{"Entry":{"collection":"auth","key":"ldap","name":"ldap","aliases":[],"metadata":{"aliases":[],"category":"Authentication and access control","content_hash":"ae824155a303611e373ba06485a3b0be060ce3d086a7d1e822b3206d1013ea1a","derived_content_hash":"28bae655e9d60c4f1285485173f99a693bbbe74a14b1fe3c0107e8a34e5b80ca","imported_at":"2026-09-30T00:40:33.296867+08:00","name":"ldap","name_zh":"","slug":"ldap","summary":"Authenticate using an LDAP server. See Section 20.10 for details."}},"Definition":{"Collection":"auth","Key":"ldap","SourceDatabase":"center","Version":"18","SourceTable":"authentication_method","SourceKey":"ldap","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","Facts":{"aliases":[],"attributes":{"configuration":"pg_hba.conf","inventory":"User-visible source authentication method","method":"ldap"},"comparison_data":{"documented_option_names":["ldapbasedn","ldapbinddn","ldapbindpasswd","ldapport","ldapprefix","ldapscheme","ldapsearchattribute","ldapsearchfilter","ldapserver","ldapsuffix","ldaptls","ldapurl"],"method":"ldap"},"comparison_hash":"d40de945ae67b3ac60a284fdd442cc24a4e9d05bc7a7b18009b54e491c381b88","description":["Authenticate using an LDAP server. See Section 20.10 for details."],"description_zh":"认证方法 ldap。","description_zh_html":"\u003cp\u003e认证方法 ldap。\u003c/p\u003e\u003cdl\u003e\u003cdt\u003e索引访问方法\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003eldap\u003c/code\u003e\u003c/dd\u003e\u003cdt\u003e配置\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003epg_hba.conf\u003c/code\u003e\u003c/dd\u003e\u003c/dl\u003e\u003ch3\u003e同版本中文手册节选\u003c/h3\u003e\u003cp\u003e\n    这种认证方法的工作方式与 \u003ccode class=\"literal\"\u003epassword\u003c/code\u003e 类似，只不过它使用 LDAP 作为密码验证方法。LDAP 只用于验证用户名/密码对。因此，在使用 LDAP 进行认证之前，用户必须已经存在于数据库中。\n   \u003c/p\u003e\u003cp\u003e\n    LDAP 认证可以在两种模式下工作。第一种模式称为简单绑定模式，服务器会绑定到按 \u003cem class=\"replaceable\"\u003e\u003ccode\u003eprefix\u003c/code\u003e\u003c/em\u003e \u003cem class=\"replaceable\"\u003e\u003ccode\u003eusername\u003c/code\u003e\u003c/em\u003e \u003cem class=\"replaceable\"\u003e\u003ccode\u003esuffix\u003c/code\u003e\u003c/em\u003e 形式构造出的可分辨名称。通常，\u003cem class=\"replaceable\"\u003e\u003ccode\u003eprefix\u003c/code\u003e\u003c/em\u003e 参数用于指定 \u003ccode class=\"literal\"\u003ecn=\u003c/code\u003e，或在 Active Directory 环境中指定 \u003cem class=\"replaceable\"\u003e\u003ccode\u003eDOMAIN\u003c/code\u003e\u003c/em\u003e\u003ccode class=\"literal\"\u003e\\\u003c/code\u003e。\u003cem class=\"replaceable\"\u003e\u003ccode\u003esuffix\u003c/code\u003e\u003c/em\u003e 则用于指定非 Active Directory 环境中 DN 的剩余部分。\n   \u003c/p\u003e\u003cp\u003e\n    第二种模式称为搜索+绑定模式，服务器首先使用由 \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapbinddn\u003c/code\u003e\u003c/em\u003e 和 \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapbindpasswd\u003c/code\u003e\u003c/em\u003e 指定的固定用户名和密码绑定到 LDAP 目录，并搜索试图登录数据库的用户。如果没有配置用户名和密码，则会尝试对目录进行匿名绑定。搜索会在 \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapbasedn\u003c/code\u003e\u003c/em\u003e 指定的子树上进行，并尝试对 \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapsearchattribute\u003c/code\u003e\u003c/em\u003e 指定的属性做精确匹配。一旦在搜索中找到了该用户，服务器就会作为该用户重新绑定到目录，并使用客户端指定的密码来验证登录是否正确。这种模式与 Apache \u003ccode class=\"literal\"\u003emod_authnz_ldap\u003c/code\u003e 和 \u003ccode class=\"literal\"\u003epam_ldap\u003c/code\u003e 等软件中的 LDAP 认证方案相同。这种方法使目录中用户对象的位置更具灵活性，但会对 LDAP 服务器额外发起两次请求。\n   \u003c/p\u003e\u003cp\u003e\n    以下配置选项在两种模式下都使用：\n    \u003c/p\u003e\u003cp\u003e\u003ca href=\"/zh/docs/18/auth-ldap.html\"\u003e查看完整中文手册与上下文\u003c/a\u003e。\u003c/p\u003e","facts":[{"label":"Method","value":"ldap"},{"label":"Configuration","value":"pg_hba.conf"},{"label":"Inventory","value":"User-visible source authentication method"}],"facts_zh":[{"label":"方法","value":"ldap"},{"label":"配置","value":"pg_hba.conf"},{"label":"清单","value":"用户可见的源码认证方法"}],"manual_html":"\u003cdiv class=\"sect1\" id=\"AUTH-LDAP\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.10. LDAP Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method operates similarly to \u003ccode class=\"literal\"\u003epassword\u003c/code\u003e except that it uses LDAP as the password verification method. LDAP is used only to validate the user name/password pairs. Therefore the user must already exist in the database before LDAP can be used for authentication.\u003c/p\u003e\n\u003cp\u003eLDAP authentication can operate in two modes. In the first mode, which we will call the simple bind mode, the server will bind to the distinguished name constructed as \u003cem class=\"replaceable\"\u003e\u003ccode\u003eprefix\u003c/code\u003e\u003c/em\u003e \u003cem class=\"replaceable\"\u003e\u003ccode\u003eusername\u003c/code\u003e\u003c/em\u003e \u003cem class=\"replaceable\"\u003e\u003ccode\u003esuffix\u003c/code\u003e\u003c/em\u003e. Typically, the \u003cem class=\"replaceable\"\u003e\u003ccode\u003eprefix\u003c/code\u003e\u003c/em\u003e parameter is used to specify \u003ccode class=\"literal\"\u003ecn=\u003c/code\u003e, or \u003cem class=\"replaceable\"\u003e\u003ccode\u003eDOMAIN\u003c/code\u003e\u003c/em\u003e\u003ccode class=\"literal\"\u003e\\\u003c/code\u003e in an Active Directory environment. \u003cem class=\"replaceable\"\u003e\u003ccode\u003esuffix\u003c/code\u003e\u003c/em\u003e is used to specify the remaining part of the DN in a non-Active Directory environment.\u003c/p\u003e\n\u003cp\u003eIn the second mode, which we will call the search+bind mode, the server first binds to the LDAP directory with a fixed user name and password, specified with \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapbinddn\u003c/code\u003e\u003c/em\u003e and \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapbindpasswd\u003c/code\u003e\u003c/em\u003e, and performs a search for the user trying to log in to the database. If no user and password is configured, an anonymous bind will be attempted to the directory. The search will be performed over the subtree at \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapbasedn\u003c/code\u003e\u003c/em\u003e, and will try to do an exact match of the attribute specified in \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapsearchattribute\u003c/code\u003e\u003c/em\u003e. Once the user has been found in this search, the server re-binds to the directory as this user, using the password specified by the client, to verify that the login is correct. This mode is the same as that used by LDAP authentication schemes in other software, such as Apache \u003ccode class=\"literal\"\u003emod_authnz_ldap\u003c/code\u003e and \u003ccode class=\"literal\"\u003epam_ldap\u003c/code\u003e. This method allows for significantly more flexibility in where the user objects are located in the directory, but will cause two additional requests to the LDAP server to be made.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are used in both modes:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapserver\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eNames or IP addresses of LDAP servers to connect to. Multiple servers may be specified, separated by spaces.