1 .lf 1 stdin 2 .TH SLAPD.CONF 5 "2025/05/22" "OpenLDAP 2.6.10" 3 .\" Copyright 1998-2024 The OpenLDAP Foundation All Rights Reserved. 4 .\" Copying restrictions apply. See COPYRIGHT/LICENSE. 5 .\" $OpenLDAP$ 6 .SH NAME 7 slapd.conf \- configuration file for slapd, the stand-alone LDAP daemon 8 .SH SYNOPSIS 9 /etc/openldap/slapd.conf 10 .SH DESCRIPTION 11 The file 12 .B /etc/openldap/slapd.conf 13 contains configuration information for the 14 .BR slapd (8) 15 daemon. This configuration file is also used by the SLAPD tools 16 .BR slapacl (8), 17 .BR slapadd (8), 18 .BR slapauth (8), 19 .BR slapcat (8), 20 .BR slapdn (8), 21 .BR slapindex (8), 22 .BR slapmodify (8), 23 and 24 .BR slaptest (8). 25 .LP 26 The 27 .B slapd.conf 28 file consists of a series of global configuration options that apply to 29 .B slapd 30 as a whole (including all backends), followed by zero or more database 31 backend definitions that contain information specific to a backend 32 instance. 33 The configuration options are case-insensitive; 34 their value, on a case by case basis, may be case-sensitive. 35 .LP 36 The general format of 37 .B slapd.conf 38 is as follows: 39 .LP 40 .nf 41 # comment - these options apply to every database 42 <global configuration options> 43 # first database definition & configuration options 44 database <backend 1 type> 45 <configuration options specific to backend 1> 46 # subsequent database definitions & configuration options 47 ... 48 .fi 49 .LP 50 As many backend-specific sections as desired may be included. Global 51 options can be overridden in a backend (for options that appear more 52 than once, the last appearance in the 53 .B slapd.conf 54 file is used). 55 .LP 56 If a line begins with white space, it is considered a continuation 57 of the previous line. No physical line should be over 2000 bytes 58 long. 59 .LP 60 Blank lines and comment lines beginning with 61 a `#' character are ignored. Note: continuation lines are unwrapped 62 before comment processing is applied. 63 .LP 64 Arguments on configuration lines are separated by white space. If an 65 argument contains white space, the argument should be enclosed in 66 double quotes. If an argument contains a double quote (`"') or a 67 backslash character (`\\'), the character should be preceded by a 68 backslash character. 69 .LP 70 The specific configuration options available are discussed below in the 71 Global Configuration Options, General Backend Options, and General Database 72 Options. Backend-specific options are discussed in the 73 .B slapd\-<backend>(5) 74 manual pages. Refer to the "OpenLDAP Administrator's Guide" for more 75 details on the slapd configuration file. 76 .SH GLOBAL CONFIGURATION OPTIONS 77 Options described in this section apply to all backends, unless specifically 78 overridden in a backend definition. Arguments that should be replaced by 79 actual text are shown in brackets <>. 80 .TP 81 .B access to <what> "[ by <who> <access> <control> ]+" 82 Grant access (specified by <access>) to a set of entries and/or 83 attributes (specified by <what>) by one or more requestors (specified 84 by <who>). 85 If no access controls are present, the default policy 86 allows anyone and everyone to read anything but restricts 87 updates to rootdn. (e.g., "access to * by * read"). 88 The rootdn can always read and write EVERYTHING! 89 See 90 .BR slapd.access (5) 91 and the "OpenLDAP's Administrator's Guide" for details. 92 .TP 93 .B allow <features> 94 Specify a set of features (separated by white space) to 95 allow (default none). 96 .B bind_v2 97 allows acceptance of LDAPv2 bind requests. Note that 98 .BR slapd (8) 99 does not truly implement LDAPv2 (RFC 1777), now Historic (RFC 3494). 100 .B bind_anon_cred 101 allows anonymous bind when credentials are not empty (e.g. 102 when DN is empty). 103 .B bind_anon_dn 104 allows unauthenticated (anonymous) bind when DN is not empty. 105 .B update_anon 106 allows unauthenticated (anonymous) update operations to be processed 107 (subject to access controls and other administrative limits). 108 .B proxy_authz_anon 109 allows unauthenticated (anonymous) proxy authorization control to be processed 110 (subject to access controls, authorization and other administrative limits). 111 .TP 112 .B argsfile <filename> 113 The (absolute) name of a file that will hold the 114 .B slapd 115 server's command line (program name and options). 116 .TP 117 .B attributeoptions [option-name]... 118 Define tagging attribute options or option tag/range prefixes. 119 Options must not end with `\-', prefixes must end with `\-'. 120 The `lang\-' prefix is predefined. 121 If you use the 122 .B attributeoptions 123 directive, `lang\-' will no longer be defined and you must specify it 124 explicitly if you want it defined. 125 126 An attribute description with a tagging option is a subtype of that 127 attribute description without the option. 128 Except for that, options defined this way have no special semantics. 129 Prefixes defined this way work like the `lang\-' options: 130 They define a prefix for tagging options starting with the prefix. 131 That is, if you define the prefix `x\-foo\-', you can use the option 132 `x\-foo\-bar'. 133 Furthermore, in a search or compare, a prefix or range name (with 134 a trailing `\-') matches all options starting with that name, as well 135 as the option with the range name sans the trailing `\-'. 136 That is, `x\-foo\-bar\-' matches `x\-foo\-bar' and `x\-foo\-bar\-baz'. 137 138 RFC 4520 reserves options beginning with `x\-' for private experiments. 139 Other options should be registered with IANA, see RFC 4520 section 3.5. 140 OpenLDAP also has the `binary' option built in, but this is a transfer 141 option, not a tagging option. 142 .HP 143 .hy 0 144 .B attributetype "(\ <oid>\ 145 [NAME\ <name>]\ 146 [DESC\ <description>]\ 147 [OBSOLETE]\ 148 [SUP\ <oid>]\ 149 [EQUALITY\ <oid>]\ 150 [ORDERING\ <oid>]\ 151 [SUBSTR\ <oid>]\ 152 [SYNTAX\ <oidlen>]\ 153 [SINGLE\-VALUE]\ 154 [COLLECTIVE]\ 155 [NO\-USER\-MODIFICATION]\ 156 [USAGE\ <attributeUsage>]\ )" 157 .RS 158 Specify an attribute type using the LDAPv3 syntax defined in RFC 4512. 159 The slapd parser extends the RFC 4512 definition by allowing string 160 forms as well as numeric OIDs to be used for the attribute OID and 161 attribute syntax OID. 162 (See the 163 .B objectidentifier 164 description.) 165 .RE 166 .TP 167 .B authid\-rewrite<cmd> <args> 168 Used by the authentication framework to convert simple user names 169 to an LDAP DN used for authorization purposes. 170 Its purpose is analogous to that of 171 .BR authz-regexp 172 (see below). 173 The prefix \fIauthid\-\fP is followed by a set of rules analogous 174 to those described in 175 .BR slapo\-rwm (5) 176 for data rewriting (replace the \fIrwm\-\fP prefix with \fIauthid\-\fP). 177 .B authid\-rewrite<cmd> 178 and 179 .B authz\-regexp 180 rules should not be intermixed. 181 .TP 182 .B authz\-policy <policy> 183 Used to specify which rules to use for Proxy Authorization. Proxy 184 authorization allows a client to authenticate to the server using one 185 user's credentials, but specify a different identity to use for authorization 186 and access control purposes. It essentially allows user A to login as user 187 B, using user A's password. 188 The 189 .B none 190 flag disables proxy authorization. This is the default setting. 191 The 192 .B from 193 flag will use rules in the 194 .I authzFrom 195 attribute of the authorization DN. 196 The 197 .B to 198 flag will use rules in the 199 .I authzTo 200 attribute of the authentication DN. 201 The 202 .B any 203 flag, an alias for the deprecated value of 204 .BR both , 205 will allow any of the above, whatever succeeds first (checked in 206 .BR to , 207 .B from 208 sequence. 209 The 210 .B all 211 flag requires both authorizations to succeed. 212 .LP 213 .RS 214 The rules are mechanisms to specify which identities are allowed 215 to perform proxy authorization. 216 The 217 .I authzFrom 218 attribute in an entry specifies which other users 219 are allowed to proxy login to this entry. The 220 .I authzTo 221 attribute in 222 an entry specifies which other users this user can authorize as. Use of 223 .I authzTo 224 rules can be easily 225 abused if users are allowed to write arbitrary values to this attribute. 226 In general the 227 .I authzTo 228 attribute must be protected with ACLs such that 229 only privileged users can modify it. 230 The value of 231 .I authzFrom 232 and 233 .I authzTo 234 describes an 235 .B identity 236 or a set of identities; it can take five forms: 237 .RS 238 .TP 239 .B ldap:///<base>??[<scope>]?<filter> 240 .RE 241 .RS 242 .B dn[.<dnstyle>]:<pattern> 243 .RE 244 .RS 245 .B u[.<mech>[/<realm>]]:<pattern> 246 .RE 247 .RS 248 .B group[/objectClass[/attributeType]]:<pattern> 249 .RE 250 .RS 251 .B <pattern> 252 .RE 253 .RS 254 255 .B <dnstyle>:={exact|onelevel|children|subtree|regex} 256 257 .RE 258 The first form is a valid LDAP 259 .B URI 260 where the 261 .IR <host>:<port> , 262 the 263 .I <attrs> 264 and the 265 .I <extensions> 266 portions must be absent, so that the search occurs locally on either 267 .I authzFrom 268 or 269 .IR authzTo . 270 271 .LP 272 The second form is a 273 .BR DN . 274 The optional 275 .B dnstyle 276 modifiers 277 .IR exact , 278 .IR onelevel , 279 .IR children , 280 and 281 .I subtree 282 provide exact, onelevel, children and subtree matches, which cause 283 .I <pattern> 284 to be normalized according to the DN normalization rules. 285 The special 286 .B dnstyle 287 modifier 288 .I regex 289 causes the 290 .I <pattern> 291 to be treated as a POSIX (''extended'') regular expression, as 292 discussed in 293 .BR regex (7) 294 and/or 295 .BR re_format (7). 296 A pattern of 297 .I * 298 means any non-anonymous DN. 299 300 .LP 301 The third form is a SASL 302 .BR id . 303 The optional fields 304 .I <mech> 305 and 306 .I <realm> 307 allow specification of a SASL 308 .BR mechanism , 309 and eventually a SASL 310 .BR realm , 311 for those mechanisms that support one. 312 The need to allow the specification of a mechanism is still debated, 313 and users are strongly discouraged to rely on this possibility. 314 315 .LP 316 The fourth form is a group specification. 317 It consists of the keyword 318 .BR group , 319 optionally followed by the specification of the group 320 .B objectClass 321 and 322 .BR attributeType . 323 The 324 .B objectClass 325 defaults to 326 .IR groupOfNames . 327 The 328 .B attributeType 329 defaults to 330 .IR member . 331 The group with DN 332 .B <pattern> 333 is searched with base scope, filtered on the specified 334 .BR objectClass . 335 The values of the resulting 336 .B attributeType 337 are searched for the asserted DN. 338 339 .LP 340 The fifth form is provided for backwards compatibility. If no identity 341 type is provided, i.e. only 342 .B <pattern> 343 is present, an 344 .I exact DN 345 is assumed; as a consequence, 346 .B <pattern> 347 is subjected to DN normalization. 348 349 .LP 350 Since the interpretation of 351 .I authzFrom 352 and 353 .I authzTo 354 can impact security, users are strongly encouraged 355 to explicitly set the type of identity specification that is being used. 356 A subset of these rules can be used as third arg in the 357 .B authz\-regexp 358 statement (see below); significantly, the 359 .IR URI , 360 provided it results in exactly one entry, 361 and the 362 .I dn.exact:<dn> 363 forms. 364 .RE 365 .TP 366 .B authz\-regexp <match> <replace> 367 Used by the authentication framework to convert simple user names, 368 such as provided by SASL subsystem, or extracted from certificates 369 in case of cert-based SASL EXTERNAL, or provided within the RFC 4370 370 "proxied authorization" control, to an LDAP DN used for 371 authorization purposes. Note that the resulting DN need not refer 372 to an existing entry to be considered valid. When an authorization 373 request is received from the SASL subsystem, the SASL 374 .BR USERNAME , 375 .BR REALM , 376 and 377 .B MECHANISM 378 are taken, when available, and combined into a name of the form 379 .RS 380 .RS 381 .TP 382 .B UID=<username>[[,CN=<realm>],CN=<mechanism>],CN=auth 383 384 .RE 385 This name is then compared against the 386 .B match 387 POSIX (''extended'') regular expression, and if the match is successful, 388 the name is replaced with the 389 .B replace 390 string. If there are wildcard strings in the 391 .B match 392 regular expression that are enclosed in parenthesis, e.g. 393 .RS 394 .TP 395 .B UID=([^,]*),CN=.* 396 397 .RE 398 then the portion of the name that matched the wildcard will be stored 399 in the numbered placeholder variable $1. If there are other wildcard strings 400 in parenthesis, the matching strings will be in $2, $3, etc. up to $9. The 401 placeholders can then be used in the 402 .B replace 403 string, e.g. 404 .RS 405 .TP 406 .B UID=$1,OU=Accounts,DC=example,DC=com 407 408 .RE 409 The replaced name can be either a DN, i.e. a string prefixed by "dn:", 410 or an LDAP URI. 411 If the latter, the server will use the URI to search its own database(s) 412 and, if the search returns exactly one entry, the name is 413 replaced by the DN of that entry. The LDAP URI must have no 414 hostport, attrs, or extensions components, but the filter is mandatory, 415 e.g. 416 .RS 417 .TP 418 .B ldap:///OU=Accounts,DC=example,DC=com??one?(UID=$1) 419 420 .RE 421 The protocol portion of the URI must be strictly 422 .BR ldap . 423 Note that this search is subject to access controls. Specifically, 424 the authentication identity must have "auth" access in the subject. 425 426 Multiple 427 .B authz\-regexp 428 options can be given in the configuration file to allow for multiple matching 429 and replacement patterns. The matching patterns are checked in the order they 430 appear in the file, stopping at the first successful match. 431 432 .\".B Caution: 433 .\"Because the plus sign + is a character recognized by the regular expression engine, 434 .\"and it will appear in names that include a REALM, be careful to escape the 435 .\"plus sign with a backslash \\+ to remove the character's special meaning. 436 .RE 437 .TP 438 .B concurrency <integer> 439 Specify a desired level of concurrency. Provided to the underlying 440 thread system as a hint. The default is not to provide any hint. This setting 441 is only meaningful on some platforms where there is not a one to one 442 correspondence between user threads and kernel threads. 443 .TP 444 .B conn_max_pending <integer> 445 Specify the maximum number of pending requests for an anonymous session. 446 If requests are submitted faster than the server can process them, they 447 will be queued up to this limit. If the limit is exceeded, the session 448 is closed. The default is 100. 449 .TP 450 .B conn_max_pending_auth <integer> 451 Specify the maximum number of pending requests for an authenticated session. 452 The default is 1000. 453 .TP 454 .B defaultsearchbase <dn> 455 Specify a default search base to use when client submits a 456 non-base search request with an empty base DN. 457 Base scoped search requests with an empty base DN are not affected. 458 .TP 459 .B disallow <features> 460 Specify a set of features (separated by white space) to 461 disallow (default none). 462 .B bind_anon 463 disables acceptance of anonymous bind requests. Note that this setting 464 does not prohibit anonymous directory access (See "require authc"). 465 .B bind_simple 466 disables simple (bind) authentication. 467 .B tls_2_anon 468 disables forcing session to anonymous status (see also 469 .BR tls_authc ) 470 upon StartTLS operation receipt. 471 .B tls_authc 472 disallows the StartTLS operation if authenticated (see also 473 .BR tls_2_anon ). 474 .B proxy_authz_non_critical 475 disables acceptance of the proxied authorization control (RFC4370) 476 with criticality set to FALSE. 477 .B dontusecopy_non_critical 478 disables acceptance of the dontUseCopy control (a work in progress) 479 with criticality set to FALSE. 480 .HP 481 .hy 0 482 .B ditcontentrule "(\ <oid>\ 483 [NAME\ <name>]\ 484 [DESC\ <description>]\ 485 [OBSOLETE]\ 486 [AUX\ <oids>]\ 487 [MUST\ <oids>]\ 488 [MAY\ <oids>]\ 489 [NOT\ <oids>]\ )" 490 .RS 491 Specify an DIT Content Rule using the LDAPv3 syntax defined in RFC 4512. 492 The slapd parser extends the RFC 4512 definition by allowing string 493 forms as well as numeric OIDs to be used for the attribute OID and 494 attribute syntax OID. 495 (See the 496 .B objectidentifier 497 description.) 498 .RE 499 .TP 500 .B gentlehup { on | off } 501 A SIGHUP signal will only cause a 'gentle' shutdown-attempt: 502 .B Slapd 503 will stop listening for new connections, but will not close the 504 connections to the current clients. Future write operations return 505 unwilling-to-perform, though. Slapd terminates when all clients 506 have closed their connections (if they ever do), or \- as before \- 507 if it receives a SIGTERM signal. This can be useful if you wish to 508 terminate the server and start a new 509 .B slapd 510 server 511 .B with another database, 512 without disrupting the currently active clients. 513 The default is off. You may wish to use 514 .B idletimeout 515 along with this option. 516 .TP 517 .B idletimeout <integer> 518 Specify the number of seconds to wait before forcibly closing 519 an idle client connection. A setting of 0 disables this 520 feature. The default is 0. You may also want to set the 521 .B writetimeout 522 option. 523 .TP 524 .B include <filename> 525 Read additional configuration information from the given file before 526 continuing with the next line of the current file. 527 .TP 528 .B index_hash64 { on | off } 529 Use a 64 bit hash for indexing. The default is to use 32 bit hashes. 530 These hashes are used for equality and substring indexing. The 64 bit 531 version may be needed to avoid index collisions when the number of 532 indexed values exceeds ~64 million. (Note that substring indexing 533 generates multiple index values per actual attribute value.) 534 Indices generated with 32 bit hashes are incompatible with the 64 bit 535 version, and vice versa. Any existing databases must be fully reloaded 536 when changing this setting. This directive is only supported on 64 bit CPUs. 537 .TP 538 .B index_intlen <integer> 539 Specify the key length for ordered integer indices. The most significant 540 bytes of the binary integer will be used for index keys. The default 541 value is 4, which provides exact indexing for 31 bit values. 542 A floating point representation is used to index too large values. 543 .TP 544 .B index_substr_if_maxlen <integer> 545 Specify the maximum length for subinitial and subfinal indices. Only 546 this many characters of an attribute value will be processed by the 547 indexing functions; any excess characters are ignored. The default is 4. 548 .TP 549 .B index_substr_if_minlen <integer> 550 Specify the minimum length for subinitial and subfinal indices. An 551 attribute value must have at least this many characters in order to be 552 processed by the indexing functions. The default is 2. 553 .TP 554 .B index_substr_any_len <integer> 555 Specify the length used for subany indices. An attribute value must have 556 at least this many characters in order to be processed. Attribute values 557 longer than this length will be processed in segments of this length. The 558 default is 4. The subany index will also be used in subinitial and 559 subfinal index lookups when the filter string is longer than the 560 .I index_substr_if_maxlen 561 value. 562 .TP 563 .B index_substr_any_step <integer> 564 Specify the steps used in subany index lookups. This value sets the offset 565 for the segments of a filter string that are processed for a subany index 566 lookup. The default is 2. For example, with the default values, a search 567 using this filter "cn=*abcdefgh*" would generate index lookups for 568 "abcd", "cdef", and "efgh". 569 570 .LP 571 Note: Indexing support depends on the particular backend in use. Also, 572 changing these settings will generally require deleting any indices that 573 depend on these parameters and recreating them with 574 .BR slapindex (8). 575 576 .HP 577 .hy 0 578 .B ldapsyntax "(\ <oid>\ 579 [DESC\ <description>]\ 580 [X\-SUBST <substitute-syntax>]\ )" 581 .RS 582 Specify an LDAP syntax using the LDAPv3 syntax defined in RFC 4512. 583 The slapd parser extends the RFC 4512 definition by allowing string 584 forms as well as numeric OIDs to be used for the syntax OID. 585 (See the 586 .B objectidentifier 587 description.) 588 The slapd parser also honors the 589 .B X\-SUBST 590 extension (an OpenLDAP-specific extension), which allows one to use the 591 .B ldapsyntax 592 statement to define a non-implemented syntax along with another syntax, 593 the extension value 594 .IR substitute-syntax , 595 as its temporary replacement. 596 The 597 .I substitute-syntax 598 must be defined. 599 This allows one to define attribute types that make use of non-implemented syntaxes 600 using the correct syntax OID. 601 Unless 602 .B X\-SUBST 603 is used, this configuration statement would result in an error, 604 since no handlers would be associated to the resulting syntax structure. 605 .RE 606 607 .TP 608 .B listener-threads <integer> 609 Specify the number of threads to use for the connection manager. 610 The default is 1 and this is typically adequate for up to 16 CPU cores. 611 The value should be set to a power of 2. 612 .TP 613 .B localSSF <SSF> 614 Specifies the Security Strength Factor (SSF) to be given local LDAP sessions, 615 such as those to the ldapi:// listener. For a description of SSF values, 616 see 617 .BR sasl-secprops 's 618 .B minssf 619 option description. The default is 71. 620 .TP 621 .B logfile <filename> 622 Specify a file for recording slapd debug messages. These messages are 623 unrelated to messages exposed by the 624 .B loglevel 625 configuration parameter. This setting only affects the slapd daemon and has 626 no effect on the command line tools. By default these messages 627 only go to stderr and are not recorded anywhere else. 628 Specifying a logfile copies messages to both stderr and the logfile. 629 .TP 630 .B logfile-format debug|syslog-utc|syslog-localtime|rfc3339-utc 631 Specify the prefix format for messages written to the logfile. The debug 632 format is the normal format used for slapd debug messages, with a timestamp 633 in hexadecimal, followed by a thread ID. The other options are to 634 use syslog(3) style prefixes, with timestamps either in UTC or in the 635 local timezone. The default is debug format. 636 .TP 637 .B logfile-only on | off 638 Specify that debug messages should only go to the configured logfile, and 639 not to stderr. 640 .TP 641 .B logfile-rotate <max> <Mbytes> <hours> 642 Specify automatic rotation for the configured logfile as the maximum 643 number of old logfiles to retain, a maximum size in megabytes to allow a 644 logfile to grow before rotation, and a maximum age in hours for a logfile 645 to be used before rotation. The maximum number must be in the range 1-99. 646 Setting Mbytes or hours to zero disables the size or age check, respectively. 647 At least one of Mbytes or hours must be non-zero. By default no automatic 648 rotation will be performed. 649 .TP 650 .B loglevel <integer> [...] 651 Specify the level at which debugging statements and operation 652 statistics should be syslogged (currently logged to the 653 .BR syslogd (8) 654 LOG_LOCAL4 facility). 655 They must be considered subsystems rather than increasingly verbose 656 log levels. 657 Some messages with higher priority are logged regardless 658 of the configured loglevel as soon as any logging is configured. 659 Log levels are additive, and available levels are: 660 .RS 661 .RS 662 .PD 0 663 .TP 664 .B 1 665 .B (0x1 trace) 666 trace function calls 667 .TP 668 .B 2 669 .B (0x2 packets) 670 debug packet handling 671 .TP 672 .B 4 673 .B (0x4 args) 674 heavy trace debugging (function args) 675 .TP 676 .B 8 677 .B (0x8 conns) 678 connection management 679 .TP 680 .B 16 681 .B (0x10 BER) 682 print out packets sent and received 683 .TP 684 .B 32 685 .B (0x20 filter) 686 search filter processing 687 .TP 688 .B 64 689 .B (0x40 config) 690 configuration file processing 691 .TP 692 .B 128 693 .B (0x80 ACL) 694 access control list processing 695 .TP 696 .B 256 697 .B (0x100 stats) 698 connections, LDAP operations, results (recommended) 699 .TP 700 .B 512 701 .B (0x200 stats2) 702 stats2 log entries sent 703 .TP 704 .B 1024 705 .B (0x400 shell) 706 print communication with shell backends 707 .TP 708 .B 2048 709 .B (0x800 parse) 710 entry parsing 711 \".TP 712 \".B 4096 713 \".B (0x1000 cache) 714 \"caching (unused) 715 \".TP 716 \".B 8192 717 \".B (0x2000 index) 718 \"data indexing (unused) 719 .TP 720 .B 16384 721 .B (0x4000 sync) 722 LDAPSync replication 723 .TP 724 .B 32768 725 .B (0x8000 none) 726 only messages that get logged whatever log level is set 727 .PD 728 .RE 729 The desired log level can be input as a single integer that combines 730 the (ORed) desired levels, both in decimal or in hexadecimal notation, 731 as a list of integers (that are ORed internally), 732 or as a list of the names that are shown between parentheses, such that 733 .LP 734 .nf 735 loglevel 129 736 loglevel 0x81 737 loglevel 128 1 738 loglevel 0x80 0x1 739 loglevel acl trace 740 .fi 741 .LP 742 are equivalent. 743 The keyword 744 .B any 745 can be used as a shortcut to enable logging at all levels (equivalent to \-1). 746 The keyword 747 .BR none , 748 or the equivalent integer representation, causes those messages 749 that are logged regardless of the configured loglevel to be logged. 750 In fact, if loglevel is set to 0, no logging occurs, 751 so at least the 752 .B none 753 level is required to have high priority messages logged. 754 755 Note that the 756 .BR packets , 757 .BR BER , 758 and 759 .B parse 760 levels are only available as debug output on stderr, and are not 761 sent to syslog. 762 763 The loglevel defaults to \fBstats\fP. 764 This level should usually also be included when using other loglevels, to 765 help analyze the logs. 766 .RE 767 .TP 768 .B maxfilterdepth <integer> 769 Specify the maximum depth of nested filters in search requests. 770 The default is 1000. 771 .TP 772 .B moduleload <filename> [<arguments>...] 773 Specify the name of a dynamically loadable module to load and any 774 additional arguments if supported by the module. The filename 775 may be an absolute path name or a simple filename. Non-absolute names 776 are searched for in the directories specified by the 777 .B modulepath 778 option. This option and the 779 .B modulepath 780 option are only usable if slapd was compiled with \-\-enable\-modules. 781 .TP 782 .B modulepath <pathspec> 783 Specify a list of directories to search for loadable modules. Typically 784 the path is colon-separated but this depends on the operating system. 785 The default is /usr/libexec/openldap, which is where the standard OpenLDAP install 786 will place its modules. 787 .HP 788 .hy 0 789 .B objectclass "(\ <oid>\ 790 [NAME\ <name>]\ 791 [DESC\ <description>]\ 792 [OBSOLETE]\ 793 [SUP\ <oids>]\ 794 [{ ABSTRACT | STRUCTURAL | AUXILIARY }]\ 795 [MUST\ <oids>] [MAY\ <oids>] )" 796 .RS 797 Specify an objectclass using the LDAPv3 syntax defined in RFC 4512. 798 The slapd parser extends the RFC 4512 definition by allowing string 799 forms as well as numeric OIDs to be used for the object class OID. 800 (See the 801 .B 802 objectidentifier 803 description.) Object classes are "STRUCTURAL" by default. 804 .RE 805 .TP 806 .B objectidentifier <name> "{ <oid> | <name>[:<suffix>] }" 807 Define a string name that equates to the given OID. The string can be used 808 in place of the numeric OID in objectclass and attribute definitions. The 809 name can also be used with a suffix of the form ":xx" in which case the 810 value "oid.xx" will be used. 811 .TP 812 .B password\-hash <hash> [<hash>...] 813 This option configures one or more hashes to be used in generation of user 814 passwords stored in the userPassword attribute during processing of 815 LDAP Password Modify Extended Operations (RFC 3062). 816 The <hash> must be one of 817 .BR {SSHA} , 818 .BR {SHA} , 819 .BR {SMD5} , 820 .BR {MD5} , 821 .BR {CRYPT} , 822 and 823 .BR {CLEARTEXT} . 824 The default is 825 .BR {SSHA} . 826 827 .B {SHA} 828 and 829 .B {SSHA} 830 use the SHA-1 algorithm (FIPS 160-1), the latter with a seed. 831 832 .B {MD5} 833 and 834 .B {SMD5} 835 use the MD5 algorithm (RFC 1321), the latter with a seed. 836 837 .B {CRYPT} 838 uses the 839 .BR crypt (3). 840 841 .B {CLEARTEXT} 842 indicates that the new password should be 843 added to userPassword as clear text. 844 845 Note that this option does not alter the normal user applications 846 handling of userPassword during LDAP Add, Modify, or other LDAP operations. 847 .TP 848 .B password\-crypt\-salt\-format <format> 849 Specify the format of the salt passed to 850 .BR crypt (3) 851 when generating {CRYPT} passwords (see 852 .BR password\-hash ) 853 during processing of LDAP Password Modify Extended Operations (RFC 3062). 854 855 This string needs to be in 856 .BR sprintf (3) 857 format and may include one (and only one) %s conversion. 858 This conversion will be substituted with a string of random 859 characters from [A\-Za\-z0\-9./]. For example, "%.2s" 860 provides a two character salt and "$1$%.8s" tells some 861 versions of crypt(3) to use an MD5 algorithm and provides 862 8 random characters of salt. The default is "%s", which 863 provides 31 characters of salt. 864 .TP 865 .B pidfile <filename> 866 The (absolute) name of a file that will hold the 867 .B slapd 868 server's process ID (see 869 .BR getpid (2)). 870 .TP 871 .B pluginlog: <filename> 872 The ( absolute ) name of a file that will contain log 873 messages from 874 .B SLAPI 875 plugins. See 876 .BR slapd.plugin (5) 877 for details. 878 .TP 879 .B referral <url> 880 Specify the referral to pass back when 881 .BR slapd (8) 882 cannot find a local database to handle a request. 883 If specified multiple times, each url is provided. 884 .TP 885 .B require <conditions> 886 Specify a set of conditions (separated by white space) to 887 require (default none). 888 The directive may be specified globally and/or per-database; 889 databases inherit global conditions, so per-database specifications 890 are additive. 891 .B bind 892 requires bind operation prior to directory operations. 893 .B LDAPv3 894 requires session to be using LDAP version 3. 895 .B authc 896 requires authentication prior to directory operations. 897 .B SASL 898 requires SASL authentication prior to directory operations. 899 .B strong 900 requires strong authentication prior to directory operations. 901 The strong keyword allows protected "simple" authentication 902 as well as SASL authentication. 903 .B none 904 may be used to require no conditions (useful to clear out globally 905 set conditions within a particular database); it must occur first 906 in the list of conditions. 907 .TP 908 .B reverse\-lookup on | off 909 Enable/disable client name unverified reverse lookup (default is 910 .BR off 911 if compiled with \-\-enable\-rlookups). 912 .TP 913 .B rootDSE <file> 914 Specify the name of an LDIF(5) file containing user defined attributes 915 for the root DSE. These attributes are returned in addition to the 916 attributes normally produced by slapd. 917 918 The root DSE is an entry with information about the server and its 919 capabilities, in operational attributes. 920 It has the empty DN, and can be read with e.g.: 921 .ti +4 922 ldapsearch \-x \-b "" \-s base "+" 923 .br 924 See RFC 4512 section 5.1 for details. 925 .TP 926 .B sasl\-auxprops <plugin> [...] 927 Specify which auxprop plugins to use for authentication lookups. The 928 default is empty, which just uses slapd's internal support. Usually 929 no other auxprop plugins are needed. 930 .TP 931 .B sasl\-auxprops\-dontusecopy <attr> [...] 932 Specify which attribute(s) should be subject to the don't use copy control. This 933 is necessary for some SASL mechanisms such as OTP to work in a replicated 934 environment. The attribute "cmusaslsecretOTP" is the default value. 935 .TP 936 .B sasl\-auxprops\-dontusecopy\-ignore on | off 937 Used to disable replication of the attribute(s) defined by 938 sasl-auxprops-dontusecopy and instead use a local value for the attribute. This 939 allows the SASL mechanism to continue to work if the provider is offline. This can 940 cause replication inconsistency. Defaults to off. 941 .TP 942 .B sasl\-host <fqdn> 943 Used to specify the fully qualified domain name used for SASL processing. 944 .TP 945 .B sasl\-realm <realm> 946 Specify SASL realm. Default is empty. 947 .TP 948 .B sasl\-cbinding none | tls-unique | tls-endpoint 949 Specify the channel-binding type, see also LDAP_OPT_X_SASL_CBINDING. 950 Default is none. 951 .TP 952 .B sasl\-secprops <properties> 953 Used to specify Cyrus SASL security properties. 954 The 955 .B none 956 flag (without any other properties) causes the flag properties 957 default, "noanonymous,noplain", to be cleared. 958 The 959 .B noplain 960 flag disables mechanisms susceptible to simple passive attacks. 961 The 962 .B noactive 963 flag disables mechanisms susceptible to active attacks. 964 The 965 .B nodict 966 flag disables mechanisms susceptible to passive dictionary attacks. 967 The 968 .B noanonymous 969 flag disables mechanisms which support anonymous login. 970 The 971 .B forwardsec 972 flag require forward secrecy between sessions. 973 The 974 .B passcred 975 require mechanisms which pass client credentials (and allow 976 mechanisms which can pass credentials to do so). 977 The 978 .B minssf=<factor> 979 property specifies the minimum acceptable 980 .I security strength factor 981 as an integer approximate to effective key length used for 982 encryption. 0 (zero) implies no protection, 1 implies integrity 983 protection only, 128 allows RC4, Blowfish and other similar ciphers, 984 256 will require modern ciphers. The default is 0. 985 The 986 .B maxssf=<factor> 987 property specifies the maximum acceptable 988 .I security strength factor 989 as an integer (see minssf description). The default is INT_MAX. 990 The 991 .B maxbufsize=<size> 992 property specifies the maximum security layer receive buffer 993 size allowed. 0 disables security layers. The default is 65536. 994 .TP 995 .B schemadn <dn> 996 Specify the distinguished name for the subschema subentry that 997 controls the entries on this server. The default is "cn=Subschema". 998 .TP 999 .B security <factors> 1000 Specify a set of security strength factors (separated by white space) 1001 to require (see 1002 .BR sasl\-secprops 's 1003 .B minssf 1004 option for a description of security strength factors). 1005 The directive may be specified globally and/or per-database. 1006 .B ssf=<n> 1007 specifies the overall security strength factor. 1008 .B transport=<n> 1009 specifies the transport security strength factor. 1010 .B tls=<n> 1011 specifies the TLS security strength factor. 1012 .B sasl=<n> 1013 specifies the SASL security strength factor. 1014 .B update_ssf=<n> 1015 specifies the overall security strength factor to require for 1016 directory updates. 1017 .B update_transport=<n> 1018 specifies the transport security strength factor to require for 1019 directory updates. 1020 .B update_tls=<n> 1021 specifies the TLS security strength factor to require for 1022 directory updates. 1023 .B update_sasl=<n> 1024 specifies the SASL security strength factor to require for 1025 directory updates. 1026 .B simple_bind=<n> 1027 specifies the security strength factor required for 1028 .I simple 1029 username/password authentication. 1030 Note that the 1031 .B transport 1032 factor is measure of security provided by the underlying transport, 1033 e.g. ldapi:// (and eventually IPSEC). It is not normally used. 1034 .TP 1035 .B serverID <integer> [<URL>] 1036 Specify an integer ID from 0 to 4095 for this server. The ID may also be 1037 specified as a hexadecimal ID by prefixing the value with "0x". 1038 Non-zero IDs are required when using multi-provider replication and each 1039 provider must have a unique non-zero ID. Note that this requirement also 1040 applies to separate providers contributing to a glued set of databases. 1041 If the URL is provided, this directive may be specified 1042 multiple times, providing a complete list of participating servers 1043 and their IDs. The fully qualified hostname of each server should be 1044 used in the supplied URLs. The IDs are used in the "replica id" field 1045 of all CSNs generated by the specified server. The default value is zero, which 1046 is only valid for single provider replication. 1047 Example: 1048 .LP 1049 .nf 1050 serverID 1 ldap://ldap1.example.com 1051 serverID 2 ldap://ldap2.example.com 1052 .fi 1053 .TP 1054 .B sizelimit {<integer>|unlimited} 1055 .TP 1056 .B sizelimit size[.{soft|hard}]=<integer> [...] 1057 Specify the maximum number of entries to return from a search operation. 1058 The default size limit is 500. 1059 Use 1060 .B unlimited 1061 to specify no limits. 1062 The second format allows a fine grain setting of the size limits. 1063 If no special qualifiers are specified, both soft and hard limits are set. 1064 Extra args can be added on the same line. 1065 Additional qualifiers are available; see 1066 .BR limits 1067 for an explanation of all of the different flags. 1068 .TP 1069 .B sockbuf_max_incoming <integer> 1070 Specify the maximum incoming LDAP PDU size for anonymous sessions. 1071 The default is 262143. 1072 .TP 1073 .B sockbuf_max_incoming_auth <integer> 1074 Specify the maximum incoming LDAP PDU size for authenticated sessions. 1075 The default is 4194303. 1076 .TP 1077 .B sortvals <attr> [...] 1078 Specify a list of multi-valued attributes whose values will always 1079 be maintained in sorted order. Using this option will allow Modify, 1080 Compare, and filter evaluations on these attributes to be performed 1081 more efficiently. The resulting sort order depends on the 1082 attributes' syntax and matching rules and may not correspond to 1083 lexical order or any other recognizable order. 1084 .TP 1085 .B tcp-buffer [listener=<URL>] [{read|write}=]<size> 1086 Specify the size of the TCP buffer. 1087 A global value for both read and write TCP buffers related to any listener 1088 is defined, unless the listener is explicitly specified, 1089 or either the read or write qualifiers are used. 1090 See 1091 .BR tcp (7) 1092 for details. 1093 Note that some OS-es implement automatic TCP buffer tuning. 1094 .TP 1095 .B threads <integer> 1096 Specify the maximum size of the primary thread pool. 1097 The default is 16; the minimum value is 2. 1098 .TP 1099 .B threadqueues <integer> 1100 Specify the number of work queues to use for the primary thread pool. 1101 The default is 1 and this is typically adequate for up to 8 CPU cores. 1102 The value should not exceed the number of CPUs in the system. 1103 .TP 1104 .B timelimit {<integer>|unlimited} 1105 .TP 1106 .B timelimit time[.{soft|hard}]=<integer> [...] 1107 Specify the maximum number of seconds (in real time) 1108 .B slapd 1109 will spend answering a search request. The default time limit is 3600. 