mod_ldap v2.7.1
===============

mod_ldap is a module that allows proftpd to do user authentication and
name/UID lookups against an LDAP database.

**Please note:** Read the CHANGES section below for mod_ldap v2.7 changes;
some significant changes have been made. Do *NOT* upgrade to mod_ldap v2.7
before reading the CHANGES section.


Sections:
1. How do I set up mod_ldap?
2. Changes in v2.5.2 - v2.7.1
3. To-Do
4. Thanks
5. Author


============================
1. How do I set up mod_ldap?
============================

If you are using a version of mod_ldap included with a ProFTPD release,
you can simply:

tar xvzf proftpd-version.tar.gz
cd proftpd-version
./configure --with-modules=mod_ldap
make
make install
Add the contents of posixAccount-objectclass to your slapd.oc.conf (or
    equivalent) and restart your LDAP server. If you plan on using mod_ldap
    for group lookups, also add the contents of posixGroup-objectclass.
The 'user-ldif' file contains a sample user ldif. Modify it to your liking
    and say ldapadd -D your-root-dn -w your-root-dn-password < ldif
Read up on the LDAP config-file directives in doc/Configuration.html. At
    bare minimum, you'll need to have LDAPServer, LDAPDNInfo, and LDAPDoAuth
    configuration directives in your proftpd.conf.

    A sample set of LDAP configuration directives is included here:

    LDAPServer            localhost
    LDAPDNInfo            cn=your-dn,dc=horde,dc=net dnpass
    LDAPDoAuth            on "dc=users,dc=horde,dc=net"



If you wish to use a newer version of mod_ldap that is not yet included with
a release version of ProFTPD, simply download the file mod_ldap.c, say:

cp -f mod_ldap.c proftpd-version/contrib

and then follow the same steps as above.

=============================
2. Changes in v2.5.2 - v2.7.1
=============================

Please check the web site for previous changelogs.

v2.7.1:
* UID/GID caching code updated with MacGyver's portability fixes

v2.7:
* Added a fix for picky LDAP servers like Sun Directory Services; using
AuthBinds with those LDAP servers would break in previous mod_ldap versions.
See the comments in the code for more details (search for "Sun Directory
Services").
* You can now specify custom LDAP search filters at runtime. See the
configuration guide (doc/Configuration.html) entries for LDAPDo* for more
details.
* Objectclass is now enforced. You *must* have an objectclass attribute for
each of your LDAP objects. This attribute must have a value of
'posixAccount' ("objectclass: posixAccount"). For groups, this attribute
must have the value 'posixGroup' ("objectclass: posixGroup"). If you wish to
disable this objectclass enforcement, use the the LDAP filter "(uid=%u)" for
Auth and UID lookups (see doc/Configuration.html for how to specify a custom
LDAP search filter).
* Removed allowedServices code. The functionality that allowedServices
provided can now be duplicated with a modified LDAP search filter.

For example, to replicate basic allowedServices checking, pass this LDAP
search filter to LDAPDoAuth:
(&(uid=%u)(|(allowedServices=*FTP*)(!(allowedService=*))))

To emulate deniedServices checking, use this search filter:
(&(uid=%u)(!(deniedServices=*FTP*)))

To emulate *both* allowedServices and deniedServices checking, use this
filter (beware line wrap):
(&(uid=%u)(|(allowedServices=*FTP*)(!(allowedService=*)))(!(deniedServices=*FTP*)))

v2.6.1:
* Fixed a bug that would prevent proper search scope selection.

v2.6:
* HomedirOnDemandSuffix - create an additional subdirectory in a user's home
  directory (/home/user/anotherdirectory) on demand
* Minor group fixes/cleanups - supplementary groups now work properly
* Password {scheme}s are now treated in a case-insensitive manner.
* Password-hash support for any crypto method OpenSSL supports
  To enable extended OpenSSL password hash support, edit mod_ldap.c and
  uncomment #define HAVE_OPENSSL. You'll also need to edit Make.rules to
  link against OpenSSL. Further details are provided in mod_ldap.c.
* Runtime search scope selection; one-level or subtree searches can be
  selected from proftpd.conf.

=======
3. ToDo
=======

* different log levels in mod_ldap to log varying debug info
* perror()-like error reporting to improve error messages
* shadowAccount objectclass stuff - inactive, expiration, etc.

=========
4. Thanks
=========

* James <james@wwnet.net> for a copy of his LDAP module that he
* Krzysztof Dabrowski <brush@pol.pl> for some big virtual-user ideas
* Peter Deacon <peterd@iea-software.com> for ideas
* Peter Fabian <fabian@staff.matavnet.hu> for ideas and a tested platform
* Ralf Kruedewagen <Ralf.Kruedewagen@meocom.de> for a tested platform
* Scott Murphy <smurphy@berbee.com> for a trouble report
* Bert Vermeulen <bert@be.easynet.net> for patches

=========
5. Author
=========

John Morrissey, <jwm@horde.net>, http://horde.net/~jwm/software/mod_ldap/
Feedback is much appreciated. If you're using mod_ldap successfully, or
you're having problems getting mod_ldap up and running at your site, or
even have some code improvements or ideas for development, please let
me know!