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapport\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003ePort number on LDAP server to connect to. If no port is specified, the LDAP library's default port setting will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapscheme\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSet to \u003ccode class=\"literal\"\u003eldaps\u003c/code\u003e to use LDAPS. This is a non-standard way of using LDAP over SSL, supported by some LDAP server implementations. See also the \u003ccode class=\"literal\"\u003eldaptls\u003c/code\u003e option for an alternative.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldaptls\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSet to 1 to make the connection between PostgreSQL and the LDAP server use TLS encryption. This uses the \u003ccode class=\"literal\"\u003eStartTLS\u003c/code\u003e operation per \u003ca class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc4513\"\u003eRFC 4513\u003c/a\u003e. See also the \u003ccode class=\"literal\"\u003eldapscheme\u003c/code\u003e option for an alternative.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eNote that using \u003ccode class=\"literal\"\u003eldapscheme\u003c/code\u003e or \u003ccode class=\"literal\"\u003eldaptls\u003c/code\u003e only encrypts the traffic between the PostgreSQL server and the LDAP server. The connection between the PostgreSQL server and the PostgreSQL client will still be unencrypted unless SSL is used there as well.\u003c/p\u003e\n\u003cp\u003eThe following options are used in simple bind mode only:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapprefix\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eString to prepend to the user name when forming the DN to bind as, when doing simple bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapsuffix\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eString to append to the user name when forming the DN to bind as, when doing simple bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eThe following options are used in search+bind mode only:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapbasedn\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eRoot DN to begin the search for the user in, when doing search+bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapbinddn\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eDN of user to bind to the directory with to perform the search when doing search+bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapbindpasswd\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003ePassword for user to bind to the directory with to perform the search when doing search+bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapsearchattribute\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAttribute to match against the user name in the search when doing search+bind authentication. If no attribute is specified, the \u003ccode class=\"literal\"\u003euid\u003c/code\u003e attribute will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapsearchfilter\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe search filter to use when doing search+bind authentication. Occurrences of \u003ccode class=\"literal\"\u003e$username\u003c/code\u003e will be replaced with the user name. This allows for more flexible search filters than \u003ccode class=\"literal\"\u003eldapsearchattribute\u003c/code\u003e.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eThe following option may be used as an alternative way to write some of the above LDAP options in a more compact and standard form:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapurl\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAn \u003ca class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc4516\"\u003eRFC 4516\u003c/a\u003e LDAP URL. The format is\u003c/p\u003e\n\u003cpre class=\"synopsis\"\u003eldap[s]://\u003cem class=\"replaceable\"\u003e\u003ccode\u003ehost\u003c/code\u003e\u003c/em\u003e[:\u003cem class=\"replaceable\"\u003e\u003ccode\u003eport\u003c/code\u003e\u003c/em\u003e]/\u003cem class=\"replaceable\"\u003e\u003ccode\u003ebasedn\u003c/code\u003e\u003c/em\u003e[?[\u003cem class=\"replaceable\"\u003e\u003ccode\u003eattribute\u003c/code\u003e\u003c/em\u003e][?[\u003cem class=\"replaceable\"\u003e\u003ccode\u003escope\u003c/code\u003e\u003c/em\u003e][?[\u003cem class=\"replaceable\"\u003e\u003ccode\u003efilter\u003c/code\u003e\u003c/em\u003e]]]]\n\u003c/pre\u003e\n\u003cp\u003e\u003cem class=\"replaceable\"\u003e\u003ccode\u003escope\u003c/code\u003e\u003c/em\u003e must be one of \u003ccode class=\"literal\"\u003ebase\u003c/code\u003e, \u003ccode class=\"literal\"\u003eone\u003c/code\u003e, \u003ccode class=\"literal\"\u003esub\u003c/code\u003e, typically the last. (The default is \u003ccode class=\"literal\"\u003ebase\u003c/code\u003e, which is normally not useful in this application.) \u003cem class=\"replaceable\"\u003e\u003ccode\u003eattribute\u003c/code\u003e\u003c/em\u003e can nominate a single attribute, in which case it is used as a value for \u003ccode class=\"literal\"\u003eldapsearchattribute\u003c/code\u003e. If \u003cem class=\"replaceable\"\u003e\u003ccode\u003eattribute\u003c/code\u003e\u003c/em\u003e is empty then \u003cem class=\"replaceable\"\u003e\u003ccode\u003efilter\u003c/code\u003e\u003c/em\u003e can be used as a value for \u003ccode class=\"literal\"\u003eldapsearchfilter\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe URL scheme \u003ccode class=\"literal\"\u003eldaps\u003c/code\u003e chooses the LDAPS method for making LDAP connections over SSL, equivalent to using \u003ccode class=\"literal\"\u003eldapscheme=ldaps\u003c/code\u003e. To use encrypted LDAP connections using the \u003ccode class=\"literal\"\u003eStartTLS\u003c/code\u003e operation, use the normal URL scheme \u003ccode class=\"literal\"\u003eldap\u003c/code\u003e and specify the \u003ccode class=\"literal\"\u003eldaptls\u003c/code\u003e option in addition to \u003ccode class=\"literal\"\u003eldapurl\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eFor non-anonymous binds, \u003ccode class=\"literal\"\u003eldapbinddn\u003c/code\u003e and \u003ccode class=\"literal\"\u003eldapbindpasswd\u003c/code\u003e must be specified as separate options.\u003c/p\u003e\n\u003cp\u003eLDAP URLs are currently only supported with \u003cspan class=\"productname\"\u003eOpenLDAP\u003c/span\u003e, not on Windows.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eIt is an error to mix configuration options for simple bind with options for search+bind. To use \u003ccode class=\"literal\"\u003eldapurl\u003c/code\u003e in simple bind mode, the URL must not contain a \u003ccode class=\"literal\"\u003ebasedn\u003c/code\u003e or query elements.