1 .TH SLAPD-LDAP 5 "RELEASEDATE" "OpenLDAP LDVERSION"
2 .\" Copyright 1998-2003 The OpenLDAP Foundation All Rights Reserved.
3 .\" Copying restrictions apply. See COPYRIGHT/LICENSE.
6 slapd-ldap \- LDAP backend to slapd
12 is not an actual database; instead it acts as a proxy to forward incoming
13 requests to another LDAP server. While processing requests it will also
14 chase referrals, so that referrals are fully processed instead of being
15 returned to the slapd client.
17 Sessions that explicitly Bind to the back-ldap database always create their
18 own private connection to the remote LDAP server. Anonymous sessions will
19 share a single anonymous connection to the remote server. For sessions bound
20 through other mechanisms, all sessions with the same DN will share the
21 same connection. This connection pooling strategy can enhance the proxy's
22 efficiency by reducing the overhead of repeatedly making/breaking multiple
28 options apply to the LDAP backend database.
29 That is, they must follow a "database ldap" line and come before any
30 subsequent "backend" or "database" lines.
31 Other database options are described in the
35 Note: It is strongly recommended to set
44 This is because operational attributes related to entry creation and
45 modification should not be used, as they could be passed to the target
46 servers, generating an error.
49 LDAP server to use. Multiple URIs can be set in in a single
51 argument, resulting in the underlying library automatically
52 call the first server of the list that responds, e.g.
54 \fBuri "ldap://host/ ldap://backup-host"\fP
56 The URI list is space- or comma-separated.
59 Obsolete option; same as `uri ldap://<hostport>/'.
61 .B binddn "<administrative DN for access control purposes>"
62 DN which is used to query the target server for acl checking; it
63 should have read access on the target server to attributes used on the
64 proxy for acl checking.
65 There is no risk of giving away such values; they are only used to
69 Password used with the bind DN above.
72 Turns on proxying of the WhoAmI extended operation. If this option is
73 given, back-ldap will replace slapd's original WhoAmI routine with its
74 own. On slapd sessions that were authenticated by back-ldap, the WhoAmI
75 request will be forwarded to the remote LDAP server. Other sessions will
76 be handled by the local slapd, as before. This option is mainly useful
77 in conjunction with Proxy Authorization.
80 If this option is given, the client's bind credentials are remembered
81 for rebinds when chasing referrals.
83 .B suffixmassage <suffix> <massaged (remote) suffix>
84 DNs ending with <suffix> in a request are changed to end with <remote
85 suffix> before sending the request to the remote server, and <remote
86 suffix> in the results are changed back to <suffix> before returning
88 The <suffix> field must be defined as a valid suffix
89 for the current database.
91 .B map "{attribute | objectclass} [<local name> | *] {<foreign name> | *}"
92 Map attribute names and object classes from the foreign server to
93 different values on the local slapd.
94 The reason is that some attributes might not be part of the local
95 slapd's schema, some attribute names might be different but serve the
97 If local or foreign name is `*', the name is preserved.
98 If local name is omitted, the foreign name is removed.
99 Unmapped names are preseved if both local and foreign name are `*',
100 and removed if local name is omitted and foreign name is `*'.
103 The rewrite options are described in the "REWRITING" section of the
107 This maps the OpenLDAP objectclass `groupOfNames' to the Active
108 Directory objectclass `group':
112 map objectclass groupOfNames group
116 This presents a limited attribute set from the foreign
123 map attribute manager *
124 map attribute description *
129 These lines map cn, sn, manager, and description to themselves, and
130 any other attribute gets "removed" from the object before it is sent
131 to the client (or sent up to the LDAP server). This is obviously a
132 simplistic example, but you get the point.
136 default slapd configuration file
143 Howard Chu, with enhancements by Pierangelo Masarati