# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

#####################################################################
## To see all LDAP configurations,
## see fe/src/org/apache/doris/common/LdapConfig.java
#####################################################################

# LDAP server configuration
# If you want to enable LDAP authentication, you should:
## step1: Configure the following parameters:
# ldap_authentication_enabled - Flag to enable LDAP authentication. Specify 'true' to enable ldap authentication.
# ldap_host - LDAP server ip.
# ldap_port - LDAP server port.
# ldap_admin_name - The DN to bind as connection, this admin DN will be used to lookup information about other users.
# ldap_user_basedn - Search base for users.
# ldap_user_filter - User lookup filter, the placeholder {login} will be replaced by the user supplied login.
# ldap_group_basedn - Search base for groups.
# ldap_group_filter - Group lookup filter, the placeholder {login} will be replaced by the user supplied login. example : "(&(memberUid={login}))"
# ldap_default_roles - Comma-separated Doris roles granted to every LDAP-authenticated user.
# Online updates of ldap_default_roles refresh the LDAP user cache automatically.
## step2: Restart fe, and use root or admin account to log in to doris.
## step3: Execute sql statement to set ldap admin password:
# set ldap_admin_password = 'password';
ldap_authentication_enabled = false
ldap_host = 127.0.0.1
ldap_port = 389
ldap_admin_name = cn=admin,dc=domain,dc=com
ldap_user_basedn = ou=people,dc=domain,dc=com
ldap_user_filter = (&(uid={login}))
ldap_group_basedn = ou=group,dc=domain,dc=com
# ldap_default_roles = ldap_default_role

# ldap_user_cache_timeout_s = 5 * 60;

## ldap_use_ssl - use secured connection to LDAP server if required (disabled by default). Note: When enabling SSL, ensure ldap_port is set appropriately (typically 636 for LDAPS instead of 389 for LDAP).
# ldap_use_ssl = false

## ldap_allow_empty_pass - allow LDAP users to log in with an empty password. Disabled by default.
##
## LDAP treats a bind with a non-empty DN and an empty password as an unauthenticated bind and
## normally reports it as successful, so with this enabled anyone who knows a valid LDAP user
## name can log in to Doris without a password. Keep it false unless you must restore the
## legacy behaviour; setting it to true reopens that hole.
##
## Changing this requires an FE restart (the config is not runtime-mutable).
##
## This setting applies to the legacy LDAP authentication path only. The plugin-based LDAP
## authentication (the fe-authentication LDAP plugin) always rejects empty passwords.
# ldap_allow_empty_pass = false

# LDAP pool configuration
# https://docs.spring.io/spring-ldap/docs/2.3.3.RELEASE/reference/#pool-configuration
# ldap_pool_max_active = 8
# ldap_pool_max_total = -1
# ldap_pool_max_idle = 8
# ldap_pool_min_idle = 0
# ldap_pool_max_wait = -1
# ldap_pool_when_exhausted = 1
# ldap_pool_test_on_borrow = true
# ldap_pool_test_on_return = true
# ldap_pool_test_while_idle = true