slapdconf2.sdf 54.6 KB
Newer Older
1
# $OpenLDAP$
Kurt Zeilenga's avatar
Kurt Zeilenga committed
2
# Copyright 2005-2006 The OpenLDAP Foundation, All Rights Reserved.
3
4
5
6
7
8
9
10
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.

H1: Configuring slapd

Once the software has been built and installed, you are ready
to configure {{slapd}}(8) for use at your site. Unlike previous
OpenLDAP releases, the slapd runtime configuration in 2.3 is
fully LDAP-enabled and can be managed using the standard LDAP
Howard Chu's avatar
Howard Chu committed
11
operations with data in {{TERM:LDIF}}. The LDAP configuration engine
12
13
14
15
16
17
18
19
allows all of slapd's configuration options to be changed on the fly,
generally without requiring a server restart for the changes
to take effect. The old style {{slapd.conf}}(5) file is still
supported, but must be converted to the new {{slapd.d}}(5) format
to allow runtime changes to be saved. While the old style
configuration uses a single file, normally installed as
{{F:/usr/local/etc/openldap/slapd.conf}}, the new style
uses a slapd backend database to store the configuration. The
Howard Chu's avatar
Howard Chu committed
20
configuration database normally resides in the
21
22
23
24
{{F:/usr/local/etc/openldap/slapd.d}} directory.

An alternate configuration directory (or file) can be specified via a
command-line option to {{slapd}}(8) or {{slurpd}}(8). This chapter
Howard Chu's avatar
Howard Chu committed
25
26
describes the general format of the configuration system, followed by a
detailed description of commonly used config settings.
27

28
29
30
31
Note: some of the backends and of the distributed overlays
do not support runtime configuration yet.  In those cases,
the old style {{slapd.conf}}(5) file must be used.

32
33
34
35
36
Note: the current version of {{slurpd}} has not been updated for
compatibility with this new configuration engine. If you must use
slurpd for replication at your site, you will have to maintain an
old-style {{slapd.conf}} file for slurpd to use.

37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

H2: Configuration Layout

The slapd configuration is stored as a special LDAP directory with
a predefined schema and DIT. There are specific objectClasses used to
carry global configuration options, schema definitions, backend and
database definitions, and assorted other items. A sample config tree
is shown in Figure 5.1.

!import "config_dit.gif"; align="center"; title="Sample configuration tree"
FT[align="Center"] Figure 5.1: Sample configuration tree.

Other objects may be part of the configuration but were omitted from
the illustration for clarity.

The {{slapd.d}} configuration tree has a very specific structure. The
root of the tree is named {{EX:cn=config}} and contains global configuration
settings. Additional settings are contained in separate child entries:
* Include files
.. Usually these are just pathnames left over from a converted
{{EX:slapd.conf}} file.
.. Otherwise use of Include files is deprecated.
* Dynamically loaded modules
.. These may only be used if the {{EX:--enable-modules}} option was
used to configure the software.
* Schema definitions
.. The {{EX:cn=schema,cn=config}} entry contains the system schema (all
the schema that is hard-coded in slapd).
.. Child entries of {{EX:cn=schema,cn=config}} contain user schema as
loaded from config files or added at runtime.
* Backend-specific configuration 
* Database-specific configuration
.. Overlays are defined in children of the Database entry.
.. Databases and Overlays may also have other miscellaneous children.

The usual rules for LDIF files apply to the configuration information:
Comment lines beginning with a '{{EX:#}}' character
74
are ignored.  If a line begins with a single space, it is considered a
75
continuation of the previous line (even if the previous line is a
76
comment) and the single leading space is removed. Entries are separated by blank lines.
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100

The general layout of the config LDIF is as follows:

>	# global configuration settings
>	dn: cn=config
>	objectClass: olcGlobal
>	cn: config
>	<global config settings>
>
>	# schema definitions
>	dn: cn=schema,cn=config
>	objectClass: olcSchemaConfig
>	cn: schema
>	<system schema>
>
>	dn: cn={X}core,cn=schema,cn=config
>	objectClass: olcSchemaConfig
>	cn: {X}core
>	<core schema>
>
>	# additional user-specified schema
>	...
>
>	# backend definitions
Howard Chu's avatar
Howard Chu committed
101
>	dn: olcBackend=<typeA>,cn=config
102
>	objectClass: olcBackendConfig
Howard Chu's avatar
Howard Chu committed
103
>	olcBackend: <typeA>
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
>	<backend-specific settings>
>
>	# database definitions
>	dn: olcDatabase={X}<typeA>,cn=config
>	objectClass: olcDatabaseConfig
>	olcDatabase: {X}<typeA>
>	<database-specific settings>
>
>	# subsequent definitions and settings
>	...

Some of the entries listed above have a numeric index {{EX:"{X}"}} in
their names. While most configuration settings have an inherent ordering
dependency (i.e., one setting must take effect before a subsequent one
may be set), LDAP databases are inherently unordered. The numeric index
is used to enforce a consistent ordering in the configuration database,
so that all ordering dependencies are preserved. In most cases the index
does not have to be provided; it will be automatically generated based
on the order in which entries are created.

Howard Chu's avatar
Howard Chu committed
124
125
126
127
128
129
130
131
132
133
Configuration directives are specified as values of individual
attributes.
Most of the attributes and objectClasses used in the slapd
configuration have a prefix of {{EX:"olc"}} (OpenLDAP Configuration)
in their names. Generally there is a one-to-one correspondence
between the attributes and the old-style {{EX:slapd.conf}} configuration
keywords, using the keyword as the attribute name, with the "olc"
prefix attached.

A configuration directive may take arguments.  If so, the arguments are
134
separated by white space.  If an argument contains white space,
135
the argument should be enclosed in double quotes {{EX:"like this"}}.
Howard Chu's avatar
Howard Chu committed
136
137
In the descriptions that follow, arguments that should be replaced
by actual text are shown in brackets {{EX:<>}}.
138
139
140
141
142
143
144
145
146
147
148
149

The distribution contains an example configuration file that will
be installed in the {{F: /usr/local/etc/openldap}} directory.
A number of files containing schema definitions (attribute types
and object classes) are also provided in the
{{F: /usr/local/etc/openldap/schema}} directory.


H2: Configuration Directives

This section details commonly used configuration directives.  For
a complete list, see the {{slapd.d}}(5) manual page.  This section
Howard Chu's avatar
Howard Chu committed
150
151
152
153
will treat the configuration directives in a top-down order, starting
with the global directives in the {{EX:cn=config}} entry. Each
directive will be described along with its default value (if any) and
an example of its use.
154
155


Howard Chu's avatar
Howard Chu committed
156
H3: cn=config
157

Howard Chu's avatar
Howard Chu committed
158
Directives contained in this entry generally apply to the server as a whole.
159
160
Most of them are system or connection oriented, not database related. This
entry must have the {{EX:olcGlobal}} objectClass.
161
162


Howard Chu's avatar
Howard Chu committed
163
H4: olcIdleTimeout: <integer>
164
165

Specify the number of seconds to wait before forcibly closing
Howard Chu's avatar
Howard Chu committed
166
an idle client connection.  A value of 0, the default,
167
168
169
disables this feature.


