MAN page from OpenSuSE perl-OpenXPKI-Core-0.9.1389-6.362.CS.i586.rpm

OpenXPKI::Server::Authentication::LDAP

Section: User Contributed Perl Documentation (3)
Updated: 2008-09-30
Index 

Name

OpenXPKI::Server::Authentication::LDAP - LDAP based authentication. 

Description

This is the class which supports OpenXPKI with an internal passphrase basedauthentication method. The parameters are passed as a hash reference.LDAP database source (user/password stored in LDAP or AD server) This is the most complex authentication method. 

Functions

 

new

is the constructor. The supported parameters are XPATH and COUNTER.This is the minimum parameter set for any authentication class.Parameters block in the configuration must also include:

*

host - LDAP server hostname (e.g. localhost);

*

port - LDAP server port (e.g. 389);

*

base - top DN for search in LDAP database;

*

version - LDAP version (we support only 3);

*

bind_dn - DN for binding to LDAP server;

*

bind_pw - password for binding to LDAP server;

*

use_tls - use 'false' here if you do not want to use TLSconnection to LDAP server, 'true_tls' value will switch onTLS mode via STARTTLS command to server, use 'true_ssl'instead if you want to try Net::LDAPS SSL connection first(if Net::LDAPS is not installed the STARTTLS will be used);

*

capath - path to the certificates for TLS connection (makes sense only if use_tls parameter is set to 'true_tls' or'true_ssl');

*

searchattr - LDAP entry attribute which value will be compared to account;

*

searchvalueprefix - prefix which will be added in front of the account name before comparing it to the value of searchattr;

*

auth_meth_attr - LDAP entry attribute which value is used to specify authentication method;

*

default_auth_meth - name of the authentication method which is used if no method found in user entry;

*

auth_meth_map - a block containing a pair attr_value->auth_meth mapping auth_meth_attr value to real authentication method name;

*

pw_attr - LDAP entry attribute which value is used to compare to password;

*

pw_attr_hash - name of the hash type stored in pw_attr (e.g. sha1 );

*

role_attr - LDAP entry attribute which value is used to assign a role;

*

role_map - block containg pair value->rolemapping role_attr value to real OpenXPKI role;

 

login_step

The procedure goes in the following way:

1.

connect to LDAP server using parameters: host, port, version and capath (the last one - in the case of using TLS);

2.

search LDAP entry starting from the base_dn using filtering conditionbuilt with search_attr, searchvalueprefix and account string(exactly one entry is expected to exist);

3.

read all values of the entry attributes whose names are specified inauth_meth_attr, pw_attr and role_attr;

4.

select an authetication method - find the value of auth_meth_attr that is present in the set of mapping pairs attr_value/auth_meth (if no match detected the method specified in default_auth_meth will be used);

5.

authenticate user using the method selected: there are two variants at the moment - to compare a password hash in pw_attr withthe hash of the password passed to the module (method name is 'pwattr') or to try password-based bind to the same LDAP server account (method name is 'bind');

6.

find the value of role_attr that is present in the set of mapping pairsvalue/role and assign the corresponding role to the user authenticated.

The procedure returns (user, role, SERVICE_READY message) triple if login was successful, (undef, undef, {}) otherwise.

---

 

Index

Name

Description

Functions

new

login_step

---

This document was created byman2html,using the manual pages.