root/trunk/configs/ldap/slapd.conf

# slapd.conf for Loblaw
# Copyright (C) 2005, 2006, 2007, Software Freedom Law Center, Inc.
#
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
# WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
# AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
# DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA
# OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
# TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
#
# License: ISC

TLSCipherSuite HIGH:+SSLv2:+SSLv3:+MEDIUM
TLSCertificateFile      /etc/ldap/server.pem
TLSCertificateKeyFile   /etc/ldap/server.pem
TLSCACertificateFile    /etc/ldap/server.pem
TLSVerifyClient never
sasl-secprops noplain
#disallow bind_simple

password-hash  {SSHA}

allow bind_v2

include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
#include         /etc/ldap/schema/mozilla.schema
include         /etc/ldap/schema/misc.schema
include         /etc/ldap/schema/loblawperson.schema
include         /etc/ldap/schema/publickey.schema

schemacheck     on

pidfile         /home/ldap/run/slapd.pid

argsfile        /home/ldap/run/slapd/slapd.args

loglevel        0

modulepath      /usr/lib/ldap
moduleload      back_bdb

defaultsearchbase       "ou=people,dc=example,dc=org"

sizelimit 1000
tool-threads 1

backend         bdb
checkpoint 512 30

database        bdb

suffix          "dc=example,dc=org"
pidfile         /home/ldap/run/slapd.pid

# List of arguments that were passed to the server
argsfile        /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values
loglevel        0

# Where the dynamically loaded modules are stored
modulepath      /usr/lib/ldap
moduleload      back_bdb

defaultsearchbase       "ou=people,dc=example,dc=org"

rootdn          "cn=root,dc=example,dc=org"
rootpw          {SSHA}4bAdjN1Q4VxtniRJ6ICNzEijUGcJNH3+

directory       "/home/ldap/example-org.db"

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM... I left it the same for the loblaw-test
#  image since it runs in QEMU
dbconfig set_cachesize 0 2097152 0

# Sven Hartge reported that he had to set this value incredibly high
# to get slapd running at all. See http://bugs.debian.org/303057
# for more information.

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index           objectClass eq
index   cn              pres,eq

cachesize       2000

lastmod         on

# Where to store the replica logs for database #1
# replogfile    /var/lib/ldap/replog

access to dn.regex="cn=.*,ou=staff,ou=people,dc=example,dc=org"
       attrs=userPassword
       by self write
       by anonymous auth
       by dn.regex="uid=apache,ou=roles,dc=example,dc=org" auth
       by dn.regex="uid=downloader,ou=roles,dc=example,dc=org"  peername.regex=127.0.0.1 read

# Note: if you want emailPassword to be readable, userPassword has to
#  be readable because emailPassword is currently a SUP of
#  userPassword

access to dn.regex="uid=.*,ou=roles,dc=example,dc=org"
       attrs=userPassword
       by self read
       by anonymous auth
       by dn.regex="uid=downloader,ou=roles,dc=example,dc=org"  peername.regex=127.0.0.1 read

access to dn.regex="uid=.*,ou=roles,dc=example,dc=org" attr=cn,entry,userPassword,uid,mail,displayName,emailPassword
       by self read
       by anonymous auth
       by dn.regex="uid=downloader,ou=roles,dc=example,dc=org"  peername.regex=127.0.0.1 read


# This next clause makes sure that other users, while they may get
# access to various fields in the staff account, don't get access to a
# few key security-related ones from the posixAccount objectClass.

access to dn.regex=".*,ou=staff,ou=people,dc=example,dc=org"
       attrs=userPassword,homeDirectory,loginShell,emailPassword
       by self read
       by dn.regex="cn=.*,ou=staff,ou=people,dc=example,dc=org" none
       by dn.regex="uid=downloader,ou=roles,dc=example,dc=org"  peername.regex=127.0.0.1 read

access to dn.regex=".*,ou=staff,ou=people,dc=example,dc=org"
        attrs=entry,cn,uid,gidNumber,uidNumber,homeDirectory,displayName,objectClass,mail,givenName,sn
        by dn.regex="uid=apache,ou=roles,dc=example,dc=org" read
        by dn.regex="uid=lj,ou=roles,dc=example,dc=org"  peername.regex=127.0.0.1 read
       by dn.regex="cn=.*,ou=staff,ou=people,dc=example,dc=org" read
       by dn.regex="uid=downloader,ou=roles,dc=example,dc=org"  peername.regex=127.0.0.1 read

 access to dn.regex=".*,ou=staff,ou=people,dc=example,dc=org"
        by dn.regex="cn=.*,ou=staff,ou=people,dc=example,dc=org" read
        by dn.regex="uid=downloader,ou=roles,dc=example,dc=org"  peername.regex=127.0.0.1 read

access to dn.regex="cn=.*,ou=mailAliases,ou=groups,dc=example,dc=org"
        by dn.regex="uid=downloader,ou=roles,dc=example,dc=org"  peername.regex=127.0.0.1 read

access to dn.regex="cn=.*,ou=emailAccounts,ou=roles,dc=example,dc=org"
        by dn.regex="uid=downloader,ou=roles,dc=example,dc=org"  peername.regex=127.0.0.1 read

access to dn.regex="cn=.*,ou=groups,dc=example,dc=org"
       by dn.regex="uid=apache,ou=roles,dc=example,dc=org" read
       by dn.regex="cn=.*,ou=staff,ou=people,dc=example,dc=org" read

access to dn.base="" by * read

# Ensure read access to the base for things like supportedSASLMechanisms.
# Without this you may have problems with SASL not knowing what mechanisms
# are available and the like.  Note that this is covered by the 'access to
# *' ACL below too but if you change that as people are wont to do you'll
# still need this if you want SASL (and possible other things) to work
# happily.