Howard Chu's avatar
Howard Chu committed
170
H4: olcLogLevel: <level>
171
172
173
174
175
176

This directive specifies the level at which debugging statements
and operation statistics should be syslogged (currently logged to
the {{syslogd}}(8) {{EX:LOG_LOCAL4}} facility). You must have
configured OpenLDAP {{EX:--enable-debug}} (the default) for this
to work (except for the two statistics levels, which are always
Howard Chu's avatar
Howard Chu committed
177
178
179
enabled). Log levels may be specified as integers or by keyword.
Multiple log levels may be used and the levels are additive.
To display what levels
180
correspond to what kind of debugging, invoke slapd with {{EX:-?}}
Howard Chu's avatar
Howard Chu committed
181
or consult the table below. The possible values for <level> are:
182
183
184

!block table; colaligns="RL"; align=Center; \
	title="Table 5.1: Debugging Levels"
Howard Chu's avatar
Howard Chu committed
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
Level	Keyword	Description
-1	Any	enable all debugging
0		no debugging
1	Trace	trace function calls
2	Packets	debug packet handling
4	Args	heavy trace debugging
8	Conns	connection management
16	BER	print out packets sent and received
32	Filter	search filter processing
64	Config	configuration processing
128	ACL	access control list processing
256	Stats	stats log connections/operations/results
512	Stats2	stats log entries sent
1024	Shell	print communication with shell backends
2048	Parse	print entry parsing debugging
4096	Cache	database cache processing
8192	Index	database indexing
16384	Sync	syncrepl consumer processing
203
204
205
206
!endblock

\Example:

Howard Chu's avatar
Howard Chu committed
207
E: olcLogLevel: -1
208
209
210
211

This will cause lots and lots of debugging information to be
logged.

Howard Chu's avatar
Howard Chu committed
212
E: olcLogLevel: Conns Filter
213

Howard Chu's avatar
Howard Chu committed
214
Just log the connection and search filter processing.
215

Howard Chu's avatar
Howard Chu committed
216
\Default:
217

Howard Chu's avatar
Howard Chu committed
218
E: olcLogLevel: Stats
219
220


Howard Chu's avatar
Howard Chu committed
221
H4: olcReferral <URI>
222
223
224
225
226
227

This directive specifies the referral to pass back when slapd
cannot find a local database to handle a request.

\Example:

Howard Chu's avatar
Howard Chu committed
228
>	olcReferral: ldap://root.openldap.org
229
230
231
232
233
234
235
236

This will refer non-local queries to the global root LDAP server
at the OpenLDAP Project. Smart LDAP clients can re-ask their
query at that server, but note that most of these clients are
only going to know how to handle simple LDAP URLs that
contain a host part and optionally a distinguished name part.


Howard Chu's avatar
Howard Chu committed
237
H4: Sample Entry
238

Howard Chu's avatar
Howard Chu committed
239
240
241
242
243
244
>dn: cn=config
>objectClass: olcGlobal
>cn: config
>olcIdleTimeout: 30
>olcLogLevel: Stats
>olcReferral: ldap://root.openldap.org
245
246
247



Howard Chu's avatar
Howard Chu committed
248
H3: cn=include
249

Howard Chu's avatar
Howard Chu committed
250
251
252
253
An include entry holds the pathname of one include file. Include files
are part of the old style slapd.conf configuration system and must be in
slapd.conf format. Include files were commonly used to load schema
specifications. While they are still supported, their use is deprecated.
254
Include entries must have the {{EX:olcIncludeFile}} objectClass.
255
256


Howard Chu's avatar
Howard Chu committed
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
H4: olcInclude: <filename>

This directive specifies that slapd should read additional
configuration information from the given file. 

Note: You should be careful when using this directive - there is
no small limit on the number of nested include directives, and no
loop detection is done.


H4: Sample Entries

>dn: cn=include{0},cn=config
>objectClass: olcIncludeFile
>cn: include{0}
>olcInclude: ./schema/core.schema
>
>dn: cn=include{1},cn=config
>objectClass: olcIncludeFile
>cn: include{1}
>olcInclude: ./schema/cosine.schema
278
279


280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
H3: cn=module

If support for dynamically loaded modules was enabled when configuring
slapd, {{EX:cn=module}} entries may be used to specify sets of modules to load.
Module entries must have the {{EX:olcModuleList}} objectClass.


H4: olcModuleLoad: <filename>

Specify the name of a dynamically loadable module to load. The filename
may be an absolute path name or a simple filename. Non-absolute names
are searched for in the directories specified by the {{EX:olcModulePath}}
directive.


H4: olcModulePath: <pathspec>

Specify a list of directories to search for loadable modules. Typically the
path is colon-separated but this depends on the operating system.


H4: Sample Entries

>dn: cn=module{0},cn=config
>objectClass: olcModuleList
>cn: module{0}
>olcModuleLoad: /usr/local/lib/smbk5pwd.la
>
>dn: cn=module{1},cn=config
>objectClass: olcModuleList
>cn: module{1}
>olcModulePath: /usr/local/lib:/usr/local/lib/slapd
>olcModuleLoad: accesslog.la
>olcModuleLoad: pcache.la


Howard Chu's avatar
Howard Chu committed
316
H3: cn=schema
317

Howard Chu's avatar
Howard Chu committed
318
319
320
321
The cn=schema entry holds all of the schema definitions that are hard-coded
in slapd. As such, the values in this entry are generated by slapd so no
schema values need to be provided in the config file. The entry must still
be defined though, to serve as a base for the user-defined schema to add
322
323
in underneath. Schema entries must have the {{EX:olcSchemaConfig}}
objectClass.
324

Howard Chu's avatar
Howard Chu committed
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349

H4: olcAttributeTypes: <{{REF:RFC2252}} Attribute Type Description>

This directive defines an attribute type.
Please see the {{SECT:Schema Specification}} chapter
for information regarding how to use this directive.


H4: olcObjectClasses: <{{REF:RFC2252}} Object Class Description>

This directive defines an object class.
Please see the {{SECT:Schema Specification}} chapter for
information regarding how to use this directive.


H4: Sample Entries

>dn: cn=schema,cn=config
>objectClass: olcSchemaConfig
>cn: schema
>
>dn: cn=test,cn=schema,cn=config
>objectClass: olcSchemaConfig
>cn: test
>olcAttributeTypes: ( 1.1.1
350
351
352
>  NAME 'testAttr'
>  EQUALITY integerMatch
>  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
Howard Chu's avatar
Howard Chu committed
353
>olcAttributeTypes: ( 1.1.2 NAME 'testTwo' EQUALITY caseIgnoreMatch
354
>  SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 )
Howard Chu's avatar
Howard Chu committed
355
>olcObjectClasses: ( 1.1.3 NAME 'testObject'
356
>  MAY ( testAttr $ testTwo ) AUXILIARY )
Howard Chu's avatar
Howard Chu committed
357
358
359
360
361


H3: Backend-specific Directives

Backend directives apply to all database instances of the
362
same type and, depending on the directive, may be overridden
363
364
by database directives. Backend entries must have the
{{EX:olcBackendConfig}} objectClass.
365

Howard Chu's avatar
Howard Chu committed
366
H4: olcBackend: <type>
367

Howard Chu's avatar
Howard Chu committed
368
This directive names a backend-specific configuration entry.
369
370
371
372
373
374
375
{{EX:<type>}} should be one of the
supported backend types listed in Table 5.2.

