-.TH SLAPD.CONF 5 "2 May 2002" "OpenLDAP LDVERSION"
-.\" Copyright 1998-2002 The OpenLDAP Foundation All Rights Reserved.
+.TH SLAPD.CONF 5 "RELEASEDATE" "OpenLDAP LDVERSION"
+.\" Copyright 1998-2003 The OpenLDAP Foundation All Rights Reserved.
.\" Copying restrictions apply. See COPYRIGHT/LICENSE.
.\" $OpenLDAP$
.SH NAME
Specify a set of features (separated by white space) to
allow (default none).
.B bind_v2
-allows acceptance of LDAPv2 bind requests.
+allows acceptance of LDAPv2 bind requests. Note that
+.BR slapd (8)
+does not truely implement LDAPv2 (RFC 1777), now Historic (RFC 3494).
.B bind_anon_cred
allows anonymous bind when credentials are not empty (e.g.
when DN is empty).
.B bind_anon_dn
allows unauthenticated (anonymous) bind when DN is not empty.
+.B update_anon
+allow unauthenticated (anonymous) update operations to be processed
+(subject to access controls and other administrative limits).
.TP
.B argsfile <filename>
The ( absolute ) name of a file that will hold the
.B slapd
server's command line options
if started without the debugging command line option.
+.TP
+.B attributeoptions [option-name]...
+Define tagging attribute options or option tag/range prefixes.
+Options must not end with `-', prefixes must end with `-'.
+The `lang-' prefix is predefined.
+If you use the
+.B attributeoptions
+directive, `lang-' will no longer be defined and you must specify it
+explicitly if you want it defined.
+
+An attribute description with a tagging option is a subtype of that
+attribute description without the option.
+Except for that, options defined this way have no special semantics.
+Prefixes defined this way work like the `lang-' options:
+They define a prefix for tagging options starting with the prefix.
+That is, if you define the prefix `x-foo-', you can use the option
+`x-foo-bar'.
+Furthermore, in a search or compare, a prefix or range name (with
+a trailing `-') matches all options starting with that name, as well
+as the option with the range name sans the trailing `-'.
+That is, `x-foo-bar-' matches `x-foo-bar' and `x-foo-bar-baz'.
+
+RFC2251 reserves options beginning with `x-' for private experiments.
+Other options should be registered with IANA, see RFC3383 section 3.4.
+OpenLDAP also has the `binary' option built in, but this is a transfer
+option, not a tagging option.
.HP
.hy 0
.B attributetype "(\ <oid> [NAME\ <name>] [OBSOLETE]\
attribute syntax OID.
(See the
.B objectidentifier
-description.) Currently the syntax name parser is case-sensitive.
-The known syntax names are:
-.RS
-.RS
-.PD 0
-AttributeTypeDescription Audio Binary BitString Certificate CertificateList
-CertificatePair DN DeliveryMethod DirectoryString DITContentRuleDescription
-DITStructureRuleDescription EnhancedGuide FacsimileTelephoneNumber
-GeneralizedTime Guide IA5String Integer MatchingRuleDescription
-MatchingRuleUseDescription MailPreference NameAndOptionalUUID
-NameFormDescription NumericString ObjectClassDescription OID
-OtherMailbox OctetString PostalAddress ProtocolInformation
-PresentationAddress PrintableString SupportedAlgorithm TelephoneNumber
-TeletexTerminalIdentifier TelexNumber UTCTime LDAPSyntaxDescription
-SubstringAssertion NISnetgrouptriple Bootparameter
-.PD
-.RE
-.RE
+description.)
.RE
.TP
.B concurrency <integer>
Specify a desired level of concurrency. Provided to the underlying
thread system as a hint. The default is not to provide any hint.
+.TP
+.B conn_max_pending <integer>
+Specify the maximum number of pending requests for an anonymous session.
+If requests are submitted faster than the server can process them, they
+will be queued up to this limit. If the limit is exceeded, the session
+is closed. The default is 100.
+.TP
+.B conn_max_pending_auth <integer>
+Specify the maximum number of pending requests for an authenticated session.
+The default is 1000.
.\".TP
.\".B debug <subsys> <level>
.\"Specify a logging level for a particular subsystem. The subsystems include
A SIGHUP signal will only cause a 'gentle' shutdown-attempt:
.B Slapd
will stop listening for new connections, but will not close the
-connections to the current clients. It terminates when all clients
+connections to the current clients. Future write operations return
+unwilling-to-perform, though. Slapd terminates when all clients
have closed their connections (if they ever do), or \- as before \-
if it receives a SIGTERM signal. This can be useful if you wish to
terminate the server and start a new
<style> ::= exact | base | one | subtree | children | regex | anonymous
.RE
-.B Anonymous
-is hit when a search is performed without prior binding;
+The term
+.B anonymous
+matches all unauthenticated clients.
