commit fe36c1a45e13a3807e9e22ee35a44e9fe5598d63 Author: Aitzol Berasategi Date: Sat Sep 12 15:55:31 2026 +0200 podman commit diff --git a/.env b/.env new file mode 100644 index 0000000..ad82768 --- /dev/null +++ b/.env @@ -0,0 +1,5 @@ +LDAP_ROOTDN=cn=admin,dc=ldap,dc=lainoa,dc=eus +LDAP_BASE_DN=cn=admin,dc=ldap,dc=lainoa,dc=eus +LDAP_ROOTPW='sagastarri996$L' +LDAP_READONLY_USER_USERNAME='readonly' +LDAP_READONLY_USER_PASSWORD='Q2M7VDeL' diff --git a/Containerfile b/Containerfile new file mode 100644 index 0000000..eb6c7c4 --- /dev/null +++ b/Containerfile @@ -0,0 +1,42 @@ +FROM alpine:3.24 +ARG BUILD_DATE=$(date +%Y-%m-%dT%H:%M:%SZ) + +LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \ + org.opencontainers.image.source=https://github.com/instantlinux/docker-tools \ + org.label-schema.build-date=$BUILD_DATE \ + org.label-schema.license=GPL-3.0 \ + org.label-schema.name=openldap \ + org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools + +ARG OPENLDAP_VERSION=2.6.14-r0 +ENV LDAP_DN_ATTR=uid \ + LDAP_FQDN=example.com \ + LDAP_LOG_LEVEL=Config,Stats \ + LDAP_ORGANIZATION=Example \ + LDAP_OU=ou=users, \ + LDAP_PWD_ATTRIBUTE=userPassword \ + LDAP_PWD_CHECK_QUALITY=2 \ + LDAP_PWD_FAILURE_COUNT_INTERVAL=1200 \ + LDAP_PWD_LOCKOUT_DURATION=1200 \ + LDAP_PWD_MAX_FAILURE=5 \ + LDAP_PWD_MIN_LENGTH=8 \ + LDAP_ROOTDN= \ + LDAP_ROOTPW_HASH= \ + LDAP_ROOTPW_SECRETNAME=openldap-user-passwords \ + LDAP_SUFFIX= \ + LDAP_ULIMIT=2048 \ + LDAP_USERPW_SECRETNAME=kendu + +RUN apk add --update --no-cache gettext gzip openldap=$OPENLDAP_VERSION \ + openldap-clients openldap-back-mdb openldap-passwd-pbkdf2 \ + openldap-overlay-auditlog openldap-overlay-memberof \ + openldap-overlay-ppolicy openldap-overlay-refint +VOLUME /etc/openldap/prepopulate /var/lib/openldap/openldap-data \ + /etc/ssl/openldap +EXPOSE 389 636 +COPY slapd.conf /root/ +COPY schema/custom.* /etc/openldap/schema/ +COPY ldif/ /root/ldif/ +COPY podman-entrypoint.sh /usr/local/bin/entrypoint.sh + +ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] diff --git a/config/ldap.container b/config/ldap.container new file mode 100644 index 0000000..41df75d --- /dev/null +++ b/config/ldap.container @@ -0,0 +1,33 @@ +[Unit] +Description=OPENLDAP Server +After=network-online.target ldap-network.service +Wants=network-online.target + +[Container] +Image=localhost/openldap:2.6.14 + +ContainerName=ldap-server +NetworkAlias=server +Network=ldap.network + +PublishPort=389:389 +PublishPort=636:636 +#- ${PORT_OPENLDAP:-389}:389 +#- ${PORT_OPENLDAP_SSL:-636}:636 + +Volume=%h/podman/ldap-pla/certs:/etc/ssl/openldap:ro +Volume=%h/podman/ldap-pla/data:/var/lib/openldap/openldap-data +Volume=%h/podman/ldap-pla/data/prepopulate:/etc/openldap/prepopulate:ro + +#add ldap server host if needed +#AddHost=ldap.example.com:x.x.x.x + +EnvironmentFile=%h/.config/containers/systemd/ldap.env +Secret=openldap-user-passwords +LogDriver=journald + +[Service] +Restart=always + +[Install] +WantedBy=default.target diff --git a/config/ldap.env b/config/ldap.env new file mode 100644 index 0000000..f5c50dd --- /dev/null +++ b/config/ldap.env @@ -0,0 +1,9 @@ +LDAP_ROOTDN=cn=admin,dc=ldap,dc=example,dc=com +LDAP_BASE_DN=cn=admin,dc=ldap,dc=example,dc=com +LDAP_ROOTPW=root_pwd +LDAP_READONLY_USER=true +LDAP_READONLY_USER_USERNAME=readonly +LDAP_READONLY_USER_PASSWORD=readonly_pwd +LDAP_FQDN=ldap.example.com +LDAP_DN_ATTR=cn +LDAP_ORGANIZATION=organization_name diff --git a/config/ldap.network b/config/ldap.network new file mode 100644 index 0000000..ae30928 --- /dev/null +++ b/config/ldap.network @@ -0,0 +1,2 @@ +[Network] +Driver=bridge diff --git a/config/pla.container b/config/pla.container new file mode 100644 index 0000000..18f8b54 --- /dev/null +++ b/config/pla.container @@ -0,0 +1,33 @@ +[Unit] +Description=PhpLdapAdmin +After=ldap.service +Requires=ldap.service + +[Container] +Image=docker.io/phpldapadmin/phpldapadmin:latest + +ContainerName=pla + +Network=ldap.network + +#PublishPort=8080:8080 +PublishPort=0.0.0.0:8080:8080 + +Environment=LDAP_HOST=ldap-server +Environment=LDAP_BASE_DN="dc=ldap,dc=lainoa,dc=eus" +Environment=LDAP_USERNAME="cn=admin,dc=ldap,dc=lainoa,dc=eus" +#Environment=LDAP_PASSWORD=${LDAP_ROOTPW} +#Environment=LDAP_LOGIN_ATTR=dn +Environment=LDAP_LOGIN_ATTR=uid +Environment=LDAP_LOGIN_OBJECTCLASS=simpleSecurityObject +Environment=LDAP_ALLOW_GUEST=false +Environment=LDAP_ALERT_ROOTDN=true +Environment=SERVER_NAME=:8080 +#EnvironmentFile=%h/.config/containers/systemd/ldap.env +EnvironmentFile=%h/.config/containers/systemd/pla.env + +[Service] +Restart=always + +[Install] +WantedBy=default.target diff --git a/config/pla.env b/config/pla.env new file mode 100644 index 0000000..f06ef04 --- /dev/null +++ b/config/pla.env @@ -0,0 +1 @@ +LDAP_PASSWORD=ldap_admin_pwd diff --git a/data/prepopulate/root.ldif b/data/prepopulate/root.ldif new file mode 100644 index 0000000..d7bca17 --- /dev/null +++ b/data/prepopulate/root.ldif @@ -0,0 +1,15 @@ +dn: uid=root,cn=admins,ou=groups,dc=ldap,dc=lainoa,dc=eus +gidnumber: 500 +memberUid: root +mail: root@lainoa.eus +objectclass: account +objectclass: simpleSecurityObject +objectclass: top +objectclass: extensibleObject +uid: root +userpassword: {MD5}KqFTu3MOzIa+1t9lgOeUpw== + +dn: cn=admins,ou=groups,${LDAP_SUFFIX} +changetype: modify +add: memberUid +memberUid: root diff --git a/data/prepopulate/services.ldif b/data/prepopulate/services.ldif new file mode 100644 index 0000000..6c78b5e --- /dev/null +++ b/data/prepopulate/services.ldif @@ -0,0 +1,55 @@ +dn: ou=services,dc=ldap,dc=lainoa,dc=eus +objectclass: organizationalUnit +objectclass: top +ou: services + +dn: cn=mumble,ou=services,dc=ldap,dc=lainoa,dc=eus +cn: mumble +objectclass: groupOfUniqueNames +objectclass: top +uniquemember: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc= + eus +uniquemember: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e + us +uniquemember: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e + us +uniquemember: cn=Garazi Telleria,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus +uniquemember: cn=Jose Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus +uniquemember: cn=Nekane Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e + us +uniquemember: cn=Nekane Eskisabel,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eu + s + +# Entry 18: cn=nextcloud,ou=services,dc=ldap,dc=lainoa,dc=eus +dn: cn=nextcloud,ou=services,dc=ldap,dc=lainoa,dc=eus +#changetype: add +cn: nextcloud +objectclass: groupOfUniqueNames +objectclass: top +uniquemember: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc= + eus +uniquemember: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e + us +uniquemember: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e + us + +# Entry 19: cn=xmpp,ou=services,dc=ldap,dc=lainoa,dc=eus +dn: cn=xmpp,ou=services,dc=ldap,dc=lainoa,dc=eus +#changetype: add +cn: xmpp +objectclass: groupOfUniqueNames +objectclass: top +uniquemember: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc= + eus +uniquemember: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e + us +uniquemember: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e + us +uniquemember: cn=Garazi Telleria,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus +uniquemember: cn=Jose Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus +uniquemember: cn=Nekane Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e + us +uniquemember: cn=Nekane Eskisabel,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eu + s +uniquemember:: Y249QWxvw7FhIEV0eGV6YWJhbCxjbj11c2VycyxvdT1ncm91cHMsZGM9bGRhc + CxkYz1sYWlub2EsZGM9ZXVz diff --git a/data/prepopulate/users.ldif b/data/prepopulate/users.ldif new file mode 100644 index 0000000..de604b5 --- /dev/null +++ b/data/prepopulate/users.ldif @@ -0,0 +1,156 @@ +dn: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus +active: TRUE +cn: Ainhize Berasategi +devices: PC / Linux / Firefox 128.0 +fakecn: FALSE +gidnumber: 501 +givenname: Ainhize +homedirectory: home/user/ainhize +ip: 192.168.2.110 +lastlogin: 20250621131028Z +mail: aiberasategi@beasaingoikastola.eus +objectclass: top +objectclass: inetOrgPerson +objectclass: posixAccount +objectclass: accountsManagement +secureauth: FALSE +sn: Berasategi +uid: ainhize +uidnumber: 1003 +userPassword: {SSHA}ZkwccsQKfDxCx3+iYBe7WzO7GgfpP3df + +dn: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus +active: TRUE +cn: Aitzol Berasategi +devices: PC / Linux / Firefox 115.0 +devices: PC / Linux / Firefox 128.0 +devices: iPhone / iOS 17.5.1 / Firefox iOS 133.4 +devices: PC / Linux / Firefox 140.0 +fakecn: FALSE +gidnumber: 501 +givenname: Aitzol +homedirectory: /home/users/aitzol +ip: 192.168.2.110 +lastlogin: 20260421214748Z +mail: aitzol@lainoa.eus +objectclass: inetOrgPerson +objectclass: posixAccount +objectclass: top +objectclass: accountsManagement +secureauth: FALSE +sn: Berasategi +uid: aitzol +uidnumber: 1000 +userPassword: {SSHA}ZvElYuNEKlO78Z7sNYvTFe12H7CVqGu1 + +dn:: Y249QWxvw7FhIEV0eGV6YWJhbCxjbj11c2VycyxvdT1ncm91cHMsZGM9bGRhcCxkYz1sYWl + ub2EsZGM9ZXVz +active: TRUE +cn:: QWxvw7FhIEV0eGV6YWJhbA== +fakecn: FALSE +gidnumber: 501 +givenname:: QWxvw7Fh +homedirectory: home/user/alona +mail: etxezabal2@gmail.com +objectclass: top +objectclass: inetOrgPerson +objectclass: posixAccount +objectclass: accountsManagement +secureauth: FALSE +sn: Etxezabal +uid:: YWxvw7Fh +uidnumber: 1002 +userPassword: {SSHA}LJpDFOrqVyNOWlM31RJKjPLRRGr+MYZh + +dn: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus +active: FALSE +cn: Araitz Berasategi +devices: PC / Linux / Firefox 115.0 +fakecn: FALSE +gidnumber: 501 +givenname: Araitz +homedirectory: home/user/araitz +ip: 192.168.2.110 +lastlogin: 20240901123138Z +mail: aberasategi@beasaingoikastola.eus +objectclass: top +objectclass: inetOrgPerson +objectclass: posixAccount +objectclass: accountsManagement +secureauth: FALSE +sn: Berasategi +uid: araitz +uidnumber: 1001 +userPassword: {SSHA}k7P67WSQo/87fso9YeNFSLgWOb1B9KPj + +dn: cn=Garazi Telleria,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus +active: TRUE +cn: Garazi Telleria +fakecn: FALSE +gidnumber: 501 +givenname: Garazi +homedirectory: home/user/garazi +mail: garazi@fakemail.com +objectclass: top +objectclass: inetOrgPerson +objectclass: posixAccount +objectclass: accountsManagement +secureauth: FALSE +sn: Telleria +uid: garazi +uidnumber: 1004 +userPassword: {SSHA}hZd/0nLphR2Mv+Q9usIHqLVzipq4fQ+J + +dn: cn=Jose Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus +active: TRUE +cn: Jose Berasategi +fakecn: FALSE +gidnumber: 501 +givenname: Jose +homedirectory: home/user/aitona +mail: joxeberasategi@gmail.com +objectclass: top +objectclass: inetOrgPerson +objectclass: posixAccount +objectclass: accountsManagement +secureauth: FALSE +sn: Berasategi +uid: aitona +uidnumber: 1007 +userPassword: {SSHA}FYBXKDw95/AzFRSXs2eDE+r5Fq+9SrAk + +dn: cn=Nekane Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus +active: TRUE +cn: Nekane Berasategi +fakecn: FALSE +gidnumber: 501 +givenname: Nekane +homedirectory: home/user/nekane +mail: nekane@fakemail.com +objectclass: top +objectclass: inetOrgPerson +objectclass: posixAccount +objectclass: accountsManagement +secureauth: FALSE +sn: Berasategi +uid: nekane +uidnumber: 1005 +userPassword: {SSHA}fH8F5MAoNyc9QTnn4wDp3w4ZJPttNdBA + +dn: cn=Nekane Eskisabel,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus +active: TRUE +cn: Nekane Eskisabel +fakecn: FALSE +gidnumber: 501 +givenname: Nekane +homedirectory: home/user/amona +mail: ertzillegi54@gmail.com +objectclass: top +objectclass: inetOrgPerson +objectclass: posixAccount +objectclass: accountsManagement +secureauth: FALSE +sn: Eskisabel +uid: amona +uidnumber: 1006 +userPassword: {SSHA}rJcOSS7WyqqxfstkuWJdjn/p00h95xTw \ No newline at end of file diff --git a/ldif/00-base.ldif b/ldif/00-base.ldif new file mode 100644 index 0000000..30cec76 --- /dev/null +++ b/ldif/00-base.ldif @@ -0,0 +1,6 @@ +dn: ${LDAP_SUFFIX} +objectClass: top +objectClass: dcObject +objectClass: organization +dc: ${LDAP_DOMAIN} +o: ${LDAP_ORGANISATION} \ No newline at end of file diff --git a/ldif/00-default-groups.ldif b/ldif/00-default-groups.ldif new file mode 100644 index 0000000..e44cff3 --- /dev/null +++ b/ldif/00-default-groups.ldif @@ -0,0 +1,17 @@ +dn: ou=groups,${LDAP_SUFFIX} +objectclass: organizationalUnit +objectclass: top +ou: groups + +dn: cn=admins,ou=groups,${LDAP_SUFFIX} +cn: admins +gidnumber: 500 +objectclass: posixGroup +objectclass: top +memberUid: admin + +dn: cn=users,ou=groups,${LDAP_SUFFIX} +cn: users +gidnumber: 501 +objectclass: posixGroup +objectclass: top diff --git a/ldif/00-default-user-admin.ldif b/ldif/00-default-user-admin.ldif new file mode 100644 index 0000000..25daad0 --- /dev/null +++ b/ldif/00-default-user-admin.ldif @@ -0,0 +1,10 @@ +dn: uid=admin,cn=admins,ou=groups,${LDAP_SUFFIX} +gidNumber: 500 +memberUid: admin +mail: admin@${LDAP_EMAIL_DOMAIN} +objectClass: account +objectClass: simpleSecurityObject +objectClass: top +objectClass: extensibleObject +uid: admin +userpassword: ${LDAP_ROOTPW} diff --git a/ldif/01-auditlog.ldif b/ldif/01-auditlog.ldif new file mode 100644 index 0000000..92223c5 --- /dev/null +++ b/ldif/01-auditlog.ldif @@ -0,0 +1,6 @@ +dn: olcOverlay=auditlog,olcDatabase={1}mdb,cn=config +changetype: add +objectClass: olcOverlayConfig +objectClass: olcAuditLogConfig +olcOverlay: auditlog +olcAuditlogFile: /var/log/slapd-audit.log diff --git a/ldif/01-memberof.ldif b/ldif/01-memberof.ldif new file mode 100644 index 0000000..8627890 --- /dev/null +++ b/ldif/01-memberof.ldif @@ -0,0 +1,27 @@ +dn: cn=module,cn=config +changetype: add +objectClass: olcModuleList +cn: module +olcModuleLoad: memberof.so +olcModuleLoad: refint.so + +dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config +changetype: add +objectClass: olcOverlayConfig +objectClass: olcMemberOf +olcOverlay: memberof +olcMemberOfDangling: ignore +olcMemberOfRefInt: TRUE +olcMemberOfGroupOC: groupOfNames +olcMemberOfMemberAD: member +olcMemberOfMemberOfAD: memberOf + +dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config +changetype: add +objectClass: olcOverlayConfig +objectClass: olcRefintConfig +olcOverlay: {1}refint +olcRefintAttribute: memberof +olcRefintAttribute: member +olcRefintAttribute: manager +olcRefintAttribute: owner \ No newline at end of file diff --git a/ldif/01-ppolicy.ldif b/ldif/01-ppolicy.ldif new file mode 100644 index 0000000..3b1b844 --- /dev/null +++ b/ldif/01-ppolicy.ldif @@ -0,0 +1,15 @@ +dn: cn=module,cn=config +changetype: add +objectClass: olcModuleList +cn: module +olcModuleLoad: ppolicy.so + +dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config +changetype: add +objectClass: olcOverlayConfig +objectClass: olcPPolicyConfig +olcOverlay: ppolicy +olcPPolicyDefault: ${PPOLICY_DN} +olcPPolicyHashCleartext: FALSE +olcPPolicyForwardUpdates: FALSE +olcPPolicyUseLockout: FALSE diff --git a/ldif/10-passwordDefaultPolicy.ldif b/ldif/10-passwordDefaultPolicy.ldif new file mode 100644 index 0000000..aa7b3b3 --- /dev/null +++ b/ldif/10-passwordDefaultPolicy.ldif @@ -0,0 +1,28 @@ +dn: ou=Policies,${LDAP_SUFFIX} +changetype: add +ou: Policies +objectClass: top +objectClass: organizationalUnit + +dn: cn=passwordDefault,ou=Policies,${LDAP_SUFFIX} +changetype: add +objectClass: pwdPolicy +objectClass: person +objectClass: top +cn: passwordDefault +sn: passwordDefault +pwdAttribute: ${LDAP_PWD_ATTRIBUTE} +pwdCheckQuality: ${LDAP_PWD_CHECK_QUALITY} +pwdMinAge: 0 +pwdMaxAge: 0 +pwdMinLength: ${LDAP_PWD_MIN_LENGTH} +pwdInHistory: 5 +pwdMaxFailure: ${LDAP_PWD_MAX_FAILURE} +pwdFailureCountInterval: ${LDAP_PWD_FAILURE_COUNT_INTERVAL} +pwdLockout: TRUE +pwdLockoutDuration: ${LDAP_PWD_LOCKOUT_DURATION} +pwdAllowUserChange: TRUE +pwdExpireWarning: 0 +pwdGraceAuthNLimit: 0 +pwdMustChange: FALSE +pwdSafeModify: TRUE diff --git a/ldif/20-readonly-user.ldif b/ldif/20-readonly-user.ldif new file mode 100644 index 0000000..9f128f3 --- /dev/null +++ b/ldif/20-readonly-user.ldif @@ -0,0 +1,6 @@ +dn: cn=${LDAP_READONLY_USER_USERNAME},${LDAP_SUFFIX} +cn: ${LDAP_READONLY_USER_USERNAME} +objectClass: simpleSecurityObject +objectClass: organizationalRole +userPassword: ${LDAP_READONLY_USER_PASSWORD_ENCRYPTED} +description: LDAP read only user \ No newline at end of file diff --git a/podman-entrypoint.sh b/podman-entrypoint.sh new file mode 100755 index 0000000..edf4829 --- /dev/null +++ b/podman-entrypoint.sh @@ -0,0 +1,152 @@ +#!/bin/sh -e + +LDAP_CONF_DIR=/etc/openldap/slapd.d +LDAP_DATA_DIR=/var/lib/openldap/openldap-data +LDAP_URLPREFIX=ldap + +export LDAP_IPC_URL=ldapi://%2Frun%2Fopenldap%2Fldapi + +dc_str=$(echo ${LDAP_FQDN} | sed -e s:[.]:,dc=:g) +[ -z "$LDAP_SUFFIX" ] && export LDAP_SUFFIX=dc=$dc_str + +# Set ulimit - See https://github.com/docker/docker/issues/8231 +ulimit -n $LDAP_ULIMIT + +INITIAL_START=0 + +if [ ! -d ${LDAP_CONF_DIR} ]; then + INITIAL_START=1 + + # At first startup, create directories and configurations + [ -z "${LDAP_ROOTDN}" ] && LDAP_ROOTDN=cn=admin,${LDAP_SUFFIX} + + if [ ! -z "$LDAP_ROOTPW" ]; then + LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \ + -h {PBKDF2-SHA512} -s "$LDAP_ROOTPW") + elif [[ -z "$LDAP_ROOTPW_HASH" && -s /run/secrets/$LDAP_ROOTPW_SECRETNAME ]]; then + LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \ + -h {PBKDF2-SHA512} -s "$(cat /run/secrets/$LDAP_ROOTPW_SECRETNAME)") + fi + + if [ -z "$LDAP_ROOTPW_HASH" ]; then + echo "** Secret LDAP_ROOTPW_SECRETNAME unspecified **" + exit 1 + fi + + export LDAP_DATA_DIR + + mkdir -p -m 750 ${LDAP_CONF_DIR} /run/openldap + + if [[ "$(ls -A /etc/ssl/openldap)" ]]; then + CA_CERT=/etc/ssl/openldap/ca_cert.pem + SSL_KEY=/etc/ssl/openldap/tls.key + SSL_CERT=/etc/ssl/openldap/tls.crt + + if [[ -f ${CA_CERT} ]]; then + echo "TLSCACertificateFile ${CA_CERT}" >> /root/slapd.conf + fi + + echo "TLSCertificateFile ${SSL_CERT}" >> /root/slapd.conf + echo "TLSCertificateKeyFile ${SSL_KEY}" >> /root/slapd.conf + echo "TLSCipherSuite HIGH:-SSLv2:-SSLv3" >> /root/slapd.conf + LDAP_URLPREFIX=ldaps + fi + + sed -i -e "s/^#BASE.*/BASE ${LDAP_SUFFIX}/" /etc/openldap/ldap.conf + export LDAP_DOMAIN=$(echo ${LDAP_FQDN} | cut -d . -f 1) + export LDAP_EMAIL_DOMAIN=$(echo "$LDAP_FQDN" | awk -F. '{print $(NF-1)"."$NF}') + + + if [[ -n "$LDAP_READONLY_USER_USERNAME" && -n "$LDAP_READONLY_USER_PASSWORD" ]]; then + echo "encrypting readonly user password.."; + LDAP_READONLY_USER_PASSWORD_ENCRYPTED=$(slappasswd \ + -o module-load=pw-pbkdf2.so \ + -h '{PBKDF2-SHA512}' \ + -s "$LDAP_READONLY_USER_PASSWORD") + + export LDAP_READONLY_USER_PASSWORD_ENCRYPTED + else + mv /root/ldif/20-readonly-user.ldif /root/ldif/20-readonly-user.ldif.unused + fi + + # Database structure + TMP=$(mktemp) + for file in $(find /root/ldif -type f) /root/slapd.conf; do + cat "${file}" | envsubst > $TMP + mv $TMP "${file}" + done + + cp /root/slapd.conf /etc/openldap/slapd.conf + + slaptest -f /etc/openldap/slapd.conf -F ${LDAP_CONF_DIR} -n0 + + # Load LDIF base schemas with slapadd + if [ ! -s ${LDAP_DATA_DIR}/data.mdb ]; then + + for file in $(find /root/ldif -maxdepth 1 -name '00-*.ldif' -type f | sort); do + echo "Loading ${file}" + slapadd -F "${LDAP_CONF_DIR}" -l "${file}" -n1 + done + + if [[ -f /root/ldif/20-readonly-user.ldif ]]; then + echo "Loading readonly LDAP user" + slapadd -F "${LDAP_CONF_DIR}" -l /root/ldif/20-readonly-user.ldif -n1 + fi + + fi +fi + +touch /var/log/slapd-audit.log + +mkdir -p -m 750 /run/openldap + +chown -R ldap:ldap ${LDAP_CONF_DIR} ${LDAP_DATA_DIR} /run/openldap \ + /var/log/slapd-audit.log + +tail -f -n0 /var/log/slapd-audit.log | + sed "s/^${LDAP_PWD_ATTRIBUTE}::.*/${LDAP_PWD_ATTRIBUTE}:: --redacted--/" & + +# Load ldif files to cn=config, password policies and optional data with ldapadd +( + if [[ "${INITIAL_START}" = "1" ]]; then + sleep 10 + + echo 'Loading server additional config' + for file in $(find /root/ldif -maxdepth 1 -name '01-*.ldif' -type f | sort); do + echo "Loading ${file}" + envsubst < "${file}" | \ + ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL} + done + + echo 'Loading password policy' + envsubst < /root/ldif/10-passwordDefaultPolicy.ldif | \ + ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL} + + if [[ -d /etc/openldap/prepopulate ]]; then + + for file in `find /etc/openldap/prepopulate`; do + echo "Loading optional file: ${file}" + envsubst < "${file}" | \ + ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL} + done + fi + fi + + echo 'Setting user passwords' + + PW_FILE=$(find /run/secrets/$LDAP_USERPW_SECRETNAME -type f | head -1) + + if [[ ! -z "${PW_FILE}" && -s "${PW_FILE}" ]]; then + awk -F : -v dnattr=${LDAP_DN_ATTR} \ + -v suffix=,${LDAP_OU}${LDAP_SUFFIX} \ + -v pwdattr=${LDAP_PWD_ATTRIBUTE} \ + '{ print "dn: " dnattr "=" $1 suffix "\n" \ + "changetype: modify\n" \ + "replace: " pwdattr "\n" \ + pwdattr ": " $2 "\n" }' <${PW_FILE} | \ + ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL} + fi +) & + +exec slapd -h "${LDAP_URLPREFIX}:/// ${LDAP_IPC_URL}" \ + -F ${LDAP_CONF_DIR} -u ldap -g ldap -d "${LDAP_LOG_LEVEL}" diff --git a/schema/custom.ldif b/schema/custom.ldif new file mode 100644 index 0000000..55384c6 --- /dev/null +++ b/schema/custom.ldif @@ -0,0 +1,813 @@ +dn: cn=schema,cn=config +objectClass: olcSchemaConfig +cn: schema +olcObjectIdentifier: OLcfg 1.3.6.1.4.1.4203.1.12.2 +olcObjectIdentifier: OLcfgAt OLcfg:3 +olcObjectIdentifier: OLcfgGlAt OLcfgAt:0 +olcObjectIdentifier: OLcfgBkAt OLcfgAt:1 +olcObjectIdentifier: OLcfgDbAt OLcfgAt:2 +olcObjectIdentifier: OLcfgOvAt OLcfgAt:3 +olcObjectIdentifier: OLcfgCtAt OLcfgAt:4 +olcObjectIdentifier: OLcfgOc OLcfg:4 +olcObjectIdentifier: OLcfgGlOc OLcfgOc:0 +olcObjectIdentifier: OLcfgBkOc OLcfgOc:1 +olcObjectIdentifier: OLcfgDbOc OLcfgOc:2 +olcObjectIdentifier: OLcfgOvOc OLcfgOc:3 +olcObjectIdentifier: OLcfgCtOc OLcfgOc:4 +olcObjectIdentifier: OMsyn 1.3.6.1.4.1.1466.115.121.1 +olcObjectIdentifier: OMsBoolean OMsyn:7 +olcObjectIdentifier: OMsDN OMsyn:12 +olcObjectIdentifier: OMsDirectoryString OMsyn:15 +olcObjectIdentifier: OMsIA5String OMsyn:26 +olcObjectIdentifier: OMsInteger OMsyn:27 +olcObjectIdentifier: OMsOID OMsyn:38 +olcObjectIdentifier: OMsOctetString OMsyn:40 +olcObjectIdentifier: olmAttributes 1.3.6.1.4.1.4203.666.1.55 +olcObjectIdentifier: olmSubSystemAttributes olmAttributes:0 +olcObjectIdentifier: olmGenericAttributes olmSubSystemAttributes:0 +olcObjectIdentifier: olmDatabaseAttributes olmSubSystemAttributes:1 +olcObjectIdentifier: olmOverlayAttributes olmSubSystemAttributes:2 +olcObjectIdentifier: olmModuleAttributes olmSubSystemAttributes:3 +olcObjectIdentifier: olmObjectClasses 1.3.6.1.4.1.4203.666.3.16 +olcObjectIdentifier: olmSubSystemObjectClasses olmObjectClasses:0 +olcObjectIdentifier: olmGenericObjectClasses olmSubSystemObjectClasses:0 +olcObjectIdentifier: olmDatabaseObjectClasses olmSubSystemObjectClasses:1 +olcObjectIdentifier: olmOverlayObjectClasses olmSubSystemObjectClasses:2 +olcObjectIdentifier: olmModuleObjectClasses olmSubSystemObjectClasses:3 +olcObjectIdentifier: olmSyncReplAttributes olmOverlayAttributes:1 +olcObjectIdentifier: olmSyncReplObjectClasses olmOverlayObjectClasses:1 +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.1 DESC 'ACI Item' X-BINARY-TRANS + FER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.2 DESC 'Access Point' X-NOT-HUMA + N-READABLE 'TRUE' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.3 DESC 'Attribute Type Descripti + on' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' X-NOT-HUMAN-READA + BLE 'TRUE' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' X-NOT-HUMAN-READ + ABLE 'TRUE' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' X-BINARY-TR + ANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' X-BINA + RY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' X-BIN + ARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.1 DESC 'X.509 AttributeCertifi + cate' X-BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' ) +olcLdapSyntaxes: ( 1.2.36.79672281.1.5.0 DESC 'RDN' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.13 DESC 'Data Quality' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'Directory String' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.16 DESC 'DIT Content Rule Descri + ption' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.17 DESC 'DIT Structure Rule Desc + ription' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.19 DESC 'DSA Quality' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.20 DESC 'DSE Type' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.21 DESC 'Enhanced Guide' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile Telephone Num + ber' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.23 DESC 'Fax' X-NOT-HUMAN-READAB + LE 'TRUE' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.25 DESC 'Guide' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'Integer' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' X-NOT-HUMAN-READA + BLE 'TRUE' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.29 DESC 'Master And Shadow Acces + s Points' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.30 DESC 'Matching Rule Descripti + on' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.31 DESC 'Matching Rule Use Descr + iption' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.32 DESC 'Mail Preference' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.33 DESC 'MHS OR Address' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID' + ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.35 DESC 'Name Form Description' + ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.37 DESC 'Object Class Descriptio + n' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.39 DESC 'Other Mailbox' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.43 DESC 'Presentation Address' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.45 DESC 'SubtreeSpecification' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' X- + BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'Telephone Number' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.51 DESC 'Teletex Terminal Identi + fier' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.54 DESC 'LDAP Syntax Description + ' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.55 DESC 'Modify Rights' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.56 DESC 'LDAP Schema Definition' + ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.57 DESC 'LDAP Schema Description + ' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.58 DESC 'Substring Assertion' ) +olcLdapSyntaxes: ( 1.3.6.1.1.1.0.0 DESC 'RFC2307 NIS Netgroup Triple' ) +olcLdapSyntaxes: ( 1.3.6.1.1.1.0.1 DESC 'RFC2307 Boot Parameter' ) +olcLdapSyntaxes: ( 1.3.6.1.1.15.1 DESC 'Certificate Exact Assertion' ) +olcLdapSyntaxes: ( 1.3.6.1.1.15.2 DESC 'Certificate Assertion' ) +olcLdapSyntaxes: ( 1.3.6.1.1.15.3 DESC 'Certificate Pair Exact Assertion' ) +olcLdapSyntaxes: ( 1.3.6.1.1.15.4 DESC 'Certificate Pair Assertion' ) +olcLdapSyntaxes: ( 1.3.6.1.1.15.5 DESC 'Certificate List Exact Assertion' ) +olcLdapSyntaxes: ( 1.3.6.1.1.15.6 DESC 'Certificate List Assertion' ) +olcLdapSyntaxes: ( 1.3.6.1.1.15.7 DESC 'Algorithm Identifier' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.2 DESC 'AttributeCertificate E + xact Assertion' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.3 DESC 'AttributeCertificate A + ssertion' ) +olcLdapSyntaxes: ( 1.3.6.1.1.16.1 DESC 'UUID' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.1 DESC 'CSN' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.4 DESC 'CSN SID' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' ) +olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.2.7 DESC 'OpenLDAP authz' ) +olcLdapSyntaxes: ( 1.2.840.113549.1.8.1.1 DESC 'PKCS#8 PrivateKeyInfo' ) +olcAttributeTypes: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC4512: object classes + of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121 + .1.38 ) +olcAttributeTypes: ( 2.5.21.9 NAME 'structuralObjectClass' DESC 'RFC4512: stru + ctural object class of entry' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4 + .1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperati + on ) +olcAttributeTypes: ( 2.5.18.1 NAME 'createTimestamp' DESC 'RFC4512: time which + object was created' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOr + deringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFIC + ATION USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.18.2 NAME 'modifyTimestamp' DESC 'RFC4512: time which + object was last modified' EQUALITY generalizedTimeMatch ORDERING generalized + TimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-M + ODIFICATION USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.18.3 NAME 'creatorsName' DESC 'RFC4512: name of creat + or' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SING + LE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.18.4 NAME 'modifiersName' DESC 'RFC4512: name of last + modifier' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. + 12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.18.9 NAME 'hasSubordinates' DESC 'X.501: entry has ch + ildren' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALU + E NO-USER-MODIFICATION USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.18.10 NAME 'subschemaSubentry' DESC 'RFC4512: name of + controlling subschema entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1. + 4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperat + ion ) +olcAttributeTypes: ( 1.3.6.1.1.20 NAME 'entryDN' DESC 'DN of the entry' EQUALI + TY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE N + O-USER-MODIFICATION USAGE directoryOperation ) +olcAttributeTypes: ( 1.3.6.1.1.16.4 NAME 'entryUUID' DESC 'UUID of the entry' + EQUALITY UUIDMatch ORDERING UUIDOrderingMatch SYNTAX 1.3.6.1.1.16.1 SINGLE-VA + LUE NO-USER-MODIFICATION USAGE directoryOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' DESC 'change seq + uence number of the entry content' EQUALITY CSNMatch ORDERING CSNOrderingMatc + h SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICATION US + AGE directoryOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.13 NAME 'namingCSN' DESC 'change s + equence number of the entry naming (RDN)' EQUALITY CSNMatch ORDERING CSNOrder + ingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICA + TION USAGE directoryOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.23 NAME 'syncreplCookie' DESC 'syn + crepl Cookie for shadow copy' EQUALITY octetStringMatch ORDERING octetStringO + rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE NO-USER-MODIFI + CATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.25 NAME 'contextCSN' DESC 'the lar + gest committed CSN of a context' EQUALITY CSNMatch ORDERING CSNOrderingMatch + SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} NO-USER-MODIFICATION USAGE dSAOperatio + n ) +olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer' DESC 'RFC4512 + : alternative servers' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 USAGE dSAOperatio + n ) +olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts' DESC 'RF + C4512: naming contexts' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.14 + 66.115.121.1.12 USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl' DESC + 'RFC4512: supported controls' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAO + peration ) +olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension' DESC + 'RFC4512: supported extended operations' SYNTAX 1.3.6.1.4.1.1466.115.121.1.3 + 8 USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion' D + ESC 'RFC4512: supported LDAP versions' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 U + SAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms + ' DESC 'RFC4512: supported SASL mechanisms' SYNTAX 1.3.6.1.4.1.1466.115.121.1 + .15 USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures' DESC 'RFC + 4512: features supported by the server' EQUALITY objectIdentifierMatch SYNTAX + 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.10 NAME 'monitorContext' DESC 'mon + itor context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121 + .1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.1 NAME 'configContext' DESC 'conf + ig context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 + .12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.1.4 NAME 'vendorName' DESC 'RFC3045: name of impl + ementation vendor' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. + 15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.1.5 NAME 'vendorVersion' DESC 'RFC3045: version o + f implementation' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1 + 5 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 2.5.18.5 NAME 'administrativeRole' DESC 'RFC3672: adminis + trative role' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121. + 1.38 USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.18.6 NAME 'subtreeSpecification' DESC 'RFC3672: subtr + ee specification' SYNTAX 1.3.6.1.4.1.1466.115.121.1.45 SINGLE-VALUE USAGE dir + ectoryOperation ) +olcAttributeTypes: ( 2.5.21.1 NAME 'dITStructureRules' DESC 'RFC4512: DIT stru + cture rules' EQUALITY integerFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115. + 121.1.17 USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.21.2 NAME 'dITContentRules' DESC 'RFC4512: DIT conten + t rules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466 + .115.121.1.16 USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.21.4 NAME 'matchingRules' DESC 'RFC4512: matching rul + es' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115. + 121.1.30 USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.21.5 NAME 'attributeTypes' DESC 'RFC4512: attribute t + ypes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.11 + 5.121.1.3 USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.21.6 NAME 'objectClasses' DESC 'RFC4512: object class + es' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115. + 121.1.37 USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.21.7 NAME 'nameForms' DESC 'RFC4512: name forms ' EQU + ALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.3 + 5 USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.21.8 NAME 'matchingRuleUse' DESC 'RFC4512: matching r + ule uses' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.146 + 6.115.121.1.31 USAGE directoryOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes' DESC 'RFC + 4512: LDAP syntaxes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3. + 6.1.4.1.1466.115.121.1.54 USAGE directoryOperation ) +olcAttributeTypes: ( 2.5.4.1 NAME ( 'aliasedObjectName' 'aliasedEntryName' ) D + ESC 'RFC4512: name of aliased object' EQUALITY distinguishedNameMatch SYNTAX + 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) +olcAttributeTypes: ( 2.16.840.1.113730.3.1.34 NAME 'ref' DESC 'RFC3296: subord + inate referral URL' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 + .15 USAGE distributedOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.1 NAME 'entry' DESC 'OpenLDAP ACL en + try pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USER-MODI + FICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.2 NAME 'children' DESC 'OpenLDAP ACL + children pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USE + R-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.8 NAME ( 'authzTo' 'saslAuthzTo' ) + DESC 'proxy authorization targets' EQUALITY authzMatch SYNTAX 1.3.6.1.4.1.42 + 03.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.9 NAME ( 'authzFrom' 'saslAuthzFro + m' ) DESC 'proxy authorization sources' EQUALITY authzMatch SYNTAX 1.3.6.1.4. + 1.4203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' ) +olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.119.3 NAME 'entryTtl' DESC 'RFC2589: + entry time-to-live' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USE + R-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.119.4 NAME 'dynamicSubtrees' DESC 'R + FC2589: dynamic subtrees' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFI + CATION USAGE dSAOperation ) +olcAttributeTypes: ( 2.5.4.49 NAME 'distinguishedName' DESC 'RFC4519: common s + upertype of DN attributes' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1 + .1466.115.121.1.12 ) +olcAttributeTypes: ( 2.5.4.41 NAME 'name' DESC 'RFC4519: common supertype of n + ame attributes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN + TAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) +olcAttributeTypes: ( 2.5.4.3 NAME ( 'cn' 'commonName' ) DESC 'RFC4519: common + name(s) for which the entity is known by' SUP name ) +olcAttributeTypes: ( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' ) DESC 'R + FC4519: user identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings + Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) +olcAttributeTypes: ( 1.3.6.1.1.1.1.0 NAME 'uidNumber' DESC 'RFC2307: An intege + r uniquely identifying a user in an administrative domain' EQUALITY integerMa + tch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE + -VALUE ) +olcAttributeTypes: ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' DESC 'RFC2307: An intege + r uniquely identifying a group in an administrative domain' EQUALITY integerM + atch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGL + E-VALUE ) +olcAttributeTypes: ( 2.5.4.35 NAME 'userPassword' DESC 'RFC4519/2307: password + of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} + ) +olcAttributeTypes: ( 1.3.6.1.4.1.250.1.57 NAME 'labeledURI' DESC 'RFC2079: Uni + form Resource Identifier with optional label' EQUALITY caseExactMatch SYNTAX + 1.3.6.1.4.1.1466.115.121.1.15 ) +olcAttributeTypes: ( 2.5.4.13 NAME 'description' DESC 'RFC4519: descriptive in + formation' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1 + .3.6.1.4.1.1466.115.121.1.15{1024} ) +olcAttributeTypes: ( 2.5.4.34 NAME 'seeAlso' DESC 'RFC4519: DN of related obje + ct' SUP distinguishedName ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.60 NAME 'pKCS8PrivateKey' DESC 'PK + CS#8 PrivateKeyInfo, use ;binary' EQUALITY privateKeyMatch SYNTAX 1.2.840.113 + 549.1.8.1.1 ) +olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.29 NAME 'pwdLastSuccess' DESC 'Th + e timestamp of the last successful authentication' EQUALITY generalizedTimeMa + tch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.2 + 4 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) +olcAttributeTypes: ( OLcfgGlAt:78 NAME 'olcConfigFile' DESC 'File for slapd co + nfiguration directives' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SIN + GLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:79 NAME 'olcConfigDir' DESC 'Directory for slap + d configuration backend' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SI + NGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:1 NAME 'olcAccess' DESC 'Access Control List' E + QUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgGlAt:86 NAME 'olcAddContentAcl' DESC 'Check ACLs aga + inst content of Add ops' EQUALITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE + ) +olcAttributeTypes: ( OLcfgGlAt:2 NAME 'olcAllows' DESC 'Allowed set of depreca + ted features' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgGlAt:3 NAME 'olcArgsFile' DESC 'File for slapd comma + nd line options' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE-VAL + UE ) +olcAttributeTypes: ( OLcfgGlAt:5 NAME 'olcAttributeOptions' EQUALITY caseIgnor + eMatch SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgGlAt:4 NAME 'olcAttributeTypes' DESC 'OpenLDAP attri + buteTypes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX O + MsDirectoryString X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgGlAt:6 NAME 'olcAuthIDRewrite' EQUALITY caseIgnoreMa + tch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgGlAt:7 NAME 'olcAuthzPolicy' EQUALITY caseIgnoreMatc + h SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:8 NAME 'olcAuthzRegexp' EQUALITY caseIgnoreMatc + h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgGlAt:9 NAME 'olcBackend' DESC 'A type of backend' EQ + UALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE X-ORDERED 'SIBL + INGS' ) +olcAttributeTypes: ( OLcfgGlAt:10 NAME 'olcConcurrency' EQUALITY integerMatch + SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:11 NAME 'olcConnMaxPending' EQUALITY integerMat + ch SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:12 NAME 'olcConnMaxPendingAuth' EQUALITY intege + rMatch SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:13 NAME 'olcDatabase' DESC 'The backend type fo + r a database instance' SUP olcBackend SINGLE-VALUE X-ORDERED 'SIBLINGS' ) +olcAttributeTypes: ( OLcfgGlAt:14 NAME 'olcDefaultSearchBase' EQUALITY disting + uishedNameMatch SYNTAX OMsDN SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.21 NAME 'olcDisabled' EQUALITY booleanMatch S + YNTAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:15 NAME 'olcDisallows' EQUALITY caseIgnoreMatch + SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgGlAt:16 NAME 'olcDitContentRules' DESC 'OpenLDAP DIT + content rules' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN + TAX OMsDirectoryString X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgDbAt:0.20 NAME 'olcExtraAttrs' EQUALITY caseIgnoreMa + tch SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgGlAt:17 NAME 'olcGentleHUP' EQUALITY booleanMatch SY + NTAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.17 NAME 'olcHidden' EQUALITY booleanMatch SYN + TAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:18 NAME 'olcIdleTimeout' EQUALITY integerMatch + SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:19 NAME 'olcInclude' SUP labeledURI ) +olcAttributeTypes: ( OLcfgGlAt:94 NAME 'olcIndexHash64' EQUALITY booleanMatch + SYNTAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:20 NAME 'olcIndexSubstrIfMinLen' EQUALITY integ + erMatch SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:21 NAME 'olcIndexSubstrIfMaxLen' EQUALITY integ + erMatch SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:22 NAME 'olcIndexSubstrAnyLen' EQUALITY integer + Match SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:23 NAME 'olcIndexSubstrAnyStep' EQUALITY intege + rMatch SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:84 NAME 'olcIndexIntLen' EQUALITY integerMatch + SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.4 NAME 'olcLastMod' EQUALITY booleanMatch SYN + TAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.22 NAME 'olcLastBind' EQUALITY booleanMatch S + YNTAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.23 NAME 'olcLastBindPrecision' EQUALITY integ + erMatch SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:85 NAME 'olcLdapSyntaxes' DESC 'OpenLDAP ldapSy + ntax' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDir + ectoryString X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgDbAt:0.5 NAME 'olcLimits' EQUALITY caseIgnoreMatch S + YNTAX OMsDirectoryString X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgGlAt:93 NAME 'olcListenerThreads' EQUALITY integerMa + tch SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:26 NAME 'olcLocalSSF' EQUALITY integerMatch SYN + TAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:27 NAME 'olcLogFile' EQUALITY caseExactMatch SY + NTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:104 NAME 'olcLogFileFormat' EQUALITY caseIgnore + Match SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:102 NAME 'olcLogFileOnly' EQUALITY booleanMatch + SYNTAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:103 NAME 'olcLogFileRotate' EQUALITY caseIgnore + Match SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:28 NAME 'olcLogLevel' EQUALITY caseIgnoreMatch + SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' EQUALITY integerMat + ch SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:101 NAME 'olcMaxFilterDepth' EQUALITY integerMa + tch SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.16 NAME ( 'olcMultiProvider' 'olcMirrorMode' + ) EQUALITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:30 NAME 'olcModuleLoad' EQUALITY caseIgnoreMatc + h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgGlAt:31 NAME 'olcModulePath' EQUALITY caseExactMatch + SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.18 NAME 'olcMonitoring' EQUALITY booleanMatch + SYNTAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:32 NAME 'olcObjectClasses' DESC 'OpenLDAP objec + t classes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX O + MsDirectoryString X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgGlAt:33 NAME 'olcObjectIdentifier' EQUALITY caseIgno + reMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDirectoryString X-ORDERED + 'VALUES' ) +olcAttributeTypes: ( OLcfgGlAt:34 NAME 'olcOverlay' SUP olcDatabase SINGLE-VAL + UE X-ORDERED 'SIBLINGS' ) +olcAttributeTypes: ( OLcfgGlAt:35 NAME 'olcPasswordCryptSaltFormat' EQUALITY c + aseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:36 NAME 'olcPasswordHash' EQUALITY caseIgnoreMa + tch SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgGlAt:37 NAME 'olcPidFile' EQUALITY caseExactMatch SY + NTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:38 NAME 'olcPlugin' EQUALITY caseIgnoreMatch SY + NTAX OMsDirectoryString X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgGlAt:39 NAME 'olcPluginLogFile' EQUALITY caseExactMa + tch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:40 NAME 'olcReadOnly' EQUALITY booleanMatch SYN + TAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:41 NAME 'olcReferral' SUP labeledURI SINGLE-VAL + UE ) +olcAttributeTypes: ( OLcfgDbAt:0.7 NAME 'olcReplica' SUP labeledURI EQUALITY c + aseIgnoreMatch X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgGlAt:43 NAME 'olcReplicaArgsFile' SYNTAX OMsDirector + yString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:44 NAME 'olcReplicaPidFile' SYNTAX OMsDirectory + String SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:45 NAME 'olcReplicationInterval' SYNTAX OMsInte + ger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:46 NAME 'olcReplogFile' SYNTAX OMsDirectoryStri + ng SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:47 NAME 'olcRequires' EQUALITY caseIgnoreMatch + SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgGlAt:48 NAME 'olcRestrict' EQUALITY caseIgnoreMatch + SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgGlAt:49 NAME 'olcReverseLookup' EQUALITY booleanMatc + h SYNTAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.8 NAME 'olcRootDN' EQUALITY distinguishedName + Match SYNTAX OMsDN SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:51 NAME 'olcRootDSE' EQUALITY caseIgnoreMatch S + YNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgDbAt:0.9 NAME 'olcRootPW' EQUALITY octetStringMatch + SYNTAX OMsOctetString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:89 NAME 'olcSaslAuxprops' EQUALITY caseIgnoreMa + tch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:91 NAME 'olcSaslAuxpropsDontUseCopy' EQUALITY c + aseIgnoreMatch SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgGlAt:92 NAME 'olcSaslAuxpropsDontUseCopyIgnore' EQUA + LITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:100 NAME 'olcSaslCBinding' EQUALITY caseIgnoreM + atch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:53 NAME 'olcSaslHost' EQUALITY caseIgnoreMatch + SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:54 NAME 'olcSaslRealm' EQUALITY caseExactMatch + SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:56 NAME 'olcSaslSecProps' EQUALITY caseExactMat + ch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:58 NAME 'olcSchemaDN' EQUALITY distinguishedNam + eMatch SYNTAX OMsDN SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:59 NAME 'olcSecurity' EQUALITY caseIgnoreMatch + SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgGlAt:81 NAME 'olcServerID' EQUALITY caseIgnoreMatch + SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgGlAt:60 NAME 'olcSizeLimit' EQUALITY caseExactMatch + SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:61 NAME 'olcSockbufMaxIncoming' EQUALITY intege + rMatch SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:62 NAME 'olcSockbufMaxIncomingAuth' EQUALITY in + tegerMatch SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:83 NAME 'olcSortVals' DESC 'Attributes whose va + lues will always be sorted' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryStrin + g ) +olcAttributeTypes: ( OLcfgDbAt:0.15 NAME 'olcSubordinate' EQUALITY caseExactMa + tch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.10 NAME 'olcSuffix' EQUALITY distinguishedNam + eMatch SYNTAX OMsDN ) +olcAttributeTypes: ( OLcfgDbAt:0.19 NAME 'olcSyncUseSubentry' DESC 'Store sync + context in a subentry' EQUALITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE + ) +olcAttributeTypes: ( OLcfgDbAt:0.11 NAME 'olcSyncrepl' EQUALITY caseIgnoreMatc + h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) +olcAttributeTypes: ( OLcfgGlAt:90 NAME 'olcTCPBuffer' DESC 'Custom TCP buffer + size' EQUALITY caseExactMatch SYNTAX OMsDirectoryString ) +olcAttributeTypes: ( OLcfgGlAt:66 NAME 'olcThreads' EQUALITY integerMatch SYNT + AX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:95 NAME 'olcThreadQueues' EQUALITY integerMatch + SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:67 NAME 'olcTimeLimit' EQUALITY caseExactMatch + SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:97 NAME 'olcTLSCACertificate' DESC 'X.509 certi + ficate, must use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.1 + 466.115.121.1.8 SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:68 NAME 'olcTLSCACertificateFile' EQUALITY case + ExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:69 NAME 'olcTLSCACertificatePath' EQUALITY case + ExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:98 NAME 'olcTLSCertificate' DESC 'X.509 certifi + cate, must use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.146 + 6.115.121.1.8 SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:70 NAME 'olcTLSCertificateFile' EQUALITY caseEx + actMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:99 NAME 'olcTLSCertificateKey' DESC 'X.509 priv + ateKey, must use ;binary' EQUALITY privateKeyMatch SYNTAX 1.2.840.113549.1.8. + 1.1 SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:71 NAME 'olcTLSCertificateKeyFile' EQUALITY cas + eExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:72 NAME 'olcTLSCipherSuite' EQUALITY caseExactM + atch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:73 NAME 'olcTLSCRLCheck' EQUALITY caseExactMatc + h SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:82 NAME 'olcTLSCRLFile' EQUALITY caseExactMatch + SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:74 NAME 'olcTLSRandFile' EQUALITY caseExactMatc + h SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:75 NAME 'olcTLSVerifyClient' EQUALITY caseExact + Match SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' EQUALITY caseExactM + atch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:96 NAME 'olcTLSECName' EQUALITY caseExactMatch + SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:87 NAME 'olcTLSProtocolMin' EQUALITY caseExactM + atch SYNTAX OMsDirectoryString SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgGlAt:80 NAME 'olcToolThreads' EQUALITY integerMatch + SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.12 NAME 'olcUpdateDN' EQUALITY distinguishedN + ameMatch SYNTAX OMsDN SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.13 NAME 'olcUpdateRef' SUP labeledURI EQUALIT + Y caseIgnoreMatch ) +olcAttributeTypes: ( OLcfgGlAt:88 NAME 'olcWriteTimeout' EQUALITY integerMatch + SYNTAX OMsInteger SINGLE-VALUE ) +olcAttributeTypes: ( OLcfgDbAt:0.1 NAME 'olcDbDirectory' DESC 'Directory for d + atabase content' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VA + LUE ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.1 NAME 'monitoredInfo' DESC 'mo + nitored info' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA + X 1.3.6.1.4.1.1466.115.121.1.15{32768} NO-USER-MODIFICATION USAGE dSAOperatio + n ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.2 NAME 'managedInfo' DESC 'moni + tor managed info' SUP name ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.3 NAME 'monitorCounter' DESC 'm + onitor counter' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1. + 3.6.1.4.1.1466.115.121.1.27 NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.4 NAME 'monitorOpCompleted' DES + C 'monitor completed operations' SUP monitorCounter NO-USER-MODIFICATION USAG + E dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.5 NAME 'monitorOpInitiated' DES + C 'monitor initiated operations' SUP monitorCounter NO-USER-MODIFICATION USAG + E dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.6 NAME 'monitorConnectionNumber + ' DESC 'monitor connection number' SUP monitorCounter NO-USER-MODIFICATION US + AGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.7 NAME 'monitorConnectionAuthzD + N' DESC 'monitor connection authorization DN' EQUALITY distinguishedNameMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation + ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.8 NAME 'monitorConnectionLocalA + ddress' DESC 'monitor connection local address' SUP monitoredInfo NO-USER-MOD + IFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.9 NAME 'monitorConnectionPeerAd + dress' DESC 'monitor connection peer address' SUP monitoredInfo NO-USER-MODIF + ICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.10 NAME 'monitorTimestamp' DESC + 'monitor timestamp' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOr + deringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFIC + ATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.11 NAME 'monitorOverlay' DESC ' + name of overlays defined for a given database' SUP monitoredInfo NO-USER-MODI + FICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.12 NAME 'readOnly' DESC 'read/w + rite status of a given database' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.146 + 6.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.13 NAME 'restrictedOperation' D + ESC 'name of restricted operation for a given database' SUP managedInfo ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.14 NAME 'monitorConnectionProto + col' DESC 'monitor connection protocol' SUP monitoredInfo NO-USER-MODIFICATIO + N USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.15 NAME 'monitorConnectionOpsRe + ceived' DESC 'monitor number of operations received by the connection' SUP mo + nitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.16 NAME 'monitorConnectionOpsEx + ecuting' DESC 'monitor number of operations in execution within the connectio + n' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.17 NAME 'monitorConnectionOpsPe + nding' DESC 'monitor number of pending operations within the connection' SUP + monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.18 NAME 'monitorConnectionOpsCo + mpleted' DESC 'monitor number of operations completed within the connection' + SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.19 NAME 'monitorConnectionGet' + DESC 'number of times connection_get() was called so far' SUP monitorCounter + NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.20 NAME 'monitorConnectionRead' + DESC 'number of times connection_read() was called so far' SUP monitorCounte + r NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.21 NAME 'monitorConnectionWrite + ' DESC 'number of times connection_write() was called so far' SUP monitorCoun + ter NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.22 NAME 'monitorConnectionMask' + DESC 'monitor connection mask' SUP monitoredInfo NO-USER-MODIFICATION USAGE + dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.23 NAME 'monitorConnectionListe + ner' DESC 'monitor connection listener' SUP monitoredInfo NO-USER-MODIFICATIO + N USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.24 NAME 'monitorConnectionPeerD + omain' DESC 'monitor connection peer domain' SUP monitoredInfo NO-USER-MODIFI + CATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.25 NAME 'monitorConnectionStart + Time' DESC 'monitor connection start time' SUP monitorTimestamp SINGLE-VALUE + NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.26 NAME 'monitorConnectionActiv + ityTime' DESC 'monitor connection activity time' SUP monitorTimestamp SINGLE- + VALUE NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.27 NAME 'monitorIsShadow' DESC + 'TRUE if the database is shadow' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.146 + 6.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.28 NAME 'monitorUpdateRef' DESC + 'update referral for shadow databases' SUP monitoredInfo SINGLE-VALUE USAGE + dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.29 NAME 'monitorRuntimeConfig' + DESC 'TRUE if component allows runtime configuration' EQUALITY booleanMatch S + YNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.30 NAME 'monitorSuperiorDN' DES + C 'monitor superior DN' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.14 + 66.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.31 NAME 'monitorConnectionOpsAs + ync' DESC 'monitor number of asynchronous operations in execution within the + connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.32 NAME 'monitorLogLevel' DESC + 'current slapd log level' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring + sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation ) +olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.33 NAME 'monitorDebugLevel' DES + C 'current slapd debug level' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst + ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation ) +olcAttributeTypes: ( olmSyncReplAttributes:1 NAME 'olmSRProviderURIList' DESC + 'List of provider URIs for this consumer instance' SUP monitoredInfo NO-USER- + MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( olmSyncReplAttributes:2 NAME 'olmSRConnection' DESC 'Loca + l address:port of connection to provider' SUP monitoredInfo SINGLE-VALUE NO-U + SER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( olmSyncReplAttributes:3 NAME 'olmSRSyncPhase' DESC 'Curre + nt syncrepl mode' SUP monitoredInfo SINGLE-VALUE NO-USER-MODIFICATION USAGE d + SAOperation ) +olcAttributeTypes: ( olmSyncReplAttributes:4 NAME 'olmSRNextConnect' DESC 'Sch + eduled time of next connection attempt' SUP monitorTimestamp SINGLE-VALUE NO- + USER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( olmSyncReplAttributes:5 NAME 'olmSRLastConnect' DESC 'Tim + e last connected to provider' SUP monitorTimestamp SINGLE-VALUE NO-USER-MODIF + ICATION USAGE dSAOperation ) +olcAttributeTypes: ( olmSyncReplAttributes:6 NAME 'olmSRLastContact' DESC 'Tim + e last message received from provider' SUP monitorTimestamp SINGLE-VALUE NO-U + SER-MODIFICATION USAGE dSAOperation ) +olcAttributeTypes: ( olmSyncReplAttributes:7 NAME 'olmSRLastCookieRcvd' DESC ' + Last sync cookie received from provider' SUP monitoredInfo NO-USER-MODIFICATI + ON USAGE dSAOperation ) +olcAttributeTypes: ( olmSyncReplAttributes:8 NAME 'olmSRLastCookieSent' DESC ' + Last sync cookie sent to provider' SUP monitoredInfo NO-USER-MODIFICATION USA + GE dSAOperation ) +olcObjectClasses: ( 2.5.6.0 NAME 'top' DESC 'top of the superclass chain' ABST + RACT MUST objectClass ) +olcObjectClasses: ( 1.3.6.1.4.1.1466.101.120.111 NAME 'extensibleObject' DESC + 'RFC4512: extensible object' SUP top AUXILIARY ) +olcObjectClasses: ( 2.5.6.1 NAME 'alias' DESC 'RFC4512: an alias' SUP top STRU + CTURAL MUST aliasedObjectName ) +olcObjectClasses: ( 2.16.840.1.113730.3.2.6 NAME 'referral' DESC 'namedref: na + med subordinate referral' SUP top STRUCTURAL MUST ref ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.1.4.1 NAME ( 'OpenLDAProotDSE' 'LDAProotD + SE' ) DESC 'OpenLDAP Root DSE object' SUP top STRUCTURAL MAY cn ) +olcObjectClasses: ( 2.5.17.0 NAME 'subentry' DESC 'RFC3672: subentry' SUP top + STRUCTURAL MUST ( cn $ subtreeSpecification ) ) +olcObjectClasses: ( 2.5.20.1 NAME 'subschema' DESC 'RFC4512: controlling subsc + hema (sub)entry' AUXILIARY MAY ( dITStructureRules $ nameForms $ dITContentRu + les $ objectClasses $ attributeTypes $ matchingRules $ matchingRuleUse ) ) +olcObjectClasses: ( 1.3.6.1.4.1.1466.101.119.2 NAME 'dynamicObject' DESC 'RFC2 + 589: Dynamic Object' SUP top AUXILIARY ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.4 NAME 'glue' DESC 'Glue Entry' SUP + top STRUCTURAL ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.5 NAME 'syncConsumerSubentry' DESC + 'Persistent Info for SyncRepl Consumer' AUXILIARY MAY syncreplCookie ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.6 NAME 'syncProviderSubentry' DESC + 'Persistent Info for SyncRepl Producer' AUXILIARY MAY contextCSN ) +olcObjectClasses: ( OLcfgGlOc:0 NAME 'olcConfig' DESC 'OpenLDAP configuration + object' SUP top ABSTRACT ) +olcObjectClasses: ( OLcfgGlOc:1 NAME 'olcGlobal' DESC 'OpenLDAP Global configu + ration options' SUP olcConfig STRUCTURAL MAY ( cn $ olcConfigFile $ olcConfig + Dir $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAuthIDRewrite $ olcA + uthzPolicy $ olcAuthzRegexp $ olcConcurrency $ olcConnMaxPending $ olcConnMax + PendingAuth $ olcDisallows $ olcGentleHUP $ olcIdleTimeout $ olcIndexSubstrIf + MaxLen $ olcIndexSubstrIfMinLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnySte + p $ olcIndexHash64 $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcL + ogFile $ olcLogFileFormat $ olcLogLevel $ olcLogFileOnly $ olcLogFileRotate $ + olcMaxFilterDepth $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFil + e $ olcPluginLogFile $ olcReadOnly $ olcReferral $ olcReplogFile $ olcRequire + s $ olcRestrict $ olcReverseLookup $ olcRootDSE $ olcSaslAuxprops $ olcSaslAu + xpropsDontUseCopy $ olcSaslAuxpropsDontUseCopyIgnore $ olcSaslCBinding $ olcS + aslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSiz + eLimit $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcTCPBuffer $ o + lcThreads $ olcThreadQueues $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLS + CACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLS + CipherSuite $ olcTLSCRLCheck $ olcTLSCACertificate $ olcTLSCertificate $ olcT + LSCertificateKey $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ + olcTLSECName $ olcTLSCRLFile $ olcTLSProtocolMin $ olcToolThreads $ olcWriteT + imeout $ olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ olcDitC + ontentRules $ olcLdapSyntaxes ) ) +olcObjectClasses: ( OLcfgGlOc:2 NAME 'olcSchemaConfig' DESC 'OpenLDAP schema o + bject' SUP olcConfig STRUCTURAL MAY ( cn $ olcObjectIdentifier $ olcLdapSynta + xes $ olcAttributeTypes $ olcObjectClasses $ olcDitContentRules ) ) +olcObjectClasses: ( OLcfgGlOc:3 NAME 'olcBackendConfig' DESC 'OpenLDAP Backend + -specific options' SUP olcConfig STRUCTURAL MUST olcBackend ) +olcObjectClasses: ( OLcfgGlOc:4 NAME 'olcDatabaseConfig' DESC 'OpenLDAP Databa + se-specific options' SUP olcConfig STRUCTURAL MUST olcDatabase MAY ( olcDisab + led $ olcHidden $ olcSuffix $ olcSubordinate $ olcAccess $ olcAddContentAcl $ + olcLastMod $ olcLastBind $ olcLastBindPrecision $ olcLimits $ olcMaxDerefDep + th $ olcPlugin $ olcReadOnly $ olcReplica $ olcReplicaArgsFile $ olcReplicaPi + dFile $ olcReplicationInterval $ olcReplogFile $ olcRequires $ olcRestrict $ + olcRootDN $ olcRootPW $ olcSchemaDN $ olcSecurity $ olcSizeLimit $ olcSyncUse + Subentry $ olcSyncrepl $ olcTimeLimit $ olcUpdateDN $ olcUpdateRef $ olcMulti + Provider $ olcMonitoring $ olcExtraAttrs ) ) +olcObjectClasses: ( OLcfgGlOc:5 NAME 'olcOverlayConfig' DESC 'OpenLDAP Overlay + -specific options' SUP olcConfig STRUCTURAL MUST olcOverlay MAY olcDisabled ) +olcObjectClasses: ( OLcfgGlOc:6 NAME 'olcIncludeFile' DESC 'OpenLDAP configura + tion include file' SUP olcConfig STRUCTURAL MUST olcInclude MAY ( cn $ olcRoo + tDSE ) ) +olcObjectClasses: ( OLcfgGlOc:7 NAME 'olcFrontendConfig' DESC 'OpenLDAP fronte + nd configuration' AUXILIARY MAY ( olcDefaultSearchBase $ olcPasswordHash $ ol + cSortVals ) ) +olcObjectClasses: ( OLcfgGlOc:8 NAME 'olcModuleList' DESC 'OpenLDAP dynamic mo + dule info' SUP olcConfig STRUCTURAL MAY ( cn $ olcModulePath $ olcModuleLoad + ) ) +olcObjectClasses: ( OLcfgDbOc:2.1 NAME 'olcLdifConfig' DESC 'LDIF backend conf + iguration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.1 NAME 'monitor' DESC 'OpenLDAP + system monitoring' SUP top STRUCTURAL MUST cn MAY ( description $ seeAlso $ l + abeledURI $ monitoredInfo $ managedInfo $ monitorOverlay ) ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.2 NAME 'monitorServer' DESC 'Ser + ver monitoring root entry' SUP monitor STRUCTURAL ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.3 NAME 'monitorContainer' DESC ' + monitor container class' SUP monitor STRUCTURAL ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.4 NAME 'monitorCounterObject' DE + SC 'monitor counter class' SUP monitor STRUCTURAL ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.5 NAME 'monitorOperation' DESC ' + monitor operation class' SUP monitor STRUCTURAL ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.6 NAME 'monitorConnection' DESC + 'monitor connection class' SUP monitor STRUCTURAL ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.7 NAME 'managedObject' DESC 'mon + itor managed entity class' SUP monitor STRUCTURAL ) +olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.8 NAME 'monitoredObject' DESC 'm + onitor monitored entity class' SUP monitor STRUCTURAL ) +olcObjectClasses: ( OLcfgDbOc:4.1 NAME 'olcMonitorConfig' DESC 'Monitor backen + d configuration' SUP olcDatabaseConfig STRUCTURAL ) +olcObjectClasses: ( olmSyncReplObjectClasses:1 NAME 'olmSyncReplInstance' SUP + monitoredObject STRUCTURAL MAY ( olmSRProviderURIList $ olmSRConnection $ olm + SRSyncPhase $ olmSRNextConnect $ olmSRLastConnect $ olmSRLastContact $ olmSRL + astCookieRcvd $ olmSRLastCookieSent ) ) +structuralObjectClass: olcSchemaConfig +entryUUID: ce4b9e89-3c52-413c-8537-0bdcd8d75e60 +creatorsName: cn=config +createTimestamp: 20260830072511Z +entryCSN: 20260830072511.415100Z#000000#000#000000 +modifiersName: cn=config +modifyTimestamp: 20260830072511Z + +dn: cn={0}custom,cn=schema,cn=config +objectClass: olcSchemaConfig +cn: {0}custom +olcAttributeTypes: {0}( 1.3.6.1.4.1.19937.1.1.0 NAME 'active' DESC 'True if ac + count is active' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SI + NGLE-VALUE ) +olcAttributeTypes: {1}( 1.3.6.1.4.1.19937.1.1.1 NAME 'fakeCn' DESC 'True if th + e CN or fullname was created randomly and is still fictitious' EQUALITY boole + anMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) +olcAttributeTypes: {2}( 1.3.6.1.4.1.19937.1.1.2 NAME 'devices' DESC 'Trusted d + evices info from user-agent' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466 + .115.121.1.15 ) +olcAttributeTypes: {3}( 1.3.6.1.4.1.19937.1.1.3 NAME 'lastLogin' DESC 'Last lo + gin timestamp' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121. + 1.24 SINGLE-VALUE ) +olcAttributeTypes: {4}( 1.3.6.1.4.1.19937.1.1.4 NAME 'ip' DESC 'ip address' EQ + UALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) +olcAttributeTypes: {5}( 1.3.6.1.4.1.19937.1.1.5 NAME 'secureAuth' DESC 'True i + f 2FA active' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGL + E-VALUE ) +olcAttributeTypes: {6}( 1.3.6.1.4.1.19937.1.1.6 NAME 'authCode' DESC 'Two fact + or authentication code' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.1 + 15.121.1.26 SINGLE-VALUE ) +olcObjectClasses: {0}( 1.3.6.1.4.1.19937.1.2.0 NAME 'accountsManagement' DESC + 'Accounts management' SUP top AUXILIARY MUST ( cn $ uid $ active $ fakeCn ) M + AY ( userPassword $ description $ lastLogin $ ip $ devices $ secureAuth $ aut + hCode ) ) +structuralObjectClass: olcSchemaConfig +entryUUID: c18fda0f-b2c6-4662-b277-94eb4ce97bbf +creatorsName: cn=config +createTimestamp: 20260830072511Z +entryCSN: 20260830072511.415100Z#000000#000#000000 +modifiersName: cn=config +modifyTimestamp: 20260830072511Z + diff --git a/schema/custom.schema b/schema/custom.schema new file mode 100644 index 0000000..e83ed06 --- /dev/null +++ b/schema/custom.schema @@ -0,0 +1,55 @@ +## +## Schema for account management extra attributes in LDAP +## by Wproject 2022 +## OIDs are owned by Cogent Innovators, LLC +## +## 1.3.6.1.4.1.19937.1.1.x - attributetypes +## 1.3.6.1.4.1.19937.1.2.x - objectclasses +## + +attributetype ( 1.3.6.1.4.1.19937.1.1.0 NAME 'active' + DESC 'True if account is active' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 + SINGLE-VALUE ) + +attributetype ( 1.3.6.1.4.1.19937.1.1.1 NAME 'fakeCn' + DESC 'True if the CN or fullname was created randomly and is still fictitious' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 + SINGLE-VALUE ) + +attributetype ( 1.3.6.1.4.1.19937.1.1.2 NAME 'devices' + DESC 'Trusted devices info from user-agent' + EQUALITY caseIgnoreMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) + +attributetype ( 1.3.6.1.4.1.19937.1.1.3 NAME 'lastLogin' + DESC 'Last login timestamp' + EQUALITY generalizedTimeMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 + SINGLE-VALUE ) + +attributetype ( 1.3.6.1.4.1.19937.1.1.4 NAME 'ip' + DESC 'ip address' + EQUALITY caseIgnoreIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 + SINGLE-VALUE ) + +attributetype ( 1.3.6.1.4.1.19937.1.1.5 NAME 'secureAuth' + DESC 'True if 2FA active' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 + SINGLE-VALUE ) + +attributetype ( 1.3.6.1.4.1.19937.1.1.6 NAME 'authCode' + DESC 'Two factor authentication code' + EQUALITY caseIgnoreIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 + SINGLE-VALUE ) + +objectclass ( 1.3.6.1.4.1.19937.1.2.0 NAME 'accountsManagement' + SUP top AUXILIARY + DESC 'Accounts management' + MUST ( cn $ uid $ active $ fakeCn ) + MAY ( userPassword $ description $ lastLogin $ ip $ devices $ secureAuth $ authCode ) ) \ No newline at end of file diff --git a/secrets/passwords.txt b/secrets/passwords.txt new file mode 100644 index 0000000..273e910 --- /dev/null +++ b/secrets/passwords.txt @@ -0,0 +1 @@ +pasahitz_segurua \ No newline at end of file diff --git a/slapd.conf b/slapd.conf new file mode 100644 index 0000000..39c8475 --- /dev/null +++ b/slapd.conf @@ -0,0 +1,34 @@ +include /etc/openldap/schema/core.schema +include /etc/openldap/schema/cosine.schema +include /etc/openldap/schema/inetorgperson.schema +include /etc/openldap/schema/openldap.schema +include /etc/openldap/schema/nis.schema +include /etc/openldap/schema/custom.schema +pidfile /run/openldap/slapd.pid +argsfile /run/openldap/slapd.args +modulepath /usr/lib/openldap +moduleload auditlog.so +moduleload back_mdb.so +moduleload pw-pbkdf2.so +database config +rootdn "gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" +database mdb +access to attrs=userPassword + by self write + by self read + by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage + by anonymous auth + by set="[cn=admins,ou=groups,${LDAP_SUFFIX}]/memberUid & user/uid" manage + by * none +access to * + by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage + by dn.exact="cn=readonly,${LDAP_SUFFIX}" read + by set="[cn=admins,ou=groups,${LDAP_SUFFIX}]/memberUid & user/uid" manage + by self read + by * none +maxsize 1073741824 +suffix "${LDAP_SUFFIX}" +rootdn "${LDAP_ROOTDN}" +rootpw ${LDAP_ROOTPW_HASH} +password-hash {PBKDF2-SHA512} +directory ${LDAP_DATA_DIR}