ITS#2497 value-level ACLs

[openldap] / doc / guide / admin / slapdconfig.sdf

diff --git a/doc/guide/admin/slapdconfig.sdf b/doc/guide/admin/slapdconfig.sdf
index de6e8798df2e4ff7769324c2584c85e0adf3e458..7b6bf2464c9e85849190237aca9b42dcf7620428 100644 (file)
--- a/doc/guide/admin/slapdconfig.sdf
+++ b/doc/guide/admin/slapdconfig.sdf
@@ -285,9 +285,9 @@ perform" error.
 H4: replica
 
 >      replica host=<hostname>[:<port>]
 H4: replica
 
 >      replica host=<hostname>[:<port>]

->              [bindmethod={ simple | kerberos | sasl }]
+>              [bindmethod={simple|kerberos|sasl}]

 >              ["binddn=<DN>"]
 >              ["binddn=<DN>"]

->              [mech=<mech>]
+>              [saslmech=<mech>]

 >              [authcid=<identity>]
 >              [authzid=<identity>]
 >              [credentials=<password>]
 >              [authcid=<identity>]
 >              [authzid=<identity>]
 >              [credentials=<password>]


@@ -323,7 +323,7 @@ mechanisms.  Kerberos authentication requires {{EX:binddn}} and
 {{EX:srvtab}} parameters.
 
 SASL authentication is generally recommended.  SASL authentication
 {{EX:srvtab}} parameters.
 
 SASL authentication is generally recommended.  SASL authentication

-requires specification of a mechanism using the {{EX:mech}} parameter.
+requires specification of a mechanism using the {{EX:saslmech}} parameter.

 Depending on the mechanism, an authentication identity and/or
 credentials can be specified using {{EX:authcid}} and {{EX:credentials}}
 respectively.  The {{EX:authzid}} parameter may be used to specify
 Depending on the mechanism, an authentication identity and/or
 credentials can be specified using {{EX:authcid}} and {{EX:credentials}}
 respectively.  The {{EX:authzid}} parameter may be used to specify


@@ -405,6 +405,79 @@ looks at the suffix line(s) in each database definition in the
 order they appear in the file. Thus, if one database suffix is a
 prefix of another, it must appear after it in the config file.
 
 order they appear in the file. Thus, if one database suffix is a
 prefix of another, it must appear after it in the config file.
 

+H4: syncrepl
+
+>      syncrepl id=<replica ID>
+>              provider=ldap[s]://<hostname>[:port]
+>              [updatedn=<dn>]
+>              [binddn=<dn>]
+>              [bindmethod=simple|sasl]
+>              [binddn=<simple DN>]
+>              [credentials=<simple passwd>]
+>              [saslmech=<SASL mech>]
+>              [secprops=<properties>]
+>              [realm=<realm>]
+>              [authcId=<authentication ID>]
+>              [authzId=<authorization ID>]
+>              [searchbase=<base DN>]
+>              [filter=<filter str>]
+>              [attrs=<attr list>]
+>              [scope=sub|one|base]
+>              [schemachecking=on|off]
+>              [type=refreshOnly|refreshAndPersist]
+>              [interval=dd:hh:mm]
+
+This directive specifies an LDAP Sync replication between this
+database and the specified replication provider site. The id=
+parameter identifies the LDAP Sync specification in the database.
+The {{EX:provider=}} parameter specifies a replication provider site as
+an LDAP URI.
+
+The LDAP Sync replication specification is based on the search
+specification which defines the content of the replica. The replica
+consists of the entries matching the search specification. As with
+the normal searches, the search specification consists of
+{{EX:searchbase}}, {{EX:scope}}, {{EX:filter}}, and EX:attrs}}
+parameters.
+
+The LDAP Sync replication has two types of operating modes. In the
+{{EX:refreshOnly}} mode, the next synchronization session is
+rescheduled at the interval time after the current session finishes.
+The default interval is set to one day. In the {{EX:refreshAndPersist}}
+mode, the LDAP Sync search remains persistent in the provider LDAP
+server. Further updates to the provider replica will generate
+searchResultEntry to the consumer.
+
+The schema checking can be enforced at the LDAP Sync consumer site
+by turning on the {{EX:schemachecking}} parameter. The default is off.
+
+The {{EX:binddn=}} parameter gives the DN for the LDAP Sync search
+to bind as to the provider slapd. The content of the replica will
+be subject to the access control privileges of the DN.
+
+The {{EX:bindmethod}} is {{EX:simple}} or {{EX:sasl}}, depending
+on whether simple password-based authentication or SASL authentication
+is to be used when connecting to the provider slapd.
+
+Simple authentication should not be used unless adequate integrity
+and data confidential protections are in place (e.g. TLS or IPSEC).
+Simple authentication requires specification of {{EX:binddn}} and
+{{EX:credentials}} parameters.
+
+SASL authentication is generally recommended. SASL authentication
+requires specification of a mechanism using the {{EX:mech}} parameter.
+Depending on the mechanism, an authentication identity and/or
+credentials can be specified using {{EX:authcid}} and {{EX:credentials}}
+respectively.  The {{EX:authzid}} parameter may be used to specify
+a proxy authorization identity.
+
+The LDAP Sync replication is supported in three native backends:
+back-bdb, back-hdb, and back-ldbm.
+
+See the {{SECT:LDAP Sync Replication}} chapter for more information
+on how to use this directive.
+
+

 H4: updatedn <dn>
 
 This directive is only applicable in a slave slapd. It specifies
 H4: updatedn <dn>
 
 This directive is only applicable in a slave slapd. It specifies


@@ -558,7 +631,7 @@ access line is:
 >              [filter=<ldapfilter>] [attrs=<attrlist>]
 >      <basic-style> ::= regex | exact
 >      <scope-style> ::= base | one | subtree | children
 >              [filter=<ldapfilter>] [attrs=<attrlist>]
 >      <basic-style> ::= regex | exact
 >      <scope-style> ::= base | one | subtree | children

->      <attrlist> ::= <attr> | <attr> , <attrlist>
+>      <attrlist> ::= <attr> [val[.<basic-style>]=<regex>] | <attr> , <attrlist>

 >      <attr> ::= <attrname> | entry | children
 >      <who> ::= * | [anonymous | users | self
 >                      | dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>] 
 >      <attr> ::= <attrname> | entry | children
 >      <who> ::= * | [anonymous | users | self
 >                      | dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>] 


@@ -636,8 +709,8 @@ search filter, as described in {{REF:RFC2254}}.  For example:
 
 >      by filter=(objectClass=person)
 
 
 >      by filter=(objectClass=person)
 

-Note that entries by be select by both DN and filter by
-include both qualifiers in the <what> clause.
+Note that entries may be selected by both DN and filter by
+including both qualifiers in the <what> clause.

 
 >      by dn.one="ou=people,o=suffix" filter=(objectClass=person)
 
 
 >      by dn.one="ou=people,o=suffix" filter=(objectClass=person)
 


@@ -646,8 +719,13 @@ list of attribute names in the <what> selector:
 
 >      attrs=<attribute list>
 
 
 >      attrs=<attribute list>
 

-There are two special {{psuedo}} attributes {{EX:entry}} and
-{{EX:children}}.  To read (and hence return) an target entry, the
+A specific value of an attribute is selected by using a single
+attribute name and also using a value selector:
+
+>      attrs=<attribute> val[.<style>]=<regex>
+
+There are two special {{pseudo}} attributes {{EX:entry}} and
+{{EX:children}}.  To read (and hence return) a target entry, the

 subject must have {{EX:read}} access to the target's {{entry}}
 attribute.  To add or delete an entry, the subject must have
 {{EX:write}} access to the entry's {{EX:entry}} attribute AND must
 subject must have {{EX:read}} access to the target's {{entry}}
 attribute.  To add or delete an entry, the subject must have
 {{EX:write}} access to the entry's {{EX:entry}} attribute AND must


@@ -682,14 +760,9 @@ dn.<scope-style>=<DN>|Users within scope of a DN
 
 The DN specifier behaves much like <what> clause DN specifiers.
 
 
 The DN specifier behaves much like <what> clause DN specifiers.
 

