aitzol/openldap-pla2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

podman commit

Browse Source
This commit is contained in:
aitzol
2026-09-12 15:55:31 +02:00
commit fe36c1a45e
23 changed files with 1521 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env
+5
View File
@@ -0,0 +1,5 @@
LDAP_ROOTDN=cn=admin,dc=ldap,dc=lainoa,dc=eus
LDAP_BASE_DN=cn=admin,dc=ldap,dc=lainoa,dc=eus
LDAP_ROOTPW='sagastarri996$L'
LDAP_READONLY_USER_USERNAME='readonly'
LDAP_READONLY_USER_PASSWORD='Q2M7VDeL'
Containerfile
+42
View File
@@ -0,0 +1,42 @@
FROM alpine:3.24
ARG BUILD_DATE=$(date +%Y-%m-%dT%H:%M:%SZ)
LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
org.opencontainers.image.source=https://github.com/instantlinux/docker-tools \
org.label-schema.build-date=$BUILD_DATE \
org.label-schema.license=GPL-3.0 \
org.label-schema.name=openldap \
org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
ARG OPENLDAP_VERSION=2.6.14-r0
ENV LDAP_DN_ATTR=uid \
LDAP_FQDN=example.com \
LDAP_LOG_LEVEL=Config,Stats \
LDAP_ORGANIZATION=Example \
LDAP_OU=ou=users, \
LDAP_PWD_ATTRIBUTE=userPassword \
LDAP_PWD_CHECK_QUALITY=2 \
LDAP_PWD_FAILURE_COUNT_INTERVAL=1200 \
LDAP_PWD_LOCKOUT_DURATION=1200 \
LDAP_PWD_MAX_FAILURE=5 \
LDAP_PWD_MIN_LENGTH=8 \
LDAP_ROOTDN= \
LDAP_ROOTPW_HASH= \
LDAP_ROOTPW_SECRETNAME=openldap-user-passwords \
LDAP_SUFFIX= \
LDAP_ULIMIT=2048 \
LDAP_USERPW_SECRETNAME=kendu
RUN apk add --update --no-cache gettext gzip openldap=$OPENLDAP_VERSION \
openldap-clients openldap-back-mdb openldap-passwd-pbkdf2 \
openldap-overlay-auditlog openldap-overlay-memberof \
openldap-overlay-ppolicy openldap-overlay-refint
VOLUME /etc/openldap/prepopulate /var/lib/openldap/openldap-data \
/etc/ssl/openldap
EXPOSE 389 636
COPY slapd.conf /root/
COPY schema/custom.* /etc/openldap/schema/
COPY ldif/ /root/ldif/
COPY podman-entrypoint.sh /usr/local/bin/entrypoint.sh
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
config/ldap.container
+33
View File
@@ -0,0 +1,33 @@
[Unit]
Description=OPENLDAP Server
After=network-online.target ldap-network.service
Wants=network-online.target
[Container]
Image=localhost/openldap:2.6.14
ContainerName=ldap-server
NetworkAlias=server
Network=ldap.network
PublishPort=389:389
PublishPort=636:636
#- ${PORT_OPENLDAP:-389}:389
#- ${PORT_OPENLDAP_SSL:-636}:636
Volume=%h/podman/ldap-pla/certs:/etc/ssl/openldap:ro
Volume=%h/podman/ldap-pla/data:/var/lib/openldap/openldap-data
Volume=%h/podman/ldap-pla/data/prepopulate:/etc/openldap/prepopulate:ro
#add ldap server host if needed
#AddHost=ldap.example.com:x.x.x.x
EnvironmentFile=%h/.config/containers/systemd/ldap.env
Secret=openldap-user-passwords
LogDriver=journald
[Service]
Restart=always
[Install]
WantedBy=default.target
config/ldap.env
+9
View File
@@ -0,0 +1,9 @@
LDAP_ROOTDN=cn=admin,dc=ldap,dc=example,dc=com
LDAP_BASE_DN=cn=admin,dc=ldap,dc=example,dc=com
LDAP_ROOTPW=root_pwd
LDAP_READONLY_USER=true
LDAP_READONLY_USER_USERNAME=readonly
LDAP_READONLY_USER_PASSWORD=readonly_pwd
LDAP_FQDN=ldap.example.com
LDAP_DN_ATTR=cn
LDAP_ORGANIZATION=organization_name
config/ldap.network
+2
View File
@@ -0,0 +1,2 @@
[Network]
Driver=bridge
config/pla.container
+33
View File
@@ -0,0 +1,33 @@
[Unit]
Description=PhpLdapAdmin
After=ldap.service
Requires=ldap.service
[Container]
Image=docker.io/phpldapadmin/phpldapadmin:latest
ContainerName=pla
Network=ldap.network
#PublishPort=8080:8080
PublishPort=0.0.0.0:8080:8080
Environment=LDAP_HOST=ldap-server
Environment=LDAP_BASE_DN="dc=ldap,dc=lainoa,dc=eus"
Environment=LDAP_USERNAME="cn=admin,dc=ldap,dc=lainoa,dc=eus"
#Environment=LDAP_PASSWORD=${LDAP_ROOTPW}
#Environment=LDAP_LOGIN_ATTR=dn
Environment=LDAP_LOGIN_ATTR=uid
Environment=LDAP_LOGIN_OBJECTCLASS=simpleSecurityObject
Environment=LDAP_ALLOW_GUEST=false
Environment=LDAP_ALERT_ROOTDN=true
Environment=SERVER_NAME=:8080
#EnvironmentFile=%h/.config/containers/systemd/ldap.env
EnvironmentFile=%h/.config/containers/systemd/pla.env
[Service]
Restart=always
[Install]
WantedBy=default.target
config/pla.env
+1
View File
@@ -0,0 +1 @@
LDAP_PASSWORD=ldap_admin_pwd
data/prepopulate/root.ldif
+15
View File
@@ -0,0 +1,15 @@
dn: uid=root,cn=admins,ou=groups,dc=ldap,dc=lainoa,dc=eus
gidnumber: 500
memberUid: root
mail: root@lainoa.eus
objectclass: account
objectclass: simpleSecurityObject
objectclass: top
objectclass: extensibleObject
uid: root
userpassword: {MD5}KqFTu3MOzIa+1t9lgOeUpw==
dn: cn=admins,ou=groups,${LDAP_SUFFIX}
changetype: modify
add: memberUid
memberUid: root
data/prepopulate/services.ldif
+55
View File
@@ -0,0 +1,55 @@
dn: ou=services,dc=ldap,dc=lainoa,dc=eus
objectclass: organizationalUnit
objectclass: top
ou: services
dn: cn=mumble,ou=services,dc=ldap,dc=lainoa,dc=eus
cn: mumble
objectclass: groupOfUniqueNames
objectclass: top
uniquemember: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=
eus
uniquemember: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Garazi Telleria,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
uniquemember: cn=Jose Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
uniquemember: cn=Nekane Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Nekane Eskisabel,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eu
s
# Entry 18: cn=nextcloud,ou=services,dc=ldap,dc=lainoa,dc=eus
dn: cn=nextcloud,ou=services,dc=ldap,dc=lainoa,dc=eus
#changetype: add
cn: nextcloud
objectclass: groupOfUniqueNames
objectclass: top
uniquemember: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=
eus
uniquemember: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
# Entry 19: cn=xmpp,ou=services,dc=ldap,dc=lainoa,dc=eus
dn: cn=xmpp,ou=services,dc=ldap,dc=lainoa,dc=eus
#changetype: add
cn: xmpp
objectclass: groupOfUniqueNames
objectclass: top
uniquemember: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=
eus
uniquemember: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Garazi Telleria,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
uniquemember: cn=Jose Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
uniquemember: cn=Nekane Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=e
us
uniquemember: cn=Nekane Eskisabel,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eu
s
uniquemember:: Y249QWxvw7FhIEV0eGV6YWJhbCxjbj11c2VycyxvdT1ncm91cHMsZGM9bGRhc
CxkYz1sYWlub2EsZGM9ZXVz
data/prepopulate/users.ldif
+156
View File
@@ -0,0 +1,156 @@
dn: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Ainhize Berasategi
devices: PC / Linux / Firefox 128.0
fakecn: FALSE
gidnumber: 501
givenname: Ainhize
homedirectory: home/user/ainhize
ip: 192.168.2.110
lastlogin: 20250621131028Z
mail: aiberasategi@beasaingoikastola.eus
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: ainhize
uidnumber: 1003
userPassword: {SSHA}ZkwccsQKfDxCx3+iYBe7WzO7GgfpP3df
dn: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Aitzol Berasategi
devices: PC / Linux / Firefox 115.0
devices: PC / Linux / Firefox 128.0
devices: iPhone / iOS 17.5.1 / Firefox iOS 133.4
devices: PC / Linux / Firefox 140.0
fakecn: FALSE
gidnumber: 501
givenname: Aitzol
homedirectory: /home/users/aitzol
ip: 192.168.2.110
lastlogin: 20260421214748Z
mail: aitzol@lainoa.eus
