1999-10-01 00:57:45 +08:00
|
|
|
# $OpenLDAP$
|
2000-07-23 02:59:40 +08:00
|
|
|
# Copyright 1999-2000, The OpenLDAP Foundation, All Rights Reserved.
|
1999-04-24 07:41:45 +08:00
|
|
|
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
|
2000-07-23 02:59:40 +08:00
|
|
|
|
2000-07-23 15:35:40 +08:00
|
|
|
H1: The slapd Configuration File
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-11 06:31:41 +08:00
|
|
|
Once the software has been built and installed, you are ready
|
2000-08-12 14:35:08 +08:00
|
|
|
to configure {{slapd}}(8) for use at your site. The slapd
|
|
|
|
runtime configuration is primarily accomplished through the
|
2000-08-24 07:23:16 +08:00
|
|
|
{{slapd.conf}}(5) file, normally installed in the
|
2000-08-12 14:35:08 +08:00
|
|
|
{{EX:/usr/local/etc/openldap}} directory.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
An alternate configuration file can be specified via a
|
2000-08-11 06:31:41 +08:00
|
|
|
command-line option to {{slapd}}(8) or {{slurpd}}(8). This chapter
|
|
|
|
describes the general format of the config file, followed by a
|
|
|
|
detailed description of commonly used config file directives.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
|
|
|
H2: Configuration File Format
|
|
|
|
|
2000-08-30 13:05:26 +08:00
|
|
|
The {{slapd.conf}}(5) file consists of three types of configuration
|
|
|
|
information: global, backend specific, and database specific. Global
|
2000-08-10 09:38:36 +08:00
|
|
|
information is specified first, followed by information associated
|
|
|
|
with a particular backend type, which is then followed by information
|
|
|
|
associated with a particular database instance. Global directives can
|
2002-06-15 09:00:50 +08:00
|
|
|
be overridden in backend and/or database directives, and backend directives
|
2000-08-10 09:38:36 +08:00
|
|
|
can be overridden by database directives.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
Blank lines and comment lines beginning with a '{{EX:#}}' character
|
|
|
|
are ignored. If a line begins with white space, it is considered a
|
1999-04-24 07:00:44 +08:00
|
|
|
continuation of the previous line. The general format of slapd.conf is
|
|
|
|
as follows:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> # global configuration directives
|
|
|
|
> <global config directives>
|
|
|
|
>
|
|
|
|
> # backend definition
|
|
|
|
> backend <typeA>
|
|
|
|
> <backend-specific directives>
|
|
|
|
>
|
|
|
|
> # first database definition & config directives
|
|
|
|
> database <typeA>
|
|
|
|
> <database-specific directives>
|
|
|
|
>
|
|
|
|
> # second database definition & config directives
|
|
|
|
> database <typeB>
|
|
|
|
> <database-specific directives>
|
|
|
|
>
|
|
|
|
> # second database definition & config directives
|
|
|
|
> database <typeA>
|
|
|
|
> <database-specific directives>
|
|
|
|
>
|
|
|
|
> # subsequent backend & database definitions & config directives
|
|
|
|
> ...
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
A configuration directive may take arguments. If so, they are
|
|
|
|
separated by white space. If an argument contains white space,
|
2000-08-10 13:23:38 +08:00
|
|
|
the argument should be enclosed in double quotes {{EX:"like this"}}. If
|
|
|
|
an argument contains a double quote or a backslash character `{{EX:\}}',
|
|
|
|
the character should be preceded by a backslash character `{{EX:\}}'.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
The distribution contains an example configuration file that will
|
2000-08-10 09:38:36 +08:00
|
|
|
be installed in the {{F: /usr/local/etc/openldap}} directory.
|
2000-08-30 13:05:26 +08:00
|
|
|
A number of files containing schema definitions (attribute types
|
2000-08-10 09:38:36 +08:00
|
|
|
and object classes) are also provided in the
|
|
|
|
{{F: /usr/local/etc/openldap/schema}} directory.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
H2: Configuration File Directives
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This section details commonly used configuration directives. For
|
2002-06-15 09:00:50 +08:00
|
|
|
a complete list, see the {{slapd.conf}}(5) manual page. This section
|
2000-08-10 09:38:36 +08:00
|
|
|
separates the configuration file directives into global,
|
|
|
|
backend-specific and data-specific categories, describing each
|
|
|
|
directive and its default value (if any), and giving an example of
|
1999-04-24 07:00:44 +08:00
|
|
|
its use.
|
|
|
|
|
|
|
|
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
H3: Global Directives
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-11 08:23:10 +08:00
|
|
|
Directives described in this section apply to all backends
|
2000-08-30 13:05:26 +08:00
|
|
|
and databases unless specifically overridden in a backend or
|
2000-09-01 02:36:01 +08:00
|
|
|
database definition. Arguments that should be replaced
|
2000-08-11 08:23:10 +08:00
|
|
|
by actual text are shown in brackets {{EX:<>}}.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
2000-07-18 18:30:54 +08:00
|
|
|
H4: access to <what> [ by <who> <accesslevel> <control> ]+
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive grants access (specified by <accesslevel>) to a
|
1999-04-24 07:00:44 +08:00
|
|
|
set of entries and/or attributes (specified by <what>) by one or
|
2000-08-11 06:31:41 +08:00
|
|
|
more requesters (specified by <who>).
|
2000-08-11 08:23:10 +08:00
|
|
|
See the {{SECT:Access Control}} section of this chapter for a
|
|
|
|
summary of basic usage.
|
|
|
|
!if 0
|
|
|
|
More details discussion of this directive can be found in the
|
|
|
|
{{SECT:Advanced Access Control}} chapter.
|
|
|
|
!endif
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
2000-08-11 08:23:10 +08:00
|
|
|
H4: attributetype <{{REF:RFC2252}} Attribute Type Description>
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive defines an attribute type.
|
2000-08-11 10:52:27 +08:00
|
|
|
Please see the {{SECT:Schema Specification}} chapter
|
|
|
|
for information regarding how to use this directive.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
H4: defaultaccess { none | compare | search | read | write }
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies the default access to grant requesters
|
2000-08-30 13:05:26 +08:00
|
|
|
when no {{EX:access}} directives have been specified. Any given
|
|
|
|
access level implies all lesser access levels (e.g., read access
|
|
|
|
implies search and compare but not write).
|
2000-08-11 06:31:41 +08:00
|
|
|
|
|
|
|
Note: It is recommend that the {{EX:access}} directive be used
|
|
|
|
to specify access control. See the {{SECT:Access Control}}
|
|
|
|
section of this chapter for information regarding the {{EX:access}}
|
|
|
|
directive.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
\Default:
|
|
|
|
|
|
|
|
E: defaultaccess read
|
|
|
|
|
2000-08-11 06:31:41 +08:00
|
|
|
|
2000-08-12 14:35:08 +08:00
|
|
|
H4: idletimeout <integer>
|
|
|
|
|
|
|
|
Specify the number of seconds to wait before forcibly closing
|
2000-08-30 13:05:26 +08:00
|
|
|
an idle client connection. An idletimeout of 0, the default,
|
2000-08-12 14:35:08 +08:00
|
|
|
disables this feature.