!block table; align=Center; coltags="EX,N"; \
	title="Table 5.2: Database Backends"
Types	Description
bdb	Berkeley DB transactional backend
Howard Chu's avatar
Howard Chu committed
376
config	Slapd configuration backend
377
dnssrv	DNS SRV backend
Howard Chu's avatar
Howard Chu committed
378
hdb	Hierarchical variant of bdb backend
379
ldap	Lightweight Directory Access Protocol (Proxy) backend
Howard Chu's avatar
Howard Chu committed
380
ldif	Lightweight Data Interchange Format backend
381
382
383
384
385
386
387
388
389
390
meta	Meta Directory backend
monitor	Monitor backend
passwd	Provides read-only access to {{passwd}}(5)
perl	Perl Programmable backend
shell	Shell (extern program) backend
sql	SQL Programmable backend
!endblock

\Example:

Howard Chu's avatar
Howard Chu committed
391
>	olcBackend: bdb
392

Howard Chu's avatar
Howard Chu committed
393
394
395
396
There are no other directives defined for this entry.  Specific backend
types may define additional attributes for their particular use but so
far none have ever been defined.  As such, these directives usually do
not appear in any actual configurations.
Howard Chu's avatar
Howard Chu committed
397
398
399
400
401
402
403


H4: Sample Entry

> dn: olcBackend=bdb,cn=config
> objectClass: olcBackendConfig
> olcBackend: bdb
404
405


Howard Chu's avatar
Howard Chu committed
406
H3: Database-specific Directives
407

Howard Chu's avatar
Howard Chu committed
408
Directives in this section are supported by every type of database.
409
Database entries must have the {{EX:olcDatabaseConfig}} objectClass.
410

Howard Chu's avatar
Howard Chu committed
411
H4: olcDatabase: [{<index>}]<type>
412

Howard Chu's avatar
Howard Chu committed
413
414
415
This directive names a specific database instance. The numeric {<index>} may
be provided to distinguish multiple databases of the same type. Usually the
index can be omitted, and slapd will generate it automatically.
416
{{EX:<type>}} should be one of the
Howard Chu's avatar
Howard Chu committed
417
418
419
420
421
422
supported backend types listed in Table 5.2 or the {{EX:frontend}} type.

The {{EX:frontend}} is a special database that is used to hold
database-level options that should be applied to all the other
databases. Subsequent database definitions may also override some
frontend settings.
423

Howard Chu's avatar
Howard Chu committed
424
425
426
427
428
The {{EX:config}} database is also special; both the {{EX:config}} and
the {{EX:frontend}} databases are always created implicitly even if they
are not explicitly configured, and they are created before any other
databases.

429
430
\Example:

Howard Chu's avatar
Howard Chu committed
431
432
433
>	olcDatabase: bdb

This marks the beginning of a new {{TERM:BDB}} database instance.
434
435


Kurt Zeilenga's avatar
Kurt Zeilenga committed
436
H4: olcAccess: to <what> [ by <who> [<accesslevel>] [<control>] ]+
437

Howard Chu's avatar
Howard Chu committed
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
This directive grants access (specified by <accesslevel>) to a
set of entries and/or attributes (specified by <what>) by one or
more requesters (specified by <who>).
See the {{SECT:Access Control}} section of this chapter for a
summary of basic usage.

!if 0
More detailed discussion of this directive can be found in the
{{SECT:Advanced Access Control}} chapter.
!endif

Note: If no {{EX:olcAccess}} directives are specified, the default
access control policy, {{EX:to * by * read}}, allows all
users (both authenticated and anonymous) read access.

Note: Access controls defined in the frontend are appended to all
other databases' controls.


H4: olcReadonly { TRUE | FALSE }
458
459
460
461
462
463
464

This directive puts the database into "read-only" mode. Any
attempts to modify the database will return an "unwilling to
perform" error.

\Default:

Howard Chu's avatar
Howard Chu committed
465
466
>	olcReadonly: FALSE

467

Howard Chu's avatar
Howard Chu committed
468
H4: olcReplica
469

Howard Chu's avatar
Howard Chu committed
470
471
>	olcReplica: uri=ldap[s]://<hostname>[:<port>] | host=<hostname>[:<port>]
>		[bindmethod={simple|sasl}]
472
473
474
475
476
477
>		["binddn=<DN>"]
>		[saslmech=<mech>]
>		[authcid=<identity>]
>		[authzid=<identity>]
>		[credentials=<password>]

Howard Chu's avatar
Howard Chu committed
478
479
This directive specifies a replication site for this database for
use with slurpd. The
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
{{EX:uri=}} parameter specifies a scheme, a host and optionally a port where
the slave slapd instance can be found. Either a domain name
or IP address may be used for <hostname>. If <port> is not
given, the standard LDAP port number (389 or 636) is used.

{{EX:host}} is deprecated in favor of the {{EX:uri}} parameter.

{{EX:uri}} allows the replica LDAP server to be specified as an LDAP 
URI such as {{EX:ldap://slave.example.com:389}} or
{{EX:ldaps://slave.example.com:636}}.

The {{EX:binddn=}} parameter gives the DN to bind as for updates
to the slave slapd. It should be a DN which has read/write access
to the slave slapd's database.  It must also match the {{EX:updatedn}}
directive in the slave slapd's config file.  Generally, this DN
{{should not}} be the same as the {{EX:rootdn}} of the master
database.  Since DNs are likely to contain embedded spaces, the
entire {{EX:"binddn=<DN>"}} string should be enclosed in double
quotes.

Howard Chu's avatar
Howard Chu committed
500
501
502
The {{EX:bindmethod}} is {{EX:simple}} or {{EX:sasl}},
depending on whether simple password-based authentication
or {{TERM:SASL}} authentication is to be used when connecting
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
to the slave slapd.

Simple authentication should not be used unless adequate data
integrity and confidentiality protections are in place (e.g. TLS
or IPSEC).  Simple authentication requires specification of
{{EX:binddn}} and {{EX:credentials}} parameters.

SASL authentication is generally recommended.  SASL authentication
requires specification of a mechanism using the {{EX:saslmech}} parameter.
Depending on the mechanism, an authentication identity and/or
credentials can be specified using {{EX:authcid}} and {{EX:credentials}}
respectively.  The {{EX:authzid}} parameter may be used to specify
an authorization identity.

See the chapter entitled {{SECT:Replication with slurpd}} for more
information on how to use this directive.


Howard Chu's avatar
Howard Chu committed
521
H4: olcReplogfile: <filename>
522
523
524
525
526
527
528
529
530
531
532
533
534

This directive specifies the name of the replication log file to
which slapd will log changes. The replication log is typically
written by slapd and read by slurpd. Normally, this directive is
only used if slurpd is being used to replicate the database.
However, you can also use it to generate a transaction log, if
slurpd is not running. In this case, you will need to periodically
truncate the file, since it will grow indefinitely otherwise.

See the chapter entitled {{SECT:Replication with slurpd}} for more
information on how to use this directive.


Howard Chu's avatar
Howard Chu committed
535
H4: olcRootDN: <DN>
536
537
538
539
540
541
542
543
544

This directive specifies the DN that is not subject to
access control or administrative limit restrictions for
operations on this database.  The DN need not refer to
an entry in this database or even in the directory. The
DN may refer to a SASL identity.

Entry-based Example:

Howard Chu's avatar
Howard Chu committed
545
>	olcRootDN: "cn=Manager,dc=example,dc=com"
546
547
548

SASL-based Example:

Howard Chu's avatar
Howard Chu committed
549
>	olcRootDN: "uid=root,cn=example.com,cn=digest-md5,cn=auth"
550
551
552
553
554

See the {{SECT:SASL Authentication}} section for information on
SASL authentication identities.


Howard Chu's avatar
Howard Chu committed
555
H4: olcRootPW: <password>
556

Howard Chu's avatar
Howard Chu committed
557
This directive can be used to specify a password for the DN for
558
559
560
561
the rootdn (when the rootdn is set to a DN within the database).

\Example:

Howard Chu's avatar
Howard Chu committed
562
>	olcRootPW: secret
563

Howard Chu's avatar
Howard Chu committed
564
It is also permissible to provide a hash of the password in RFC 2307
565
566
567
568
form.  {{slappasswd}}(8) may be used to generate the password hash.

\Example:

Howard Chu's avatar
Howard Chu committed
569
>	olcRootPW: {SSHA}ZKKuqbEKJfKSXhUbHG3fG8MDn9j1v4QN
570
571
572
573

The hash was generated using the command {{EX:slappasswd -s secret}}.


Howard Chu's avatar
Howard Chu committed
574
575
576
577
578
579
580
581
582
583
584
585
H4: olcSizeLimit: <integer>

This directive specifies the maximum number of entries to return
from a search operation.

