allow to specify a per-database list of attributes that need to be always collected...

[openldap] / doc / man / man5 / slapd-config.5

diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5
index 06197ed4dd9a4e17582bfe563ad6cadd9a9e64e4..69e024d6cd45ca5e0554b16ec8e3e94c2f75710e 100644 (file)
--- a/doc/man/man5/slapd-config.5
+++ b/doc/man/man5/slapd-config.5
@@ -1,9 +1,9 @@
 .TH SLAPD-CONFIG 5 "RELEASEDATE" "OpenLDAP LDVERSION"
 .TH SLAPD-CONFIG 5 "RELEASEDATE" "OpenLDAP LDVERSION"

-.\" Copyright 1998-2009 The OpenLDAP Foundation All Rights Reserved.
+.\" Copyright 1998-2010 The OpenLDAP Foundation All Rights Reserved.

 .\" Copying restrictions apply.  See COPYRIGHT/LICENSE.
 .\" $OpenLDAP$
 .SH NAME
 .\" Copying restrictions apply.  See COPYRIGHT/LICENSE.
 .\" $OpenLDAP$
 .SH NAME

-slapd-config \- configuration backend to slapd
+slapd\-config \- configuration backend to slapd

 .SH SYNOPSIS
 ETCDIR/slapd.d
 .SH DESCRIPTION
 .SH SYNOPSIS
 ETCDIR/slapd.d
 .SH DESCRIPTION


@@ -109,7 +109,7 @@ reading the attribute via LDAP, the items will be returned as individual
 attribute values.
 
 Backend-specific options are discussed in the
 attribute values.
 
 Backend-specific options are discussed in the

-.B slapd-<backend>(5)
+.B slapd\-<backend>(5)

 manual pages.  Refer to the "OpenLDAP Administrator's Guide" for more
 details on configuring slapd.
 .SH GLOBAL CONFIGURATION OPTIONS
 manual pages.  Refer to the "OpenLDAP Administrator's Guide" for more
 details on configuring slapd.
 .SH GLOBAL CONFIGURATION OPTIONS


@@ -148,30 +148,46 @@ server's command line (program name and options).
 .TP
 .B olcAttributeOptions: <option-name>...
 Define tagging attribute options or option tag/range prefixes.
 .TP
 .B olcAttributeOptions: <option-name>...
 Define tagging attribute options or option tag/range prefixes.

-Options must not end with `-', prefixes must end with `-'.
-The `lang-' prefix is predefined.
+Options must not end with `\-', prefixes must end with `\-'.
+The `lang\-' prefix is predefined.

 If you use the
 .B olcAttributeOptions
 If you use the
 .B olcAttributeOptions

-directive, `lang-' will no longer be defined and you must specify it
+directive, `lang\-' will no longer be defined and you must specify it

 explicitly if you want it defined.
 
 An attribute description with a tagging option is a subtype of that
 attribute description without the option.
 Except for that, options defined this way have no special semantics.
 explicitly if you want it defined.
 
 An attribute description with a tagging option is a subtype of that
 attribute description without the option.
 Except for that, options defined this way have no special semantics.

-Prefixes defined this way work like the `lang-' options:
+Prefixes defined this way work like the `lang\-' options:

 They define a prefix for tagging options starting with the prefix.
 They define a prefix for tagging options starting with the prefix.

-That is, if you define the prefix `x-foo-', you can use the option
-`x-foo-bar'.
+That is, if you define the prefix `x\-foo\-', you can use the option
+`x\-foo\-bar'.

 Furthermore, in a search or compare, a prefix or range name (with
 Furthermore, in a search or compare, a prefix or range name (with

-a trailing `-') matches all options starting with that name, as well
-as the option with the range name sans the trailing `-'.
-That is, `x-foo-bar-' matches `x-foo-bar' and `x-foo-bar-baz'.
+a trailing `\-') matches all options starting with that name, as well
+as the option with the range name sans the trailing `\-'.
+That is, `x\-foo\-bar\-' matches `x\-foo\-bar' and `x\-foo\-bar\-baz'.

 
 

-RFC 4520 reserves options beginning with `x-' for private experiments.
+RFC 4520 reserves options beginning with `x\-' for private experiments.