-Other control factors are also supported.
-For example, a {{EX:<who>}} can be restricted by a
-regular expression matching the client's domain name:
-
->      domain=<regular expression>
-
-or by an entry listed in a DN-valued attribute in the entry to
-which the access applies:
+Other control factors are also supported.  For example, a {{EX:<who>}}
+can be restricted by an entry listed in a DN-valued attribute in
+the entry to which the access applies:

 
 >      dnattr=<dn-valued attribute name>
 
 
 >      dnattr=<dn-valued attribute name>
 


@@ -698,6 +771,10 @@ whose DN is listed in an attribute of the entry (e.g., give
 access to a group entry to whoever is listed as the owner of
 the group entry).
 
 access to a group entry to whoever is listed as the owner of
 the group entry).
 

+Some factors may not be appropriate in all environments (or any).
+For example, the domain factor relies on IP to domain name lookups.
+As these can easily spoofed, the domain factor should not be avoided.
+

 
 H3: The access to grant
 
 
 H3: The access to grant
 


@@ -772,11 +849,12 @@ This access directive grants read access to everyone.
 >              by anonymous auth
 >              by * read
 
 >              by anonymous auth
 >              by * read
 

-This directive allows users to modify their own entries, allows
-authenticate, and allows all others to read.  Note that only the
-first {{EX:by <who>}} clause which matches applies.  Hence, the
-anonymous users are granted {{EX:auth}}, not {{EX:read}}.  The last
-clause could just as well have been "{{EX:by users read}}".
+This directive allows the user to modify their entry, allows anonymous
+to authentication against these entries, and allows all others to
+read these entries.  Note that only the first {{EX:by <who>}} clause
+which matches applies.  Hence, the anonymous users are granted
+{{EX:auth}}, not {{EX:read}}.  The last clause could just as well
+have been "{{EX:by users read}}".

 
 It is often desirable to restrict operations based upon the level
 of protection in place.  The following shows how security strength
 
 It is often desirable to restrict operations based upon the level
 of protection in place.  The following shows how security strength


@@ -789,10 +867,12 @@ factors (SSF) can be used.
 
 This directive allows users to modify their own entries if security
 protections have of strength 128 or better have been established,
 
 This directive allows users to modify their own entries if security
 protections have of strength 128 or better have been established,

-allows simple authentication and read access when 64 or better
-security protections have been established.
+allows authentication access to anonymous users, and read access
+when 64 or better security protections have been established.  If
+client has not establish sufficient security protections, the
+implicit {{EX:by * none}} clause would be applied.

 
 

-The following example shows the use of a regular expression
+The following example shows the use of a style specifiers

 to select the entries by DN in two access directives where
 ordering is significant.
 
 to select the entries by DN in two access directives where
 ordering is significant.
 


@@ -823,7 +903,7 @@ attribute and various {{EX:<who>}} selectors.
 >      access to dn.subtree="dc=example,dc=com" attr=homePhone
 >              by self write
 >              by dn.children=dc=example,dc=com" search
 >      access to dn.subtree="dc=example,dc=com" attr=homePhone
 >              by self write
 >              by dn.children=dc=example,dc=com" search

->              by domain=.*\.example\.com read
+>              by peername=IP:10\..+ read

 >      access to dn.subtree="dc=example,dc=com"
 >              by self write
 >              by dn.children="dc=example,dc=com" search
 >      access to dn.subtree="dc=example,dc=com"
 >              by self write
 >              by dn.children="dc=example,dc=com" search


@@ -836,9 +916,9 @@ by them, anybody else has no access (implicit {{EX:by * none}})
 excepting for authentication/authorization (which is always done
 anonymously).  The {{EX:homePhone}} attribute is writable by the
 entry, searchable by entries under {{EX:example.com}}, readable by
 excepting for authentication/authorization (which is always done
 anonymously).  The {{EX:homePhone}} attribute is writable by the
 entry, searchable by entries under {{EX:example.com}}, readable by

-clients connecting from somewhere in the {{EX:example.com}} domain,
-and otherwise not readable (implicit {{EX:by * none}}).  All other
-access is denied by the implicit {{EX:access to * by * none}}.
+clients connecting from network 10, and otherwise not readable
+(implicit {{EX:by * none}}).  All other access is denied by the
+implicit {{EX:access to * by * none}}.

 
 Sometimes it is useful to permit a particular DN to add or
 remove itself from an attribute. For example, if you would like to
 
 Sometimes it is useful to permit a particular DN to add or
 remove itself from an attribute. For example, if you would like to