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: aitzol
uidnumber: 1000
userPassword: {SSHA}ZvElYuNEKlO78Z7sNYvTFe12H7CVqGu1
dn:: Y249QWxvw7FhIEV0eGV6YWJhbCxjbj11c2VycyxvdT1ncm91cHMsZGM9bGRhcCxkYz1sYWl
ub2EsZGM9ZXVz
active: TRUE
cn:: QWxvw7FhIEV0eGV6YWJhbA==
fakecn: FALSE
gidnumber: 501
givenname:: QWxvw7Fh
homedirectory: home/user/alona
mail: etxezabal2@gmail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Etxezabal
uid:: YWxvw7Fh
uidnumber: 1002
userPassword: {SSHA}LJpDFOrqVyNOWlM31RJKjPLRRGr+MYZh
dn: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: FALSE
cn: Araitz Berasategi
devices: PC / Linux / Firefox 115.0
fakecn: FALSE
gidnumber: 501
givenname: Araitz
homedirectory: home/user/araitz
ip: 192.168.2.110
lastlogin: 20240901123138Z
mail: aberasategi@beasaingoikastola.eus
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: araitz
uidnumber: 1001
userPassword: {SSHA}k7P67WSQo/87fso9YeNFSLgWOb1B9KPj
dn: cn=Garazi Telleria,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Garazi Telleria
fakecn: FALSE
gidnumber: 501
givenname: Garazi
homedirectory: home/user/garazi
mail: garazi@fakemail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Telleria
uid: garazi
uidnumber: 1004
userPassword: {SSHA}hZd/0nLphR2Mv+Q9usIHqLVzipq4fQ+J
dn: cn=Jose Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Jose Berasategi
fakecn: FALSE
gidnumber: 501
givenname: Jose
homedirectory: home/user/aitona
mail: joxeberasategi@gmail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: aitona
uidnumber: 1007
userPassword: {SSHA}FYBXKDw95/AzFRSXs2eDE+r5Fq+9SrAk
dn: cn=Nekane Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Nekane Berasategi
fakecn: FALSE
gidnumber: 501
givenname: Nekane
homedirectory: home/user/nekane
mail: nekane@fakemail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Berasategi
uid: nekane
uidnumber: 1005
userPassword: {SSHA}fH8F5MAoNyc9QTnn4wDp3w4ZJPttNdBA
dn: cn=Nekane Eskisabel,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
active: TRUE
cn: Nekane Eskisabel
fakecn: FALSE
gidnumber: 501
givenname: Nekane
homedirectory: home/user/amona
mail: ertzillegi54@gmail.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: accountsManagement
secureauth: FALSE
sn: Eskisabel
uid: amona
uidnumber: 1006
userPassword: {SSHA}rJcOSS7WyqqxfstkuWJdjn/p00h95xTw
ldif/00-base.ldif
+6
View File
@@ -0,0 +1,6 @@
dn: ${LDAP_SUFFIX}
objectClass: top
objectClass: dcObject
objectClass: organization
dc: ${LDAP_DOMAIN}
o: ${LDAP_ORGANISATION}
ldif/00-default-groups.ldif
+17
View File
@@ -0,0 +1,17 @@
dn: ou=groups,${LDAP_SUFFIX}
objectclass: organizationalUnit
objectclass: top
ou: groups
dn: cn=admins,ou=groups,${LDAP_SUFFIX}
cn: admins
gidnumber: 500
objectclass: posixGroup
objectclass: top
memberUid: admin
dn: cn=users,ou=groups,${LDAP_SUFFIX}
cn: users
gidnumber: 501
objectclass: posixGroup
objectclass: top
ldif/00-default-user-admin.ldif
+10
View File
@@ -0,0 +1,10 @@
dn: uid=admin,cn=admins,ou=groups,${LDAP_SUFFIX}
gidNumber: 500
memberUid: admin
mail: admin@${LDAP_EMAIL_DOMAIN}
objectClass: account
objectClass: simpleSecurityObject
objectClass: top
objectClass: extensibleObject
uid: admin
userpassword: ${LDAP_ROOTPW}
ldif/01-auditlog.ldif
+6
View File
@@ -0,0 +1,6 @@
dn: olcOverlay=auditlog,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcAuditLogConfig
olcOverlay: auditlog
olcAuditlogFile: /var/log/slapd-audit.log
ldif/01-memberof.ldif
+27
View File
@@ -0,0 +1,27 @@
dn: cn=module,cn=config
changetype: add
objectClass: olcModuleList
cn: module
olcModuleLoad: memberof.so
olcModuleLoad: refint.so
dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcMemberOf
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf
dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
olcOverlay: {1}refint
olcRefintAttribute: memberof
olcRefintAttribute: member
olcRefintAttribute: manager
olcRefintAttribute: owner
ldif/01-ppolicy.ldif
+15
View File
@@ -0,0 +1,15 @@
dn: cn=module,cn=config
changetype: add
objectClass: olcModuleList
cn: module
olcModuleLoad: ppolicy.so
dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: ppolicy
olcPPolicyDefault: ${PPOLICY_DN}
olcPPolicyHashCleartext: FALSE
olcPPolicyForwardUpdates: FALSE
olcPPolicyUseLockout: FALSE
ldif/10-passwordDefaultPolicy.ldif
+28
View File
@@ -0,0 +1,28 @@
dn: ou=Policies,${LDAP_SUFFIX}
changetype: add
ou: Policies
objectClass: top
objectClass: organizationalUnit
dn: cn=passwordDefault,ou=Policies,${LDAP_SUFFIX}
changetype: add
objectClass: pwdPolicy
objectClass: person
objectClass: top
cn: passwordDefault
sn: passwordDefault
pwdAttribute: ${LDAP_PWD_ATTRIBUTE}
pwdCheckQuality: ${LDAP_PWD_CHECK_QUALITY}
pwdMinAge: 0
pwdMaxAge: 0
pwdMinLength: ${LDAP_PWD_MIN_LENGTH}
pwdInHistory: 5
pwdMaxFailure: ${LDAP_PWD_MAX_FAILURE}
pwdFailureCountInterval: ${LDAP_PWD_FAILURE_COUNT_INTERVAL}
pwdLockout: TRUE
pwdLockoutDuration: ${LDAP_PWD_LOCKOUT_DURATION}
pwdAllowUserChange: TRUE
pwdExpireWarning: 0
pwdGraceAuthNLimit: 0
pwdMustChange: FALSE
pwdSafeModify: TRUE
ldif/20-readonly-user.ldif
+6
View File
@@ -0,0 +1,6 @@
dn: cn=${LDAP_READONLY_USER_USERNAME},${LDAP_SUFFIX}
cn: ${LDAP_READONLY_USER_USERNAME}
objectClass: simpleSecurityObject
objectClass: organizationalRole
userPassword: ${LDAP_READONLY_USER_PASSWORD_ENCRYPTED}
description: LDAP read only user
podman-entrypoint.sh
Executable
+152
View File
@@ -0,0 +1,152 @@
#!/bin/sh -e
LDAP_CONF_DIR=/etc/openldap/slapd.d
LDAP_DATA_DIR=/var/lib/openldap/openldap-data
LDAP_URLPREFIX=ldap
export LDAP_IPC_URL=ldapi://%2Frun%2Fopenldap%2Fldapi
dc_str=$(echo ${LDAP_FQDN} | sed -e s:[.]:,dc=:g)
[ -z "$LDAP_SUFFIX" ] && export LDAP_SUFFIX=dc=$dc_str
# Set ulimit - See https://github.com/docker/docker/issues/8231
ulimit -n $LDAP_ULIMIT
INITIAL_START=0
if [ ! -d ${LDAP_CONF_DIR} ]; then
INITIAL_START=1
# At first startup, create directories and configurations
[ -z "${LDAP_ROOTDN}" ] && LDAP_ROOTDN=cn=admin,${LDAP_SUFFIX}
if [ ! -z "$LDAP_ROOTPW" ]; then
LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \
-h {PBKDF2-SHA512} -s "$LDAP_ROOTPW")
elif [[ -z "$LDAP_ROOTPW_HASH" && -s /run/secrets/$LDAP_ROOTPW_SECRETNAME ]]; then
LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \
-h {PBKDF2-SHA512} -s "$(cat /run/secrets/$LDAP_ROOTPW_SECRETNAME)")
fi
if [ -z "$LDAP_ROOTPW_HASH" ]; then
echo "** Secret LDAP_ROOTPW_SECRETNAME unspecified **"
exit 1
fi
export LDAP_DATA_DIR
mkdir -p -m 750 ${LDAP_CONF_DIR} /run/openldap
if [[ "$(ls -A /etc/ssl/openldap)" ]]; then
CA_CERT=/etc/ssl/openldap/ca_cert.pem
SSL_KEY=/etc/ssl/openldap/tls.key
SSL_CERT=/etc/ssl/openldap/tls.crt
if [[ -f ${CA_CERT} ]]; then
echo "TLSCACertificateFile ${CA_CERT}" >> /root/slapd.conf
fi
echo "TLSCertificateFile ${SSL_CERT}" >> /root/slapd.conf
echo "TLSCertificateKeyFile ${SSL_KEY}" >> /root/slapd.conf
echo "TLSCipherSuite HIGH:-SSLv2:-SSLv3" >> /root/slapd.conf
LDAP_URLPREFIX=ldaps
fi
sed -i -e "s/^#BASE.*/BASE ${LDAP_SUFFIX}/" /etc/openldap/ldap.conf
export LDAP_DOMAIN=$(echo ${LDAP_FQDN} | cut -d . -f 1)
export LDAP_EMAIL_DOMAIN=$(echo "$LDAP_FQDN" | awk -F. '{print $(NF-1)"."$NF}')
