aitzol/openldap-pla2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docker commit

Browse Source
This commit is contained in:
aitzol
2026-09-12 15:46:16 +02:00
commit f96af95f53
26 changed files with 2460 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.dockerignore
+1
View File
@@ -0,0 +1 @@
**/*~
.env
+5
View File
@@ -0,0 +1,5 @@
LDAP_ROOTDN=cn=admin,dc=ldap,dc=lainoa,dc=eus
LDAP_BASE_DN=cn=admin,dc=ldap,dc=lainoa,dc=eus
LDAP_ROOTPW='sagastarri996$L'
LDAP_READONLY_USER_USERNAME='readonly'
LDAP_READONLY_USER_PASSWORD='Q2M7VDeL'
.gitignore
View File
Dockerfile
+42
View File
@@ -0,0 +1,42 @@
FROM alpine:3.24
ARG BUILD_DATE=$(date +%Y-%m-%dT%H:%M:%SZ)
LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
org.opencontainers.image.source=https://github.com/instantlinux/docker-tools \
org.label-schema.build-date=$BUILD_DATE \
org.label-schema.license=GPL-3.0 \
org.label-schema.name=openldap \
org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
ARG OPENLDAP_VERSION=2.6.14-r0
ENV LDAP_DN_ATTR=uid \
LDAP_FQDN=example.com \
LDAP_LOG_LEVEL=Config,Stats \
LDAP_ORGANIZATION=Example \
LDAP_OU=ou=users, \
LDAP_PWD_ATTRIBUTE=userPassword \
LDAP_PWD_CHECK_QUALITY=2 \
LDAP_PWD_FAILURE_COUNT_INTERVAL=1200 \
LDAP_PWD_LOCKOUT_DURATION=1200 \
LDAP_PWD_MAX_FAILURE=5 \
LDAP_PWD_MIN_LENGTH=8 \
LDAP_ROOTDN= \
LDAP_ROOTPW_HASH= \
LDAP_ROOTPW_SECRETNAME=aldatu \
LDAP_SUFFIX= \
LDAP_ULIMIT=2048 \
LDAP_USERPW_SECRETNAME=kendu
RUN apk add --update --no-cache gettext gzip openldap=$OPENLDAP_VERSION \
openldap-clients openldap-back-mdb openldap-passwd-pbkdf2 \
openldap-overlay-auditlog openldap-overlay-memberof \
openldap-overlay-ppolicy openldap-overlay-refint
VOLUME /etc/openldap/prepopulate /var/lib/openldap/openldap-data \
/etc/ssl/openldap
EXPOSE 389 636
COPY slapd.conf /root/
COPY schema/custom.* /etc/openldap/schema/
COPY ldif/ /root/ldif/
COPY entrypoint.sh /usr/local/bin/
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
LICENSE
+733
View File
File diff suppressed because one or more lines are too long
README.md
+76
View File
@@ -0,0 +1,76 @@
## openldap
[![](https://img.shields.io/docker/v/instantlinux/openldap?sort=date)](https://hub.docker.com/r/instantlinux/openldap/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/openldap?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/openldap "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/openldap/Dockerfile "dockerfile") [![](https://img.shields.io/badge/ghcr-package-blue?logo=github "ghcr badge")](https://github.com/users/instantlinux/packages/container/package/openldap)
This is OpenLDAP in a tiny alpine container, with simple setup. All features and capabilities are supported.
Why this new image (in 2022), when there are others? The dinkel and osixia images fell out of maintenance, so the only current maintained alternative is the larger / more complex / single-platform bitnami.
### Usage
Set environment variables as shown below, and mount a blank storage volume as `/var/lib/openldap/openldap-data`. Optionally, put your users and groups into ldif format (see [example](https://github.com/instantlinux/docker-tools/blob/main/images/openldap/example-users.ldif)) and mount them as `/etc/openldap/prepopulate`, and/or add TLS certifates under `/etc/ssl/openldap`.
Example kubernetes and docker-compose resource definition files are provided here along with a helm chart. This repo has complete instructions for
[building a kubernetes cluster](https://github.com/instantlinux/docker-tools/blob/main/k8s/README.md) where you can launch with [helm](https://github.com/instantlinux/docker-tools/tree/main/images/openldap/helm) using _make_ and customizing [Makefile.vars](https://github.com/instantlinux/docker-tools/blob/main/k8s/Makefile.vars) after cloning this repo:
~~~
git clone https://github.com/instantlinux/docker-tools.git
cd docker-tools/k8s
make openldap
~~~
### Variables
| Variable | Default | Description |
| -------- | ------- | ----------- |
| SLAPD_DN_ATTR | uid | Attribute of user dn (usually `cn` or `uid`) |
| SLAPD_FQDN | example.com | |
| SLAPD_LOG_LEVEL | Config,Stats | See [loglevel keywords](https://www.openldap.org/doc/admin24/slapdconfig.html) |
| SLAPD_ORGANIZATION | Example | |
| SLAPD_OU | ou=users, | Org-unit component of DN |
| SLAPD_PWD_ATTRIBUTE | userPassword | Attribute of hashed password |
| SLAPD_PWD_CHECK_QUALITY | 2 | Password-modify enforcement option 0-2 |
| SLAPD_PWD_FAILURE_COUNT_INTERVAL | 1200 | Reset failures [20 min] |
| SLAPD_PWD_LOCKOUT_DURATION | 1200 | Clear lockout [20 min] |
| SLAPD_PWD_MAX_FAILURE | 5 | Maximum attempts before lockout |
| SLAPD_PWD_MIN_LENGTH | 8 | Password-modify minimum length |
| SLAPD_ROOTDN | cn=admin,dc=(suffix) | Admin user's DN |
| SLAPD_ROOTPW | | Plain-text admin password |
| SLAPD_ROOTPW_HASH | | Hashed admin password |
| SLAPD_ROOTPW_SECRETNAME | openldap-ro-password | Name of secret to hold pw |
| SLAPD_SUFFIX | (based on `SLAPD_FQDN`) | Suffix of DN |
| SLAPD_ULIMIT | 2048 | maximum file size |
| SLAPD_USERPW_SECRETNAME | openldap-user-passwords | Name of secret to hold pws |
If overriding default root DN, it should be specified in the form `cn=admin,dc=example,dc=com`.
The root password must be specified in one of three ways:
* `SLAPD_ROOTPW` - plain text value, only for testing
* `SLAPD_ROOTPW_HASH` - encrypted value starting with `{PBKDF2-SHA512}`
* `openldap-ro-password` secret - most secure place to store the hash
You will want to override values for `SLAPD_FQDN` and `SLAPD_ORGANIZATION`. All the other default values will work for many typical use-cases.
User passwords are normally initialized by the administrator using `ldappasswd`, and from then on updated by the user (through the same tool or protocol). With this image, you can also define user passwords by providing their (hashed) values via a secret. Don't use `ldappasswd` to update passwords that are provided with the latter method: use it to generate a new hashed value and update the secret.
### Volumes
Mount these path names to persistent storage; all are optional.
Path | Description
---- | -----------
/etc/openldap/prepopulate | Zero or more .ldif files to load upon startup
/var/lib/openldap/openldap-data | Persistent storage for ldap database
/etc/ssl/openldap | TLS/SSL certificate
### Secrets
Secret | Description
------ | -----------
openldap-rootpw | Hashed password (key name openldap-rootpw-hash)
openldap-ssl | Certificate (cacert.pem, tls.crt, tls.key)
openldap-user-passwords | Hashed passwords (in _user: {PBK...} hash_ form)
### Contributing
If you want to make improvements to this image, see [CONTRIBUTING](https://github.com/instantlinux/docker-tools/blob/main/CONTRIBUTING.md).
