---
name: "ypldap.conf"
section: "5"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["freebsd", "openbsd"]
url: "https://new.carta.tech/ypldap.conf"
---

# ypldap.conf(5)

LDAP YP map daemon configuration file

## NAME

**ypldap.conf** – LDAP YP map daemon configuration file

## DESCRIPTION

The [ypldap(8)](/ypldap/8.md) daemon provides YP maps using LDAP as a backend.

The **ypldap.conf** config file is divided into the following main sections:

- Macros

  Definitions of variables that can be used later, simplifying the configuration file.

- Global configuration

  Global settings for [ypldap(8)](/ypldap/8.md).

- Directories

  LDAP Directory specific parameters.

### Macros

A macro is defined with a command of the form *name*=*value*. The macro *name* can contain letters, digits, and underscores and cannot be a reserved word (for example, **domain**). Within unquoted arguments, the string $*name* is later expanded to *value*.

For example:

```
fixed_gecos="Pulled from LDAP"
fixed attribute gecos $fixed_gecos
```

### Global configuration

Global settings concern the main behaviour of the daemon.

- **domain** *string*

  Specify the name of the NIS domain [ypldap(8)](/ypldap/8.md) will provide.

- **interval** *seconds*

  Specify the interval in seconds at which the whole directory will be pulled from LDAP.

- **provide** **map** *string*

  Specify a map that should be provided by [ypldap(8)](/ypldap/8.md) The currently implemented maps are: passwd.byname, passwd.byuid, group.byname, group.bygid.

- **cafile** *filename*

  Load CA certificates from the specified file to validate the server certificate. If not specified, CA certificates will be loaded from */etc/ssl/cert.pem*.

- **bind** *mode*

  Specify how the domain is made available for binding. Valid options are:

  - **portmap**

    Register with [portmap(8)](/portmap/8.md) and allow [ypbind(8)](/ypbind/8.md) discovery. This is the default mode.

  - **local**

    Create a YP binding file in */var/yp/binding* to enable YP support in the [passwd(5)](/passwd/5.md) and [group(5)](/group/5.md) databases. In this mode it is not necessary to run [portmap(8)](/portmap/8.md), and [ypbind(8)](/ypbind/8.md) must not be running. YP services are only available to the host running [ypldap(8)](/ypldap/8.md).

### Directories

Directories are used to describe the LDAP schema and help [ypldap(8)](/ypldap/8.md) convert LDAP entries to [passwd(5)](/passwd/5.md), [master.passwd(5)](/master.passwd/5.md), and [group(5)](/group/5.md) lines. Each directory section consists of a declaration of the directory server name and a set of directives describing how entries from the directory are used to construct YP map entries.

- **directory** *hostname* \[**port** *port*\] \[tls\] {...}

  Defines a directory by hostname and optionally port number. If the *tls* argument is not specified, no transport-level security will be used. Valid options are:

  - **tls**

    Use STARTTLS to negotiate TLS, by default on port 389.

  - **ldaps**

    Connect with TLS enabled, by default on port 636.

Valid directives for directories are:

-

  **attribute** *name* **maps** **to** *string* Map the [passwd(5)](/passwd/5.md), [master.passwd(5)](/master.passwd/5.md), or [group(5)](/group/5.md) attribute to the LDAP attribute name supplied.

- **basedn** *string*

  Use the supplied search base as starting point for the directory search.

- **certfile** *string*

  Use the specified client certificate when connecting to the directory. The file must contain a PEM encoded certificate.

- **groupdn** *string*

  Use the supplied search base as starting point for the directory search for groups. If not supplied, the basedn value will be used.

- **bindcred** *string*

  Use the supplied credentials for simple authentication against the directory.

- **binddn** *string*

  Use the supplied Distinguished Name to bind to the directory.

- **bindext** \[*string*\]

  Bind to the directory using SASL EXTERNAL, optionally using a supplied identity string. When using a TLS client certificate, this allows the client to bind as the subject of the certificate. If an identity string is supplied, usually in the form of a distinguished name prefixed with "dn:", the directory will only allow the bind to succeed if it matches the subject of the certificate.

- **fixed** **attribute** *attribute* *string*

  Do not retrieve the specified attribute from LDAP but instead set it unconditionally to the supplied value for every entry.

- **group** **filter** *string*

  Use the supplied LDAP filter to retrieve group entries.

- **keyfile** *string*

  Use the specified private key when connecting to the directory. The file must contain a PEM encoded key.

-

  **list** *name* **maps** **to** *string* Map the [passwd(5)](/passwd/5.md), [master.passwd(5)](/master.passwd/5.md), or [group(5)](/group/5.md) attribute to the LDAP attribute name supplied. A list creates a comma separated list of all the LDAP attributes found.

  Valid attributes are:

  - **name**

    - **passwd**

    - **uid**

    - **gid**

    - **gecos**

    - **home**

    - **shell**

    - **change**

    - **expire**

    - **class**

    - **groupname**

    - **grouppasswd**

    - **groupgid**

    - **groupmembers**

    - **passwd** **filter** *string*

  Use the supplied LDAP filter to retrieve password entries.

## FILES

- */etc/ypldap.conf*

  [ypldap(8)](/ypldap/8.md) configuration file.

- */etc/examples/ypldap.conf*

  Example configuration file.

## SEE ALSO

[ypbind(8)](/ypbind/8.md), [ypldap(8)](/ypldap/8.md), [ypserv(8)](/ypserv/8.md)

## HISTORY

The **ypldap.conf** file format first appeared in OpenBSD 4.4.