options can be overridden in a backend (for options that appear more
than once, the last appearance in the
.B slapd.conf
-file is used). Blank lines and comment lines beginning with a `#'
-character are ignored. If a line begins with white space, it is
-considered a continuation of the previous line.
+file is used).
+.LP
+If a line begins with white space, it is considered a continuation
+of the previous line. Blank lines and comment lines beginning with
+a `#' character are ignored. (Note: continuation lines are unwrapped
+before comment processing is applied.)
.LP
Arguments on configuration lines are separated by white space. If an
argument contains white space, the argument should be enclosed in
.B bind_v2
allows acceptance of LDAPv2 bind requests. Note that
.BR slapd (8)
-does not truely implement LDAPv2 (RFC 1777), now Historic (RFC 3494).
+does not truly implement LDAPv2 (RFC 1777), now Historic (RFC 3494).
.B bind_anon_cred
allows anonymous bind when credentials are not empty (e.g.
when DN is empty).
option, not a tagging option.
.HP
.hy 0
-.B attributetype "(\ <oid> [NAME\ <name>] [OBSOLETE]\
+.B attributetype "(\ <oid>\
+ [NAME\ <name>]\
[DESC\ <description>]\
- [SUP\ <oid>] [EQUALITY\ <oid>] [ORDERING\ <oid>]\
- [SUBSTR\ <oid>] [SYNTAX\ <oidlen>] [SINGLE\-VALUE] [COLLECTIVE]\
- [NO\-USER\-MODIFICATION] [USAGE\ <attributeUsage>]\ )"
+ [OBSOLETE]\
+ [SUP\ <oid>]\
+ [EQUALITY\ <oid>]\
+ [ORDERING\ <oid>]\
+ [SUBSTR\ <oid>]\
+ [SYNTAX\ <oidlen>]\
+ [SINGLE\-VALUE]\
+ [COLLECTIVE]\
+ [NO\-USER\-MODIFICATION]\
+ [USAGE\ <attributeUsage>]\ )"
.RS
Specify an attribute type using the LDAPv3 syntax defined in RFC 2252.
The slapd parser extends the RFC 2252 definition by allowing string
.B tls_authc
disables StartTLS if authenticated (see also
.BR tls_2_anon ).
+.HP
+.hy 0
+.B ditcontentrule "(\ <oid>\
+ [NAME\ <name>]\
+ [DESC\ <description>]\
+ [OBSOLETE]\
+ [AUX\ <oids>]\
+ [MUST\ <oids>]\
+ [MAY\ <oids>]\
+ [NOT\ <oids>]\ )"
+.RS
+Specify an DIT Content Rule using the LDAPv3 syntax defined in RFC 2252.
+The slapd parser extends the RFC 2252 definition by allowing string
+forms as well as numeric OIDs to be used for the attribute OID and
+attribute syntax OID.
+(See the
+.B objectidentifier
+description.)
+.RE
.TP
.B gentlehup { on | off }
A SIGHUP signal will only cause a 'gentle' shutdown-attempt:
.B exact
or
.B base
-(which are synonims), to require an exact match; with
+(which are synonyms), to require an exact match; with
.BR one,
to require exactly one level of depth match; with
.BR subtree,
is the number of seconds slapd will spend answering a search request.
If no time limit is explicitly requested by the client, the
.BR soft
-limit is used; if the requested time limit exceedes the
+limit is used; if the requested time limit exceeds the
.BR hard
limit, an "Administrative limit exceeded" is returned.
If the
request.
If no size limit is explicitly requested by the client, the
.BR soft
-limit is used; if the requested size limit exceedes the
+limit is used; if the requested size limit exceeds the
.BR hard
limit, an "Administrative limit exceeded" is returned.
If the
Specify a list of directories to search for loadable modules. Typically
the path is colon-separated but this depends on the operating system.
.HP
-.B objectclass "( <oid> [NAME <name>] [DESC <description] [OBSOLETE]\
- [SUP <oids>] [{ ABSTRACT | STRUCTURAL | AUXILIARY }] [MUST <oids>]\
- [MAY <oids>] )"
+.hy 0
+.B objectclass "(\ <oid>\
+ [NAME\ <name>]\
+ [DESC\ <description]\
+ [OBSOLETE]\
+ [SUP\ <oids>]\
+ [{ ABSTRACT | STRUCTURAL | AUXILIARY }]\
+ [MUST\ <oids>] [MAY\ <oids>] )"
.RS
Specify an objectclass using the LDAPv3 syntax defined in RFC 2252.
The slapd parser extends the RFC 2252 definition by allowing string
Specify SASL realm. Default is empty.
.TP
.B sasl-regexp <match> <replace>
-Used by the SASL authorization mechanism to convert a SASL authenticated
-username to an LDAP DN. When an authorization request is received, the SASL
+Used by the SASL mechanism to convert a SASL authenticated
+username to an LDAP DN used for authorization purposes. Note that
+the resultant DN need not refer to an existing entry to be considered
+valid. When an authorization request is received, the SASL
.B USERNAME, REALM,
and
.B MECHANISM
Used to specify Cyrus SASL security properties.
The
.B none
-flag (without any other properities) causes the flag properites
+flag (without any other properties) causes the flag properties
default, "noanonymous,noplain", to be cleared.
The
.B noplain
.TP
.B maxderefdepth <depth>
Specifies the maximum number of aliases to dereference when trying to
-resolve an entry, used to avoid inifinite alias loops. The default is 1.