1110 Use 1111 .B unlimited 1112 to specify no limits. 1113 The second format allows a fine grain setting of the time limits. 1114 Extra args can be added on the same line. See 1115 .BR limits 1116 for an explanation of the different flags. 1117 .TP 1118 .B tool\-threads <integer> 1119 Specify the maximum number of threads to use in tool mode. 1120 This should not be greater than the number of CPUs in the system. 1121 The default is 1. 1122 .TP 1123 .B writetimeout <integer> 1124 Specify the number of seconds to wait before forcibly closing 1125 a connection with an outstanding write. This allows recovery from 1126 various network hang conditions. A writetimeout of 0 disables this 1127 feature. The default is 0. 1128 .SH TLS OPTIONS 1129 If 1130 .B slapd 1131 is built with support for Transport Layer Security, there are more options 1132 you can specify. 1133 .TP 1134 .B TLSCipherSuite <cipher-suite-spec> 1135 Permits configuring what ciphers will be accepted and the preference order. 1136 <cipher-suite-spec> should be a cipher specification for the TLS library 1137 in use (OpenSSL or GnuTLS). 1138 Example: 1139 .RS 1140 .RS 1141 .TP 1142 .I OpenSSL: 1143 TLSCipherSuite HIGH:MEDIUM:+SSLv2 1144 .TP 1145 .I GnuTLS: 1146 TLSCiphersuite SECURE256:!AES-128-CBC 1147 .RE 1148 1149 To check what ciphers a given spec selects in OpenSSL, use: 1150 1151 .nf 1152 openssl ciphers \-v <cipher-suite-spec> 1153 .fi 1154 1155 With GnuTLS the available specs can be found in the manual page of 1156 .BR gnutls\-cli (1) 1157 (see the description of the 1158 option 1159 .BR \-\-priority ). 1160 1161 In older versions of GnuTLS, where gnutls\-cli does not support the option 1162 \-\-priority, you can obtain the \(em more limited \(em list of ciphers by calling: 1163 1164 .nf 1165 gnutls\-cli \-l 1166 .fi 1167 .RE 1168 .TP 1169 .B TLSCACertificateFile <filename> 1170 Specifies the file that contains certificates for all of the Certificate 1171 Authorities that 1172 .B slapd 1173 will recognize. The certificate for 1174 the CA that signed the server certificate must(GnuTLS)/may(OpenSSL) be included among 1175 these certificates. If the signing CA was not a top-level (root) CA, 1176 certificates for the entire sequence of CA's from the signing CA to 1177 the top-level CA should be present. Multiple certificates are simply 1178 appended to the file; the order is not significant. 1179 .TP 1180 .B TLSCACertificatePath <path> 1181 Specifies the path of directories that contain Certificate Authority 1182 certificates in separate individual files. Usually only one of this 1183 or the TLSCACertificateFile is used. If both are specified, both 1184 locations will be used. Multiple directories may be specified, 1185 separated by a semi-colon. 1186 .TP 1187 .B TLSCertificateFile <filename> 1188 Specifies the file that contains the 1189 .B slapd 1190 server certificate. 1191 1192 When using OpenSSL that file may also contain any number of intermediate 1193 certificates after the server certificate. 1194 .TP 1195 .B TLSCertificateKeyFile <filename> 1196 Specifies the file that contains the 1197 .B slapd 1198 server private key that matches the certificate stored in the 1199 .B TLSCertificateFile 1200 file. Currently, the private key must not be protected with a password, so 1201 it is of critical importance that it is protected carefully. 1202 .TP 1203 .B TLSDHParamFile <filename> 1204 This directive specifies the file that contains parameters for Diffie-Hellman 1205 ephemeral key exchange. This is required in order to use a DSA certificate on 1206 the server, or an RSA certificate missing the "key encipherment" key usage. 1207 Note that setting this option may also enable 1208 Anonymous Diffie-Hellman key exchanges in certain non-default cipher suites. 1209 Anonymous key exchanges should generally be avoided since they provide no 1210 actual client or server authentication and provide no protection against 1211 man-in-the-middle attacks. 1212 You should append "!ADH" to your cipher suites to ensure that these suites 1213 are not used. 1214 .TP 1215 .B TLSECName <name> 1216 Specify the name of the curve(s) to use for Elliptic curve Diffie-Hellman 1217 ephemeral key exchange. This option is only used for OpenSSL. 1218 This option is not used with GnuTLS; the curves may be 1219 chosen in the GnuTLS ciphersuite specification. 1220 .TP 1221 .B TLSProtocolMin <major>[.<minor>] 1222 Specifies minimum SSL/TLS protocol version that will be negotiated. 1223 If the server doesn't support at least that version, 1224 the SSL handshake will fail. 1225 To require TLS 1.x or higher, set this option to 3.(x+1), 1226 e.g., 1227 1228 .nf 1229 TLSProtocolMin 3.2 1230 .fi 1231 1232 would require TLS 1.1. 1233 Specifying a minimum that is higher than that supported by the 1234 OpenLDAP implementation will result in it requiring the 1235 highest level that it does support. 1236 This directive is ignored with GnuTLS. 1237 .TP 1238 .B TLSRandFile <filename> 1239 Specifies the file to obtain random bits from when /dev/[u]random 1240 is not available. Generally set to the name of the EGD/PRNGD socket. 1241 The environment variable RANDFILE can also be used to specify the filename. 1242 This directive is ignored with GnuTLS. 1243 .TP 1244 .B TLSVerifyClient <level> 1245 Specifies what checks to perform on client certificates in an 1246 incoming TLS session, if any. 1247 The 1248 .B <level> 1249 can be specified as one of the following keywords: 1250 .RS 1251 .TP 1252 .B never 1253 This is the default. 1254 .B slapd 1255 will not ask the client for a certificate. 1256 .TP 1257 .B allow 1258 The client certificate is requested. If no certificate is provided, 1259 the session proceeds normally. If a bad certificate is provided, 1260 it will be ignored and the session proceeds normally. 1261 .TP 1262 .B try 1263 The client certificate is requested. If no certificate is provided, 1264 the session proceeds normally. If a bad certificate is provided, 1265 the session is immediately terminated. 1266 .TP 1267 .B demand | hard | true 1268 These keywords are all equivalent, for compatibility reasons. 1269 The client certificate is requested. If no certificate is provided, 1270 or a bad certificate is provided, the session is immediately terminated. 1271 1272 Note that a valid client certificate is required in order to use the 1273 SASL EXTERNAL authentication mechanism with a TLS session. As such, 1274 a non-default 1275 .B TLSVerifyClient 1276 setting must be chosen to enable SASL EXTERNAL authentication. 1277 .RE 1278 .TP 1279 .B TLSCRLCheck <level> 1280 Specifies if the Certificate Revocation List (CRL) of the CA should be 1281 used to verify if the client certificates have not been revoked. This 1282 requires 1283 .B TLSCACertificatePath 1284 parameter to be set. This directive is ignored with GnuTLS. 1285 .B <level> 1286 can be specified as one of the following keywords: 1287 .RS 1288 .TP 1289 .B none 1290 No CRL checks are performed 1291 .TP 1292 .B peer 1293 Check the CRL of the peer certificate 1294 .TP 1295 .B all 1296 Check the CRL for a whole certificate chain 1297 .RE 1298 .TP 1299 .B TLSCRLFile <filename> 1300 Specifies a file containing a Certificate Revocation List to be used 1301 for verifying that certificates have not been revoked. This directive is 1302 only valid when using GnuTLS. 1303 .SH GENERAL BACKEND OPTIONS 1304 Options in this section only apply to the configuration file section 1305 of all instances of the specified backend. All backends may support 1306 this class of options, but currently only back-mdb does. 1307 .TP 1308 .B backend <databasetype> 1309 Mark the beginning of a backend definition. <databasetype> 1310 should be one of 1311 .BR asyncmeta , 1312 .BR config , 1313 .BR dnssrv , 1314 .BR ldap , 1315 .BR ldif , 1316 .BR mdb , 1317 .BR meta , 1318 .BR monitor , 1319 .BR null , 1320 .BR passwd , 1321 .BR perl , 1322 .BR relay , 1323 .BR sock , 1324 .BR sql , 1325 or 1326 .BR wt . 1327 At present, only back-mdb implements any options of this type, so this 1328 setting is not needed for any other backends. 1329 1330 .SH GENERAL DATABASE OPTIONS 1331 Options in this section only apply to the configuration file section 1332 for the database in which they are defined. They are supported by every 1333 type of backend. Note that the 1334 .B database 1335 and at least one 1336 .B suffix 1337 option are mandatory for each database. 1338 .TP 1339 .B database <databasetype> 1340 Mark the beginning of a new database instance definition. <databasetype> 1341 should be one of 1342 .BR asyncmeta , 1343 .BR config , 1344 .BR dnssrv , 1345 .BR ldap , 1346 .BR ldif , 1347 .BR mdb , 1348 .BR meta , 1349 .BR monitor , 1350 .BR null , 1351 .BR passwd , 1352 .BR perl , 1353 .BR relay , 1354 .BR sock , 1355 .BR sql , 1356 or 1357 .BR wt , 1358 depending on which backend will serve the database. 1359 1360 LDAP operations, even subtree searches, normally access only one 1361 database. 1362 That can be changed by gluing databases together with the 1363 .B subordinate 1364 keyword. 1365 Access controls and some overlays can also involve multiple databases. 1366 .TP 1367 .B add_content_acl on | off 1368 Controls whether Add operations will perform ACL checks on 1369 the content of the entry being added. This check is off 1370 by default. See the 1371 .BR slapd.access (5) 1372 manual page for more details on ACL requirements for 1373 Add operations. 1374 .TP 1375 .B extra_attrs <attrlist> 1376 Lists what attributes need to be added to search requests. 1377 Local storage backends return the entire entry to the frontend. 1378 The frontend takes care of only returning the requested attributes 1379 that are allowed by ACLs. 1380 However, features like access checking and so may need specific 1381 attributes that are not automatically returned by remote storage 1382 backends, like proxy backends and so on. 1383 .B <attrlist> 1384 is a list of attributes that are needed for internal purposes 1385 and thus always need to be collected, even when not explicitly 1386 requested by clients. 