\Default:

>	olcSizeLimit: 500



H4: olcSuffix: <dn suffix>
586
587
588

This directive specifies the DN suffix of queries that will be
passed to this backend database. Multiple suffix lines can be
Howard Chu's avatar
Howard Chu committed
589
590
591
592
given, and usually at least one is required for each database
definition. (Some backend types, such as {{EX:frontend}} and
{{EX:monitor}} use a hard-coded suffix which may not be overridden
in the configuration.)
593
594
595

\Example:

Howard Chu's avatar
Howard Chu committed
596
>	olcSuffix: "dc=example,dc=com"
597
598
599
600
601

Queries with a DN ending in "dc=example,dc=com"
will be passed to this backend.

Note: When the backend to pass a query to is selected, slapd
Howard Chu's avatar
Howard Chu committed
602
603
604
looks at the suffix value(s) in each database definition in the
order in which they were configured. Thus, if one database suffix is a
prefix of another, it must appear after it in the configuration.
605
606


Howard Chu's avatar
Howard Chu committed
607
H4: olcSyncrepl
608

Howard Chu's avatar
Howard Chu committed
609
>	olcSyncrepl: rid=<replica ID>
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
>		provider=ldap[s]://<hostname>[:port]
>		[type=refreshOnly|refreshAndPersist]
>		[interval=dd:hh:mm:ss]
>		[retry=[<retry interval> <# of retries>]+]
>		[searchbase=<base DN>]
>		[filter=<filter str>]
>		[scope=sub|one|base]
>		[attrs=<attr list>]
>		[attrsonly]
>		[sizelimit=<limit>]
>		[timelimit=<limit>]
>		[schemachecking=on|off]
>		[bindmethod=simple|sasl]
>		[binddn=<DN>]
>		[saslmech=<mech>]
>		[authcid=<identity>]
>		[authzid=<identity>]
>		[credentials=<passwd>]
>		[realm=<realm>]
>		[secprops=<properties>]


This directive specifies the current database as a replica of the
master content by establishing the current {{slapd}}(8) as a
replication consumer site running a syncrepl replication engine.
The master database is located at the replication provider site
specified by the {{EX:provider}} parameter. The replica database is
kept up-to-date with the master content using the LDAP Content
Synchronization protocol. See {{EX:draft-zeilenga-ldup-sync-xx.txt}}
({{a work in progress}}) for more information on the protocol.

The {{EX:rid}} parameter is used for identification of the current
{{EX:syncrepl}} directive within the replication consumer server,
where {{EX:<replica ID>}} uniquely identifies the syncrepl specification
described by the current {{EX:syncrepl}} directive. {{EX:<replica ID>}}
is non-negative and is no more than three decimal digits in length.

The {{EX:provider}} parameter specifies the replication provider site
containing the master content as an LDAP URI. The {{EX:provider}}
parameter specifies a scheme, a host and optionally a port where the
provider slapd instance can be found. Either a domain name or IP
address may be used for <hostname>. Examples are
{{EX:ldap://provider.example.com:389}} or {{EX:ldaps://192.168.1.1:636}}.
If <port> is not given, the standard LDAP port number (389 or 636) is used.
Note that the syncrepl uses a consumer-initiated protocol, and hence its
specification is located at the consumer site, whereas the {{EX:replica}}
specification is located at the provider site. {{EX:syncrepl}} and
{{EX:replica}} directives define two independent replication
mechanisms. They do not represent the replication peers of each other.

The content of the syncrepl replica is defined using a search
specification as its result set. The consumer slapd will
send search requests to the provider slapd according to the search
specification. The search specification includes {{EX:searchbase}},
{{EX:scope}}, {{EX:filter}}, {{EX:attrs}}, {{EX:attrsonly}},
{{EX:sizelimit}}, and {{EX:timelimit}} parameters as in the normal
666
667
668
669
670
search specification. The {{EX:searchbase}} parameter has no
default value and must always be specified. The {{EX:scope}} defaults
to {{EX:sub}}, the {{EX:filter}} defaults to {{EX:(objectclass=*)}},
{{EX:attrs}} defaults to {{EX:"*,+"}} to replicate all user and operational
attributes, and {{EX:attrsonly}} is unset by default. Both {{EX:sizelimit}}
671
672
and {{EX:timelimit}} default to "unlimited", and only positive integers
or "unlimited" may be specified.
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687

The LDAP Content Synchronization protocol has two operation
types: {{EX:refreshOnly}} and {{EX:refreshAndPersist}}.
The operation type is specified by the {{EX:type}} parameter.
In the {{EX:refreshOnly}} operation, the next synchronization search operation
is periodically rescheduled at an interval time after each
synchronization operation finishes. The interval is specified
by the {{EX:interval}} parameter. It is set to one day by default.
In the {{EX:refreshAndPersist}} operation, a synchronization search
remains persistent in the provider slapd. Further updates to the
master replica will generate {{EX:searchResultEntry}} to the consumer slapd
as the search responses to the persistent synchronization search.

If an error occurs during replication, the consumer will attempt to reconnect
according to the retry parameter which is a list of the <retry interval>
688
and <# of retries> pairs. For example, retry="60 10 300 3" lets the consumer
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
retry every 60 seconds for the first 10 times and then retry every 300 seconds
for the next three times before stop retrying. + in <#  of retries> means
indefinite number of retries until success.

The schema checking can be enforced at the LDAP Sync consumer site
by turning on the {{EX:schemachecking}} parameter.
If it is turned on, every replicated entry will be checked for its
schema as the entry is stored into the replica content.
Every entry in the replica should contain those attributes
required by the schema definition.
If it is turned off, entries will be stored without checking
schema conformance. The default is off.

The {{EX:binddn}} parameter gives the DN to bind as for the
syncrepl searches to the provider slapd. It should be a DN
which has read access to the replication content in the
master database. 

The {{EX:bindmethod}} is {{EX:simple}} or {{EX:sasl}},
depending on whether simple password-based authentication or
{{TERM:SASL}} authentication is to be used when connecting
to the provider slapd.

Simple authentication should not be used unless adequate data
integrity and confidentiality protections are in place (e.g. TLS
or IPSEC). Simple authentication requires specification of {{EX:binddn}}
and {{EX:credentials}} parameters.

SASL authentication is generally recommended.  SASL authentication
requires specification of a mechanism using the {{EX:saslmech}} parameter.
Depending on the mechanism, an authentication identity and/or
credentials can be specified using {{EX:authcid}} and {{EX:credentials}},
respectively.  The {{EX:authzid}} parameter may be used to specify
an authorization identity.

The {{EX:realm}} parameter specifies a realm which a certain
mechanisms authenticate the identity within. The {{EX:secprops}}
parameter specifies Cyrus SASL security properties.

The syncrepl replication mechanism is supported by the
729
two native backends: back-bdb and back-hdb.
730
731
732
733
734

See the {{SECT:LDAP Sync Replication}} chapter of the admin guide
for more information on how to use this directive.


Howard Chu's avatar
Howard Chu committed
735
736
737
738
739
740
741
742
743
744
745
746
747
H4: olcTimeLimit: <integer>

This directive specifies the maximum number of seconds (in real
time) slapd will spend answering a search request. If a
request is not finished in this time, a result indicating an
exceeded timelimit will be returned.

\Default:

>	olcTimeLimit: 3600


H4: olcUpdateDN: <DN>
748
749
750
751
752
753
754
755

This directive is only applicable in a slave slapd. It specifies
the DN allowed to make changes to the replica.  This may be the DN
{{slurpd}}(8) binds as when making changes to the replica or the DN
associated with a SASL identity.

Entry-based Example:

Howard Chu's avatar
Howard Chu committed
756
>	olcUpdateDN: "cn=Update Daemon,dc=example,dc=com"
757
758
759

SASL-based Example:

Howard Chu's avatar
Howard Chu committed
760
>	olcUpdateDN: "uid=slurpd,cn=example.com,cn=digest-md5,cn=auth"
761
762
763
764

See the {{SECT:Replication with slurpd}} chapter for more information
on how to use this directive.

