X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=doc%2Fman%2Fman5%2Fslapd.conf.5;h=ff4242e19dac3b6b28021438a37d1fd968e0dfaf;hb=a7f9086ade0e1e4d8ae32d96b4b5c216d1a39902;hp=5d9fc030e16b2f8c02924a83d31b782707469aa4;hpb=0cfffff4e223e4828d822d487ba87b90f5289ea3;p=openldap diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 index 5d9fc030e1..ff4242e19d 100644 --- a/doc/man/man5/slapd.conf.5 +++ b/doc/man/man5/slapd.conf.5 @@ -1,5 +1,5 @@ .TH SLAPD.CONF 5 "RELEASEDATE" "OpenLDAP LDVERSION" -.\" Copyright 1998-2007 The OpenLDAP Foundation All Rights Reserved. +.\" Copyright 1998-2009 The OpenLDAP Foundation All Rights Reserved. .\" Copying restrictions apply. See COPYRIGHT/LICENSE. .\" $OpenLDAP$ .SH NAME @@ -68,7 +68,7 @@ backslash character. The specific configuration options available are discussed below in the Global Configuration Options, General Backend Options, and General Database Options. Backend-specific options are discussed in the -.B slapd-(5) +.B slapd\-(5) manual pages. Refer to the "OpenLDAP Administrator's Guide" for more details on the slapd configuration file. .SH GLOBAL CONFIGURATION OPTIONS @@ -108,33 +108,32 @@ allows unauthenticated (anonymous) proxy authorization control to be processed (subject to access controls, authorization and other administrative limits). .TP .B argsfile -The ( absolute ) name of a file that will hold the +The (absolute) name of a file that will hold the .B slapd -server's command line options -if started without the debugging command line option. +server's command line (program name and options). .TP .B attributeoptions [option-name]... Define tagging attribute options or option tag/range prefixes. -Options must not end with `-', prefixes must end with `-'. -The `lang-' prefix is predefined. +Options must not end with `\-', prefixes must end with `\-'. +The `lang\-' prefix is predefined. If you use the .B attributeoptions -directive, `lang-' will no longer be defined and you must specify it +directive, `lang\-' will no longer be defined and you must specify it explicitly if you want it defined. An attribute description with a tagging option is a subtype of that attribute description without the option. Except for that, options defined this way have no special semantics. -Prefixes defined this way work like the `lang-' options: +Prefixes defined this way work like the `lang\-' options: They define a prefix for tagging options starting with the prefix. -That is, if you define the prefix `x-foo-', you can use the option -`x-foo-bar'. +That is, if you define the prefix `x\-foo\-', you can use the option +`x\-foo\-bar'. Furthermore, in a search or compare, a prefix or range name (with -a trailing `-') matches all options starting with that name, as well -as the option with the range name sans the trailing `-'. -That is, `x-foo-bar-' matches `x-foo-bar' and `x-foo-bar-baz'. +a trailing `\-') matches all options starting with that name, as well +as the option with the range name sans the trailing `\-'. +That is, `x\-foo\-bar\-' matches `x\-foo\-bar' and `x\-foo\-bar\-baz'. -RFC 4520 reserves options beginning with `x-' for private experiments. +RFC 4520 reserves options beginning with `x\-' for private experiments. Other options should be registered with IANA, see RFC 4520 section 3.5. OpenLDAP also has the `binary' option built in, but this is a transfer option, not a tagging option. @@ -163,7 +162,7 @@ attribute syntax OID. description.) .RE .TP -.B authz-policy +.B authz\-policy Used to specify which rules to use for Proxy Authorization. Proxy authorization allows a client to authenticate to the server using one user's credentials, but specify a different identity to use for authorization @@ -226,7 +225,7 @@ or a set of identities; it can take five forms: .B dn[.]: .RE .RS -.B u[[]]: +.B u[.[/]]: .RE .RS .B group[/objectClass[/attributeType]]: @@ -312,18 +311,21 @@ and can impact security, users are strongly encouraged to explicitly set the type of identity specification that is being used. A subset of these rules can be used as third arg in the -.B authz-regexp +.B authz\-regexp statement (see below); significantly, the -.I URI +.IR URI , +provided it results in exactly one entry, and the .I dn.exact: forms. .RE .TP -.B authz-regexp +.B authz\-regexp Used by the authentication framework to convert simple user names, -such as provided by SASL subsystem, to an LDAP DN used for -authorization purposes. Note that the resultant DN need not refer +such as provided by SASL subsystem, or extracted from certificates +in case of cert-based SASL EXTERNAL, or provided within the RFC 4370 +"proxied authorization" control, to an LDAP DN used for +authorization purposes. Note that the resulting DN need not refer to an existing entry to be considered valid. When an authorization request is received from the SASL subsystem, the SASL .BR USERNAME , @@ -379,7 +381,7 @@ Note that this search is subject to access controls. Specifically, the authentication identity must have "auth" access in the subject. Multiple -.B authz-regexp +.B authz\-regexp options can be given in the configuration file to allow for multiple matching and replacement patterns. The matching patterns