You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by rb...@apache.org on 2015/04/15 18:35:22 UTC
svn commit: r1673855 [21/37] - /httpd/httpd/branches/2.4.x/docs/manual/mod/
Modified: httpd/httpd/branches/2.4.x/docs/manual/mod/mod_ldap.html.en
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/docs/manual/mod/mod_ldap.html.en?rev=1673855&r1=1673854&r2=1673855&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/docs/manual/mod/mod_ldap.html.en (original)
+++ httpd/httpd/branches/2.4.x/docs/manual/mod/mod_ldap.html.en Wed Apr 15 16:35:10 2015
@@ -85,6 +85,421 @@ by other LDAP modules</td></tr>
<li><img alt="" src="../images/down.gif" /> <a href="#settingcerts">SSL/TLS Certificates</a></li>
</ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPCacheEntries" id="LDAPCacheEntries">LDAPCacheEntries</a> <a name="ldapcacheentries" id="ldapcacheentries">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Maximum number of entries in the primary LDAP cache</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPCacheEntries <var>number</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPCacheEntries 1024</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>Specifies the maximum size of the primary LDAP cache. This
+ cache contains successful search/binds. Set it to 0 to turn off
+ search/bind caching. The default size is 1024 cached
+ searches.</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPCacheTTL" id="LDAPCacheTTL">LDAPCacheTTL</a> <a name="ldapcachettl" id="ldapcachettl">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Time that cached items remain valid</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPCacheTTL <var>seconds</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPCacheTTL 600</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>Specifies the time (in seconds) that an item in the
+ search/bind cache remains valid. The default is 600 seconds (10
+ minutes).</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPConnectionPoolTTL" id="LDAPConnectionPoolTTL">LDAPConnectionPoolTTL</a> <a name="ldapconnectionpoolttl" id="ldapconnectionpoolttl">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Discard backend connections that have been sitting in the connection pool too long</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPConnectionPoolTTL <var>n</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPConnectionPoolTTL -1</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.3.12 and later</td></tr>
+</table>
+ <p>Specifies the maximum age, in seconds, that a pooled LDAP connection can remain idle
+ and still be available for use. Connections are cleaned up when they are next needed,
+ not asynchronously.</p>
+
+ <p>A setting of 0 causes connections to never be saved in the backend
+ connection pool. The default value of -1, and any other negative value,
+ allows connections of any age to be reused.</p>
+
+ <p>For performance reasons, the reference time used by this directive is
+ based on when the LDAP connection is returned to the pool, not the time
+ of the last successful I/O with the LDAP server. </p>
+
+ <p>Since 2.4.10, new measures are in place to avoid the reference time
+ from being inflated by cache hits or slow requests. First, the reference
+ time is not updated if no backend LDAP conncetions were needed. Second,
+ the reference time uses the time the HTTP request was received instead
+ of the time the request is completed.</p>
+
+ <div class="note"><p>This timeout defaults to units of seconds, but accepts
+ suffixes for milliseconds (ms), minutes (min), and hours (h).
+ </p></div>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPConnectionTimeout" id="LDAPConnectionTimeout">LDAPConnectionTimeout</a> <a name="ldapconnectiontimeout" id="ldapconnectiontimeout">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the socket connection timeout in seconds</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPConnectionTimeout <var>seconds</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>This directive configures the LDAP_OPT_NETWORK_TIMEOUT (or LDAP_OPT_CONNECT_TIMEOUT)
+ option in the underlying LDAP client library, when available. This value
+ typically controls how long the LDAP client library will wait for the TCP
+ connection to the LDAP server to complete.</p>
+
+ <p> If a connection is not successful with the timeout period, either an error will be
+ returned or the LDAP client library will attempt to connect to a secondary LDAP
+ server if one is specified (via a space-separated list of hostnames in the
+ <code class="directive"><a href="../mod/mod_authnz_ldap.html#authldapurl">AuthLDAPURL</a></code>).</p>
+
+ <p>The default is 10 seconds, if the LDAP client library linked with the
+ server supports the LDAP_OPT_NETWORK_TIMEOUT option.</p>
+
+ <div class="note">LDAPConnectionTimeout is only available when the LDAP client library linked
+ with the server supports the LDAP_OPT_NETWORK_TIMEOUT
+ (or LDAP_OPT_CONNECT_TIMEOUT) option, and the ultimate behavior is
+ dictated entirely by the LDAP client library.
+ </div>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPLibraryDebug" id="LDAPLibraryDebug">LDAPLibraryDebug</a> <a name="ldaplibrarydebug" id="ldaplibrarydebug">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable debugging in the LDAP SDK</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPLibraryDebug <var>7</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>disabled</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>Turns on SDK-specific LDAP debug options that generally cause the LDAP
+ SDK to log verbose trace information to the main Apache error log.
