mirror of
https://github.com/glauth/glauth.git
synced 2026-10-25 13:40:48 +00:00
Chris F Ravenscroft
2eb2215ae4
This commit actually covers a few items. In future commits, I will keep features distinct. This is only happening this time around due to how long it took to merge this branch. Covered: - Database plugins (at this time: SQLite, MySQL, Postgres) - Backends acting as middleware: added the [[Backends]] configuration directive while retaining backward compatibility with [Backend] - Schema introspection (root DSE query with base scope) - When proxying, insert queried attribute back in upstream response, if absent, so that the LDAP library does not filter out all entries - When chaining backends, any backend can be used to inject OTP value in password, before reaching a non-OTP-aware backend (currently guarded by a True statement in case we find an issue (I did thoroughly test but you never know)) - Handling of special "1.1" attributes filter meaning "I do not want attributes" (RFC 4511, 4.5.1.8) - Support for "want types only" queries, even when proxying
83 lines
2.3 KiB
INI
83 lines
2.3 KiB
INI
#################
|
|
# glauth.conf
|
|
|
|
#################
|
|
# General configuration.
|
|
debug = true
|
|
# syslog = true
|
|
#
|
|
# Enable hot-reload of configuration on changes
|
|
# - does NOT work [ldap], [ldaps], [backend] or [api] sections
|
|
# watchconfig = true
|
|
|
|
#################
|
|
# yubikeyclientid = "yubi-api-clientid"
|
|
# yubikeysecret = "yubi-api-secret"
|
|
|
|
#################
|
|
# Server configuration.
|
|
#
|
|
# This is the old server-config format
|
|
# - will still work, but please use new format, shown below
|
|
#
|
|
# [frontend]
|
|
# listen = "localhost:8484"
|
|
# tls = false
|
|
# cert ="certs/server.crt"
|
|
# key = "certs/server.key"
|
|
|
|
# This ([ldap] and [ldaps]) is the new server-config format
|
|
[ldap]
|
|
enabled = true
|
|
listen = "0.0.0.0:3893"
|
|
|
|
[ldaps]
|
|
enabled = true
|
|
listen = "0.0.0.0:3894"
|
|
cert = "certs/server.crt"
|
|
key = "certs/server.key"
|
|
|
|
#################
|
|
# The backend section controls the data store.
|
|
[backend]
|
|
datastore = "plugin"
|
|
# If "plugin," uncomment the line below
|
|
plugin = "bin/sqlite.so"
|
|
pluginhandler = "NewSQLiteHandler"
|
|
baseDN = "dc=glauth,dc=com"
|
|
|
|
# // MySQL //
|
|
# Uncomment this line to configure your MySQL database connection string:
|
|
# database = "glauth:glauth@tcp(127.0.0.1:3306)/glauth"
|
|
# Creating database:
|
|
# create database glauth identified;
|
|
# grant all on glauth.* to glauth@localhost identified by 'glauth';
|
|
# // Postgres //
|
|
# Uncomment this line to configure your Postgres database connection string:
|
|
# database = "host=127.0.0.1 port=5432 dbname=glauth user=glauth password=glauth sslmode=disable"
|
|
# Creating database:
|
|
# CREATE DATABASE <dbname>;
|
|
# CREATE USER <username> WITH PASSWORD '<userpassword>'
|
|
# GRANT ALL PRIVILEGES ON DATABASE <dbname> to <username>;
|
|
# // SQLite //
|
|
# Uncomment this line to configure your SQLite database connection string:
|
|
database = "gl.db"
|
|
|
|
## Configure dn format to use structures like
|
|
## "uid=serviceuser,cn=svcaccts,$BASEDN" instead of "cn=serviceuser,ou=svcaccts,$BASEDN"
|
|
## to help ease migrations from other LDAP systems
|
|
# nameformat = "uid"
|
|
# groupformat = "cn"
|
|
|
|
## Configure ssh-key attribute name, default is 'sshPublicKey'
|
|
# sshkeyattr = "ipaSshPubKey"
|
|
|
|
#################
|
|
# Enable and configure the optional REST API here.
|
|
[api]
|
|
enabled = true
|
|
tls = false # enable TLS for production!!
|
|
listen = "0.0.0.0:5555"
|
|
cert = "cert.pem"
|
|
key = "key.pem"
|