#### 3.2.20 The `ldap` Statement ¶

#### Syntax ¶

    ldap {
      # Enable LDAP lookups.
      enable bool;
      # Set URL of the LDAP server.
      url url;
      # Base DN for LDAP lookups.
      base string;
      # DN for accessing LDAP database.
      binddn string;
      # Password for use with binddn.
      passwd string;
      # Use TLS encryption.
      tls bool;
      # Set LDAP debugging level.
      debug number;
      # Set a field-map for parsing LDAP replies.
      field-map list;
      # LDAP filter to use for getpwnam requests.
      getpwnam string;
      # LDAP filter to use for getpwuid requests.
      getpwuid filter;
    }

#### Description ¶

The `ldap` statement configures the use of LDAP for authentication.

Configuration: enable bool ¶

  Enables LDAP lookups. If absent, ‘`enable On`’ is assumed.

Configuration: url url ¶

  Sets the URL of the LDAP server.

Configuration: base string ¶

  Defines base DN for LDAP lookups.

Configuration: binddn string ¶

  Defines the DN for accessing LDAP database.

Configuration: passwd string ¶

  Password for use when binding to the database.

Configuration: tls bool ¶

  Enable the use of TLS when connecting to the server.

Configuration: debug number ¶

  Set LDAP debug level. Please refer to the OpenLDAP documentation, for allowed number values and their meaning.

Configuration: field-map map ¶

  Defines a map for parsing LDAP replies. The map is a list of mappings1. Each mapping is ‘`field=attr`’, where attr is the name of the LDAP attribute and field is a field name that declares what information that attribute carries. Available values for field are:

  name

    User name.

  passwd

    User password.

  uid

    UID of the user.

  gid

    GID of the primary group.

  gecos

    Textual description of the user.

  dir

    User’s home directory

  shell

    User’s shell program.

  The default mapping is

        ("name=uid",
         "passwd=userPassword",
         "uid=uidNumber",
         "gid=gidNumber",
         "gecos=gecos",
         "dir=homeDirectory",
         "shell=loginShell")

Configuration: getpwnam string ¶

  Defines the LDAP filter to use for ‘`getpwnam`’ requests. The default is:

        (&(objectClass=posixAccount) (uid=$user))

Configuration: getpwuid string ¶

  Defines the LDAP filter to use for ‘`getpwuid`’ requests. The default filter is:

        (&(objectClass=posixAccount) (uidNumber=$user))

#### Footnotes

##### (1)

For backward compatibility, map can be a string containing colon-delimited list of mappings. Such usage is, however, deprecated.