Commit c204f406 authored by Jong Hyuk Choi's avatar Jong Hyuk Choi
Browse files

keeps syncrepl manpage sections current

parent f2f195ac
......@@ -114,7 +114,7 @@ The default is 0600.
.TP
.B searchstack <depth>
Specify the depth of the stack used for search filter evaluation.
Search filters are evaluated on a stack to accomodate nested AND / OR
Search filters are evaluated on a stack to accommodate nested AND / OR
clauses. An individual stack is assigned to each server thread.
The depth of the stack determines how complex a filter can be
evaluated without requiring any additional memory allocation. Filters that
......@@ -130,6 +130,19 @@ Specify a key for a shared memory BDB environment. By default the
BDB environment uses memory mapped files. If a non-zero value is
specified, it will be used as the key to identify a shared memory
region that will house the environment.
.TP
.B sessionlog <sid> <limit>
Specify a session log store for the syncrepl replication provider
site which contains information on the entries that have been scoped
out of the content of the replication session identified by {{EX:<sid>}}.
The number of entries in the session log store is limited
by {{EX:<limit>}}. Excessive entries are removed from the store
in the FIFO order. Both {{EX:<sid>}} and {{EX:<limit>}} are
non-negative integers. {{EX:<sid>}} has no more than three digits.
Refer to the "OpenLDAP Administrator's Guide" for detailed information
on setting up a replicated slapd directory service using the syncrepl
replication engine and the session log store.
.B
.SH FILES
.TP
ETCDIR/slapd.conf
......
......@@ -83,7 +83,7 @@ allow (default none).
.B bind_v2
allows acceptance of LDAPv2 bind requests. Note that
.BR slapd (8)
does not truely implement LDAPv2 (RFC 1777), now Historic (RFC 3494).
does not truly implement LDAPv2 (RFC 1777), now Historic (RFC 3494).
.B bind_anon_cred
allows anonymous bind when credentials are not empty (e.g.
when DN is empty).
......@@ -316,7 +316,7 @@ with
.B exact
or
.B base
(which are synonims), to require an exact match; with
(which are synonyms), to require an exact match; with
.BR one,
to require exactly one level of depth match; with
.BR subtree,
......@@ -350,7 +350,7 @@ where
is the number of seconds slapd will spend answering a search request.
If no time limit is explicitly requested by the client, the
.BR soft
limit is used; if the requested time limit exceedes the
limit is used; if the requested time limit exceeds the
.BR hard
limit, an "Administrative limit exceeded" is returned.
If the
......@@ -375,7 +375,7 @@ is the maximum number of entries slapd will return answering a search
request.
If no size limit is explicitly requested by the client, the
.BR soft
limit is used; if the requested size limit exceedes the
limit is used; if the requested size limit exceeds the
.BR hard
limit, an "Administrative limit exceeded" is returned.
If the
......@@ -729,7 +729,7 @@ appear in the file, stopping at the first successful match.
Used to specify Cyrus SASL security properties.
The
.B none
flag (without any other properities) causes the flag properites
flag (without any other properties) causes the flag properties
default, "noanonymous,noplain", to be cleared.
The
.B noplain
......@@ -999,7 +999,7 @@ createTimestamp attributes for entries. By default, lastmod is on.
.TP
.B maxderefdepth <depth>
Specifies the maximum number of aliases to dereference when trying to
resolve an entry, used to avoid inifinite alias loops. The default is 1.
resolve an entry, used to avoid infinite alias loops. The default is 1.
.TP
.B readonly on | off
This option puts the database into "read-only" mode. Any attempts to
......@@ -1098,7 +1098,7 @@ password can only be set if the rootdn is within the namingContext
This option accepts all RFC 2307 userPassword formats known to
the server (see
.B password-hash
desription) as well as cleartext.
description) as well as cleartext.
.BR slappasswd (8)
may be used to generate a hash of a password. Cleartext
and \fB{CRYPT}\fP passwords are not recommended. If empty
......@@ -1123,89 +1123,91 @@ associated with a single namingContext should have identical rootdns.
Behavior of other LDAP operations is unaffected by this setting. In
particular, it is not possible to use moddn to move an entry from
one subordinate to another subordinate within the namingContext.
.TP
.B updatedn <dn>
This option is only applicable in a slave
.B slapd.
It specifies the DN permitted to update (subject to access controls)
the replica (typically, this is the DN
.BR slurpd (8)
binds to update the replica).
.TP
.B updateref <url>
Specify the referral to pass back when
.BR slapd (8)
is asked to modify a replicated local database.
If specified multiple times, each url is provided.
