1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
|
[General]
#Verbosity = 0
# The following should be set to the local NFSv4 domain name
# The default is the host's DNS domain name.
#Domain = local.domain.edu
# In multi-domain environments, some NFS servers will append the identity
# management domain to the owner and owner_group in lieu of a true NFSv4
# domain. This option can facilitate lookups in such environments. If
# set to a value other than "none", the nsswitch plugin will first pass
# the name to the password/group lookup function without stripping the
# domain off. If that mapping fails then the plugin will try again using
# the old method (comparing the domain in the string to the Domain value,
# stripping it if it matches, and passing the resulting short name to the
# lookup function). Valid values are "user", "group", "both", and
# "none". The default is "none".
#No-Strip = none
# Winbind has a quirk whereby doing a group lookup in UPN format
# (e.g. staff@americas.example.com) will cause the group to be
# displayed prefixed with the full domain in uppercase
# (e.g. AMERICAS.EXAMPLE.COM\staff) instead of in the familiar netbios
# name format (e.g. AMERICAS\staff). Setting this option to true
# causes the name to be reformatted before passing it to the group
# lookup function in order to work around this. This setting is
# ignored unless No-Strip is set to either "both" or "group".
# The default is "false".
#Reformat-Group = false
# The following is a comma-separated list of Kerberos realm
# names that should be considered to be equivalent to the
# local realm, such that <user>@REALM.A can be assumed to
# be the same user as <user>@REALM.B
# If not specified, the default local realm is the domain name,
# which defaults to the host's DNS domain name,
# translated to upper-case.
# Note that if this value is specified, the local realm name
# must be included in the list!
#Local-Realms =
[Mapping]
#Nobody-User = nobody
#Nobody-Group = nobody
[Translation]
# Translation Method is an comma-separated, ordered list of
# translation methods that can be used. Distributed methods
# include "nsswitch", "umich_ldap", and "static". Each method
# is a dynamically loadable plugin library.
# New methods may be defined and inserted in the list.
# The default is "nsswitch".
#Method = nsswitch
# Optional. This is a comma-separated, ordered list of
# translation methods to be used for translating GSS
# authenticated names to ids.
# If this option is omitted, the same methods as those
# specified in "Method" are used.
#GSS-Methods = <alternate method list for translating GSS names>
#-------------------------------------------------------------------#
# The following are used only for the "static" Translation Method.
#-------------------------------------------------------------------#
[Static]
# A "static" list of GSS-Authenticated names to
# local user name mappings
#someuser@REALM = localuser
#-------------------------------------------------------------------#
# The following are used only for the "umich_ldap" Translation Method.
#-------------------------------------------------------------------#
[UMICH_SCHEMA]
# server information (REQUIRED)
LDAP_server = ldap-server.local.domain.edu
# the default search base (REQUIRED)
LDAP_base = dc=local,dc=domain,dc=edu
#-----------------------------------------------------------#
# The remaining options have defaults (as shown)
# and are therefore not required.
#-----------------------------------------------------------#
# whether or not to perform canonicalization on the
# name given as LDAP_server
#LDAP_canonicalize_name = true
# absolute search base for (people) accounts
#LDAP_people_base = <LDAP_base>
# absolute search base for groups
#LDAP_group_base = <LDAP_base>
# Whether to follow ldap referrals
#LDAP_follow_referrals = true
# Set to true to enable SSL - anything else is not enabled
#LDAP_use_ssl = false
# Controls the LDAP server certificate validation behavior
# It can take the same values as ldap.conf(5)'s TLS_REQCERT
# tunable
#LDAP_tls_reqcert = "hard"
# Location of CA certificate, mandatory if LDAP_tls_reqcert
# is not set to "never"
#LDAP_ca_cert = /etc/ldapca.cert
# SASL mechanism to use while binding to LDAP
#LDAP_sasl_mech = <SASL mech>
# SASL realm to be used for SASL auth
#LDAP_sasl_realm = <SASL realm>
# Authentication identity to be used for SASL auth
#LDAP_sasl_authcid = <SASL authcid>
# Authorization identity for SASL auth
#LDAP_sasl_authzid = <SASL authzid>
# Cyrus SASL security properties
#LDAP_sasl_secprops = <secprops>
# Specifies whether the LDAP server hostname should be canonicalised.
# If set to yes LDAP lib with do a reverse hostname lookup.
# If this is not set the LDAP library's default will be used.
#LDAP_sasl_canonicalize <yes | no>
# Specifies the kerberos ticket cache to be used
#LDAP_sasl_krb5_ccname = <kerberos ticket cache>
# Objectclass mapping information
# Mapping for the person (account) object class
#NFSv4_person_objectclass = NFSv4RemotePerson
# Mapping for the nfsv4name attribute the person object
#NFSv4_name_attr = NFSv4Name
# Mapping for the UID number
#NFSv4_uid_attr = UIDNumber
# Mapping for the GSSAPI Principal name
#GSS_principal_attr = GSSAuthName
# Mapping for the account name attribute (usually uid)
# The value for this attribute must match the value of
# the group member attribute - NFSv4_member_attr
#NFSv4_acctname_attr = uid
# Mapping for the group object class
#NFSv4_group_objectclass = NFSv4RemoteGroup
# Mapping for the GID attribute
#NFSv4_gid_attr = GIDNumber
# Mapping for the Group NFSv4 name
#NFSv4_group_attr = NFSv4Name
# Mapping for the Group member attribute (usually memberUID)
# The value of this attribute must match the value of NFSv4_acctname_attr
#NFSv4_member_attr = memberUID
|
