From: Jorge Pereira Date: Mon, 11 Feb 2019 22:31:08 +0000 (-0200) Subject: Update raddb/mods-available/winbind X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=528b5dff2cef4e6c3a99653709cacfa819056946;p=thirdparty%2Ffreeradius-server.git Update raddb/mods-available/winbind --- diff --git a/raddb/mods-available/winbind b/raddb/mods-available/winbind index a83688f76d0..3e9ec0f5a70 100644 --- a/raddb/mods-available/winbind +++ b/raddb/mods-available/winbind @@ -1,132 +1,177 @@ # -*- text -*- # +# :toc: +# # $Id$ -# Winbind module to authenticate PAP users against Microsoft -# Active Directory or Samba, via winbind. +####################################################################### +# +# = WinModule +# +# The `winbind` module authenticate PAP users against Microsoft Active +# Directory or Samba, via `winbind`. # # This module is for PAP authentication (where plaintext passwords -# are sent in the User-Password attribute) only. For authenticating -# mschap requests against AD/Samba see the options available in the -# rlm_mschap module. +# are sent in the `User-Password` attribute) only. For authenticating +# `mschap` requests against AD/Samba see the options available in the +# `rlm_mschap` module. +# +# NOTE: Samba version 4.2.1 or higher is required to use this module. # -# Samba version 4.2.1 or higher is required to use this module. +# +# ## Default instance +# winbind { - - # The username to pass to winbind for authentication. + # + # winbind_username:: The username to pass to `winbind` for authentication. # winbind_username = "%{%{Stripped-User-Name}:-%{User-Name}}" - # The Windows Domain. While not required to be set, it is - # likely authentication will fail if it is not set correctly. - # This configuration option, as the username above, is also - # expanded before use. # - # If unset then winbind will be queried for the correct value. - # If you actually want it blank it should be explicitly set - # here. + # winbind_domain:: The windows domain. # - #winbind_domain = "" - + # While not required to be set, it is likely authentication will fail + # if it is not set correctly. + # + # This configuration option, as the username above, is also expanded before use. + # + # If unset then winbind will be queried for the correct value. If you + # actually want it blank it should be explicitly set here. + # +# winbind_domain = "" - # Group membership checking + # + # group { ... }:: Group membership checking. # group { - # AD username to search for group searches # - # This should generally not include a realm, so - # Stripped-User-Name is likely the best attribute - # if it exists. + # group_search_username:: AD username to search for group searches. + # + # This should generally not include a realm, so `Stripped-User-Name` + # is likely the best attribute if it exists. # group_search_username = "%{%{Stripped-User-Name}:-%{User-Name}}" - # Include the domain in group searches? + # + # group_add_domain:: Include the domain in group searches. # # When this is enabled, winbind_domain is prepended to the - # username (as domain\username) before searching. This is + # username (as `domain\username`) before searching. This is # generally required. # - #group_add_domain = yes +# group_add_domain = yes - # Attribute to use for group comparisons. # - # This will normally be "Winbind-Group" if this instance is - # unnamed, otherwise it will be "name-Winbind-Group". The + # group_attribute:: Attribute to use for group comparisons. + # + # This will normally be `Winbind-Group` if this instance is + # unnamed, otherwise it will be `name-Winbind-Group`. The # name of this attribute can be overridden here. # - #group_attribute = "Winbind-Group" +# group_attribute = "Winbind-Group" } - - # Information for the winbind connection pool. The configuration - # items below are the same for all modules which use the new - # connection pool. + # + # pool { ... }:: + # + # Information for the `winbind` connection pool. + # + # The configuration items below are the same for all modules which + # use the new connection pool. # pool { + # + # start:: + # # Connections to create during module instantiation. # If the server cannot create specified number of # connections during instantiation it will exit. - # Set to 0 to allow the server to start without the + # + # Set to `0` to allow the server to start without the # winbind daemon being available. + # start = ${thread[pool].num_workers} - # Minimum number of connections to keep open + # + # min:: Minimum number of connections to keep open. + # min = ${thread[pool].num_workers} - # Maximum number of connections + # + # max:: Maximum number of connections. # # If these connections are all in use and a new one # is requested, the request will NOT get a connection. # - # Setting 'max' to LESS than the number of threads means + # Setting `max` to LESS than the number of threads means # that some threads may starve, and you will see errors # like 'No connections available and at max connection limit' # - # Setting 'max' to MORE than the number of threads means + # Setting `max` to MORE than the number of threads means # that there are more connections than necessary. + # max = ${thread[pool].num_workers} - # Spare connections to be left idle # - # NOTE: Idle connections WILL be closed if "idle_timeout" - # is set. This should be less than or equal to "max" above. + # spare:: Spare connections to be left idle. + # + # NOTE: Idle connections WILL be closed if `idle_timeout` + # is set. This should be less than or equal to `max` above. + # spare = 1 - # Number of uses before the connection is closed # - # 0 means "infinite" + # uses:: Number of uses before the connection is closed. + # + # NOTE: A setting of 0 means infinite (no limit). + # uses = 0 - # The number of seconds to wait after the server tries - # to open a connection, and fails. During this time, - # no new connections will be opened. + # + # retry_delay:: The number of seconds to wait after the server tries + # to open a connection, and fails. + # + # During this time, no new connections will be opened. + # retry_delay = 30 - # The lifetime (in seconds) of the connection + # + # lifetime:: The lifetime (in seconds) of the connection. # # NOTE: A setting of 0 means infinite (no limit). + # lifetime = 86400 - # The pool is checked for free connections every - # "cleanup_interval". If there are free connections, - # then one of them is closed. + # + # cleanup_interval:: The pool is checked for free connections every + # `cleanup_interval`. + # + # If there are free connections, then one of them is closed. + # cleanup_interval = 300 - # The idle timeout (in seconds). A connection which is - # unused for this length of time will be closed. + # + # idle_timeout:: The idle timeout (in seconds). + # + # A connection which is unused for this length of time will be closed. # # NOTE: A setting of 0 means infinite (no timeout). + # idle_timeout = 600 - # NOTE: All configuration settings are enforced. If a - # connection is closed because of "idle_timeout", - # "uses", or "lifetime", then the total number of - # connections MAY fall below "min". When that - # happens, it will open a new connection. It will - # also log a WARNING message. # - # The solution is to either lower the "min" connections, - # or increase lifetime/idle_timeout. + # [NOTE] + # ==== + # All configuration settings are enforced. If a connection is closed because of + # `idle_timeout`, `uses`, or `lifetime`, then the total + # number of connections MAY fall below `min`. + # + # When that happens, it will open a new connection. It will also log a *WARNING* message. + # + # The solution is to either lower the "min" connections, or + # increase lifetime/idle_timeout. + # ==== + # } }