if [[ -n "$LDAP_READONLY_USER_USERNAME" && -n "$LDAP_READONLY_USER_PASSWORD" ]]; then
echo "encrypting readonly user password..";
LDAP_READONLY_USER_PASSWORD_ENCRYPTED=$(slappasswd \
-o module-load=pw-pbkdf2.so \
-h '{PBKDF2-SHA512}' \
-s "$LDAP_READONLY_USER_PASSWORD")
export LDAP_READONLY_USER_PASSWORD_ENCRYPTED
else
mv /root/ldif/20-readonly-user.ldif /root/ldif/20-readonly-user.ldif.unused
fi
# Database structure
TMP=$(mktemp)
for file in $(find /root/ldif -type f) /root/slapd.conf; do
cat "${file}" | envsubst > $TMP
mv $TMP "${file}"
done
cp /root/slapd.conf /etc/openldap/slapd.conf
slaptest -f /etc/openldap/slapd.conf -F ${LDAP_CONF_DIR} -n0
# Load LDIF base schemas with slapadd
if [ ! -s ${LDAP_DATA_DIR}/data.mdb ]; then
for file in $(find /root/ldif -maxdepth 1 -name '00-*.ldif' -type f | sort); do
echo "Loading ${file}"
slapadd -F "${LDAP_CONF_DIR}" -l "${file}" -n1
done
if [[ -f /root/ldif/20-readonly-user.ldif ]]; then
echo "Loading readonly LDAP user"
slapadd -F "${LDAP_CONF_DIR}" -l /root/ldif/20-readonly-user.ldif -n1
fi
fi
fi
touch /var/log/slapd-audit.log
mkdir -p -m 750 /run/openldap
chown -R ldap:ldap ${LDAP_CONF_DIR} ${LDAP_DATA_DIR} /run/openldap \
/var/log/slapd-audit.log
tail -f -n0 /var/log/slapd-audit.log |
sed "s/^${LDAP_PWD_ATTRIBUTE}::.*/${LDAP_PWD_ATTRIBUTE}:: --redacted--/" &
# Load ldif files to cn=config, password policies and optional data with ldapadd
(
if [[ "${INITIAL_START}" = "1" ]]; then
sleep 10
echo 'Loading server additional config'
for file in $(find /root/ldif -maxdepth 1 -name '01-*.ldif' -type f | sort); do
echo "Loading ${file}"
envsubst < "${file}" | \
ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL}
done
echo 'Loading password policy'
envsubst < /root/ldif/10-passwordDefaultPolicy.ldif | \
ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL}
if [[ -d /etc/openldap/prepopulate ]]; then
for file in `find /etc/openldap/prepopulate`; do
echo "Loading optional file: ${file}"
envsubst < "${file}" | \
ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL}
done
fi
fi
echo 'Setting user passwords'
PW_FILE=$(find /run/secrets/$LDAP_USERPW_SECRETNAME -type f | head -1)
if [[ ! -z "${PW_FILE}" && -s "${PW_FILE}" ]]; then
awk -F : -v dnattr=${LDAP_DN_ATTR} \
-v suffix=,${LDAP_OU}${LDAP_SUFFIX} \
-v pwdattr=${LDAP_PWD_ATTRIBUTE} \
'{ print "dn: " dnattr "=" $1 suffix "\n" \
"changetype: modify\n" \
"replace: " pwdattr "\n" \
pwdattr ": " $2 "\n" }' <${PW_FILE} | \
ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL}
fi
) &
exec slapd -h "${LDAP_URLPREFIX}:/// ${LDAP_IPC_URL}" \
-F ${LDAP_CONF_DIR} -u ldap -g ldap -d "${LDAP_LOG_LEVEL}"
schema/custom.ldif
+813
View File
@@ -0,0 +1,813 @@
dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
olcObjectIdentifier: OLcfg 1.3.6.1.4.1.4203.1.12.2
olcObjectIdentifier: OLcfgAt OLcfg:3
olcObjectIdentifier: OLcfgGlAt OLcfgAt:0
olcObjectIdentifier: OLcfgBkAt OLcfgAt:1
olcObjectIdentifier: OLcfgDbAt OLcfgAt:2
olcObjectIdentifier: OLcfgOvAt OLcfgAt:3
olcObjectIdentifier: OLcfgCtAt OLcfgAt:4
olcObjectIdentifier: OLcfgOc OLcfg:4
olcObjectIdentifier: OLcfgGlOc OLcfgOc:0
olcObjectIdentifier: OLcfgBkOc OLcfgOc:1
olcObjectIdentifier: OLcfgDbOc OLcfgOc:2
olcObjectIdentifier: OLcfgOvOc OLcfgOc:3
olcObjectIdentifier: OLcfgCtOc OLcfgOc:4
olcObjectIdentifier: OMsyn 1.3.6.1.4.1.1466.115.121.1
olcObjectIdentifier: OMsBoolean OMsyn:7
olcObjectIdentifier: OMsDN OMsyn:12
olcObjectIdentifier: OMsDirectoryString OMsyn:15
olcObjectIdentifier: OMsIA5String OMsyn:26
olcObjectIdentifier: OMsInteger OMsyn:27
olcObjectIdentifier: OMsOID OMsyn:38
olcObjectIdentifier: OMsOctetString OMsyn:40
olcObjectIdentifier: olmAttributes 1.3.6.1.4.1.4203.666.1.55
olcObjectIdentifier: olmSubSystemAttributes olmAttributes:0
olcObjectIdentifier: olmGenericAttributes olmSubSystemAttributes:0
olcObjectIdentifier: olmDatabaseAttributes olmSubSystemAttributes:1
olcObjectIdentifier: olmOverlayAttributes olmSubSystemAttributes:2
olcObjectIdentifier: olmModuleAttributes olmSubSystemAttributes:3
olcObjectIdentifier: olmObjectClasses 1.3.6.1.4.1.4203.666.3.16
olcObjectIdentifier: olmSubSystemObjectClasses olmObjectClasses:0
olcObjectIdentifier: olmGenericObjectClasses olmSubSystemObjectClasses:0
olcObjectIdentifier: olmDatabaseObjectClasses olmSubSystemObjectClasses:1
olcObjectIdentifier: olmOverlayObjectClasses olmSubSystemObjectClasses:2
olcObjectIdentifier: olmModuleObjectClasses olmSubSystemObjectClasses:3
olcObjectIdentifier: olmSyncReplAttributes olmOverlayAttributes:1
olcObjectIdentifier: olmSyncReplObjectClasses olmOverlayObjectClasses:1
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.1 DESC 'ACI Item' X-BINARY-TRANS
FER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.2 DESC 'Access Point' X-NOT-HUMA
N-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.3 DESC 'Attribute Type Descripti
on' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' X-NOT-HUMAN-READA
BLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' X-NOT-HUMAN-READ
ABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' X-BINARY-TR
ANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' X-BINA
RY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' X-BIN
ARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.1 DESC 'X.509 AttributeCertifi
cate' X-BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' )
olcLdapSyntaxes: ( 1.2.36.79672281.1.5.0 DESC 'RDN' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.13 DESC 'Data Quality' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'Directory String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.16 DESC 'DIT Content Rule Descri
ption' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.17 DESC 'DIT Structure Rule Desc
ription' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.19 DESC 'DSA Quality' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.20 DESC 'DSE Type' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.21 DESC 'Enhanced Guide' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile Telephone Num
ber' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.23 DESC 'Fax' X-NOT-HUMAN-READAB
LE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.25 DESC 'Guide' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'Integer' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' X-NOT-HUMAN-READA
BLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.29 DESC 'Master And Shadow Acces
s Points' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.30 DESC 'Matching Rule Descripti
on' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.31 DESC 'Matching Rule Use Descr
iption' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.32 DESC 'Mail Preference' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.33 DESC 'MHS OR Address' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID'
)
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.35 DESC 'Name Form Description'
)
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.37 DESC 'Object Class Descriptio
n' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.39 DESC 'Other Mailbox' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.43 DESC 'Presentation Address' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.45 DESC 'SubtreeSpecification' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' X-
BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'Telephone Number' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.51 DESC 'Teletex Terminal Identi
fier' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.54 DESC 'LDAP Syntax Description
' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.55 DESC 'Modify Rights' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.56 DESC 'LDAP Schema Definition'
)
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.57 DESC 'LDAP Schema Description
' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.58 DESC 'Substring Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.1.0.0 DESC 'RFC2307 NIS Netgroup Triple' )
olcLdapSyntaxes: ( 1.3.6.1.1.1.0.1 DESC 'RFC2307 Boot Parameter' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.1 DESC 'Certificate Exact Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.2 DESC 'Certificate Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.3 DESC 'Certificate Pair Exact Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.4 DESC 'Certificate Pair Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.5 DESC 'Certificate List Exact Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.6 DESC 'Certificate List Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.15.7 DESC 'Algorithm Identifier' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.2 DESC 'AttributeCertificate E
xact Assertion' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.3 DESC 'AttributeCertificate A
ssertion' )
olcLdapSyntaxes: ( 1.3.6.1.1.16.1 DESC 'UUID' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.1 DESC 'CSN' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.4 DESC 'CSN SID' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' )
olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.2.7 DESC 'OpenLDAP authz' )
olcLdapSyntaxes: ( 1.2.840.113549.1.8.1.1 DESC 'PKCS#8 PrivateKeyInfo' )
olcAttributeTypes: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC4512: object classes
of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121
.1.38 )
olcAttributeTypes: ( 2.5.21.9 NAME 'structuralObjectClass' DESC 'RFC4512: stru
ctural object class of entry' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4
.1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperati
on )
olcAttributeTypes: ( 2.5.18.1 NAME 'createTimestamp' DESC 'RFC4512: time which
object was created' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOr
deringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFIC
ATION USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.2 NAME 'modifyTimestamp' DESC 'RFC4512: time which
object was last modified' EQUALITY generalizedTimeMatch ORDERING generalized
TimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-M
ODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.3 NAME 'creatorsName' DESC 'RFC4512: name of creat
or' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SING
LE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.4 NAME 'modifiersName' DESC 'RFC4512: name of last
modifier' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.9 NAME 'hasSubordinates' DESC 'X.501: entry has ch
ildren' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALU
E NO-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.10 NAME 'subschemaSubentry' DESC 'RFC4512: name of
controlling subschema entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.
4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperat
ion )
olcAttributeTypes: ( 1.3.6.1.1.20 NAME 'entryDN' DESC 'DN of the entry' EQUALI
TY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE N
O-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 1.3.6.1.1.16.4 NAME 'entryUUID' DESC 'UUID of the entry'
EQUALITY UUIDMatch ORDERING UUIDOrderingMatch SYNTAX 1.3.6.1.1.16.1 SINGLE-VA
LUE NO-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' DESC 'change seq
uence number of the entry content' EQUALITY CSNMatch ORDERING CSNOrderingMatc
h SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICATION US
AGE directoryOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.13 NAME 'namingCSN' DESC 'change s
equence number of the entry naming (RDN)' EQUALITY CSNMatch ORDERING CSNOrder
ingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICA
TION USAGE directoryOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.23 NAME 'syncreplCookie' DESC 'syn
crepl Cookie for shadow copy' EQUALITY octetStringMatch ORDERING octetStringO
rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE NO-USER-MODIFI
CATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.25 NAME 'contextCSN' DESC 'the lar
gest committed CSN of a context' EQUALITY CSNMatch ORDERING CSNOrderingMatch
SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} NO-USER-MODIFICATION USAGE dSAOperatio
n )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer' DESC 'RFC4512
: alternative servers' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 USAGE dSAOperatio
n )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts' DESC 'RF
C4512: naming contexts' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.14
66.115.121.1.12 USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl' DESC
'RFC4512: supported controls' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAO
peration )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension' DESC
'RFC4512: supported extended operations' SYNTAX 1.3.6.1.4.1.1466.115.121.1.3
8 USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion' D
ESC 'RFC4512: supported LDAP versions' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 U
SAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms
' DESC 'RFC4512: supported SASL mechanisms' SYNTAX 1.3.6.1.4.1.1466.115.121.1
.15 USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures' DESC 'RFC
4512: features supported by the server' EQUALITY objectIdentifierMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.10 NAME 'monitorContext' DESC 'mon
itor context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121
.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.1 NAME 'configContext' DESC 'conf
ig context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.1.4 NAME 'vendorName' DESC 'RFC3045: name of impl
ementation vendor' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.1.5 NAME 'vendorVersion' DESC 'RFC3045: version o
f implementation' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
5 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 2.5.18.5 NAME 'administrativeRole' DESC 'RFC3672: adminis
trative role' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
1.38 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.18.6 NAME 'subtreeSpecification' DESC 'RFC3672: subtr
ee specification' SYNTAX 1.3.6.1.4.1.1466.115.121.1.45 SINGLE-VALUE USAGE dir
ectoryOperation )
olcAttributeTypes: ( 2.5.21.1 NAME 'dITStructureRules' DESC 'RFC4512: DIT stru
cture rules' EQUALITY integerFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.