1387 .TP 1388 .B hidden on | off 1389 Controls whether the database will be used to answer 1390 queries. A database that is hidden will never be 1391 selected to answer any queries, and any suffix configured 1392 on the database will be ignored in checks for conflicts 1393 with other databases. By default, hidden is off. 1394 .TP 1395 .B lastmod on | off 1396 Controls whether 1397 .B slapd 1398 will automatically maintain the 1399 modifiersName, modifyTimestamp, creatorsName, and 1400 createTimestamp attributes for entries. It also controls 1401 the entryCSN and entryUUID attributes, which are needed 1402 by the syncrepl provider. By default, lastmod is on. 1403 .TP 1404 .B lastbind on | off 1405 Controls whether 1406 .B slapd 1407 will automatically maintain the pwdLastSuccess attribute for 1408 entries. By default, lastbind is off. 1409 .TP 1410 .B lastbind-precision <integer> 1411 If lastbind is enabled, specifies how frequently pwdLastSuccess 1412 will be updated. More than 1413 .B integer 1414 seconds must have passed since the last successful bind. In a 1415 replicated environment with frequent bind activity it may be 1416 useful to set this to a large value. 1417 .TP 1418 .B limits <selector> <limit> [<limit> [...]] 1419 Specify time and size limits based on the operation's initiator or 1420 base DN. 1421 The argument 1422 .B <selector> 1423 can be any of 1424 .RS 1425 .RS 1426 .TP 1427 anonymous | users | [<dnspec>=]<pattern> | group[/oc[/at]]=<pattern> 1428 1429 .RE 1430 with 1431 .RS 1432 .TP 1433 <dnspec> ::= dn[.<type>][.<style>] 1434 .TP 1435 <type> ::= self | this 1436 .TP 1437 <style> ::= exact | base | onelevel | subtree | children | regex | anonymous 1438 1439 .RE 1440 DN type 1441 .B self 1442 is the default and means the bound user, while 1443 .B this 1444 means the base DN of the operation. 1445 The term 1446 .B anonymous 1447 matches all unauthenticated clients. 1448 The term 1449 .B users 1450 matches all authenticated clients; 1451 otherwise an 1452 .B exact 1453 dn pattern is assumed unless otherwise specified by qualifying 1454 the (optional) key string 1455 .B dn 1456 with 1457 .B exact 1458 or 1459 .B base 1460 (which are synonyms), to require an exact match; with 1461 .BR onelevel , 1462 to require exactly one level of depth match; with 1463 .BR subtree , 1464 to allow any level of depth match, including the exact match; with 1465 .BR children , 1466 to allow any level of depth match, not including the exact match; 1467 .BR regex 1468 explicitly requires the (default) match based on POSIX (''extended'') 1469 regular expression pattern. 1470 Finally, 1471 .B anonymous 1472 matches unbound operations; the 1473 .B pattern 1474 field is ignored. 1475 The same behavior is obtained by using the 1476 .B anonymous 1477 form of the 1478 .B <selector> 1479 clause. 1480 The term 1481 .BR group , 1482 with the optional objectClass 1483 .B oc 1484 and attributeType 1485 .B at 1486 fields, followed by 1487 .BR pattern , 1488 sets the limits for any DN listed in the values of the 1489 .B at 1490 attribute (default 1491 .BR member ) 1492 of the 1493 .B oc 1494 group objectClass (default 1495 .BR groupOfNames ) 1496 whose DN exactly matches 1497 .BR pattern . 1498 1499 The currently supported limits are 1500 .B size 1501 and 1502 .BR time . 1503 1504 The syntax for time limits is 1505 .BR time[.{soft|hard}]=<integer> , 1506 where 1507 .I integer 1508 is the number of seconds slapd will spend answering a search request. 1509 If no time limit is explicitly requested by the client, the 1510 .BR soft 1511 limit is used; if the requested time limit exceeds the 1512 .BR hard 1513 .\"limit, an 1514 .\".I "Administrative limit exceeded" 1515 .\"error is returned. 1516 limit, the value of the limit is used instead. 1517 If the 1518 .BR hard 1519 limit is set to the keyword 1520 .IR soft , 1521 the soft limit is used in either case; if it is set to the keyword 1522 .IR unlimited , 1523 no hard limit is enforced. 1524 Explicit requests for time limits smaller or equal to the 1525 .BR hard 1526 limit are honored. 1527 If no limit specifier is set, the value is assigned to the 1528 .BR soft 1529 limit, and the 1530 .BR hard 1531 limit is set to 1532 .IR soft , 1533 to preserve the original behavior. 1534 1535 The syntax for size limits is 1536 .BR size[.{soft|hard|unchecked}]=<integer> , 1537 where 1538 .I integer 1539 is the maximum number of entries slapd will return answering a search 1540 request. 1541 If no size limit is explicitly requested by the client, the 1542 .BR soft 1543 limit is used; if the requested size limit exceeds the 1544 .BR hard 1545 .\"limit, an 1546 .\".I "Administrative limit exceeded" 1547 .\"error is returned. 1548 limit, the value of the limit is used instead. 1549 If the 1550 .BR hard 1551 limit is set to the keyword 1552 .IR soft , 1553 the soft limit is used in either case; if it is set to the keyword 1554 .IR unlimited , 1555 no hard limit is enforced. 1556 Explicit requests for size limits smaller or equal to the 1557 .BR hard 1558 limit are honored. 1559 The 1560 .BR unchecked 1561 specifier sets a limit on the number of candidates a search request is allowed 1562 to examine. 1563 The rationale behind it is that searches for non-properly indexed 1564 attributes may result in large sets of candidates, which must be 1565 examined by 1566 .BR slapd (8) 1567 to determine whether they match the search filter or not. 1568 The 1569 .B unchecked 1570 limit provides a means to drop such operations before they are even 1571 started. 1572 If the selected candidates exceed the 1573 .BR unchecked 1574 limit, the search will abort with 1575 .IR "Unwilling to perform" . 1576 If it is set to the keyword 1577 .IR unlimited , 1578 no limit is applied (the default). 1579 If it is set to 1580 .IR disabled , 1581 the search is not even performed; this can be used to disallow searches 1582 for a specific set of users. 1583 If no limit specifier is set, the value is assigned to the 1584 .BR soft 1585 limit, and the 1586 .BR hard 1587 limit is set to 1588 .IR soft , 1589 to preserve the original behavior. 1590 1591 In case of no match, the global limits are used. 1592 The default values are the same as for 1593 .B sizelimit 1594 and 1595 .BR timelimit ; 1596 no limit is set on 1597 .BR unchecked . 1598 1599 If 1600 .B pagedResults 1601 control is requested, the 1602 .B hard 1603 size limit is used by default, because the request of a specific page size 1604 is considered an explicit request for a limitation on the number 1605 of entries to be returned. 1606 However, the size limit applies to the total count of entries returned within 1607 the search, and not to a single page. 1608 Additional size limits may be enforced; the syntax is 1609 .BR size.pr={<integer>|noEstimate|unlimited} , 1610 where 1611 .I integer 1612 is the max page size if no explicit limit is set; the keyword 1613 .I noEstimate 1614 inhibits the server from returning an estimate of the total number 1615 of entries that might be returned 1616 (note: the current implementation does not return any estimate). 1617 The keyword 1618 .I unlimited 1619 indicates that no limit is applied to the pagedResults control page size. 1620 The syntax 1621 .B size.prtotal={<integer>|hard|unlimited|disabled} 1622 allows one to set a limit on the total number of entries that the pagedResults 1623 control will return. 1624 By default it is set to the 1625 .B hard 1626 limit which will use the size.hard value. 1627 When set, 1628 .I integer 1629 is the max number of entries that the whole search with pagedResults control 1630 can return. 1631 Use 1632 .I unlimited 1633 to allow unlimited number of entries to be returned, e.g. to allow 1634 the use of the pagedResults control as a means to circumvent size 1635 limitations on regular searches; the keyword 1636 .I disabled 1637 disables the control, i.e. no paged results can be returned. 1638 Note that the total number of entries returned when the pagedResults control 1639 is requested cannot exceed the 1640 .B hard 1641 size limit of regular searches unless extended by the 1642 .B prtotal 1643 switch. 1644 1645 The \fBlimits\fP statement is typically used to let an unlimited 1646 number of entries be returned by searches performed 1647 with the identity used by the consumer for synchronization purposes 1648 by means of the RFC 4533 LDAP Content Synchronization protocol 1649 (see \fBsyncrepl\fP for details). 1650 1651 When using subordinate databases, it is necessary for any limits that 1652 are to be applied across the parent and its subordinates to be defined in 1653 both the parent and its subordinates. Otherwise the settings on the 1654 subordinate databases are not honored. 1655 .RE 1656 .TP 1657 .B maxderefdepth <depth> 1658 Specifies the maximum number of aliases to dereference when trying to 1659 resolve an entry, used to avoid infinite alias loops. The default is 15. 1660 .TP 1661 .B multiprovider on | off 1662 This option puts a consumer database into Multi-Provider mode. Update 1663 operations will be accepted from any user, not just the updatedn. The 1664 database must already be configured as a syncrepl consumer 1665 before this keyword may be set. This mode also requires a 1666 .B serverID 1667 (see above) to be configured. 1668 By default, multiprovider is off. 1669 .TP 1670 .B monitoring on | off 1671 This option enables database-specific monitoring in the entry related 1672 to the current database in the "cn=Databases,cn=Monitor" subtree 1673 of the monitor database, if the monitor database is enabled. 