Howard Chu's avatar
Howard Chu committed
765
H4: olcUpdateref: <URL>
766
767
768
769
770
771
772
773

This directive is only applicable in a slave slapd. It
specifies the URL to return to clients which submit update
requests upon the replica.
If specified multiple times, each {{TERM:URL}} is provided.

\Example:

Howard Chu's avatar
Howard Chu committed
774
>	olcUpdateref:	ldap://master.example.net
775
776


Howard Chu's avatar
Howard Chu committed
777
H4: Sample Entries
Howard Chu's avatar
Howard Chu committed
778
779
780

>dn: olcDatabase=frontend,cn=config
>objectClass: olcDatabaseConfig
Howard Chu's avatar
Howard Chu committed
781
>objectClass: olcFrontendConfig
Howard Chu's avatar
Howard Chu committed
782
783
>olcDatabase: frontend
>olcReadOnly: FALSE
Howard Chu's avatar
Howard Chu committed
784
785
786
787
788
789
>
>dn: olcDatabase=config,cn=config
>objectClass: olcDatabaseConfig
>olcDatabase: config
>olcRootDN: cn=Manager,dc=example,dc=com

Howard Chu's avatar
Howard Chu committed
790

Howard Chu's avatar
Howard Chu committed
791
H3: BDB and HDB Database Directives
792

Howard Chu's avatar
Howard Chu committed
793
794
Directives in this category apply to both the {{TERM:BDB}}
and the {{TERM:HDB}} database.
Howard Chu's avatar
Howard Chu committed
795
They are used in an olcDatabase entry in addition to the generic
796
database directives defined above.  For a complete reference
797
798
799
800
of BDB/HDB configuration directives, see {{slapd-bdb}}(5). In
addition to the {{EX:olcDatabaseConfig}} objectClass, BDB and HDB
database entries must have the {{EX:olcBdbConfig}} and
{{EX:olcHdbConfig}} objectClass, respectively.
801
802


Howard Chu's avatar
Howard Chu committed
803
H4: olcDbDirectory: <directory>
804
805
806
807
808
809

This directive specifies the directory where the BDB files
containing the database and associated indices live.

\Default:

Howard Chu's avatar
Howard Chu committed
810
811
812
>	olcDbDirectory: /usr/local/var/openldap-data


813
H4: olcDbCachesize: <integer>
814

815
816
This directive specifies the size in entries of the in-memory
cache maintained by the BDB backend database instance.
817

818
\Default:
819

820
>	olcDbCachesize: 1000
821
822


823
H4: olcDbCheckpoint: <kbyte> <min>
824

825
826
827
828
829
830
831
832
This directive specifies how often to checkpoint the BDB transaction log.
A checkpoint operation flushes the database buffers to disk and writes a
checkpoint record in the log.
The checkpoint will occur if either <kbyte> data has been written or
<min> minutes have passed since the last checkpont. Both arguments default
to zero, in which case they are ignored. When the <min> argument is
non-zero, an internal task will run every <min> minutes to perform the
checkpoint. See the Berkeley DB reference guide for more details.
833

834
\Example:
835

836
>	olcDbCheckpoint: 1024 10
837
838


839
H4: olcDbConfig: <DB_CONFIG setting>
840

841
842
843
844
845
846
847
848
This attribute specifies a configuration directive to be placed in the
{{EX:DB_CONFIG}} file of the database directory. At server startup time, if
no such file exists yet, the {{EX:DB_CONFIG}} file will be created and the
settings in this attribute will be written to it. If the file exists,
its contents will be read and displayed in this attribute. The attribute
is multi-valued, to accomodate multiple configuration directives. No default
is provided, but it is essential to use proper settings here to get the
best server performance.
849

850
\Example:
851

852
853
854
855
>	olcDbConfig: set_cachesize 0 10485760 0
>	olcDbConfig: set_lg_bsize 2097512
>	olcDbConfig: set_lg_dir /var/tmp/bdb-log
>	olcDbConfig: set_flags DB_LOG_AUTOREMOVE
856

857
858
859
860
861
862
863
864
In this example, the BDB cache is set to 10MB, the BDB transaction log
buffer size is set to 2MB, and the transaction log files are to be stored
in the /var/tmp/bdb-log directory. Also a flag is set to tell BDB to
delete transaction log files as soon as their contents have been
checkpointed and they are no longer needed. Without this setting the
transaction log files will continue to accumulate until some other
cleanup procedure removes them. See the SleepyCat documentation for the
{{EX:db_archive}} command for details.
865

866
867
868
869
870
871
872
873
Ideally the BDB cache must be
at least as large as the working set of the database, the log buffer size
should be large enough to accomodate most transactions without overflowing,
and the log directory must be on a separate physical disk from the main
database files. And both the database directory and the log directory
should be separate from disks used for regular system activities such as
the root, boot, or swap filesystems. See the FAQ-o-Matic and the SleepyCat
documentation for more details.
874
875


876
H4: olcDbNosync: { TRUE | FALSE }
877
878

This option causes on-disk database contents to not be immediately
879
synchronized with in memory changes upon change.  Setting this option
880
to {{EX:TRUE}} may improve performance at the expense of data integrity. This
881
882
directive has the same effect as using
>	olcDbConfig: set_flags DB_TXN_NOSYNC
883
884


885
H4: olcDbIDLcacheSize: <integer>
886

887
888
889
890
891
Specify the size of the in-memory index cache, in index slots. The
default is zero. A larger value will speed up frequent searches of
indexed entries. The optimal size will depend on the data and search
characteristics of the database, but using a number three times
the entry cache size is a good starting point.
892

893
\Example:
894

895
>	olcDbIDLcacheSize: 3000
896
897


898
H4: olcDbIndex: {<attrlist> | default} [pres,eq,approx,sub,none]
899
900
901
902
903
904
905

This directive specifies the indices to maintain for the given
attribute. If only an {{EX:<attrlist>}} is given, the default
indices are maintained.

\Example:

906
907
908
909
>	olcDbIndex: default pres,eq
>	olcDbIndex: uid
>	olcDbIndex: cn,sn pres,eq,sub
>	olcDbIndex: objectClass eq
910
911
912
913
914
915
916
917
918
919
920
921

The first line sets the default set of indices to maintain to
present and equality.  The second line causes the default (pres,eq)
set of indices to be maintained for the {{EX:uid}} attribute type.
The third line causes present, equality, and substring indices to
be maintained for {{EX:cn}} and {{EX:sn}} attribute types.  The
fourth line causes an equality index for the {{EX:objectClass}}
attribute type.

By default, no indices are maintained.  It is generally advised
that minimally an equality index upon objectClass be maintained.

922
923
924
925
926
927
928
929
>	olcDbindex: objectClass eq

If this setting is changed while slapd is running, an internal task
will be run to generate the changed index data. All server operations
can continue as normal while the indexer does its work.  If slapd is
stopped before the index task completes, indexing will have to be
manually completed using the slapindex tool.

930

931
H4: olcDbLinearIndex: { TRUE | FALSE }
932

933
934
935
936
937
938
939
940
941
942
If this setting is {{EX:TRUE}} slapindex will index one attribute
at a time. The default settings is {{EX:FALSE}} in which case all
indexed attributes of an entry are processed at the same time. When
enabled, each indexed attribute is processed individually, using
multiple passes through the entire database. This option improves
slapindex performance when the database size exceeds the BDB cache
size. When the BDB cache is large enough, this option is not needed
and will decrease performance. Also by default, slapadd performs
full indexing and so a separate slapindex run is not needed. With
this option, slapadd does no indexing and slapindex must be used.
943

944
945

H4: olcDbMode: <integer>
946
947
948
949
950
951

This directive specifies the file protection mode that newly
created database index files should have.