are checked in the order they appear in the file, stopping at the first successful match. @@ -424,6 +426,12 @@ upon StartTLS operation receipt. .B tls_authc disallows the StartTLS operation if authenticated (see also .BR tls_2_anon ). +.B proxy_authz_non_critical +disables acceptance of the proxied authorization control (RFC4370) +when criticality is FALSE. +.B dontusecopy_non_critical +disables acceptance of the dontUseCopy control (a work in progress) +when criticality is FALSE. .HP .hy 0 .B ditcontentrule "(\ \ @@ -450,7 +458,7 @@ A SIGHUP signal will only cause a 'gentle' shutdown-attempt: will stop listening for new connections, but will not close the connections to the current clients. Future write operations return unwilling-to-perform, though. Slapd terminates when all clients -have closed their connections (if they ever do), or \- as before \- +have closed their connections (if they ever do), or - as before - if it receives a SIGTERM signal. This can be useful if you wish to terminate the server and start a new .B slapd @@ -464,12 +472,20 @@ along with this option. .B idletimeout Specify the number of seconds to wait before forcibly closing an idle client connection. A idletimeout of 0 disables this -feature. The default is 0. +feature. The default is 0. You may also want to set the +.B writetimeout +option. .TP .B include Read additional configuration information from the given file before continuing with the next line of the current file. .TP +.B index_intlen +Specify the key length for ordered integer indices. The most significant +bytes of the binary integer will be used for index keys. The default +value is 4, which provides exact indexing for 31 bit values. +A floating point representation is used to index too large values. +.TP .B index_substr_if_minlen Specify the minimum length for subinitial and subfinal indices. An attribute value must have at least this many characters in order to be @@ -496,7 +512,42 @@ lookup. The default is 2. For example, with the default values, a search using this filter "cn=*abcdefgh*" would generate index lookups for "abcd", "cdef", and "efgh". -Note: Indexing support depends on the particular backend in use. +.LP +Note: Indexing support depends on the particular backend in use. Also, +changing these settings will generally require deleting any indices that +depend on these parameters and recreating them with +.BR slapindex (8). + +.HP +.hy 0 +.B ldapsyntax "(\ \ + [DESC\ ]\ + [X\-SUBST ]\ )" +.RS +Specify an LDAP syntax using the LDAPv3 syntax defined in RFC 4512. +The slapd parser extends the RFC 4512 definition by allowing string +forms as well as numeric OIDs to be used for the syntax OID. +(See the +.B objectidentifier +description.) +The slapd parser also honors the +.B X\-SUBST +extension (an OpenLDAP-specific extension), which allows to use the +.B ldapsyntax +statement to define a non-implemented syntax along with another syntax, +the extension value +.IR substitute-syntax , +as its temporary replacement. +The +.I substitute-syntax +must be defined. +This allows to define attribute types that make use of non-implemented syntaxes +using the correct syntax OID. +Unless +.B X\-SUBST +is used, this configuration statement would result in an error, +since no handlers would be associated to the resulting syntax structure. +.RE .TP .B localSSF @@ -607,7 +658,7 @@ or as a list of the names that are shown between brackets, such that are equivalent. The keyword .B any -can be used as a shortcut to enable logging at all levels (equivalent to -1). +can be used as a shortcut to enable logging at all levels (equivalent to \-1). The keyword .BR none , or the equivalent integer representation, causes those messages @@ -629,11 +680,13 @@ are searched for in the directories specified by the .B modulepath option. This option and the .B modulepath -option are only usable if slapd was compiled with --enable-modules. +option are only usable if slapd was compiled with \-\-enable\-modules. .TP .B modulepath Specify a list of directories to search for loadable modules. Typically the path is colon-separated but this depends on the operating system. +The default is MODULEDIR, which is where the standard OpenLDAP install +will place its modules. .HP .hy 0 .B objectclass "(\ \ @@ -659,7 +712,7 @@ in place of the numeric OID in objectclass and attribute definitions. The name can also be used with a suffix of the form ":xx" in which case the value "oid.xx" will be used. .TP -.B password-hash [...] +.B password\-hash [...] This option configures one or more hashes to be used in generation of user passwords stored in the userPassword attribute during processing of LDAP Password Modify Extended Operations (RFC 3062). @@ -713,11 +766,10 @@ versions of crypt(3) to use an MD5 algorithm and provides provides 31 characters of salt. .TP .B pidfile -The ( absolute ) name of a file that will hold the +The (absolute) name of a file that will hold the .B slapd -server's process ID ( see -.BR getpid (2) -) if started without the debugging command line option. +server's process ID (see +.BR getpid (2)). .TP .B referral Specify the referral to pass back when @@ -748,10 +800,10 @@ may