|
|
|
|
|
|
|
|
|
1999-04-24 07:00:44 +08:00
|
|
|
H4: include <filename>
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies that slapd should read additional
|
1999-04-24 07:00:44 +08:00
|
|
|
configuration information from the given file before continuing
|
|
|
|
with the next line of the current file. The included file should
|
2000-08-11 06:31:41 +08:00
|
|
|
follow the normal slapd config file format. The file is commonly
|
|
|
|
used to include files containing schema specifications.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
Note: You should be careful when using this directive - there is
|
|
|
|
no small limit on the number of nested include directives, and no
|
1999-04-24 07:00:44 +08:00
|
|
|
loop detection is done.
|
|
|
|
|
|
|
|
H4: loglevel <integer>
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies the level at which debugging statements
|
2000-08-24 07:23:16 +08:00
|
|
|
and operation statistics should be syslogged (currently logged to
|
2002-06-14 21:01:48 +08:00
|
|
|
the {{syslogd}}(8) {{EX:LOG_LOCAL4}} facility). You must have
|
2000-08-24 07:23:16 +08:00
|
|
|
configured OpenLDAP {{EX:--enable-debug}} (the default) for this
|
|
|
|
to work (except for the two statistics levels, which are always
|
|
|
|
enabled). Log levels are additive. To display what numbers
|
|
|
|
correspond to what kind of debugging, invoke slapd with {{EX:-?}}
|
|
|
|
or consult the table below. The possible values for <integer> are:
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 15:17:54 +08:00
|
|
|
!block table; colaligns="RL"; align=Center; \
|
|
|
|
title="Table 5.1: Debugging Levels"
|
|
|
|
Level Description
|
|
|
|
-1 enable all debugging
|
|
|
|
0 no debugging
|
|
|
|
1 trace function calls
|
|
|
|
2 debug packet handling
|
|
|
|
4 heavy trace debugging
|
|
|
|
8 connection management
|
|
|
|
16 print out packets sent and received
|
|
|
|
32 search filter processing
|
|
|
|
64 configuration file processing
|
|
|
|
128 access control list processing
|
|
|
|
256 stats log connections/operations/results
|
|
|
|
512 stats log entries sent
|
|
|
|
1024 print communication with shell backends
|
|
|
|
2048 print entry parsing debugging
|
|
|
|
!endblock
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
\Example:
|
|
|
|
|
2000-08-10 15:17:54 +08:00
|
|
|
E: loglevel -1
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
This will cause lots and lots of debugging information to be
|
2000-08-10 15:17:54 +08:00
|
|
|
logged.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
\Default:
|
|
|
|
|
|
|
|
E: loglevel 256
|
|
|
|
|
2000-08-11 08:23:10 +08:00
|
|
|
|
|
|
|
H4: objectclass <{{REF:RFC2252}} Object Class Description>
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive defines an object class.
|
2000-08-11 10:52:27 +08:00
|
|
|
Please see the {{SECT:Schema Specification}} chapter for
|
|
|
|
information regarding how to use this directive.
|
2000-08-11 08:23:10 +08:00
|
|
|
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-11 01:49:29 +08:00
|
|
|
H4: referral <URI>
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies the referral to pass back when slapd
|
1999-04-24 07:00:44 +08:00
|
|
|
cannot find a local database to handle a request.
|
|
|
|
|
|
|
|
\Example:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> referral ldap://root.openldap.org
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This will refer non-local queries to the global root LDAP server
|
|
|
|
at the OpenLDAP Project. Smart LDAP clients can re-ask their
|
1999-04-24 07:00:44 +08:00
|
|
|
query at that server, but note that most of these clients are
|
|
|
|
only going to know how to handle simple LDAP URLs that
|
|
|
|
contain a host part and optionally a distinguished name part.
|
|
|
|
|
|
|
|
|
|
|
|
H4: sizelimit <integer>
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies the maximum number of entries to return
|
1999-04-24 07:00:44 +08:00
|
|
|
from a search operation.
|
|
|
|
|
|
|
|
\Default:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> sizelimit 500
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
|
|
|
H4: timelimit <integer>
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies the maximum number of seconds (in real
|
1999-04-24 07:00:44 +08:00
|
|
|
time) slapd will spend answering a search request. If a
|
|
|
|
request is not finished in this time, a result indicating an
|
|
|
|
exceeded timelimit will be returned.
|
|
|
|
|
|
|
|
\Default:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> timelimit 3600
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
H3: General Backend Directives
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-09-01 02:36:01 +08:00
|
|
|
Directives in this section apply only to the backend in which
|
|
|
|
they are defined. They are supported by every type of backend.
|
|
|
|
Backend directives apply to all databases instances of the
|
|
|
|
same type and, depending on the directive, may be overridden
|
|
|
|
by database directives.
|
|
|
|
|
|
|
|
H4: backend <type>
|
|
|
|
|
2002-06-15 05:19:42 +08:00
|
|
|
This directive marks the beginning of a backend declaration.
|
2002-06-15 09:00:50 +08:00
|
|
|
{{EX:<type>}} should be one of the
|
2002-06-15 05:19:42 +08:00
|
|
|
supported backend types listed in Table 5.2.
|
|
|
|
|
|
|
|
!block table; align=Center; coltags="EX,N"; \
|
|
|
|
title="Table 5.2: Database Backends"
|
|
|
|
Types Description
|
|
|
|
bdb Berkeley DB transactional backend
|
|
|
|
dnssrv DNS SRV backend
|
|
|
|
ldbm Lightweight DBM backend
|
|
|
|
ldap Lightweight Directory Access Protocol (Proxy) backend
|
|
|
|
meta Meta Directory backend
|
|
|
|
monitor Monitor backend
|
|
|
|
passwd Provides read-only access to {{passwd}}(5)
|
|
|
|
perl Perl Programmable backend
|
|
|
|
shell Shell (extern program) backend
|
|
|
|
sql SQL Programmable backend
|
2002-06-15 05:59:23 +08:00
|
|
|
tcl TCL Programmable backend
|
2002-06-15 05:19:42 +08:00
|
|
|
!endblock
|
|
|
|
|
|
|
|
\Example:
|
|
|
|
|
2002-06-15 09:00:50 +08:00
|
|
|
> backend bdb
|
2002-06-15 05:19:42 +08:00
|
|
|
|
|
|
|
This marks the beginning of a new {{TERM:BDB}} backend
|
|
|
|
definition.