+ The trace messages from the LDAP SDK provide gory details that
+ can be useful during debugging of connectivity problems with backend LDAP servers</p>
+
+ <p>This option is only configurable when Apache HTTP Server is linked with
+ an LDAP SDK that implements <code>LDAP_OPT_DEBUG</code> or
+ <code>LDAP_OPT_DEBUG_LEVEL</code>, such as OpenLDAP (a value of 7 is verbose)
+ or Tivoli Directory Server (a value of 65535 is verbose).</p>
+
+ <div class="warning">
+ <p>The logged information will likely contain plaintext credentials being used or
+ validated by LDAP authentication, so care should be taken in protecting and purging
+ the error log when this directive is used.</p>
+ </div>
+
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPOpCacheEntries" id="LDAPOpCacheEntries">LDAPOpCacheEntries</a> <a name="ldapopcacheentries" id="ldapopcacheentries">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Number of entries used to cache LDAP compare
+operations</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPOpCacheEntries <var>number</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPOpCacheEntries 1024</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>This specifies the number of entries <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code>
+ will use to cache LDAP compare operations. The default is 1024
+ entries. Setting it to 0 disables operation caching.</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPOpCacheTTL" id="LDAPOpCacheTTL">LDAPOpCacheTTL</a> <a name="ldapopcachettl" id="ldapopcachettl">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Time that entries in the operation cache remain
+valid</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPOpCacheTTL <var>seconds</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPOpCacheTTL 600</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>Specifies the time (in seconds) that entries in the
+ operation cache remain valid. The default is 600 seconds.</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPReferralHopLimit" id="LDAPReferralHopLimit">LDAPReferralHopLimit</a> <a name="ldapreferralhoplimit" id="ldapreferralhoplimit">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The maximum number of referral hops to chase before terminating an LDAP query.</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPReferralHopLimit <var>number</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SDK dependent, typically between 5 and 10</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
+<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>This directive, if enabled by the <code class="directive">LDAPReferrals</code> directive,
+ limits the number of referral hops that are followed before terminating an
+ LDAP query.</p>
+
+<div class="warning">
+<p> Support for this tunable is uncommon in LDAP SDKs.</p>
+</div>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPReferrals" id="LDAPReferrals">LDAPReferrals</a> <a name="ldapreferrals" id="ldapreferrals">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable referral chasing during queries to the LDAP server.</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPReferrals <var>On|Off|default</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPReferrals On</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
+<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>The <var>default</var> parameter is available in Apache 2.4.7 and later</td></tr>
+</table>
+ <p>Some LDAP servers divide their directory among multiple domains and use referrals
+ to direct a client when a domain boundary is crossed. This is similar to a HTTP redirect.
+ LDAP client libraries may or may not chase referrals by default. This directive
+ explicitly configures the referral chasing in the underlying SDK.</p>
+
+
+ <p><code class="directive">LDAPReferrals</code> takes the following values:</p>
+ <dl>
+ <dt>"on"</dt>
+ <dd> <p> When set to "on", the underlying SDK's referral chasing state
+ is enabled, <code class="directive">LDAPReferralHopLimit</code> is used to
+ override the SDK's hop limit, and an LDAP rebind callback is
+ registered.</p></dd>
+ <dt>"off"</dt>
+ <dd> <p> When set to "off", the underlying SDK's referral chasing state
+ is disabled completely.</p></dd>
+ <dt>"default"</dt>
+ <dd> <p> When set to "default", the underlying SDK's referral chasing state
+ is not changed, <code class="directive">LDAPReferralHopLimit</code> is not
+ used to overide the SDK's hop limit, and no LDAP rebind callback is
+ registered.</p></dd>
+ </dl>
+
+ <p>The directive <code class="directive">LDAPReferralHopLimit</code> works in conjunction with
+ this directive to limit the number of referral hops to follow before terminating the LDAP query.
+ When referral processing is enabled by a value of "On", client credentials will be provided,
+ via a rebind callback, for any LDAP server requiring them.</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPRetries" id="LDAPRetries">LDAPRetries</a> <a name="ldapretries" id="ldapretries">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configures the number of LDAP server retries.</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPRetries <var>number-of-retries</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPRetries 3</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>The server will retry failed LDAP requests up to
+ <code class="directive">LDAPRetries</code> times. Setting this
+ directive to 0 disables retries.</p>
+ <p>LDAP errors such as timeouts and refused connections are retryable.</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPRetryDelay" id="LDAPRetryDelay">LDAPRetryDelay</a> <a name="ldapretrydelay" id="ldapretrydelay">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configures the delay between LDAP server retries.</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPRetryDelay <var>seconds</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPRetryDelay 0</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>If <code class="directive">LDAPRetryDelay</code> is set to a non-zero
+ value, the server will delay retrying an LDAP request for the
+ specified amount of time. Setting this directive to 0 will
+ result in any retry to occur without delay.</p>
+
+ <p>LDAP errors such as timeouts and refused connections are retryable.</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPSharedCacheFile" id="LDAPSharedCacheFile">LDAPSharedCacheFile</a> <a name="ldapsharedcachefile" id="ldapsharedcachefile">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the shared memory cache file</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPSharedCacheFile <var>directory-path/filename</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>Specifies the directory path and file name of the shared memory
+ cache file. If not set, anonymous shared memory will be used if the
+ platform supports it.</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPSharedCacheSize" id="LDAPSharedCacheSize">LDAPSharedCacheSize</a> <a name="ldapsharedcachesize" id="ldapsharedcachesize">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Size in bytes of the shared-memory cache</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPSharedCacheSize <var>bytes</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPSharedCacheSize 500000</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>Specifies the number of bytes to allocate for the shared
+ memory cache. The default is 500kb. If set to 0, shared memory
+ caching will not be used and every HTTPD process will create its
+ own cache.</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPTimeout" id="LDAPTimeout">LDAPTimeout</a> <a name="ldaptimeout" id="ldaptimeout">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the timeout for LDAP search and bind operations, in seconds</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTimeout <var>seconds</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPTimeout 60</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.3.5 and later</td></tr>
+</table>
+ <p>This directive configures the timeout for bind and search operations, as well as
+ the LDAP_OPT_TIMEOUT option in the underlying LDAP client library, when available.</p>
+
+ <p> If the timeout expires, httpd will retry in case an existing connection has
+ been silently dropped by a firewall. However, performance will be much better if
+ the firewall is configured to send TCP RST packets instead of silently dropping
+ packets.</p>
+
+ <div class="note">
+ <p>Timeouts for ldap compare operations requires an SDK with LDAP_OPT_TIMEOUT, such as OpenLDAP >= 2.4.4.</p>
+ </div>
+
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPTrustedClientCert" id="LDAPTrustedClientCert">LDAPTrustedClientCert</a> <a name="ldaptrustedclientcert" id="ldaptrustedclientcert">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the file containing or nickname referring to a per
+connection client certificate. Not all LDAP toolkits support per
+connection client certificates.</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTrustedClientCert <var>type</var> <var>directory-path/filename/nickname</var> <var>[password]</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>It specifies the directory path, file name or nickname of a
+ per connection client certificate used when establishing an SSL
+ or TLS connection to an LDAP server. Different locations or
+ directories may have their own independent client certificate
+ settings. Some LDAP toolkits (notably Novell)
+ do not support per connection client certificates, and will throw an
+ error on LDAP server connection if you try to use this directive
+ (Use the LDAPTrustedGlobalCert directive instead for Novell client
+ certificates - See the SSL/TLS certificate guide above for details).
