mirror of
https://git.openldap.org/openldap/openldap.git
synced 2024-12-27 03:20:22 +08:00
f11c6b27e7
Now related ITSes need be audited and possibly closed.
Enhancements:
- re-styled code for better readability
- upgraded backend API to reflect recent changes
- LDAP schema is checked when loading SQL/LDAP mapping
- AttributeDescription/ObjectClass pointers used for more efficient
mapping lookup
- bervals used where string length is required often
- atomized write operations by committing at the end of each operation
and defaulting connection closure to rollback
- added LDAP access control to write operations
- fully implemented modrdn (with rdn attrs change, deleteoldrdn,
access check, parent/children check and more)
- added parent access control, children control to delete operation
- added structuralObjectClass operational attribute check and
value return on search
- added hasSubordinate operational attribute on demand
- search limits are appropriately enforced
- function backsql_strcat() has been made more efficient
- concat function has been made configurable by means of a pattern
- added config switches:
- fail_if_no_mapping write operations fail if there is no mapping
- has_ldapinfo_dn_ru overrides autodetect
- concat_pattern a string containing two '?' is used
(note that "?||?" should be more portable
than builtin function "CONCAT(?,?)")
- strcast_func cast of string constants in "SELECT DISTINCT statements (needed by PostgreSQL)
- upper_needs_cast cast the argument of upper when required
(basically when building dn substring queries)
Todo:
- add security checks for SQL statements that can be injected (?)
- re-test with previously supported RDBMs
- replace dn_ru and so with normalized dn (no need for upper() and so
in dn match)
- implement a backsql_normalize() function to replace the upper()
conversion routines
- note that subtree deletion, subtree renaming and so could be easily
implemented (rollback and consistency checks are available :)
- implement "lastmod" and other operational stuff (ldap_entries table ?)
37 lines
1.1 KiB
Plaintext
37 lines
1.1 KiB
Plaintext
# $OpenLDAP$
|
|
#
|
|
# See slapd.conf(5) for details on configuration options.
|
|
# This file should NOT be world readable.
|
|
#
|
|
include /usr/local/etc/openldap/schema/core.schema
|
|
include /usr/local/etc/openldap/schema/cosine.schema
|
|
include /usr/local/etc/openldap/schema/inetorgperson.schema
|
|
|
|
# Define global ACLs to disable default read access.
|
|
|
|
# Do not enable referrals until AFTER you have a working directory
|
|
# service AND an understanding of referrals.
|
|
#referral ldap://root.openldap.org
|
|
|
|
pidfile /usr/local/var/slapd.pid
|
|
argsfile /usr/local/var/slapd.args
|
|
|
|
#######################################################################
|
|
# sql database definitions
|
|
#######################################################################
|
|
|
|
database sql
|
|
suffix "o=sql,c=RU"
|
|
rootdn "cn=root,o=sql,c=RU"
|
|
rootpw secret
|
|
dbname ldap_db2
|
|
dbuser db2inst1
|
|
dbpasswd ibmdb2
|
|
subtree_cond "upper(ldap_entries.dn) LIKE CONCAT('%',?)"
|
|
insentry_query "insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?)"
|
|
upper_func "upper"
|
|
upper_needs_cast "yes"
|
|
create_needs_select "yes"
|
|
has_ldapinfo_dn_ru "no"
|
|
|