1674 Currently, only the MDB database provides database-specific monitoring. 1675 If monitoring is supported by the backend it defaults to on, otherwise 1676 off. 1677 .TP 1678 .B overlay <overlay-name> 1679 Add the specified overlay to this database. An overlay is a piece of 1680 code that intercepts database operations in order to extend or change 1681 them. Overlays are pushed onto 1682 a stack over the database, and so they will execute in the reverse 1683 of the order in which they were configured and the database itself 1684 will receive control last of all. See the 1685 .BR slapd.overlays (5) 1686 manual page for an overview of the available overlays. 1687 Note that all of the database's 1688 regular settings should be configured before any overlay settings. 1689 .TP 1690 .B readonly on | off 1691 This option puts the database into "read-only" mode. Any attempts to 1692 modify the database will return an "unwilling to perform" error. By 1693 default, readonly is off. 1694 .TP 1695 .B restrict <oplist> 1696 Specify a whitespace separated list of operations that are restricted. 1697 If defined inside a database specification, restrictions apply only 1698 to that database, otherwise they are global. 1699 Operations can be any of 1700 .BR add , 1701 .BR bind , 1702 .BR compare , 1703 .BR delete , 1704 .BR extended[=<OID>] , 1705 .BR modify , 1706 .BR rename , 1707 .BR search , 1708 or the special pseudo-operations 1709 .B read 1710 and 1711 .BR write , 1712 which respectively summarize read and write operations. 1713 The use of 1714 .I restrict write 1715 is equivalent to 1716 .I readonly on 1717 (see above). 1718 The 1719 .B extended 1720 keyword allows one to indicate the OID of the specific operation 1721 to be restricted. 1722 .TP 1723 .B rootdn <dn> 1724 Specify the distinguished name that is not subject to access control 1725 or administrative limit restrictions for operations on this database. 1726 This DN may or may not be associated with an entry. An empty root 1727 DN (the default) specifies no root access is to be granted. It is 1728 recommended that the rootdn only be specified when needed (such as 1729 when initially populating a database). If the rootdn is within 1730 a namingContext (suffix) of the database, a simple bind password 1731 may also be provided using the 1732 .B rootpw 1733 directive. Many optional features, including syncrepl, require the 1734 rootdn to be defined for the database. 1735 .TP 1736 .B rootpw <password> 1737 Specify a password (or hash of the password) for the rootdn. The 1738 password can only be set if the rootdn is within the namingContext 1739 (suffix) of the database. 1740 This option accepts all RFC 2307 userPassword formats known to 1741 the server (see 1742 .B password\-hash 1743 description) as well as cleartext. 1744 .BR slappasswd (8) 1745 may be used to generate a hash of a password. Cleartext 1746 and \fB{CRYPT}\fP passwords are not recommended. If empty 1747 (the default), authentication of the root DN is by other means 1748 (e.g. SASL). Use of SASL is encouraged. 1749 .TP 1750 .B suffix <dn suffix> 1751 Specify the DN suffix of queries that will be passed to this 1752 backend database. Multiple suffix lines can be given and at least one is 1753 required for each database definition. 1754 1755 If the suffix of one database is "inside" that of another, the database 1756 with the inner suffix must come first in the configuration file. 1757 You may also want to glue such databases together with the 1758 .B subordinate 1759 keyword. 1760 .TP 1761 .B subordinate [advertise] 1762 Specify that the current backend database is a subordinate of another 1763 backend database. A subordinate database may have only one suffix. This 1764 option may be used to glue multiple databases into a single namingContext. 1765 If the suffix of the current database is within the namingContext of a 1766 superior database, searches against the superior database will be 1767 propagated to the subordinate as well. All of the databases 1768 associated with a single namingContext should have identical rootdns. 1769 Behavior of other LDAP operations is unaffected by this setting. In 1770 particular, it is not possible to use moddn to move an entry from 1771 one subordinate to another subordinate within the namingContext. 1772 1773 If the optional \fBadvertise\fP flag is supplied, the naming context of 1774 this database is advertised in the root DSE. The default is to hide this 1775 database context, so that only the superior context is visible. 1776 1777 If the slap tools 1778 .BR slapcat (8), 1779 .BR slapadd (8), 1780 .BR slapmodify (8), 1781 or 1782 .BR slapindex (8) 1783 are used on the superior database, any glued subordinates that support 1784 these tools are opened as well. 1785 1786 Databases that are glued together should usually be configured with the 1787 same indices (assuming they support indexing), even for attributes that 1788 only exist in some of these databases. In general, all of the glued 1789 databases should be configured as similarly as possible, since the intent 1790 is to provide the appearance of a single directory. 1791 1792 Note that the \fIsubordinate\fP functionality is implemented internally 1793 by the \fIglue\fP overlay and as such its behavior will interact with other 1794 overlays in use. By default, the glue overlay is automatically configured as 1795 the last overlay on the superior backend. Its position on the backend 1796 can be explicitly configured by setting an \fBoverlay glue\fP directive 1797 at the desired position. This explicit configuration is necessary e.g. 1798 when using the \fIsyncprov\fP overlay, which needs to follow \fIglue\fP 1799 in order to work over all of the glued databases. E.g. 1800 .RS 1801 .nf 1802 database mdb 1803 suffix dc=example,dc=com 1804 ... 1805 overlay glue 1806 overlay syncprov 1807 .fi 1808 .RE 1809 .TP 1810 .B sync_use_subentry 1811 Store the syncrepl contextCSN in a subentry instead of the context entry 1812 of the database. The subentry's RDN will be "cn=ldapsync". By default 1813 the contextCSN is stored in the context entry. 1814 .HP 1815 .hy 0 1816 .B syncrepl rid=<replica ID> 1817 .B provider=ldap[s]://<hostname>[:port] 1818 .B searchbase=<base DN> 1819 .B [type=refreshOnly|refreshAndPersist] 1820 .B [interval=dd:hh:mm:ss] 1821 .B [retry=[<retry interval> <# of retries>]+] 1822 .B [filter=<filter str>] 1823 .B [scope=sub|one|base|subord] 1824 .B [attrs=<attr list>] 1825 .B [exattrs=<attr list>] 1826 .B [attrsonly] 1827 .B [sizelimit=<limit>] 1828 .B [timelimit=<limit>] 1829 .B [schemachecking=on|off] 1830 .B [network\-timeout=<seconds>] 1831 .B [timeout=<seconds>] 1832 .B [tcp\-user\-timeout=<milliseconds>] 1833 .B [bindmethod=simple|sasl] 1834 .B [binddn=<dn>] 1835 .B [saslmech=<mech>] 1836 .B [authcid=<identity>] 1837 .B [authzid=<identity>] 1838 .B [credentials=<passwd>] 1839 .B [realm=<realm>] 1840 .B [secprops=<properties>] 1841 .B [keepalive=<idle>:<probes>:<interval>] 1842 .B [starttls=yes|critical] 1843 .B [tls_cert=<file>] 1844 .B [tls_key=<file>] 1845 .B [tls_cacert=<file>] 1846 .B [tls_cacertdir=<path>] 1847 .B [tls_reqcert=never|allow|try|demand] 1848 .B [tls_reqsan=never|allow|try|demand] 1849 .B [tls_cipher_suite=<ciphers>] 1850 .B [tls_ecname=<names>] 1851 .B [tls_crlcheck=none|peer|all] 1852 .B [tls_protocol_min=<major>[.<minor>]] 1853 .B [suffixmassage=<real DN>] 1854 .B [logbase=<base DN>] 1855 .B [logfilter=<filter str>] 1856 .B [syncdata=default|accesslog|changelog] 1857 .B [lazycommit] 1858 .RS 1859 Specify the current database as a consumer which is kept up-to-date with the 1860 provider content by establishing the current 1861 .BR slapd (8) 1862 as a replication consumer site running a 1863 .B syncrepl 1864 replication engine. 1865 The consumer content is kept synchronized to the provider content using 1866 the LDAP Content Synchronization protocol. Refer to the 1867 "OpenLDAP Administrator's Guide" for detailed information on 1868 setting up a replicated 1869 .B slapd 1870 directory service using the 1871 .B syncrepl 1872 replication engine. 1873 1874 .B rid 1875 identifies the current 1876 .B syncrepl 1877 directive within the replication consumer site. 1878 It is a non-negative integer not greater than 999 (limited 1879 to three decimal digits). 1880 1881 .B provider 1882 specifies the replication provider site containing the provider content 1883 as an LDAP URI. If <port> is not given, the standard LDAP port number 1884 (389 or 636) is used. 1885 1886 The content of the 1887 .B syncrepl 1888 consumer is defined using a search 1889 specification as its result set. The consumer 1890 .B slapd 1891 will send search requests to the provider 1892 .B slapd 1893 according to the search specification. The search specification includes 1894 .BR searchbase ", " scope ", " filter ", " attrs ", " attrsonly ", " sizelimit ", " 1895 and 1896 .B timelimit 1897 parameters as in the normal search specification. The 1898 .B exattrs 1899 option may also be used to specify attributes that should be omitted 1900 from incoming entries. 1901 The \fBscope\fP defaults to \fBsub\fP, the \fBfilter\fP defaults to 1902 \fB(objectclass=*)\fP, and there is no default \fBsearchbase\fP. The 1903 \fBattrs\fP list defaults to \fB"*,+"\fP to return all user and operational 1904 attributes, and \fBattrsonly\fP and \fBexattrs\fP are unset by default. 1905 The \fBsizelimit\fP and \fBtimelimit\fP only 1906 accept "unlimited" and positive integers, and both default to "unlimited". 1907 The \fBsizelimit\fP and \fBtimelimit\fP parameters define 1908 a consumer requested limitation on the number of entries that can be returned 1909 by the LDAP Content Synchronization operation; these should be left unchanged 1910 from the default otherwise replication may never succeed. 