From 4f5791ebd03eaec1c7da0865a383175b05102712 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 5 May 2024 19:47:29 +0200
Subject: Adding upstream version 2:4.17.12+dfsg.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 .../smbdotconf/ldap/clientldapsaslwrapping.xml     | 41 ++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml

(limited to 'docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml')

diff --git a/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml b/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml
new file mode 100644
index 0000000..21bd209
--- /dev/null
+++ b/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml
@@ -0,0 +1,41 @@
+<samba:parameter name="client ldap sasl wrapping"
+                 context="G"
+                 type="enum"
+                 enumlist="enum_ldap_sasl_wrapping"
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+	<para>
+	The <smbconfoption name="client ldap sasl wrapping"/> defines whether
+	ldap traffic will be signed or signed and encrypted (sealed). 
+	Possible values are <emphasis>plain</emphasis>, <emphasis>sign</emphasis> 
+	and <emphasis>seal</emphasis>. 	
+	</para>
+
+	<para>
+	The values <emphasis>sign</emphasis> and <emphasis>seal</emphasis> are 
+	only available if Samba has been compiled against a modern 
+	OpenLDAP version (2.3.x or higher).
+	</para>
+	
+	<para>
+	This option is needed firstly to secure the privacy of
+	administrative connections from <command>samba-tool</command>,
+	including in particular new or reset passwords for users. For
+	this reason the default is <emphasis>seal</emphasis>.</para>
+
+	<para>Additionally, <command>winbindd</command> and the
+	<command>net</command> tool can use LDAP to communicate with
+	Domain Controllers, so this option also controls the level of
+	privacy for those connections.  All supported AD DC versions
+	will enforce the usage of at least signed LDAP connections by
+	default, so a value of at least <emphasis>sign</emphasis> is
+	required in practice.
+	</para>
+
+	<para>
+	The default value is <emphasis>seal</emphasis>. That implies synchronizing the time
+	with the KDC in the case of using <emphasis>Kerberos</emphasis>.
+	</para>
+</description>
+<value type="default">seal</value>
+</samba:parameter>
-- 
cgit v1.2.3