\u003c/p\u003e\n\u003cp\u003eWhen using search+bind mode, the search can be performed using a single attribute specified with \u003ccode class=\"literal\"\u003eldapsearchattribute\u003c/code\u003e, or using a custom search filter specified with \u003ccode class=\"literal\"\u003eldapsearchfilter\u003c/code\u003e. Specifying \u003ccode class=\"literal\"\u003eldapsearchattribute=foo\u003c/code\u003e is equivalent to specifying \u003ccode class=\"literal\"\u003eldapsearchfilter=\"(foo=$username)\"\u003c/code\u003e. If neither option is specified the default is \u003ccode class=\"literal\"\u003eldapsearchattribute=uid\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eIf \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e was compiled with \u003cspan class=\"productname\"\u003eOpenLDAP\u003c/span\u003e as the LDAP client library, the \u003ccode class=\"literal\"\u003eldapserver\u003c/code\u003e setting may be omitted. In that case, a list of host names and ports is looked up via \u003ca class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc2782\"\u003eRFC 2782\u003c/a\u003e DNS SRV records. The name \u003ccode class=\"literal\"\u003e_ldap._tcp.DOMAIN\u003c/code\u003e is looked up, where \u003ccode class=\"literal\"\u003eDOMAIN\u003c/code\u003e is extracted from \u003ccode class=\"literal\"\u003eldapbasedn\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eHere is an example for a simple-bind LDAP configuration:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapserver=ldap.example.net ldapprefix=\"cn=\" ldapsuffix=\", dc=example, dc=net\"\n\u003c/pre\u003e\n\u003cp\u003eWhen a connection to the database server as database user \u003ccode class=\"literal\"\u003esomeuser\u003c/code\u003e is requested, PostgreSQL will attempt to bind to the LDAP server using the DN \u003ccode class=\"literal\"\u003ecn=someuser, dc=example, dc=net\u003c/code\u003e and the password provided by the client. If that connection succeeds, the database access is granted.\u003c/p\u003e\n\u003cp\u003eHere is a different simple-bind configuration, which uses the LDAPS scheme and a custom port number, written as a URL:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapurl=\"ldaps://ldap.example.net:49151\" ldapprefix=\"cn=\" ldapsuffix=\", dc=example, dc=net\"\n\u003c/pre\u003e\n\u003cp\u003eThis is slightly more compact than specifying \u003ccode class=\"literal\"\u003eldapserver\u003c/code\u003e, \u003ccode class=\"literal\"\u003eldapscheme\u003c/code\u003e, and \u003ccode class=\"literal\"\u003eldapport\u003c/code\u003e separately.\u003c/p\u003e\n\u003cp\u003eHere is an example for a search+bind configuration:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapserver=ldap.example.net ldapbasedn=\"dc=example, dc=net\" ldapsearchattribute=uid\n\u003c/pre\u003e\n\u003cp\u003eWhen a connection to the database server as database user \u003ccode class=\"literal\"\u003esomeuser\u003c/code\u003e is requested, PostgreSQL will attempt to bind anonymously (since \u003ccode class=\"literal\"\u003eldapbinddn\u003c/code\u003e was not specified) to the LDAP server, perform a search for \u003ccode class=\"literal\"\u003e(uid=someuser)\u003c/code\u003e under the specified base DN. If an entry is found, it will then attempt to bind using that found information and the password supplied by the client. If that second bind succeeds, the database access is granted.\u003c/p\u003e\n\u003cp\u003eHere is the same search+bind configuration written as a URL:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapurl=\"ldap://ldap.example.net/dc=example,dc=net?uid?sub\"\n\u003c/pre\u003e\n\u003cp\u003eSome other software that supports authentication against LDAP uses the same URL format, so it will be easier to share the configuration.\u003c/p\u003e\n\u003cp\u003eHere is an example for a search+bind configuration that uses \u003ccode class=\"literal\"\u003eldapsearchfilter\u003c/code\u003e instead of \u003ccode class=\"literal\"\u003eldapsearchattribute\u003c/code\u003e to allow authentication by user ID or email address:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapserver=ldap.example.net ldapbasedn=\"dc=example, dc=net\" ldapsearchfilter=\"(|(uid=$username)(mail=$username))\"\n\u003c/pre\u003e\n\u003cp\u003eHere is an example for a search+bind configuration that uses DNS SRV discovery to find the host name(s) and port(s) for the LDAP service for the domain name \u003ccode class=\"literal\"\u003eexample.net\u003c/code\u003e:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapbasedn=\"dc=example,dc=net\"\n\u003c/pre\u003e\n\u003cdiv class=\"tip\"\u003e\n\u003ch3 class=\"title\"\u003eTip\u003c/h3\u003e\n\u003cp\u003eSince LDAP often uses commas and spaces to separate the different parts of a DN, it is often necessary to use double-quoted parameter values when configuring LDAP options, as shown in the examples.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/div\u003e","manual_path":"/docs/18/auth-ldap.html","related":[],"release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sections":[],"sections_zh":[],"signature":"","sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"auth-ldap.html","sha256":"8f02f50758b63b0d9a9011b2c3c1ee12e8caa3830408f5ea5d97e0e81ee52628","url":"/docs/18/auth-ldap.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"Names or IP addresses of LDAP servers to connect to. Multiple servers may be specified, separated by spaces.","name":"ldapserver"},{"description":"Port number on LDAP server to connect to. If no port is specified, the LDAP library's default port setting will be used.","name":"ldapport"},{"description":"Set to ldaps to use LDAPS. This is a non-standard way of using LDAP over SSL, supported by some LDAP server implementations. See also the ldaptls option for an alternative.","name":"ldapscheme"},{"description":"Set to 1 to make the connection between PostgreSQL and the LDAP server use TLS encryption. This uses the StartTLS operation per RFC 4513 . See also the ldapscheme option for an alternative.","name":"ldaptls"},{"description":"String to prepend to the user name when forming the DN to bind as, when doing simple bind authentication.","name":"ldapprefix"},{"description":"String to append to the user name when forming the DN to bind as, when doing simple bind authentication.","name":"ldapsuffix"},{"description":"Root DN to begin the search for the user in, when doing search+bind authentication.","name":"ldapbasedn"},{"description":"DN of user to bind to the directory with to perform the search when doing search+bind authentication.","name":"ldapbinddn"},{"description":"Password for user to bind to the directory with to perform the search when doing search+bind authentication.","name":"ldapbindpasswd"},{"description":"Attribute to match against the user name in the search when doing search+bind authentication. If no attribute is specified, the uid attribute will be used.","name":"ldapsearchattribute"},{"description":"The search filter to use when doing search+bind authentication. Occurrences of $username will be replaced with the user name. This allows for more flexible search filters than ldapsearchattribute .","name":"ldapsearchfilter"},{"description":"An RFC 4516 LDAP URL. The format is ldap[s]:// host [: port ]/ basedn [?[ attribute ][?[ scope ][?