+the term
.B users
-is hit when a search is performed by a successfully bound user;
+matches all authenticated clients;
otherwise a
.B regex
dn pattern is assumed unless otherwise specified by qualifying
.BR soft
limit is used; if the requested time limit exceedes the
.BR hard
-limit, an "Unwilling to perform" is returned.
+limit, an "Administrative limit exceeded" is returned.
If the
.BR hard
limit is set to 0 or to the keyword "soft", the soft limit is used
.BR soft
limit is used; if the requested size limit exceedes the
.BR hard
-limit, an "Unwilling to perform" is returned.
+limit, an "Administrative limit exceeded" is returned.
If the
.BR hard
limit is set to 0 or to the keyword "soft", the soft limit is used
.BR timelimit ;
no limit is set on
.BR unchecked .
+
+If
+.B pagedResults
+control is defined, additional size limits may be enforced; the syntax is
+.BR size.pr={<integer>|noEstimate} ,
+where
+.BR integer
+is the max page size if no explicit limit is set; the keyword
+.BR noEstimate
+inhibits the server to return an estimate of the total number
+of entries that will be returned.
.RE
.\".TP
.\".B logfile <filename>
.BR {SHA} ,
.BR {SMD5} ,
.BR {MD5} ,
+.BR {CRYPT} ,
and
-.BR {CRYPT} .
+.BR {CLEARTEXT} .
The default is
.BR {SSHA} .
+.B {SHA}
+and
+.B {SSHA}
+use the SHA-1 algorithm (FIPS 160-1), the latter with a seed.
+
+.B {MD5}
+and
+.B {SMD5}
+use the MD5 algorithm (RFC 1321), the latter with a seed.
+
+.B {CRYPT}
+uses the
+.BR crypt (3).
+
+.B {CLEARTEXT}
+indicates that the new password should be
+added to userPassword as clear text.
+
Note that this option does not alter the normal user applications
handling of userPassword during LDAP Add, Modify, or other LDAP operations.
.TP
cannot find a local database to handle a request.
If specified multiple times, each url is provided.
.TP
+.B replica-argsfile
+The ( absolute ) name of a file that will hold the
+.B slurpd
+server's command line options
+if started without the debugging command line option.
+.TP
+.B replica-pidfile
+The ( absolute ) name of a file that will hold the
+.B slurpd
+server's process ID ( see
+.BR getpid (2)
+) if started without the debugging command line option.
+.TP
.B require <conditions>
Specify a set of conditions (separated by white space) to
require (default none).
requires SASL authentication prior to directory operations.
.B strong
requires strong authentication prior to directory operations.
-The
-.B SASL
-and
-.B strong
-conditions are currently same.
+The strong keyword allows protected "simple" authentication
+as well as SASL authentication.
.B none
may be used to require no conditions (useful for clearly globally
set conditions within a particular database).
.TP
.B reverse-lookup on | off
-Enable/disable client name reverse lookup (default is
-.BR on
+Enable/disable client name unverified reverse lookup (default is
+.BR off
if compiled with --enable-rlookups).
.TP
.B rootDSE <file>
for the root DSE. These attributes are returned in addition to the
attributes normally produced by slapd.
.TP
+.B sasl-authz-policy <policy>
+Used to specify which rules to use for SASL Proxy Authorization. Proxy
+authorization allows a client to authenticate to the server using one
+user's credentials, but specify a different identity to use for authorization
+and access control purposes. It essentially allows user A to login as user
+B, using user A's password.
+The
+.B none
+flag disables proxy authorization. This is the default setting.
+The
+.B from
+flag will use rules in the
+.I saslAuthzFrom
+attribute of the authorization DN.
+The
+.B to
+flag will use rules in the
+.I saslAuthzTo
+attribute of the authentication DN.
+The
+.B both
+flag will allow both of the above. The rules are simply regular expressions
+specifying which DNs are allowed to perform proxy authorization. The
+.I saslAuthzFrom
+attribute in an entry specifies which other users
+are allowed to proxy login to this entry. The
+.I saslAuthzTo
+attribute in
+an entry specifies which other users this user can authorize as. Use of
+.I saslAuthzTo
+rules can be easily
+abused if users are allowed to write arbitrary values to this attribute.
+In general the
+.I saslAuthzTo
+attribute must be protected with ACLs such that
+only privileged users can modify it.
+.TP
.B sasl-host <fqdn>
Used to specify the fully qualified domain name used for SASL processing.
.TP
.B nodict
flag disables mechanisms susceptible to passive dictionary attacks.
The
-.B noanonyous
+.B noanonymous
flag disables mechanisms which support anonymous login.
The
.B forwardsec
property specifies the maximum security layer receive buffer
size allowed. 0 disables security layers. The default is 65536.
.TP
+.B schemadn <dn>
+Specify the distinguished name for the subschema subentry that
+controls the entries on this server. The default is "cn=Subschema".
+.TP
.B security <factors>
Specify a set of factors (separated by white space) to require.
An integer value is associated with each factor and is roughly
.B update_sasl=<n>
specifies the SASL security strength factor to require for
directory updates.
+.B simple_bind=<n>
+specifies the security strength factor required for
+.I simple
+username/password authentication.
Note that the
.B transport
factor is measure of security provided by the underlying transport,
e.g. ldapi:// (and eventually IPSEC). It is not normally used.
.TP
-.B sizelimit <integer>
+.B sizelimit {<integer>|unlimited}
.TP
.B sizelimit size[.{soft|hard|unchecked}]=<integer> [...]
Specify the maximum number of entries to return from a search operation.
The default size limit is 500.
+Use
+.B -1
+or
+.B unlimited
+to specify no limits.
The second format allows a fine grain setting of the size limits.
Extra args can be added on the same line.
See
.TP
.B threads <integer>
Specify the maximum size of the primary thread pool.
-The default is 32.
+The default is 16.
.TP
-.B timelimit <integer>
+.B timelimit {<integer>|unlimited}
.TP
.B timelimit time[.{soft|hard}]=<integer> [...]
Specify the maximum number of seconds (in real time)
.B slapd
will spend answering a search request. The default time limit is 3600.
+Use
+.B -1
+or
+.B unlimited
+to specify no limits.
The second format allows a fine grain setting of the time limits.
Extra args can be added on the same line.
See
.B replica host=<hostname>[:port] [tls=yes|critical]
.B [suffix=<suffix> [...]]
.B bindmethod=simple|sasl [binddn=<simple DN>] [credentials=<simple password>]
-.B [saslmech=<SASL mech>] [secopts=<options>] [realm=<realm>]
-.B [authcId=<authentication ID>] [authcId=<authentication ID>]
+.B [saslmech=<SASL mech>] [secprops=<properties>] [realm=<realm>]
+.B [authcId=<authentication ID>] [authzId=<authorization ID>]
.B [attr[!]=<attr list>]
.RS
Specify a replication site for this database. Refer to the "OpenLDAP
.B sasl
requires the option
.B saslmech.
+Specific security properties (as with the
+.B sasl-secprops
+keyword above) for a SASL bind can be set with the
+.B secprops
+option. A non-default SASL realm can be set with the
+.B realm
+option.
If the
.B mechanism
will use Kerberos, a kerberos instance should be given in
directive.
.TP
.B rootpw <password>
-Specify a password (or hash of the password) for the rootdn. If
-the rootdn is not within the namingContext of the database, the
-provided password is ignored.
+Specify a password (or hash of the password) for the rootdn. The
+password can only be set if the rootdn is within the namingContext
+(suffix) of the database.
This option accepts all RFC 2307 userPassword formats known to
the server (see
.B password-hash
If the suffix of one database is "inside" that of another, the database
with the inner suffix must come first in the configuration file.
.TP
-.B suffixalias <alias> <aliased suffix>
-Specify an alternate suffix that may be used to reference an already defined
-database suffix. Operations specifying DNs residing under the alias
-will execute as if they had specified the aliased suffix.
-.TP
.B subordinate
Specify that the current backend database is a subordinate of another
backend database. A subordinate database may have only one suffix. This
.TP
.B updatedn <dn>
This option is only applicable in a slave
-.B slapd.
-It specifies the DN allowed to make changes to the replica (typically,
-this is the DN
+.B slapd.
+It specifies the DN permitted to update (subject to access controls)
+the replica (typically, this is the DN
.BR slurpd (8)
-binds as when making changes to the replica).
+binds to update the replica).
.TP
.B updateref <url>
Specify the referral to pass back when
include SYSCONFDIR/schema/core.schema
pidfile LOCALSTATEDIR/slapd.pid
+# Subtypes of "name" (e.g. "cn" and "ou") with the
+# option ";x-hidden" can be searched for/compared,
+# but are not shown. See \fBslapd.access\fP(5).
+attributeoptions x-hidden lang-
+access to attr=name;x-hidden by * =cs
+
database bdb
suffix "dc=our-domain,dc=com"
# The database directory MUST exist prior to
.BR slapadd (8),
.BR slapcat (8),
.BR slapindex (8),
-.BR slappassword (8),
+.BR slappasswd (8),
.BR slurpd (8),
.LP
"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)
projects / openldap / blobdiff