121.1.17 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.2 NAME 'dITContentRules' DESC 'RFC4512: DIT conten
t rules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466
.115.121.1.16 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.4 NAME 'matchingRules' DESC 'RFC4512: matching rul
es' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.
121.1.30 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.5 NAME 'attributeTypes' DESC 'RFC4512: attribute t
ypes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.11
5.121.1.3 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.6 NAME 'objectClasses' DESC 'RFC4512: object class
es' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.
121.1.37 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.7 NAME 'nameForms' DESC 'RFC4512: name forms ' EQU
ALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.3
5 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.21.8 NAME 'matchingRuleUse' DESC 'RFC4512: matching r
ule uses' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.146
6.115.121.1.31 USAGE directoryOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes' DESC 'RFC
4512: LDAP syntaxes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.
6.1.4.1.1466.115.121.1.54 USAGE directoryOperation )
olcAttributeTypes: ( 2.5.4.1 NAME ( 'aliasedObjectName' 'aliasedEntryName' ) D
ESC 'RFC4512: name of aliased object' EQUALITY distinguishedNameMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
olcAttributeTypes: ( 2.16.840.1.113730.3.1.34 NAME 'ref' DESC 'RFC3296: subord
inate referral URL' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
.15 USAGE distributedOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.1 NAME 'entry' DESC 'OpenLDAP ACL en
try pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USER-MODI
FICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.2 NAME 'children' DESC 'OpenLDAP ACL
children pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USE
R-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.8 NAME ( 'authzTo' 'saslAuthzTo' )
DESC 'proxy authorization targets' EQUALITY authzMatch SYNTAX 1.3.6.1.4.1.42
03.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.9 NAME ( 'authzFrom' 'saslAuthzFro
m' ) DESC 'proxy authorization sources' EQUALITY authzMatch SYNTAX 1.3.6.1.4.
1.4203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.119.3 NAME 'entryTtl' DESC 'RFC2589:
entry time-to-live' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USE
R-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.119.4 NAME 'dynamicSubtrees' DESC 'R
FC2589: dynamic subtrees' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFI
CATION USAGE dSAOperation )
olcAttributeTypes: ( 2.5.4.49 NAME 'distinguishedName' DESC 'RFC4519: common s
upertype of DN attributes' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1
.1466.115.121.1.12 )
olcAttributeTypes: ( 2.5.4.41 NAME 'name' DESC 'RFC4519: common supertype of n
ame attributes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN
TAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )
olcAttributeTypes: ( 2.5.4.3 NAME ( 'cn' 'commonName' ) DESC 'RFC4519: common
name(s) for which the entity is known by' SUP name )
olcAttributeTypes: ( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' ) DESC 'R
FC4519: user identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings
Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
olcAttributeTypes: ( 1.3.6.1.1.1.1.0 NAME 'uidNumber' DESC 'RFC2307: An intege
r uniquely identifying a user in an administrative domain' EQUALITY integerMa
tch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE
-VALUE )
olcAttributeTypes: ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' DESC 'RFC2307: An intege
r uniquely identifying a group in an administrative domain' EQUALITY integerM
atch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGL
E-VALUE )
olcAttributeTypes: ( 2.5.4.35 NAME 'userPassword' DESC 'RFC4519/2307: password
of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128}
)
olcAttributeTypes: ( 1.3.6.1.4.1.250.1.57 NAME 'labeledURI' DESC 'RFC2079: Uni
form Resource Identifier with optional label' EQUALITY caseExactMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( 2.5.4.13 NAME 'description' DESC 'RFC4519: descriptive in
formation' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1
.3.6.1.4.1.1466.115.121.1.15{1024} )
olcAttributeTypes: ( 2.5.4.34 NAME 'seeAlso' DESC 'RFC4519: DN of related obje
ct' SUP distinguishedName )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.60 NAME 'pKCS8PrivateKey' DESC 'PK
CS#8 PrivateKeyInfo, use ;binary' EQUALITY privateKeyMatch SYNTAX 1.2.840.113
549.1.8.1.1 )
olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.29 NAME 'pwdLastSuccess' DESC 'Th
e timestamp of the last successful authentication' EQUALITY generalizedTimeMa
tch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
4 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
olcAttributeTypes: ( OLcfgGlAt:78 NAME 'olcConfigFile' DESC 'File for slapd co
nfiguration directives' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SIN
GLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:79 NAME 'olcConfigDir' DESC 'Directory for slap
d configuration backend' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SI
NGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:1 NAME 'olcAccess' DESC 'Access Control List' E
QUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:86 NAME 'olcAddContentAcl' DESC 'Check ACLs aga
inst content of Add ops' EQUALITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE
)
olcAttributeTypes: ( OLcfgGlAt:2 NAME 'olcAllows' DESC 'Allowed set of depreca
ted features' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:3 NAME 'olcArgsFile' DESC 'File for slapd comma
nd line options' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE-VAL
UE )
olcAttributeTypes: ( OLcfgGlAt:5 NAME 'olcAttributeOptions' EQUALITY caseIgnor
eMatch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:4 NAME 'olcAttributeTypes' DESC 'OpenLDAP attri
buteTypes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX O
MsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:6 NAME 'olcAuthIDRewrite' EQUALITY caseIgnoreMa
tch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:7 NAME 'olcAuthzPolicy' EQUALITY caseIgnoreMatc
h SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:8 NAME 'olcAuthzRegexp' EQUALITY caseIgnoreMatc
h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:9 NAME 'olcBackend' DESC 'A type of backend' EQ
UALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE X-ORDERED 'SIBL
INGS' )
olcAttributeTypes: ( OLcfgGlAt:10 NAME 'olcConcurrency' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:11 NAME 'olcConnMaxPending' EQUALITY integerMat
ch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:12 NAME 'olcConnMaxPendingAuth' EQUALITY intege
rMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:13 NAME 'olcDatabase' DESC 'The backend type fo
r a database instance' SUP olcBackend SINGLE-VALUE X-ORDERED 'SIBLINGS' )
olcAttributeTypes: ( OLcfgGlAt:14 NAME 'olcDefaultSearchBase' EQUALITY disting
uishedNameMatch SYNTAX OMsDN SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.21 NAME 'olcDisabled' EQUALITY booleanMatch S
YNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:15 NAME 'olcDisallows' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:16 NAME 'olcDitContentRules' DESC 'OpenLDAP DIT
content rules' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN
TAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgDbAt:0.20 NAME 'olcExtraAttrs' EQUALITY caseIgnoreMa
tch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:17 NAME 'olcGentleHUP' EQUALITY booleanMatch SY
NTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.17 NAME 'olcHidden' EQUALITY booleanMatch SYN
TAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:18 NAME 'olcIdleTimeout' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:19 NAME 'olcInclude' SUP labeledURI )
olcAttributeTypes: ( OLcfgGlAt:94 NAME 'olcIndexHash64' EQUALITY booleanMatch
SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:20 NAME 'olcIndexSubstrIfMinLen' EQUALITY integ
erMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:21 NAME 'olcIndexSubstrIfMaxLen' EQUALITY integ
erMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:22 NAME 'olcIndexSubstrAnyLen' EQUALITY integer
Match SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:23 NAME 'olcIndexSubstrAnyStep' EQUALITY intege
rMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:84 NAME 'olcIndexIntLen' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.4 NAME 'olcLastMod' EQUALITY booleanMatch SYN
TAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.22 NAME 'olcLastBind' EQUALITY booleanMatch S
YNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.23 NAME 'olcLastBindPrecision' EQUALITY integ
erMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:85 NAME 'olcLdapSyntaxes' DESC 'OpenLDAP ldapSy