[![](https://img.shields.io/badge/license-OpenLDAP-red.svg)](https://git.openldap.org/openldap/openldap/-/blob/master/LICENSE "License badge") [![](https://img.shields.io/badge/code-openldap%2Fopenldap-blue.svg)](https://git.openldap.org/openldap/openldap "Code repo")
data/prepopulate/root.ldif
+15
View File
@@ -0,0 +1,15 @@
dn: uid=root,cn=admins,ou=groups,dc=ldap,dc=lainoa,dc=eus
gidnumber: 500
memberUid: root
mail: root@lainoa.eus
objectclass: account
objectclass: simpleSecurityObject
objectclass: top
objectclass: extensibleObject
uid: root
userpassword: {MD5}KqFTu3MOzIa+1t9lgOeUpw==
dn: cn=admins,ou=groups,${LDAP_SUFFIX}
changetype: modify
add: memberUid
memberUid: root
data/prepopulate/services.ldif
+55
View File
@@ -0,0 +1,55 @@
dn: ou=services,dc=ldap,dc=lainoa,dc=eus
objectclass: organizationalUnit
objectclass: top
ou: services
dn: cn=mumble,ou=services,dc=ldap,dc=lainoa,dc=eus
cn: mumble
objectclass: groupOfUniqueNames
objectclass: top
uniquemember: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=
eus
uniquemember: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Garazi Telleria,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
uniquemember: cn=Jose Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
uniquemember: cn=Nekane Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Nekane Eskisabel,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eu
s
# Entry 18: cn=nextcloud,ou=services,dc=ldap,dc=lainoa,dc=eus
dn: cn=nextcloud,ou=services,dc=ldap,dc=lainoa,dc=eus
#changetype: add
cn: nextcloud
objectclass: groupOfUniqueNames
objectclass: top
uniquemember: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=
eus
uniquemember: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
# Entry 19: cn=xmpp,ou=services,dc=ldap,dc=lainoa,dc=eus
dn: cn=xmpp,ou=services,dc=ldap,dc=lainoa,dc=eus
#changetype: add
cn: xmpp
objectclass: groupOfUniqueNames
objectclass: top
uniquemember: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=
eus
uniquemember: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Garazi Telleria,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
uniquemember: cn=Jose Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
uniquemember: cn=Nekane Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Nekane Eskisabel,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eu
s
uniquemember:: Y249QWxvw7FhIEV0eGV6YWJhbCxjbj11c2VycyxvdT1ncm91cHMsZGM9bGRhc
CxkYz1sYWlub2EsZGM9ZXVz
data/prepopulate/users.ldif
+156
View File
@@ -0,0 +1,156 @@
dn: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Ainhize Berasategi
devices: PC / Linux / Firefox 128.0
fakecn: FALSE
gidnumber: 501
givenname: Ainhize
homedirectory: home/user/ainhize
ip: 192.168.2.110
lastlogin: 20250621131028Z
mail: aiberasategi@beasaingoikastola.eus
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: ainhize
uidnumber: 1003
userPassword: {SSHA}ZkwccsQKfDxCx3+iYBe7WzO7GgfpP3df
dn: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Aitzol Berasategi
devices: PC / Linux / Firefox 115.0
devices: PC / Linux / Firefox 128.0
devices: iPhone / iOS 17.5.1 / Firefox iOS 133.4
devices: PC / Linux / Firefox 140.0
fakecn: FALSE
gidnumber: 501
givenname: Aitzol
homedirectory: /home/users/aitzol
ip: 192.168.2.110
lastlogin: 20260421214748Z
mail: aitzol@lainoa.eus
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: aitzol
uidnumber: 1000
userPassword: {SSHA}ZvElYuNEKlO78Z7sNYvTFe12H7CVqGu1
dn:: Y249QWxvw7FhIEV0eGV6YWJhbCxjbj11c2VycyxvdT1ncm91cHMsZGM9bGRhcCxkYz1sYWl
ub2EsZGM9ZXVz
active: TRUE
cn:: QWxvw7FhIEV0eGV6YWJhbA==
fakecn: FALSE
gidnumber: 501
givenname:: QWxvw7Fh
homedirectory: home/user/alona
mail: etxezabal2@gmail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Etxezabal
uid:: YWxvw7Fh
uidnumber: 1002
userPassword: {SSHA}LJpDFOrqVyNOWlM31RJKjPLRRGr+MYZh
dn: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: FALSE
cn: Araitz Berasategi
devices: PC / Linux / Firefox 115.0
fakecn: FALSE
gidnumber: 501
givenname: Araitz
homedirectory: home/user/araitz
ip: 192.168.2.110
lastlogin: 20240901123138Z
mail: aberasategi@beasaingoikastola.eus
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: araitz
uidnumber: 1001
userPassword: {SSHA}k7P67WSQo/87fso9YeNFSLgWOb1B9KPj
dn: cn=Garazi Telleria,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Garazi Telleria
fakecn: FALSE
gidnumber: 501
givenname: Garazi
homedirectory: home/user/garazi
mail: garazi@fakemail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Telleria
uid: garazi
uidnumber: 1004
userPassword: {SSHA}hZd/0nLphR2Mv+Q9usIHqLVzipq4fQ+J
dn: cn=Jose Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Jose Berasategi
fakecn: FALSE
gidnumber: 501
givenname: Jose
homedirectory: home/user/aitona
mail: joxeberasategi@gmail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: aitona
uidnumber: 1007
userPassword: {SSHA}FYBXKDw95/AzFRSXs2eDE+r5Fq+9SrAk
dn: cn=Nekane Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Nekane Berasategi
fakecn: FALSE
gidnumber: 501
givenname: Nekane
homedirectory: home/user/nekane
mail: nekane@fakemail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: nekane
uidnumber: 1005
userPassword: {SSHA}fH8F5MAoNyc9QTnn4wDp3w4ZJPttNdBA
dn: cn=Nekane Eskisabel,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Nekane Eskisabel
fakecn: FALSE
gidnumber: 501
givenname: Nekane
homedirectory: home/user/amona
mail: ertzillegi54@gmail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Eskisabel
uid: amona
uidnumber: 1006
userPassword: {SSHA}rJcOSS7WyqqxfstkuWJdjn/p00h95xTw
data/prepopulate/users.ldif~
+156
View File
@@ -0,0 +1,156 @@
dn: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Ainhize Berasategi
devices: PC / Linux / Firefox 128.0
fakecn: FALSE
gidnumber: 501
givenname: Ainhize
homedirectory: home/user/ainhize
ip: 192.168.2.110
lastlogin: 20250621131028Z
mail: aiberasategi@beasaingoikastola.eus
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: ainhize
uidnumber: 1003
userpassword: {SSHA}ZkwccsQKfDxCx3+iYBe7WzO7GgfpP3df
dn: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Aitzol Berasategi
devices: PC / Linux / Firefox 115.0
devices: PC / Linux / Firefox 128.0
devices: iPhone / iOS 17.5.1 / Firefox iOS 133.4
devices: PC / Linux / Firefox 140.0
fakecn: FALSE
gidnumber: 501
givenname: Aitzol
homedirectory: /home/users/aitzol
ip: 192.168.2.110
lastlogin: 20260421214748Z
mail: aitzol@lainoa.eus
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: aitzol
uidnumber: 1000
userpassword: {SSHA}ZvElYuNEKlO78Z7sNYvTFe12H7CVqGu1
dn:: Y249QWxvw7FhIEV0eGV6YWJhbCxjbj11c2VycyxvdT1ncm91cHMsZGM9bGRhcCxkYz1sYWl
ub2EsZGM9ZXVz
active: TRUE
cn:: QWxvw7FhIEV0eGV6YWJhbA==
fakecn: FALSE
gidnumber: 501
givenname:: QWxvw7Fh
homedirectory: home/user/alona
mail: etxezabal2@gmail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Etxezabal
uid:: YWxvw7Fh
uidnumber: 1002
userpassword: {SSHA}LJpDFOrqVyNOWlM31RJKjPLRRGr+MYZh
dn: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: FALSE
cn: Araitz Berasategi
devices: PC / Linux / Firefox 115.0
fakecn: FALSE
gidnumber: 501
givenname: Araitz
homedirectory: home/user/araitz
ip: 192.168.2.110
lastlogin: 20240901123138Z
mail: aberasategi@beasaingoikastola.eus
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: araitz
uidnumber: 1001
userpassword: {SSHA}k7P67WSQo/87fso9YeNFSLgWOb1B9KPj
dn: cn=Garazi Telleria,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Garazi Telleria
fakecn: FALSE
gidnumber: 501
givenname: Garazi
homedirectory: home/user/garazi
mail: garazi@fakemail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Telleria
uid: garazi
uidnumber: 1004
userpassword: {SSHA}hZd/0nLphR2Mv+Q9usIHqLVzipq4fQ+J
dn: cn=Jose Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Jose Berasategi
fakecn: FALSE
gidnumber: 501
givenname: Jose
homedirectory: home/user/aitona
mail: joxeberasategi@gmail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: aitona
uidnumber: 1007
userpassword: {SSHA}FYBXKDw95/AzFRSXs2eDE+r5Fq+9SrAk
dn: cn=Nekane Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Nekane Berasategi
fakecn: FALSE
gidnumber: 501
givenname: Nekane
homedirectory: home/user/nekane
mail: nekane@fakemail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: nekane
uidnumber: 1005
userpassword: {SSHA}fH8F5MAoNyc9QTnn4wDp3w4ZJPttNdBA
dn: cn=Nekane Eskisabel,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Nekane Eskisabel
fakecn: FALSE
gidnumber: 501
givenname: Nekane
homedirectory: home/user/amona
mail: ertzillegi54@gmail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Eskisabel
uid: amona
uidnumber: 1006
userpassword: {SSHA}rJcOSS7WyqqxfstkuWJdjn/p00h95xTw
docker-compose.yml
+45
View File
@@ -0,0 +1,45 @@
services:
app:
image: openldap:2.6.14
environment:
LDAP_ROOTDN: ${LDAP_ROOTDN}
LDAP_BASE_DN: ${LDAP_BASE_DN}
#LDAP_ROOTDN: ${LDAP_ROOTDN:-cn=admin,dc=ldap,dc=lainoa,dc=eus}
LDAP_ROOTPW: ${LDAP_ROOTPW}
LDAP_FQDN: ldap.lainoa.eus
LDAP_DN_ATTR: cn
LDAP_ORGANIZATION: wproject
LDAP_READONLY_USER: "true"
LDAP_READONLY_USER_USERNAME: ${LDAP_READONLY_USER_USERNAME}
LDAP_READONLY_USER_PASSWORD: ${LDAP_READONLY_USER_PASSWORD}
#hostname: openldap
volumes:
- ./data:/var/lib/openldap/openldap-data
- ./data/prepopulate:/etc/openldap/prepopulate:ro
- ./certs:/etc/ssl/openldap:ro
ports:
- ${PORT_OPENLDAP:-389}:389
- ${PORT_OPENLDAP_SSL:-636}:636
secrets:
- openldap-user-passwords
phpldapadmin:
image: phpldapadmin/phpldapadmin:latest
environment:
LDAP_HOST: app
LDAP_BASE_DN: dc=ldap,dc=lainoa,dc=eus
LDAP_USERNAME: cn=admin,dc=ldap,dc=lainoa,dc=eus
LDAP_PASSWORD: ${LDAP_ROOTPW}
#LDAP_LOGIN_ATTR: dn
LDAP_LOGIN_ATTR: uid
LDAP_LOGIN_OBJECTCLASS: simpleSecurityObject
LDAP_ALLOW_GUEST: "FALSE"
LDAP_ALERT_ROOTDN: "TRUE"
ports:
- "8080:8080"
depends_on:
- app
secrets:
openldap-user-passwords:
file: ./secrets/passwords.txt
dot.env
+5
View File
@@ -0,0 +1,5 @@
LDAP_ROOTDN=cn=admin,dc=ldap,dc=example,dc=com
LDAP_BASE_DN=cn=admin,dc=ldap,dc=example,dc=com
LDAP_ROOTPW='root_pwd'
LDAP_READONLY_USER_USERNAME='readonly'
LDAP_READONLY_USER_PASSWORD='readonly_pwd'
entrypoint.sh
Executable
+152
View File
@@ -0,0 +1,152 @@
#!/bin/sh -e
LDAP_CONF_DIR=/etc/openldap/slapd.d
LDAP_DATA_DIR=/var/lib/openldap/openldap-data
LDAP_URLPREFIX=ldap
export LDAP_IPC_URL=ldapi://%2Frun%2Fopenldap%2Fldapi
dc_str=$(echo ${LDAP_FQDN} | sed -e s:[.]:,dc=:g)
[ -z "$LDAP_SUFFIX" ] && export LDAP_SUFFIX=dc=$dc_str
# Set ulimit - See https://github.com/docker/docker/issues/8231
ulimit -n $LDAP_ULIMIT
INITIAL_START=0
if [ ! -d ${LDAP_CONF_DIR} ]; then
INITIAL_START=1
# At first startup, create directories and configurations
[ -z "${LDAP_ROOTDN}" ] && LDAP_ROOTDN=cn=admin,${LDAP_SUFFIX}
if [ ! -z "$LDAP_ROOTPW" ]; then
LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \
-h {PBKDF2-SHA512} -s "$LDAP_ROOTPW")
elif [[ -z "$LDAP_ROOTPW_HASH" && -s /run/secrets/$LDAP_ROOTPW_SECRETNAME ]]; then
LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \
-h {PBKDF2-SHA512} -s "$(cat /run/secrets/$LDAP_ROOTPW_SECRETNAME)")
fi
if [ -z "$LDAP_ROOTPW_HASH" ]; then
echo "** Secret LDAP_ROOTPW_SECRETNAME unspecified **"
exit 1
fi
export LDAP_DATA_DIR
mkdir -p -m 750 ${LDAP_CONF_DIR} /run/openldap
if [[ "$(ls -A /etc/ssl/openldap)" ]]; then
CA_CERT=/etc/ssl/openldap/ca_cert.pem
SSL_KEY=/etc/ssl/openldap/tls.key
SSL_CERT=/etc/ssl/openldap/tls.crt
if [[ -f ${CA_CERT} ]]; then
echo "TLSCACertificateFile ${CA_CERT}" >> /root/slapd.conf
fi
echo "TLSCertificateFile ${SSL_CERT}" >> /root/slapd.conf
echo "TLSCertificateKeyFile ${SSL_KEY}" >> /root/slapd.conf
echo "TLSCipherSuite HIGH:-SSLv2:-SSLv3" >> /root/slapd.conf
LDAP_URLPREFIX=ldaps
fi
sed -i -e "s/^#BASE.*/BASE ${LDAP_SUFFIX}/" /etc/openldap/ldap.conf
export LDAP_DOMAIN=$(echo ${LDAP_FQDN} | cut -d . -f 1)
export LDAP_EMAIL_DOMAIN=$(echo "$LDAP_FQDN" | awk -F. '{print $(NF-1)"."$NF}')
if [[ -n "$LDAP_READONLY_USER_USERNAME" && -n "$LDAP_READONLY_USER_PASSWORD" ]]; then
echo "encrypting readonly user password..";
LDAP_READONLY_USER_PASSWORD_ENCRYPTED=$(slappasswd \
-o module-load=pw-pbkdf2.so \
-h '{PBKDF2-SHA512}' \
-s "$LDAP_READONLY_USER_PASSWORD")
export LDAP_READONLY_USER_PASSWORD_ENCRYPTED
else
mv /root/ldif/20-readonly-user.ldif /root/ldif/20-readonly-user.ldif.unused
fi
# Database structure
TMP=$(mktemp)
for file in $(find /root/ldif -type f) /root/slapd.conf; do
cat "${file}" | envsubst > $TMP
mv $TMP "${file}"
done
cp /root/slapd.conf /etc/openldap/slapd.conf
slaptest -f /etc/openldap/slapd.conf -F ${LDAP_CONF_DIR} -n0
# Load LDIF base schemas with slapadd
if [ ! -s ${LDAP_DATA_DIR}/data.mdb ]; then
for file in $(find /root/ldif -maxdepth 1 -name '00-*.ldif' -type f | sort); do
echo "Loading ${file}"
slapadd -F "${LDAP_CONF_DIR}" -l "${file}" -n1
done
if [[ -f /root/ldif/20-readonly-user.ldif ]]; then
echo "Loading readonly LDAP user"
slapadd -F "${LDAP_CONF_DIR}" -l /root/ldif/20-readonly-user.ldif -n1
fi
fi
fi
touch /var/log/slapd-audit.log
mkdir -p -m 750 /run/openldap
chown -R ldap:ldap ${LDAP_CONF_DIR} ${LDAP_DATA_DIR} /run/openldap \
/var/log/slapd-audit.log
tail -f -n0 /var/log/slapd-audit.log |
sed "s/^${LDAP_PWD_ATTRIBUTE}::.*/${LDAP_PWD_ATTRIBUTE}:: --redacted--/" &
# Load ldif files to cn=config, password policies and optional data with ldapadd
(
if [[ "${INITIAL_START}" = "1" ]]; then
sleep 10
echo 'Loading server additional config'
for file in $(find /root/ldif -maxdepth 1 -name '01-*.ldif' -type f | sort); do
echo "Loading ${file}"
envsubst < "${file}" | \
ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL}
done
echo 'Loading password policy'
envsubst < /root/ldif/10-passwordDefaultPolicy.ldif | \
ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL}
if [[ -d /etc/openldap/prepopulate ]]; then
for file in `find /etc/openldap/prepopulate`; do
echo "Loading optional file: ${file}"
envsubst < "${file}" | \
ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL}
done
fi
fi
echo 'Setting user passwords'
PW_FILE=$(find /run/secrets/$LDAP_USERPW_SECRETNAME -type f | head -1)
if [[ ! -z "${PW_FILE}" && -s "${PW_FILE}" ]]; then
awk -F : -v dnattr=${LDAP_DN_ATTR} \
-v suffix=,${LDAP_OU}${LDAP_SUFFIX} \
-v pwdattr=${LDAP_PWD_ATTRIBUTE} \
'{ print "dn: " dnattr "=" $1 suffix "\n" \
"changetype: modify\n" \
"replace: " pwdattr "\n" \
pwdattr ": " $2 "\n" }' <${PW_FILE} | \
ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL}
fi
) &
exec slapd -h "${LDAP_URLPREFIX}:/// ${LDAP_IPC_URL}" \
-F ${LDAP_CONF_DIR} -u ldap -g ldap -d "${LDAP_LOG_LEVEL}"
gitignore
+1
View File
@@ -0,0 +1 @@
.env
ldif/00-base.ldif
+6
View File
@@ -0,0 +1,6 @@
dn: ${LDAP_SUFFIX}
objectClass: top
objectClass: dcObject
objectClass: organization
dc: ${LDAP_DOMAIN}
o: ${LDAP_ORGANISATION}
ldif/00-default-groups.ldif
+17
View File
@@ -0,0 +1,17 @@
dn: ou=groups,${LDAP_SUFFIX}
objectclass: organizationalUnit
objectclass: top
ou: groups
dn: cn=admins,ou=groups,${LDAP_SUFFIX}
cn: admins
gidnumber: 500
objectclass: posixGroup
objectclass: top
memberUid: admin
dn: cn=users,ou=groups,${LDAP_SUFFIX}
cn: users
gidnumber: 501
objectclass: posixGroup
objectclass: top
ldif/00-default-user-admin.ldif
+10
View File
@@ -0,0 +1,10 @@
dn: uid=admin,cn=admins,ou=groups,${LDAP_SUFFIX}
gidNumber: 500
memberUid: admin
mail: admin@${LDAP_EMAIL_DOMAIN}
objectClass: account
objectClass: simpleSecurityObject
objectClass: top
objectClass: extensibleObject
uid: admin
userpassword: ${LDAP_ROOTPW}
ldif/01-auditlog.ldif
+6
View File
@@ -0,0 +1,6 @@
dn: olcOverlay=auditlog,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcAuditLogConfig
olcOverlay: auditlog
olcAuditlogFile: /var/log/slapd-audit.log
ldif/01-memberof.ldif
+27
View File
@@ -0,0 +1,27 @@
dn: cn=module,cn=config
changetype: add
objectClass: olcModuleList
cn: module
olcModuleLoad: memberof.so
olcModuleLoad: refint.so
dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcMemberOf
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf
dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
olcOverlay: {1}refint
olcRefintAttribute: memberof
olcRefintAttribute: member
olcRefintAttribute: manager
olcRefintAttribute: owner
ldif/01-ppolicy.ldif
+15
View File
@@ -0,0 +1,15 @@
dn: cn=module,cn=config
changetype: add
objectClass: olcModuleList
cn: module
olcModuleLoad: ppolicy.so
dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: ppolicy
olcPPolicyDefault: ${PPOLICY_DN}
olcPPolicyHashCleartext: FALSE
olcPPolicyForwardUpdates: FALSE
olcPPolicyUseLockout: FALSE
ldif/10-passwordDefaultPolicy.ldif
+28
View File
@@ -0,0 +1,28 @@
dn: ou=Policies,${LDAP_SUFFIX}
changetype: add
ou: Policies
objectClass: top
objectClass: organizationalUnit
dn: cn=passwordDefault,ou=Policies,${LDAP_SUFFIX}
changetype: add
objectClass: pwdPolicy
objectClass: person
objectClass: top
cn: passwordDefault
sn: passwordDefault
pwdAttribute: ${LDAP_PWD_ATTRIBUTE}
pwdCheckQuality: ${LDAP_PWD_CHECK_QUALITY}
pwdMinAge: 0
pwdMaxAge: 0
pwdMinLength: ${LDAP_PWD_MIN_LENGTH}
pwdInHistory: 5
pwdMaxFailure: ${LDAP_PWD_MAX_FAILURE}
pwdFailureCountInterval: ${LDAP_PWD_FAILURE_COUNT_INTERVAL}