[ filter ]]]] scope must be one of base , one , sub , typically the last. (The default is base , which is normally not useful in this application.) attribute can nominate a single attribute, in which case it is used as a value for ldapsearchattribute . If attribute is empty then filter can be used as a value for ldapsearchfilter . The URL scheme ldaps chooses the LDAPS method for making LDAP connections over SSL, equivalent to using ldapscheme=ldaps . To use encrypted LDAP connections using the StartTLS operation, use the normal URL scheme ldap and specify the ldaptls option in addition to ldapurl . For non-anonymous binds, ldapbinddn and ldapbindpasswd must be specified as separate options. LDAP URLs are currently only supported with OpenLDAP , not on Windows.","name":"ldapurl"}],"title":"Documented method options and alternatives"}],"tables_zh":[{"columns":[{"key":"name","label":"选项或术语"},{"key":"description","label":"含义"}],"key":"method-options","rows":[{"description":"要连接的LDAP服务器的名称或IP地址。可以指定多个服务器，用空格分隔。","name":"ldapserver"},{"description":"要连接的LDAP服务器的端口号。如果未指定端口，则将使用LDAP库的默认端口设置。","name":"ldapport"},{"description":"设置为 ldaps 以使用LDAPS。这是一种非标准的通过 SSL 使用 LDAP 的方式，受一些LDAP服务器实现支持。另请参阅 ldaptls 选项作为替代。","name":"ldapscheme"},{"description":"设置为 1 时，PostgreSQL 与 LDAP 服务器之间的连接使用 TLS 加密，通过 RFC 4513 规定的 StartTLS 操作实现。另可参见 ldapscheme 选项所提供的替代方式。","name":"ldaptls"},{"description":"在进行简单绑定认证时，附加到用户名前面以形成绑定 DN 的字符串。","name":"ldapprefix"},{"description":"在进行简单绑定认证时，附加到用户名后面以形成绑定 DN 的字符串。","name":"ldapsuffix"},{"description":"在进行搜索+绑定认证时，用作用户搜索起点的根 DN。","name":"ldapbasedn"},{"description":"在进行搜索+绑定认证时，用于绑定到目录并执行搜索的用户 DN。","name":"ldapbinddn"},{"description":"在进行搜索+绑定认证时，用于绑定到目录并执行搜索的用户密码。","name":"ldapbindpasswd"},{"description":"在进行搜索+绑定认证时，用于与用户名匹配的属性。如果未指定属性，则会使用 uid 属性。","name":"ldapsearchattribute"},{"description":"在进行搜索+绑定认证时使用的搜索过滤器。其中出现的 $username 会被替换为用户名。这使得搜索过滤器比 ldapsearchattribute 更灵活。","name":"ldapsearchfilter"},{"description":"符合 RFC 4516 的 LDAP URL。格式为 ldap[s]://host[:port]/basedn[?[attribute][?[scope][?[filter]]]]。scope 必须为 base、one 或 sub，通常使用 sub；默认值 base 在此用途下一般没有实际帮助。attribute 可指定一个属性，作为 ldapsearchattribute 的值；attribute 为空时，filter 可用作 ldapsearchfilter 的值。URL 方案 ldaps 表示通过 SSL 建立 LDAP 连接，等同于 ldapscheme=ldaps。若要通过 StartTLS 使用加密 LDAP 连接，应使用普通的 ldap URL 方案，并在 ldapurl 之外指定 ldaptls。对于非匿名绑定，必须另行指定 ldapbinddn 和 ldapbindpasswd。LDAP URL 目前仅在 OpenLDAP 中受支持，Windows 不支持。","name":"ldapurl"}],"title":"手册中的方法选项与替代方式"}],"zh_from":{"authored_translation":"source-derived-structured-summary","body_sha256":"5a8ab9944d7b29b510f1348eab0b77072b928b5ccce9d779650e736b54cd7ac0","kind":"same-version-chinese-manual-with-source-derived-structured-summary","manual":{"anchor":"","build_id":107,"extraction":"concept-introduction","fragment_sha256":"ade9ede427d8c1521a1f2fe149790aadb3980c44e0d8d901a5ed7f396015e0af","locale":"zh-Hans","page_key":"auth-ldap.html","source_hash":"8a05440dce4f97244904d89dfc6ab43fb988975ea445014608a045863396f70f","source_revision":"unknown:rendered-translation-baseline","translated_from_revision":null,"translation_revision":"git:b1b500221dbe5437cfca004d6b04d3f6e422765d;html-sha256:08e987a66af27b98444a8057c256314eafa13611a3fb9e888214fc436824244b","url":"/zh/docs/18/auth-ldap.html","version":"18"},"runtime_rerun":false,"source_facts_revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"}},"ManualEvidence":{"manual_path":"/docs/18/auth-ldap.html","release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"auth-ldap.html","sha256":"8f02f50758b63b0d9a9011b2c3c1ee12e8caa3830408f5ea5d97e0e81ee52628","url":"/docs/18/auth-ldap.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}]},"MeasuredEvidence":{}},"Text":{"Collection":"auth","Key":"ldap","SourceDatabase":"center","Version":"18","Locale":"en","Title":"ldap","Summary":"Authenticate using an LDAP server. See Section 20.10 for details.","BodyHTML":"\u003cdiv id=\"AUTH-LDAP\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2\u003e20.10. LDAP Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method operates similarly to \u003ccode\u003epassword\u003c/code\u003e except that it uses LDAP as the password verification method. LDAP is used only to validate the user name/password pairs. Therefore the user must already exist in the database before LDAP can be used for authentication.\u003c/p\u003e\n\u003cp\u003eLDAP authentication can operate in two modes. In the first mode, which we will call the simple bind mode, the server will bind to the distinguished name constructed as \u003cem\u003e\u003ccode\u003eprefix\u003c/code\u003e\u003c/em\u003e \u003cem\u003e\u003ccode\u003eusername\u003c/code\u003e\u003c/em\u003e \u003cem\u003e\u003ccode\u003esuffix\u003c/code\u003e\u003c/em\u003e. Typically, the \u003cem\u003e\u003ccode\u003eprefix\u003c/code\u003e\u003c/em\u003e parameter is used to specify \u003ccode\u003ecn=\u003c/code\u003e, or \u003cem\u003e\u003ccode\u003eDOMAIN\u003c/code\u003e\u003c/em\u003e\u003ccode\u003e\\\u003c/code\u003e in an Active Directory environment. \u003cem\u003e\u003ccode\u003esuffix\u003c/code\u003e\u003c/em\u003e is used to specify the remaining part of the DN in a non-Active Directory environment.\u003c/p\u003e\n\u003cp\u003eIn the second mode, which we will call the search+bind mode, the server first binds to the LDAP directory with a fixed user name and password, specified with \u003cem\u003e\u003ccode\u003eldapbinddn\u003c/code\u003e\u003c/em\u003e and \u003cem\u003e\u003ccode\u003eldapbindpasswd\u003c/code\u003e\u003c/em\u003e, and performs a search for the user trying to log in to the database. If no user and password is configured, an anonymous bind will be attempted to the directory. The search will be performed over the subtree at \u003cem\u003e\u003ccode\u003eldapbasedn\u003c/code\u003e\u003c/em\u003e, and will try to do an exact match of the attribute specified in \u003cem\u003e\u003ccode\u003eldapsearchattribute\u003c/code\u003e\u003c/em\u003e. Once the user has been found in this search, the server re-binds to the directory as this user, using the password specified by the client, to verify that the login is correct. This mode is the same as that used by LDAP authentication schemes in other software, such as Apache \u003ccode\u003emod_authnz_ldap\u003c/code\u003e and \u003ccode\u003epam_ldap\u003c/code\u003e. This method allows for significantly more flexibility in where the user objects are located in the directory, but will cause two additional requests to the LDAP server to be made.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are used in both modes:\u003c/p\u003e\n\u003cdiv\u003e\n\u003cdl\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldapserver\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eNames or IP addresses of LDAP servers to connect to. Multiple servers may be specified, separated by spaces.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldapport\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003ePort number on LDAP server to connect to. If no port is specified, the LDAP library\u0026#39;s default port setting will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldapscheme\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSet to \u003ccode\u003eldaps\u003c/code\u003e to use LDAPS. This is a non-standard way of using LDAP over SSL, supported by some LDAP server implementations. See also the \u003ccode\u003eldaptls\u003c/code\u003e option for an alternative.