 Other options should be registered with IANA, see RFC 4520 section 3.5.
 OpenLDAP also has the `binary' option built in, but this is a transfer
 option, not a tagging option.
 .TP
 Other options should be registered with IANA, see RFC 4520 section 3.5.
 OpenLDAP also has the `binary' option built in, but this is a transfer
 option, not a tagging option.
 .TP

+.B olcAuthIDRewrite: <rewrite\-rule>
+Used by the authentication framework to convert simple user names
+to an LDAP DN used for authorization purposes.
+Its purpose is analogous to that of
+.BR olcAuthzRegexp
+(see below).
+The
+.B rewrite\-rule
+is a set of rules analogous to those described in
+.BR slapo\-rwm (5)
+for data rewriting (after stripping the \fIrwm\-\fP prefix).
+.B olcAuthIDRewrite
+and
+.B olcAuthzRegexp
+should not be intermixed.
+.TP

 .B olcAuthzPolicy: <policy>
 Used to specify which rules to use for Proxy Authorization.  Proxy
 authorization allows a client to authenticate to the server using one
 .B olcAuthzPolicy: <policy>
 Used to specify which rules to use for Proxy Authorization.  Proxy
 authorization allows a client to authenticate to the server using one


@@ -430,13 +446,27 @@ upon StartTLS operation receipt.
 disallows the StartTLS operation if authenticated (see also
 .BR tls_2_anon ).
 .TP
 disallows the StartTLS operation if authenticated (see also
 .BR tls_2_anon ).
 .TP

+.B olcExtraAttrs: <attr>
+Lists what attributes need to be added to search requests.
+Local storage backends return the entire entry to the frontend.
+The frontend takes care of only returning the requested attributes
+that are allowed by ACLs.
+However, features like access checking and so may need specific
+attributes that are not automatically returned by remote storage
+backends, like proxy backends and so on.
+.B <attr>
+is an attribute that is needed for internal purposes
+and thus always needs to be collected, even when not explicitly
+requested by clients.
+This attribute is multi-valued.
+.TP

 .B olcGentleHUP: { TRUE | FALSE }
 A SIGHUP signal will only cause a 'gentle' shutdown-attempt:
 .B Slapd
 will stop listening for new connections, but will not close the
 connections to the current clients.  Future write operations return
 unwilling-to-perform, though.  Slapd terminates when all clients
 .B olcGentleHUP: { TRUE | FALSE }
 A SIGHUP signal will only cause a 'gentle' shutdown-attempt:
 .B Slapd
 will stop listening for new connections, but will not close the
 connections to the current clients.  Future write operations return
 unwilling-to-perform, though.  Slapd terminates when all clients

-have closed their connections (if they ever do), or \- as before \-
+have closed their connections (if they ever do), or - as before -

 if it receives a SIGTERM signal.  This can be useful if you wish to
 terminate the server and start a new
 .B slapd
 if it receives a SIGTERM signal.  This can be useful if you wish to
 terminate the server and start a new
 .B slapd


@@ -601,7 +631,7 @@ or as a list of the names that are shown between brackets, such that
 are equivalent.
 The keyword 
 .B any
 are equivalent.
 The keyword 
 .B any

-can be used as a shortcut to enable logging at all levels (equivalent to -1).
+can be used as a shortcut to enable logging at all levels (equivalent to \-1).

 The keyword
 .BR none ,
 or the equivalent integer representation, causes those messages
 The keyword
 .BR none ,
 or the equivalent integer representation, causes those messages


@@ -652,7 +682,7 @@ If multiple values are specified, each url is provided.
 .B olcReverseLookup: TRUE | FALSE
 Enable/disable client name unverified reverse lookup (default is 
 .BR FALSE 
 .B olcReverseLookup: TRUE | FALSE
 Enable/disable client name unverified reverse lookup (default is 
 .BR FALSE 

-if compiled with --enable-rlookups).
+if compiled with \-\-enable\-rlookups).

 .TP
 .B olcRootDSE: <file>
 Specify the name of an LDIF(5) file containing user defined attributes
 .TP
 .B olcRootDSE: <file>
 Specify the name of an LDIF(5) file containing user defined attributes


@@ -663,7 +693,7 @@ The root DSE is an entry with information about the server and its
 capabilities, in operational attributes.
 It has the empty DN, and can be read with e.g.:
 .ti +4
 capabilities, in operational attributes.
 It has the empty DN, and can be read with e.g.:
 .ti +4

-ldapsearch -x -b "" -s base "+"
+ldapsearch \-x \-b "" \-s base "+"

 .br
 See RFC 4512 section 5.1 for details.
 .TP
 .br
 See RFC 4512 section 5.1 for details.
 .TP


