1 .TH SLAPO-NSSOV 5 "RELEASEDATE" "OpenLDAP LDVERSION"
2 .\" Copyright 1998-2012 The OpenLDAP Foundation, All Rights Reserved.
3 .\" Copying restrictions apply. See the COPYRIGHT file.
6 slapo-nssov \- NSS and PAM requests through a local Unix Domain socket
14 services NSS and PAM requests through a local Unix Domain socket.
15 It uses the same IPC protocol as Arthur de Jong's nss-ldapd, and
16 a complete copy of the nss-ldapd source is included along with the
19 Using a separate IPC protocol for NSS and PAM requests eliminates the
20 libldap dependencies/clashes that the current pam_ldap/nss_ldap solutions
21 all suffer from. Both the original nss-ldapd and this nssov solution
22 are free from these library issues.
24 Unlike nss-pam-ldapd, since this overlay executes inside slapd it allows for
25 the possibility of sophisticated caching, without any of the weaknesses of
26 nscd and other related caching solutions. E.g., a remote LDAP database can
27 be accessed using back-ldap with proxy caching (see
31 ) to leverage back-ldap's
32 connection pooling as well as pcache's persistent caching, to provide
33 high performance and a measure of support for disconnected operation.
34 Alternatively, cache considerations can be completely eliminated by running
35 a regular database with syncrepl to maintain synchronization with a remote
38 Another major benefit of nssov is that it allows all security policy to be
39 administered centrally via LDAP, instead of having fragile rules scattered
40 across multiple flat files. As such, there is no client-side configuration at
41 all for the NSS/PAM stub libraries. (The stubs talk to the server via a Unix
42 domain socket whose path is hardcoded to /var/run/nslcd/). As a side benefit,
43 this can finally eliminate the perpetual confusion between OpenLDAP's
44 ldap.conf file in ETCDIR/ldap.conf and the similarly named files typically
45 used by pam_ldap and nss_ldap.
47 User authentication is performed by internal simple Binds. User authorization
48 leverages the slapd ACL engine, which offers much more power and flexibility
49 than the simple group/hostname checks in the old pam_ldap code.
51 To use this code, you will need the client-side stuf library from
52 nss-pam-ldapd. You can get it from:
53 http://arthurdejong.org/nss-pam-ldapd
54 You will not need the nslcd daemon; this overlay replaces that part.
55 To disable building of the nslcd daemon in nss-pam-ldapd, add the
56 --disable-nslcd option to the nss-pam-ldapd configure script. You
57 should already be familiar with the RFC2307 and RFC2307bis schema
58 to use this overlay. See the nss-pam-ldapd README for more information
59 on the schema and which features are supported.
61 You will also need to include the nis.schema in your slapd configuration
62 for RFC2307 support. If you wish to use RFC2307bis you will need a slightly
63 different schema. You will also need the ldapns.schema for PAM authorization
68 in the appropriate services in
70 in order for these NSS features to take effect. Likewise, you must
73 for the authenticate, account, session, and password services in
77 for these PAM features to take effect.
81 This directive adds the nssov overlay to the current backend.
83 .B nssov-ssd <service> <url>
84 This directive configures a Service Search Descriptor (SSD) for each NSS
85 service that will be used. The <service> may be one of
101 and the <url> must be of the form
104 .B ldap:///[<basedn>][??[<scope>][?<filter>]]
108 will default to the first suffix of the current database.
111 defaults to "subtree". The default
113 depends on which service is being used.
115 .B nssov-map <service> <orig> <new>
116 If the local database is actually a proxy to a foreign LDAP server, some
117 mapping of schema may be needed. This directive allows some simple attribute
118 substitutions to be performed. See the
120 for the original attribute names used in this code.
122 .B nssov-pam <option> [...]
123 This directive determines a number of PAM behaviors. Multiple options may
124 be used at once, and available levels are:
130 check host attribute in user entry for authorization
133 check authorizedService attribute in user entry for authorization
136 check that user is a member of specific group for authorization
139 check authorizedService attribute in host entry for authorization
142 use authz-regexp mapping to map uid to LDAP DN
145 use NSS passwd SSD to map uid to LDAP DN
154 options duplicates the original pam_ldap authorization behavior.
