# Allow to override current settings with local configuration
if (file_exists (__DIR__ . '/conf/config.inc.local.php')) {
    require_once __DIR__ . '/conf/config.inc.local.php';
}

docker exec self-service-password-182-web php -r 'require "/var/www/conf/config.inc.php"; echo $ldap_url, " | ", $hash, " | ", $mail_smtp_host, ":", $mail_smtp_port, "\n";'

ldap://openldap:389 | SSHA | mailsink:1025

docker compose restart ssp

$ldap_url = "ldap://localhost";          # 目录地址，可写 ldap://host:389 或 ldaps://host:636
$ldap_starttls = false;                  # 连接后是否发起 STARTTLS
$ldap_binddn = "cn=manager,dc=example,dc=com";   # 搜索绑定 DN
$ldap_bindpw = 'secret';                 # 搜索绑定密码
$ldap_base = "dc=example,dc=com";        # 搜索基准
$ldap_login_attribute = "uid";           # 登录名属性
$ldap_fullname_attribute = "cn";         # 显示名属性
$ldap_filter = "(&(objectClass=person)($ldap_login_attribute={login}))";  # 用户过滤
$ldap_scope = "sub";                     # sub / one / base
$ldap_use_exop_passwd = false;           # LDAP EXOP PASSWD 扩展改密（RFC 3062）
$ldap_use_ppolicy_control = false;       # 携带 ppolicy 控制获取服务端策略消息
$ldap_network_timeout = 10;              # 网络超时秒
$ldap_page_size = 0;                     # 分页搜索大小，0=不分页
$ldap_type = "openldap";                 # openldap / activedirectory
$ldap_options['force_unlock'] = false;           # 改密后强制解锁（AD）
$ldap_options['force_pwd_change'] = false;       # 改密后强制下次登录改密（AD）
$ldap_options['change_expired_password'] = false; # 允许过期密码登录改密（AD）

$hash = "clear";        # SSHA/SSHA256/SSHA384/SSHA512/SHA*/SMD5/MD5/CRYPT/ARGON2/clear/auto
$hash_options['crypt_salt_prefix'] = "$6$";   # CRYPT 模式的盐前缀（$6$ 即 SHA-512 crypt）
$hash_options['crypt_salt_length'] = "6";
$who_change_password = "user";   # user=用户自身身份改密；manager=用 $ldap_binddn 身份
$show_extended_error = false;    # 展示目录返回的扩展错误（如密码太短的具体原因）

$pwd_min_length = 0;            # 最小长度
$pwd_max_length = 0;            # 最大长度
$pwd_min_lower = 0;             # 最少小写字母
$pwd_min_upper = 0;             # 最少大写字母
$pwd_min_digit = 0;             # 最少数字
$pwd_min_special = 0;           # 最少特殊字符
$pwd_special_chars = "^a-zA-Z0-9";  # 特殊字符的判定集合（正则字符类，此处=非字母数字）
$pwd_no_reuse = true;           # 禁止与当前密码相同
$pwd_diff_login = true;         # 禁止与登录名相同
$pwd_diff_last_min_chars = 0;   # 新旧密码至少差 N 个字符
$pwd_forbidden_words = array(); # 禁用词表（公司名等）
$pwd_forbidden_ldap_fields = array();  # 用户条目字段值不得出现在密码里（如 cn/sn/mail）
$pwd_complexity = 0;            # 至少命中几类字符（0-4）
$use_pwnedpasswords = false;    # 调 pwnedpasswords API 查泄露库（需出网）
$pwd_display_entropy = false;   # 显示熵进度条（需 php zxcvbn 模块）
$pwd_check_entropy = false;     # 强制熵校验
$pwd_min_entropy = 3;           # 最低熵值
$pwd_show_policy = "never";     # 策略提示展示：always/never/onerror
$pwd_show_policy_pos = "above"; # 提示位置：above/below 表单
$pwd_no_special_at_ends = false; # 首尾不得用特殊字符

