HP UX Red Hat Direry Server Software manual Authmethod = saslmechanism

Chapter 6. Managing Access Control

Simple. The client must provide a user name and password to bind to the directory.

•

SSL. The client must bind to the directory over a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) connection, using a client certificate for authentication.

In the case of SSL, the connection is established to the LDAPS second port; in the case of TLS, the connection is established through a Start TLS operation. In both cases, a certificate must be provided. For information on setting up SSL, see Chapter 11, Managing SSL.

•

SASL. The client must bind to the directory over a Simple Authentication and Security Layer (SASL) connection. Directory Server supports three SASL mechanisms: EXTERNAL, CRAM-MD5, DIGEST-MD5, and GSS-API(for Kerberos systems). For information on setting up SASL, see Chapter 12, Managing SASL.

NOTE

You cannot set up authentication-based bind rules through the Access Control Editor.

The LDIF syntax for setting a bind rule based on an authentication method is as follows:

authmethod = "sasl_mechanism

sasl_mechanism can be none, simple, ssl, or "sasl sasl_mechanism".

4.9.1. Examples

The following are examples of the authmethod keyword:

•Authentication is not checked during bind rule evaluation.

authmethod = "none";

•The bind rule is evaluated to be true if the client is accessing the directory using a username and password.

authmethod = "simple";

•The bind rule is evaluated to be true if the client authenticates to the directory using a certificate over LDAPS. This is not evaluated to be true if the client authenticates using simple

200