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldaptls\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSet to 1 to make the connection between PostgreSQL and the LDAP server use TLS encryption. This uses the \u003ccode\u003eStartTLS\u003c/code\u003e operation per \u003ca href=\"https://datatracker.ietf.org/doc/html/rfc4513\" rel=\"nofollow\"\u003eRFC 4513\u003c/a\u003e. See also the \u003ccode\u003eldapscheme\u003c/code\u003e option for an alternative.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eNote that using \u003ccode\u003eldapscheme\u003c/code\u003e or \u003ccode\u003eldaptls\u003c/code\u003e only encrypts the traffic between the PostgreSQL server and the LDAP server. The connection between the PostgreSQL server and the PostgreSQL client will still be unencrypted unless SSL is used there as well.\u003c/p\u003e\n\u003cp\u003eThe following options are used in simple bind mode only:\u003c/p\u003e\n\u003cdiv\u003e\n\u003cdl\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldapprefix\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eString to prepend to the user name when forming the DN to bind as, when doing simple bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldapsuffix\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eString to append to the user name when forming the DN to bind as, when doing simple bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eThe following options are used in search+bind mode only:\u003c/p\u003e\n\u003cdiv\u003e\n\u003cdl\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldapbasedn\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eRoot DN to begin the search for the user in, when doing search+bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldapbinddn\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eDN of user to bind to the directory with to perform the search when doing search+bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldapbindpasswd\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003ePassword for user to bind to the directory with to perform the search when doing search+bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldapsearchattribute\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAttribute to match against the user name in the search when doing search+bind authentication. If no attribute is specified, the \u003ccode\u003euid\u003c/code\u003e attribute will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldapsearchfilter\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe search filter to use when doing search+bind authentication. Occurrences of \u003ccode\u003e$username\u003c/code\u003e will be replaced with the user name. This allows for more flexible search filters than \u003ccode\u003eldapsearchattribute\u003c/code\u003e.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eThe following option may be used as an alternative way to write some of the above LDAP options in a more compact and standard form:\u003c/p\u003e\n\u003cdiv\u003e\n\u003cdl\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eldapurl\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAn \u003ca href=\"https://datatracker.ietf.org/doc/html/rfc4516\" rel=\"nofollow\"\u003eRFC 4516\u003c/a\u003e LDAP URL. The format is\u003c/p\u003e\n\u003cpre\u003eldap[s]://\u003cem\u003e\u003ccode\u003ehost\u003c/code\u003e\u003c/em\u003e[:\u003cem\u003e\u003ccode\u003eport\u003c/code\u003e\u003c/em\u003e]/\u003cem\u003e\u003ccode\u003ebasedn\u003c/code\u003e\u003c/em\u003e[?[\u003cem\u003e\u003ccode\u003eattribute\u003c/code\u003e\u003c/em\u003e][?[\u003cem\u003e\u003ccode\u003escope\u003c/code\u003e\u003c/em\u003e][?[\u003cem\u003e\u003ccode\u003efilter\u003c/code\u003e\u003c/em\u003e]]]]\n\u003c/pre\u003e\n\u003cp\u003e\u003cem\u003e\u003ccode\u003escope\u003c/code\u003e\u003c/em\u003e must be one of \u003ccode\u003ebase\u003c/code\u003e, \u003ccode\u003eone\u003c/code\u003e, \u003ccode\u003esub\u003c/code\u003e, typically the last. (The default is \u003ccode\u003ebase\u003c/code\u003e, which is normally not useful in this application.) \u003cem\u003e\u003ccode\u003eattribute\u003c/code\u003e\u003c/em\u003e can nominate a single attribute, in which case it is used as a value for \u003ccode\u003eldapsearchattribute\u003c/code\u003e. If \u003cem\u003e\u003ccode\u003eattribute\u003c/code\u003e\u003c/em\u003e is empty then \u003cem\u003e\u003ccode\u003efilter\u003c/code\u003e\u003c/em\u003e can be used as a value for \u003ccode\u003eldapsearchfilter\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe URL scheme \u003ccode\u003eldaps\u003c/code\u003e chooses the LDAPS method for making LDAP connections over SSL, equivalent to using \u003ccode\u003eldapscheme=ldaps\u003c/code\u003e. To use encrypted LDAP connections using the \u003ccode\u003eStartTLS\u003c/code\u003e operation, use the normal URL scheme \u003ccode\u003eldap\u003c/code\u003e and specify the \u003ccode\u003eldaptls\u003c/code\u003e option in addition to \u003ccode\u003eldapurl\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eFor non-anonymous binds, \u003ccode\u003eldapbinddn\u003c/code\u003e and \u003ccode\u003eldapbindpasswd\u003c/code\u003e must be specified as separate options.\u003c/p\u003e\n\u003cp\u003eLDAP URLs are currently only supported with \u003cspan\u003eOpenLDAP\u003c/span\u003e, not on Windows.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eIt is an error to mix configuration options for simple bind with options for search+bind. To use \u003ccode\u003eldapurl\u003c/code\u003e in simple bind mode, the URL must not contain a \u003ccode\u003ebasedn\u003c/code\u003e or query elements.\u003c/p\u003e\n\u003cp\u003eWhen using search+bind mode, the search can be performed using a single attribute specified with \u003ccode\u003eldapsearchattribute\u003c/code\u003e, or using a custom search filter specified with \u003ccode\u003eldapsearchfilter\u003c/code\u003e. Specifying \u003ccode\u003eldapsearchattribute=foo\u003c/code\u003e is equivalent to specifying \u003ccode\u003eldapsearchfilter=\u0026#34;(foo=$username)\u0026#34;\u003c/code\u003e. If neither option is specified the default is \u003ccode\u003eldapsearchattribute=uid\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eIf \u003cspan\u003ePostgreSQL\u003c/span\u003e was compiled with \u003cspan\u003eOpenLDAP\u003c/span\u003e as the LDAP client library, the \u003ccode\u003eldapserver\u003c/code\u003e setting may be omitted. In that case, a list of host names and ports is looked up via \u003ca href=\"https://datatracker.ietf.org/doc/html/rfc2782\" rel=\"nofollow\"\u003eRFC 2782\u003c/a\u003e DNS SRV records. The name \u003ccode\u003e_ldap._tcp.DOMAIN\u003c/code\u003e is looked up, where \u003ccode\u003eDOMAIN\u003c/code\u003e is extracted from \u003ccode\u003eldapbasedn\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eHere is an example for a simple-bind LDAP configuration:\u003c/p\u003e\n\u003cpre\u003ehost ... ldap ldapserver=ldap.example.net ldapprefix=\u0026#34;cn=\u0026#34; ldapsuffix=\u0026#34;, dc=example, dc=net\u0026#34;\n\u003c/pre\u003e\n\u003cp\u003eWhen a connection to the database server as database user \u003ccode\u003esomeuser\u003c/code\u003e is requested, PostgreSQL will attempt to bind to the LDAP server using the DN \u003ccode\u003ecn=someuser, dc=example, dc=net\u003c/code\u003e and the password provided by the client. If that connection succeeds, the database access is granted.