From: André Malo
@@ -42,17 +42,23 @@ by other LDAP modules
flag to the
-Description: LDAP connection pooling and result caching services for use
by other LDAP modules
+Status: Experimental Status: Extension Module Identifier: ldap_module Source File: util_ldap.c Compatibility: Available in version 2.0.41 and later configure
script when building
Apache.
SSL support requires that mod_ldap
be linked
- with one of the following LDAP SDKs:
- OpenLDAP SDK (both 1.x and 2.x),
- Novell LDAP SDK, native Solaris LDAP SDK, native Microsoft LDAP SDK, or the
- iPlanet(Netscape) SDK.
SSL/TLS support is dependant on which LDAP toolkit has been + linked to APR. As of this writing, APR-util supports: + OpenLDAP SDK (2.x or later), + Novell LDAP + SDK, + Mozilla LDAP SDK, native Solaris LDAP SDK (Mozilla based), + native Microsoft LDAP SDK, or the + iPlanet + (Netscape) SDK. See the APR + website for details.
The different LDAP SDKs have widely different methods of setting - and handling both CA and client side certificates. Some of the - differences are described below:
+ and handling both CA and client side certificates. + +If you intend to use SSL or TLS, read this section CAREFULLY so as to + understand the differences between configurations on the different LDAP + toolkits supported.
CA certificates are specified within a file called cert7.db. @@ -269,13 +278,14 @@ by other LDAP modules client certificates are required, an optional key3.db file may be specified with an optional password. The secmod file can be specified if required. These files are in the same format as - used by Netscape Communicator / Mozilla web browser. The easiest - way to obtain these files is to grab them from a browser + used by the Netscape Communicator or Mozilla web browsers. The easiest + way to obtain these files is to grab them from your browser installation.
-Client certificates are specified per connection by referring - to the certificate "nickname", and an optional password may be - specified.
+Client certificates are specified per connection using the + LDAPTrustedClientCert directive by referring + to the certificate "nickname". An optional password may be + specified to unlock the certificate's private key.
The SDK supports SSL only. An attempt to use STARTTLS will cause an error when an attempt is made to contact the LDAP server at @@ -311,15 +321,15 @@ by other LDAP modules SDK to work correctly. These certificates can be specified as binary DER or Base64 (PEM) encoded files.
-Client certificates are specified globally rather than per - connection, and so must be specified with the global certificate - option as below. Trying to set client certificates via the - LDAPTrustedClientCert option will cause an error to be thrown - when httpd starts up.
+Note: Client certificates are specified globally rather than per + connection, and so must be specified with the LDAPTrustedGlobalCert + directive as below. Trying to set client certificates via the + LDAPTrustedClientCert directive will cause an error to be logged + when an attempt is made to connect to the LDAP server..
The SDK supports both SSL and STARTTLS, set using the LDAPTrustedMode parameter. If an ldaps:// URL is specified, - SSL mode is forced.
+ SSL mode is forced, override this directive.
# Specify two CA certificate files
@@ -328,6 +338,8 @@ by other LDAP modules
# Specify a client certificate file and key
LDAPTrustedGlobalCert CERT_BASE64 /certs/cert1.pem
LDAPTrustedGlobalCert KEY_BASE64 /certs/key1.pem [password]
+ # Do not use this directive, as it will throw an error
+ #LDAPTrustedClientCert CERT_BASE64 /certs/cert1.pem
Both SSL and TLS are supported by using the ldaps:// URL format, or by using the LDAPTrustedMode directive accordingly.
+Note: The status of support for client certificates is not yet known + for this toolkit.
+LDAPCacheEntries number
LDAPCacheEntries 1024
Specifies the maximum size of the primary LDAP cache. This @@ -414,13 +429,29 @@ by other LDAP modules
LDAPCacheTTL seconds
LDAPCacheTTL 600
Specifies the time (in seconds) that an item in the search/bind cache remains valid. The default is 600 seconds (10 minutes).
+ + +Description: | Specifies the socket connection timeout in seconds |
---|---|
Syntax: | LDAPConnectionTimeout seconds |
Context: | server config |
Status: | Extension |
Module: | mod_ldap |
Specifies the timeout value (in seconds) in which the module will + attempt to connect to the LDAP server. If a connection is not + successful with the timeout period, either an error will be + returned or the module will attempt to connect to a secondary LDAP + server if one is specified. The default is 10 seconds.
+LDAPOpCacheEntries number
LDAPOpCacheEntries 1024
This specifies the number of entries mod_ldap
@@ -446,7 +477,7 @@ valid
LDAPOpCacheTTL seconds
LDAPOpCacheTTL 600
Specifies the time (in seconds) that entries in the @@ -459,7 +490,7 @@ valid
LDAPSharedCacheFile directory-path/filename
Specifies the directory path and file name of the shared memory @@ -474,7 +505,7 @@ valid
LDAPSharedCacheSize bytes
LDAPSharedCacheSize 102400
Specifies the number of bytes to allocate for the shared @@ -490,13 +521,18 @@ connection client certificate. Not all LDAP toolkits support per connection client certificates.
LDAPTrustedClientCert type directory-path/filename/nickname [password]
It specifies the directory path, file name or nickname of a per connection client certificate used when establishing an SSL - or TLS connection to an LDAP server. Not all LDAP toolkits support - per connection client certificates (See the toolkit guide for details). + or TLS connection to an LDAP server. Different locations or + directories may have their own independant client certificate + settings. Some LDAP toolkits (notably Novell) + do not support per connection client certificates, and will throw an + error on LDAP server connection if you try to use this directive + (Use the LDAPTrustedGlobalCert directive instead for Novell client + certificates - See the SSL/TLS certificate guide above for details). The type specifies the kind of certificate parameter being set, depending on the LDAP toolkit being used. Supported types are:
LDAPTrustedGlobalCert type directory-path/filename [password]
It specifies the directory path and file name of the trusted CA
- certificates and/or client certificates mod_ldap
+ certificates and/or system wide client certificates mod_ldap
should use when establishing an SSL or TLS connection to an LDAP
- server. The type specifies the kind of certificate parameter being
+ server. Note that all certificate information specified using this directive
+ is applied globally to the entire server installation. Some LDAP toolkits
+ (notably Novell) require all client certificates to be set globally using
+ this directive. Most other toolkits require clients certificates to be set
+ per Directory or per Location using LDAPTrustedClientCert. If you get this
+ wrong, an error may be logged when an attempt is made to contact the LDAP
+ server, or the connection may silently fail (See the SSL/TLS certificate
+ guide above for details).
+ The type specifies the kind of certificate parameter being
set, depending on the LDAP toolkit being used. Supported types are:
LDAPTrustedMode type
The following modes are supported:
diff --git a/docs/manual/mod/mod_log_config.html.en b/docs/manual/mod/mod_log_config.html.en index 89af06731c4..856f46ea9f0 100644 --- a/docs/manual/mod/mod_log_config.html.en +++ b/docs/manual/mod/mod_log_config.html.en @@ -84,9 +84,9 @@%...A
%...B
%...b
-
' rather than a 0 when no bytes are sent.%...{Foobar}C
\n
, \t
etc).
+ Note that in httpd 2.0, unlike 1.3, the %b
and
+ %B
format strings do not represent the number of
+ bytes sent to the client, but simply the size in bytes of the HTTP
+ response (which will differ, for instance, if the connection is
+ aborted, or if SSL is used). The %O
format provided
+ by mod_logio
will log the actual number of bytes
+ sent over the network.
Some commonly used log format strings are: