From: Kurt Zeilenga <kurt@openldap.org>
Date: Wed, 17 Mar 2004 21:02:22 +0000 (+0000)
Subject: sync with HEAD
X-Git-Tag: OPENLDAP_REL_ENG_2_2_7~26
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=65cadcaed9a31a2763d95001254cb3f7ac1b5c8f;hp=b88720091597780b6919b7020a0d2a4fae27101e;p=openldap

sync with HEAD
---

diff --git a/doc/man/man5/slapd-meta.5 b/doc/man/man5/slapd-meta.5
index 4f37eef4a5..a7e3228df6 100644
--- a/doc/man/man5/slapd-meta.5
+++ b/doc/man/man5/slapd-meta.5
@@ -513,20 +513,22 @@ client -> server:
 .LP
 .RS
 .nf
-(default)      if defined and no specific context 
-               is available
-bindDN         bind
-searchBase     search
-searchFilter   search
-compareDN      compare
-compareAttrDN  compare AVA
-addDN          add
-addAttrDN      add AVA
-modifyDN       modify
-modifyAttrDN   modify AVA
-modrDN         modrdn
-newSuperiorDN  modrdn
-deleteDN       delete
+(default)            if defined and no specific context 
+                     is available
+bindDN               bind
+searchBase           search
+searchFilter         search
+searchFilterAttrDN   search
+compareDN            compare
+compareAttrDN        compare AVA
+addDN                add
+addAttrDN            add AVA
+modifyDN             modify
+modifyAttrDN         modify AVA
+modrDN               modrdn
+newSuperiorDN        modrdn
+deleteDN             delete
+exopPasswdDN         passwd exop DN if proxy
 .fi
 .RE
 .LP
@@ -534,11 +536,11 @@ server -> client:
 .LP
 .RS
 .nf
-searchResult   search (only if defined; no default;
-               acts on DN and DN-syntax attributes 
-               of search results)
-searchAttrDN   search AVA
-matchedDN      all ops (only if applicable)
+searchResult         search (only if defined; no default;
+                     acts on DN and DN-syntax attributes 
+                     of search results)
+searchAttrDN         search AVA
+matchedDN            all ops (only if applicable)
 .fi
 .RE
 .LP
@@ -627,10 +629,10 @@ rewriteRule     ".*" "%{>addBlanks(%0)}" ":"
 .\" 
 .\" # Finally, in a bind, if one uses a `uid=username' DN,
 .\" # it is rewritten in `cn=name surname' if possible.
-.\" rewriteContext  bindDn
+.\" rewriteContext  bindDN
 .\" rewriteRule     ".*" "%{>addBlanks(%{>uid2Gecos(%0)})}" ":"
 .\" 
-# Rewrite the search base  according to `default' rules.
+# Rewrite the search base according to `default' rules.
 rewriteContext  searchBase alias default
 
 # Search results with OpenLDAP DN are rewritten back with
@@ -652,7 +654,7 @@ rewriteMap ldap attr2dn "ldap://host/dc=my,dc=org?dn?sub"
 # to real naming contexts, we also need to rewrite
 # regular DNs, because the definition of a bindDn
 # rewrite context overrides the default definition.
-rewriteContext bindDn
+rewriteContext bindDN
 rewriteRule "^mail=[^,]+@[^,]+$" "%{attr2dn(%0)}" ":@I"
 
 # This is a rather sophisticated example. It massages a
@@ -661,7 +663,7 @@ rewriteRule "^mail=[^,]+@[^,]+$" "%{attr2dn(%0)}" ":@I"
 # track of the bind DN of the incoming request, which is
 # stored in a variable called `binddn' with session scope,
 # and left in place to allow regular binding:
-rewriteContext  bindDn
+rewriteContext  bindDN
 rewriteRule     ".+" "%{&&binddn(%0)}%0" ":"
 
 # A search filter containing `uid=' is rewritten only
diff --git a/doc/man/man5/slapd.access.5 b/doc/man/man5/slapd.access.5
index 168780aa03..ac34684912 100644
--- a/doc/man/man5/slapd.access.5
+++ b/doc/man/man5/slapd.access.5
@@ -184,12 +184,12 @@ It can have the forms
 	dn[.<dnstyle>[,<modifier>]]=<DN>
 	dnattr=<attrname>
 	group[/<objectclass>[/<attrname>]]
-		[.<style>]=<group>
+		[.<groupstyle>]=<group>
 	peername[.<peernamestyle>]=<peername>
 	sockname[.<style>]=<sockname>
 	domain[.<domainstyle>[,<modifier>]]=<domain>
 	sockurl[.<style>]=<sockurl>
-	set[.<style>]=<pattern>
+	set[.<setstyle>]=<pattern>
 
 	ssf=<n>
 	transport_ssf=<n>
@@ -203,9 +203,11 @@ with
 .LP
 .nf
 	<dnstyle>={{exact|base}|regex|sub(tree)|one(level)|children}
-	<style>={exact|regex}
-	<peernamestyle>={exact|regex|ip|path}
+	<groupstyle>={exact|expand}
+	<style>={exact|regex|expand}
+	<peernamestyle>={<style>|ip|path}
 	<domainstyle>={exact|regex|sub(tree)}
+	<setstyle>={exact|regex}
 	<modifier>={expand}
 .fi
 .LP
@@ -286,16 +288,12 @@ define the objectClass and the member attributeType of the group entry.
 The optional style qualifier
 .B <style>
 can be
-.BR regex ,
+.BR expand ,
 which means that
 .B <group>
 will be expanded as a replacement string (but not as a regular expression)
 according to regex (7), and
-.B base
-or
-.B exact
-(an alias of
-.BR base ),
+.BR exact ,
 which means that exact match will be used.
 .LP
 For static groups, the specified attributeType must have
@@ -307,7 +305,7 @@ be a subtype of the
 .B labeledURI
 attributeType. Only LDAP URIs of the form
 .B ldap:///<base>??<scope>?<filter>
-will be evaluated in a dynamic group.
+will be evaluated in a dynamic group, by searching the local server only.
 .LP
 The statements
 .BR peername=<peername> ,
@@ -334,7 +332,13 @@ The same
 .B style
 rules for pattern match described for the
 .B group
-case apply. 
+case apply, plus the
+.B regex
+style, which implies submatch
+.B expand
+and
+.BR regex (7)
+match of the corresponding connection parameters.
 The
 .B exact
 style of the
@@ -398,6 +402,13 @@ pattern, or its trailing part, after a
 exactly matches the 
 .BR domain
 pattern.
+The 
+.B expand
+style is allowed, implying an
+.B exact 
+match with submatch expansion; the use of 
+.B expand 
+as a style modifier is considered more appropriate.
 As an example,
 .B domain.subtree=example.com
 will match www.example.com, but will not match www.anotherexample.com.
diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5
index 76b2145c10..eec4f0187b 100644
--- a/doc/man/man5/slapd.conf.5
+++ b/doc/man/man5/slapd.conf.5
@@ -298,7 +298,7 @@ anonymous | users | [dn[.<style>]=]<pattern> | group[/oc[/at]]=<pattern>
 with
 .RS
 .TP
-<style> ::= exact | base | one | subtree | children | regex | anonymous
+<style> ::= exact | base | onelevel | subtree | children | regex | anonymous
 
 .RE
 The term
@@ -317,11 +317,11 @@ with
 or
 .B base
 (which are synonyms), to require an exact match; with
-.BR one, 
+.BR onelevel , 
 to require exactly one level of depth match; with
-.BR subtree,
+.BR subtree ,
 to allow any level of depth match, including the exact match; with
-.BR children,
+.BR children ,
 to allow any level of depth match, not including the exact match;
 .BR regex
 explicitly requires the (default) match based on regular expression
@@ -359,7 +359,7 @@ whose DN exactly matches
 The currently supported limits are 
 .B size
 and 
-.BR time.
+.BR time .
 
 The syntax for time limits is 
 .BR time[.{soft|hard}]=<integer> ,
@@ -370,11 +370,17 @@ If no time limit is explicitly requested by the client, the
 .BR soft
 limit is used; if the requested time limit exceeds the
 .BR hard
-limit, an "Administrative limit exceeded" is returned.
+limit, an
+.I \"Administrative limit exceeded\"
+is returned.
 If the
 .BR hard
-limit is set to 0 or to the keyword "soft", the soft limit is used 
-in either case; if it is set to -1 or to the keyword "none", 
+limit is set to 0 or to the keyword 
+.IR soft ,
+the soft limit is used in either case; if it is set to 
+.I -1 
+or to the keyword 
+.IR none , 
 no hard limit is enforced.
 Explicit requests for time limits smaller or equal to the
 .BR hard 
@@ -395,11 +401,17 @@ If no size limit is explicitly requested by the client, the
 .BR soft
 limit is used; if the requested size limit exceeds the
 .BR hard
-limit, an "Administrative limit exceeded" is returned.
+limit, an 
+.I \"Administrative limit exceeded\"
+is returned.
 If the 
 .BR hard
-limit is set to 0 or to the keyword "soft", the soft limit is used 
-in either case; if it is set to -1 or to the keyword "none", 
+limit is set to 0 or to the keyword 
+.IR soft , 
+the soft limit is used in either case; if it is set to 
+.I -1 
+or to the keyword
+.IR none , 
 no hard limit is enforced.
 Explicit requests for size limits smaller or equal to the
 .BR hard
@@ -410,8 +422,13 @@ flag sets a limit on the number of candidates a search request is allowed
 to examine.
 If the selected candidates exceed the 
 .BR unchecked
-limit, the search will abort with "Unwilling to perform".
-If it is set to -1 or to the keyword "none", no limit is applied (the default).
+limit, the search will abort with 
+.IR \"Unwilling to perform\" .
+If it is set to
+.I -1 
+or to the keyword 
+.IR none , 
+no limit is applied (the default).
 If no flag is set, the value is assigned to the
 .BR soft 
 limit, and the
@@ -420,7 +437,7 @@ limit is set to zero, to preserve the original behavior.
 
 In case of no match, the global limits are used.
 The default values are the same of
-.BR sizelimit
+.B sizelimit
 and
 .BR timelimit ;
 no limit is set on 
@@ -433,7 +450,7 @@ control is defined, additional size limits may be enforced; the syntax is
 where
 .BR integer
 is the max page size if no explicit limit is set; the keyword
-.BR noEstimate
+.IR noEstimate
 inhibits the server to return an estimate of the total number
 of entries that will be returned.
 .RE
@@ -529,9 +546,9 @@ in place of the numeric OID in objectclass and attribute definitions. The
 name can also be used with a suffix of the form ":xx" in which case the
 value "oid.xx" will be used.
 .TP
-.B password-hash <hash>
-This option sets the hash to be used in generation of user
-passwords, stored in userPassword, during processing of
+.B password-hash <hash> [<hash>...]
+This option configures one or more hashes to be used in generation of user
+passwords stored in the userPassword attribute during processing of
 LDAP Password Modify Extended Operations (RFC 3062).
 The <hash> must be one of
 .BR {SSHA} ,
@@ -684,6 +701,87 @@ In general the
 .I saslAuthzTo
 attribute must be protected with ACLs such that
 only privileged users can modify it.
+The value of
+.I saslAuthzFrom
+and
+.I saslAuthzTo
+describes an 
+.B identity 
+or a set of identities; it can take three forms:
+.RS
+.RS
+.TP
+.B ldap:///<base>??[<scope>]?<filter>
+.RE
+.RS
+.B dn[.<dnstyle>]:<pattern>
+.RE
+.RS
+.B u[<mech>[<realm>]]:<pattern>
+.RE
+.RS
+.B <pattern>
+.RE
+.RS
+
+.B <dnstyle>:={exact|onelevel|children|subtree|regex}
+
+.RE
+The first form is a valid LDAP
+.B uri
+where the 
+.IR <host>:<port> ,
+the
+.I <attrs>
+and the
+.I <extensions>
+portions must be absent, so that the search occurs locally on either
+.I saslAuthzFrom
+or 
+.IR saslAuthzTo .
+The second form is a 
+.BR DN ,
+with the optional style modifiers
+.IR exact ,
+.IR onelevel ,
+.IR children ,
+and
+.I subtree
+for exact, onelevel, children and subtree matches, which cause 
+.I <pattern>
+to be normalized according to the DN normalization rules, or the special
+.I regex
+style, which causes
+.I <pattern>
+to be compiled according to 
+.BR regex (7).
+The third form is a SASL
+.BR id ,
+with the optional fields
+.I <mech>
+and
+.I <realm>
+that allow to specify a SASL
+.BR mechanism ,
+and eventually a SASL
+.BR realm ,
+for those mechanisms that support one.
+The need to allow the specification of a mechanism is still debated, 
+and users are strongly discouraged to rely on this possibility.
+For backwards compatibility, if no identity type is provided, i.e. only
+.B <pattern>
+is present, an
+.I exact DN
+is assumed; as a consequence, 
+.B <pattern>
+is subjected to DN normalization.
+Since the interpretation of
+.I saslAuthzFrom
+and
+.I saslAuthzTo
+can impact security, users are strongly encouraged 
+to explicitly set the type of identity specification that is being used.
+.RE
 .TP
 .B sasl-host <fqdn>
 Used to specify the fully qualified domain name used for SASL processing.
@@ -1029,6 +1127,14 @@ createTimestamp attributes for entries.  By default, lastmod is on.
 Specifies the maximum number of aliases to dereference when trying to
 resolve an entry, used to avoid infinite alias loops. The default is 1.
 .TP
+.B overlay <overlay-name>
+Add the specified overlay to this database. An overlay is a piece of
+code that intercepts database operations in order to extend or change
+them. Overlays are pushed onto
+a stack over the database, and so they will execute in the reverse
+of the order in which they were configured and the database itself
+will receive control last of all.
+.TP
 .B readonly on | off
 This option puts the database into "read-only" mode.  Any attempts to 
 modify the database will return an "unwilling to perform" error.  By
diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8
index 1fa1b5c00a..9be1d191a4 100644
--- a/doc/man/man8/slapd.8
+++ b/doc/man/man8/slapd.8
@@ -7,6 +7,7 @@ slapd \- Stand-alone LDAP Daemon
 .SH SYNOPSIS
 .B LIBEXECDIR/slapd 
 .B [\-[4|6]]
+.B [\-T (a|c|i|p)]
 .B [\-d debug\-level]
 .B [\-f slapd\-config\-file]
 .B [\-h URLs]
@@ -64,6 +65,14 @@ Listen on IPv4 addresses only.
 .B \-6
 Listen on IPv6 addresses only.
 .TP
+.B \-T (a|c|i|p)
+Run in Tool mode. The additional argument selects whether to run as
+slapadd, slapcat, slapindex, or slappasswd. This option should be the first
+option specified when it is used. Any remaining options will be interpreted
+by the corresponding slap tool program. Note that these tool programs will
+usually be symbolic links to slapd. This option is provided for situations
+where symbolic links are not provided or not usable.
+.TP
 .BI \-d " debug\-level"
 Turn on debugging as defined by
 .I debug\-level.
@@ -228,6 +237,10 @@ To test whether the configuration file is correct or not, type:
 .BR ldap (3),
 .BR slapd.conf (5),
 .BR slapd.access (5),
+.BR slapadd (8),
+.BR slapcat (8),
+.BR slapindex (8),
+.BR slappasswd (8),
 .BR slurpd (8)
 .LP
 "OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)