\u003c/p\u003e\n\u003cp\u003eHere is a different simple-bind configuration, which uses the LDAPS scheme and a custom port number, written as a URL:\u003c/p\u003e\n\u003cpre\u003ehost ... ldap ldapurl=\u0026#34;ldaps://ldap.example.net:49151\u0026#34; ldapprefix=\u0026#34;cn=\u0026#34; ldapsuffix=\u0026#34;, dc=example, dc=net\u0026#34;\n\u003c/pre\u003e\n\u003cp\u003eThis is slightly more compact than specifying \u003ccode\u003eldapserver\u003c/code\u003e, \u003ccode\u003eldapscheme\u003c/code\u003e, and \u003ccode\u003eldapport\u003c/code\u003e separately.\u003c/p\u003e\n\u003cp\u003eHere is an example for a search+bind configuration:\u003c/p\u003e\n\u003cpre\u003ehost ... ldap ldapserver=ldap.example.net ldapbasedn=\u0026#34;dc=example, dc=net\u0026#34; ldapsearchattribute=uid\n\u003c/pre\u003e\n\u003cp\u003eWhen a connection to the database server as database user \u003ccode\u003esomeuser\u003c/code\u003e is requested, PostgreSQL will attempt to bind anonymously (since \u003ccode\u003eldapbinddn\u003c/code\u003e was not specified) to the LDAP server, perform a search for \u003ccode\u003e(uid=someuser)\u003c/code\u003e under the specified base DN. If an entry is found, it will then attempt to bind using that found information and the password supplied by the client. If that second bind succeeds, the database access is granted.\u003c/p\u003e\n\u003cp\u003eHere is the same search+bind configuration written as a URL:\u003c/p\u003e\n\u003cpre\u003ehost ... ldap ldapurl=\u0026#34;ldap://ldap.example.net/dc=example,dc=net?uid?sub\u0026#34;\n\u003c/pre\u003e\n\u003cp\u003eSome other software that supports authentication against LDAP uses the same URL format, so it will be easier to share the configuration.\u003c/p\u003e\n\u003cp\u003eHere is an example for a search+bind configuration that uses \u003ccode\u003eldapsearchfilter\u003c/code\u003e instead of \u003ccode\u003eldapsearchattribute\u003c/code\u003e to allow authentication by user ID or email address:\u003c/p\u003e\n\u003cpre\u003ehost ... ldap ldapserver=ldap.example.net ldapbasedn=\u0026#34;dc=example, dc=net\u0026#34; ldapsearchfilter=\u0026#34;(|(uid=$username)(mail=$username))\u0026#34;\n\u003c/pre\u003e\n\u003cp\u003eHere is an example for a search+bind configuration that uses DNS SRV discovery to find the host name(s) and port(s) for the LDAP service for the domain name \u003ccode\u003eexample.net\u003c/code\u003e:\u003c/p\u003e\n\u003cpre\u003ehost ... ldap ldapbasedn=\u0026#34;dc=example,dc=net\u0026#34;\n\u003c/pre\u003e\n\u003cdiv\u003e\n\u003ch3\u003eTip\u003c/h3\u003e\n\u003cp\u003eSince LDAP often uses commas and spaces to separate the different parts of a DN, it is often necessary to use double-quoted parameter values when configuring LDAP options, as shown in the examples.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/div\u003e","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","ContentHash":"693316270287bacad0a5a6f1502f21f5c3d51a4b8bad6a9840c18873ef8f89bd","Payload":{"description":["Authenticate using an LDAP server. See Section 20.10 for details."],"manual_html":"\u003cdiv class=\"sect1\" id=\"AUTH-LDAP\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.10. LDAP Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method operates similarly to \u003ccode class=\"literal\"\u003epassword\u003c/code\u003e except that it uses LDAP as the password verification method. LDAP is used only to validate the user name/password pairs. Therefore the user must already exist in the database before LDAP can be used for authentication.\u003c/p\u003e\n\u003cp\u003eLDAP authentication can operate in two modes. In the first mode, which we will call the simple bind mode, the server will bind to the distinguished name constructed as \u003cem class=\"replaceable\"\u003e\u003ccode\u003eprefix\u003c/code\u003e\u003c/em\u003e \u003cem class=\"replaceable\"\u003e\u003ccode\u003eusername\u003c/code\u003e\u003c/em\u003e \u003cem class=\"replaceable\"\u003e\u003ccode\u003esuffix\u003c/code\u003e\u003c/em\u003e. Typically, the \u003cem class=\"replaceable\"\u003e\u003ccode\u003eprefix\u003c/code\u003e\u003c/em\u003e parameter is used to specify \u003ccode class=\"literal\"\u003ecn=\u003c/code\u003e, or \u003cem class=\"replaceable\"\u003e\u003ccode\u003eDOMAIN\u003c/code\u003e\u003c/em\u003e\u003ccode class=\"literal\"\u003e\\\u003c/code\u003e in an Active Directory environment. \u003cem class=\"replaceable\"\u003e\u003ccode\u003esuffix\u003c/code\u003e\u003c/em\u003e is used to specify the remaining part of the DN in a non-Active Directory environment.\u003c/p\u003e\n\u003cp\u003eIn the second mode, which we will call the search+bind mode, the server first binds to the LDAP directory with a fixed user name and password, specified with \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapbinddn\u003c/code\u003e\u003c/em\u003e and \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapbindpasswd\u003c/code\u003e\u003c/em\u003e, and performs a search for the user trying to log in to the database. If no user and password is configured, an anonymous bind will be attempted to the directory. The search will be performed over the subtree at \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapbasedn\u003c/code\u003e\u003c/em\u003e, and will try to do an exact match of the attribute specified in \u003cem class=\"replaceable\"\u003e\u003ccode\u003eldapsearchattribute\u003c/code\u003e\u003c/em\u003e. Once the user has been found in this search, the server re-binds to the directory as this user, using the password specified by the client, to verify that the login is correct. This mode is the same as that used by LDAP authentication schemes in other software, such as Apache \u003ccode class=\"literal\"\u003emod_authnz_ldap\u003c/code\u003e and \u003ccode class=\"literal\"\u003epam_ldap\u003c/code\u003e. This method allows for significantly more flexibility in where the user objects are located in the directory, but will cause two additional requests to the LDAP server to be made.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are used in both modes:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapserver\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eNames or IP addresses of LDAP servers to connect to. Multiple servers may be specified, separated by spaces.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapport\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003ePort number on LDAP server to connect to. If no port is specified, the LDAP library's default port setting will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapscheme\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSet to \u003ccode class=\"literal\"\u003eldaps\u003c/code\u003e to use LDAPS. This is a non-standard way of using LDAP over SSL, supported by some LDAP server implementations. See also the \u003ccode class=\"literal\"\u003eldaptls\u003c/code\u003e option for an alternative.