More attr/attrs cleanup

[openldap] / doc / guide / admin / slapdconf2.sdf

diff --git a/doc/guide/admin/slapdconf2.sdf b/doc/guide/admin/slapdconf2.sdf
index 4db17e6d77554d4e3793811f3fd48136cfbfd444..05fceeda2c40747590edca869e3460638948b05d 100644 (file)
--- a/doc/guide/admin/slapdconf2.sdf
+++ b/doc/guide/admin/slapdconf2.sdf
@@ -1,5 +1,5 @@
 # $OpenLDAP$
-# Copyright 2005, The OpenLDAP Foundation, All Rights Reserved.
+# Copyright 2005-2007 The OpenLDAP Foundation, All Rights Reserved.
 # COPYING RESTRICTIONS APPLY, see COPYRIGHT.
 
 H1: Configuring slapd
@@ -609,10 +609,11 @@ H4: olcSyncrepl
 
 >      olcSyncrepl: rid=<replica ID>
 >              provider=ldap[s]://<hostname>[:port]
+>              [starttls=yes|critical]
 >              [type=refreshOnly|refreshAndPersist]
 >              [interval=dd:hh:mm:ss]
 >              [retry=[<retry interval> <# of retries>]+]
->              [searchbase=<base DN>]
+>              searchbase=<base DN>
 >              [filter=<filter str>]
 >              [scope=sub|one|base]
 >              [attrs=<attr list>]
@@ -658,15 +659,25 @@ specification is located at the provider site. {{EX:syncrepl}} and
 {{EX:replica}} directives define two independent replication
 mechanisms. They do not represent the replication peers of each other.
 
+The {{EX:starttls}} parameter specifies use of the StartTLS extended
+operation to establish a TLS session before Binding to the provider. If the
+StartTLS request fails and the {{EX:critical}} argument was used, the
+session will be aborted. Otherwise the syncrepl session continues without
+TLS.
+
 The content of the syncrepl replica is defined using a search
 specification as its result set. The consumer slapd will
 send search requests to the provider slapd according to the search
 specification. The search specification includes {{EX:searchbase}},
 {{EX:scope}}, {{EX:filter}}, {{EX:attrs}}, {{EX:attrsonly}},
 {{EX:sizelimit}}, and {{EX:timelimit}} parameters as in the normal
-search specification. The syncrepl search specification has
-the same value syntax and the same default values as in the
-{{ldapsearch}}(1) client search tool.
+search specification. The {{EX:searchbase}} parameter has no
+default value and must always be specified. The {{EX:scope}} defaults
+to {{EX:sub}}, the {{EX:filter}} defaults to {{EX:(objectclass=*)}},
+{{EX:attrs}} defaults to {{EX:"*,+"}} to replicate all user and operational
+attributes, and {{EX:attrsonly}} is unset by default. Both {{EX:sizelimit}}
+and {{EX:timelimit}} default to "unlimited", and only positive integers
+or "unlimited" may be specified.
 
 The LDAP Content Synchronization protocol has two operation
 types: {{EX:refreshOnly}} and {{EX:refreshAndPersist}}.
@@ -1287,7 +1298,7 @@ the access directives and the {{EX:by <who>}} clauses.  It also
 shows the use of an attribute selector to grant access to a specific
 attribute and various {{EX:<who>}} selectors.
 
->      olcAccess: to dn.subtree="dc=example,dc=com" attr=homePhone
+>      olcAccess: to dn.subtree="dc=example,dc=com" attrs=homePhone
 >              by self write
 >              by dn.children=dc=example,dc=com" search
 >              by peername.regex=IP:10\..+ read
@@ -1313,7 +1324,7 @@ create a group and allow people to add and remove only
 their own DN from the member attribute, you could accomplish
 it with an access directive like this:
 
->      olcAccess: to attr=member,entry
+>      olcAccess: to attrs=member,entry
 >              by dnattr=member selfwrite
 
 The dnattr {{EX:<who>}} selector says that the access applies to
@@ -1337,7 +1348,7 @@ tags are maintained automatically by slapd and do not need to be specified
 when originally defining the values. For example, when you create the
 settings
 
->      olcAccess: to attr=member,entry
+>      olcAccess: to attrs=member,entry
 >              by dnattr=member selfwrite
 >      olcAccess: to dn.children="dc=example,dc=com"
 >              by * search
@@ -1346,7 +1357,7 @@ settings
 
 when you read them back using slapcat or ldapsearch they will contain
 
->      olcAccess: {0}to attr=member,entry
+>      olcAccess: {0}to attrs=member,entry
 >              by dnattr=member selfwrite
 >      olcAccess: {1}to dn.children="dc=example,dc=com"
 >              by * search
@@ -1385,7 +1396,7 @@ This example deletes whatever rule is in value #1 of the {{EX:olcAccess}}
 attribute (regardless of its value) and adds a new value that is
 explicitly inserted as value #1. The result will be
 
->      olcAccess: {0}to attr=member,entry
+>      olcAccess: {0}to attrs=member,entry
 >              by dnattr=member selfwrite
 >      olcAccess: {1}to dn.children="dc=example,dc=com"
 >              by * write
@@ -1475,7 +1486,7 @@ E: 29.    olcRootPW: secret
 E: 30. olcDbIndex: uid pres,eq
 E: 31. olcDbIndex: cn,sn,uid pres,eq,approx,sub
 E: 32. olcDbIndex: objectClass eq
-E: 33. olcAccess: to attr=userPassword
+E: 33. olcAccess: to attrs=userPassword
 E: 34.   by self write
 E: 35.   by anonymous auth
 E: 36.   by dn.base="cn=Admin,dc=example,dc=com" write