Pwcheck — Cyrus SASL 2.1.28 documentation

- Home
- Cyrus IMAP
- Download
- Contribute

# Cyrus SASL

# Pwcheck

## Auxprop

## Auxprop-hashed

## Saslauthd

What is saslauthd? saslauthd is a daemon which validates

`ldap_servers` - `ldap://localhost`

> Specify a space separated list of LDAP server URIs of the form ldap[si]://[name[:port]]. See the `ldap.conf` URI option for formatting details.

`ldap_bind_dn` - none

> When simple authentication is desired, specify a distinguished name to use for a simple authenticated bind or a simple unauthenticated bind. Do not specify if an anonymous bind is desired. This option is ignored when the evaluated `ldap_auth_method` is `fastbind`.

`ldap_bind_pw` - none

> `ldap_bind_pw` is an alias for `ldap_password`.

`ldap_password` - none

> When simple authentication is desired, specify a password to perform an authenticated bind, or do not specify for an unauthenticated or anonymous bind. When SASL authentication is desired, specify a password to use where required by the underlying SASL mechanism. This option is ignored when the evaluated `ldap_auth_method` is `fastbind`.

`ldap_version` - 3

> Defaults to version 3. If `ldap_use_sasl` or `ldap_start_tls` are enabled, this option will be ignored, and will conform to the default value. Version 3 is compatible with anonymous binds, simple authenticated binds and simple unauthenticated binds. Version 2 should only be necessary where required by the server.

`ldap_search_base` - none

> When `ldap_auth_method` is evaluated as bind, `ldap_search_base` will be used to search for the user’s distinguished name. When `ldap_auth_method` is custom, `ldap_search_base` will be used to find the user’s `ldap_password_attr` attribute. When `ldap_auth_method` is evaluated as fastbind, `ldap_search_base` is ignored. If `ldap_search_base` contains substitution tokens, they will be replaced as specified in the `ldap_filter` token expansion rules.

`ldap_filter` - uid=%u

> When `ldap_auth_method` is evaluated as bind, `ldap_filter` will be used to search for the user’s distinguished name. When `ldap_auth_method` is custom, `ldap_filter` will become, after token expansion, the user’s distinguished name. When `ldap_auth_method` is evaluated as fastbind, `ldap_filter` is ignored.

> The following tokens, when contained within the `ldap_filter` option, will be substituted with the specified values:

> `%%`

> > is replaced with a literal %.

> `%u`

> > is replaced with the userid to be authenticated.

> `%U`

> > is replaced by the portion of the userid before the first @ character. If an @ character does not exist in the userid, then `%U` would function identically to `%u`. For example, if the userid to be authenticated is jsmith@example.org, `%u` would be replaced by jsmith@example.org and `%U` would be replaced by jsmith.

> `%d`

> > is replaced by the portion of the userid after the first @ character. If an @ character does not exist in the userid, `%d` will be replaced by the `realm` value passed to `saslauthd`. If no `realm` value was passed to saslauthd, `%d` will be replaced by the configured `ldap_default_realm`, or by an empty string if `ldap_default_realm` is not configured.

> `%1-9`

> > Within a userid which contains an @ character, followed by a domain name, `%1` will be replaced by the top level domain, `%2` will be replaced by the secondary domain, `%3` will be replaced by the tertiary domain, up to and including `%9` which would be replaced by the ninth level domain. If no @ character exists in the userid, or if there is no domain name after the @ character, or if the specified hierarchical domain level does not exist, the option is replaced by the `realm` value passed to `saslauthd`. Should no `realm` value exist in those scenarios, the option is replaced by the configured `ldap_default_realm`, or by an empty string if `ldap_default_realm` has not been configured.

> > For example, if the userid to be authenticated is jsmith@example.org, `%1` would be replaced by org and `%2` would be replaced by example.

> `%s`

> > is replaced by the `service` option passed to `saslauthd`, or by an empty string if no `service` option was passed.

> `%r`

> > is replaced by the `realm` option passed to `saslauthd`. If no `realm` value was passed to saslauthd, `%r` will be replaced by the configured `ldap_default_realm`, or by an empty string if `ldap_default_realm` is not configured.

`ldap_password_attr` - userPassword

> When `ldap_auth_method` is evaluated as custom, `ldap_password_attr` specifies an attribute that will be requested and retrived. If successfully retrived, the authentication request will succeed if the `ldap_password_attr` attribute contains a supported password hash, and if the user submitted password matches the hash. When `ldap_auth_method` is bind or fastbind, `ldap_password_attr` is ignored.

`ldap_group_dn` - none

> If `ldap_group_dn` is specified, group authorization must also succeed (in addition to the prior authentication step), for the user’s authentication attempt to be successful. If `ldap_group_dn` contains substitution tokens, they will be replaced as specified in the `ldap_filter` token expansion rules. One additional token substitution is applicable to `ldap_group_dn`:

> `%D`

> > is replaced by the distinguished name that was specified, or evaluated, in the authentication step. If `ldap_use_sasl` is enabled, the distinguished name will be resolved by performing an ldapwhoami extended operation after a successful authentication. If `ldap_group_dn` is specified and `ldap_use_sasl` is enabled, but the ldap server does not support the ldapwhoami extended operation, or if the ldapwhoami extended operation fails, then the user’s authentication attempt is unsuccessful.

`ldap_group_attr` - uniqueMember

> `ldap_group_attr` is ignored unless `ldap_group_dn` is also specified and `ldap_group_match_method` is attr. `ldap_group_attr` specifies an attribute which contains the authenticating identity’s dinstinguished name. See the `ldap_group_match_method` entry for additional details.

`ldap_group_filter` - none

`ldap_group_search_base` - defaults to the evaluated `ldap_search_base`

`ldap_group_scope` - sub

`ldap_group_match_method` - attr

`ldap_default_realm` - none

`ldap_default_domain` - none

> `ldap_default_domain` is an alias for `ldap_default_realm`.

`ldap_auth_method` - bind

`ldap_timeout` - 5

`ldap_size_limit` - 1

`ldap_time_limit` - 5

`ldap_deref` - never

`ldap_referrals` - no

`ldap_restart` - yes

`ldap_scope` - sub

`ldap_use_sasl` - no

`ldap_id` - none

`ldap_sasl_authc_id` - none

`ldap_authz_id` - none

> Does not make any sense to supply an authz identity when performing sasl/fastbind.

`ldap_sasl_authz_id` - none

> `ldap_sasl_authz_id` is an alias for `ldap_authz_id`.

`ldap_realm` - none

`ldap_sasl_realm` -

`ldap_mech` -

> It doesn’t make any sense to use a mech that does not require an authname and password, when using fastbind.

`ldap_sasl_mech` -

`ldap_sasl_secprops` -

`ldap_start_tls` -

`ldap_tls_check_peer` -

`ldap_tls_cacert_file` -

`ldap_tls_cacert_dir` -

`ldap_tls_ciphers` -

`ldap_tls_cert` -

`ldap_tls_key` -

`ldap_debug` -

## Authdaemon

## Alwaystrue

## Auto Transition