pwdLockout: TRUE
pwdLockoutDuration: ${LDAP_PWD_LOCKOUT_DURATION}
pwdAllowUserChange: TRUE
pwdExpireWarning: 0
pwdGraceAuthNLimit: 0
pwdMustChange: FALSE
pwdSafeModify: TRUE
ldif/20-readonly-user.ldif
+6
View File
@@ -0,0 +1,6 @@
dn: cn=${LDAP_READONLY_USER_USERNAME},${LDAP_SUFFIX}
cn: ${LDAP_READONLY_USER_USERNAME}
objectClass: simpleSecurityObject
objectClass: organizationalRole
userPassword: ${LDAP_READONLY_USER_PASSWORD_ENCRYPTED}
description: LDAP read only user
schema/custom.ldif
+813
View File
@@ -0,0 +1,813 @@
dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
olcObjectIdentifier: OLcfg 1.3.6.1.4.1.4203.1.12.2
olcObjectIdentifier: OLcfgAt OLcfg:3
olcObjectIdentifier: OLcfgGlAt OLcfgAt:0
olcObjectIdentifier: OLcfgBkAt OLcfgAt:1
olcObjectIdentifier: OLcfgDbAt OLcfgAt:2
olcObjectIdentifier: OLcfgOvAt OLcfgAt:3
olcObjectIdentifier: OLcfgCtAt OLcfgAt:4
olcObjectIdentifier: OLcfgOc OLcfg:4
olcObjectIdentifier: OLcfgGlOc OLcfgOc:0
olcObjectIdentifier: OLcfgBkOc OLcfgOc:1
olcObjectIdentifier: OLcfgDbOc OLcfgOc:2
olcObjectIdentifier: OLcfgOvOc OLcfgOc:3
olcObjectIdentifier: OLcfgCtOc OLcfgOc:4
olcObjectIdentifier: OMsyn 1.3.6.1.4.1.1466.115.121.1
olcObjectIdentifier: OMsBoolean OMsyn:7
olcObjectIdentifier: OMsDN OMsyn:12
olcObjectIdentifier: OMsDirectoryString OMsyn:15
olcObjectIdentifier: OMsIA5String OMsyn:26
olcObjectIdentifier: OMsInteger OMsyn:27
olcObjectIdentifier: OMsOID OMsyn:38
olcObjectIdentifier: OMsOctetString OMsyn:40
olcObjectIdentifier: olmAttributes 1.3.6.1.4.1.4203.666.1.55
olcObjectIdentifier: olmSubSystemAttributes olmAttributes:0
olcObjectIdentifier: olmGenericAttributes olmSubSystemAttributes:0
olcObjectIdentifier: olmDatabaseAttributes olmSubSystemAttributes:1
olcObjectIdentifier: olmOverlayAttributes olmSubSystemAttributes:2
olcObjectIdentifier: olmModuleAttributes olmSubSystemAttributes:3
olcObjectIdentifier: olmObjectClasses 1.3.6.1.4.1.4203.666.3.16
olcObjectIdentifier: olmSubSystemObjectClasses olmObjectClasses:0
olcObjectIdentifier: olmGenericObjectClasses olmSubSystemObjectClasses:0
olcObjectIdentifier: olmDatabaseObjectClasses olmSubSystemObjectClasses:1
olcObjectIdentifier: olmOverlayObjectClasses olmSubSystemObjectClasses:2
olcObjectIdentifier: olmModuleObjectClasses olmSubSystemObjectClasses:3
olcObjectIdentifier: olmSyncReplAttributes olmOverlayAttributes:1
olcObjectIdentifier: olmSyncReplObjectClasses olmOverlayObjectClasses:1
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.1 DESC 'ACI Item' X-BINARY-TRANS
FER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.2 DESC 'Access Point' X-NOT-HUMA
N-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.3 DESC 'Attribute Type Descripti
on' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' X-NOT-HUMAN-READA
BLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' X-NOT-HUMAN-READ
ABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' X-BINARY-TR
ANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' X-BINA
RY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' X-BIN
ARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.1 DESC 'X.509 AttributeCertifi
cate' X-BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' )
olcLdapSyntaxes: ( 1.2.36.79672281.1.5.0 DESC 'RDN' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.13 DESC 'Data Quality' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'Directory String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.16 DESC 'DIT Content Rule Descri
ption' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.17 DESC 'DIT Structure Rule Desc
ription' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.19 DESC 'DSA Quality' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.20 DESC 'DSE Type' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.21 DESC 'Enhanced Guide' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile Telephone Num
ber' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.23 DESC 'Fax' X-NOT-HUMAN-READAB
LE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.25 DESC 'Guide' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'Integer' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' X-NOT-HUMAN-READA
BLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.29 DESC 'Master And Shadow Acces
s Points' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.30 DESC 'Matching Rule Descripti
on' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.31 DESC 'Matching Rule Use Descr
iption' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.32 DESC 'Mail Preference' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.33 DESC 'MHS OR Address' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID'
)
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.35 DESC 'Name Form Description'
)
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.37 DESC 'Object Class Descriptio
n' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.39 DESC 'Other Mailbox' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.43 DESC 'Presentation Address' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.45 DESC 'SubtreeSpecification' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' X-
BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'Telephone Number' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.51 DESC 'Teletex Terminal Identi
fier' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.54 DESC 'LDAP Syntax Description
' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.55 DESC 'Modify Rights' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.56 DESC 'LDAP Schema Definition'
)
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.57 DESC 'LDAP Schema Description
' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.58 DESC 'Substring Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.1.0.0 DESC 'RFC2307 NIS Netgroup Triple' )
olcLdapSyntaxes: ( 1.3.6.1.1.1.0.1 DESC 'RFC2307 Boot Parameter' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.1 DESC 'Certificate Exact Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.2 DESC 'Certificate Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.3 DESC 'Certificate Pair Exact Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.4 DESC 'Certificate Pair Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.5 DESC 'Certificate List Exact Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.6 DESC 'Certificate List Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.7 DESC 'Algorithm Identifier' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.2 DESC 'AttributeCertificate E
xact Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.3 DESC 'AttributeCertificate A
ssertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.16.1 DESC 'UUID' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.1 DESC 'CSN' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.4 DESC 'CSN SID' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.2.7 DESC 'OpenLDAP authz' )
olcLdapSyntaxes: ( 1.2.840.113549.1.8.1.1 DESC 'PKCS#8 PrivateKeyInfo' )
olcAttributeTypes: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC4512: object classes
of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121
.1.38 )
olcAttributeTypes: ( 2.5.21.9 NAME 'structuralObjectClass' DESC 'RFC4512: stru
ctural object class of entry' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4
.1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperati
on )
olcAttributeTypes: ( 2.5.18.1 NAME 'createTimestamp' DESC 'RFC4512: time which
object was created' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOr
deringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFIC
ATION USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.2 NAME 'modifyTimestamp' DESC 'RFC4512: time which
object was last modified' EQUALITY generalizedTimeMatch ORDERING generalized
TimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-M
ODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.3 NAME 'creatorsName' DESC 'RFC4512: name of creat
or' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SING
LE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.4 NAME 'modifiersName' DESC 'RFC4512: name of last
modifier' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.9 NAME 'hasSubordinates' DESC 'X.501: entry has ch
ildren' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALU
E NO-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.10 NAME 'subschemaSubentry' DESC 'RFC4512: name of
controlling subschema entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.
