The FTP-Proxy White Paper: Using an LDAP Directory

Next Previous Contents

## 8. Using an LDAP Directory

The main option to use an LDAP directory is the `LDAPServer` configuration option. If given, it specifies the hostname of the directory server (optionally followed by port number separated by a colon).

The program will bind the directory using `LDAPBindDN` (and `LDAPBindPW`) and retrive the values having an object class of `LDAPObjectClass` and identified by the `LDAPIdentifier`.

The LDAPBindDN and LDAPBindPW option defines the distinguished name and credentials (password) needed to access the data in the directory service. It is allowed to include one %s in LDAPBindDN - it will be replaced with the user name. If UserAuthMagic is used, the special "authuser" and "authpass" are used, otherwise normal "ftpuser" and "ftppass" from USER and PASS ftp commands. If no LDAPBindDN specified, a annonymous bind will be used.

Additionally the directory tree root should be specified using the `LDAPBaseDN` or `LDAPAuthDN` option. You can also use both options set to differen root's if your profile data is stored in a different tree than the authentication data. One of both options is mandatory.

- LDAP User-Profiles

  In order to gain more flexibiliy for the user management, the user dependent parts of the configuration can also be supplied with an LDAP directory.

  The following configuration options will be tryed to retrieve from the tree root specified by the `LDAPBaseDN` option:

       DestinationAddress, DestinationPort, DestinationTransferMode,
       DestinationMinPort, DestinationMaxPort, ActiveMinDataPort,
       ActiveMaxDataPort, PassiveMinDataPort, PassiveMaxDataPort,
       SameAddress, TimeOut, ValidCommands.

  For example, if your user (USERNAME) dependent configuration is stored as uid=USERNAME,ou=FTPProxy,dc=domain,dc=top in the directory, the setup may be as follows:

        LDAPServer      ldap.domain.top:389
        LDAPBaseDN      ou=FTPProxy,dc=domain,dc=top
        LDAPIdentifier  uid

  If a non-anonymous bind is needed to access the tree, a LDAPBind can be specified either to an specific user, i.e. "proxyuser":

        LDAPBindDN      uid=proxyuser,ou=FTPProxy,dc=domain,dc=top

  or also the user who want to login (ftp-user or auth-user name depending on UserAuthMagic):

        LDAPBindDN      uid=%s,ou=FTPProxy,dc=domain,dc=top

- User-Authentication

  Since proxy-suite Version 1.9 the ftp-proxy supports also LDAP based user authentication.

  To activate it, you have to set the `UserAuthType` configuration option to ldap and define the authentication tree root using the `LDAPAuthDN` configuration option. If no `LDAPAuthDN` option is set, `LDAPBaseDN` is used instead.

  If you only want to check, if an user is allowed to use the ftp-proxy service or not, you can define the `LDAPAuthOKFlag` option to an attribute name and its value, separated with an equal character. The program will check, if the value for the given attribute exists - the attribute may contain multiple values. Example:

      LDAPAuthOKFlag   AllowedService=ftpProxy

  .

  Further it is also possible to preform an password authentication using the `LDAPAuthPWAttr` and `LDAPAuthPWType` options. The `LDAPAuthPWAttr` defines the name of the password attribute. A common name for this attribute is userPassword.

  The `LDAPAuthPWType` option defined the type of the password stored in the directory service. Supported password types are plain for plain-text passwords, crypt for crypted passwords and {crypt} for crypted passwords prefixed with a {crypt} string (a scheme specification). The type may be followed by the number 0-9 of minimal allowed passord length, i.e.

      LDAPAuthPWType   plain

  This definition means, the directory contains plain-text password with the default minimal length of at least 5 characters.

Next Previous Contents