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldaptls\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eSet to 1 to make the connection between PostgreSQL and the LDAP server use TLS encryption. This uses the \u003ccode class=\"literal\"\u003eStartTLS\u003c/code\u003e operation per \u003ca class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc4513\"\u003eRFC 4513\u003c/a\u003e. See also the \u003ccode class=\"literal\"\u003eldapscheme\u003c/code\u003e option for an alternative.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eNote that using \u003ccode class=\"literal\"\u003eldapscheme\u003c/code\u003e or \u003ccode class=\"literal\"\u003eldaptls\u003c/code\u003e only encrypts the traffic between the PostgreSQL server and the LDAP server. The connection between the PostgreSQL server and the PostgreSQL client will still be unencrypted unless SSL is used there as well.\u003c/p\u003e\n\u003cp\u003eThe following options are used in simple bind mode only:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapprefix\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eString to prepend to the user name when forming the DN to bind as, when doing simple bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapsuffix\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eString to append to the user name when forming the DN to bind as, when doing simple bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eThe following options are used in search+bind mode only:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapbasedn\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eRoot DN to begin the search for the user in, when doing search+bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapbinddn\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eDN of user to bind to the directory with to perform the search when doing search+bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapbindpasswd\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003ePassword for user to bind to the directory with to perform the search when doing search+bind authentication.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapsearchattribute\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAttribute to match against the user name in the search when doing search+bind authentication. If no attribute is specified, the \u003ccode class=\"literal\"\u003euid\u003c/code\u003e attribute will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapsearchfilter\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe search filter to use when doing search+bind authentication. Occurrences of \u003ccode class=\"literal\"\u003e$username\u003c/code\u003e will be replaced with the user name. This allows for more flexible search filters than \u003ccode class=\"literal\"\u003eldapsearchattribute\u003c/code\u003e.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eThe following option may be used as an alternative way to write some of the above LDAP options in a more compact and standard form:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eldapurl\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAn \u003ca class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc4516\"\u003eRFC 4516\u003c/a\u003e LDAP URL. The format is\u003c/p\u003e\n\u003cpre class=\"synopsis\"\u003eldap[s]://\u003cem class=\"replaceable\"\u003e\u003ccode\u003ehost\u003c/code\u003e\u003c/em\u003e[:\u003cem class=\"replaceable\"\u003e\u003ccode\u003eport\u003c/code\u003e\u003c/em\u003e]/\u003cem class=\"replaceable\"\u003e\u003ccode\u003ebasedn\u003c/code\u003e\u003c/em\u003e[?[\u003cem class=\"replaceable\"\u003e\u003ccode\u003eattribute\u003c/code\u003e\u003c/em\u003e][?[\u003cem class=\"replaceable\"\u003e\u003ccode\u003escope\u003c/code\u003e\u003c/em\u003e][?[\u003cem class=\"replaceable\"\u003e\u003ccode\u003efilter\u003c/code\u003e\u003c/em\u003e]]]]\n\u003c/pre\u003e\n\u003cp\u003e\u003cem class=\"replaceable\"\u003e\u003ccode\u003escope\u003c/code\u003e\u003c/em\u003e must be one of \u003ccode class=\"literal\"\u003ebase\u003c/code\u003e, \u003ccode class=\"literal\"\u003eone\u003c/code\u003e, \u003ccode class=\"literal\"\u003esub\u003c/code\u003e, typically the last. (The default is \u003ccode class=\"literal\"\u003ebase\u003c/code\u003e, which is normally not useful in this application.) \u003cem class=\"replaceable\"\u003e\u003ccode\u003eattribute\u003c/code\u003e\u003c/em\u003e can nominate a single attribute, in which case it is used as a value for \u003ccode class=\"literal\"\u003eldapsearchattribute\u003c/code\u003e. If \u003cem class=\"replaceable\"\u003e\u003ccode\u003eattribute\u003c/code\u003e\u003c/em\u003e is empty then \u003cem class=\"replaceable\"\u003e\u003ccode\u003efilter\u003c/code\u003e\u003c/em\u003e can be used as a value for \u003ccode class=\"literal\"\u003eldapsearchfilter\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe URL scheme \u003ccode class=\"literal\"\u003eldaps\u003c/code\u003e chooses the LDAPS method for making LDAP connections over SSL, equivalent to using \u003ccode class=\"literal\"\u003eldapscheme=ldaps\u003c/code\u003e. To use encrypted LDAP connections using the \u003ccode class=\"literal\"\u003eStartTLS\u003c/code\u003e operation, use the normal URL scheme \u003ccode class=\"literal\"\u003eldap\u003c/code\u003e and specify the \u003ccode class=\"literal\"\u003eldaptls\u003c/code\u003e option in addition to \u003ccode class=\"literal\"\u003eldapurl\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eFor non-anonymous binds, \u003ccode class=\"literal\"\u003eldapbinddn\u003c/code\u003e and \u003ccode class=\"literal\"\u003eldapbindpasswd\u003c/code\u003e must be specified as separate options.\u003c/p\u003e\n\u003cp\u003eLDAP URLs are currently only supported with \u003cspan class=\"productname\"\u003eOpenLDAP\u003c/span\u003e, not on Windows.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eIt is an error to mix configuration options for simple bind with options for search+bind. To use \u003ccode class=\"literal\"\u003eldapurl\u003c/code\u003e in simple bind mode, the URL must not contain a \u003ccode class=\"literal\"\u003ebasedn\u003c/code\u003e or query elements.