+ The type specifies the kind of certificate parameter being
+ set, depending on the LDAP toolkit being used. Supported types are:</p>
+ <ul>
+ <li>CA_DER - binary DER encoded CA certificate</li>
+ <li>CA_BASE64 - PEM encoded CA certificate</li>
+ <li>CERT_DER - binary DER encoded client certificate</li>
+ <li>CERT_BASE64 - PEM encoded client certificate</li>
+ <li>CERT_NICKNAME - Client certificate "nickname" (Netscape SDK)</li>
+ <li>KEY_DER - binary DER encoded private key</li>
+ <li>KEY_BASE64 - PEM encoded private key</li>
+ </ul>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPTrustedGlobalCert" id="LDAPTrustedGlobalCert">LDAPTrustedGlobalCert</a> <a name="ldaptrustedglobalcert" id="ldaptrustedglobalcert">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the file or database containing global trusted
+Certificate Authority or global client certificates</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTrustedGlobalCert <var>type</var> <var>directory-path/filename</var> <var>[password]</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>It specifies the directory path and file name of the trusted CA
+ certificates and/or system wide client certificates <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code>
+ should use when establishing an SSL or TLS connection to an LDAP
+ server. Note that all certificate information specified using this directive
+ is applied globally to the entire server installation. Some LDAP toolkits
+ (notably Novell) require all client certificates to be set globally using
+ this directive. Most other toolkits require clients certificates to be set
+ per Directory or per Location using LDAPTrustedClientCert. If you get this
+ wrong, an error may be logged when an attempt is made to contact the LDAP
+ server, or the connection may silently fail (See the SSL/TLS certificate
+ guide above for details).
+ The type specifies the kind of certificate parameter being
+ set, depending on the LDAP toolkit being used. Supported types are:</p>
+ <ul>
+ <li>CA_DER - binary DER encoded CA certificate</li>
+ <li>CA_BASE64 - PEM encoded CA certificate</li>
+ <li>CA_CERT7_DB - Netscape cert7.db CA certificate database file</li>
+ <li>CA_SECMOD - Netscape secmod database file</li>
+ <li>CERT_DER - binary DER encoded client certificate</li>
+ <li>CERT_BASE64 - PEM encoded client certificate</li>
+ <li>CERT_KEY3_DB - Netscape key3.db client certificate database file</li>
+ <li>CERT_NICKNAME - Client certificate "nickname" (Netscape SDK)</li>
+ <li>CERT_PFX - PKCS#12 encoded client certificate (Novell SDK)</li>
+ <li>KEY_DER - binary DER encoded private key</li>
+ <li>KEY_BASE64 - PEM encoded private key</li>
+ <li>KEY_PFX - PKCS#12 encoded private key (Novell SDK)</li>
+ </ul>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPTrustedMode" id="LDAPTrustedMode">LDAPTrustedMode</a> <a name="ldaptrustedmode" id="ldaptrustedmode">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the SSL/TLS mode to be used when connecting to an LDAP server.</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTrustedMode <var>type</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>The following modes are supported:</p>
+ <ul>
+ <li>NONE - no encryption</li>
+ <li>SSL - ldaps:// encryption on default port 636</li>
+ <li>TLS - STARTTLS encryption on default port 389</li>
+ </ul>
+
+ <p>Not all LDAP toolkits support all the above modes. An error message
+ will be logged at runtime if a mode is not supported, and the
+ connection to the LDAP server will fail.
+ </p>
+
+ <p>If an ldaps:// URL is specified, the mode becomes SSL and the setting
+ of LDAPTrustedMode is ignored.</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="directive-section"><h2><a name="LDAPVerifyServerCert" id="LDAPVerifyServerCert">LDAPVerifyServerCert</a> <a name="ldapverifyservercert" id="ldapverifyservercert">Directive</a></h2>
+<table class="directive">
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Force server certificate verification</td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPVerifyServerCert <var>On|Off</var></code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPVerifyServerCert On</code></td></tr>
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
+</table>
+ <p>Specifies whether to force the verification of a
+ server certificate when establishing an SSL connection to the
+ LDAP server.</p>
+
+</div>
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="exampleconfig" id="exampleconfig">Example Configuration</a></h2>
<p>The following is an example configuration that uses
@@ -252,590 +667,175 @@ LDAPTrustedGlobalCert CA_DER "/certs/cer
AuthBasicProvider ldap
AuthLDAPURL "ldaps://127.0.0.1/dc=example,dc=com?uid?one"
Require valid-user
-</Location></pre>
-
-
- <pre class="prettyprint lang-config"># Establish a TLS LDAP connection on port 389. Requires that
-# mod_ldap and mod_authnz_ldap be loaded. Change the
-# "yourdomain.example.com" to match your domain.