+resolve an entry, used to avoid infinite alias loops. The default is 1.
.TP
.B readonly on | off
This option puts the database into "read-only" mode. Any attempts to
modify the database will return an "unwilling to perform" error. By
default, readonly is off.
.HP
+.hy 0
.B replica uri=ldap[s]://<hostname>[:port]|host=<hostname>[:port]
.B [starttls=yes|critical]
.B [suffix=<suffix> [...]]
This option accepts all RFC 2307 userPassword formats known to
the server (see
.B password-hash
-desription) as well as cleartext.
+description) as well as cleartext.
.BR slappasswd (8)
may be used to generate a hash of a password. Cleartext
and \fB{CRYPT}\fP passwords are not recommended. If empty
Behavior of other LDAP operations is unaffected by this setting. In
particular, it is not possible to use moddn to move an entry from
one subordinate to another subordinate within the namingContext.
+.HP
+.hy 0
+.B syncrepl id=<replica ID>
+.B provider=ldap[s]://<hostname>[:port]
+.B [type=refreshOnly|refreshAndPersist]
+.B [interval=dd:hh:mm:ss]
+.B [searchbase=<base DN>]
+.B [filter=<filter str>]
+.B [scope=sub|one|base]
+.B [attrs=<attr list>]
+.B [attrsonly]
+.B [sizelimit=<limit>]
+.B [timelimit=<limit>]
+.B [schemachecking=on|off]
+.B [updatedn=<dn>]
+.B [bindmethod=simple|sasl]
+.B [binddn=<dn>]
+.B [saslmech=<mech>]
+.B [authcid=<identity>]
+.B [authzid=<identity>]
+.B [credentials=<passwd>]
+.B [realm=<realm>]
+.B [secprops=<properties>]
+.RS
+Specify the current database as a replica which is kept up-to-date with the
+master content by establishing the current
+.BR slapd (8)
+as a replication consumer site running a
+.B syncrepl
+replication engine.
+The replica content is kept synchronized to the master content using
+the LDAP Content Synchronization protocol. Refer to the
+"OpenLDAP Administrator's Guide" for detailed information on
+setting up a replicated
+.B slapd
+directory service using the
+.B syncrepl
+replication engine.
+.B id
+identifies the current
+.B syncrepl
+directive within the database.
+It is a non-negative integer having no more than three digits.
+.B provider
+specifies the replication provider site containing the master content
+as an LDAP URI. If <port> is not given, the standard LDAP port number
+(389 or 636) is used. The content of the
+.B syncrepl
+replica is defined using a search
+specification as its result set. The consumer
+.B slapd
+will send search requests to the provider
+.B slapd
+according to the search specification. The search specification includes
+.B searchbase, scope, filter, attrs, attrsonly, sizelimit,
+and
+.B timelimit
+parameters as in the normal search specification.
+The search specification for the LDAP Content Synchronization operation
+has the same value syntax and the same default values as in the
+.BR ldapsearch (1)
+client search tool.
+The LDAP Content Synchronization protocol has two operation types.
+In the
+.B refreshOnly
+operation, the next synchronization search operation
+is periodically rescheduled at an interval time (specified by
+.B interval
+parameter; 1 day by default)
+after each synchronization operation finishes.
+In the
+.B refreshAndPersist
+operation, a synchronization search remains persistent in the provider slapd.
+Further updates to the master replica will generate
+.B searchResultEntry
+to the consumer slapd as the search responses to the persistent
+synchronization search. The schema checking can be enforced at the LDAP Sync
+consumer site by turning on the
+.B schemachecking
+parameter. The default is off.
+The
+.B updatedn
+parameter specifies the DN in the consumer site
+which is allowed to make changes to the replica.
+The DN should have read/write access to the replica database.
+A
+.B bindmethod
+of
+.B simple
+requires the options
+.B binddn
+and
+.B credentials
+and should only be used when adequate security services
+(e.g. TLS or IPSEC) are in place.
+A
+.B bindmethod
+of
+.B sasl
+requires the option
+.B saslmech.
+Depending on the mechanism, an authentication identity and/or
+credentials can be specified using
+.B authcid
+and
+.B credentials.
+The
+.B authzid
+parameter may be used to specify an authorization identity.
+Specific security properties (as with the
+.B sasl-secprops
+keyword above) for a SASL bind can be set with the
+.B secprops
+option. A non default SASL realm can be set with the
+.B realm
+option.
+.RE
.TP
.B updatedn <dn>
This option is only applicable in a slave
.BR slapd (8)
is asked to modify a replicated local database.
If specified multiple times, each url is provided.
+
.SH DATABASE-SPECIFIC OPTIONS
Each database may allow specific configuration options; they are
documented separately in the backends' manual pages.
.TP
.B meta
This backend performs basic LDAP proxying with respect to a set of
-remote LDAP servers.
-It is an enhancement of the ldap backend.
+remote LDAP servers. It is an enhancement of the ldap backend. The
+proxy cache extension of meta backend provides answering of search
+requests from the proxy using results of previously cached requests.
.TP
.B monitor
This backend provides information about the running status of the slapd
.BR slapd-shell (5),
.BR slapd-sql (5),
.BR slapd-tcl (5),
-.BR slapd.replog (5),
.BR slapd.access (5),
+.BR slapd.plugin (5),
+.BR slapd.replog (5),
.BR slapd (8),
.BR slapadd (8),
.BR slapcat (8),
projects / openldap / blobdiff