1911 Note, however, that any provider-side limits for the replication identity 1912 will be enforced by the provider regardless of the limits requested 1913 by the LDAP Content Synchronization operation, much like for any other 1914 search operation. 1915 1916 The LDAP Content Synchronization protocol has two operation types. 1917 In the 1918 .B refreshOnly 1919 operation, the next synchronization search operation 1920 is periodically rescheduled at an interval time (specified by 1921 .B interval 1922 parameter; 1 day by default) 1923 after each synchronization operation finishes. 1924 In the 1925 .B refreshAndPersist 1926 operation, a synchronization search remains persistent in the provider slapd. 1927 Further updates to the provider will generate 1928 .B searchResultEntry 1929 to the consumer slapd as the search responses to the persistent 1930 synchronization search. If the initial search fails due to an error, the 1931 next synchronization search operation is periodically rescheduled at an 1932 interval time (specified by 1933 .B interval 1934 parameter; 1 day by default) 1935 1936 If an error occurs during replication, the consumer will attempt to 1937 reconnect according to the 1938 .B retry 1939 parameter which is a list of the <retry interval> and <# of retries> pairs. 1940 For example, retry="60 10 300 3" lets the consumer retry every 60 seconds 1941 for the first 10 times and then retry every 300 seconds for the next 3 1942 times before stop retrying. The `+' in <# of retries> means indefinite 1943 number of retries until success. 1944 If no 1945 .B retry 1946 is specified, by default syncrepl retries every hour forever. 1947 1948 The schema checking can be enforced at the LDAP Sync 1949 consumer site by turning on the 1950 .B schemachecking 1951 parameter. The default is \fBoff\fP. 1952 Schema checking \fBon\fP means that replicated entries must have 1953 a structural objectClass, must obey to objectClass requirements 1954 in terms of required/allowed attributes, and that naming attributes 1955 and distinguished values must be present. 1956 As a consequence, schema checking should be \fBoff\fP when partial 1957 replication is used. 1958 1959 The 1960 .B network\-timeout 1961 parameter sets how long the consumer will wait to establish a 1962 network connection to the provider. Once a connection is 1963 established, the 1964 .B timeout 1965 parameter determines how long the consumer will wait for the initial 1966 Bind request to complete. The defaults for these parameters come 1967 from 1968 .BR ldap.conf (5). 1969 The 1970 .B tcp\-user\-timeout 1971 parameter, if non-zero, corresponds to the 1972 .B TCP_USER_TIMEOUT 1973 set on the target connections, overriding the operating system setting. 1974 Only some systems support the customization of this parameter, it is 1975 ignored otherwise and system-wide settings are used. 1976 1977 A 1978 .B bindmethod 1979 of 1980 .B simple 1981 requires the options 1982 .B binddn 1983 and 1984 .B credentials 1985 and should only be used when adequate security services 1986 (e.g. TLS or IPSEC) are in place. 1987 .B REMEMBER: simple bind credentials must be in cleartext! 1988 A 1989 .B bindmethod 1990 of 1991 .B sasl 1992 requires the option 1993 .B saslmech. 1994 Depending on the mechanism, an authentication identity and/or 1995 credentials can be specified using 1996 .B authcid 1997 and 1998 .B credentials. 1999 The 2000 .B authzid 2001 parameter may be used to specify an authorization identity. 2002 Specific security properties (as with the 2003 .B sasl\-secprops 2004 keyword above) for a SASL bind can be set with the 2005 .B secprops 2006 option. A non default SASL realm can be set with the 2007 .B realm 2008 option. 2009 The identity used for synchronization by the consumer should be allowed 2010 to receive an unlimited number of entries in response to a search request. 2011 The provider, other than allowing authentication of the syncrepl identity, 2012 should grant that identity appropriate access privileges to the data 2013 that is being replicated (\fBaccess\fP directive), and appropriate time 2014 and size limits. 2015 This can be accomplished by either allowing unlimited \fBsizelimit\fP 2016 and \fBtimelimit\fP, or by setting an appropriate \fBlimits\fP statement 2017 in the consumer's configuration (see \fBsizelimit\fP and \fBlimits\fP 2018 for details). 2019 2020 The 2021 .B keepalive 2022 parameter sets the values of \fIidle\fP, \fIprobes\fP, and \fIinterval\fP 2023 used to check whether a socket is alive; 2024 .I idle 2025 is the number of seconds a connection needs to remain idle before TCP 2026 starts sending keepalive probes; 2027 .I probes 2028 is the maximum number of keepalive probes TCP should send before dropping 2029 the connection; 2030 .I interval 2031 is interval in seconds between individual keepalive probes. 2032 Only some systems support the customization of these values; 2033 the 2034 .B keepalive 2035 parameter is ignored otherwise, and system-wide settings are used. 2036 2037 The 2038 .B starttls 2039 parameter specifies use of the StartTLS extended operation 2040 to establish a TLS session before Binding to the provider. If the 2041 .B critical 2042 argument is supplied, the session will be aborted if the StartTLS request 2043 fails. Otherwise the syncrepl session continues without TLS. The 2044 .B tls_reqcert 2045 setting defaults to "demand", the 2046 .B tls_reqsan 2047 setting defaults to "allow", and the other TLS settings 2048 default to the same as the main slapd TLS settings. 2049 2050 The 2051 .B suffixmassage 2052 parameter allows the consumer to pull entries from a remote directory 2053 whose DN suffix differs from the local directory. The portion of the 2054 remote entries' DNs that matches the \fIsearchbase\fP will be replaced 2055 with the suffixmassage DN. 2056 2057 Rather than replicating whole entries, the consumer can query logs of 2058 data modifications. This mode of operation is referred to as \fIdelta 2059 syncrepl\fP. In addition to the above parameters, the 2060 .B logbase 2061 and 2062 .B logfilter 2063 parameters must be set appropriately for the log that will be used. The 2064 .B syncdata 2065 parameter must be set to either "accesslog" if the log conforms to the 2066 .BR slapo\-accesslog (5) 2067 log format, or "changelog" if the log conforms 2068 to the obsolete \fIchangelog\fP format. If the 2069 .B syncdata 2070 parameter is omitted or set to "default" then the log parameters are 2071 ignored. 2072 2073 The 2074 .B lazycommit 2075 parameter tells the underlying database that it can store changes without 2076 performing a full flush after each change. This may improve performance 2077 for the consumer, while sacrificing safety or durability. 2078 .RE 2079 .TP 2080 .B updatedn <dn> 2081 This option is only applicable in a replica 2082 database. 2083 It specifies the DN permitted to update (subject to access controls) 2084 the replica. It is only needed in certain push-mode 2085 replication scenarios. Generally, this DN 2086 .I should not 2087 be the same as the 2088 .B rootdn 2089 used at the provider. 2090 .TP 2091 .B updateref <url> 2092 Specify the referral to pass back when 2093 .BR slapd (8) 2094 is asked to modify a replicated local database. 2095 If specified multiple times, each url is provided. 2096 2097 .SH DATABASE-SPECIFIC OPTIONS 2098 Each database may allow specific configuration options; they are 2099 documented separately in the backends' manual pages. See the 2100 .BR slapd.backends (5) 2101 manual page for an overview of available backends. 2102 .SH EXAMPLES 2103 .LP 2104 Here is a short example of a configuration file: 2105 .LP 2106 .RS 2107 .nf 2108 include /etc/openldap/schema/core.schema 2109 pidfile /var/openldap/run/slapd.pid 2110 2111 # Subtypes of "name" (e.g. "cn" and "ou") with the 2112 # option ";x\-hidden" can be searched for/compared, 2113 # but are not shown. See \fBslapd.access\fP(5). 2114 attributeoptions x\-hidden lang\- 2115 access to attrs=name;x\-hidden by * =cs 2116 2117 # Protect passwords. See \fBslapd.access\fP(5). 2118 access to attrs=userPassword by * auth 2119 # Read access to other attributes and entries. 2120 access to * by * read 2121 2122 database mdb 2123 suffix "dc=our\-domain,dc=com" 2124 # The database directory MUST exist prior to 2125 # running slapd AND should only be accessible 2126 # by the slapd/tools. Mode 0700 recommended. 2127 directory /var/openldap/openldap\-data 2128 # Indices to maintain 2129 index objectClass eq 2130 index cn,sn,mail pres,eq,approx,sub 2131 2132 # We serve small clients that do not handle referrals, 2133 # so handle remote lookups on their behalf. 2134 database ldap 2135 suffix "" 2136 uri ldap://ldap.some\-server.com/ 2137 lastmod off 2138 .fi 2139 .RE 2140 .LP 2141 "OpenLDAP Administrator's Guide" contains a longer annotated 2142 example of a configuration file. 2143 The original /etc/openldap/slapd.conf is another example. 2144 .SH FILES 2145 .TP 2146 /etc/openldap/slapd.conf 2147 default slapd configuration file 2148 .SH SEE ALSO 2149 .BR ldap (3), 2150 .BR gnutls\-cli (1), 2151 .BR slapd\-config (5), 2152 .BR slapd.access (5), 2153 .BR slapd.backends (5), 2154 .BR slapd.overlays (5), 2155 .BR slapd.plugin (5), 2156 .BR slapd (8), 2157 .BR slapacl (8), 2158 .BR slapadd (8), 2159 .BR slapauth (8), 2160 .BR slapcat (8), 2161 .BR slapdn (8), 2162 .BR slapindex (8), 2163 .BR slapmodify (8), 2164 .BR slappasswd (8), 2165 .BR slaptest (8). 2166 .LP 2167 "OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) 2168 .SH ACKNOWLEDGEMENTS 2169 .lf 1 ./../Project 2170 .\" Shared Project Acknowledgement Text 2171 .B "OpenLDAP Software" 2172 is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. 2173 .B "OpenLDAP Software" 2174 is derived from the University of Michigan LDAP 3.3 Release. 2175 .lf 2169 stdin 2176
Indexes created Tue Mar 03 05:31:39 UTC 2026