is a client-server protocol for accessing a directory service. Sympa provide various features based on access to one or more LDAP directories :
Sympa stores the data relative to the subscribers in a DataBase. Among these data: password, email exploited during the Web authentication. The module of allows to use Sympa in an intranet without duplicating user passwords.
This way users can indifferently authenticate with their ldap_uid, their alternate_email or their canonic email stored in the directory.
Sympa gets the canonic email in the directory with the ldap_uid or the alternate_email. Sympa will first attempt an anonymous bind to the directory to get the user's DN, then Sympa will bind with the DN and the user's ldap_password in order to perform an efficient authentication. This last bind will work only if the good ldap_password is provided. Indeed the value returned by the bind(DN,ldap_password) is tested.
Example: a person is described by
Dn:cn=Fabrice Rafart, ou=Siege , o=MaSociete , c=FR Objectclass: person Cn: Fabrice Rafart Title: Network Responsible O: Siege Or: Data processing Telephonenumber: 01-00-00-00-00 Facsimiletelephonenumber:01-00-00-00-00 L:Paris Country: France uid: frafart mail: Fabrice.Rafart@MaSociete.fr alternate_email: frafart@MaSociete.fr alternate:rafart@MaSociete.fr
So Fabrice Rafart can be authenticated with: frafart, Fabrice.Rafart@MaSociete.fr, frafart@MaSociete.fr,Rafart@MaSociete.fr. After this operation, the address in the field FROM will be the Canonic email, in this case Fabrice.Rafart@MaSociete.fr. That means that Sympa will get this email and use it during all the session until you clearly ask Sympa to change your email address via the two pages : which and pref.
The /home/sympa/etc/auth.conf configuration file contains numerous parameters which are read on start-up of Sympa. If you change this file, do not forget that you will need to restart Sympa afterwards.
The /home/sympa/etc/auth.conf is organised in paragraphs. Each paragraph coincides with the configuration of an ldap directory.
The /home/sympa/etc/auth.conf file contains directives in the following format:
paragraphs
keyword value
paragraphs
keyword value
Comments start with the # character at the beginning of a line.
Empty lines are also considered as comments and are ignored at the beginning. After the first paragraph they are considered as paragraphs separators.
There should only be one directive per line, but their order in the file is of no importance.
Thanks to this type of configuration Sympa is able to consult various directories. So, users who come from different directories will be authenticated through their ldap_password. Indeed, Sympa will try to bind on the first directory with the given ldap_password. If it does not work, Sympa will try to bind on the second with the same ldap_password, etc. This mechanism is useful in the case of homonyms.
Example :
#Configuration file auth.conf for the LDAP authentification #Description of parameters for each directory ldap host ldap.univ-rennes1.fr:389 timeout 30 suffix dc=univ-rennes1,dc=fr get_dn_by_uid_filter (uid=[sender]) get_dn_by_email_filter (|(mail=[sender])(mailalternateaddress=[sender])) email_attribute mail alternative_email_attribute mailalternateaddress,ur1mail scope sub use_ssl 1 ssl_version sslv3 ssl_ciphers MEDIUM:HIGH ldap host ldap.univ-nancy2.fr:392,ldap1.univ-nancy2.fr:392,ldap2.univ-nancy2.fr:392 timeout 20 bind_dn cn=sympa,ou=people,dc=cru,dc=fr bind_password sympaPASSWD suffix dc=univ-nancy2,dc=fr get_dn_by_uid_filter (uid=[sender]) get_dn_by_email_filter (|(mail=[sender])(n2atraliasmail=[sender])) alternative_email_attribute n2atrmaildrop email_attribute mail scope sub authentication_info_url http://sso.univ-nancy2.fr/
This keyword is mandatory. It is the domain name used in order to bind to the directory and then to extract informations. You must mention the port number after the server name. Server replication is supported by listing several servers separated by commas.
Example :
host ldap.univ-rennes1.fr:389 host ldap0.university.com:389,ldap1.university.com:389,ldap2.university.com:389
It corresponds to the timelimit in the Search fonction. A timelimit that restricts the maximum time (in seconds) allowed for a search. A value of 0 (the default), means that no timelimit will be requested.
The root of the DIT (Directory Information Tree). The DN that is the base object entry relative to which the search is to be performed.
Example: dc=university,dc=fr
If anonymous bind is not allowed on the LDAP server, a DN and password can be used.
This password is used, combined with the bind_dn above.
Defines the search filter corresponding to the ldap_uid. (RFC 2254 compliant). If you want to apply the filter on the user, use the variable ' [sender] '. It will work with every type of authentication (uid, alternate_email..).
Example :
(Login = [sender]) (|(ID = [sender])(UID = [sender]))
Defines the search filter corresponding to the email addresses (canonic and alternative).(RFC 2254 compliant). If you want to apply the filter on the user, use the variable ' [sender] '. It will work with every type of authentication (uid, alternate_email..).
Example: a person is described by
Dn:cn=Fabrice Rafart, ou=Siege , o=MaSociete , c=FR Objectclass: person Cn: Fabrice Rafart Title: Network Responsible O: Siege Or: Data processing Telephonenumber: 01-00-00-00-00 Facsimiletelephonenumber:01-00-00-00-00 L:Paris Country: France uid: frafart mail: Fabrice.Rafart@MaSociete.fr alternate_email: frafart@MaSociete.fr alternate:rafart@MaSociete.fr
The filters can be :
(mail = [sender]) (| (mail = [sender])(alternate_email = [sender]) ) (| (mail = [sender])(alternate_email = [sender])(alternate = [sender]) )
The name of the attribute for the canonic email in your directory : for instance mail, canonic_email, canonic_address ... In the previous example the canonic email is 'mail'.
The name of the attribute for the alternate email in your directory : for instance alternate_email, mailalternateaddress, ... You make a list of these attributes separated by commas.
With this list Sympa creates a cookie which contains various information : the user is authenticated via Ldap or not, his alternate email. To store the alternate email is interesting when you want to canonify your preferences and subscriptions. That is to say you want to use a unique address in User_table and Subscriber_table which is the canonic email.
(Default value: sub) By default the search is performed on the whole tree below the specified base object. This may be changed by specifying a scope :
Defines the URL of a document describing LDAP password management. When hitting Sympa's Send me a password button, LDAP users will be redirected to this URL.
If set to 1, connection to the LDAP server will use SSL (LDAPS).
This defines the version of the SSL/TLS protocol to use. Defaults of to sslv2/3, other possible values are sslv2, sslv3, and tlsv1.
Specify which subset of cipher suites are permissible for this connection, using the standard OpenSSL string format. The default value of for ciphers is ALL, which permits all ciphers, even those that don't encrypt!
At the moment Named Filters are only used in scenarii. They enable to select a category of people who will be authorized or not to realise some actions.
As a consequence, you can grant privileges in a list to people belonging to an directory thanks to a scenario.
People are selected through an defined in a configuration file. This file must have the extension '.ldap'.It is stored in /home/sympa/etc/search_filters/.
You must give several informations in order to create a Named Filter:
example.ldap : we want to select the professors of mathematics in the university of Rennes1 in France
host ldap.univ-rennes1.fr:389,ldap2.univ-rennes1.fr:390 suffix dc=univ-rennes1.fr,dc=fr filter (&(canonic_mail = [sender])(EmployeeType = prof)(subject = math)) scope sub
The search condition is used in scenarii which are defined and decribed in (see 11.8)
The syntax of this rule is:
search(example.ldap,[sender]) smtp,smime,md5 -> do_it
The variables used by 'search' are :
The method of authentication does not change.