.HP
.hy 0
.B syncrepl id=<replica ID>
.B provider=ldap[s]://<hostname>[:port]
.B [updatedn=<dn>]
.B [binddn=<dn>]
.B [bindmethod=simple|sasl] [binddn=<simple DN>] [credentials=<simple passwd>]
.B [saslmech=<SASL mech>] [secprops=<properties>] [realm=<realm>]
.B [authcId=<authentication ID>] [authzId=<authorization ID>]
.B [type=refreshOnly|refreshAndPersist]
.B [interval=dd:hh:mm:ss]
.B [searchbase=<base DN>]
.B [filter=<filter str>]
.B [scope=sub|one|base]
.B [attrs=<attr list>]
.B [attrsonly]
.B [sizelimit=<limit>]
.B [timelimit=<limit>]
.B [schemachecking=on|off]
.B [scope=sub|one|base]
.B [type=refreshOnly|refreshAndPersist]
.B [interval=dd:hh:mm]
.B [updatedn=<dn>]
.B [bindmethod=simple|sasl]
.B [binddn=<dn>]
.B [saslmech=<mech>]
.B [authcid=<identity>]
.B [authzid=<identity>]
.B [credentials=<passwd>]
.B [realm=<realm>]
.B [secprops=<properties>]
.RS
Specify an LDAP Sync replication session between the specified replication provider
site and this database (a replication consumer).
The replication consumer communicates with the replication provider to perform
an initial population and the following periodic or persistent synchronizations.
The LDAP Sync replication engine is based on the LDAP Content Sync protocol :
a stateful, pull, incremental, and partial synchronization protocol which
supports both polling and listening modes of operations.
It currently supports entry-level synchronization.
A directory server wide
Specify the current database as a replica which is kept up-to-date with the
master content by establishing the current
.BR slapd (8)
as a replication consumer site running a
.B syncrepl
replication engine.
The replica content is kept synchronized to the master content using
the LDAP Content Synchronization protocol. Refer to the
"OpenLDAP Administrator's Guide" for detailed information on
setting up a replicated
.B slapd
directory service using the
.B syncrepl
replication engine.
.B id
uniquely identifies this LDAP Sync replication specification
in the directory server instance. The specification of an LDAP Sync replication
session is based on the search specification which defines the replica content.
The replicated entries are those directory entries of the subtree under the
.B searchbase
with the
.B scope
that match the
.B filter.
Only the attributes specified in the
.B attrs
are included in the replica content.
There are two synchronization modes depending on the incremental
synchronization semantics after the intial content population.
The incremental synchronization is performed periodically with
the
.B interval
when the sync
.B type
is
.B refreshOnly.
Alternatively, the provider sends synchronization messages to the consumer
upon updates to the replicated contents when the sync
.B type
is
.B refreshAndPersist.
The replication provider site is specified by
identifies the current
.B syncrepl
directive within the database.
It is a non-negative integer having no more than three digits.
.B provider
as an LDAP URI.
If
.B schemachecking
is
.B on,
every replicated entry will be checked for its schema
when it is stored in the consumer replica.
The consumer slapd should retrieve attributes of an entry
that are required by the schema definition.
If
specifies the replication provider site containing the master content
as an LDAP URI. If <port> is not given, the standard LDAP port number
(389 or 636) is used. The content of the
.B syncrepl
replica is defined using a search
specification as its result set. The consumer
.B slapd
will send search requests to the provider
.B slapd
according to the search specification. The search specification includes
.B searchbase, scope, filter, attrs, attrsonly, sizelimit,
and
.B timelimit
parameters as in the normal search specification.
The search specification for the LDAP Content Synchronization operation
has the same value syntax and the same default values as in the
.BR ldapsearch (1)
client search tool.
The LDAP Content Synchronization protocol has two operation types.
In the
.B refreshOnly
operation, the next synchronization search operation
is periodically rescheduled at an interval time (specified by
.B interval
parameter; 1 day by default)
after each synchronization operation finishes.
In the
.B refreshAndPersist
operation, a synchronization search remains persistent in the provider slapd.
Further updates to the master replica will generate
.B searchResultEntry
to the consumer slapd as the search responses to the persistent
synchronization search. The schema checking can be enforced at the LDAP Sync
consumer site by turning on the
.B schemachecking
is
.B off,
entries will be stored without checking the schema conformance.
parameter. The default is off.
The
.B updatedn
parameter specifies the DN in the consumer site
which is allowed to make changes to the replica.
The DN should have read/write access to the replica database.
A
.B bindmethod
of
......@@ -1214,27 +1216,45 @@ requires the options
.B binddn
and
.B credentials
and should only be used when adequate security services (e.g. TLS or IPSEC) are in place.
and should only be used when adequate security services
(e.g. TLS or IPSEC) are in place.
A
.B bindmethod
of
.B sasl
requires the option
.B saslmech.
Depending on the mechanism, an authentication identity and/or
credentials can be specified using
.B authcid
and
.B credentials.
The
.B authzid
parameter may be used to specify an authorization identity.
Specific security properties (as with the
.B sasl secprops
.B sasl-secprops
keyword above) for a SASL bind can be set with the
.B secprops
option. A non default SASL realm can be set with the
.B realm
option.
If the
.B mechanism
will use Kerberos, a kerberos instance should be given in
.B authcId.
.B updatedn
specifies the DN used to update (subject to access controls) the
replica at the consumer replica.
.RE
.TP
.B updatedn <dn>
This option is only applicable in a slave
.B slapd.
It specifies the DN permitted to update (subject to access controls)
the replica (typically, this is the DN
.BR slurpd (8)
binds to update the replica).
.TP
.B updateref <url>
Specify the referral to pass back when
.BR slapd (8)
is asked to modify a replicated local database.
If specified multiple times, each url is provided.
.SH DATABASE-SPECIFIC OPTIONS
Each database may allow specific configuration options; they are
documented separately in the backends' manual pages.
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment