AUTOFS_LDAP_AUTH.CONF(5)

💖 AUTOFS_LDAP_AUTH.CONF 💖

okay bestie, so this is a page from the File Formats Manual — it's the manual for autofs_ldap_auth.conf, and it's literally the glow-up guide for making your autofs talk to LDAP all safe and certified. let's get into it ✨

---

🎀 NAME 🎀

autofs_ldap_auth.conf — autofs LDAP authentication configuration. that's the whole vibe, no cap.

---

🌸 DESCRIPTION 🌸

so here's the tea: you can have LDAP authenticated binds, TLS encrypted connections and certification — all of it — by setting the right values in the autofs authentication configuration file, and by configuring your LDAP client with the appropriate settings. they go together, like you and your emotional support water bottle 🫶

the default location of this file is /etc/autofs_ldap_auth.conf. and listen — if this file exists, it will be used to establish whether TLS or authentication should be used. so like, its mere existence is doing something. main character energy fr fr 👑

an example of this file is:

<?xml version="1.0" ?>
<autofs_ldap_sasl_conf
        usetls="yes"
        tlsrequired="no"
        authrequired="no"
        authtype="DIGEST-MD5"
        user="xyz"
        secret="abc"
/>

now, if TLS encryption is going to be used, the location of the Certificate Authority certificate must be set within the LDAP client configuration — that's how you validate the server certificate, periodt. and if, in addition, a certified connection is going to be used, then the client certificate and private key file locations must also be configured within the LDAP client. three things, all vibes, all necessary 💅

---

✨ OPTIONS ✨

this file contains a single XML element, like the one in the example above, and it's got several attributes. one element, many attributes. it's giving minimalist but make it loaded.

the possible attributes are:

• usetls="yes"|"no" — determines whether an encrypted connection to the ldap server should be attempted. yes means we try it, no means we don't. simple as 🦋
• tlsrequired="yes"|"no" — this flag tells whether the ldap connection must be encrypted. if it's set to "yes", the automounter will fail to start if an encrypted connection cannot be established. so like, no TLS, no launch. dramatic? yes. correct? also yes 😭
• authrequired="yes"|"no"|"autodetect"|"simple" — this option tells whether an authenticated connection to the ldap server is required in order to perform ldap queries. here's the breakdown bestie:
  • if the flag is set to yes, only sasl authenticated connections will be allowed.
  • if it is set to no then authentication is not needed for ldap server connections.
  • if it is set to autodetect then the ldap server will be queried to establish a suitable sasl authentication mechanism. and if no suitable mechanism can be found, connections to the ldap server are made without authentication. (she tried, she moved on 💀)
  • finally, if it is set to simple, then simple authentication will be used instead of SASL.
• authtype="GSSAPI"|"LOGIN"|"PLAIN"|"ANONYMOUS"|"DIGEST-MD5"|"SCRAM-SHA-1"|"EXTERNAL" — this attribute can be used to specify a preferred authentication mechanism. in normal operations, the automounter will attempt to authenticate to the ldap server using the list of supported SASL mechanisms obtained from the directory server. explicitly setting the authtype will bypass this selection and only try the mechanism specified. no second options, no plan B, she's committed 💅

the EXTERNAL mechanism may be used to authenticate using a client certificate, and it requires that authrequired be set to "yes" if using SSL — or usetls, tlsrequired and authrequired all set to "yes" if using TLS — in addition to authtype being set to EXTERNAL. yeah, that's a lot of yeses. count them twice bestie 🙈

if using authtype EXTERNAL two additional configuration entries are required:

• external_cert="<client certificate path>" — this specifies the path of the file containing the client certificate.
• external_key="<client certificate key path>" — this specifies the path of the file containing the client certificate key.

these two configuration entries are mandatory when using the EXTERNAL method, because the HOME environment variable cannot be assumed to be set or, if it is, to be set to the location we expect. so like, don't skip them. seriously. 🚨

• user="<username>" — this attribute holds the authentication identity used by authentication mechanisms that require it. legal values for this attribute include any printable characters that can be used by the selected authentication mechanism. so: whatever your mechanism will accept, that's the range. ✨
• secret="<password>" — this attribute holds the secret used by authentication mechanisms that require it. legal values for this attribute include any printable characters that can be used by the selected authentication mechanism. same deal as user, just, y'know, the secret one 🤫
• encoded_secret="<base64 encoded password>" — this attribute holds the base64 encoded secret used by authentication mechanisms that require it. and here's the important part: if this entry is present as well as the secret entry, this value will take precedence. encoded_secret wins, every time, no discussion 👑
• clientprinc="<GSSAPI client principal>" — when using GSSAPI authentication, this attribute is consulted to determine the principal name to use when authenticating to the directory server. by default, this will be set to autofsclient/<fqdn>@<REALM>. (yes, that's autofsclient — it wraps in the original text but it's one word, bestie, don't split her 🥺)
• credentialcache="<external credential cache path>" — when using GSSAPI authentication, this attribute can be used to specify an externally configured credential cache that is used during authentication. by default, autofs will setup a memory based credential cache. so if you don't set this, it's all in RAM, cozy and temporary 🧚

---

🔥 SEE ALSO 🔥

• auto.master(5)
• autofs.conf(5)

go read those too, they're part of the lore 📚

---

💜 AUTHOR 💜

this manual page was written by Ian Kent <raven@themaw.net>. absolute icon, we stan 🫶

---

and that's the whole page bestie!! this was the AUTOFS_LDAP_AUTH.CONF(5) page from 19 Feb 2010 — old but iconic, and now you know every single attribute by heart. go forth and authenticate responsibly 💖✨🎀🦋🌸💅