+ linkend="auth-ldap"> for details.
+
+
+
+
pam>
+
+
LDAP authentication
+
+
+
+
+ This authentication method operates similarly to
+ password except that it uses LDAP
+ as the authentication method. LDAP is used only to validate
+ the user name/password pairs. Therefore the user must already
+ exist in the database before LDAP can be used for
+ authentication. The server and parameters used are specified
+ after the ldap> key word in the file
+ pg_hba.conf. The format of this parameter is:
+
+ldap[s>]://servername>[:port>]/base dn[;prefix>[;suffix>]]
+
+ for example:
+
+ldap://ldap.example.net/dc=example,dc=net;EXAMPLE\
+
+
+
+ If ldaps> is specified instead of ldap>,
+ TLS encryption will be enabled for the connection. Note that this
+ will encrypt only the connection between the PostgreSQL server
+ and the LDAP server. The connection between the client and the
+ PostgreSQL server is not affected by this setting. To make use of
+ TLS encryption, you may need to configure the LDAP library prior
+ to configuring PostgreSQL.
+
+ If no port is specified, the default port as configured in the
+ LDAP library will be used.
+
+ The server will bind to the distinguished name specified as
+ base dn> using the username supplied by the client.
+ If prefix> and suffix> is
+ specified, it will be prepended and appended to the username
+ before the bind. Typically, the prefix parameter is used to specify
+ cn=>, or DOMAIN\> in an Active
+ Directory environment.
+
+
+
+
PAM authentication