|
2000-09-01 02:36:01 +08:00
|
|
|
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
H3: General Database Directives
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-09-01 02:36:01 +08:00
|
|
|
Directives in this section apply only to the database in which
|
2000-08-10 09:38:36 +08:00
|
|
|
they are defined. They are supported by every type of database.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-09-01 02:36:01 +08:00
|
|
|
H4: database <type>
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2002-06-15 05:19:42 +08:00
|
|
|
This directive marks the beginning of a database instance
|
|
|
|
declaration.
|
2002-06-15 09:00:50 +08:00
|
|
|
{{EX:<type>}} should be one of the
|
2002-06-15 05:19:42 +08:00
|
|
|
supported backend types listed in Table 5.2.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
\Example:
|
|
|
|
|
2002-06-15 05:19:42 +08:00
|
|
|
> database bdb
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2002-06-15 05:19:42 +08:00
|
|
|
This marks the beginning of a new {{TERM:BDB}} database instance
|
|
|
|
declaration.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
|
|
|
H4: readonly { on | off }
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive puts the database into "read-only" mode. Any
|
1999-04-24 07:00:44 +08:00
|
|
|
attempts to modify the database will return an "unwilling to
|
|
|
|
perform" error.
|
|
|
|
|
|
|
|
\Default:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> readonly off
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
H4: replica
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> replica host=<hostname>[:<port>]
|
2000-08-24 07:23:16 +08:00
|
|
|
> [bindmethod={ simple | kerberos | sasl }]
|
|
|
|
> ["binddn=<DN>"]
|
|
|
|
> [mech=<mech>]
|
|
|
|
> [authcid=<identity>]
|
|
|
|
> [authzid=<identity>]
|
2000-08-10 13:23:38 +08:00
|
|
|
> [credentials=<password>]
|
|
|
|
> [srvtab=<filename>]
|
2000-08-10 09:38:36 +08:00
|
|
|
|
|
|
|
This directive specifies a replication site for this database. The
|
2000-08-10 13:23:38 +08:00
|
|
|
{{EX:host=}} parameter specifies a host and optionally a port where
|
1999-04-24 07:00:44 +08:00
|
|
|
the slave slapd instance can be found. Either a domain name
|
|
|
|
or IP address may be used for <hostname>. If <port> is not
|
1999-04-25 06:31:03 +08:00
|
|
|
given, the standard LDAP port number (389) is used.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
The {{EX:binddn=}} parameter gives the DN to bind as for updates to
|
1999-04-24 07:00:44 +08:00
|
|
|
the slave slapd. It should be a DN which has read/write
|
|
|
|
access to the slave slapd's database, typically given as a
|
2000-08-10 13:23:38 +08:00
|
|
|
{{EX:rootdn}} in the slave's config file. It must also match the
|
2000-08-24 07:23:16 +08:00
|
|
|
{{EX:updatedn}} directive in the slave slapd's config file. Since DNs are
|
2000-08-10 13:23:38 +08:00
|
|
|
likely to contain embedded spaces, the entire {{EX:"binddn=<DN>"}}
|
|
|
|
string should be enclosed in double quotes.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-24 07:23:16 +08:00
|
|
|
The {{EX:bindmethod}} is {{EX:simple}} or {{EX:kerberos}} or {{EX:sasl}},
|
|
|
|
depending on whether simple password-based authentication or Kerberos
|
|
|
|
authentication or {{TERM:SASL}} authentication is to be used when connecting
|
|
|
|
to the slave slapd.
|
|
|
|
|
|
|
|
Simple authentication should not be used unless adequate integrity
|
|
|
|
and privacy protections are in place (e.g. TLS or IPSEC). Simple
|
|
|
|
authentication requires specification of {{EX:binddn}} and
|
|
|
|
{{EX:credentials}} parameters.
|
|
|
|
|
|
|
|
Kerberos authentication is deprecated in favor of SASL authentication
|
2000-09-05 06:51:48 +08:00
|
|
|
mechanisms, in particular the {{EX:KERBEROS_V4}} and {{EX:GSSAPI}}
|
2000-08-24 07:23:16 +08:00
|
|
|
mechanisms. Kerberos authentication requires {{EX:binddn}} and
|
|
|
|
{{EX:srvtab}} parameters.
|
|
|
|
|
|
|
|
SASL authentication is generally recommended. SASL authentication
|
|
|
|
requires specification of a mechanism using the {{EX:mech}} parameter.
|
|
|
|
Depending on the mechanism, an authentication identity and/or
|
|
|
|
credentials can be specified using {{EX:authcid}} and {{EX:credentials}}
|
|
|
|
respectively. The {{EX:authzid}} parameter may be used to specify
|
|
|
|
an authorization identity.
|
2000-08-11 06:31:41 +08:00
|
|
|
|
2000-09-05 06:51:48 +08:00
|
|
|
See the chapter entitled {{SECT:Replication with slurpd}} for more
|
|
|
|
information on how to use this directive.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
|
|
|
H4: replogfile <filename>
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies the name of the replication log file to
|
1999-04-24 07:00:44 +08:00
|
|
|
which slapd will log changes. The replication log is typically
|
2000-08-10 09:38:36 +08:00
|
|
|
written by slapd and read by slurpd. Normally, this directive is
|
1999-04-24 07:00:44 +08:00
|
|
|
only used if slurpd is being used to replicate the database.
|
|
|
|
However, you can also use it to generate a transaction log, if
|
|
|
|
slurpd is not running. In this case, you will need to periodically
|
|
|
|
truncate the file, since it will grow indefinitely otherwise.
|
|
|
|
|
2000-09-05 06:51:48 +08:00
|
|
|
See the chapter entitled {{SECT:Replication with slurpd}} for more
|
|
|
|
information on how to use this directive.
|
2000-08-11 06:31:41 +08:00
|
|
|
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
H4: rootdn <dn>
|
|
|
|
|
2000-08-11 06:31:41 +08:00
|
|
|
This directive specifies the DN that is not subject to
|
1999-04-24 07:00:44 +08:00
|
|
|
access control or administrative limit restrictions for
|
2000-08-11 06:31:41 +08:00
|
|
|
operations on this database. The DN need not refer to
|
2002-06-17 13:33:32 +08:00
|
|
|
an entry in this database or even in the directory. The
|
|
|
|
DN may refer to a SASL identity.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-11 06:31:41 +08:00
|
|
|
Entry-based Example:
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-10-24 03:00:05 +08:00
|
|
|
> rootdn "cn=Manager,dc=example,dc=com"
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-11 06:31:41 +08:00
|
|
|
SASL-based Example:
|
|
|
|
|
2002-06-15 09:00:50 +08:00
|
|
|
> rootdn "uid=root,cn=example.com,cn=digest-md5,cn=auth"
|
2000-08-11 06:31:41 +08:00
|
|
|
|
|
|
|
|
1999-04-24 07:00:44 +08:00
|
|
|
H4: rootpw <password>
|
|
|
|
|
2002-06-17 13:33:32 +08:00
|
|
|
This directive can be used to specifies a password for the DN for
|
|
|
|
the rootdn.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
\Example:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> rootpw secret
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2002-06-17 13:33:32 +08:00
|
|
|
It is also permissible to provide hash of the password in
|
|
|
|
RFC 2307 form. {{slappasswd}}(8) may be used to generate
|
|
|
|
the password hash.
