This is the reference documentation for the Python module package web2ldapcnf. You can set configuration options for various aspects. See also the usability summary on how to customize the user interface the by configuration.

The configuration module is divided into different sub-modules:

__init__.py
  Initialization module for the directory module and global options
hosts.py
  Options specific for certain LDAP hosts

Note:
The configuration itself is a Python module and therefore you have to provide a syntactically correct module and correct configuration parameters.
For doing nifty things please refer to the Python docs on details about the Python syntax itself. Most times this is not necessary since the example configuration is pretty easy to understand.

[access_allowed] [connect_template] [cookie_domain] [cookie_length] [cookie_max_age] [good_redirect_targets] [http_headers] [input_maxattrs] [input_maxfieldlen] [ldap_cache_ttl] [ldap_opt_debug_level] [ldap_trace_level] [ldif_maxbytes] [ldif_url_schemes] [log_error_details] [max_searchparams] [redirect_template] [search_attrs] [session_checkvars] [session_limit] [session_paranoid] [session_per_ip_limit] [session_remove]

# General options

connect_template
  HTML template file for the input fields of a Connect Form based on Python's Format String Syntax to reference the different dynamically generated input fields etc.
cookie_domain
  Sets cookie domain (DNS name) sent in Set-Cookie header. None lets web2ldap send the hostname automatically determined which might not work in tunnel/proxy setups because it has to match the DNS name the browser uses to access web2ldap.
cookie_length
  Integer number of chars to use for cookie 0 or None disables using cookies completely.
cookie_max_age
  Cookie lifetime in seconds. It's probably a good idea to set it to the same value like session_remove.
ldif_maxbytes
  Maximum length (in bytes) of LDIF data in the <textarea> of addform/modifyform.
ldif_url_schemes
  List of strings which specifies the URL schemes to process in LDIF input (marker :< in LDIF notation, see RFC 2849).
  Think twice!!!
  This can be a security nightmare! Every resource addressable by URL which is accessible by the system running web2ldap can be revealed. Usually you MUST not allow file if others can access your web2ldap installation and you MUST not allow any URL retrieval when running at a security border (like somewhere at firewall border).
  If unsure leave as empty list to ignore all URLs in LDIF.
  Once again. This is the safe setting:
  `ldif_url_schemes = []`
input_maxattrs
  Maximum count of input attribute fields in addform/modifyform.
input_maxfieldlen
  Maximum length of attribute data input fields in addform/modifyform.
max_searchparams
  Maximum count of search parameters in advanced search form.

  Example:

  `max_searchparams=9`
ldap_cache_ttl
  Time (seconds) search results retrieved with a synchronous search operation will be kept in a short-time cache used per LDAP connection. E.g. this affects performance of dynamic select lists.
ldap_opt_debug_level
  If non-zero this turns on debug output of the OpenLDAP libs and sets the debug level. Warning! Confidential information might be disclosed to the log! If unsure leave zero! Only set to non-zero if you have protected logs!
ldap_trace_level
  Trace output of the LDAP connection can be written to error output. Set to non-zero if you want debug your LDAP connection. Warning! Passwords (credentials) are written to this trace log! If unsure leave zero! Only set to non-zero for testing purposes and if you have protected logs!
redirect_template
  HTML template file for the redirect page.

# Logging options

log_error_details
  If set to True exceptions are logged with details of LDAP connection and HTTP request. The default is the value of Python variable __debug__.

# HTML and HTTP options

http_headers
  Static dictionary of HTTP headers to be always sent to the browser. You can extend this if new HTTP headers are defined for enabling optional security features in browsers.

# Security options

You should think about these parameters a little bit longer...

access_allowed
  Dictionary which defines for each URL command a list of accepted address/net mask strings of client addresses permitted to access a certain page.

  Example for accepting only clients from loopback network for all commands:

  `access_allowed = {'_': ['127.0.0.1/255.0.0.0', '::1']}`

  Example for allowing access to all clients for all commands:

  `access_allowed = {'_': ['0.0.0.0/0.0.0.0', '::0/0']}`

  Example for allowing access to all clients for all commands except monitor page:

  `access_allowed = {'_': ['0.0.0.0/0.0.0.0', '::0/0'], 'monitor': ['127.0.0.1/255.255.255.255']}`
good_redirect_targets
  Set of unsuspicious target URLs accept by redirector even without a session.
session_limit
  Maximum number of currently persistent web sessions.
session_per_ip_limit
  Maximum number of currently persistent web sessions per remote IP address.
session_paranoid
  If non-zero this is the time-span in seconds after which a new session ID is generated.
  Disadvantage: The browser's back button does not work anymore.
  Default: 0 (disabled)
session_remove
  Amount of time in seconds after which inactive sessions will be expired and the session data is removed silently without the possibility to relogin.
session_checkvars
  List of environment variables assumed to be constant throughout web sessions with the same ID if existent. These env vars are cross-checked for each hit while restoring a web session to reduce the risk of session-hijacking.
  Note: REMOTE_ADDR and REMOTE_HOST might not be constant if the client accesses web2ldap through a network of web proxy siblings.