# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.

include		/etc/openldap/schema/core.schema
include		/etc/openldap/schema/cosine.schema
include		/etc/openldap/schema/inetorgperson.schema
include		/etc/openldap/schema/nis.schema

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

#pidfile	/var/run/slapd.pid
#argsfile	/var/run/slapd.args

# Create a replication log in /var/lib/ldap for use by slurpd.
#   REPLICA: Comment this out on the replicas
replogfile	/var/lib/ldap/master-slapd.replog

# SSL certificate and key with the official (as reported by a reverse
# DNS lookup) hostname in the CN field.
# Make sure the key file is not world-readable.  Best also if the
# ldap user can't write to it.  Something like the following should do:
# chown root; chgrp ldap; chmod 640
#   REPLICA:  Each replica should have it's own SSL cert/key
TLSCertificateFile /usr/share/ssl/certs/slapd-cert-ldap1.pem
TLSCertificateKeyFile /usr/share/ssl/certs/slapd-key-ldap1.pem

#
# Access Control
#

# This is a bit of a hack to restrict the SASL mechanisms that the
# server advertises to just GSSAPI.  Otherwise it also advertises
# DIGEST-MD5, which the clients prefer.  Then you have to add "-Y
# GSSAPI" to all of your ldapsearch/ldapmodify/etc. command lines, which
# is annoying.  The default for this is noanonymous,noplain so the
# addition of noactive is what makes DIGEST-MD5 and the others go away.
sasl-secprops noanonymous,noplain,noactive

# Map SASL authentication DNs to LDAP DNs
#   This leaves "username/admin" principals untouched
saslRegexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=example,dc=com
# This should be a  ^  plus, not a star, but slapd won't accept it

# REPLICA:
#   On replica servers replace the first line of each section below (the
#   line that allows /admin principals to write to things) with the
#   following line (allowing the primary server to write instead).  Thus
#   admins can make changes on the primary server, and the primary
#   server can push changes to the replicas.
#by dn.exact="uid=host/foo.example.com,cn=GSSAPI,cn=auth" write

# Users with /admin principals can change anything

# Users can change their shell, anyone else can see it
access to attrs=loginShell
	by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write
	by self write
	by * read
# Only the user can see their employeeNumber
access to attrs=employeeNumber
	by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write
	by self read
	by * none
# Default read access for everything else
access to *
	by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write
	by * read

# Limit number of search results to prevent trolling of directory
# by spammers, etc.
#sizelimit 10
# Alternatively, specify a large enough size limit to ensure we can dump
# the entire directory
sizelimit 5000

# Limit the number of threads
# The default is 16 and that has been reported on the openldap mailing
# list to be too many for a machine with < 1 GB of RAM
threads 8
                                                                                
# Disconnect idle connections after 4 hours.  Otherwise connections
# from nss_ldap keep piling up and we eventually exceed our open file
# handle limit.  Increasing that limit above 1024 is difficult on Linux
# because slapd uses select(2) and the FD_SETSIZE is hard-coded at 1024.
# Presumably slapd will eventually be converted to use poll(2) instead
# of select, which doesn't have that limit.  But until then this is our
# workaround.
idletimeout 14400
                                                                                
# Turn off logging.  We can always turn it back on when we need to see
# what's going on.
# 256 is the default.  256 logs connections, operations and results,
# it would be nice to log only operations but there isn't a level just
# for operations.
#loglevel 0
                                                                                
# Allow LDAPv2 for Mozilla's address book
allow bind_v2

#######################################################################
# ldbm database definitions
#######################################################################

database	bdb
suffix		"dc=example,dc=com"

# Increase the size of slapd's entry cache.  Note that this is a
# seperate cache from BDB's cache, who's size is configured in DB_CONFIG
cachesize 10000

# BDB tuning
# It would be preferable to do all BDB tuning in BDB's configuration
# file, but there are some settings that aren't supported there.
# BDB's config file is var/openldap-data/DB_CONFIG
# Docs:  http://www.openldap.org/faq/data/cache/893.html
#
# Turn on checkpointing, which is off by default.  This reduces the
# amount of time it takes db_recover to run on a restart.
checkpoint 256 15

# Uncomment these only for the initial load, then comment them back
# out and restart slapd.
#rootdn		"cn=Manager,dc=example,dc=com"
#rootpw		Secret!

# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd/tools. Mode 700 recommended.
directory	/var/lib/ldap
# Indices to maintain
index	objectClass,uid,uidNumber,gidNumber,memberUid	eq
index	cn,mail,surname,givenname			eq,subinitial

# Replicas to which we should propagate changes
# Make sure you have a cronjob set up to keep a ticket for this principal
# up to date and that slurpd is started with a KRB5CCNAME environment
# variable pointing to the cache file containing that ticket.
#   REPLICA:  Comment this out on replicas
replica host=ldap2.example.com:389 tls=critical
	bindmethod=sasl saslmech=GSSAPI
	authcId=host/foo.example.com@EXAMPLE.COM

# The purpose of the updatedn is to tell slapd not to send the updateref
# if that DN tries to make changes.  Any other user which attempts to
# submit a change will be refered to the master LDAP server found in
# updateref.
#   REPLICA:  Uncomment these on replicas
#updatedn "uid=host/foo.example.com"
#updateref ldaps://ldap1.example.com/