-
-LDAPTrustedGlobalCert CA_DER "/certs/certfile.der:
-
-<Location "/ldap-status">
- SetHandler ldap-status
-
- Require host yourdomain.example.com
-
- Satisfy any
- AuthType Basic
- AuthName "LDAP Protected"
- AuthBasicProvider ldap
- AuthLDAPURL "ldap://127.0.0.1/dc=example,dc=com?uid?one" TLS
- Require valid-user
-</Location></pre>
-
-
-</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="section">
-<h2><a name="settingcerts" id="settingcerts">SSL/TLS Certificates</a></h2>
-
- <p>The different LDAP SDKs have widely different methods of setting
- and handling both CA and client side certificates.</p>
-
- <p>If you intend to use SSL or TLS, read this section CAREFULLY so as to
- understand the differences between configurations on the different LDAP
- toolkits supported.</p>
-
- <h3><a name="settingcerts-netscape" id="settingcerts-netscape">Netscape/Mozilla/iPlanet SDK</a></h3>
- <p>CA certificates are specified within a file called cert7.db.
- The SDK will not talk to any LDAP server whose certificate was
- not signed by a CA specified in this file. If
- client certificates are required, an optional key3.db file may
- be specified with an optional password. The secmod file can be
- specified if required. These files are in the same format as
- used by the Netscape Communicator or Mozilla web browsers. The easiest
- way to obtain these files is to grab them from your browser
- installation.</p>
-
- <p>Client certificates are specified per connection using the
- LDAPTrustedClientCert directive by referring
- to the certificate "nickname". An optional password may be
- specified to unlock the certificate's private key.</p>
-
- <p>The SDK supports SSL only. An attempt to use STARTTLS will cause
- an error when an attempt is made to contact the LDAP server at
- runtime.</p>
-
- <pre class="prettyprint lang-config"># Specify a Netscape CA certificate file
-LDAPTrustedGlobalCert CA_CERT7_DB "/certs/cert7.db"
-# Specify an optional key3.db file for client certificate support
-LDAPTrustedGlobalCert CERT_KEY3_DB "/certs/key3.db"
-# Specify the secmod file if required
-LDAPTrustedGlobalCert CA_SECMOD "/certs/secmod"
-<Location "/ldap-status">
- SetHandler ldap-status
-
- Require host yourdomain.example.com
-
- Satisfy any
- AuthType Basic
- AuthName "LDAP Protected"
- AuthBasicProvider ldap
- LDAPTrustedClientCert CERT_NICKNAME <nickname> [password]
- AuthLDAPURL "ldaps://127.0.0.1/dc=example,dc=com?uid?one"
- Require valid-user
-</Location></pre>
-
-
-
-
- <h3><a name="settingcerts-novell" id="settingcerts-novell">Novell SDK</a></h3>
-
- <p>One or more CA certificates must be specified for the Novell
- SDK to work correctly. These certificates can be specified as
- binary DER or Base64 (PEM) encoded files.</p>
-
- <p>Note: Client certificates are specified globally rather than per
- connection, and so must be specified with the LDAPTrustedGlobalCert
- directive as below. Trying to set client certificates via the
- LDAPTrustedClientCert directive will cause an error to be logged
- when an attempt is made to connect to the LDAP server..</p>
-
- <p>The SDK supports both SSL and STARTTLS, set using the
- LDAPTrustedMode parameter. If an ldaps:// URL is specified,
- SSL mode is forced, override this directive.</p>
-
- <pre class="prettyprint lang-config"># Specify two CA certificate files
-LDAPTrustedGlobalCert CA_DER "/certs/cacert1.der"
-LDAPTrustedGlobalCert CA_BASE64 "/certs/cacert2.pem"
-# Specify a client certificate file and key
-LDAPTrustedGlobalCert CERT_BASE64 "/certs/cert1.pem"
-LDAPTrustedGlobalCert KEY_BASE64 "/certs/key1.pem" [password]
-# Do not use this directive, as it will throw an error
-#LDAPTrustedClientCert CERT_BASE64 "/certs/cert1.pem"</pre>
-
-
-
-
- <h3><a name="settingcerts-openldap" id="settingcerts-openldap">OpenLDAP SDK</a></h3>
-
- <p>One or more CA certificates must be specified for the OpenLDAP
- SDK to work correctly. These certificates can be specified as
- binary DER or Base64 (PEM) encoded files.</p>
-
- <p>Both CA and client certificates may be specified globally
- (LDAPTrustedGlobalCert) or per-connection (LDAPTrustedClientCert).
- When any settings are specified per-connection, the global
- settings are superceded.</p>
-
- <p>The documentation for the SDK claims to support both SSL and
- STARTTLS, however STARTTLS does not seem to work on all versions
- of the SDK. The SSL/TLS mode can be set using the
- LDAPTrustedMode parameter. If an ldaps:// URL is specified,
- SSL mode is forced. The OpenLDAP documentation notes that SSL
- (ldaps://) support has been deprecated to be replaced with TLS,
- although the SSL functionality still works.</p>
-
- <pre class="prettyprint lang-config"># Specify two CA certificate files
-LDAPTrustedGlobalCert CA_DER "/certs/cacert1.der"
-LDAPTrustedGlobalCert CA_BASE64 "/certs/cacert2.pem"
-<Location "/ldap-status">
- SetHandler ldap-status
-
- Require host yourdomain.example.com
-
- LDAPTrustedClientCert CERT_BASE64 "/certs/cert1.pem"
- LDAPTrustedClientCert KEY_BASE64 "/certs/key1.pem"
- # CA certs respecified due to per-directory client certs
- LDAPTrustedClientCert CA_DER "/certs/cacert1.der"
- LDAPTrustedClientCert CA_BASE64 "/certs/cacert2.pem"
- Satisfy any
- AuthType Basic
- AuthName "LDAP Protected"
- AuthBasicProvider ldap
- AuthLDAPURL "ldaps://127.0.0.1/dc=example,dc=com?uid?one"
- Require valid-user
-</Location></pre>
-
-
-
-
- <h3><a name="settingcerts-solaris" id="settingcerts-solaris">Solaris SDK</a></h3>
-
- <p>SSL/TLS for the native Solaris LDAP libraries is not yet
- supported. If required, install and use the OpenLDAP libraries
- instead.</p>
-
-
-
- <h3><a name="settingcerts-microsoft" id="settingcerts-microsoft">Microsoft SDK</a></h3>
-
- <p>SSL/TLS certificate configuration for the native Microsoft
- LDAP libraries is done inside the system registry, and no
- configuration directives are required.</p>
+</Location></pre>
- <p>Both SSL and TLS are supported by using the ldaps:// URL
- format, or by using the LDAPTrustedMode directive accordingly.</p>
- <p>Note: The status of support for client certificates is not yet known
- for this toolkit.</p>
+ <pre class="prettyprint lang-config"># Establish a TLS LDAP connection on port 389. Requires that
+# mod_ldap and mod_authnz_ldap be loaded. Change the
+# "yourdomain.example.com" to match your domain.