|
|
|
|
|
|
|
|
\Example:
|
|
|
|
|
|
|
|
> rootpw {SSHA}ZKKuqbEKJfKSXhUbHG3fG8MDn9j1v4QN
|
|
|
|
|
|
|
|
The hash was generated using the command {{EX:slappasswd -s secret}}.
|
|
|
|
|
|
|
|
This directive is deprecated in favor of SASL based authentication.
|
|
|
|
|
2000-08-11 06:31:41 +08:00
|
|
|
|
1999-04-24 07:00:44 +08:00
|
|
|
H4: suffix <dn suffix>
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies the DN suffix of queries that will be
|
1999-04-24 07:00:44 +08:00
|
|
|
passed to this backend database. Multiple suffix lines can be
|
|
|
|
given, and at least one is required for each database
|
|
|
|
definition.
|
|
|
|
|
|
|
|
\Example:
|
|
|
|
|
2000-10-24 03:00:05 +08:00
|
|
|
> suffix "dc=example,dc=com"
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-10-24 03:00:05 +08:00
|
|
|
Queries with a DN ending in "dc=example,dc=com"
|
1999-04-24 07:00:44 +08:00
|
|
|
will be passed to this backend.
|
|
|
|
|
2000-08-30 13:05:26 +08:00
|
|
|
Note: When the backend to pass a query to is selected, slapd
|
1999-04-24 07:00:44 +08:00
|
|
|
looks at the suffix line(s) in each database definition in the
|
|
|
|
order they appear in the file. Thus, if one database suffix is a
|
|
|
|
prefix of another, it must appear after it in the config file.
|
|
|
|
|
|
|
|
H4: updatedn <dn>
|
|
|
|
|
2000-09-15 00:40:12 +08:00
|
|
|
This directive is only applicable in a slave slapd. It specifies
|
|
|
|
the DN allowed to make changes to the replica. This may be the DN
|
|
|
|
{{slurpd}}(8) binds as when making changes to the replica or the DN
|
|
|
|
associated with a SASL identity.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-11 06:31:41 +08:00
|
|
|
Entry-based Example:
|
|
|
|
|
2000-10-24 03:00:05 +08:00
|
|
|
> updatedn "cn=Update Daemon,dc=example,dc=com"
|
2000-08-11 06:31:41 +08:00
|
|
|
|
|
|
|
SASL-based Example:
|
|
|
|
|
2002-06-15 09:00:50 +08:00
|
|
|
> updatedn "uid=slurpd,cn=example.com,cn=digest-md5,cn=auth"
|
2000-08-11 06:31:41 +08:00
|
|
|
|
2002-06-15 09:00:50 +08:00
|
|
|
See the {{SECT:Replication with slurpd}} chapter for more information
|
|
|
|
on how to use this directive.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-12 14:35:08 +08:00
|
|
|
H4: updateref <URL>
|
|
|
|
|
|
|
|
This directive is only applicable in a slave slapd. It
|
|
|
|
specifies the URL to return to clients which submit update
|
|
|
|
requests upon the replica.
|
|
|
|
If specified multiple times, each {{TERM:URL}} is provided.
|
|
|
|
|
|
|
|
\Example:
|
|
|
|
|
2000-10-04 03:27:56 +08:00
|
|
|
> updateref ldap://master.example.net
|
2000-08-12 14:35:08 +08:00
|
|
|
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2002-06-15 05:19:42 +08:00
|
|
|
H3: BDB Database Directives
|
|
|
|
|
2002-06-17 02:59:17 +08:00
|
|
|
Directives in this category only apply to a {{TERM:BDB}} database.
|
|
|
|
That is, they must follow a "database bdb" line and come before any
|
|
|
|
subsequent "backend" or "database" line. For a complete reference
|
|
|
|
of BDB configuration directives, see {{slapd-bdb}}(5).
|
2002-06-15 05:19:42 +08:00
|
|
|
|
|
|
|
H4: directory <directory>
|
|
|
|
|
|
|
|
This directive specifies the directory where the BDB files
|
2002-06-15 09:00:50 +08:00
|
|
|
containing the database and associated indices live.
|
2002-06-15 05:19:42 +08:00
|
|
|
|
|
|
|
\Default:
|
|
|
|
|
|
|
|
> directory /usr/local/var/openldap-data
|
|
|
|
|
|
|
|
|
|
|
|
H3: LDBM Database Directives
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2002-06-17 02:59:17 +08:00
|
|
|
Directives in this category only apply to a {{TERM:LDBM}} database.
|
|
|
|
That is, they must follow a "database ldbm" line and come before
|
|
|
|
any subsequent "backend" or "database" line. For a complete reference
|
|
|
|
of LDBM configuration directives, see {{slapd-ldbm}}(5).
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
H4: cachesize <integer>
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies the size in entries of the in-memory
|
1999-04-24 07:00:44 +08:00
|
|
|
cache maintained by the LDBM backend database instance.
|
|
|
|
|
|
|
|
\Default:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> cachesize 1000
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
|
|
|
H4: dbcachesize <integer>
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies the size in bytes of the in-memory cache
|
1999-04-24 07:00:44 +08:00
|
|
|
associated with each open index file. If not supported by the
|
2000-08-10 09:38:36 +08:00
|
|
|
underlying database method, this directive is ignored without
|
1999-04-24 07:00:44 +08:00
|
|
|
comment. Increasing this number uses more memory but can
|
|
|
|
cause a dramatic performance increase, especially during
|
2002-06-15 09:00:50 +08:00
|
|
|
modifies or when building indices.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
\Default:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> dbcachesize 100000
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
2000-08-12 14:35:08 +08:00
|
|
|
H4: dbnolocking
|
|
|
|
|
|
|
|
This option, if present, disables database locking.
|
|
|
|
Enabling this option may improve performance at the expense
|
|
|
|
of data security.
|
|
|
|
|
|
|
|
|
|
|
|
H4: dbnosync
|
|
|
|
|
2002-06-15 09:00:50 +08:00
|
|
|
This option causes on-disk database contents to not be immediately
|
2000-08-12 14:35:08 +08:00
|
|
|
synchronized with in memory changes upon change. Enabling this option
|
2002-06-15 09:00:50 +08:00
|
|
|
may improve performance at the expense of data integrity.