4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperat
ion )
olcAttributeTypes: ( 1.3.6.1.1.20 NAME 'entryDN' DESC 'DN of the entry' EQUALI
TY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE N
O-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 1.3.6.1.1.16.4 NAME 'entryUUID' DESC 'UUID of the entry'
EQUALITY UUIDMatch ORDERING UUIDOrderingMatch SYNTAX 1.3.6.1.1.16.1 SINGLE-VA
LUE NO-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' DESC 'change seq
uence number of the entry content' EQUALITY CSNMatch ORDERING CSNOrderingMatc
h SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICATION US
AGE directoryOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.13 NAME 'namingCSN' DESC 'change s
equence number of the entry naming (RDN)' EQUALITY CSNMatch ORDERING CSNOrder
ingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICA
TION USAGE directoryOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.23 NAME 'syncreplCookie' DESC 'syn
crepl Cookie for shadow copy' EQUALITY octetStringMatch ORDERING octetStringO
rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE NO-USER-MODIFI
CATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.25 NAME 'contextCSN' DESC 'the lar
gest committed CSN of a context' EQUALITY CSNMatch ORDERING CSNOrderingMatch
SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} NO-USER-MODIFICATION USAGE dSAOperatio
n )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer' DESC 'RFC4512
: alternative servers' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 USAGE dSAOperatio
n )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts' DESC 'RF
C4512: naming contexts' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.14
66.115.121.1.12 USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl' DESC
'RFC4512: supported controls' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAO
peration )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension' DESC
'RFC4512: supported extended operations' SYNTAX 1.3.6.1.4.1.1466.115.121.1.3
8 USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion' D
ESC 'RFC4512: supported LDAP versions' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 U
SAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms
' DESC 'RFC4512: supported SASL mechanisms' SYNTAX 1.3.6.1.4.1.1466.115.121.1
.15 USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures' DESC 'RFC
4512: features supported by the server' EQUALITY objectIdentifierMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.10 NAME 'monitorContext' DESC 'mon
itor context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121
.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.1 NAME 'configContext' DESC 'conf
ig context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.1.4 NAME 'vendorName' DESC 'RFC3045: name of impl
ementation vendor' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.1.5 NAME 'vendorVersion' DESC 'RFC3045: version o
f implementation' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
5 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 2.5.18.5 NAME 'administrativeRole' DESC 'RFC3672: adminis
trative role' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
1.38 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.6 NAME 'subtreeSpecification' DESC 'RFC3672: subtr
ee specification' SYNTAX 1.3.6.1.4.1.1466.115.121.1.45 SINGLE-VALUE USAGE dir
ectoryOperation )
olcAttributeTypes: ( 2.5.21.1 NAME 'dITStructureRules' DESC 'RFC4512: DIT stru
cture rules' EQUALITY integerFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.
121.1.17 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.2 NAME 'dITContentRules' DESC 'RFC4512: DIT conten
t rules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466
.115.121.1.16 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.4 NAME 'matchingRules' DESC 'RFC4512: matching rul
es' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.
121.1.30 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.5 NAME 'attributeTypes' DESC 'RFC4512: attribute t
ypes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.11
5.121.1.3 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.6 NAME 'objectClasses' DESC 'RFC4512: object class
es' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.
121.1.37 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.7 NAME 'nameForms' DESC 'RFC4512: name forms ' EQU
ALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.3
5 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.8 NAME 'matchingRuleUse' DESC 'RFC4512: matching r
ule uses' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.146
6.115.121.1.31 USAGE directoryOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes' DESC 'RFC
4512: LDAP syntaxes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.
6.1.4.1.1466.115.121.1.54 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.4.1 NAME ( 'aliasedObjectName' 'aliasedEntryName' ) D
ESC 'RFC4512: name of aliased object' EQUALITY distinguishedNameMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
olcAttributeTypes: ( 2.16.840.1.113730.3.1.34 NAME 'ref' DESC 'RFC3296: subord
inate referral URL' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
.15 USAGE distributedOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.1 NAME 'entry' DESC 'OpenLDAP ACL en
try pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USER-MODI
FICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.2 NAME 'children' DESC 'OpenLDAP ACL
children pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USE
R-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.8 NAME ( 'authzTo' 'saslAuthzTo' )
DESC 'proxy authorization targets' EQUALITY authzMatch SYNTAX 1.3.6.1.4.1.42
03.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.9 NAME ( 'authzFrom' 'saslAuthzFro
m' ) DESC 'proxy authorization sources' EQUALITY authzMatch SYNTAX 1.3.6.1.4.
1.4203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.119.3 NAME 'entryTtl' DESC 'RFC2589:
entry time-to-live' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USE
R-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.119.4 NAME 'dynamicSubtrees' DESC 'R
FC2589: dynamic subtrees' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFI
CATION USAGE dSAOperation )
olcAttributeTypes: ( 2.5.4.49 NAME 'distinguishedName' DESC 'RFC4519: common s
upertype of DN attributes' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1
.1466.115.121.1.12 )
olcAttributeTypes: ( 2.5.4.41 NAME 'name' DESC 'RFC4519: common supertype of n
ame attributes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN
TAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )
olcAttributeTypes: ( 2.5.4.3 NAME ( 'cn' 'commonName' ) DESC 'RFC4519: common
name(s) for which the entity is known by' SUP name )
olcAttributeTypes: ( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' ) DESC 'R
FC4519: user identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings
Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
olcAttributeTypes: ( 1.3.6.1.1.1.1.0 NAME 'uidNumber' DESC 'RFC2307: An intege
r uniquely identifying a user in an administrative domain' EQUALITY integerMa
tch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE
-VALUE )
olcAttributeTypes: ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' DESC 'RFC2307: An intege
r uniquely identifying a group in an administrative domain' EQUALITY integerM
atch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGL
E-VALUE )
olcAttributeTypes: ( 2.5.4.35 NAME 'userPassword' DESC 'RFC4519/2307: password
of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128}
)
olcAttributeTypes: ( 1.3.6.1.4.1.250.1.57 NAME 'labeledURI' DESC 'RFC2079: Uni
form Resource Identifier with optional label' EQUALITY caseExactMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( 2.5.4.13 NAME 'description' DESC 'RFC4519: descriptive in
formation' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1
.3.6.1.4.1.1466.115.121.1.15{1024} )
olcAttributeTypes: ( 2.5.4.34 NAME 'seeAlso' DESC 'RFC4519: DN of related obje
ct' SUP distinguishedName )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.60 NAME 'pKCS8PrivateKey' DESC 'PK
CS#8 PrivateKeyInfo, use ;binary' EQUALITY privateKeyMatch SYNTAX 1.2.840.113
549.1.8.1.1 )
olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.29 NAME 'pwdLastSuccess' DESC 'Th
e timestamp of the last successful authentication' EQUALITY generalizedTimeMa
tch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
4 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( OLcfgGlAt:78 NAME 'olcConfigFile' DESC 'File for slapd co
nfiguration directives' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SIN
GLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:79 NAME 'olcConfigDir' DESC 'Directory for slap
d configuration backend' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SI
NGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:1 NAME 'olcAccess' DESC 'Access Control List' E
QUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:86 NAME 'olcAddContentAcl' DESC 'Check ACLs aga
inst content of Add ops' EQUALITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE
)
olcAttributeTypes: ( OLcfgGlAt:2 NAME 'olcAllows' DESC 'Allowed set of depreca
ted features' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:3 NAME 'olcArgsFile' DESC 'File for slapd comma
nd line options' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE-VAL
UE )
olcAttributeTypes: ( OLcfgGlAt:5 NAME 'olcAttributeOptions' EQUALITY caseIgnor
eMatch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:4 NAME 'olcAttributeTypes' DESC 'OpenLDAP attri
buteTypes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX O
MsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:6 NAME 'olcAuthIDRewrite' EQUALITY caseIgnoreMa
tch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:7 NAME 'olcAuthzPolicy' EQUALITY caseIgnoreMatc
h SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:8 NAME 'olcAuthzRegexp' EQUALITY caseIgnoreMatc
h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:9 NAME 'olcBackend' DESC 'A type of backend' EQ
UALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE X-ORDERED 'SIBL
INGS' )
olcAttributeTypes: ( OLcfgGlAt:10 NAME 'olcConcurrency' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:11 NAME 'olcConnMaxPending' EQUALITY integerMat
ch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:12 NAME 'olcConnMaxPendingAuth' EQUALITY intege
rMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:13 NAME 'olcDatabase' DESC 'The backend type fo
r a database instance' SUP olcBackend SINGLE-VALUE X-ORDERED 'SIBLINGS' )
olcAttributeTypes: ( OLcfgGlAt:14 NAME 'olcDefaultSearchBase' EQUALITY disting
