[%# The contents of this file are subject to the Mozilla Public
  # License Version 1.1 (the "License"); you may not use this file
  # except in compliance with the License. You may obtain a copy of
  # the License at http://www.mozilla.org/MPL/
  #
  # Software distributed under the License is distributed on an "AS
  # IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
  # implied. See the License for the specific language governing
  # rights and limitations under the License.
  #
  # The Original Code is the Bugzilla Bug Tracking System.
  #
  # The Initial Developer of the Original Code is Netscape Communications
  # Corporation. Portions created by Netscape are
  # Copyright (C) 1998 Netscape Communications Corporation. All
  # Rights Reserved.
  #
  # Contributor(s): Dave Miller <justdave@bugzilla.org>
  #                 Frédéric Buclin <LpSolit@gmail.com>
  #%]
[%
  title = "LDAP"
  desc = "Configure this first before choosing LDAP as an authentication method"
  info = "<p>LDAP authentication is a module for Bugzilla's plugin"
    _ " authentication architecture. This page contains the parameters required"
    _ " to use it. After setting them up, also set 'LDAP' value for the 'user_verify_class'"
    _ " parameter.</p>"
    _ "<p>NOTE: If you end up with no working authentication methods listed"
    _ " as 'user_verify_class', you may not be able to log back in to Bugzilla once"
    _ " you log out. If this happens to you, you will need to manually edit"
    _ " <tt>data/params</tt> and set 'user_verify_class' to 'DB'.</p>"
    _ "<p>The existing authentication"
    _ " scheme for Bugzilla uses email addresses as the primary user ID, and a"
    _ " password to authenticate that user. All places within Bugzilla that"
    _ " require a user ID (e.g assigning a bug) use the email"
    _ " address. The LDAP authentication builds on top of this scheme, rather"
    _ " than replacing it. The initial log-in is done with a username and"
    _ " password for the LDAP directory. Bugzilla tries to bind to LDAP using"
    _ " those credentials and, if successful, tries to map this account to a"
    _ " Bugzilla account. If an LDAP mail attribute is defined, the value of this"
    _ " attribute is used, otherwise the 'emailsuffix' parameter is appended to LDAP"
    _ " username to form a full email address. If an account for this address"
    _ " already exists in the Bugzilla installation, it will log in to that account."
    _ " If no account for that email address exists, one is created at the time"
    _ " of login. (In this case, Bugzilla will attempt to use the 'displayName'"
    _ " or 'cn' attribute to determine the user's full name.) After"
    _ " authentication, all other user-related tasks are still handled by email"
    _ " address, not LDAP username. For example, bugs are still assigned by"
    _ " email address and users are still queried by email address.</p>"
    _ "<p>CAUTION: Because the Bugzilla account is not created until the first time"
    _ " a user logs in, a user who has not yet logged is unknown to Bugzilla."
    _ " This means they cannot be used as an assignee or QA contact (default or"
    _ " otherwise), added to any CC list, or any other such operation. One"
    _ " possible workaround is the <i><tt>bugzilla_ldapsync.rb</tt></i>"
    _ " script in the _contrib_ directory. Another possible solution is fixing"
    _ " <a href='https://bugzilla.mozilla.org/show_bug.cgi?id=201069'>bug 201069</a>.</p>"
%]

[% param_descs = {
  LDAPserver => "The name (and optionally port) of your LDAP server " _
                "(e.g. ldap.company.com, or ldap.company.com:portnum). " _
                "URI syntax can also be used, such as "_
                "ldaps://ldap.company.com (for a secure connection) or " _
                "ldapi://%2fvar%2flib%2fldap_sock (for a socket-based " _
                "local connection. Multiple hostnames or URIs can be comma " _
                "separated; each will be tried in turn until a connection is " _
                "established.",

  LDAPstarttls => "Whether to require encrypted communication once a normal " _
                  "LDAP connection is achieved with the server.",

  LDAPbinddn => "If your LDAP server requires that you use a binddn and password " _
                "instead of binding anonymously, enter it here " _
                "(e.g. cn=default,cn=user:password). " _
                "Leave this empty for the normal case of an anonymous bind.",

  LDAPBaseDN => "The BaseDN for authenticating users against " _
                "(e.g. ou=People,o=Company).",

  LDAPuidattribute => "The name of the attribute containing the user's login name.",

  LDAPmailattribute => "The name of the attribute of a user in your " _
                       "directory that contains the email address, to be " _
                       "used as $terms.Bugzilla username. If this parameter " _
                       "is empty, $terms.Bugzilla will use the LDAP username"_
                       " as the $terms.Bugzilla username. You may also want" _
                       " to set the \"emailsuffix\" parameter, in this case.",

  LDAPfilter => "LDAP filter to AND with the <tt>LDAPuidattribute</tt> for " _
                "filtering the list of valid users." }
%]
