Profile Attributes

is the common name of the profile entry.

is a mapping from RFC 2307 attributes to alternate attributes. Use this if your entries do not conform to RFC 2307. Each entry consists of: Service:Attribute=Altattribute where Service is one of the supported services: passwd, group, shadow, or pam. Attribute is an attribute of the service as defined by RFC 2307. Altattribute is the attribute that should be used instead of the standard attribute.

For example, pam:userPassword=ntUserPassword maps the userPassword attribute to ntUserPassword for the pam service. passwd:uidnumber=employeeNumber maps the uidnumber attribute to employeeNumber for the passwd service.

	NOTE: The userPassword attribute is mapped to *NULL* to prevent passwords from being returned for increased security and to prevent PAM_UNIX from authenticating users in the LDAP directory. Mapping to *NULL* or any other nonexistent attribute means do not return anything.

is how the client binds to the directory. The value can be "simple" indicating bind using a user name and password. If this attribute has no value, "simple" is the default.

is how long, in seconds, the client should wait to bind before aborting. 0 (zero) means no time limit. If this attribute has no value, the default is no time limit.

is the identity clients use when binding to the directory. The value must be one of the following: "proxy", "anonymous", or "proxy anonymous". "proxy" means use the configured proxy user. "anonymous" means use anonymous access. "proxy anonymous" means use the configured proxy user and if that fails, bind anonymously. If this attribute has no value, "anonymous" is the default.

is the base DN where clients can find user and group information, for example DC=cup,DC=hp,DC=com. This attribute must have a value.

is the same as preferredServerList except the order in which the specified hosts is tried can be interpreted, and defaultServerList is used only after preferredServerList. If neither defaultServerList nor preferredServerList specifies a host, the client tries the host where the profile is. See preferredServerList below.

specifies whether or not referrals should be followed. If the entry is 0 (zero), referrals will not be followed. If the attribute has no value or any other numeric value, referrals will be followed.

is a list of one or more host IP addresses and optional port numbers where LDAP directory servers are running. Each host is searched in the order given. If this attribute has no value, or if none of the specified servers satisfies the client's request, the defaultServerList is used. See defaultServerList above.

For example, 15.13.128.145:250 is the host at IP address 15.13.128.145 using port number 250. When specifying multiple hosts, each host:port entry must be separated by a space.

is the recommended time interval before refreshing the cached configuration profile.

is how long, in seconds, a client should wait for directory searches before aborting. 0 (zero) means no time limit. If this attribute has no value, the default is no time limit.

is one to three custom search descriptors for each service. The format is Service:BaseDN?Scope?(Filter) where Service is one of the supported services passwd, group, shadow, or pam. BaseDN is the base DN at which to start searches. Scope is the search scope and can be one of the following: one, base, sub. Filter is an LDAP search filter, typically the object class. Each service can have up to three custom search descriptors.

For example, the following defines a search descriptor for the passwd service specifying a baseDN of CN=Users,DC=cup,DC=hp,DC=com, a search scope of sub, and a search filter of the posixAccount object class.

passwd:CN=Users,DC=cup,DC=hp,DC=com?sub?(objectclass=posixAccount)