\u003c/p\u003e\n\u003cp\u003eWhen using search+bind mode, the search can be performed using a single attribute specified with \u003ccode class=\"literal\"\u003eldapsearchattribute\u003c/code\u003e, or using a custom search filter specified with \u003ccode class=\"literal\"\u003eldapsearchfilter\u003c/code\u003e. Specifying \u003ccode class=\"literal\"\u003eldapsearchattribute=foo\u003c/code\u003e is equivalent to specifying \u003ccode class=\"literal\"\u003eldapsearchfilter=\"(foo=$username)\"\u003c/code\u003e. If neither option is specified the default is \u003ccode class=\"literal\"\u003eldapsearchattribute=uid\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eIf \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e was compiled with \u003cspan class=\"productname\"\u003eOpenLDAP\u003c/span\u003e as the LDAP client library, the \u003ccode class=\"literal\"\u003eldapserver\u003c/code\u003e setting may be omitted. In that case, a list of host names and ports is looked up via \u003ca class=\"ulink\" href=\"https://datatracker.ietf.org/doc/html/rfc2782\"\u003eRFC 2782\u003c/a\u003e DNS SRV records. The name \u003ccode class=\"literal\"\u003e_ldap._tcp.DOMAIN\u003c/code\u003e is looked up, where \u003ccode class=\"literal\"\u003eDOMAIN\u003c/code\u003e is extracted from \u003ccode class=\"literal\"\u003eldapbasedn\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eHere is an example for a simple-bind LDAP configuration:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapserver=ldap.example.net ldapprefix=\"cn=\" ldapsuffix=\", dc=example, dc=net\"\n\u003c/pre\u003e\n\u003cp\u003eWhen a connection to the database server as database user \u003ccode class=\"literal\"\u003esomeuser\u003c/code\u003e is requested, PostgreSQL will attempt to bind to the LDAP server using the DN \u003ccode class=\"literal\"\u003ecn=someuser, dc=example, dc=net\u003c/code\u003e and the password provided by the client. If that connection succeeds, the database access is granted.\u003c/p\u003e\n\u003cp\u003eHere is a different simple-bind configuration, which uses the LDAPS scheme and a custom port number, written as a URL:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapurl=\"ldaps://ldap.example.net:49151\" ldapprefix=\"cn=\" ldapsuffix=\", dc=example, dc=net\"\n\u003c/pre\u003e\n\u003cp\u003eThis is slightly more compact than specifying \u003ccode class=\"literal\"\u003eldapserver\u003c/code\u003e, \u003ccode class=\"literal\"\u003eldapscheme\u003c/code\u003e, and \u003ccode class=\"literal\"\u003eldapport\u003c/code\u003e separately.\u003c/p\u003e\n\u003cp\u003eHere is an example for a search+bind configuration:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapserver=ldap.example.net ldapbasedn=\"dc=example, dc=net\" ldapsearchattribute=uid\n\u003c/pre\u003e\n\u003cp\u003eWhen a connection to the database server as database user \u003ccode class=\"literal\"\u003esomeuser\u003c/code\u003e is requested, PostgreSQL will attempt to bind anonymously (since \u003ccode class=\"literal\"\u003eldapbinddn\u003c/code\u003e was not specified) to the LDAP server, perform a search for \u003ccode class=\"literal\"\u003e(uid=someuser)\u003c/code\u003e under the specified base DN. If an entry is found, it will then attempt to bind using that found information and the password supplied by the client. If that second bind succeeds, the database access is granted.\u003c/p\u003e\n\u003cp\u003eHere is the same search+bind configuration written as a URL:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapurl=\"ldap://ldap.example.net/dc=example,dc=net?uid?sub\"\n\u003c/pre\u003e\n\u003cp\u003eSome other software that supports authentication against LDAP uses the same URL format, so it will be easier to share the configuration.\u003c/p\u003e\n\u003cp\u003eHere is an example for a search+bind configuration that uses \u003ccode class=\"literal\"\u003eldapsearchfilter\u003c/code\u003e instead of \u003ccode class=\"literal\"\u003eldapsearchattribute\u003c/code\u003e to allow authentication by user ID or email address:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapserver=ldap.example.net ldapbasedn=\"dc=example, dc=net\" ldapsearchfilter=\"(|(uid=$username)(mail=$username))\"\n\u003c/pre\u003e\n\u003cp\u003eHere is an example for a search+bind configuration that uses DNS SRV discovery to find the host name(s) and port(s) for the LDAP service for the domain name \u003ccode class=\"literal\"\u003eexample.net\u003c/code\u003e:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... ldap ldapbasedn=\"dc=example,dc=net\"\n\u003c/pre\u003e\n\u003cdiv class=\"tip\"\u003e\n\u003ch3 class=\"title\"\u003eTip\u003c/h3\u003e\n\u003cp\u003eSince LDAP often uses commas and spaces to separate the different parts of a DN, it is often necessary to use double-quoted parameter values when configuring LDAP options, as shown in the examples.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/div\u003e","related":[],"sections":[],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"Names or IP addresses of LDAP servers to connect to. Multiple servers may be specified, separated by spaces.","name":"ldapserver"},{"description":"Port number on LDAP server to connect to. If no port is specified, the LDAP library's default port setting will be used.","name":"ldapport"},{"description":"Set to ldaps to use LDAPS. This is a non-standard way of using LDAP over SSL, supported by some LDAP server implementations. See also the ldaptls option for an alternative.","name":"ldapscheme"},{"description":"Set to 1 to make the connection between PostgreSQL and the LDAP server use TLS encryption. This uses the StartTLS operation per RFC 4513 . See also the ldapscheme option for an alternative.","name":"ldaptls"},{"description":"String to prepend to the user name when forming the DN to bind as, when doing simple bind authentication.","name":"ldapprefix"},{"description":"String to append to the user name when forming the DN to bind as, when doing simple bind authentication.","name":"ldapsuffix"},{"description":"Root DN to begin the search for the user in, when doing search+bind authentication.","name":"ldapbasedn"},{"description":"DN of user to bind to the directory with to perform the search when doing search+bind authentication.","name":"ldapbinddn"},{"description":"Password for user to bind to the directory with to perform the search when doing search+bind authentication.","name":"ldapbindpasswd"},{"description":"Attribute to match against the user name in the search when doing search+bind authentication. If no attribute is specified, the uid attribute will be used.","name":"ldapsearchattribute"},{"description":"The search filter to use when doing search+bind authentication. Occurrences of $username will be replaced with the user name. This allows for more flexible search filters than ldapsearchattribute .","name":"ldapsearchfilter"},{"description":"An RFC 4516 LDAP URL. The format is ldap[s]:// host [: port ]/ basedn [?[ attribute ][?[ scope ][?[ filter ]]]] scope must be one of base , one , sub , typically the last. (The default is base , which is normally not useful in this application.) attribute can nominate a single attribute, in which case it is used as a value for ldapsearchattribute . If attribute is empty then filter can be used as a value for ldapsearchfilter . The URL scheme ldaps chooses the LDAPS method for making LDAP connections over SSL, equivalent to using ldapscheme=ldaps . To use encrypted LDAP connections using the StartTLS operation, use the normal URL scheme ldap and specify the ldaptls option in addition to ldapurl . For non-anonymous binds, ldapbinddn and ldapbindpasswd must be specified as separate options. LDAP URLs are currently only supported with OpenLDAP , not on Windows.","name":"ldapurl"}],"title":"Documented method options and alternatives"}]}},"RequestedLocale":"en","Fallback":false,"Versions":["10","11","12","13","14","15","16","17","18","19","20"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}