web2ldap - hosts.py

This section describes the parameters related to specific LDAP hosts/backends.

ldap_uri_list

List of LDAP URLs which will appear in the default select list of the login form. It may contain either strings (only a LDAP URL) or 2-tuples of strings containing LDAP URL and description.

Example:

ldap_uri_list = [
  'ldap://localhost',
  ('ldap://ldap.openldap.org',u"OpenLDAP's demo server"),
]
    

ldap_def

This is a string-keyed dictionary (Python data structure) which holds all options specific for certain LDAP hosts or backends( naming contexts). The values of the dictionary ldap_def are of the simple class Web2LDAPConfig which is instantiated via key word arguments.
Any configuration parameter in the dictionary web2ldapcnf.hosts.ldap_def is retrieved by looking at string-key 'ldap://ldap_host/ldap_basedn', 'ldap_host' and '_' in this particular order.
This allows to hold several database backends on the same host with the same DNS name. It also shortens the ldap_def dictionary by avoiding having to repeat same options for every server and makes browsing of completely unconfigured hosts easy.

Example:

ldap_def = {

  '_': {
    # Default fall-back options
  },

  'nldap.com': {
    # Per-host options for host nldap.com
  },

  'ldap://localhost/dc=stroeder,dc=com': {
    # Options dictionary entries for backend
    # on host localhost with naming context dc=stroeder,dc=com
  }

}
  

addform_oc_list

Default:

[]

Example:

binddnsearch

Search filter template for smart login. Occurences of %s are substituted by the string the user entered.
Note:
Think about using indexed attributes here! A bad filter template can be a performance hog.

Default:

'(uid=%s)'

Example:

description

Textual description of the host or backend.

Default:

''

login_template

HTML template file for the input fields of a Login Form. The HTML document must not contain HTML <head> section, <body> or <html> tags.

Default:

''

groupadm_defs

Dictionary containing definitions about group entries storing members in multi-valued member attributes. This is used in the group admin mask. The dictionary's keys are the name of the group entry object classes. The dictionary values are 2-tuples representing the name of the multi-valued member attribute in the group entry and the attribute type name of the user attribute which is put to/removed from the group entry.

Default:

{}

Example:

groupadm_defs={
  'groupOfNames':       ('member',None),
  'groupOfUniqueNames': ('uniqueMember',None),
  'rfc822MailGroup':    ('mail','mail'),
  'mailGroup':          ('mgrprfc822mailmember','mail'),
  'accessGroup':        ('member',None),
  'posixGroup':         ('memberUid','uid'),
},
          

passwd_hashtypes

List of strings specifying the allowed password-hash types. Valid values of implemented hashing schemes are:

'' (empty string)

no hashing, plain text

'crypt'

Unix crypt algorithm (with salt like used with Unix passwd)

'md5'

MD5 hash

'smd5'

salted MD5 hash

'sha'

SHA-1 hash

'ssha'

salted SHA-1 hash

The hash-based encodings require the appropriate Python modules to be installed on your system. The presence of the modules is automatically detected and the displayed select list shows the available password hash-types.

Default:

[]

Example (allow only salted MD5 and salted SHA-1):

'passwd_hashtypes':['smd5','ssha']

print_cols

Number of columns for printable output.

Default:

'4'

print_template

HTML template files for printing table entries. This is a dictionary with object class names as key and path names of HTML template files as value.

Default:

None

read_operationalattrstemplate

Path name of a HTML template file for displaying operational attributes at the bottom when displaying a single entry.

Default:

''

read_template

Dictionary defining HTML templates for displaying entries of certain object classes.

Default:

{}

requested_attrs

List of attribute type names which are explicitly requested when doing a search/read or modify operation. This is meant for accessing operational attributes which the LDAP server does not return without being asked for them.

Default:

[]

schema_uri

URI pointing to fake sub schema sub entry. If schema_uri is a LDAP URL an LDAP server is queried directly. Otherwise schema_uri is assumed to point to a LDIF file.

Default:

None

search_attrs

Attribute types which should be present in search attribute type select list of advanced search form.

Default:

['cn','mail']

Example:

search_attrs = ['cn','mail','o','ou','st','uid','telephonenumber','description']

search_attrsonly

There are some situations in which web2ldap just wants to get the existing attribute types of an entry and not the data itself for saving bandwidth. However some broken LDAP hosts (e.g. Notes Domino 4.61) have problems with such an attributetype-only request, they won't return any matches for a search. If you experience this problems (no matching entry) set this to 0.

Default:

1

search_resultsperpage

Integer which specifies the number of results shown per page. This affects the select list of the search form and displaying results of a search without prior use of a search form.

Default:

10

search_tablistattrs

Default:

[]

search_tdtemplate

HTML template strings used to display entries in the table of search results depending on the object class of an entry. This is a dictionary with object class names as key and HTML templates strings as value.

Default:

{}

searchform_template

HTML template file for the input fields of a Basic Search Form. The HTML document must not contain HTML <head> section, <body> or <html> tags.

Default:

''

ssl_minlevel

Defines the minimum required SSL security level for accessing this host/backend through the web2ldap gateway.

Default:

0

ssl_valid_dn

Regex describing the valid subject DNs of client certificates.

Default:

''

ssl_valid_idn

Regex describing the valid DNs of issuer certificates of valid client certificates.

Default:

''

starttls

Integer defining whether StartTLS should not be used (value 0), StartTLS should be tried (value 1) or use of StartTLS is mandantory (value 2) for connecting to this server. Does only make sense per server.

Default:

0

tls_cacertdir

Specifies the directory that contains certificates for all of the Certificate Authorities that will be recognized.

Default:

''

tls_cacertfile

Specifies the file that contains certificates for all of the Certificate Authorities that will be recognized.

Default:

''

tls_certfile

Specifies the file that contains the client certificate for strong SSL/TLS-based authentication.

Default:

''

tls_keyfile

Specifies the file that contains the client key file for strong SSL/TLS-based authentication.

Default:

''

timeout

Timeout value for LDAP operations on seconds. -1 switches off timeout handling.

Default:

-1

vcard_template

HTML template files for vCard downloading. This is a dictionary with object class names as key and path names of vCard template files as value.

Default:

{}

---

Page last modified: Wednesday, 12-Mar-2003 02:24:00 CET, sponsored by
stroeder.com - Information Technology, IT-Security, Identity Management, System Integration