Chapter 9. Authentication in ThinLinc
9.5.7.2. Configuration
tl-ldap-certalias uses the /utils/tl-ldap-certalias hiveconf folder for configuration purposes.
On a standard ThinLinc installation, it’s located in
/opt/thinlinc/etc/conf.d/tl-ldap-certalias.hconf.
Configuration parameters
/utils/tl-ldap-certalias/ldap_schema
Specify the schema type that is used on the target LDAP server. Valid options are rfc2307 and AD.
rfc2307 is default and should be used with standard LDAP servers that complies to rfc2307.
AD should be used if target LDAP server is an Active Directory.
/utils/tl-ldap-certalias/allow_invalid_certificates
This parameter controls whether to perform validation on certificates found in the LDAP database.
Possible values are yes and no.
Please note that by setting this to yes, you will allow users with expired, invalid, revoked or
untrusted certificates to log in as if their certificates are valid.
Note: If you want tl-ldap-certalias to match the behaviour of tl-ldap-certalias versions earlier
than 3.2.0, set this to yes.
/utils/tl-ldap-certalias/certificate_user_match
The method to use for finding certificates assigned to the user. Valid options are sameobject and
novell_certificate_subjectname.
sameobject makes tl-ldap-certalias search for certificates in the userCertificate attribute on
user objects it finds.
novell_certificate_subjectname allows for certificates to be stored in another LDAP tree.
User objects are associated to certificates by storing subject names of certificates in a multivalued
attribute called sasAllowableSubjectName (OID 2.16.840.1.113719.1.39.42.1.0.69) on the user
object. tl-ldap-certalias can handle both DN:s as written by Novell iManager
(DC=com.DC=example.OU=test.CN=foo) and as returned by tl-certtool --subject
(cn=foo,ou=test,dc=example,dc=com).
/utils/tl-ldap-certalias/users/uri
A LDAP server URI for finding users on the form ldap [s] :// name [:port]
/utils/tl-ldap-certalias/users/base
The LDAP search base for finding users.
/utils/tl-ldap-certalias/users/binddn
The username to bind as for searching for users. If left blank, no bind is performed.
106
Comentarios a estos manuales