# LDAP authentication configuration, see authn/ldap-authn-config.xml
# Note, this doesn't apply to the use of JAAS

## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator
idp.authn.LDAP.authenticator= adAuthenticator

## Connection properties ##
idp.authn.LDAP.ldapURL= ldap://127.0.0.1:10389/
#idp.authn.LDAP.useStartTLS                     = true
idp.authn.LDAP.useStartTLS                     = false
#idp.authn.LDAP.useSSL                          = false
#idp.authn.LDAP.connectTimeout                  = 3000

## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust
#idp.authn.LDAP.sslConfig                       = certificateTrust
## If using certificateTrust above, set to the trusted certificate's path
idp.authn.LDAP.trustCertificates= %{idp.home}/credentials/ldap-server.crt
## If using keyStoreTrust above, set to the truststore path
idp.authn.LDAP.trustStore= %{idp.home}/credentials/ldap-server.truststore

## Return attributes during authentication
## NOTE: there is a separate property used for attribute resolution
idp.authn.LDAP.returnAttributes= cn,passwordExpirationTime,loginGraceRemaining

## DN resolution properties ##

# Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator
# for AD: CN=Users,DC=example,DC=org
idp.authn.LDAP.baseDN= OU=MSKCC_Users, DC=mskcc, DC=dom
#idp.authn.LDAP.subtreeSearch                   = false
idp.authn.LDAP.userFilter= (sAMAccountName={user})
# bind search configuration
# for AD: idp.authn.LDAP.bindDN=adminuser@domain.com
idp.authn.LDAP.bindDN= OU=MSKCC_Users, DC=mskcc, DC=dom
idp.authn.LDAP.bindDNCredential= 

# Format DN resolution, used by directAuthenticator, adAuthenticator
# for AD use idp.authn.LDAP.dnFormat=%s@domain.com
idp.authn.LDAP.dnFormat= uid=%s, OU=MSKCC_Users, DC=mskcc, DC=dom

# LDAP attribute configuration, see attribute-resolver.xml
# Note, this likely won't apply to the use of legacy V2 resolver configurations
idp.attribute.resolver.LDAP.ldapURL= %{idp.authn.LDAP.ldapURL}
idp.attribute.resolver.LDAP.baseDN= %{idp.authn.LDAP.baseDN:undefined}
idp.attribute.resolver.LDAP.bindDN= %{idp.authn.LDAP.bindDN:undefined}
idp.attribute.resolver.LDAP.bindDNCredential= %{idp.authn.LDAP.bindDNCredential:undefined}
idp.attribute.resolver.LDAP.useStartTLS= %{idp.authn.LDAP.useStartTLS:true}
idp.attribute.resolver.LDAP.trustCertificates= %{idp.authn.LDAP.trustCertificates:undefined}
idp.attribute.resolver.LDAP.searchFilter= (uid=$(resolutionContext.principal))
idp.attribute.resolver.LDAP.returnAttributes= cn,homephone,mail

# LDAP pool configuration, used for both authn and DN resolution
idp.pool.LDAP.minSize                          = 3
idp.pool.LDAP.maxSize                          = 10
idp.pool.LDAP.validateOnCheckout               = false
idp.pool.LDAP.validatePeriodically             = true
idp.pool.LDAP.validatePeriod                   = 300
idp.pool.LDAP.prunePeriod                      = 300
idp.pool.LDAP.idleTime                         = 600
idp.pool.LDAP.blockWaitTime                    = 300
idp.pool.LDAP.failFastInitialize               = false
idp.pool.LDAP.expirationTime                   = 600
idp.pool.LDAP.validateDN                       = false
idp.pool.LDAP.validateFilter                   = false
idp.pool.LDAP.failFastInitialize               = false