156 The recommended approach is to use
158 instead. In this case, ipHost entries must be created for all hosts
159 being managed, and they must also have the authorizedServiceObject
160 class to allow authorizedService attributes to be used. Also the
161 NSS host SSD must be configured so that ipHost entries can be found.
162 Authorization is checked by performing an LDAP Compare operation
163 looking for the PAM service name in the authorizedService attribute.
165 ACLs should be set to grant or deny
167 privilege to the appropriate users or groups as desired.
171 option is set then authz-regexp mappings will be used to map the
172 PAM username to an LDAP DN. The authentication DN will be of the
175 .B cn=<service>+uid=<user>,cn=<hostname>,cn=pam,cn=auth
178 If no mapping is found for this authentication DN, then this
179 mapping will be ignored.
183 option is set then the NSS passwd SSD will be used to map the
184 PAM username to an LDAP DN. The passwd SSD must have already been
185 configured for this mapping to succeed.
187 If neither the authz2dn nor the uid2dn mapping succeeds, the module
188 will return a PAM_USER_UNKNOWN failure code. If both options are set,
189 the authz mapping is attempted first; if it succeeds the uid2dn mapping
197 .B nssov-pam-defhost <hostname>
198 Specify a default hostname to check if an ipHost entry for the current
199 hostname cannot be found. This setting is only relevant if the
203 .B nssov-pam-group-dn <DN>
204 Specify the DN of an LDAP group to check for authorization. The LDAP user
205 must be a member of this group for the login to be allowed. There is no
206 default value. This setting is only relevant if the
210 .B nssov-pam-group-ad <attribute>
211 Specify the attribute to use for group membership checks.
212 There is no default value. This setting is only relevant if the
216 .B nssov-pam-min-uid <integer>
217 Specify a minimum uid that is allowed to login. Users with a uidNumber
218 lower than this value will be denied access. The default is zero, which
219 disables this setting.
221 .B nssov-pam-max-uid <integer>
222 Specify a maximum uid that is allowed to login. Users with a uidNumber
223 higher than this value will be denied access. The default is zero, which
224 disables this setting.
226 .B nssov-pam-template-ad <attribute>
227 Specify an attribute to check in a user's entry for a template login name.
228 The template login feature is used by FreeBSD's PAM framework. It can be
229 viewed as a form of proxying, where a user can authenticate with one
230 username/password pair, but is assigned the identity and credentials of
231 the template user. This setting is disabled by default.
233 .B nssov-pam-template <name>
234 Specify a default username to be used if no template attribute is found
235 in the user's entry. The
236 .B nssov-pam-template-ad
237 directive must be configured for this setting to have any effect.
239 .B nssov-pam-session <service>
240 Specify a PAM service name whose sessions will be recorded. For the
241 configured services, logins will be recorded in the
243 operational attribute of the user's entry. The attribute's values are
247 .B <generalizedTime> <host> <service> <tty> (<ruser@rhost>)
250 Upon logout the corresponding value will be deleted. This feature allows
251 a single LDAP Search to be used to check which users are logged in across
252 all the hosts of a network. The rootdn of the database is used to perform
253 the updates of the loginStatus attribute, so a rootdn must already be
254 configured for this feature to work. By default no services are configured.
256 The PAM functions support LDAP Password Policy as well. If the password
257 policy overlay is in use (see
258 .BR slapo-ppolicy (5)),
260 information (e.g. password expiration, password quality, etc.)
261 may be returned to the PAM client as a result of authentication,
262 account management, and password modification requests.
264 The overlay also supports dynamic configuration in cn=config. An example
265 of the config entry is
269 dn: olcOverlay={0}nssov,ocDatabase={1}hdb,cn=config
270 objectClass: olcOverlayConfig
271 objectClass: olcNssOvConfig
273 olcNssSsd: passwd ldap:///ou=users,dc=example,dc=com??one
274 olcNssMap: passwd uid accountName
275 olcNssPam: hostservice uid2dn
276 olcNssPamDefHost: defaulthost
278 olcNssPamMaxUid: 32000
279 olcNssPamSession: login
280 olcNssPamSession: sshd
284 which enables the passwd service, and uses the accountName attribute to
285 fetch what is usually retrieved from the uid attribute. It also enables
286 some PAM authorization controls, and specifies that the PAM
290 services should have their logins recorded.
294 default slapd configuration file
297 .BR slapd\-config (5),
299 .BR slapo\-pcache (5),
300 .BR slapo\-ppolicy (5),
303 Howard Chu, inspired by nss-ldapd by Arthur de Jong and pam_ldap by Luke Howard