\Default:

952
953
>	olcDbMode: 0600

954

955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
H4: olcDbSearchStack: <integer>

Specify the depth of the stack used for search filter evaluation.
Search filters are evaluated on a stack to accomodate nested {{EX:AND}} /
{{EX:OR}} clauses. An individual stack is allocated for each server thread.
The depth of the stack determines how complex a filter can be evaluated
without requiring any additional memory allocation. Filters that are
nested deeper than the search stack depth will cause a separate stack to
be allocated for that particular search operation. These separate allocations
can have a major negative impact on server performance, but specifying
too much stack will also consume a great deal of memory. Each search
uses 512K bytes per level on a 32-bit machine, or 1024K bytes per level
on a 64-bit machine. The default stack depth is 16, thus 8MB or 16MB
per thread is used on 32 and 64 bit machines, respectively. Also the
512KB size of a single stack slot is set by a compile-time constant which
may be changed if needed; the code must be recompiled for the change
to take effect.

\Default:

>	olcDbSearchStack: 16


H4: olcDbShmKey: <integer>

Specify a key for a shared memory BDB environment. By default the BDB
environment uses memory mapped files. If a non-zero value is specified,
it will be used as the key to identify a shared memory region that will
house the environment.

\Example:

>	olcDbShmKey: 42


H4: Sample Entry

Howard Chu's avatar
Howard Chu committed
992
>dn: olcDatabase=hdb,cn=config
993
>objectClass: olcDatabaseConfig
994
>objectClass: olcHdbConfig
Howard Chu's avatar
Howard Chu committed
995
>olcDatabase: hdb
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
>olcSuffix: "dc=example,dc=com"
>olcDbDirectory: /usr/local/var/openldap-data
>olcDbCacheSize: 1000
>olcDbCheckpoint: 1024 10
>olcDbConfig: set_cachesize 0 10485760 0
>olcDbConfig: set_lg_bsize 2097152
>olcDbConfig: set_lg_dir /var/tmp/bdb-log
>olcDbConfig: set_flags DB_LOG_AUTOREMOVE
>olcDbIDLcacheSize: 3000
>olcDbIndex: objectClass eq


1008
1009
1010
H2: Access Control

Access to slapd entries and attributes is controlled by the
1011
1012
olcAccess attribute, whose values are a sequence of access directives.
The general form of the olcAccess configuration is:
1013

1014
1015
>	olcAccess: <access directive>
>	<access directive> ::= to <what>
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1016
>		[by <who> [<access>] [<control>] ]+
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
>	<what> ::= * |
>		[dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>]
>		[filter=<ldapfilter>] [attrs=<attrlist>]
>	<basic-style> ::= regex | exact
>	<scope-style> ::= base | one | subtree | children
>	<attrlist> ::= <attr> [val[.<basic-style>]=<regex>] | <attr> , <attrlist>
>	<attr> ::= <attrname> | entry | children
>	<who> ::= * | [anonymous | users | self
>			| dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>] 
>		[dnattr=<attrname>]
>		[group[/<objectclass>[/<attrname>][.<basic-style>]]=<regex>]
>		[peername[.<basic-style>]=<regex>]
>		[sockname[.<basic-style>]=<regex>]
>		[domain[.<basic-style>]=<regex>]
>		[sockurl[.<basic-style>]=<regex>]
>		[set=<setspec>]
>		[aci=<attrname>]
>	<access> ::= [self]{<level>|<priv>}
1035
1036
>	<level> ::= none | disclose | auth | compare | search | read | write | manage
>	<priv> ::= {=|+|-}{m|w|r|s|c|x|d|0}+
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
>	<control> ::= [stop | continue | break]

where the <what> part selects the entries and/or attributes to which
the access applies, the {{EX:<who>}} part specifies which entities
are granted access, and the {{EX:<access>}} part specifies the
access granted. Multiple {{EX:<who> <access> <control>}} triplets
are supported, allowing many entities to be granted different access
to the same set of entries and attributes. Not all of these access
control options are described here; for more details see the
{{slapd.access}}(5) man page.


H3: What to control access to

The <what> part of an access specification determines the entries
and attributes to which the access control applies.  Entries are
commonly selected in two ways: by DN and by filter.  The following
qualifiers select entries by DN:

>	to *
>	to dn[.<basic-style>]=<regex>
>	to dn.<scope-style>=<DN>

The first form is used to select all entries.  The second form may
be used to select entries by matching a regular expression against
the target entry's {{normalized DN}}.   (The second form is not
discussed further in this document.)  The third form is used to
select entries which are within the requested scope of DN.  The
<DN> is a string representation of the Distinguished Name, as
described in {{REF:RFC2253}}.

The scope can be either {{EX:base}}, {{EX:one}}, {{EX:subtree}},
or {{EX:children}}.  Where {{EX:base}} matches only the entry with
provided DN, {{EX:one}} matches the entries whose parent is the
provided DN, {{EX:subtree}} matches all entries in the subtree whose
root is the provided DN, and {{EX:children}} matches all entries
under the DN (but not the entry named by the DN).

For example, if the directory contained entries named:

>	0: o=suffix
>	1: cn=Manager,o=suffix
>	2: ou=people,o=suffix
>	3: uid=kdz,ou=people,o=suffix
>	4: cn=addresses,uid=kdz,ou=people,o=suffix
>	5: uid=hyc,ou=people,o=suffix

\Then:
. {{EX:dn.base="ou=people,o=suffix"}} match 2;
. {{EX:dn.one="ou=people,o=suffix"}} match 3, and 5;
. {{EX:dn.subtree="ou=people,o=suffix"}} match 2, 3, 4, and 5; and
. {{EX:dn.children="ou=people,o=suffix"}} match 3, 4, and 5.


Entries may also be selected using a filter:

>	to filter=<ldap filter>

where <ldap filter> is a string representation of an LDAP
search filter, as described in {{REF:RFC2254}}.  For example:

>	to filter=(objectClass=person)

Note that entries may be selected by both DN and filter by
including both qualifiers in the <what> clause.

>	to dn.one="ou=people,o=suffix" filter=(objectClass=person)

Attributes within an entry are selected by including a comma-separated
list of attribute names in the <what> selector:

>	attrs=<attribute list>

A specific value of an attribute is selected by using a single
attribute name and also using a value selector:

>	attrs=<attribute> val[.<style>]=<regex>

There are two special {{pseudo}} attributes {{EX:entry}} and
{{EX:children}}.  To read (and hence return) a target entry, the
subject must have {{EX:read}} access to the target's {{entry}}
attribute.  To add or delete an entry, the subject must have
{{EX:write}} access to the entry's {{EX:entry}} attribute AND must
have {{EX:write}} access to the entry's parent's {{EX:children}}
attribute.  To rename an entry, the subject must have {{EX:write}}
access to entry's {{EX:entry}} attribute AND have {{EX:write}}
access to both the old parent's and new parent's {{EX:children}}
attributes.  The complete examples at the end of this section should
help clear things up.

Lastly, there is a special entry selector {{EX:"*"}} that is used to
select any entry.  It is used when no other {{EX:<what>}}
selector has been provided.  It's equivalent to "{{EX:dn=.*}}"


H3: Who to grant access to

The <who> part identifies the entity or entities being granted
access. Note that access is granted to "entities" not "entries."
The following table summarizes entity specifiers:

!block table; align=Center; coltags="EX,N"; \
	title="Table 5.3: Access Entity Specifiers"
Specifier|Entities
*|All, including anonymous and authenticated users
anonymous|Anonymous (non-authenticated) users
users|Authenticated users
self|User associated with target entry
dn[.<basic-style>]=<regex>|Users matching a regular expression
dn.<scope-style>=<DN>|Users within scope of a DN
!endblock

The DN specifier behaves much like <what> clause DN specifiers.