|
2000-08-12 14:35:08 +08:00
|
|
|
|
|
|
|
|
1999-04-24 07:00:44 +08:00
|
|
|
H4: directory <directory>
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies the directory where the LDBM files
|
2002-06-15 09:00:50 +08:00
|
|
|
containing the database and associated indices live.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
\Default:
|
|
|
|
|
2002-06-15 05:19:42 +08:00
|
|
|
> directory /usr/local/var/openldap-data
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
|
|
|
H4: index {<attrlist> | default} [pres,eq,approx,sub,none]
|
|
|
|
|
2002-06-15 09:00:50 +08:00
|
|
|
This directive specifies the indices to maintain for the given
|
2000-08-11 06:31:41 +08:00
|
|
|
attribute. If only an {{EX:<attrlist>}} is given, the default
|
2002-06-15 09:00:50 +08:00
|
|
|
indices are maintained.
|
2000-08-11 06:31:41 +08:00
|
|
|
|
1999-04-24 07:00:44 +08:00
|
|
|
\Example:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> index default pres,eq
|
2001-06-13 04:57:19 +08:00
|
|
|
> index uid
|
|
|
|
> index cn,sn pres,eq,sub
|
|
|
|
> index objectClass eq
|
|
|
|
|
|
|
|
The first line sets the default set of indices to maintain to
|
|
|
|
present and equality. The second line causes the default (pres,eq)
|
|
|
|
set of indices to be maintained for the {{EX:uid}} attribute type.
|
|
|
|
The third line causes present, equality, and substring indices to
|
|
|
|
be maintained for {{EX:cn}} and {{EX:sn}} attribute types. The
|
|
|
|
fourth line causes an equality index for the {{EX:objectClass}}
|
|
|
|
attribute type.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2001-09-02 01:49:27 +08:00
|
|
|
By default, no indices are maintained. It is generally advised
|
|
|
|
that minimally an equality index upon objectClass be maintained.
|
|
|
|
|
|
|
|
> index objectClass eq
|
|
|
|
|
|
|
|
|
|
|
|
|
1999-04-24 07:00:44 +08:00
|
|
|
H4: mode <integer>
|
|
|
|
|
2000-08-10 09:38:36 +08:00
|
|
|
This directive specifies the file protection mode that newly
|
1999-04-24 07:00:44 +08:00
|
|
|
created database index files should have.
|
|
|
|
|
|
|
|
\Default:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> mode 0600
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
|
|
|
H2: Access Control
|
|
|
|
|
|
|
|
Access to slapd entries and attributes is controlled by the
|
|
|
|
access configuration file directive. The general form of an
|
|
|
|
access line is:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> <access directive> ::= access to <what>
|
|
|
|
> [by <who> <access> <control>]+
|
2002-06-15 09:00:50 +08:00
|
|
|
> <what> ::= * | [ dn[.<dn style>]=<regex>]
|
2000-08-10 13:23:38 +08:00
|
|
|
> [filter=<ldapfilter>] [attrs=<attrlist>]
|
2002-06-15 09:00:50 +08:00
|
|
|
> <dn style> ::= regex | exact | base | one | subtree | children
|
2000-08-10 13:23:38 +08:00
|
|
|
> <attrlist> ::= <attr> | <attr> , <attrlist>
|
|
|
|
> <attr> ::= <attrname> | entry | children
|
|
|
|
> <who> ::= [* | anonymous | users | self |
|
2002-06-15 09:00:50 +08:00
|
|
|
> dn[.<dn style>]=<regex>]
|
2000-08-10 13:23:38 +08:00
|
|
|
> [dnattr=<attrname> ]
|
|
|
|
> [group[/<objectclass>[/<attrname>][.<basic style>]]=<regex> ]
|
|
|
|
> [peername[.<basic style>]=<regex>]
|
|
|
|
> [sockname[.<basic style>]=<regex>]
|
|
|
|
> [domain[.<basic style>]=<regex>]
|
|
|
|
> [sockurl[.<basic style>]=<regex>]
|
|
|
|
> [set=<setspec>]
|
|
|
|
> [aci=<attrname>]
|
|
|
|
> <basic style> ::= regex | exact
|
|
|
|
> <access> ::= [self]{<level>|<priv>}
|
|
|
|
> <level> ::= none | auth | compare | search | read | write
|
|
|
|
> <priv> ::= {=|+|-}{w|r|s|c|x}+
|
|
|
|
> <control> ::= [stop | continue | break]
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
where the <what> part selects the entries and/or attributes to
|
2000-08-10 13:23:38 +08:00
|
|
|
which the access applies, the {{EX:<who>}} part specifies which
|
|
|
|
entities are granted access, and the {{EX:<access>}} part specifies
|
|
|
|
the access granted. Multiple {{EX:<who> <access> <control>}} triplets
|
|
|
|
are supported, allowing many entities to be granted different
|
2002-06-15 09:00:50 +08:00
|
|
|
access to the same set of entries and attributes. Not all of these
|
|
|
|
access control options are described here; for more details see
|
|
|
|
the {{slapd.access}}(5) man page.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
|
|
|
H3: What to control access to
|
|
|
|
|
|
|
|
The <what> part of an access specification determines the
|
|
|
|
entries and attributes to which the access control applies.
|
|
|
|
Entries can be selected in two ways: by a regular expression
|
|
|
|
matching the entry's distinguished name:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> dn=<regular expression>
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-11-11 06:03:25 +08:00
|
|
|
Note: The DN pattern specified should be "normalized" to the RFC2253
|
|
|
|
restricted DN form. In particular, there should be no extra spaces
|
|
|
|
and commas should be used to separate components. An example
|
|
|
|
normalized DN is "{{EX:cn=Babs Jensen,dc=example,dc=com}}". An
|
|
|
|
example of a non-normalized DN is "{{EX:cn=Babs Jensen; dc=example;
|
|
|
|
dc=com}}".
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
Or, entries may be selected by a filter matching some
|
|
|
|
attribute(s) in the entry:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> filter=<ldap filter>
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
where <ldap filter> is a string representation of an LDAP
|
2000-08-11 09:21:14 +08:00
|
|
|
search filter, as described in {{REF:RFC2254}}.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
Attributes within an entry are selected by including a
|
|
|
|
comma-separated list of attribute names in the <what>
|
|
|
|
selector:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> attrs=<attribute list>
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
Access to the entry itself must be granted or denied using the
|
2000-08-10 09:38:36 +08:00
|
|
|
special attribute name "{{EX:entry}}". Note that giving access to an
|
1999-04-24 07:00:44 +08:00
|
|
|
attribute is not enough; access to the entry itself through the
|
2000-08-10 09:38:36 +08:00
|
|
|
{{EX:entry}} attribute is also required. The complete examples at
|
1999-04-24 07:00:44 +08:00
|
|
|
the end of this section should help clear things up.
|
|
|
|
|
2000-08-30 13:05:26 +08:00
|
|
|
Lastly, there is a special entry selector {{EX:"*"}} that is used to
|
2000-08-11 09:21:14 +08:00
|
|
|
select any entry. It is used when no other {{EX:<what>}}
|
|
|
|
selector has been provided. It's equivalent to "{{EX:dn=.*}}"
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
2000-08-11 03:20:11 +08:00
|
|
|
H3: Who to grant access to
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
The <who> part identifies the entity or entities being granted
|
|
|
|
access. Note that access is granted to "entities" not "entries."
|
2000-08-30 13:05:26 +08:00
|
|
|
The following table summarizes entity specifiers:
|
2000-08-11 09:21:14 +08:00
|
|
|
|
2000-08-13 15:48:13 +08:00
|
|
|
!block table; align=Center; coltags="EX,N"; \
|
2000-08-12 14:35:08 +08:00
|
|
|
title="Table 5.3: Access Entity Specifiers"
|
2000-08-11 09:21:14 +08:00
|
|
|
Specifier Entities
|
|
|
|
* All, including anonymous and authenticated users
|
|
|
|
anonymous Anonymous (non-authenticated) users
|
|
|
|
users Authenticated users
|
|
|
|
self User associated with target entry
|
|
|
|
dn=<regex> Users matching regular expression
|
|
|
|
!endblock
|
|
|
|
|
|
|
|
The DN specifier takes a regular expression which is used
|
|
|
|
to match against the "normalized" DN of the current entity.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> dn=<regular expression>
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-11 09:21:14 +08:00
|
|
|
By "normalized", we mean that all extra spaces have been
|
2000-08-30 13:05:26 +08:00
|
|
|
removed from the entity's DN and commas are used to
|
2000-08-11 09:21:14 +08:00
|
|
|
separate RDN components.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-30 13:05:26 +08:00
|
|
|
Other control factors are also supported.
|
2000-08-11 09:21:14 +08:00
|
|
|
For example, a {{EX:<what>}} can be restricted by a
|
2001-01-03 07:31:38 +08:00
|
|
|
regular expression matching the client's domain name:
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> domain=<regular expression>
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
or by an entry listed in a DN-valued attribute in the entry to
|
|
|
|
which the access applies:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> dnattr=<dn-valued attribute name>
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
The dnattr specification is used to give access to an entry
|
|
|
|
whose DN is listed in an attribute of the entry (e.g., give
|
|
|
|
access to a group entry to whoever is listed as the owner of
|
|
|
|
the group entry).
|
|
|
|
|
|
|
|
|
|
|
|
H3: The access to grant
|
|
|
|
|
|
|
|
|
|
|
|
The kind of <access> granted can be one of the following:
|
|
|
|
|
|
|
|
|
2000-08-13 15:48:13 +08:00
|
|
|
!block table; colaligns="LRL"; coltags="EX,EX,N"; align=Center; \
|
2000-08-12 14:35:08 +08:00
|
|
|
title="Table 5.4: Access Levels"
|
2000-08-30 13:05:26 +08:00
|
|
|
Level Privileges Description
|
2000-08-10 15:17:54 +08:00
|
|
|
none no access
|
|
|
|
auth =x needed to bind
|
|
|
|
compare =cx needed to compare
|
|
|
|
search =scx needed to apply search filters
|
|
|
|
read =rscx needed to read search results
|
|
|
|
write =wrscx needed to modify/rename
|
|
|
|
!endblock
|
|
|
|
|
|
|
|
Each level implies all lower levels of access. So, for
|
2000-08-30 13:05:26 +08:00
|
|
|
example, granting someone {{EX:write}} access to an entry also
|
|
|
|
grants them {{EX:read}}, {{EX:search}}, {{EX:compare}}, and
|
|
|
|
{{EX:auth}} access. However, one may use the privileges specifier
|
|
|
|
to grant specific permissions.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
|
|
|
H3: Access Control Evaluation
|
|
|
|
|
2001-05-18 10:45:46 +08:00
|
|
|
When evaluating whether some requester should be given access to
|
|
|
|
an entry and/or attribute, slapd compares the entry and/or attribute
|
|
|
|
to the {{EX:<what>}} selectors given in the configuration file.
|
2002-06-15 09:00:50 +08:00
|
|
|
For each entry, access controls provided in the database which holds
|
2001-05-18 10:45:46 +08:00
|
|
|
the entry (or the first database if not held in any database) apply
|
2002-06-15 09:00:50 +08:00
|
|
|
first, followed by the global access directives. Within this
|
2001-05-18 10:45:46 +08:00
|
|
|
priority, access directives are examined in the order in which they
|
|
|
|
appear in the config file. Slapd stops with the first {{EX:<what>}}
|
|
|
|
selector that matches the entry and/or attribute. The corresponding
|
|
|
|
access directive is the one slapd will use to evaluate access.
|
|
|
|
|
|
|
|
Next, slapd compares the entity requesting access to the {{EX:<who>}}
|
|
|
|
selectors within the access directive selected above in the order
|
|
|
|
in which they appear. It stops with the first {{EX:<who>}} selector
|
|
|
|
that matches the requester. This determines the access the entity
|
|
|
|
requesting access has to the entry and/or attribute.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
Finally, slapd compares the access granted in the selected
|
2001-05-18 10:45:46 +08:00
|
|
|
{{EX:<access>}} clause to the access requested by the client. If
|
|
|
|
it allows greater or equal access, access is granted. Otherwise,
|
1999-04-24 07:00:44 +08:00
|
|
|
access is denied.
|
|
|
|
|
2001-05-18 10:45:46 +08:00
|
|
|
The order of evaluation of access directives makes their placement
|
|
|
|
in the configuration file important. If one access directive is
|
|
|
|
more specific than another in terms of the entries it selects, it
|
|
|
|
should appear first in the config file. Similarly, if one {{EX:<who>}}
|
|
|
|
selector is more specific than another it should come first in the
|
|
|
|
access directive. The access control examples given below should
|
|
|
|
help make this clear.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
H3: Access Control Examples
|
|
|
|
|
|
|
|
The access control facility described above is quite powerful.
|
|
|
|
This section shows some examples of its use. First, some
|
|
|
|
simple examples:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> access to * by * read
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
This access directive grants read access to everyone.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> access to *
|
|
|
|
> by self write
|
|
|
|
> by anonymous auth
|
|
|
|
> by * read
|
|
|
|
|
2002-06-16 08:11:51 +08:00
|
|
|
This directive allows users to modify their own entries, allows
|
|
|
|
authenticate, and allows all others to read. Note that only the
|
|
|
|
first {{EX:by <who>}} clause which matches applies. Hence, the
|
|
|
|
anonymous users are granted {{EX:auth}}, not {{EX:read}}. The last
|
|
|
|
clause could just as well have been "{{EX:by users read}}".
|
|
|
|
|
|
|
|
It is often desirable to restrict operations based upon the level
|
|
|
|
of protection in place. The following shows how security strength
|
|
|
|
factors (SSF) can be used.
|
|
|
|
|
|
|
|
> access to *
|
|
|
|
> by ssf=128 self write
|
|
|
|
> by ssf=64 anonymous auth
|
|
|
|
> by ssf=64 users read
|
|
|
|
|
|
|
|
This directive allows users to modify their own entries if security
|
|
|
|
protections have of strength 128 or better have been established,
|
|
|
|
allows simple authentication and read access when 64 or better
|
|
|
|
security protections have been established.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
The following example shows the use of a regular expression
|
|
|
|
to select the entries by DN in two access directives where
|
|
|
|
ordering is significant.
