X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=doc%2Fman%2Fman5%2Fslapd-ldap.5;h=1d015bf8d9166550359debd9ff6aedcd24aec3cc;hb=05a84fb025ed397624730b3b5d79c15cc80c4357;hp=e92774840d00df80000faee5aa5605e230044cb8;hpb=0bb46f937b787cb29e70998de0e0d223c10898de;p=openldap diff --git a/doc/man/man5/slapd-ldap.5 b/doc/man/man5/slapd-ldap.5 index e92774840d..1d015bf8d9 100644 --- a/doc/man/man5/slapd-ldap.5 +++ b/doc/man/man5/slapd-ldap.5 @@ -1,5 +1,5 @@ -.TH SLAPD-LDAP 5 "30 April 2002" "OpenLDAP LDVERSION" -.\" Copyright 1998-2002 The OpenLDAP Foundation All Rights Reserved. +.TH SLAPD-LDAP 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2004 The OpenLDAP Foundation All Rights Reserved. .\" Copying restrictions apply. See COPYRIGHT/LICENSE. .\" $OpenLDAP$ .SH NAME @@ -13,6 +13,15 @@ is not an actual database; instead it acts as a proxy to forward incoming requests to another LDAP server. While processing requests it will also chase referrals, so that referrals are fully processed instead of being returned to the slapd client. + +Sessions that explicitly Bind to the back-ldap database always create their +own private connection to the remote LDAP server. Anonymous sessions will +share a single anonymous connection to the remote server. For sessions bound +through other mechanisms, all sessions with the same DN will share the +same connection. This connection pooling strategy can enhance the proxy's +efficiency by reducing the overhead of repeatedly making/breaking multiple +connections. + .SH CONFIGURATION These .B slapd.conf @@ -22,9 +31,33 @@ subsequent "backend" or "database" lines. Other database options are described in the .BR slapd.conf (5) manual page. +.LP +Note: It is strongly recommended to set +.LP +.RS +.nf +lastmod off +.fi +.RE +.LP +for every +.B ldap +and +.B meta +database. +This is because operational attributes related to entry creation and +modification should not be used, as they could be passed to the target +servers, generating an error. .TP .B uri -LDAP server to use. +LDAP server to use. Multiple URIs can be set in in a single +.B ldapurl +argument, resulting in the underlying library automatically +call the first server of the list that responds, e.g. + +\fBuri "ldap://host/ ldap://backup-host"\fP + +The URI list is space- or comma-separated. .TP .B server Obsolete option; same as `uri ldap:///'. @@ -39,6 +72,40 @@ check permissions. .B bindpw Password used with the bind DN above. .TP +.B proxyauthzdn "" +DN which is used to propagate the client's identity to the target +by means of the proxyAuthz control when the client does not +belong to the DIT fragment that is being proxyied by back-ldap. +This is useful when operations performed by users bound to another +backend are propagated through back-ldap. +This requires the entry with +.B proxyauthzdn +identity on the remote server to have +.B proxyAuthz +privileges on a wide set of DNs, e.g. +.BR authzTo=dn.regex:.* , +and the remote server to have +.B authz-policy +set to +.B to +or +.BR both . +See +.BR slapd.conf (5) +for details on these statements and for remarks and drawbacks about +their usage. +.TP +.B proxyauthzpw +Password used with the proxy authzDN above. +.TP +.B proxy-whoami +Turns on proxying of the WhoAmI extended operation. If this option is +given, back-ldap will replace slapd's original WhoAmI routine with its +own. On slapd sessions that were authenticated by back-ldap, the WhoAmI +request will be forwarded to the remote LDAP server. Other sessions will +be handled by the local slapd, as before. This option is mainly useful +in conjunction with Proxy Authorization. +.TP .B rebind-as-user If this option is given, the client's bind credentials are remembered for rebinds when chasing referrals. @@ -48,21 +115,19 @@ DNs ending with in a request are changed to end with before sending the request to the remote server, and in the results are changed back to before returning them to the client. -The field must be defined as a valid suffix (or suffixAlias?) -for the current database; the shouldn't have already -been defined as a valid suffix or suffixAlias for the current server. +The field must be defined as a valid suffix +for the current database. .TP -.B map "{attribute | objectclass} { | *} [ | *]" +.B map "{attribute | objectclass} [ | *] { | *}" Map attribute names and object classes from the foreign server to different values on the local slapd. The reason is that some attributes might not be part of the local slapd's schema, some attribute names might be different but serve the same purpose, etc. If local or foreign name is `*', the name is preserved. -If foreign name is missing, the name is dropped. -Local name `*' and no foreign name means unmapped attributes are -removed, while local name = foreign name = `*' means unmapped -attributes are preserved. +If local name is omitted, the foreign name is removed. +Unmapped names are preseved if both local and foreign name are `*', +and removed if local name is omitted and foreign name is `*'. .TP .B rewrite* The rewrite options are described in the "REWRITING" section of the @@ -72,30 +137,37 @@ manual page. This maps the OpenLDAP objectclass `groupOfNames' to the Active Directory objectclass `group': .LP +.RS .nf - map objectclass groupOfNames group +map objectclass groupOfNames group .fi +.RE .LP -This presents a limited a limited attribute set from the foreign +This presents a limited attribute set from the foreign server: .LP +.RS .nf - map attribute cn * - map attribute sn * - map attribute manager * - map attribute description * - map attribute * +map attribute cn * +map attribute sn * +map attribute manager * +map attribute description * +map attribute * .fi +.RE .LP These lines map cn, sn, manager, and description to themselves, and any other attribute gets "removed" from the object before it is sent to the client (or sent up to the LDAP server). This is obviously a simplistic example, but you get the point. .SH FILES +.TP ETCDIR/slapd.conf +default slapd configuration file .SH SEE ALSO .BR slapd.conf (5), .BR slapd-meta (5), .BR slapd (8), .BR ldap (3). - +.SH AUTHOR +Howard Chu, with enhancements by Pierangelo Masarati