be used to require no conditions (useful to clear out globally set conditions within a particular database); it must occur first in the list of conditions. .TP -.B reverse-lookup on | off +.B reverse\-lookup on | off Enable/disable client name unverified reverse lookup (default is .BR off -if compiled with --enable-rlookups). +if compiled with \-\-enable\-rlookups). .TP .B rootDSE Specify the name of an LDIF(5) file containing user defined attributes @@ -762,17 +814,22 @@ The root DSE is an entry with information about the server and its capabilities, in operational attributes. It has the empty DN, and can be read with e.g.: .ti +4 -ldapsearch -x -b "" -s base "+" +ldapsearch \-x \-b "" \-s base "+" .br See RFC 4512 section 5.1 for details. .TP -.B sasl-host +.B sasl\-auxprops [...] +Specify which auxprop plugins to use for authentication lookups. The +default is empty, which just uses slapd's internal support. Usually +no other auxprop plugins are needed. +.TP +.B sasl\-host Used to specify the fully qualified domain name used for SASL processing. .TP -.B sasl-realm +.B sasl\-realm Specify SASL realm. Default is empty. .TP -.B sasl-secprops +.B sasl\-secprops Used to specify Cyrus SASL security properties. The .B none @@ -823,7 +880,7 @@ controls the entries on this server. The default is "cn=Subschema". .B security Specify a set of security strength factors (separated by white space) to require (see -.BR sasl-secprops 's +.BR sasl\-secprops 's .B minssf option for a description of security strength factors). The directive may be specified globally and/or per-database. @@ -858,10 +915,13 @@ e.g. ldapi:// (and eventually IPSEC). It is not normally used. .TP .B serverID [] Specify an integer ID from 0 to 4095 for this server (limited -to 3 hexadecimal digits). +to 3 hexadecimal digits). The ID may also be specified as a +hexadecimal ID by prefixing the value with "0x". These IDs are required when using multimaster replication and each master must have a -unique ID. If the URL is provided, this directive may be specified +unique ID. Note that this requirement also applies to separate masters +contributing to a glued set of databases. +If the URL is provided, this directive may be specified multiple times, providing a complete list of participating servers and their IDs. The fully qualified hostname of each server should be used in the supplied URLs. The IDs are used in the "replica id" field @@ -902,6 +962,16 @@ more efficiently. The resulting sort order depends on the attributes' syntax and matching rules and may not correspond to lexical order or any other recognizable order. .TP +.B tcp-buffer [listener=] [{read|write}=] +Specify the size of the TCP buffer. +A global value for both read and write TCP buffers related to any listener +is defined, unless the listener is explicitly specified, +or either the read or write qualifiers are used. +See +.BR tcp (7) +for details. +Note that some OS-es implement automatic TCP buffer tuning. +.TP .B threads Specify the maximum size of the primary thread pool. The default is 16; the minimum value is 2. @@ -921,7 +991,7 @@ See .BR limits for an explanation of the different flags. .TP -.B tool-threads +.B tool\-threads Specify the maximum number of threads to use in tool mode. This should not be greater than the number of CPUs in the system. The default is 1. @@ -930,6 +1000,12 @@ The default is 1. .\".B ucdata-path .\"Specify the path to the directory containing the Unicode character .\"tables. The default path is DATADIR/ucdata. +.TP +.B writetimeout +Specify the number of seconds to wait before forcibly closing +a connection with an outstanding write. This allows recovery from +various network hang conditions. A writetimeout of 0 disables this +feature. The default is 0. .SH TLS OPTIONS If .B slapd @@ -945,13 +1021,13 @@ TLSCipherSuite HIGH:MEDIUM:+SSLv2 To check what ciphers a given spec selects, use: .nf - openssl ciphers -v + openssl ciphers \-v .fi To obtain the list of ciphers in GNUtls use: .nf - gnutls-cli -l + gnutls-cli \-l .fi .TP @@ -1109,6 +1185,21 @@ should be one of or .BR sql , depending on which backend will serve the database. + +LDAP operations, even subtree searches, normally access only one +database. +That can be changed by gluing databases together with the +.B subordinate +keyword. +Access controls and some overlays can also involve multiple databases. +.TP +.B add_content_acl on | off +Controls whether Add operations will perform ACL checks on +the content of the entry being added. This check is off +by default. See the +.BR slapd.access (5) +manual page for more details on ACL requirements for +Add operations. .TP .B hidden on | off Controls whether the database will be used to answer @@ -1126,23 +1217,33 @@ createTimestamp attributes for entries. It also controls the entryCSN and entryUUID attributes, which are needed by the syncrepl provider. By default, lastmod is on. .TP -.B limits [ [...]] -Specify time and size limits based on who initiated an operation. +.B limits [ [...]] +Specify time and size limits based on the operation's initiator or +base DN. The argument -.B who +.B can be any of .RS .RS .TP -anonymous | users | [dn[.