@@ -723,7 +753,10 @@ property specifies the maximum security layer receive buffer
 size allowed.  0 disables security layers.  The default is 65536.
 .TP
 .B olcServerID: <integer> [<URL>]
 size allowed.  0 disables security layers.  The default is 65536.
 .TP
 .B olcServerID: <integer> [<URL>]

-Specify an integer ID from 0 to 4095 for this server. These IDs are
+Specify an integer ID from 0 to 4095 for this server (limited
+to 3 hexadecimal digits).  The ID may also be specified as a
+hexadecimal ID by prefixing the value with "0x".
+These IDs are

 required when using multimaster replication and each master must have a
 unique ID. Note that this requirement also applies to separate masters
 contributing to a glued set of databases.
 required when using multimaster replication and each master must have a
 unique ID. Note that this requirement also applies to separate masters
 contributing to a glued set of databases.


@@ -747,6 +780,16 @@ The default is 262143.
 Specify the maximum incoming LDAP PDU size for authenticated sessions.
 The default is 4194303.
 .TP
 Specify the maximum incoming LDAP PDU size for authenticated sessions.
 The default is 4194303.
 .TP

+.B olcTCPBuffer [listener=<URL>] [{read|write}=]<size>
+Specify the size of the TCP buffer.
+A global value for both read and write TCP buffers related to any listener
+is defined, unless the listener is explicitly specified,
+or either the read or write qualifiers are used.
+See
+.BR tcp (7)
+for details.
+Note that some OS-es implement automatic TCP buffer tuning.
+.TP

 .B olcThreads: <integer>
 Specify the maximum size of the primary thread pool.
 The default is 16; the minimum value is 2.
 .B olcThreads: <integer>
 Specify the maximum size of the primary thread pool.
 The default is 16; the minimum value is 2.


@@ -776,13 +819,13 @@ olcTLSCipherSuite: HIGH:MEDIUM:+SSLv2
 To check what ciphers a given spec selects in OpenSSL, use:
 
 .nf
 To check what ciphers a given spec selects in OpenSSL, use:
 
 .nf

-       openssl ciphers -v <cipher-suite-spec>
+       openssl ciphers \-v <cipher-suite-spec>

 .fi
 
 To obtain the list of ciphers in GNUtls use:
 
 .nf
 .fi
 
 To obtain the list of ciphers in GNUtls use:
 
 .nf

-       gnutls-cli -l
+       gnutls-cli \-l

 .fi
 .TP
 .B olcTLSCACertificateFile: <filename>
 .fi
 .TP
 .B olcTLSCACertificateFile: <filename>


@@ -893,7 +936,7 @@ is only valid when using GNUtls.
 .SH DYNAMIC MODULE OPTIONS
 If
 .B slapd
 .SH DYNAMIC MODULE OPTIONS
 If
 .B slapd

-is compiled with --enable-modules then the module-related entries will
+is compiled with \-\-enable\-modules then the module-related entries will

 be available. These entries are named
 .B cn=module{x},cn=config
 and
 be available. These entries are named
 .B cn=module{x},cn=config
 and


@@ -913,6 +956,8 @@ option.
 .B olcModulePath: <pathspec>
 Specify a list of directories to search for loadable modules. Typically
 the path is colon-separated but this depends on the operating system.
 .B olcModulePath: <pathspec>
 Specify a list of directories to search for loadable modules. Typically
 the path is colon-separated but this depends on the operating system.

+The default is MODULEDIR, which is where the standard OpenLDAP install
+will place its modules. 

 .SH SCHEMA OPTIONS
 Schema definitions are created as entries in the
 .B cn=schema,cn=config
 .SH SCHEMA OPTIONS
 Schema definitions are created as entries in the
 .B cn=schema,cn=config


@@ -1023,7 +1068,7 @@ and must have the olcDatabaseConfig objectClass. Normally the config
 engine generates the "{x}" index in the RDN automatically, so it
 can be omitted when initially loading these entries.
 
 engine generates the "{x}" index in the RDN automatically, so it
 can be omitted when initially loading these entries.
 

-The special frontend database is always numbered "{-1}" and the config
+The special frontend database is always numbered "{\-1}" and the config

 database is always numbered "{0}".
 
 .SH GLOBAL DATABASE OPTIONS
 database is always numbered "{0}".
 
