diff options
| author | Peter Eisentraut <peter@eisentraut.org> | 2024-07-23 10:14:38 +0200 |
|---|---|---|
| committer | Peter Eisentraut <peter@eisentraut.org> | 2024-07-23 10:17:55 +0200 |
| commit | f68d85bf69233ef842a08707bbd1204ef8216549 (patch) | |
| tree | fdc7205dff0d4044b8ecf7026fcf6a7dfe210116 /doc/src | |
| parent | 935e675f3c9efd0e39bf33db15ab85049cc4ee7c (diff) | |
| download | postgresql-f68d85bf69233ef842a08707bbd1204ef8216549.tar.gz postgresql-f68d85bf69233ef842a08707bbd1204ef8216549.zip | |
ldapurl is supported with simple bind
The docs currently imply that ldapurl is for search+bind only, but
that's not true. Rearrange the docs to cover this better.
Add a test ldapurl with simple bind. This was previously allowed but
unexercised, and now that it's documented it'd be good to pin the
behavior.
Improve error when mixing LDAP bind modes. The option names had gone
stale; replace them with a more general statement.
Author: Jacob Champion <jacob.champion@enterprisedb.com>
Discussion: https://www.postgresql.org/message-id/flat/CAOYmi+nyg9gE0LeP=xQ3AgyQGR=5ZZMkVVbWd0uR8XQmg_dd5Q@mail.gmail.com
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/client-auth.sgml | 23 |
1 files changed, 20 insertions, 3 deletions
diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index f1eb3b279ed..51343de7cad 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -1910,13 +1910,19 @@ omicron bryanh guest1 </para> </listitem> </varlistentry> + </variablelist> + </para> + + <para> + The following option may be used as an alternative way to write some of the + above LDAP options in a more compact and standard form: + <variablelist> <varlistentry> <term><literal>ldapurl</literal></term> <listitem> <para> An <ulink url="https://datatracker.ietf.org/doc/html/rfc4516">RFC 4516</ulink> - LDAP URL. This is an alternative way to write some of the - other LDAP options in a more compact and standard form. The format is + LDAP URL. The format is <synopsis> ldap[s]://<replaceable>host</replaceable>[:<replaceable>port</replaceable>]/<replaceable>basedn</replaceable>[?[<replaceable>attribute</replaceable>][?[<replaceable>scope</replaceable>][?[<replaceable>filter</replaceable>]]]] </synopsis> @@ -1958,7 +1964,8 @@ ldap[s]://<replaceable>host</replaceable>[:<replaceable>port</replaceable>]/<rep <para> It is an error to mix configuration options for simple bind with options - for search+bind. + for search+bind. To use <literal>ldapurl</literal> in simple bind mode, the + URL must not contain a <literal>basedn</literal> or query elements. </para> <para> @@ -1995,6 +2002,16 @@ host ... ldap ldapserver=ldap.example.net ldapprefix="cn=" ldapsuffix=", dc=exam </para> <para> + Here is a different simple-bind configuration, which uses the LDAPS scheme + and a custom port number, written as a URL: +<programlisting> +host ... ldap ldapurl="ldaps://ldap.example.net:49151" ldapprefix="cn=" ldapsuffix=", dc=example, dc=net" +</programlisting> + This is slightly more compact than specifying <literal>ldapserver</literal>, + <literal>ldapscheme</literal>, and <literal>ldapport</literal> separately. + </para> + + <para> Here is an example for a search+bind configuration: <programlisting> host ... ldap ldapserver=ldap.example.net ldapbasedn="dc=example, dc=net" ldapsearchattribute=uid |