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> access to dn=".*,dc=example,dc=com"
|
|
|
|
> by * search
|
|
|
|
> access to dn=".*,dc=com"
|
|
|
|
> by * read
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-30 02:56:29 +08:00
|
|
|
Read access is granted to entries under the {{EX:dc=com}}
|
2000-08-10 15:17:54 +08:00
|
|
|
subtree, except for those entries under the {{EX:dc=example,dc=com}}
|
2000-08-30 02:56:29 +08:00
|
|
|
subtree, to which search access is granted. No access is granted to
|
|
|
|
{{EX:dc=com}} as neither access directive matches this DN.
|
2000-08-10 15:17:54 +08:00
|
|
|
If the order of these access directives was reversed, the
|
2000-08-10 09:38:36 +08:00
|
|
|
trailing directive would never be reached, since all
|
|
|
|
{{EX:dc=example,dc=com}} entries are also {{EX:dc=com}} entries.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
Also note that if no {{EX:access to}} directive matches or
|
|
|
|
no {{EX:by <who>}} clause, {{B:access is denied}}. That is, every
|
2000-08-30 13:05:26 +08:00
|
|
|
{{EX:access to}} directive ends with an implicit {{EX:by * none}}
|
|
|
|
clause and every access list ends with an implicit
|
|
|
|
{{EX:access to * by * none}} directive. Only if no access controls
|
|
|
|
are specified is the {{EX:defaultaccess}} granted.
|
2000-08-10 13:23:38 +08:00
|
|
|
|
1999-04-24 07:00:44 +08:00
|
|
|
The next example again shows the importance of ordering,
|
2000-08-10 13:23:38 +08:00
|
|
|
both of the access directives and the {{EX:by <who>}} clauses.
|
|
|
|
It also shows the use of an attribute selector to grant access
|
2000-08-10 15:17:54 +08:00
|
|
|
to a specific attribute and various {{EX:<who>}} selectors.
|
2000-08-10 13:23:38 +08:00
|
|
|
|
|
|
|
> access to dn="(.*,)?dc=example,dc=com" attr=homePhone
|
|
|
|
> by self write
|
|
|
|
> by dn="(.*,)?dc=example,dc=com" search
|
|
|
|
> by domain=.*\.example\.com read
|
|
|
|
> access to dn="(.*,)?dc=example,dc=com"
|
|
|
|
> by self write
|
|
|
|
> by dn=".*,dc=example,dc=com" search
|
|
|
|
> by anonymous auth
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-10-24 03:00:05 +08:00
|
|
|
This example applies to entries in the "{{EX:dc=example,dc=com}}"
|
2000-08-10 15:17:54 +08:00
|
|
|
subtree. To all attributes except {{EX:homePhone}}, the entry itself
|
|
|
|
can write them, other {{EX:example.com}} entries can search by them,
|
2002-01-05 03:09:36 +08:00
|
|
|
anybody else has no access (implicit {{EX:by * none}}) excepting for
|
2000-08-10 13:23:38 +08:00
|
|
|
authentication/authorization (which is always done anonymously).
|
2000-08-10 15:17:54 +08:00
|
|
|
The {{EX:homePhone}} attribute is writable by the entry, searchable
|
|
|
|
by other {{EX:example.com}} entries, readable by clients connecting
|
|
|
|
from somewhere in the {{EX:example.com}} domain, and otherwise not
|
2000-08-10 13:23:38 +08:00
|
|
|
readable (implicit {{EX:by * none}}). All other access
|
|
|
|
is denied by the implicit {{EX:access to * by * none}}.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
Sometimes it is useful to permit a particular DN to add or
|
|
|
|
remove itself from an attribute. For example, if you would like to
|
2000-08-30 02:56:29 +08:00
|
|
|
create a group and allow people to add and remove only
|
1999-04-24 07:00:44 +08:00
|
|
|
their own DN from the member attribute, you could accomplish
|
|
|
|
it with an access directive like this:
|
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
> access to attr=member,entry
|
|
|
|
> by dnattr=member selfwrite
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2000-08-10 13:23:38 +08:00
|
|
|
The dnattr {{EX:<who>}} selector says that the access applies to
|
2000-08-10 15:17:54 +08:00
|
|
|
entries listed in the {{EX:member}} attribute. The {{EX:selfwrite}} access
|
1999-04-24 07:00:44 +08:00
|
|
|
selector says that such members can only add or delete their
|
|
|
|
own DN from the attribute, not other values. The addition of
|
|
|
|
the entry attribute is required because access to the entry is
|
|
|
|
required to access any of the entry's attributes.
|
|
|
|
|
2000-08-11 09:21:14 +08:00
|
|
|
!if 0
|
|
|
|
For more details on how to use the {{EX:access}} directive,
|
|
|
|
consult the {{Advanced Access Control}} chapter.
|
|
|
|
!endif
|
2000-08-10 15:17:54 +08:00
|
|
|
|
1999-04-24 07:00:44 +08:00
|
|
|
|
|
|
|
H2: Configuration File Example
|
|
|
|
|
|
|
|
The following is an example configuration file, interspersed
|
|
|
|
with explanatory text. It defines two databases to handle
|
2002-06-15 05:19:42 +08:00
|
|
|
different parts of the {{TERM:X.500}} tree; both are {{TERM:BDB}}
|
2000-08-10 15:17:54 +08:00
|
|
|
database instances. The line numbers shown are provided for
|
1999-04-24 07:00:44 +08:00
|
|
|
reference only and are not included in the actual file. First, the
|
|
|
|
global configuration section:
|
|
|
|
|
2000-08-12 01:07:41 +08:00
|
|
|
E: 1. # example config file - global configuration section
|
|
|
|
E: 2. include /usr/local/etc/schema/core.schema
|
|
|
|
E: 3. referral ldap://root.openldap.org
|
|
|
|
E: 4. access to * by * read
|
|
|
|
|
2000-08-30 13:05:26 +08:00
|
|
|
Line 1 is a comment. Line 2 includes another config file
|
2002-06-15 09:00:50 +08:00
|
|
|
which contains {{core}} schema definitions.
|
2000-08-10 13:23:38 +08:00
|
|
|
The {{EX:referral}} directive on line 3
|
1999-04-24 07:00:44 +08:00
|
|
|
means that queries not local to one of the databases defined
|
|
|
|
below will be referred to the LDAP server running on the
|
2000-08-10 13:23:38 +08:00
|
|
|
standard port (389) at the host {{EX:root.openldap.org}}.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2001-05-18 10:45:46 +08:00
|
|
|
Line 4 is a global access control. It applies to all
|
|
|
|
entries (after any applicable database-specific access
|
|
|
|
controls).