$use_questions = true;                     # 功能开关
$multiple_answers = false;                 # 允许多个答案
$multiple_answers_one_str = false;         # 多答案合并存一个字符串属性
$answer_objectClass = "extensibleObject";  # 保存答案时追加的辅助类
$answer_attribute = "info";                # 答案存储属性
$crypt_answers = true;                     # 答案加密存储（用 $keyphrase）
$questions_use_default = true;             # 是否包含内置问题（lang/$lang.inc.php 中 2 个）
$questions_count = 1;                      # 需回答的问题数（>1 必须配合 multiple_answers）
$question_populate_enable = false;         # 仅凭登录名即可回显注册问题（用户体验/枚举风险权衡）

objectClass: inetOrgPerson
objectClass: extensibleObject
info: 3vUCACQAzkDYd9EtvhkWagaFWLMkQ/mpTC2xpJuQ3J6zBve+L2siiUWGfnyPxDYob7EoDUgP

$use_tokens = true;            # 邮件重置功能开关
$crypt_tokens = true;          # token 加密（URL 里的 token 为加密串）
$token_lifetime = "3600";      # token 有效期（秒）
$cache_type = "File";          # File / Redis
$cache_namespace = "sspCache";
$cache_directory = null;       # null=系统临时目录
$cache_token_expiration = 3600;   # token 相关缓存对象寿命（建议 ≥ $token_lifetime）
$cache_form_expiration = 120;     # 表单校验步骤缓存寿命（如邮箱确认表单）
$reset_url = "http://ssp.example.com/";   # 重置链接的对外地址（必配）

$mail_attributes = array( "mail", "gosaMailAlternateAddress", "proxyAddresses" );  # 依次尝试的邮箱属性
$mail_address_use_ldap = false;   # 直接从目录取邮箱并隐藏输入框
$mail_from = "admin@example.com"; # 发件人
$mail_from_name = "Self Service Password";
$mail_signature = "";
$notify_on_change = false;        # 改密成功后发通知
$mail_protocol = 'smtp';          # smtp / mail（PHP mail()）
$mail_smtp_debug = 0;
$mail_debug_format = 'error_log';
$mail_smtp_host = 'localhost';
$mail_smtp_auth = false;
$mail_smtp_user = '';
$mail_smtp_pass = '';
$mail_smtp_port = 25;
$mail_smtp_timeout = 30;
$mail_smtp_keepalive = false;
$mail_smtp_secure = 'tls';        # tls / ssl / ''（空=明文）
$mail_smtp_autotls = true;        # 服务端宣告 STARTTLS 时自动升级
$mail_smtp_options = array();
$mail_contenttype = 'text/plain';
$mail_wordwrap = 0;
$mail_charset = 'utf-8';
$mail_priority = 3;

$use_sms = true;             # 默认开启！
$sms_use_ldap = false;       # 直接从目录取手机号
$sms_method = "mail";        # mail（邮件转短信网关）/ api（库调用）
$sms_api_lib = "";           # 内置 signal-cli / twilio / ovh 三个库，也可自写
$sms_attributes = array( "mobile", "pager", "ipPhone", "homephone" );
$sms_partially_hide_number = true;
$smsmailto = "{sms_attribute}@service.provider.com";   # 邮件网关地址模板
$smsmail_subject = "Provider code";
$sms_message = "{smsresetmessage} {smstoken}";
$sms_sanitize_number = false;    # 去除非数字字符
$sms_truncate_number = false;    # 截断号码
$sms_truncate_number_length = 10;
$sms_token_length = 6;
$sms_max_attempts_token = 3;

$show_help = true;
$lang = "en";                    # 默认语言
$date_timezone = "UTC";
$allowed_lang = array();         # 空=全部放行；非空=白名单外回落 $lang
$show_menu = true;               # 顶部导航
$show_pwd = false;               # 密码输入框的眼睛按钮
$logo = "images/ltb-logo.png";
$background_image = "images/unsplash-space.jpeg";
$favicon = "images/favicon.ico";
$custom_css = "";                # 例 "css/sample.css"（相对 htdocs/html）
$display_footer = true;
$custom_tpl_dir = "";            # 模板覆盖目录
$default_action = "change";      # change / sendtoken / sendsms / changecustompwdfield