-
+LDAPTrustedGlobalCert CA_DER "/certs/certfile.der:
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPCacheEntries" id="LDAPCacheEntries">LDAPCacheEntries</a> <a name="ldapcacheentries" id="ldapcacheentries">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Maximum number of entries in the primary LDAP cache</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPCacheEntries <var>number</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPCacheEntries 1024</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>Specifies the maximum size of the primary LDAP cache. This
- cache contains successful search/binds. Set it to 0 to turn off
- search/bind caching. The default size is 1024 cached
- searches.</p>
+<Location "/ldap-status">
+ SetHandler ldap-status
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPCacheTTL" id="LDAPCacheTTL">LDAPCacheTTL</a> <a name="ldapcachettl" id="ldapcachettl">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Time that cached items remain valid</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPCacheTTL <var>seconds</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPCacheTTL 600</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>Specifies the time (in seconds) that an item in the
- search/bind cache remains valid. The default is 600 seconds (10
- minutes).</p>
+ Require host yourdomain.example.com
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPConnectionPoolTTL" id="LDAPConnectionPoolTTL">LDAPConnectionPoolTTL</a> <a name="ldapconnectionpoolttl" id="ldapconnectionpoolttl">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Discard backend connections that have been sitting in the connection pool too long</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPConnectionPoolTTL <var>n</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPConnectionPoolTTL -1</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.3.12 and later</td></tr>
-</table>
- <p>Specifies the maximum age, in seconds, that a pooled LDAP connection can remain idle
- and still be available for use. Connections are cleaned up when they are next needed,
- not asynchronously.</p>
+ Satisfy any
+ AuthType Basic
+ AuthName "LDAP Protected"
+ AuthBasicProvider ldap
+ AuthLDAPURL "ldap://127.0.0.1/dc=example,dc=com?uid?one" TLS
+ Require valid-user
+</Location></pre>
- <p>A setting of 0 causes connections to never be saved in the backend
- connection pool. The default value of -1, and any other negative value,
- allows connections of any age to be reused.</p>
- <p>For performance reasons, the reference time used by this directive is
- based on when the LDAP connection is returned to the pool, not the time
- of the last successful I/O with the LDAP server. </p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="settingcerts" id="settingcerts">SSL/TLS Certificates</a></h2>
- <p>Since 2.4.10, new measures are in place to avoid the reference time
- from being inflated by cache hits or slow requests. First, the reference
- time is not updated if no backend LDAP conncetions were needed. Second,
- the reference time uses the time the HTTP request was received instead
- of the time the request is completed.</p>
-
- <div class="note"><p>This timeout defaults to units of seconds, but accepts
- suffixes for milliseconds (ms), minutes (min), and hours (h).
- </p></div>
+ <p>The different LDAP SDKs have widely different methods of setting
+ and handling both CA and client side certificates.</p>
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPConnectionTimeout" id="LDAPConnectionTimeout">LDAPConnectionTimeout</a> <a name="ldapconnectiontimeout" id="ldapconnectiontimeout">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the socket connection timeout in seconds</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPConnectionTimeout <var>seconds</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>This directive configures the LDAP_OPT_NETWORK_TIMEOUT (or LDAP_OPT_CONNECT_TIMEOUT)
- option in the underlying LDAP client library, when available. This value
- typically controls how long the LDAP client library will wait for the TCP
- connection to the LDAP server to complete.</p>
+ <p>If you intend to use SSL or TLS, read this section CAREFULLY so as to
+ understand the differences between configurations on the different LDAP
+ toolkits supported.</p>
- <p> If a connection is not successful with the timeout period, either an error will be
- returned or the LDAP client library will attempt to connect to a secondary LDAP
- server if one is specified (via a space-separated list of hostnames in the
- <code class="directive"><a href="../mod/mod_authnz_ldap.html#authldapurl">AuthLDAPURL</a></code>).</p>
+ <h3><a name="settingcerts-netscape" id="settingcerts-netscape">Netscape/Mozilla/iPlanet SDK</a></h3>
+ <p>CA certificates are specified within a file called cert7.db.
+ The SDK will not talk to any LDAP server whose certificate was
+ not signed by a CA specified in this file. If
+ client certificates are required, an optional key3.db file may
+ be specified with an optional password. The secmod file can be
+ specified if required. These files are in the same format as
+ used by the Netscape Communicator or Mozilla web browsers. The easiest
+ way to obtain these files is to grab them from your browser
+ installation.</p>
- <p>The default is 10 seconds, if the LDAP client library linked with the
- server supports the LDAP_OPT_NETWORK_TIMEOUT option.</p>
+ <p>Client certificates are specified per connection using the
+ LDAPTrustedClientCert directive by referring
+ to the certificate "nickname". An optional password may be
+ specified to unlock the certificate's private key.</p>
- <div class="note">LDAPConnectionTimeout is only available when the LDAP client library linked
- with the server supports the LDAP_OPT_NETWORK_TIMEOUT
- (or LDAP_OPT_CONNECT_TIMEOUT) option, and the ultimate behavior is
- dictated entirely by the LDAP client library.
