection, or by 123using the 124.Ic secure 125keyword in the configuration file. 126.Sh FILES 127.Bl -tag -width "/var/run/ldapd.sockXXXXXXX" -compact 128.It Pa /etc/ldapd.conf 129default 130.Nm 131configuration file 132.It Pa /var/run/ldapd.sock 133default 134.Nm 135control socket 136.It Pa /var/db/ldap/*.db 137.Nm 138database files 139.El 140.Sh SEE ALSO 141.Xr ldap 1 , 142.Xr ldapd.conf 5 , 143.Xr login.conf 5 , 144.Xr ldapctl 8 145.Sh STANDARDS 146.Rs 147.%A J. Sermersheim 148.%D June 2006 149.%R RFC 4511 150.%T Lightweight Directory Access Protocol (LDAP): The Protocol 151.Re 152.Pp 153.Rs 154.%A K. Zeilenga 155.%D June 2006 156.%R RFC 4512 157.%T Lightweight Directory Access Protocol (LDAP): Directory Information Models 158.Re 159.Sh HISTORY 160The 161.Nm 162program first appeared in 163.Ox 4.8 . 164.Sh CAVEATS 165.Nm 166is not yet fully LDAPv3 compliant. 167.Pp 168Database files are not expected to work across architectures and may 169not work across versions. 170