$keyphrase = "secret";           # token/答案加密密钥——1.8.2 强制修改
$login_forbidden_chars = "*()&|";   # 登录名禁用字符（防 LDAP 注入；空=只允许字母数字）
$obscure_usernotfound_sendtoken = true;   # sendtoken 不泄露「用户不存在」
$obscure_notfound_sendsms = true;
$use_captcha = false;            # 验证码开关
$captcha_class = "InternalCaptcha";   # 内置图形验证码；另支持 FriendlyCaptcha / ReCaptcha
$use_ratelimit = false;          # 限流开关
$max_attempts_per_user = 2;      # 同一登录名的尝试阈值
$max_attempts_per_ip = 2;        # 同一 IP 的尝试阈值
$max_attempts_block_seconds = "60";   # 触发后封锁秒数
$client_ip_header = 'REMOTE_ADDR';    # 反代场景改 HTTP_X_FORWARDED_FOR

$prehook = "/usr/share/self-service-password/prehook.sh";    # 改密前钩子，退出码 0 才放行
$display_prehook_error = true;
$prehook_password_encodebase64 = false;   # 传给钩子的密码 base64 编码
$ignore_prehook_error = true;             # 钩子失败是否放行
$posthook = "/usr/share/self-service-password/posthook.sh";  # 改密后钩子
$display_posthook_error = true;
$posthook_password_encodebase64 = false;
$audit_log_file = "/var/log/self-service-password/audit.log";  # 审计日志（注释状态=未启用）
$reset_request_log = "/var/log/self-service-password";          # 重置请求日志（默认进 Apache 日志）
$debug = false;
$smarty_debug = false;

<?php
# ---- LDAP ----
$ldap_url = "ldap://${LDAP_HOST}:389";
$ldap_starttls = true;                       # 内网目录也开 STARTTLS
$ldap_binddn = "cn=ssp-search,ou=services,dc=example,dc=org";   # 专用只读绑定账号（见安全加固指南）
$ldap_bindpw = '${LDAP_BINDPW}';
$ldap_base = "dc=example,dc=org";
$ldap_login_attribute = "uid";
$ldap_fullname_attribute = "cn";
$ldap_filter = "(&(objectClass=inetOrgPerson)(uid={login}))";
$ldap_use_exop_passwd = true;
$ldap_use_ppolicy_control = true;

# ---- 密码存储与策略 ----
$hash = "SSHA";
$who_change_password = "user";
$pwd_min_length = 12;
$pwd_max_length = 128;
$pwd_min_lower = 1;
$pwd_min_upper = 1;
$pwd_min_digit = 1;
$pwd_min_special = 1;
$pwd_no_reuse = true;
$pwd_diff_login = true;
$pwd_diff_last_min_chars = 3;
$pwd_forbidden_words = array("example", "password", "qwer");
$pwd_forbidden_ldap_fields = array('cn', 'sn', 'mail');
$pwd_show_policy = "always";
$pwd_show_policy_pos = "above";

# ---- 重置通道 ----
$use_questions = true;
$use_tokens = true;
$use_sms = false;                            # 无短信网关即关
$use_ratelimit = true;
$max_attempts_per_user = 5;
$max_attempts_per_ip = 10;
$max_attempts_block_seconds = "300";
$use_captcha = true;

# ---- Token / 缓存 ----
$reset_url = "https://ssp.example.org/";
$token_lifetime = "1800";                    # 30 分钟
$cache_type = "File";                        # 多实例改 Redis
$cache_token_expiration = 3600;

# ---- 邮件 ----
$mail_from = "ssp@example.org";
$mail_from_name = "企业自助密码服务";
$mail_address_use_ldap = true;
$notify_on_change = true;
$mail_smtp_host = 'smtp.example.org';
$mail_smtp_port = 587;
$mail_smtp_auth = true;
$mail_smtp_user = 'ssp@example.org';
$mail_smtp_pass = '${SMTP_PASS}';
$mail_smtp_secure = 'tls';

# ---- 加密密钥 ----
$keyphrase = '${KEYPHRASE}';                 # openssl rand -hex 16 生成

# ---- 界面 ----
$lang = "zh-CN";
$allowed_lang = array("zh-CN");
$default_action = "change";

# ---- 审计 ----
$audit_log_file = "/var/log/self-service-password/audit.log";
$debug = false;