Pwcheck
=======

Auxprop
-------

Auxprop-hashed
--------------

Saslauthd
---------

**What is saslauthd?** saslauthd is a daemon which validates

``ldap_servers`` - ``ldap://localhost``

    Specify a space separated list of LDAP server URIs of the form **ldap[si]://[name[:port]]**. See the ``ldap.conf`` *URI* option for formatting details.

``ldap_bind_dn`` - none

    When simple authentication is desired, specify a distinguished name to use for a simple authenticated bind or a simple unauthenticated bind. Do not specify if an anonymous bind is desired. This option is ignored when the evaluated ``ldap_auth_method`` is ``fastbind``.

``ldap_bind_pw`` - none

    ``ldap_bind_pw`` is an alias for ``ldap_password``.

``ldap_password`` - none

    When simple authentication is desired, specify a password to perform an authenticated bind, or do not specify for an unauthenticated or anonymous bind. When SASL authentication is desired, specify a password to use where required by the underlying SASL mechanism. This option is ignored when the evaluated ``ldap_auth_method`` is ``fastbind``.

``ldap_version`` - 3

    Defaults to version *3*. If ``ldap_use_sasl`` or ``ldap_start_tls`` are enabled, this option will be ignored, and will conform to the default value. Version *3* **is** compatible with anonymous binds, simple authenticated binds and simple unauthenticated binds. Version *2* should only be necessary where required by the server.

``ldap_search_base`` - none

    When ``ldap_auth_method`` is evaluated as *bind*, ``ldap_search_base`` will be used to search for the user's distinguished name. When ``ldap_auth_method`` is *custom*, ``ldap_search_base`` will be used to find the user's ``ldap_password_attr`` attribute. When ``ldap_auth_method`` is evaluated as *fastbind*, ``ldap_search_base`` is ignored. If ``ldap_search_base`` contains substitution tokens, they will be replaced as specified in the ``ldap_filter`` token expansion rules.

``ldap_filter`` - uid=%u

    When ``ldap_auth_method`` is evaluated as *bind*, ``ldap_filter`` will be used to search for the user's distinguished name. When ``ldap_auth_method`` is *custom*, ``ldap_filter`` will become, after token expansion, the user's distinguished name. When ``ldap_auth_method`` is evaluated as *fastbind*, ``ldap_filter`` is ignored.

    The following tokens, when contained within the ``ldap_filter`` option, will be substituted with the specified values:

    ``%%``

        is replaced with a literal %.

    ``%u``

        is replaced with the userid to be authenticated.

    ``%U``

        is replaced by the portion of the userid before the first @ character. If an @ character does not exist in the userid, then ``%U`` would function identically to ``%u``. For example, if the userid to be authenticated is *jsmith@example.org*, ``%u`` would be replaced by *jsmith@example.org* and ``%U`` would be replaced by *jsmith*.

    ``%d``

        is replaced by the portion of the userid after the first @ character. If an @ character does not exist in the userid, ``%d`` will be replaced by the ``realm`` value passed to ``saslauthd``. If no ``realm`` value was passed to saslauthd, ``%d`` will be replaced by the configured ``ldap_default_realm``, or by an empty string if ``ldap_default_realm`` is not configured.

    ``%1-9``

        Within a userid which contains an @ character, followed by a domain name, ``%1`` will be replaced by the top level domain, ``%2`` will be replaced by the secondary domain, ``%3`` will be replaced by the tertiary domain, up to and including ``%9`` which would be replaced by the ninth level domain. If no @ character exists in the userid, or if there is no domain name after the @ character, or if the specified hierarchical domain level does not exist, the option is replaced by the ``realm`` value passed to ``saslauthd``. Should no ``realm`` value exist in those scenarios, the option is replaced by the configured ``ldap_default_realm``, or by an empty string if ``ldap_default_realm`` has not been configured.

        For example, if the userid to be authenticated is *jsmith@example.org*, ``%1`` would be replaced by *org* and ``%2`` would be replaced by *example*.

    ``%s``

        is replaced by the ``service`` option passed to ``saslauthd``, or by an empty string if no ``service`` option was passed.

    ``%r``

        is replaced by the ``realm`` option passed to ``saslauthd``. If no ``realm`` value was passed to saslauthd, ``%r`` will be replaced by the configured ``ldap_default_realm``, or by an empty string if ``ldap_default_realm`` is not configured.

``ldap_password_attr`` - userPassword

    When ``ldap_auth_method`` is evaluated as *custom*, ``ldap_password_attr`` specifies an attribute that will be requested and retrived. If successfully retrived, the authentication request will succeed if the ``ldap_password_attr`` attribute contains a supported password hash, and if the user submitted password matches the hash. When ``ldap_auth_method`` is *bind* or *fastbind*, ``ldap_password_attr`` is ignored.


``ldap_group_dn`` - none

    If ``ldap_group_dn`` is specified, group authorization must also succeed (in addition to the prior authentication step), for the user's authentication attempt to be successful. If ``ldap_group_dn`` contains substitution tokens, they will be replaced as specified in the ``ldap_filter`` token expansion rules. One additional token substitution is applicable to ``ldap_group_dn``:

    ``%D``

        is replaced by the distinguished name that was specified, or evaluated, in the authentication step. If ``ldap_use_sasl`` is enabled, the distinguished name will be resolved by performing an ldapwhoami extended operation after a successful authentication. If ``ldap_group_dn`` is specified and ``ldap_use_sasl`` is enabled, but the ldap server does not support the ldapwhoami extended operation, or if the ldapwhoami extended operation fails, then the user's authentication attempt is unsuccessful.


``ldap_group_attr`` - uniqueMember

    ``ldap_group_attr`` is ignored unless ``ldap_group_dn`` is also specified and ``ldap_group_match_method`` is *attr*. ``ldap_group_attr`` specifies an attribute which contains the authenticating identity's dinstinguished name. See the ``ldap_group_match_method`` entry for additional details.

``ldap_group_filter`` - none

``ldap_group_search_base`` - defaults to the evaluated ``ldap_search_base``

``ldap_group_scope`` - *sub*

``ldap_group_match_method`` - attr

``ldap_default_realm`` - none

``ldap_default_domain`` - none

    ``ldap_default_domain`` is an alias for ``ldap_default_realm``.

``ldap_auth_method`` - bind

``ldap_timeout`` - 5

``ldap_size_limit`` - 1

``ldap_time_limit`` - 5

``ldap_deref`` - never

``ldap_referrals`` - no

``ldap_restart`` - yes

``ldap_scope`` - sub

``ldap_use_sasl`` - no

``ldap_id`` - none

``ldap_sasl_authc_id`` - none

``ldap_authz_id`` - none

    Does not make any sense to supply an authz identity when performing sasl/fastbind.

``ldap_sasl_authz_id`` - none

    ``ldap_sasl_authz_id`` is an alias for ``ldap_authz_id``.

``ldap_realm`` - none

``ldap_sasl_realm`` - 

``ldap_mech`` - 

    It doesn't make any sense to use a mech that does not require an authname and password, when using fastbind.

``ldap_sasl_mech`` - 

``ldap_sasl_secprops`` - 

``ldap_start_tls`` - 

``ldap_tls_check_peer`` - 

``ldap_tls_cacert_file`` - 

``ldap_tls_cacert_dir`` - 

``ldap_tls_ciphers`` - 

``ldap_tls_cert`` - 

``ldap_tls_key`` - 

``ldap_debug`` - 

Authdaemon
----------

Alwaystrue
----------

Auto Transition
---------------