 .SH GLOBAL DATABASE OPTIONS


@@ -1599,6 +1644,11 @@ with the inner suffix must come first in the configuration file.
 You may also want to glue such databases together with the
 .B olcSubordinate
 attribute.
 You may also want to glue such databases together with the
 .B olcSubordinate
 attribute.

+.TP
+.B olcSyncUseSubentry: TRUE | FALSE
+Store the syncrepl contextCSN in a subentry instead of the context entry
+of the database. The subentry's RDN will be "cn=ldapsync". The default is
+FALSE, meaning the contextCSN is stored in the context entry.

 .HP
 .hy 0
 .B olcSyncrepl: rid=<replica ID>
 .HP
 .hy 0
 .B olcSyncrepl: rid=<replica ID>


@@ -1615,7 +1665,7 @@ attribute.
 .B [sizelimit=<limit>]
 .B [timelimit=<limit>]
 .B [schemachecking=on|off]
 .B [sizelimit=<limit>]
 .B [timelimit=<limit>]
 .B [schemachecking=on|off]

-.B [network-timeout=<seconds>]
+.B [network\-timeout=<seconds>]

 .B [timeout=<seconds>]
 .B [bindmethod=simple|sasl]
 .B [binddn=<dn>]
 .B [timeout=<seconds>]
 .B [bindmethod=simple|sasl]
 .B [binddn=<dn>]


@@ -1625,6 +1675,7 @@ attribute.
 .B [credentials=<passwd>]
 .B [realm=<realm>]
 .B [secprops=<properties>]
 .B [credentials=<passwd>]
 .B [realm=<realm>]
 .B [secprops=<properties>]

+.B [keepalive=<idle>:<probes>:<interval>]

 .B [starttls=yes|critical]
 .B [tls_cert=<file>]
 .B [tls_key=<file>]
 .B [starttls=yes|critical]
 .B [tls_cert=<file>]
 .B [tls_key=<file>]


@@ -1656,7 +1707,7 @@ replication engine.
 identifies the current
 .B syncrepl
 directive within the replication consumer site.
 identifies the current
 .B syncrepl
 directive within the replication consumer site.

-It is a non-negative integer having no more than three digits.
+It is a non-negative integer having no more than three decimal digits.

 
 .B provider
 specifies the replication provider site containing the master content
 
 .B provider
 specifies the replication provider site containing the master content


@@ -1720,7 +1771,7 @@ consumer site by turning on the
 parameter. The default is off.
 
 The
 parameter. The default is off.
 
 The

-.B network-timeout
+.B network\-timeout

 parameter sets how long the consumer will wait to establish a
 network connection to the provider. Once a connection is
 established, the
 parameter sets how long the consumer will wait to establish a
 network connection to the provider. Once a connection is
 established, the


@@ -1755,7 +1806,7 @@ The
 .B authzid
 parameter may be used to specify an authorization identity.
 Specific security properties (as with the
 .B authzid
 parameter may be used to specify an authorization identity.
 Specific security properties (as with the

-.B sasl-secprops
+.B sasl\-secprops

 keyword above) for a SASL bind can be set with the
 .B secprops
 option. A non default SASL realm can be set with the
 keyword above) for a SASL bind can be set with the
 .B secprops
 option. A non default SASL realm can be set with the


@@ -1766,6 +1817,22 @@ should grant that identity appropriate access privileges to the data
 that is being replicated (\fBaccess\fP directive), and appropriate time 
 and size limits (\fBlimits\fP directive).
 
 that is being replicated (\fBaccess\fP directive), and appropriate time 
 and size limits (\fBlimits\fP directive).
 

+The
+.B keepalive
+parameter sets the values of \fIidle\fP, \fIprobes\fP, and \fIinterval\fP
+used to check whether a socket is alive;
+.I idle
+is the number of seconds a connection needs to remain idle before TCP 
+starts sending keepalive probes;
+.I probes
+is the maximum number of keepalive probes TCP should send before dropping
+the connection;
+.I interval
+is interval in seconds between individual keepalive probes.
+Only some systems support the customization of these values;
+the
+.B keepalive
+parameter is ignored otherwise, and system-wide settings are used.

