Movatterモバイル変換

This authentication method operates similarly topassword except that it uses LDAP as the password verification method. LDAP is used only to validate the user name/password pairs. Therefore the user must already exist in the database before LDAP can be used for authentication.

LDAP authentication can operate in two modes. In the first mode, which we will call the simple bind mode, the server will bind to the distinguished name constructed asprefixusernamesuffix. Typically, theprefix parameter is used to specifycn=, orDOMAIN\ in an Active Directory environment.suffix is used to specify the remaining part of the DN in a non-Active Directory environment.

In the second mode, which we will call the search+bind mode, the server first binds to the LDAP directory with a fixed user name and password, specified withldapbinddn andldapbindpasswd, and performs a search for the user trying to log in to the database. If no user and password is configured, an anonymous bind will be attempted to the directory. The search will be performed over the subtree atldapbasedn, and will try to do an exact match of the attribute specified inldapsearchattribute. Once the user has been found in this search, the server re-binds to the directory as this user, using the password specified by the client, to verify that the login is correct. This mode is the same as that used by LDAP authentication schemes in other software, such as Apachemod_authnz_ldap andpam_ldap. This method allows for significantly more flexibility in where the user objects are located in the directory, but will cause two additional requests to the LDAP server to be made.

The following configuration options are used in both modes:

Note that usingldapscheme orldaptls only encrypts the traffic between the PostgreSQL server and the LDAP server. The connection between the PostgreSQL server and the PostgreSQL client will still be unencrypted unless SSL is used there as well.

The following options are used in simple bind mode only:

The following options are used in search+bind mode only:

It is an error to mix configuration options for simple bind with options for search+bind.

When using search+bind mode, the search can be performed using a single attribute specified withldapsearchattribute, or using a custom search filter specified withldapsearchfilter. Specifyingldapsearchattribute=foo is equivalent to specifyingldapsearchfilter="(foo=$username)". If neither option is specified the default isldapsearchattribute=uid.

IfPostgreSQL was compiled withOpenLDAP as the LDAP client library, theldapserver setting may be omitted. In that case, a list of host names and ports is looked up viaRFC 2782 DNS SRV records. The name_ldap._tcp.DOMAIN is looked up, whereDOMAIN is extracted fromldapbasedn.

Here is an example for a simple-bind LDAP configuration:

host ... ldap ldapserver=ldap.example.net ldapprefix="cn=" ldapsuffix=", dc=example, dc=net"

When a connection to the database server as database usersomeuser is requested, PostgreSQL will attempt to bind to the LDAP server using the DNcn=someuser, dc=example, dc=net and the password provided by the client. If that connection succeeds, the database access is granted.

Here is an example for a search+bind configuration:

host ... ldap ldapserver=ldap.example.net ldapbasedn="dc=example, dc=net" ldapsearchattribute=uid

When a connection to the database server as database usersomeuser is requested, PostgreSQL will attempt to bind anonymously (sinceldapbinddn was not specified) to the LDAP server, perform a search for(uid=someuser) under the specified base DN. If an entry is found, it will then attempt to bind using that found information and the password supplied by the client. If that second bind succeeds, the database access is granted.

Here is the same search+bind configuration written as a URL:

host ... ldap ldapurl="ldap://ldap.example.net/dc=example,dc=net?uid?sub"

Some other software that supports authentication against LDAP uses the same URL format, so it will be easier to share the configuration.

Here is an example for a search+bind configuration that usesldapsearchfilter instead ofldapsearchattribute to allow authentication by user ID or email address:

host ... ldap ldapserver=ldap.example.net ldapbasedn="dc=example, dc=net" ldapsearchfilter="(|(uid=$username)(mail=$username))"

Here is an example for a search+bind configuration that uses DNS SRV discovery to find the host name(s) and port(s) for the LDAP service for the domain nameexample.net:

host ... ldap ldapbasedn="dc=example,dc=net"