diff options
| author | Gerald W. Carter <jerry@samba.org> | 2008-04-22 10:09:40 -0500 |
|---|---|---|
| committer | Gerald W. Carter <jerry@samba.org> | 2008-04-23 08:47:48 -0500 |
| commit | 8f8a9f01909ba29e2b781310baeeaaddc3f15f0d (patch) | |
| tree | 90c6b720ad3a7bc815245c0ef28820424f89d658 /docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml | |
| parent | 197238246389c40edc60c6630d18d6913086e630 (diff) | |
| download | samba-8f8a9f01909ba29e2b781310baeeaaddc3f15f0d.tar.gz samba-8f8a9f01909ba29e2b781310baeeaaddc3f15f0d.tar.bz2 samba-8f8a9f01909ba29e2b781310baeeaaddc3f15f0d.zip | |
Moving docs tree to docs-xml to make room for generated docs in the release tarball.
(This used to be commit 9f672c26d63955f613088489c6efbdc08b5b2d14)
Diffstat (limited to 'docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml')
| -rw-r--r-- | docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml b/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml new file mode 100644 index 0000000000..a926cec645 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml @@ -0,0 +1,44 @@ +<samba:parameter name="client ldap sasl wrapping" + context="G" + type="string" + advanced="1" + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> +<description> + <para> + The <smbconfoption name="client ldap sasl wrapping"/> defines whether + ldap traffic will be signed or signed and encrypted (sealed). + Possible values are <emphasis>plain</emphasis>, <emphasis>sign</emphasis> + and <emphasis>seal</emphasis>. + </para> + + <para> + The values <emphasis>sign</emphasis> and <emphasis>seal</emphasis> are + only available if Samba has been compiled against a modern + OpenLDAP version (2.3.x or higher). + </para> + + <para> + This option is needed in the case of Domain Controllers enforcing + the usage of signed LDAP connections (e.g. Windows 2000 SP3 or higher). + LDAP sign and seal can be controlled with the registry key + "<literal>HKLM\System\CurrentControlSet\Services\</literal> + <literal>NTDS\Parameters\LDAPServerIntegrity</literal>" + on the Windows server side. + </para> + + <para> + Depending on the used KRB5 library (MIT and older Heimdal versions) + it is possible that the message "integrity only" is not supported. + In this case, <emphasis>sign</emphasis> is just an alias for + <emphasis>seal</emphasis>. + </para> + + <para> + The default value is <emphasis>plain</emphasis> which is not irritable + to KRB5 clock skew errors. That implies synchronizing the time + with the KDC in the case of using <emphasis>sign</emphasis> or + <emphasis>seal</emphasis>. + </para> +</description> +<value type="default">plain</value> +</samba:parameter> |