This document describes the parameter which influence the
basic behaviour of web2ldap.
[connect_template]
[cookie_domain]
[cookie_length]
[cookie_max_age]
[dumpasn1cfg]
[gzip_level]
[http_headers]
[input_maxattrs]
[input_maxfieldlen]
[ldap_opt_debug_level]
[ldap_trace_level]
[ldif_maxbytes]
[ldif_url_schemes]
[max_searchparams]
[pylibdirs]
[redirect_template]
[search_attrs]
[search_attrsonly]
[sec_sslacceptedciphers]
[session_checkvars]
[session_limit]
[session_paranoid]
[session_per_ip_limit]
[session_remove]
- connect_template
-
HTML template file for the input fields of a Connect Form based on
Python's Format String Syntax to reference the different
dynamically generated input fields etc.
- cookie_domain
-
Sets cookie domain (DNS name) sent in Set-Cookie header.
None lets web2ldap send the hostname automatically
determined which might not work in tunnel/proxy setups because it has
to match the DNS name the browser uses to access web2ldap.
- cookie_length
-
Integer number of chars to use for cookie
0 or None disables using cookies completely.
- cookie_max_age
-
Cookie lifetime in seconds. It's probably a good idea to set it to
the same value like session_remove.
- pylibdirs
-
A list of strings with the full pathnames of directories
containing the required Python modules.
Example:
pylibdirs = ['/opt/web2ldap/pylib','/usr/local/python/ldapmodule']
- ldif_maxbytes
-
Maximum length (in bytes) of LDIF data in the <textarea>
of addform/modifyform.
- ldif_url_schemes
-
List of strings which specifies the URL schemes to process in LDIF input
(marker :< in LDIF notation, see
RFC 2849).
Think twice!!!
This can be a security nightmare! Every resource addressable by URL
which is accessible by the system running web2ldap can be revealed.
Usually you MUST not allow file if others can access
your web2ldap installation and you MUST not allow any URL retrieval
when running at a security border (like somewhere at firewall border).
If unsure leave as empty list to ignore all URLs in LDIF.
Once again. This is the safe setting:
ldif_url_schemes = []
- input_maxattrs
-
Maximum count of input attribute fields in addform/modifyform.
- input_maxfieldlen
-
Maximum length of attribute data input fields in addform/modifyform.
- max_searchparams
-
Maximum count of search parameters in advanced search form.
Example:
max_searchparams=9
- search_attrsonly
-
There are some situations where web2ldap just wants to determine the
existing attribute types of an entry and not the data itself for
saving bandwidth.
However some LDAP hosts (e.g. Notes Domino 4.61 and prior versions)
have problems with such an search requesting only attribute types,
they won't return any matches for a search. If you experience this
problems (no matching entry) set this to 0.
Example:
search_attrsonly=1
- ldap_opt_debug_level
-
If non-zero this turns on debug output of the OpenLDAP libs
and sets the debug level.
Warning! Confidential information might be disclosed to the log!
If unsure leave zero! Only set to non-zero if you have protected logs!
- ldap_trace_level
-
Trace output of the LDAP connection can be written to error
output. Set to non-zero if you want debug your LDAP connection.
Warning! Passwords (credentials) are written to this trace log!
If unsure leave zero! Only set to non-zero for testing purposes
and if you have protected logs!
- dumpasn1cfg
-
Path name to file
dumpasn1.cfg needed for displaying names of OIDs
in subject and issuer name and X.509v3 extensions of certificates.
- redirect_template
-
HTML template file for the redirect page.
HTML and HTTP options
- gzip_level
-
The HTTP body can be sent compressed with gzip algorithm if this parameter
is set to a non-zero compressing level, the HTTP client sends
Accept-Encoding: gzip in the HTTP request header and the
web server sets HTTP_ACCEPT_CHARSET environment variable.
This also needs zlibmodule which is automatically detected.
Note:
This might speed things up if the server's CPU rather fast
compared to the network link. Even with large search results you
won't gain much by choosing gzip level higher than 1.
Example:
gzip_level=1
-
Static dictionary of HTTP headers to be always sent to the browser.
You can extend this if new HTTP headers are defined for enabling
optional security features in browsers.
Security options
You should think about these parameters a little bit longer...
- session_limit
-
Maximum number of currently persistent web sessions.
- session_per_ip_limit
-
Maximum number of currently persistent web sessions per remote IP address.
- session_paranoid
-
If non-zero this is the time-span in seconds after which a
new session ID is generated.
Disadvantage: The browser's back button does not work anymore.
Default: 0 (disabled)
- session_remove
-
Amount of time in seconds after which inactive sessions will be expired
and the session data is removed silently without the possibility to relogin.
- session_checkvars
-
List of environment variables assumed to be constant throughout
web sessions with the same ID if existent.
These env vars are cross-checked for each hit while restoring a
web session to reduce the risk of session-hijacking.
Note: REMOTE_ADDR and REMOTE_HOST might not be
constant if the client accesses web2ldap through a network of web proxy
siblings.
- sec_sslacceptedciphers
-
Specifies a list of strings with the acceptable symmetric key ciphers to
reach at least security level 1.
See also the documentation of your SSL capable web server.