<Directory /usr/share/self-service-password>

    Options Indexes FollowSymLinks

    AllowOverride None

    Require all granted

</Directory>

<IfModule mod_ssl.c>

    <VirtualHost *:>

        DocumentRoot /usr/share/self-service-password

        SSLEngine on

        SSLCertificateFile /home/chen/ssp.crt

        SSLCertificateKeyFile /home/chen/ssp.key

        SSLCACertificateFile /home/chen/ca.crt

    </VirtualHost>

</IfModule>

RewriteEngine On

RewriteCond %{HTTPS} !on

RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

# LDAP

$ldap_url = "ldaps://dc1.abc.local";

$ldap_binddn = "cn=administrator,cn=users,dc=abc,dc=local";

$ldap_bindpw = 'XXXXXX';

$ldap_base = "ou=vb-user,dc=abc,dc=local";

$ldap_login_attribute = "uid";

$ldap_fullname_attribute = "cn";

$ldap_filter = "(&(objectClass=user)(sAMAccountName={login})(!(userAccountControl:1.2.840.113556.1.4.:=)))";

# Active Directory mode

# true: use unicodePwd as password field

# false: LDAPv3 standard behavior

$ad_mode = true;

# Force account unlock when password is changed

$ad_options['force_unlock'] = true;

# Force user change password at next login

$ad_options['force_pwd_change'] = false;

....略...

# Who changes the password?

# Also applicable for question/answer save

# user: the user itself

# manager: the above binddn

$who_change_password = "manager";

TLS_CACERT /home/chen/ca.crt    ##指定CA证书的路径

## Mail

# LDAP mail attribute

$mail_attribute = "mail";

# Who the email should come from

$mail_from = "VBPR@abc.cn";

# Notify users anytime their password is changed

$notify_on_change = false;