ntax' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDir
ectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgDbAt:0.5 NAME 'olcLimits' EQUALITY caseIgnoreMatch S
YNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:93 NAME 'olcListenerThreads' EQUALITY integerMa
tch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:26 NAME 'olcLocalSSF' EQUALITY integerMatch SYN
TAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:27 NAME 'olcLogFile' EQUALITY caseExactMatch SY
NTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:104 NAME 'olcLogFileFormat' EQUALITY caseIgnore
Match SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:102 NAME 'olcLogFileOnly' EQUALITY booleanMatch
SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:103 NAME 'olcLogFileRotate' EQUALITY caseIgnore
Match SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:28 NAME 'olcLogLevel' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' EQUALITY integerMat
ch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:101 NAME 'olcMaxFilterDepth' EQUALITY integerMa
tch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.16 NAME ( 'olcMultiProvider' 'olcMirrorMode'
) EQUALITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:30 NAME 'olcModuleLoad' EQUALITY caseIgnoreMatc
h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:31 NAME 'olcModulePath' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.18 NAME 'olcMonitoring' EQUALITY booleanMatch
SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:32 NAME 'olcObjectClasses' DESC 'OpenLDAP objec
t classes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX O
MsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:33 NAME 'olcObjectIdentifier' EQUALITY caseIgno
reMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDirectoryString X-ORDERED
'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:34 NAME 'olcOverlay' SUP olcDatabase SINGLE-VAL
UE X-ORDERED 'SIBLINGS' )
olcAttributeTypes: ( OLcfgGlAt:35 NAME 'olcPasswordCryptSaltFormat' EQUALITY c
aseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:36 NAME 'olcPasswordHash' EQUALITY caseIgnoreMa
tch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:37 NAME 'olcPidFile' EQUALITY caseExactMatch SY
NTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:38 NAME 'olcPlugin' EQUALITY caseIgnoreMatch SY
NTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:39 NAME 'olcPluginLogFile' EQUALITY caseExactMa
tch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:40 NAME 'olcReadOnly' EQUALITY booleanMatch SYN
TAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:41 NAME 'olcReferral' SUP labeledURI SINGLE-VAL
UE )
olcAttributeTypes: ( OLcfgDbAt:0.7 NAME 'olcReplica' SUP labeledURI EQUALITY c
aseIgnoreMatch X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:43 NAME 'olcReplicaArgsFile' SYNTAX OMsDirector
yString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:44 NAME 'olcReplicaPidFile' SYNTAX OMsDirectory
String SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:45 NAME 'olcReplicationInterval' SYNTAX OMsInte
ger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:46 NAME 'olcReplogFile' SYNTAX OMsDirectoryStri
ng SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:47 NAME 'olcRequires' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:48 NAME 'olcRestrict' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:49 NAME 'olcReverseLookup' EQUALITY booleanMatc
h SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.8 NAME 'olcRootDN' EQUALITY distinguishedName
Match SYNTAX OMsDN SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:51 NAME 'olcRootDSE' EQUALITY caseIgnoreMatch S
YNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgDbAt:0.9 NAME 'olcRootPW' EQUALITY octetStringMatch
SYNTAX OMsOctetString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:89 NAME 'olcSaslAuxprops' EQUALITY caseIgnoreMa
tch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:91 NAME 'olcSaslAuxpropsDontUseCopy' EQUALITY c
aseIgnoreMatch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:92 NAME 'olcSaslAuxpropsDontUseCopyIgnore' EQUA
LITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:100 NAME 'olcSaslCBinding' EQUALITY caseIgnoreM
atch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:53 NAME 'olcSaslHost' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:54 NAME 'olcSaslRealm' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:56 NAME 'olcSaslSecProps' EQUALITY caseExactMat
ch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:58 NAME 'olcSchemaDN' EQUALITY distinguishedNam
eMatch SYNTAX OMsDN SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:59 NAME 'olcSecurity' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:81 NAME 'olcServerID' EQUALITY caseIgnoreMatch
SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:60 NAME 'olcSizeLimit' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:61 NAME 'olcSockbufMaxIncoming' EQUALITY intege
rMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:62 NAME 'olcSockbufMaxIncomingAuth' EQUALITY in
tegerMatch SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:83 NAME 'olcSortVals' DESC 'Attributes whose va
lues will always be sorted' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryStrin
g )
olcAttributeTypes: ( OLcfgDbAt:0.15 NAME 'olcSubordinate' EQUALITY caseExactMa
tch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.10 NAME 'olcSuffix' EQUALITY distinguishedNam
eMatch SYNTAX OMsDN )
olcAttributeTypes: ( OLcfgDbAt:0.19 NAME 'olcSyncUseSubentry' DESC 'Store sync
context in a subentry' EQUALITY booleanMatch SYNTAX OMsBoolean SINGLE-VALUE
)
olcAttributeTypes: ( OLcfgDbAt:0.11 NAME 'olcSyncrepl' EQUALITY caseIgnoreMatc
h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )
olcAttributeTypes: ( OLcfgGlAt:90 NAME 'olcTCPBuffer' DESC 'Custom TCP buffer
size' EQUALITY caseExactMatch SYNTAX OMsDirectoryString )
olcAttributeTypes: ( OLcfgGlAt:66 NAME 'olcThreads' EQUALITY integerMatch SYNT
AX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:95 NAME 'olcThreadQueues' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:67 NAME 'olcTimeLimit' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:97 NAME 'olcTLSCACertificate' DESC 'X.509 certi
ficate, must use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.1
466.115.121.1.8 SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:68 NAME 'olcTLSCACertificateFile' EQUALITY case
ExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:69 NAME 'olcTLSCACertificatePath' EQUALITY case
ExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:98 NAME 'olcTLSCertificate' DESC 'X.509 certifi
cate, must use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.146
6.115.121.1.8 SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:70 NAME 'olcTLSCertificateFile' EQUALITY caseEx
actMatch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:99 NAME 'olcTLSCertificateKey' DESC 'X.509 priv
ateKey, must use ;binary' EQUALITY privateKeyMatch SYNTAX 1.2.840.113549.1.8.
1.1 SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:71 NAME 'olcTLSCertificateKeyFile' EQUALITY cas
eExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:72 NAME 'olcTLSCipherSuite' EQUALITY caseExactM
atch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:73 NAME 'olcTLSCRLCheck' EQUALITY caseExactMatc
h SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:82 NAME 'olcTLSCRLFile' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:74 NAME 'olcTLSRandFile' EQUALITY caseExactMatc
h SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:75 NAME 'olcTLSVerifyClient' EQUALITY caseExact
Match SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' EQUALITY caseExactM
atch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:96 NAME 'olcTLSECName' EQUALITY caseExactMatch
SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:87 NAME 'olcTLSProtocolMin' EQUALITY caseExactM
atch SYNTAX OMsDirectoryString SINGLE-VALUE )
olcAttributeTypes: ( OLcfgGlAt:80 NAME 'olcToolThreads' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.12 NAME 'olcUpdateDN' EQUALITY distinguishedN
ameMatch SYNTAX OMsDN SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.13 NAME 'olcUpdateRef' SUP labeledURI EQUALIT
Y caseIgnoreMatch )
olcAttributeTypes: ( OLcfgGlAt:88 NAME 'olcWriteTimeout' EQUALITY integerMatch
SYNTAX OMsInteger SINGLE-VALUE )
olcAttributeTypes: ( OLcfgDbAt:0.1 NAME 'olcDbDirectory' DESC 'Directory for d
atabase content' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VA
LUE )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.1 NAME 'monitoredInfo' DESC 'mo
nitored info' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA
X 1.3.6.1.4.1.1466.115.121.1.15{32768} NO-USER-MODIFICATION USAGE dSAOperatio
n )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.2 NAME 'managedInfo' DESC 'moni
tor managed info' SUP name )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.3 NAME 'monitorCounter' DESC 'm
onitor counter' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.