uishedNameMatch SYNTAX OMsDN SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.21 NAME 'olcDisabled' EQUALITY booleanMatch S
YNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:15 NAME 'olcDisallows' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:16 NAME 'olcDitContentRules' DESC 'OpenLDAP DIT
content rules' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN
TAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgDbAt:0.20 NAME 'olcExtraAttrs' EQUALITY caseIgnoreMa
tch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:17 NAME 'olcGentleHUP' EQUALITY booleanMatch SY
NTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.17 NAME 'olcHidden' EQUALITY booleanMatch SYN
TAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:18 NAME 'olcIdleTimeout' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:19 NAME 'olcInclude' SUP labeledURI )
olcAttributeTypes: ( OLcfgGlAt:94 NAME 'olcIndexHash64' EQUALITY booleanMatch
SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:20 NAME 'olcIndexSubstrIfMinLen' EQUALITY integ
erMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:21 NAME 'olcIndexSubstrIfMaxLen' EQUALITY integ
erMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:22 NAME 'olcIndexSubstrAnyLen' EQUALITY integer
Match SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:23 NAME 'olcIndexSubstrAnyStep' EQUALITY intege
rMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:84 NAME 'olcIndexIntLen' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.4 NAME 'olcLastMod' EQUALITY booleanMatch SYN
TAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.22 NAME 'olcLastBind' EQUALITY booleanMatch S
YNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.23 NAME 'olcLastBindPrecision' EQUALITY integ
erMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:85 NAME 'olcLdapSyntaxes' DESC 'OpenLDAP ldapSy
ntax' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDir
ectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgDbAt:0.5 NAME 'olcLimits' EQUALITY caseIgnoreMatch S
YNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:93 NAME 'olcListenerThreads' EQUALITY integerMa
tch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:26 NAME 'olcLocalSSF' EQUALITY integerMatch SYN
TAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:27 NAME 'olcLogFile' EQUALITY caseExactMatch SY
NTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:104 NAME 'olcLogFileFormat' EQUALITY caseIgnore
Match SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:102 NAME 'olcLogFileOnly' EQUALITY booleanMatch
SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:103 NAME 'olcLogFileRotate' EQUALITY caseIgnore
Match SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:28 NAME 'olcLogLevel' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' EQUALITY integerMat
ch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:101 NAME 'olcMaxFilterDepth' EQUALITY integerMa
tch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.16 NAME ( 'olcMultiProvider' 'olcMirrorMode'
) EQUALITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:30 NAME 'olcModuleLoad' EQUALITY caseIgnoreMatc
h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:31 NAME 'olcModulePath' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.18 NAME 'olcMonitoring' EQUALITY booleanMatch
SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:32 NAME 'olcObjectClasses' DESC 'OpenLDAP objec
t classes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX O
MsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:33 NAME 'olcObjectIdentifier' EQUALITY caseIgno
reMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDirectoryString X-ORDERED
'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:34 NAME 'olcOverlay' SUP olcDatabase SINGLE-VAL
UE X-ORDERED 'SIBLINGS' )
olcAttributeTypes: ( OLcfgGlAt:35 NAME 'olcPasswordCryptSaltFormat' EQUALITY c
aseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:36 NAME 'olcPasswordHash' EQUALITY caseIgnoreMa
tch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:37 NAME 'olcPidFile' EQUALITY caseExactMatch SY
NTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:38 NAME 'olcPlugin' EQUALITY caseIgnoreMatch SY
NTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:39 NAME 'olcPluginLogFile' EQUALITY caseExactMa
tch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:40 NAME 'olcReadOnly' EQUALITY booleanMatch SYN
TAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:41 NAME 'olcReferral' SUP labeledURI SINGLE-VAL
UE )
olcAttributeTypes: ( OLcfgDbAt:0.7 NAME 'olcReplica' SUP labeledURI EQUALITY c
aseIgnoreMatch X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:43 NAME 'olcReplicaArgsFile' SYNTAX OMsDirector
yString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:44 NAME 'olcReplicaPidFile' SYNTAX OMsDirectory
String SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:45 NAME 'olcReplicationInterval' SYNTAX OMsInte
ger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:46 NAME 'olcReplogFile' SYNTAX OMsDirectoryStri
ng SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:47 NAME 'olcRequires' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:48 NAME 'olcRestrict' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:49 NAME 'olcReverseLookup' EQUALITY booleanMatc
h SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.8 NAME 'olcRootDN' EQUALITY distinguishedName
Match SYNTAX OMsDN SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:51 NAME 'olcRootDSE' EQUALITY caseIgnoreMatch S
YNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgDbAt:0.9 NAME 'olcRootPW' EQUALITY octetStringMatch
SYNTAX OMsOctetString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:89 NAME 'olcSaslAuxprops' EQUALITY caseIgnoreMa
tch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:91 NAME 'olcSaslAuxpropsDontUseCopy' EQUALITY c
aseIgnoreMatch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:92 NAME 'olcSaslAuxpropsDontUseCopyIgnore' EQUA
LITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:100 NAME 'olcSaslCBinding' EQUALITY caseIgnoreM
atch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:53 NAME 'olcSaslHost' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:54 NAME 'olcSaslRealm' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:56 NAME 'olcSaslSecProps' EQUALITY caseExactMat
ch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:58 NAME 'olcSchemaDN' EQUALITY distinguishedNam
eMatch SYNTAX OMsDN SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:59 NAME 'olcSecurity' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:81 NAME 'olcServerID' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:60 NAME 'olcSizeLimit' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:61 NAME 'olcSockbufMaxIncoming' EQUALITY intege
rMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:62 NAME 'olcSockbufMaxIncomingAuth' EQUALITY in
tegerMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:83 NAME 'olcSortVals' DESC 'Attributes whose va
lues will always be sorted' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryStrin
g )
olcAttributeTypes: ( OLcfgDbAt:0.15 NAME 'olcSubordinate' EQUALITY caseExactMa
tch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.10 NAME 'olcSuffix' EQUALITY distinguishedNam
eMatch SYNTAX OMsDN )
olcAttributeTypes: ( OLcfgDbAt:0.19 NAME 'olcSyncUseSubentry' DESC 'Store sync
context in a subentry' EQUALITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE
)
olcAttributeTypes: ( OLcfgDbAt:0.11 NAME 'olcSyncrepl' EQUALITY caseIgnoreMatc
h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:90 NAME 'olcTCPBuffer' DESC 'Custom TCP buffer
size' EQUALITY caseExactMatch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:66 NAME 'olcThreads' EQUALITY integerMatch SYNT
AX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:95 NAME 'olcThreadQueues' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:67 NAME 'olcTimeLimit' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:97 NAME 'olcTLSCACertificate' DESC 'X.509 certi
ficate, must use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.1
466.115.121.1.8 SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:68 NAME 'olcTLSCACertificateFile' EQUALITY case
ExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:69 NAME 'olcTLSCACertificatePath' EQUALITY case
ExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:98 NAME 'olcTLSCertificate' DESC 'X.509 certifi
cate, must use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.146
6.115.121.1.8 SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:70 NAME 'olcTLSCertificateFile' EQUALITY caseEx
actMatch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:99 NAME 'olcTLSCertificateKey' DESC 'X.509 priv
ateKey, must use ;binary' EQUALITY privateKeyMatch SYNTAX 1.2.840.113549.1.8.
1.1 SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:71 NAME 'olcTLSCertificateKeyFile' EQUALITY cas
eExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:72 NAME 'olcTLSCipherSuite' EQUALITY caseExactM
atch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:73 NAME 'olcTLSCRLCheck' EQUALITY caseExactMatc
h SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:82 NAME 'olcTLSCRLFile' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:74 NAME 'olcTLSRandFile' EQUALITY caseExactMatc
h SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:75 NAME 'olcTLSVerifyClient' EQUALITY caseExact
Match SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' EQUALITY caseExactM
atch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:96 NAME 'olcTLSECName' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:87 NAME 'olcTLSProtocolMin' EQUALITY caseExactM
atch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:80 NAME 'olcToolThreads' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.12 NAME 'olcUpdateDN' EQUALITY distinguishedN
ameMatch SYNTAX OMsDN SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.13 NAME 'olcUpdateRef' SUP labeledURI EQUALIT
Y caseIgnoreMatch )
olcAttributeTypes: ( OLcfgGlAt:88 NAME 'olcWriteTimeout' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.1 NAME 'olcDbDirectory' DESC 'Directory for d
atabase content' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VA
LUE )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.1 NAME 'monitoredInfo' DESC 'mo
nitored info' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA
X 1.3.6.1.4.1.1466.115.121.1.15{32768} NO-USER-MODIFICATION USAGE dSAOperatio
n )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.2 NAME 'managedInfo' DESC 'moni
tor managed info' SUP name )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.3 NAME 'monitorCounter' DESC 'm
onitor counter' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.