 
 The
 .B starttls
 
 The
 .B starttls


@@ -1786,7 +1853,7 @@ and
 parameters must be set appropriately for the log that will be used. The
 .B syncdata
 parameter must be set to either "accesslog" if the log conforms to the
 parameters must be set appropriately for the log that will be used. The
 .B syncdata
 parameter must be set to either "accesslog" if the log conforms to the

-.BR slapo-accesslog (5)
+.BR slapo\-accesslog (5)

 log format, or "changelog" if the log conforms
 to the obsolete \fIchangelog\fP format. If the
 .B syncdata
 log format, or "changelog" if the log conforms
 to the obsolete \fIchangelog\fP format. If the
 .B syncdata


@@ -1846,7 +1913,7 @@ dn: cn=config
 objectClass: olcGlobal
 cn: config
 olcPidFile: LOCALSTATEDIR/run/slapd.pid
 objectClass: olcGlobal
 cn: config
 olcPidFile: LOCALSTATEDIR/run/slapd.pid

-olcAttributeOptions: x-hidden lang-
+olcAttributeOptions: x\-hidden lang\-

 
 dn: cn=schema,cn=config
 objectClass: olcSchemaConfig
 
 dn: cn=schema,cn=config
 objectClass: olcSchemaConfig


@@ -1859,9 +1926,9 @@ objectClass: olcDatabaseConfig
 objectClass: olcFrontendConfig
 olcDatabase: frontend
 # Subtypes of "name" (e.g. "cn" and "ou") with the
 objectClass: olcFrontendConfig
 olcDatabase: frontend
 # Subtypes of "name" (e.g. "cn" and "ou") with the

-# option ";x-hidden" can be searched for/compared,
+# option ";x\-hidden" can be searched for/compared,

 # but are not shown.  See \fBslapd.access\fP(5).
 # but are not shown.  See \fBslapd.access\fP(5).

-olcAccess: to attrs=name;x-hidden by * =cs
+olcAccess: to attrs=name;x\-hidden by * =cs

 # Protect passwords.  See \fBslapd.access\fP(5).
 olcAccess: to attrs=userPassword  by * auth
 # Read access to other attributes and entries.
 # Protect passwords.  See \fBslapd.access\fP(5).
 olcAccess: to attrs=userPassword  by * auth
 # Read access to other attributes and entries.


@@ -1879,11 +1946,11 @@ dn: olcDatabase=bdb,cn=config
 objectClass: olcDatabaseConfig
 objectClass: olcBdbConfig
 olcDatabase: bdb
 objectClass: olcDatabaseConfig
 objectClass: olcBdbConfig
 olcDatabase: bdb

-olcSuffix: "dc=our-domain,dc=com"
+olcSuffix: "dc=our\-domain,dc=com"

 # The database directory MUST exist prior to
 # running slapd AND should only be accessible
 # by the slapd/tools. Mode 0700 recommended.
 # The database directory MUST exist prior to
 # running slapd AND should only be accessible
 # by the slapd/tools. Mode 0700 recommended.

-olcDbDirectory: LOCALSTATEDIR/openldap-data
+olcDbDirectory: LOCALSTATEDIR/openldap\-data

 # Indices to maintain
 olcDbIndex:     objectClass  eq
 olcDbIndex:     cn,sn,mail   pres,eq,approx,sub
 # Indices to maintain
 olcDbIndex:     objectClass  eq
 olcDbIndex:     cn,sn,mail   pres,eq,approx,sub


@@ -1895,7 +1962,7 @@ objectClass: olcDatabaseConfig
 objectClass: olcLdapConfig
 olcDatabase: ldap
 olcSuffix: ""
 objectClass: olcLdapConfig
 olcDatabase: ldap
 olcSuffix: ""

-olcDbUri: ldap://ldap.some-server.com/
+olcDbUri: ldap://ldap.some\-server.com/

 .fi
 .RE
 .LP
 .fi
 .RE
 .LP


@@ -1904,7 +1971,7 @@ ETCDIR/slapd.d directory has been created, this command will initialize
 the configuration:
 .RS
 .nf
 the configuration:
 .RS
 .nf

-slapadd -F ETCDIR/slapd.d -n 0 -l config.ldif
+slapadd \-F ETCDIR/slapd.d \-n 0 \-l config.ldif

 .fi
 .RE
 
 .fi
 .RE
 


@@ -1916,7 +1983,7 @@ Alternatively, an existing slapd.conf file can be converted to the new
 format using slapd or any of the slap tools:
 .RS
 .nf
 format using slapd or any of the slap tools:
 .RS
 .nf

-slaptest -f ETCDIR/slapd.conf -F ETCDIR/slapd.d
+slaptest \-f ETCDIR/slapd.conf \-F ETCDIR/slapd.d

 .fi
 .RE
 
 .fi
 .RE