Other control factors are also supported.  For example, a {{EX:<who>}}
can be restricted by an entry listed in a DN-valued attribute in
the entry to which the access applies:

>	dnattr=<dn-valued attribute name>

The dnattr specification is used to give access to an entry
whose DN is listed in an attribute of the entry (e.g., give
access to a group entry to whoever is listed as the owner of
the group entry).

Some factors may not be appropriate in all environments (or any).
For example, the domain factor relies on IP to domain name lookups.
As these can easily spoofed, the domain factor should not be avoided.


H3: The access to grant

The kind of <access> granted can be one of the following:

!block table; colaligns="LRL"; coltags="EX,EX,N"; align=Center; \
	title="Table 5.4: Access Levels"
1173
1174
1175
1176
1177
1178
1179
1180
1181
Level		Privileges	Description
none		=0			no access
disclose	=d			needed for information disclosure on error
auth		=dx			needed to authenticate (bind)
compare		=cdx		needed to compare
search		=scdx		needed to apply search filters
read		=rscdx		needed to read search results
write		=wrscdx		needed to modify/rename
manage		=mwrscdx	needed to manage
1182
1183
!endblock

1184
1185
1186
1187
Each level implies all lower levels of access. So, for example,
granting someone {{EX:write}} access to an entry also grants them
{{EX:read}}, {{EX:search}}, {{EX:compare}}, {{EX:auth}} and
{{EX:disclose}} access.  However, one may use the privileges specifier
1188
1189
1190
1191
1192
1193
1194
to grant specific permissions.


H3: Access Control Evaluation

When evaluating whether some requester should be given access to
an entry and/or attribute, slapd compares the entry and/or attribute
1195
1196
to the {{EX:<what>}} selectors given in the configuration.  For
each entry, access controls provided in the database which holds
1197
the entry (or the first database if not held in any database) apply
1198
first, followed by the global access directives (which are held in
1199
1200
1201
1202
1203
1204
the {{EX:frontend}} database definition).  Within this priority,
access directives are examined in the order in which they appear
in the configuration attribute.  Slapd stops with the first
{{EX:<what>}} selector that matches the entry and/or attribute. The
corresponding access directive is the one slapd will use to evaluate
access.
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219

Next, slapd compares the entity requesting access to the {{EX:<who>}}
selectors within the access directive selected above in the order
in which they appear. It stops with the first {{EX:<who>}} selector
that matches the requester. This determines the access the entity
requesting access has to the entry and/or attribute.

Finally, slapd compares the access granted in the selected
{{EX:<access>}} clause to the access requested by the client. If
it allows greater or equal access, access is granted. Otherwise,
access is denied.

The order of evaluation of access directives makes their placement
in the configuration file important. If one access directive is
more specific than another in terms of the entries it selects, it
1220
should appear first in the configuration. Similarly, if one {{EX:<who>}}
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
selector is more specific than another it should come first in the
access directive. The access control examples given below should
help make this clear.



H3: Access Control Examples

The access control facility described above is quite powerful.  This
section shows some examples of its use for descriptive purposes.

A simple example:

1234
>	olcAccess: to * by * read
1235
1236
1237

This access directive grants read access to everyone.

1238
>	olcAccess: to *
1239
1240
1241
1242
1243
>		by self write
>		by anonymous auth
>		by * read

This directive allows the user to modify their entry, allows anonymous
1244
to authenticate against these entries, and allows all others to
1245
1246
1247
1248
1249
1250
1251
1252
1253
read these entries.  Note that only the first {{EX:by <who>}} clause
which matches applies.  Hence, the anonymous users are granted
{{EX:auth}}, not {{EX:read}}.  The last clause could just as well
have been "{{EX:by users read}}".

It is often desirable to restrict operations based upon the level
of protection in place.  The following shows how security strength
factors (SSF) can be used.

1254
>	olcAccess: to *
1255
1256
1257
1258
1259
>		by ssf=128 self write
>		by ssf=64 anonymous auth
>		by ssf=64 users read

This directive allows users to modify their own entries if security
1260
protections of strength 128 or better have been established,
1261
allows authentication access to anonymous users, and read access
1262
1263
when strength 64 or better security protections have been established.  If
the client has not establish sufficient security protections, the
1264
1265
implicit {{EX:by * none}} clause would be applied.

1266
The following example shows the use of style specifiers to select
1267
1268
1269
the entries by DN in two access directives where ordering is
significant.

1270
>	olcAccess: to dn.children="dc=example,dc=com"
1271
> 		by * search
1272
>	olcAccess: to dn.children="dc=com"
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
> 		by * read

Read access is granted to entries under the {{EX:dc=com}} subtree,
except for those entries under the {{EX:dc=example,dc=com}} subtree,
to which search access is granted.  No access is granted to
{{EX:dc=com}} as neither access directive matches this DN.  If the
order of these access directives was reversed, the trailing directive
would never be reached, since all entries under {{EX:dc=example,dc=com}}
are also under {{EX:dc=com}} entries.

1283
1284
Also note that if no {{EX:olcAccess: to}} directive matches or no {{EX:by
<who>}} clause, {{B:access is denied}}.  That is, every {{EX:olcAccess:
1285
to}} directive ends with an implicit {{EX:by * none}} clause and
1286
every access list ends with an implicit {{EX:olcAccess: to * by * none}}
1287
1288
1289
1290
1291
1292
1293
directive.

The next example again shows the importance of ordering, both of
the access directives and the {{EX:by <who>}} clauses.  It also
shows the use of an attribute selector to grant access to a specific
attribute and various {{EX:<who>}} selectors.

1294
>	olcAccess: to dn.subtree="dc=example,dc=com" attr=homePhone
1295
1296
1297
>		by self write
>		by dn.children=dc=example,dc=com" search
>		by peername.regex=IP:10\..+ read
1298
>	olcAccess: to dn.subtree="dc=example,dc=com"
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
>		by self write
>		by dn.children="dc=example,dc=com" search
>		by anonymous auth

This example applies to entries in the "{{EX:dc=example,dc=com}}"
subtree. To all attributes except {{EX:homePhone}}, an entry can
write to itself, entries under {{EX:example.com}} entries can search
by them, anybody else has no access (implicit {{EX:by * none}})
excepting for authentication/authorization (which is always done
anonymously).  The {{EX:homePhone}} attribute is writable by the
entry, searchable by entries under {{EX:example.com}}, readable by
clients connecting from network 10, and otherwise not readable
(implicit {{EX:by * none}}).  All other access is denied by the
implicit {{EX:access to * by * none}}.

Sometimes it is useful to permit a particular DN to add or
remove itself from an attribute. For example, if you would like to
create a group and allow people to add and remove only
their own DN from the member attribute, you could accomplish
it with an access directive like this:

1320
>	olcAccess: to attr=member,entry
1321
1322
1323
1324
1325
1326
1327
1328
1329
> 		by dnattr=member selfwrite

The dnattr {{EX:<who>}} selector says that the access applies to
entries listed in the {{EX:member}} attribute. The {{EX:selfwrite}} access
selector says that such members can only add or delete their
own DN from the attribute, not other values. The addition of
the entry attribute is required because access to the entry is
required to access any of the entry's attributes.

