LDAP.CONF(5)              (2021/06/03)               LDAP.CONF(5)

          ldap.conf, .ldaprc - LDAP configuration file/environment

          /etc/ldap/ldap.conf, ldaprc, .ldaprc, $LDAP<option-name>

          If the environment variable LDAPNOINIT is defined, all
          defaulting is disabled.

          The ldap.conf configuration file is used to set system-wide
          defaults to be applied when running ldap clients.

          Users may create an optional configuration file, ldaprc or
          .ldaprc, in their home directory which will be used to over-
          ride the system-wide defaults file.  The file ldaprc in the
          current working directory is also used.

          Additional configuration files can be specified using the
          LDAPCONF and LDAPRC environment variables.  LDAPCONF may be
          set to the path of a configuration file.  This path can be
          absolute or relative to the current working directory.  The
          LDAPRC, if defined, should be the basename of a file in the
          current working directory or in the user's home directory.

          Environmental variables may also be used to augment the file
          based defaults.  The name of the variable is the option name
          with an added prefix of LDAP.  For example, to define BASE
          via the environment, set the variable LDAPBASE to the
          desired value.

          Some options are user-only.  Such options are ignored if
          present in the ldap.conf (or file specified by LDAPCONF).

          Thus the following files and variables are read, in order:
              variable     $LDAPNOINIT, and if that is not set:
              system file  /etc/ldap/ldap.conf,
              user files   $HOME/ldaprc,  $HOME/.ldaprc,  ./ldaprc,
              system file  $LDAPCONF,
              user files   $HOME/$LDAPRC, $HOME/.$LDAPRC, ./$LDAPRC,
              variables    $LDAP<uppercase option name>.
          Settings late in the list override earlier ones.

          The configuration options are case-insensitive; their value,
          on a case by case basis, may be case-sensitive.

          Blank lines are ignored.
          Lines beginning with a hash mark (`#') are comments, and

     Page 1               OpenLDAP 2.4.59+dfsg-1     (printed 5/26/22)

     LDAP.CONF(5)              (2021/06/03)               LDAP.CONF(5)


          Valid lines are made of an option's name (a sequence of
          non-blanks, conventionally written in uppercase, although
          not required), followed by a value.  The value starts with
          the first non-blank character after the option's name, and
          terminates at the end of the line, or at the last sequence
          of blanks before the end of the line.  The tokenization of
          the value, if any, is delegated to the handler(s) for that
          option, if any.  Quoting values that contain blanks may be
          incorrect, as the quotes would become part of the value.
          For example,

               # Wrong - erroneous quotes:
               URI     "ldap:// ldaps://"

               # Right - space-separated list of URIs, without quotes:
               URI     ldap:// ldaps://

               # Right - DN syntax needs quoting for Example, Inc:
               BASE    ou=IT staff,o="Example, Inc",c=US
               # or:
               BASE    ou=IT staff,o=Example\2C Inc,c=US

               # Wrong - comment on same line as option:
               DEREF   never           # Never follow aliases

          A line cannot be longer than LINE_MAX, which should be more
          than 2000 bytes on all platforms.  There is no mechanism to
          split a long line on multiple lines, either for beautifica-
          tion or to overcome the above limit.

          The different configuration options are:

          URI <ldap[si]://[name[:port]] ...>
               Specifies the URI(s) of an LDAP server(s) to which the
               LDAP library should connect.  The URI scheme may be any
               of ldap, ldaps or ldapi, which refer to LDAP over TCP,
               LDAP over SSL (TLS) and LDAP over IPC (UNIX domain
               sockets), respectively.  Each server's name can be
               specified as a domain-style name or an IP address lit-
               eral.  Optionally, the server's name can followed by a
               ':' and the port number the LDAP server is listening
               on.  If no port number is provided, the default port
               for the scheme is used (389 for ldap://, 636 for
               ldaps://).  For LDAP over IPC, name is the name of the
               socket, and no port is required, nor allowed; note that
               directory separators must be URL-encoded, like any
               other characters that are special to URLs; so the

     Page 2               OpenLDAP 2.4.59+dfsg-1     (printed 5/26/22)

     LDAP.CONF(5)              (2021/06/03)               LDAP.CONF(5)


               must be specified as


               A space separated list of URIs may be provided.

          BASE <base>
               Specifies the default base DN to use when performing
               ldap operations.  The base must be specified as a Dis-
               tinguished Name in LDAP format.

          BINDDN <dn>
               Specifies the default bind DN to use when performing
               ldap operations.  The bind DN must be specified as a
               Distinguished Name in LDAP format.  This is a user-only

          DEREF <when>
               Specifies how alias dereferencing is done when perform-
               ing a search. The <when> can be specified as one of the
               following keywords:

                    Aliases are never dereferenced. This is the

                    Aliases are dereferenced in subordinates of the
                    base object, but not in locating the base object
                    of the search.

                    Aliases are only dereferenced when locating the
                    base object of the search.

                    Aliases are dereferenced both in searching and in
                    locating the base object of the search.

          is derived from the University of Michigan LDAP 3.3 Release.

     Page 3               OpenLDAP 2.4.59+dfsg-1     (printed 5/26/22)