Disclaimer for behavior in a master/slave replication environment

[openldap] / contrib / slapd-modules / smbk5pwd / README

diff --git a/contrib/slapd-modules/smbk5pwd/README b/contrib/slapd-modules/smbk5pwd/README
index ec599bedbf9a5377efef2614a8cebf1dbdd876b4..8031f534cfecc13e6dca83553f2455b5db20739c 100644 (file)
--- a/contrib/slapd-modules/smbk5pwd/README
+++ b/contrib/slapd-modules/smbk5pwd/README
@@ -16,7 +16,7 @@ The Kerberos support is written for Heimdal using its hdb-ldap backend.
 If a PasswordModify is performed on an entry that has the krb5KDCEntry
 objectclass, then the krb5Key and krb5KeyVersionNumber will be updated
 using the new password in the PasswordModify request. Additionally, a
-new "{K5KEY}" password hash mechanism is provided. krb5KDCEntries that
+new "{K5KEY}" password hash mechanism is provided. For krb5KDCEntries that
 have this hash specifier in their userPassword attribute, Simple Binds
 will be checked against the Kerberos keys of the Entry. No data is
 needed after the "{K5KEY}" hash specifier in the userPassword, it is
@@ -42,7 +42,38 @@ To use the overlay, add:
 to your slapd configuration file. (You should obtain the necessary schema
 files from the Heimdal and/or Samba distributions. At this time, there
 are several known errors in these schema files that you will have to
-correct before they will load in slapd.)
+correct before they will load in slapd.  As of Samba 3.0 the schema looks
+fine as shipped.)
+
+All modules compiled in (i.e. krb5 and samba) are enabled; the statement
+
+       smbk5pwd-enable         <module>
+
+can be used to enable only the desired one(s); legal values for <module>
+are "krb5" and "samba", if they are respectively enabled by defining
+DO_KRB5 and DO_SAMBA.
+
+The samba module also supports the
+
+       smbk5pwd-must-change    <seconds>
+
+which sets the "sambaPwdMustChange" attribute accordingly to force passwd
+expiry.  A value of 0 disables this feature.
+
+The overlay now supports table-driven configuration, and thus can be run-time
+loaded and configured via back-config.  The layout of the entry is
+
+       # {0}smbk5pwd, {1}bdb, config
+       dn: olcOverlay={0}smbk5pwd,olcDatabase={1}bdb,cn=config
+       objectClass: olcOverlayConfig
+       objectClass: olcSmbK5PwdConfig
+       olcOverlay: {0}smbk5pwd
+       olcSmbK5PwdEnable: krb5
+       olcSmbK5PwdEnable: samba
+       olcSmbK5PwdMustChange: 2592000
+
+which enables both krb5 and samba modules with a password expiry time
+of 30 days.
 
 The provided Makefile builds both Kerberos and Samba support by default.
 You must edit the Makefile to insure that the correct include and library
@@ -50,7 +81,10 @@ paths are used. You can change the DEFS macro if you only want one or the
 other of Kerberos or Samba support.
 
 This overlay is only set up to be built as a dynamically loaded module.
-If you need to build it statically, you will have to move it into the
+On most platforms, in order for the module to be usable, all of the 
+library dependencies must also be available as shared libraries.
+
+If you need to build the overlay statically, you will have to move it into the
 slapd/overlays directory and edit the Makefile and overlays.c to reference
 it. You will also have to define SLAPD_OVER_SMBK5PWD to SLAPD_MOD_STATIC,
 and add the relevant libraries to the main slapd link command.