Howard Chu's avatar
Howard Chu committed
1330
1331
1332
1333


H3: Access Control Ordering

1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
Since the ordering of {{EX:olcAccess}} directives is essential to their
proper evaluation, but LDAP attributes normally do not preserve the
ordering of their values, OpenLDAP uses a custom schema extension to
maintain a fixed ordering of these values. This ordering is maintained
by prepending a {{EX:"{X}"}} numeric index to each value, similarly to
the approach used for ordering the configuration entries. These index
tags are maintained automatically by slapd and do not need to be specified
when originally defining the values. For example, when you create the
settings

>	olcAccess: to attr=member,entry
> 		by dnattr=member selfwrite
>	olcAccess: to dn.children="dc=example,dc=com"
> 		by * search
>	olcAccess: to dn.children="dc=com"
> 		by * read

when you read them back using slapcat or ldapsearch they will contain

>	olcAccess: {0}to attr=member,entry
> 		by dnattr=member selfwrite
>	olcAccess: {1}to dn.children="dc=example,dc=com"
> 		by * search
>	olcAccess: {2}to dn.children="dc=com"
> 		by * read

The numeric index may be used to specify a particular value to change
when using ldapmodify to edit the access rules. This index can be used
Howard Chu's avatar
Howard Chu committed
1362
1363
instead of (or in addition to) the actual access value. Using this 
numeric index is very helpful when multiple access rules are being managed.
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375

For example, if we needed to change the second rule above to grant
write access instead of search, we could try this LDIF:

>	changetype: modify
>	delete: olcAccess
>	olcAccess: to dn.children="dc=example,dc=com" by * search
>	-
>	add: olcAccess
>	olcAccess: to dn.children="dc=example,dc=com" by * write
>	-

Howard Chu's avatar
Howard Chu committed
1376
But this example {{B:will not}} guarantee that the existing values remain in
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
their original order, so it will most likely yield a broken security
configuration. Instead, the numeric index should be used:

>	changetype: modify
>	delete: olcAccess
>	olcAccess: {1}
>	-
>	add: olcAccess
>	olcAccess: {1}to dn.children="dc=example,dc=com" by * write
>	-

Howard Chu's avatar
Howard Chu committed
1388
This example deletes whatever rule is in value #1 of the {{EX:olcAccess}}
1389
attribute (regardless of its value) and adds a new value that is
Howard Chu's avatar
Howard Chu committed
1390
explicitly inserted as value #1. The result will be
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400

>	olcAccess: {0}to attr=member,entry
> 		by dnattr=member selfwrite
>	olcAccess: {1}to dn.children="dc=example,dc=com"
> 		by * write
>	olcAccess: {2}to dn.children="dc=com"
> 		by * read

which is exactly what was intended.

1401
1402
1403
1404
1405
1406
!if 0
For more details on how to use the {{EX:access}} directive,
consult the {{Advanced Access Control}} chapter.
!endif


1407
H2: Configuration Example
1408

1409
The following is an example configuration, interspersed
1410
1411
1412
1413
1414
1415
with explanatory text. It defines two databases to handle
different parts of the {{TERM:X.500}} tree; both are {{TERM:BDB}}
database instances. The line numbers shown are provided for
reference only and are not included in the actual file. First, the
global configuration section:

1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
E:  1.	# example config file - global configuration entry
E:  2.	dn: cn=config
E:  3.	objectClass: olcGlobal
E:  4.	cn: config
E:  5.	olcReferral: ldap://root.openldap.org
E:  6.	

Line 1 is a comment. Lines 2-4 identify this as the global
configuration entry.
The {{EX:olcReferral:}} directive on line 5
1426
1427
1428
means that queries not local to one of the databases defined
below will be referred to the LDAP server running on the
standard port (389) at the host {{EX:root.openldap.org}}.
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
Line 6 is a blank line, indicating the end of this entry.

E:  7.	# internal schema
E:  8.	dn: cn=schema,cn=config
E:  9.	objectClass: olcSchemaConfig
E: 10.	cn: schema
E: 11.	

Line 7 is a comment. Lines 8-10 identify this as the root of
the schema subtree. The actual schema definitions in this entry
are hardcoded into slapd so no additional attributes are specified here.
Line 11 is a blank line, indicating the end of this entry.

E: 12.	# include the core schema
E: 13.	include: file:///usr/local/etc/openldap/schema/core.ldif
E: 14.	

Line 12 is a comment. Line 13 is an LDIF include directive which
accesses the {{core}} schema definitions in LDIF format. Line 14
is a blank line.

Next comes the database definitions. The first database is the
special {{EX:frontend}} database whose settings are applied globally
to all the other databases.

E: 15.	# global database parameters
E: 16.	dn: olcDatabase=frontend,cn=config
E: 17.	objectClass: olcDatabaseConfig
E: 18.	olcDatabase: frontend
E: 19.	olcAccess: to * by * read
E: 20.	

Line 15 is a comment. Lines 16-18 identify this entry as the global
database entry. Line 19 is a global access control. It applies to all
entries (after any applicable database-specific access controls).

The next entry defines a BDB backend that will handle queries for things
in the "dc=example,dc=com" portion of the tree. Indices are to be maintained
for several attributes, and the {{EX:userPassword}} attribute is to be
protected from unauthorized access.

E: 21.	# BDB definition for example.com
E: 22.	dn: olcDatabase=bdb,cn=config
E: 23.	objectClass: olcDatabaseConfig
Howard Chu's avatar
Howard Chu committed
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
E: 24.	objectClass: olcBdbConfig
E: 25.	olcDatabase: bdb
E: 26.	olcSuffix: "dc=example,dc=com"
E: 27.	olcDbDirectory: /usr/local/var/openldap-data
E: 28.	olcRootDN: "cn=Manager,dc=example,dc=com"
E: 29.	olcRootPW: secret
E: 30.	olcDbIndex: uid pres,eq
E: 31.	olcDbIndex: cn,sn,uid pres,eq,approx,sub
E: 32.	olcDbIndex: objectClass eq
E: 33.	olcAccess: to attr=userPassword
E: 34.	  by self write
E: 35.	  by anonymous auth
E: 36.	  by dn.base="cn=Admin,dc=example,dc=com" write
E: 37.	  by * none
E: 38.	olcAccess: to *
E: 39.	  by self write
E: 40.	  by dn.base="cn=Admin,dc=example,dc=com" write
E: 41.	  by * read
E: 42.	

Line 21 is a comment. Lines 22-25 identify this entry as a BDB database
configuration entry.  Line 26 specifies the DN suffix
for queries to pass to this database. Line 27 specifies the directory
1496
1497
in which the database files will live.

Howard Chu's avatar
Howard Chu committed
1498
Lines 28 and 29 identify the database {{super-user}} entry and associated
1499
1500
1501
password. This entry is not subject to access control or size or
time limit restrictions.

Howard Chu's avatar
Howard Chu committed
1502
Lines 30 through 32 indicate the indices to maintain for various
1503
1504
attributes.

Howard Chu's avatar
Howard Chu committed
1505
Lines 33 through 41 specify access control for entries in this
1506
1507
1508
1509
1510
1511
1512
1513
database.  As this is the first database, the controls also apply
to entries not held in any database (such as the Root DSE).  For
all applicable entries, the {{EX:userPassword}} attribute is writable
by the entry itself and by the "admin" entry.  It may be used for
authentication/authorization purposes, but is otherwise not readable.
All other attributes are writable by the entry and the "admin"
entry, but may be read by all users (authenticated or not).

Howard Chu's avatar
Howard Chu committed
1514
Line 42 is a blank line, indicating the end of this entry.
1515

1516
1517
1518
The next section of the example configuration file defines another
BDB database. This one handles queries involving the
{{EX:dc=example,dc=net}} subtree but is managed by the same entity
Howard Chu's avatar
Howard Chu committed
1519
as the first database.  Note that without line 51, the read access
1520
1521
1522
1523
1524
would be allowed due to the global access rule at line 19.

E: 42.	# BDB definition for example.net
E: 43.	dn: olcDatabase=bdb,cn=config
E: 44.	objectClass: olcDatabaseConfig
Howard Chu's avatar
Howard Chu committed
1525
1526
1527
1528
1529
1530
1531
E: 45.	objectClass: olcBdbConfig
E: 46.	olcDatabase: bdb
E: 47.	olcSuffix: "dc=example,dc=net"
E: 48.	olcDbDirectory: /usr/local/var/openldap-data-net
E: 49.	olcRootDN: "cn=Manager,dc=example,dc=com"
E: 50.	olcDbIndex: objectClass eq
E: 51.	olcAccess: to * by users read