misc.py

The configuration module for general options

This document describes the parameter which influence the basic behaviour of web2ldap.

[connect_template] [cookie_domain] [cookie_length] [cookie_max_age] [dumpasn1cfg] [gzip_level] [http_headers] [input_maxattrs] [input_maxfieldlen] [ldap_opt_debug_level] [ldap_trace_level] [ldif_maxbytes] [ldif_url_schemes] [max_searchparams] [pylibdirs] [redirect_template] [search_attrs] [search_attrsonly] [sec_sslacceptedciphers] [session_checkvars] [session_limit] [session_paranoid] [session_per_ip_limit] [session_remove]

connect_template
HTML template file for the input fields of a Connect Form based on Python's Format String Syntax to reference the different dynamically generated input fields etc.
Sets cookie domain (DNS name) sent in Set-Cookie header. None lets web2ldap send the hostname automatically determined which might not work in tunnel/proxy setups because it has to match the DNS name the browser uses to access web2ldap.
Integer number of chars to use for cookie 0 or None disables using cookies completely.
Cookie lifetime in seconds. It's probably a good idea to set it to the same value like session_remove.
pylibdirs
A list of strings with the full pathnames of directories containing the required Python modules.

Example:

pylibdirs = ['/opt/web2ldap/pylib','/usr/local/python/ldapmodule']
ldif_maxbytes
Maximum length (in bytes) of LDIF data in the <textarea> of addform/modifyform.
ldif_url_schemes
List of strings which specifies the URL schemes to process in LDIF input (marker :< in LDIF notation, see RFC 2849).
Think twice!!!
This can be a security nightmare! Every resource addressable by URL which is accessible by the system running web2ldap can be revealed. Usually you MUST not allow file if others can access your web2ldap installation and you MUST not allow any URL retrieval when running at a security border (like somewhere at firewall border).

If unsure leave as empty list to ignore all URLs in LDIF.
Once again. This is the safe setting:
ldif_url_schemes = []
input_maxattrs
Maximum count of input attribute fields in addform/modifyform.
input_maxfieldlen
Maximum length of attribute data input fields in addform/modifyform.
max_searchparams
Maximum count of search parameters in advanced search form.

Example:

max_searchparams=9
search_attrsonly
There are some situations where web2ldap just wants to determine the existing attribute types of an entry and not the data itself for saving bandwidth.
However some LDAP hosts (e.g. Notes Domino 4.61 and prior versions) have problems with such an search requesting only attribute types, they won't return any matches for a search. If you experience this problems (no matching entry) set this to 0.

Example:

search_attrsonly=1
ldap_opt_debug_level
If non-zero this turns on debug output of the OpenLDAP libs and sets the debug level. Warning! Confidential information might be disclosed to the log! If unsure leave zero! Only set to non-zero if you have protected logs!
ldap_trace_level
Trace output of the LDAP connection can be written to error output. Set to non-zero if you want debug your LDAP connection. Warning! Passwords (credentials) are written to this trace log! If unsure leave zero! Only set to non-zero for testing purposes and if you have protected logs!
dumpasn1cfg
Path name to file dumpasn1.cfg needed for displaying names of OIDs in subject and issuer name and X.509v3 extensions of certificates.
redirect_template
HTML template file for the redirect page.

HTML and HTTP options

gzip_level
The HTTP body can be sent compressed with gzip algorithm if this parameter is set to a non-zero compressing level, the HTTP client sends Accept-Encoding: gzip in the HTTP request header and the web server sets HTTP_ACCEPT_CHARSET environment variable. This also needs zlibmodule which is automatically detected.
Note:
This might speed things up if the server's CPU rather fast compared to the network link. Even with large search results you won't gain much by choosing gzip level higher than 1.

Example:

gzip_level=1
http_headers
Static dictionary of HTTP headers to be always sent to the browser. You can extend this if new HTTP headers are defined for enabling optional security features in browsers.

Security options

You should think about these parameters a little bit longer...

session_limit
Maximum number of currently persistent web sessions.
session_per_ip_limit
Maximum number of currently persistent web sessions per remote IP address.
session_paranoid
If non-zero this is the time-span in seconds after which a new session ID is generated.
Disadvantage: The browser's back button does not work anymore.
Default: 0 (disabled)
session_remove
Amount of time in seconds after which inactive sessions will be expired and the session data is removed silently without the possibility to relogin.
session_checkvars
List of environment variables assumed to be constant throughout web sessions with the same ID if existent. These env vars are cross-checked for each hit while restoring a web session to reduce the risk of session-hijacking.
Note: REMOTE_ADDR and REMOTE_HOST might not be constant if the client accesses web2ldap through a network of web proxy siblings.
sec_sslacceptedciphers
Specifies a list of strings with the acceptable symmetric key ciphers to reach at least security level 1. See also the documentation of your SSL capable web server.