3.6.1.4.1.1466.115.121.1.27 NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.4 NAME 'monitorOpCompleted' DES
C 'monitor completed operations' SUP monitorCounter NO-USER-MODIFICATION USAG
E dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.5 NAME 'monitorOpInitiated' DES
C 'monitor initiated operations' SUP monitorCounter NO-USER-MODIFICATION USAG
E dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.6 NAME 'monitorConnectionNumber
' DESC 'monitor connection number' SUP monitorCounter NO-USER-MODIFICATION US
AGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.7 NAME 'monitorConnectionAuthzD
N' DESC 'monitor connection authorization DN' EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation
)
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.8 NAME 'monitorConnectionLocalA
ddress' DESC 'monitor connection local address' SUP monitoredInfo NO-USER-MOD
IFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.9 NAME 'monitorConnectionPeerAd
dress' DESC 'monitor connection peer address' SUP monitoredInfo NO-USER-MODIF
ICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.10 NAME 'monitorTimestamp' DESC
'monitor timestamp' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOr
deringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFIC
ATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.11 NAME 'monitorOverlay' DESC '
name of overlays defined for a given database' SUP monitoredInfo NO-USER-MODI
FICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.12 NAME 'readOnly' DESC 'read/w
rite status of a given database' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.146
6.115.121.1.7 SINGLE-VALUE USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.13 NAME 'restrictedOperation' D
ESC 'name of restricted operation for a given database' SUP managedInfo )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.14 NAME 'monitorConnectionProto
col' DESC 'monitor connection protocol' SUP monitoredInfo NO-USER-MODIFICATIO
N USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.15 NAME 'monitorConnectionOpsRe
ceived' DESC 'monitor number of operations received by the connection' SUP mo
nitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.16 NAME 'monitorConnectionOpsEx
ecuting' DESC 'monitor number of operations in execution within the connectio
n' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.17 NAME 'monitorConnectionOpsPe
nding' DESC 'monitor number of pending operations within the connection' SUP
monitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.18 NAME 'monitorConnectionOpsCo
mpleted' DESC 'monitor number of operations completed within the connection'
SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.19 NAME 'monitorConnectionGet'
DESC 'number of times connection_get() was called so far' SUP monitorCounter
NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.20 NAME 'monitorConnectionRead'
DESC 'number of times connection_read() was called so far' SUP monitorCounte
r NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.21 NAME 'monitorConnectionWrite
' DESC 'number of times connection_write() was called so far' SUP monitorCoun
ter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.22 NAME 'monitorConnectionMask'
DESC 'monitor connection mask' SUP monitoredInfo NO-USER-MODIFICATION USAGE
dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.23 NAME 'monitorConnectionListe
ner' DESC 'monitor connection listener' SUP monitoredInfo NO-USER-MODIFICATIO
N USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.24 NAME 'monitorConnectionPeerD
omain' DESC 'monitor connection peer domain' SUP monitoredInfo NO-USER-MODIFI
CATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.25 NAME 'monitorConnectionStart
Time' DESC 'monitor connection start time' SUP monitorTimestamp SINGLE-VALUE
NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.26 NAME 'monitorConnectionActiv
ityTime' DESC 'monitor connection activity time' SUP monitorTimestamp SINGLE-
VALUE NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.27 NAME 'monitorIsShadow' DESC
'TRUE if the database is shadow' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.146
6.115.121.1.7 SINGLE-VALUE USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.28 NAME 'monitorUpdateRef' DESC
'update referral for shadow databases' SUP monitoredInfo SINGLE-VALUE USAGE
dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.29 NAME 'monitorRuntimeConfig'
DESC 'TRUE if component allows runtime configuration' EQUALITY booleanMatch S
YNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.30 NAME 'monitorSuperiorDN' DES
C 'monitor superior DN' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.14
66.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.31 NAME 'monitorConnectionOpsAs
ync' DESC 'monitor number of asynchronous operations in execution within the
connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.32 NAME 'monitorLogLevel' DESC
'current slapd log level' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.33 NAME 'monitorDebugLevel' DES
C 'current slapd debug level' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst
ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:1 NAME 'olmSRProviderURIList' DESC
'List of provider URIs for this consumer instance' SUP monitoredInfo NO-USER-
MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:2 NAME 'olmSRConnection' DESC 'Loca
l address:port of connection to provider' SUP monitoredInfo SINGLE-VALUE NO-U
SER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:3 NAME 'olmSRSyncPhase' DESC 'Curre
nt syncrepl mode' SUP monitoredInfo SINGLE-VALUE NO-USER-MODIFICATION USAGE d
SAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:4 NAME 'olmSRNextConnect' DESC 'Sch
eduled time of next connection attempt' SUP monitorTimestamp SINGLE-VALUE NO-
USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:5 NAME 'olmSRLastConnect' DESC 'Tim
e last connected to provider' SUP monitorTimestamp SINGLE-VALUE NO-USER-MODIF
ICATION USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:6 NAME 'olmSRLastContact' DESC 'Tim
e last message received from provider' SUP monitorTimestamp SINGLE-VALUE NO-U
SER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:7 NAME 'olmSRLastCookieRcvd' DESC '
Last sync cookie received from provider' SUP monitoredInfo NO-USER-MODIFICATI
ON USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:8 NAME 'olmSRLastCookieSent' DESC '
Last sync cookie sent to provider' SUP monitoredInfo NO-USER-MODIFICATION USA
GE dSAOperation )
olcObjectClasses: ( 2.5.6.0 NAME 'top' DESC 'top of the superclass chain' ABST
RACT MUST objectClass )
olcObjectClasses: ( 1.3.6.1.4.1.1466.101.120.111 NAME 'extensibleObject' DESC
'RFC4512: extensible object' SUP top AUXILIARY )
olcObjectClasses: ( 2.5.6.1 NAME 'alias' DESC 'RFC4512: an alias' SUP top STRU
CTURAL MUST aliasedObjectName )
olcObjectClasses: ( 2.16.840.1.113730.3.2.6 NAME 'referral' DESC 'namedref: na
med subordinate referral' SUP top STRUCTURAL MUST ref )
olcObjectClasses: ( 1.3.6.1.4.1.4203.1.4.1 NAME ( 'OpenLDAProotDSE' 'LDAProotD
SE' ) DESC 'OpenLDAP Root DSE object' SUP top STRUCTURAL MAY cn )
olcObjectClasses: ( 2.5.17.0 NAME 'subentry' DESC 'RFC3672: subentry' SUP top
STRUCTURAL MUST ( cn $ subtreeSpecification ) )
olcObjectClasses: ( 2.5.20.1 NAME 'subschema' DESC 'RFC4512: controlling subsc
hema (sub)entry' AUXILIARY MAY ( dITStructureRules $ nameForms $ dITContentRu
les $ objectClasses $ attributeTypes $ matchingRules $ matchingRuleUse ) )
olcObjectClasses: ( 1.3.6.1.4.1.1466.101.119.2 NAME 'dynamicObject' DESC 'RFC2
589: Dynamic Object' SUP top AUXILIARY )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.4 NAME 'glue' DESC 'Glue Entry' SUP
top STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.5 NAME 'syncConsumerSubentry' DESC
'Persistent Info for SyncRepl Consumer' AUXILIARY MAY syncreplCookie )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.6 NAME 'syncProviderSubentry' DESC
'Persistent Info for SyncRepl Producer' AUXILIARY MAY contextCSN )
olcObjectClasses: ( OLcfgGlOc:0 NAME 'olcConfig' DESC 'OpenLDAP configuration
object' SUP top ABSTRACT )
olcObjectClasses: ( OLcfgGlOc:1 NAME 'olcGlobal' DESC 'OpenLDAP Global configu
ration options' SUP olcConfig STRUCTURAL MAY ( cn $ olcConfigFile $ olcConfig
Dir $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAuthIDRewrite $ olcA
uthzPolicy $ olcAuthzRegexp $ olcConcurrency $ olcConnMaxPending $ olcConnMax
PendingAuth $ olcDisallows $ olcGentleHUP $ olcIdleTimeout $ olcIndexSubstrIf
MaxLen $ olcIndexSubstrIfMinLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnySte
p $ olcIndexHash64 $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcL
ogFile $ olcLogFileFormat $ olcLogLevel $ olcLogFileOnly $ olcLogFileRotate $
olcMaxFilterDepth $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFil
e $ olcPluginLogFile $ olcReadOnly $ olcReferral $ olcReplogFile $ olcRequire
s $ olcRestrict $ olcReverseLookup $ olcRootDSE $ olcSaslAuxprops $ olcSaslAu
xpropsDontUseCopy $ olcSaslAuxpropsDontUseCopyIgnore $ olcSaslCBinding $ olcS
aslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSiz
eLimit $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcTCPBuffer $ o
lcThreads $ olcThreadQueues $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLS
CACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLS
CipherSuite $ olcTLSCRLCheck $ olcTLSCACertificate $ olcTLSCertificate $ olcT
LSCertificateKey $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $
olcTLSECName $ olcTLSCRLFile $ olcTLSProtocolMin $ olcToolThreads $ olcWriteT
imeout $ olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ olcDitC
ontentRules $ olcLdapSyntaxes ) )
olcObjectClasses: ( OLcfgGlOc:2 NAME 'olcSchemaConfig' DESC 'OpenLDAP schema o
bject' SUP olcConfig STRUCTURAL MAY ( cn $ olcObjectIdentifier $ olcLdapSynta
xes $ olcAttributeTypes $ olcObjectClasses $ olcDitContentRules ) )
olcObjectClasses: ( OLcfgGlOc:3 NAME 'olcBackendConfig' DESC 'OpenLDAP Backend
-specific options' SUP olcConfig STRUCTURAL MUST olcBackend )
olcObjectClasses: ( OLcfgGlOc:4 NAME 'olcDatabaseConfig' DESC 'OpenLDAP Databa
se-specific options' SUP olcConfig STRUCTURAL MUST olcDatabase MAY ( olcDisab
led $ olcHidden $ olcSuffix $ olcSubordinate $ olcAccess $ olcAddContentAcl $
olcLastMod $ olcLastBind $ olcLastBindPrecision $ olcLimits $ olcMaxDerefDep
th $ olcPlugin $ olcReadOnly $ olcReplica $ olcReplicaArgsFile $ olcReplicaPi
dFile $ olcReplicationInterval $ olcReplogFile $ olcRequires $ olcRestrict $
olcRootDN $ olcRootPW $ olcSchemaDN $ olcSecurity $ olcSizeLimit $ olcSyncUse
Subentry $ olcSyncrepl $ olcTimeLimit $ olcUpdateDN $ olcUpdateRef $ olcMulti
Provider $ olcMonitoring $ olcExtraAttrs ) )
olcObjectClasses: ( OLcfgGlOc:5 NAME 'olcOverlayConfig' DESC 'OpenLDAP Overlay
-specific options' SUP olcConfig STRUCTURAL MUST olcOverlay MAY olcDisabled )
olcObjectClasses: ( OLcfgGlOc:6 NAME 'olcIncludeFile' DESC 'OpenLDAP configura
tion include file' SUP olcConfig STRUCTURAL MUST olcInclude MAY ( cn $ olcRoo
tDSE ) )
olcObjectClasses: ( OLcfgGlOc:7 NAME 'olcFrontendConfig' DESC 'OpenLDAP fronte
nd configuration' AUXILIARY MAY ( olcDefaultSearchBase $ olcPasswordHash $ ol
cSortVals ) )
olcObjectClasses: ( OLcfgGlOc:8 NAME 'olcModuleList' DESC 'OpenLDAP dynamic mo
dule info' SUP olcConfig STRUCTURAL MAY ( cn $ olcModulePath $ olcModuleLoad
) )
olcObjectClasses: ( OLcfgDbOc:2.1 NAME 'olcLdifConfig' DESC 'LDIF backend conf
iguration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.1 NAME 'monitor' DESC 'OpenLDAP
system monitoring' SUP top STRUCTURAL MUST cn MAY ( description $ seeAlso $ l
abeledURI $ monitoredInfo $ managedInfo $ monitorOverlay ) )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.2 NAME 'monitorServer' DESC 'Ser
ver monitoring root entry' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.3 NAME 'monitorContainer' DESC '
monitor container class' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.4 NAME 'monitorCounterObject' DE
SC 'monitor counter class' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.5 NAME 'monitorOperation' DESC '
monitor operation class' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.6 NAME 'monitorConnection' DESC
'monitor connection class' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.7 NAME 'managedObject' DESC 'mon
itor managed entity class' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.8 NAME 'monitoredObject' DESC 'm
onitor monitored entity class' SUP monitor STRUCTURAL )
olcObjectClasses: ( OLcfgDbOc:4.1 NAME 'olcMonitorConfig' DESC 'Monitor backen
d configuration' SUP olcDatabaseConfig STRUCTURAL )
olcObjectClasses: ( olmSyncReplObjectClasses:1 NAME 'olmSyncReplInstance' SUP
monitoredObject STRUCTURAL MAY ( olmSRProviderURIList $ olmSRConnection $ olm
SRSyncPhase $ olmSRNextConnect $ olmSRLastConnect $ olmSRLastContact $ olmSRL
astCookieRcvd $ olmSRLastCookieSent ) )
structuralObjectClass: olcSchemaConfig
entryUUID: ce4b9e89-3c52-413c-8537-0bdcd8d75e60
creatorsName: cn=config
createTimestamp: 20260830072511Z
entryCSN: 20260830072511.415100Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20260830072511Z
dn: cn={0}custom,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: {0}custom
olcAttributeTypes: {0}( 1.3.6.1.4.1.19937.1.1.0 NAME 'active' DESC 'True if ac
count is active' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SI
NGLE-VALUE )
olcAttributeTypes: {1}( 1.3.6.1.4.1.19937.1.1.1 NAME 'fakeCn' DESC 'True if th
e CN or fullname was created randomly and is still fictitious' EQUALITY boole
anMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
olcAttributeTypes: {2}( 1.3.6.1.4.1.19937.1.1.2 NAME 'devices' DESC 'Trusted d
evices info from user-agent' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466
.115.121.1.15 )
olcAttributeTypes: {3}( 1.3.6.1.4.1.19937.1.1.3 NAME 'lastLogin' DESC 'Last lo
gin timestamp' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
1.24 SINGLE-VALUE )
olcAttributeTypes: {4}( 1.3.6.1.4.1.19937.1.1.4 NAME 'ip' DESC 'ip address' EQ
UALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
olcAttributeTypes: {5}( 1.3.6.1.4.1.19937.1.1.5 NAME 'secureAuth' DESC 'True i
f 2FA active' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGL
E-VALUE )
olcAttributeTypes: {6}( 1.3.6.1.4.1.19937.1.1.6 NAME 'authCode' DESC 'Two fact
or authentication code' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.1
15.121.1.26 SINGLE-VALUE )
olcObjectClasses: {0}( 1.3.6.1.4.1.19937.1.2.0 NAME 'accountsManagement' DESC
'Accounts management' SUP top AUXILIARY MUST ( cn $ uid $ active $ fakeCn ) M
AY ( userPassword $ description $ lastLogin $ ip $ devices $ secureAuth $ aut
hCode ) )
structuralObjectClass: olcSchemaConfig
entryUUID: c18fda0f-b2c6-4662-b277-94eb4ce97bbf
creatorsName: cn=config
createTimestamp: 20260830072511Z
entryCSN: 20260830072511.415100Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20260830072511Z
schema/custom.schema
+55
View File
@@ -0,0 +1,55 @@
##
## Schema for account management extra attributes in LDAP
## by Wproject 2022
## OIDs are owned by Cogent Innovators, LLC
##
## 1.3.6.1.4.1.19937.1.1.x - attributetypes
## 1.3.6.1.4.1.19937.1.2.x - objectclasses
##
attributetype ( 1.3.6.1.4.1.19937.1.1.0 NAME 'active'
DESC 'True if account is active'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
attributetype ( 1.3.6.1.4.1.19937.1.1.1 NAME 'fakeCn'
DESC 'True if the CN or fullname was created randomly and is still fictitious'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
attributetype ( 1.3.6.1.4.1.19937.1.1.2 NAME 'devices'
DESC 'Trusted devices info from user-agent'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributetype ( 1.3.6.1.4.1.19937.1.1.3 NAME 'lastLogin'
DESC 'Last login timestamp'
EQUALITY generalizedTimeMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
SINGLE-VALUE )
attributetype ( 1.3.6.1.4.1.19937.1.1.4 NAME 'ip'
DESC 'ip address'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE )
attributetype ( 1.3.6.1.4.1.19937.1.1.5 NAME 'secureAuth'
DESC 'True if 2FA active'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
attributetype ( 1.3.6.1.4.1.19937.1.1.6 NAME 'authCode'
DESC 'Two factor authentication code'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE )
objectclass ( 1.3.6.1.4.1.19937.1.2.0 NAME 'accountsManagement'
SUP top AUXILIARY
DESC 'Accounts management'
MUST ( cn $ uid $ active $ fakeCn )
MAY ( userPassword $ description $ lastLogin $ ip $ devices $ secureAuth $ authCode ) )
secrets/passwords.txt
+1
View File
@@ -0,0 +1 @@
pasahitz_segurua
slapd.conf
+34
View File
@@ -0,0 +1,34 @@
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/custom.schema
pidfile /run/openldap/slapd.pid
argsfile /run/openldap/slapd.args
modulepath /usr/lib/openldap
moduleload auditlog.so
moduleload back_mdb.so
moduleload pw-pbkdf2.so
database config
rootdn "gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
database mdb
access to attrs=userPassword
by self write
by self read
by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by anonymous auth
by set="[cn=admins,ou=groups,${LDAP_SUFFIX}]/memberUid & user/uid" manage
by * none
access to *
by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by dn.exact="cn=readonly,${LDAP_SUFFIX}" read
by set="[cn=admins,ou=groups,${LDAP_SUFFIX}]/memberUid & user/uid" manage
by self read
by * none
maxsize 1073741824
suffix "${LDAP_SUFFIX}"
rootdn "${LDAP_ROOTDN}"
rootpw ${LDAP_ROOTPW_HASH}
password-hash {PBKDF2-SHA512}
directory ${LDAP_DATA_DIR}