3.6.1.4.1.1466.115.121.1.27 NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.4 NAME 'monitorOpCompleted' DES
C 'monitor completed operations' SUP monitorCounter NO-USER-MODIFICATION USAG
E dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.5 NAME 'monitorOpInitiated' DES
C 'monitor initiated operations' SUP monitorCounter NO-USER-MODIFICATION USAG
E dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.6 NAME 'monitorConnectionNumber
' DESC 'monitor connection number' SUP monitorCounter NO-USER-MODIFICATION US
AGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.7 NAME 'monitorConnectionAuthzD
N' DESC 'monitor connection authorization DN' EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation
)
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.8 NAME 'monitorConnectionLocalA
ddress' DESC 'monitor connection local address' SUP monitoredInfo NO-USER-MOD
IFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.9 NAME 'monitorConnectionPeerAd
dress' DESC 'monitor connection peer address' SUP monitoredInfo NO-USER-MODIF
ICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.10 NAME 'monitorTimestamp' DESC
'monitor timestamp' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOr
deringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFIC
ATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.11 NAME 'monitorOverlay' DESC '
name of overlays defined for a given database' SUP monitoredInfo NO-USER-MODI
FICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.12 NAME 'readOnly' DESC 'read/w
rite status of a given database' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.146
6.115.121.1.7 SINGLE-VALUE USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.13 NAME 'restrictedOperation' D
ESC 'name of restricted operation for a given database' SUP managedInfo )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.14 NAME 'monitorConnectionProto
col' DESC 'monitor connection protocol' SUP monitoredInfo NO-USER-MODIFICATIO
N USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.15 NAME 'monitorConnectionOpsRe
ceived' DESC 'monitor number of operations received by the connection' SUP mo
nitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.16 NAME 'monitorConnectionOpsEx
ecuting' DESC 'monitor number of operations in execution within the connectio
n' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.17 NAME 'monitorConnectionOpsPe
nding' DESC 'monitor number of pending operations within the connection' SUP
monitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.18 NAME 'monitorConnectionOpsCo
mpleted' DESC 'monitor number of operations completed within the connection'
SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.19 NAME 'monitorConnectionGet'
DESC 'number of times connection_get() was called so far' SUP monitorCounter
NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.20 NAME 'monitorConnectionRead'
DESC 'number of times connection_read() was called so far' SUP monitorCounte
r NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.21 NAME 'monitorConnectionWrite
' DESC 'number of times connection_write() was called so far' SUP monitorCoun
ter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.22 NAME 'monitorConnectionMask'
DESC 'monitor connection mask' SUP monitoredInfo NO-USER-MODIFICATION USAGE
dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.23 NAME 'monitorConnectionListe
ner' DESC 'monitor connection listener' SUP monitoredInfo NO-USER-MODIFICATIO
N USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.24 NAME 'monitorConnectionPeerD
omain' DESC 'monitor connection peer domain' SUP monitoredInfo NO-USER-MODIFI
CATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.25 NAME 'monitorConnectionStart
Time' DESC 'monitor connection start time' SUP monitorTimestamp SINGLE-VALUE
NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.26 NAME 'monitorConnectionActiv
ityTime' DESC 'monitor connection activity time' SUP monitorTimestamp SINGLE-
VALUE NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.27 NAME 'monitorIsShadow' DESC
'TRUE if the database is shadow' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.146
6.115.121.1.7 SINGLE-VALUE USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.28 NAME 'monitorUpdateRef' DESC
'update referral for shadow databases' SUP monitoredInfo SINGLE-VALUE USAGE
dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.29 NAME 'monitorRuntimeConfig'
DESC 'TRUE if component allows runtime configuration' EQUALITY booleanMatch S
YNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.30 NAME 'monitorSuperiorDN' DES
C 'monitor superior DN' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.14
66.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.31 NAME 'monitorConnectionOpsAs
ync' DESC 'monitor number of asynchronous operations in execution within the
connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.32 NAME 'monitorLogLevel' DESC
'current slapd log level' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation )
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.33 NAME 'monitorDebugLevel' DES
C 'current slapd debug level' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst
ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:1 NAME 'olmSRProviderURIList' DESC
'List of provider URIs for this consumer instance' SUP monitoredInfo NO-USER-
MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:2 NAME 'olmSRConnection' DESC 'Loca
l address:port of connection to provider' SUP monitoredInfo SINGLE-VALUE NO-U
SER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:3 NAME 'olmSRSyncPhase' DESC 'Curre
nt syncrepl mode' SUP monitoredInfo SINGLE-VALUE NO-USER-MODIFICATION USAGE d
SAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:4 NAME 'olmSRNextConnect' DESC 'Sch
eduled time of next connection attempt' SUP monitorTimestamp SINGLE-VALUE NO-
USER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:5 NAME 'olmSRLastConnect' DESC 'Tim
e last connected to provider' SUP monitorTimestamp SINGLE-VALUE NO-USER-MODIF
ICATION USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:6 NAME 'olmSRLastContact' DESC 'Tim
e last message received from provider' SUP monitorTimestamp SINGLE-VALUE NO-U
SER-MODIFICATION USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:7 NAME 'olmSRLastCookieRcvd' DESC '
Last sync cookie received from provider' SUP monitoredInfo NO-USER-MODIFICATI
ON USAGE dSAOperation )
olcAttributeTypes: ( olmSyncReplAttributes:8 NAME 'olmSRLastCookieSent' DESC '
Last sync cookie sent to provider' SUP monitoredInfo NO-USER-MODIFICATION USA
GE dSAOperation )
olcObjectClasses: ( 2.5.6.0 NAME 'top' DESC 'top of the superclass chain' ABST
RACT MUST objectClass )
olcObjectClasses: ( 1.3.6.1.4.1.1466.101.120.111 NAME 'extensibleObject' DESC
'RFC4512: extensible object' SUP top AUXILIARY )
olcObjectClasses: ( 2.5.6.1 NAME 'alias' DESC 'RFC4512: an alias' SUP top STRU
CTURAL MUST aliasedObjectName )
olcObjectClasses: ( 2.16.840.1.113730.3.2.6 NAME 'referral' DESC 'namedref: na
med subordinate referral' SUP top STRUCTURAL MUST ref )
olcObjectClasses: ( 1.3.6.1.4.1.4203.1.4.1 NAME ( 'OpenLDAProotDSE' 'LDAProotD
SE' ) DESC 'OpenLDAP Root DSE object' SUP top STRUCTURAL MAY cn )
olcObjectClasses: ( 2.5.17.0 NAME 'subentry' DESC 'RFC3672: subentry' SUP top
STRUCTURAL MUST ( cn $ subtreeSpecification ) )
olcObjectClasses: ( 2.5.20.1 NAME 'subschema' DESC 'RFC4512: controlling subsc
