# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.8 2003/05/24 23:19:14 kurt Exp $
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#

include	    	/etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

pidfile	    	/var/run/slapd/slapd.pid
argsfile    	/var/run/slapd/slapd.args

# SSL certificate and key with the official (as reported by a reverse
# DNS lookup) hostname in the CN field.
# Make sure the key file is not world-readable.  Best also if the
# ldap user can't write to it.  Something like the following should do:
# chown root; chgrp ldap; chmod 640
#   REPLICA:  Each replica should have it's own SSL cert/key
#

TLSCertificateFile      /etc/openldap/certs/server.crt
TLSCertificateKeyFile   /etc/openldap/certs/server.key

# Load dynamic backend modules:
# modulepath	/usr/sbin/openldap
# moduleload	back_bdb.la
# moduleload	back_ldap.la
# moduleload	back_ldbm.la
# moduleload	back_passwd.la
# moduleload	back_shell.la

# This is a bit of a hack to restrict the SASL mechanisms that the
# server advertises to just GSSAPI.  Otherwise it also advertises
# DIGEST-MD5, which the clients prefer.  Then you have to add "-Y
# GSSAPI" to all of your ldapsearch/ldapmodify/etc. command lines, which
# is annoying.  The default for this is noanonymous,noplain so the
# addition of noactive is what makes DIGEST-MD5 and the others go away.
#

sasl-secprops noanonymous,noplain,noactive

# Map SASL authentication DNs to LDAP DNs
#   This leaves "username/admin" principals untouched
#

saslRegexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=example,dc=com

# This should be a  ^  plus, not a star, but slapd won't accept it

# Users with /admin principals can change anything

# Users can change their shell, anyone else can see it

access to attr=loginShell
        by dn="uid=[^/]+/admin,cn=GSSAPI,cn=auth" write
        by self write
        by * read

# Only the user can see their employeeNumber

access to attr=employeeNumber
        by dn="uid=[^/]+/admin,cn=GSSAPI,cn=auth" write
        by self read
        by * none

# Default read access for everything else

access to *
        by dn="uid=[^/]+/admin,cn=GSSAPI,cn=auth" write
        by * read

# Limit the number of threads
# The default is 16 and that has been reported on the openldap mailing
# list to be too many for a machine with < 1 GB of RAM
#

threads 6
 
# Disconnect idle connections after 4 hours.  Otherwise connections
# from nss_ldap keep piling up and we eventually exceed our open file
# handle limit.  Increasing that limit above 1024 is difficult on Linux
# because slapd uses select(2) and the FD_SETSIZE is hard-coded at 1024.
# Presumably slapd will eventually be converted to use poll(2) instead
# of select, which doesn't have that limit.  But until then this is our
# workaround.
#

idletimeout 14400
 
# Sample security restrictions
#	Require integrity protection (prevent hijacking)
#	Require 112-bit (3DES or better) encryption for updates
#	Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#	Root DSE: allow anyone to read it
#	Subschema (sub)entry DSE: allow anyone to read it
#	Other DSEs:
#		Allow self write access
#		Allow authenticated users read access
#		Allow anonymous users to authenticate
#	Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#	by self write
#	by users read
#	by anonymous auth
#
# if no access controls are present, the default policy is:
#	Allow read by all
#
# rootdn can always write!

# Allow LDAPv2 for Mozilla's address book
#

allow bind_v2


#######################################################################
# ldbm database definitions
#######################################################################

database	bdb
suffix		"dc=example,dc=com"
rootdn		"cn=Manager,dc=example,dc=com"

# Increase the size of slapd's entry cache.  Note that this is a
# seperate cache from BDB's cache, who's size is configured in DB_CONFIG
#

cachesize 10000

# BDB tuning
# It would be preferable to do all BDB tuning in BDB's configuration
# file, but there are some settings that aren't supported there.
# BDB's config file is var/openldap-data/DB_CONFIG
# Docs:  http://www.openldap.org/faq/data/cache/893.html
#
# Turn on checkpointing, which is off by default.  This reduces the
# amount of time it takes db_recover to run on a restart.
#

checkpoint 256 15

# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
#

rootpw		secret

# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
#

directory	/var/lib/openldap-data

# Indices to maintain
index   objectClass,uid,uidNumber,gidNumber,memberUid   eq
index   cn,mail,surname,givenname                       eq,subinitial