- </div>
+ <p>The SDK supports SSL only. An attempt to use STARTTLS will cause
+ an error when an attempt is made to contact the LDAP server at
+ runtime.</p>
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPLibraryDebug" id="LDAPLibraryDebug">LDAPLibraryDebug</a> <a name="ldaplibrarydebug" id="ldaplibrarydebug">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable debugging in the LDAP SDK</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPLibraryDebug <var>7</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>disabled</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>Turns on SDK-specific LDAP debug options that generally cause the LDAP
- SDK to log verbose trace information to the main Apache error log.
- The trace messages from the LDAP SDK provide gory details that
- can be useful during debugging of connectivity problems with backend LDAP servers</p>
+ <pre class="prettyprint lang-config"># Specify a Netscape CA certificate file
+LDAPTrustedGlobalCert CA_CERT7_DB "/certs/cert7.db"
+# Specify an optional key3.db file for client certificate support
+LDAPTrustedGlobalCert CERT_KEY3_DB "/certs/key3.db"
+# Specify the secmod file if required
+LDAPTrustedGlobalCert CA_SECMOD "/certs/secmod"
+<Location "/ldap-status">
+ SetHandler ldap-status
- <p>This option is only configurable when Apache HTTP Server is linked with
- an LDAP SDK that implements <code>LDAP_OPT_DEBUG</code> or
- <code>LDAP_OPT_DEBUG_LEVEL</code>, such as OpenLDAP (a value of 7 is verbose)
- or Tivoli Directory Server (a value of 65535 is verbose).</p>
+ Require host yourdomain.example.com
- <div class="warning">
- <p>The logged information will likely contain plaintext credentials being used or
- validated by LDAP authentication, so care should be taken in protecting and purging
- the error log when this directive is used.</p>
- </div>
+ Satisfy any
+ AuthType Basic
+ AuthName "LDAP Protected"
+ AuthBasicProvider ldap
+ LDAPTrustedClientCert CERT_NICKNAME <nickname> [password]
+ AuthLDAPURL "ldaps://127.0.0.1/dc=example,dc=com?uid?one"
+ Require valid-user
+</Location></pre>
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPOpCacheEntries" id="LDAPOpCacheEntries">LDAPOpCacheEntries</a> <a name="ldapopcacheentries" id="ldapopcacheentries">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Number of entries used to cache LDAP compare
-operations</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPOpCacheEntries <var>number</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPOpCacheEntries 1024</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>This specifies the number of entries <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code>
- will use to cache LDAP compare operations. The default is 1024
- entries. Setting it to 0 disables operation caching.</p>
+
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPOpCacheTTL" id="LDAPOpCacheTTL">LDAPOpCacheTTL</a> <a name="ldapopcachettl" id="ldapopcachettl">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Time that entries in the operation cache remain
-valid</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPOpCacheTTL <var>seconds</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPOpCacheTTL 600</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>Specifies the time (in seconds) that entries in the
- operation cache remain valid. The default is 600 seconds.</p>
+ <h3><a name="settingcerts-novell" id="settingcerts-novell">Novell SDK</a></h3>
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPReferralHopLimit" id="LDAPReferralHopLimit">LDAPReferralHopLimit</a> <a name="ldapreferralhoplimit" id="ldapreferralhoplimit">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The maximum number of referral hops to chase before terminating an LDAP query.</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPReferralHopLimit <var>number</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SDK dependent, typically between 5 and 10</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
-<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>This directive, if enabled by the <code class="directive">LDAPReferrals</code> directive,
- limits the number of referral hops that are followed before terminating an
- LDAP query.</p>
+ <p>One or more CA certificates must be specified for the Novell
+ SDK to work correctly. These certificates can be specified as
+ binary DER or Base64 (PEM) encoded files.</p>
-<div class="warning">
-<p> Support for this tunable is uncommon in LDAP SDKs.</p>
-</div>
+ <p>Note: Client certificates are specified globally rather than per
+ connection, and so must be specified with the LDAPTrustedGlobalCert
+ directive as below. Trying to set client certificates via the
+ LDAPTrustedClientCert directive will cause an error to be logged
+ when an attempt is made to connect to the LDAP server..</p>
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPReferrals" id="LDAPReferrals">LDAPReferrals</a> <a name="ldapreferrals" id="ldapreferrals">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable referral chasing during queries to the LDAP server.</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPReferrals <var>On|Off|default</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPReferrals On</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
-<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>The <var>default</var> parameter is available in Apache 2.4.7 and later</td></tr>
-</table>
- <p>Some LDAP servers divide their directory among multiple domains and use referrals
- to direct a client when a domain boundary is crossed. This is similar to a HTTP redirect.
- LDAP client libraries may or may not chase referrals by default. This directive
- explicitly configures the referral chasing in the underlying SDK.</p>
+ <p>The SDK supports both SSL and STARTTLS, set using the
+ LDAPTrustedMode parameter. If an ldaps:// URL is specified,
+ SSL mode is forced, override this directive.</p>
+
+ <pre class="prettyprint lang-config"># Specify two CA certificate files
+LDAPTrustedGlobalCert CA_DER "/certs/cacert1.der"
+LDAPTrustedGlobalCert CA_BASE64 "/certs/cacert2.pem"
+# Specify a client certificate file and key
+LDAPTrustedGlobalCert CERT_BASE64 "/certs/cert1.pem"
+LDAPTrustedGlobalCert KEY_BASE64 "/certs/key1.pem" [password]
+# Do not use this directive, as it will throw an error
+#LDAPTrustedClientCert CERT_BASE64 "/certs/cert1.pem"</pre>
- <p><code class="directive">LDAPReferrals</code> takes the following values:</p>
- <dl>
- <dt>"on"</dt>
- <dd> <p> When set to "on", the underlying SDK's referral chasing state
- is enabled, <code class="directive">LDAPReferralHopLimit</code> is used to
- override the SDK's hop limit, and an LDAP rebind callback is
- registered.</p></dd>
- <dt>"off"</dt>
- <dd> <p> When set to "off", the underlying SDK's referral chasing state
- is disabled completely.</p></dd>
- <dt>"default"</dt>
- <dd> <p> When set to "default", the underlying SDK's referral chasing state
- is not changed, <code class="directive">LDAPReferralHopLimit</code> is not
- used to overide the SDK's hop limit, and no LDAP rebind callback is
- registered.</p></dd>
- </dl>
+
- <p>The directive <code class="directive">LDAPReferralHopLimit</code> works in conjunction with
- this directive to limit the number of referral hops to follow before terminating the LDAP query.
- When referral processing is enabled by a value of "On", client credentials will be provided,
- via a rebind callback, for any LDAP server requiring them.</p>
+ <h3><a name="settingcerts-openldap" id="settingcerts-openldap">OpenLDAP SDK</a></h3>
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPRetries" id="LDAPRetries">LDAPRetries</a> <a name="ldapretries" id="ldapretries">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configures the number of LDAP server retries.</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPRetries <var>number-of-retries</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPRetries 3</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>The server will retry failed LDAP requests up to
- <code class="directive">LDAPRetries</code> times. Setting this
- directive to 0 disables retries.</p>
- <p>LDAP errors such as timeouts and refused connections are retryable.</p>
+ <p>One or more CA certificates must be specified for the OpenLDAP
+ SDK to work correctly. These certificates can be specified as
+ binary DER or Base64 (PEM) encoded files.</p>
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPRetryDelay" id="LDAPRetryDelay">LDAPRetryDelay</a> <a name="ldapretrydelay" id="ldapretrydelay">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Configures the delay between LDAP server retries.</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPRetryDelay <var>seconds</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPRetryDelay 0</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>If <code class="directive">LDAPRetryDelay</code> is set to a non-zero
- value, the server will delay retrying an LDAP request for the
- specified amount of time. Setting this directive to 0 will
- result in any retry to occur without delay.</p>
+ <p>Both CA and client certificates may be specified globally
+ (LDAPTrustedGlobalCert) or per-connection (LDAPTrustedClientCert).
+ When any settings are specified per-connection, the global
+ settings are superceded.</p>
- <p>LDAP errors such as timeouts and refused connections are retryable.</p>
+ <p>The documentation for the SDK claims to support both SSL and
+ STARTTLS, however STARTTLS does not seem to work on all versions
+ of the SDK. The SSL/TLS mode can be set using the
+ LDAPTrustedMode parameter. If an ldaps:// URL is specified,
+ SSL mode is forced. The OpenLDAP documentation notes that SSL
+ (ldaps://) support has been deprecated to be replaced with TLS,
+ although the SSL functionality still works.</p>
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPSharedCacheFile" id="LDAPSharedCacheFile">LDAPSharedCacheFile</a> <a name="ldapsharedcachefile" id="ldapsharedcachefile">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the shared memory cache file</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPSharedCacheFile <var>directory-path/filename</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>Specifies the directory path and file name of the shared memory
- cache file. If not set, anonymous shared memory will be used if the
- platform supports it.</p>
+ <pre class="prettyprint lang-config"># Specify two CA certificate files
+LDAPTrustedGlobalCert CA_DER "/certs/cacert1.der"
+LDAPTrustedGlobalCert CA_BASE64 "/certs/cacert2.pem"
+<Location "/ldap-status">
+ SetHandler ldap-status
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPSharedCacheSize" id="LDAPSharedCacheSize">LDAPSharedCacheSize</a> <a name="ldapsharedcachesize" id="ldapsharedcachesize">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Size in bytes of the shared-memory cache</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPSharedCacheSize <var>bytes</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPSharedCacheSize 500000</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>Specifies the number of bytes to allocate for the shared
- memory cache. The default is 500kb. If set to 0, shared memory
- caching will not be used and every HTTPD process will create its
- own cache.</p>
+ Require host yourdomain.example.com
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPTimeout" id="LDAPTimeout">LDAPTimeout</a> <a name="ldaptimeout" id="ldaptimeout">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the timeout for LDAP search and bind operations, in seconds</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTimeout <var>seconds</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPTimeout 60</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.3.5 and later</td></tr>
-</table>
- <p>This directive configures the timeout for bind and search operations, as well as
- the LDAP_OPT_TIMEOUT option in the underlying LDAP client library, when available.</p>
+ LDAPTrustedClientCert CERT_BASE64 "/certs/cert1.pem"
+ LDAPTrustedClientCert KEY_BASE64 "/certs/key1.pem"
+ # CA certs respecified due to per-directory client certs
+ LDAPTrustedClientCert CA_DER "/certs/cacert1.der"
+ LDAPTrustedClientCert CA_BASE64 "/certs/cacert2.pem"
+ Satisfy any
+ AuthType Basic
+ AuthName "LDAP Protected"
+ AuthBasicProvider ldap
+ AuthLDAPURL "ldaps://127.0.0.1/dc=example,dc=com?uid?one"
+ Require valid-user
+</Location></pre>
- <p> If the timeout expires, httpd will retry in case an existing connection has
- been silently dropped by a firewall. However, performance will be much better if
- the firewall is configured to send TCP RST packets instead of silently dropping
- packets.</p>
- <div class="note">
- <p>Timeouts for ldap compare operations requires an SDK with LDAP_OPT_TIMEOUT, such as OpenLDAP >= 2.4.4.</p>
- </div>
+
+ <h3><a name="settingcerts-solaris" id="settingcerts-solaris">Solaris SDK</a></h3>
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPTrustedClientCert" id="LDAPTrustedClientCert">LDAPTrustedClientCert</a> <a name="ldaptrustedclientcert" id="ldaptrustedclientcert">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the file containing or nickname referring to a per
-connection client certificate. Not all LDAP toolkits support per
-connection client certificates.</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTrustedClientCert <var>type</var> <var>directory-path/filename/nickname</var> <var>[password]</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>It specifies the directory path, file name or nickname of a
- per connection client certificate used when establishing an SSL
- or TLS connection to an LDAP server. Different locations or
- directories may have their own independent client certificate
- settings. Some LDAP toolkits (notably Novell)
- do not support per connection client certificates, and will throw an
- error on LDAP server connection if you try to use this directive
- (Use the LDAPTrustedGlobalCert directive instead for Novell client
- certificates - See the SSL/TLS certificate guide above for details).
- The type specifies the kind of certificate parameter being
- set, depending on the LDAP toolkit being used. Supported types are:</p>
- <ul>
- <li>CA_DER - binary DER encoded CA certificate</li>
- <li>CA_BASE64 - PEM encoded CA certificate</li>
- <li>CERT_DER - binary DER encoded client certificate</li>
- <li>CERT_BASE64 - PEM encoded client certificate</li>
- <li>CERT_NICKNAME - Client certificate "nickname" (Netscape SDK)</li>
- <li>KEY_DER - binary DER encoded private key</li>
- <li>KEY_BASE64 - PEM encoded private key</li>
- </ul>
+ <p>SSL/TLS for the native Solaris LDAP libraries is not yet
+ supported. If required, install and use the OpenLDAP libraries
+ instead.</p>
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPTrustedGlobalCert" id="LDAPTrustedGlobalCert">LDAPTrustedGlobalCert</a> <a name="ldaptrustedglobalcert" id="ldaptrustedglobalcert">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the file or database containing global trusted
-Certificate Authority or global client certificates</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTrustedGlobalCert <var>type</var> <var>directory-path/filename</var> <var>[password]</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>It specifies the directory path and file name of the trusted CA
- certificates and/or system wide client certificates <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code>
- should use when establishing an SSL or TLS connection to an LDAP
- server. Note that all certificate information specified using this directive
- is applied globally to the entire server installation. Some LDAP toolkits
- (notably Novell) require all client certificates to be set globally using
- this directive. Most other toolkits require clients certificates to be set
- per Directory or per Location using LDAPTrustedClientCert. If you get this
- wrong, an error may be logged when an attempt is made to contact the LDAP
- server, or the connection may silently fail (See the SSL/TLS certificate
- guide above for details).
- The type specifies the kind of certificate parameter being
- set, depending on the LDAP toolkit being used. Supported types are:</p>
- <ul>
- <li>CA_DER - binary DER encoded CA certificate</li>
- <li>CA_BASE64 - PEM encoded CA certificate</li>
- <li>CA_CERT7_DB - Netscape cert7.db CA certificate database file</li>
- <li>CA_SECMOD - Netscape secmod database file</li>
- <li>CERT_DER - binary DER encoded client certificate</li>
- <li>CERT_BASE64 - PEM encoded client certificate</li>
- <li>CERT_KEY3_DB - Netscape key3.db client certificate database file</li>
- <li>CERT_NICKNAME - Client certificate "nickname" (Netscape SDK)</li>
- <li>CERT_PFX - PKCS#12 encoded client certificate (Novell SDK)</li>
- <li>KEY_DER - binary DER encoded private key</li>
- <li>KEY_BASE64 - PEM encoded private key</li>
- <li>KEY_PFX - PKCS#12 encoded private key (Novell SDK)</li>
- </ul>
+
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPTrustedMode" id="LDAPTrustedMode">LDAPTrustedMode</a> <a name="ldaptrustedmode" id="ldaptrustedmode">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the SSL/TLS mode to be used when connecting to an LDAP server.</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPTrustedMode <var>type</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>The following modes are supported:</p>
- <ul>
- <li>NONE - no encryption</li>
- <li>SSL - ldaps:// encryption on default port 636</li>
- <li>TLS - STARTTLS encryption on default port 389</li>
- </ul>
+ <h3><a name="settingcerts-microsoft" id="settingcerts-microsoft">Microsoft SDK</a></h3>
- <p>Not all LDAP toolkits support all the above modes. An error message
- will be logged at runtime if a mode is not supported, and the
- connection to the LDAP server will fail.
- </p>
+ <p>SSL/TLS certificate configuration for the native Microsoft
+ LDAP libraries is done inside the system registry, and no
+ configuration directives are required.</p>
- <p>If an ldaps:// URL is specified, the mode becomes SSL and the setting
- of LDAPTrustedMode is ignored.</p>
+ <p>Both SSL and TLS are supported by using the ldaps:// URL
+ format, or by using the LDAPTrustedMode directive accordingly.</p>
-</div>
-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-<div class="directive-section"><h2><a name="LDAPVerifyServerCert" id="LDAPVerifyServerCert">LDAPVerifyServerCert</a> <a name="ldapverifyservercert" id="ldapverifyservercert">Directive</a></h2>
-<table class="directive">
-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Force server certificate verification</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>LDAPVerifyServerCert <var>On|Off</var></code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>LDAPVerifyServerCert On</code></td></tr>
-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ldap</td></tr>
-</table>
- <p>Specifies whether to force the verification of a
- server certificate when establishing an SSL connection to the
- LDAP server.</p>
+ <p>Note: The status of support for client certificates is not yet known
+ for this toolkit.</p>
+
+
</div>
</div>