|
2000-08-12 01:07:41 +08:00
|
|
|
|
2002-06-15 09:00:50 +08:00
|
|
|
The next section of the configuration file defines a BDB
|
1999-04-24 07:00:44 +08:00
|
|
|
backend that will handle queries for things in the
|
2000-08-10 09:38:36 +08:00
|
|
|
"dc=example,dc=com" portion of the tree. The
|
1999-04-24 07:00:44 +08:00
|
|
|
database is to be replicated to two slave slapds, one on
|
2002-06-15 09:00:50 +08:00
|
|
|
truelies, the other on judgmentday. Indices are to be
|
2000-08-10 13:23:38 +08:00
|
|
|
maintained for several attributes, and the {{EX:userPassword}}
|
1999-04-24 07:00:44 +08:00
|
|
|
attribute is to be protected from unauthorized access.
|
|
|
|
|
2002-06-15 05:19:42 +08:00
|
|
|
E: 5. # BDB definition for the example.com
|
|
|
|
E: 6. database bdb
|
2000-10-24 03:00:05 +08:00
|
|
|
E: 7. suffix "dc=example,dc=com"
|
2002-06-15 05:19:42 +08:00
|
|
|
E: 8. directory /usr/local/var/openldap-data
|
2000-10-24 03:00:05 +08:00
|
|
|
E: 9. rootdn "cn=Manager,dc=example,dc=com"
|
2000-08-12 01:07:41 +08:00
|
|
|
E: 10. rootpw secret
|
|
|
|
E: 11. # replication directives
|
|
|
|
E: 12. replogfile /usr/local/var/openldap/slapd.replog
|
|
|
|
E: 13. replica host=slave1.example.com:389
|
2000-10-24 03:00:05 +08:00
|
|
|
E: 14. binddn="cn=Replicator,dc=example,dc=com"
|
2000-08-12 01:07:41 +08:00
|
|
|
E: 15. bindmethod=simple credentials=secret
|
|
|
|
E: 16. replica host=slave2.example.com
|
2000-10-24 03:00:05 +08:00
|
|
|
E: 17. binddn="cn=Replicator,dc=example,dc=com"
|
2000-08-12 01:07:41 +08:00
|
|
|
E: 18. bindmethod=simple credentials=secret
|
|
|
|
E: 19. # indexed attribute definitions
|
|
|
|
E: 20. index uid pres,eq
|
|
|
|
E: 21. index cn,sn,uid pres,eq,approx,sub
|
|
|
|
E: 22. index objectClass eq
|
2002-06-15 05:19:42 +08:00
|
|
|
E: 23. # database access control definitions
|
2000-08-12 01:07:41 +08:00
|
|
|
E: 24. access to attr=userPassword
|
|
|
|
E: 25. by self write
|
|
|
|
E: 26. by anonymous auth
|
|
|
|
E: 27. by dn="cn=Admin,dc=example,dc=com" write
|
|
|
|
E: 28. by * none
|
|
|
|
E: 29. access to *
|
|
|
|
E: 30. by self write
|
2000-09-06 10:46:53 +08:00
|
|
|
E: 31. by dn="cn=Admin,dc=example,dc=com" write
|
|
|
|
E: 32. by * read
|
2000-08-12 01:07:41 +08:00
|
|
|
|
2001-05-18 10:45:46 +08:00
|
|
|
Line 5 is a comment. The start of the database definition is marked
|
|
|
|
by the database keyword on line 6. Line 7 specifies the DN suffix
|
|
|
|
for queries to pass to this database. Line 8 specifies the directory
|
|
|
|
in which the database files will live.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2002-06-15 09:00:50 +08:00
|
|
|
Lines 9 and 10 identify the database {{super-user}} entry and associated
|
2001-05-18 10:45:46 +08:00
|
|
|
password. This entry is not subject to access control or size or
|
|
|
|
time limit restrictions.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2001-09-02 01:49:27 +08:00
|
|
|
Lines 11 through 18 are for replication. Line 12 specifies the
|
2002-06-15 09:00:50 +08:00
|
|
|
replication log file (where changes to the database are logged -
|
2001-09-02 01:49:27 +08:00
|
|
|
this file is written by slapd and read by slurpd). Lines 13 through
|
|
|
|
15 specify the hostname and port for a replicated host, the DN to
|
2001-05-18 10:45:46 +08:00
|
|
|
bind as when performing updates, the bind method (simple) and the
|
2001-09-02 01:49:27 +08:00
|
|
|
credentials (password) for the binddn. Lines 16 through 18 specify
|
2001-05-18 10:45:46 +08:00
|
|
|
a second replication site. See the {{SECT:Replication with slurpd}}
|
|
|
|
chapter for more information on these directives.
|
|
|
|
|
2002-06-15 09:00:50 +08:00
|
|
|
Lines 20 through 22 indicate the indices to maintain for various
|
2001-05-18 10:45:46 +08:00
|
|
|
attributes.
|
|
|
|
|
2002-06-15 09:00:50 +08:00
|
|
|
Lines 24 through 32 specify access control for entries in this
|
2001-05-18 10:45:46 +08:00
|
|
|
database. As this is the first database, the controls also apply
|
|
|
|
to entries not held in any database (such as the Root DSE). For
|
|
|
|
all applicable entries, the {{EX:userPassword}} attribute is writable
|
|
|
|
by the entry itself and by the "admin" entry. It may be used for
|
|
|
|
authentication/authorization purposes, but is otherwise not readable.
|
|
|
|
All other attributes are writable by the entry and the "admin"
|
2001-06-13 04:57:19 +08:00
|
|
|
entry, but may be read by all users (authenticated or not).
|
2001-05-18 10:45:46 +08:00
|
|
|
|
|
|
|
The next section of the example configuration file defines another
|
2002-06-15 05:19:42 +08:00
|
|
|
BDB database. This one handles queries involving the
|
2001-09-02 01:49:27 +08:00
|
|
|
{{EX:dc=example,dc=net}} subtree but is managed by the same entity
|
|
|
|
as the first database. Note that without line 39, the read access
|
|
|
|
would be allowed due to the global access rule at line 4.
|
1999-04-24 07:00:44 +08:00
|
|
|
|
2002-06-15 05:19:42 +08:00
|
|
|
E: 33. # BDB definition for example.net
|
|
|
|
E: 34. database bdb
|
2000-10-24 03:00:05 +08:00
|
|
|
E: 35. suffix "dc=example,dc=net"
|
2002-06-15 05:19:42 +08:00
|
|
|
E: 36. directory /usr/local/var/openldap-data-net
|
2000-10-24 03:00:05 +08:00
|
|
|
E: 37. rootdn "cn=Manager,dc=example,dc=com"
|
2001-09-02 01:49:27 +08:00
|
|
|
E: 38. index objectClass eq
|
|
|
|
E: 39. access to * by users read
|