hema (sub)entry' AUXILIARY MAY ( dITStructureRules $ nameForms $ dITContentRu
les $ objectClasses $ attributeTypes $ matchingRules $ matchingRuleUse ) )
olcObjectClasses: ( 1.3.6.1.4.1.1466.101.119.2 NAME 'dynamicObject' DESC 'RFC2
589: Dynamic Object' SUP top AUXILIARY )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.4 NAME 'glue' DESC 'Glue Entry' SUP
top STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.5 NAME 'syncConsumerSubentry' DESC
'Persistent Info for SyncRepl Consumer' AUXILIARY MAY syncreplCookie )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.6 NAME 'syncProviderSubentry' DESC
'Persistent Info for SyncRepl Producer' AUXILIARY MAY contextCSN )
olcObjectClasses: ( OLcfgGlOc:0 NAME 'olcConfig' DESC 'OpenLDAP configuration
object' SUP top ABSTRACT )
olcObjectClasses: ( OLcfgGlOc:1 NAME 'olcGlobal' DESC 'OpenLDAP Global configu
ration options' SUP olcConfig STRUCTURAL MAY ( cn $ olcConfigFile $ olcConfig
Dir $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAuthIDRewrite $ olcA
uthzPolicy $ olcAuthzRegexp $ olcConcurrency $ olcConnMaxPending $ olcConnMax
PendingAuth $ olcDisallows $ olcGentleHUP $ olcIdleTimeout $ olcIndexSubstrIf
MaxLen $ olcIndexSubstrIfMinLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnySte
p $ olcIndexHash64 $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcL
ogFile $ olcLogFileFormat $ olcLogLevel $ olcLogFileOnly $ olcLogFileRotate $
olcMaxFilterDepth $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFil
e $ olcPluginLogFile $ olcReadOnly $ olcReferral $ olcReplogFile $ olcRequire
s $ olcRestrict $ olcReverseLookup $ olcRootDSE $ olcSaslAuxprops $ olcSaslAu
xpropsDontUseCopy $ olcSaslAuxpropsDontUseCopyIgnore $ olcSaslCBinding $ olcS
aslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSiz
eLimit $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcTCPBuffer $ o
lcThreads $ olcThreadQueues $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLS
CACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLS
CipherSuite $ olcTLSCRLCheck $ olcTLSCACertificate $ olcTLSCertificate $ olcT
LSCertificateKey $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $
olcTLSECName $ olcTLSCRLFile $ olcTLSProtocolMin $ olcToolThreads $ olcWriteT
imeout $ olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ olcDitC
ontentRules $ olcLdapSyntaxes ) )
olcObjectClasses: ( OLcfgGlOc:2 NAME 'olcSchemaConfig' DESC 'OpenLDAP schema o
bject' SUP olcConfig STRUCTURAL MAY ( cn $ olcObjectIdentifier $ olcLdapSynta
xes $ olcAttributeTypes $ olcObjectClasses $ olcDitContentRules ) )
olcObjectClasses: ( OLcfgGlOc:3 NAME 'olcBackendConfig' DESC 'OpenLDAP Backend
-specific options' SUP olcConfig STRUCTURAL MUST olcBackend )
olcObjectClasses: ( OLcfgGlOc:4 NAME 'olcDatabaseConfig' DESC 'OpenLDAP Databa
se-specific options' SUP olcConfig STRUCTURAL MUST olcDatabase MAY ( olcDisab
led $ olcHidden $ olcSuffix $ olcSubordinate $ olcAccess $ olcAddContentAcl $
olcLastMod $ olcLastBind $ olcLastBindPrecision $ olcLimits $ olcMaxDerefDep
th $ olcPlugin $ olcReadOnly $ olcReplica $ olcReplicaArgsFile $ olcReplicaPi
dFile $ olcReplicationInterval $ olcReplogFile $ olcRequires $ olcRestrict $
olcRootDN $ olcRootPW $ olcSchemaDN $ olcSecurity $ olcSizeLimit $ olcSyncUse
Subentry $ olcSyncrepl $ olcTimeLimit $ olcUpdateDN $ olcUpdateRef $ olcMulti
Provider $ olcMonitoring $ olcExtraAttrs ) )
olcObjectClasses: ( OLcfgGlOc:5 NAME 'olcOverlayConfig' DESC 'OpenLDAP Overlay
-specific options' SUP olcConfig STRUCTURAL MUST olcOverlay MAY olcDisabled )
olcObjectClasses: ( OLcfgGlOc:6 NAME 'olcIncludeFile' DESC 'OpenLDAP configura
tion include file' SUP olcConfig STRUCTURAL MUST olcInclude MAY ( cn $ olcRoo
tDSE ) )
olcObjectClasses: ( OLcfgGlOc:7 NAME 'olcFrontendConfig' DESC 'OpenLDAP fronte
nd configuration' AUXILIARY MAY ( olcDefaultSearchBase $ olcPasswordHash $ ol
cSortVals ) )
olcObjectClasses: ( OLcfgGlOc:8 NAME 'olcModuleList' DESC 'OpenLDAP dynamic mo
dule info' SUP olcConfig STRUCTURAL MAY ( cn $ olcModulePath $ olcModuleLoad
) )
olcObjectClasses: ( OLcfgDbOc:2.1 NAME 'olcLdifConfig' DESC 'LDIF backend conf
iguration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.1 NAME 'monitor' DESC 'OpenLDAP
system monitoring' SUP top STRUCTURAL MUST cn MAY ( description $ seeAlso $ l
abeledURI $ monitoredInfo $ managedInfo $ monitorOverlay ) )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.2 NAME 'monitorServer' DESC 'Ser
ver monitoring root entry' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.3 NAME 'monitorContainer' DESC '
monitor container class' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.4 NAME 'monitorCounterObject' DE
SC 'monitor counter class' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.5 NAME 'monitorOperation' DESC '
monitor operation class' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.6 NAME 'monitorConnection' DESC
'monitor connection class' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.7 NAME 'managedObject' DESC 'mon
itor managed entity class' SUP monitor STRUCTURAL )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.8 NAME 'monitoredObject' DESC 'm
onitor monitored entity class' SUP monitor STRUCTURAL )
olcObjectClasses: ( OLcfgDbOc:4.1 NAME 'olcMonitorConfig' DESC 'Monitor backen
d configuration' SUP olcDatabaseConfig STRUCTURAL )
olcObjectClasses: ( olmSyncReplObjectClasses:1 NAME 'olmSyncReplInstance' SUP
monitoredObject STRUCTURAL MAY ( olmSRProviderURIList $ olmSRConnection $ olm
SRSyncPhase $ olmSRNextConnect $ olmSRLastConnect $ olmSRLastContact $ olmSRL
astCookieRcvd $ olmSRLastCookieSent ) )
structuralObjectClass: olcSchemaConfig
entryUUID: ce4b9e89-3c52-413c-8537-0bdcd8d75e60
creatorsName: cn=config
createTimestamp: 20260830072511Z
entryCSN: 20260830072511.415100Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20260830072511Z
dn: cn={0}custom,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: {0}custom
olcAttributeTypes: {0}( 1.3.6.1.4.1.19937.1.1.0 NAME 'active' DESC 'True if ac
count is active' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SI
NGLE-VALUE )
olcAttributeTypes: {1}( 1.3.6.1.4.1.19937.1.1.1 NAME 'fakeCn' DESC 'True if th
e CN or fullname was created randomly and is still fictitious' EQUALITY boole
anMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
olcAttributeTypes: {2}( 1.3.6.1.4.1.19937.1.1.2 NAME 'devices' DESC 'Trusted d
evices info from user-agent' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466
.115.121.1.15 )
olcAttributeTypes: {3}( 1.3.6.1.4.1.19937.1.1.3 NAME 'lastLogin' DESC 'Last lo
gin timestamp' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
1.24 SINGLE-VALUE )
olcAttributeTypes: {4}( 1.3.6.1.4.1.19937.1.1.4 NAME 'ip' DESC 'ip address' EQ
UALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
olcAttributeTypes: {5}( 1.3.6.1.4.1.19937.1.1.5 NAME 'secureAuth' DESC 'True i
f 2FA active' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGL
E-VALUE )
olcAttributeTypes: {6}( 1.3.6.1.4.1.19937.1.1.6 NAME 'authCode' DESC 'Two fact
or authentication code' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.1
15.121.1.26 SINGLE-VALUE )
olcObjectClasses: {0}( 1.3.6.1.4.1.19937.1.2.0 NAME 'accountsManagement' DESC
'Accounts management' SUP top AUXILIARY MUST ( cn $ uid $ active $ fakeCn ) M
AY ( userPassword $ description $ lastLogin $ ip $ devices $ secureAuth $ aut
hCode ) )
structuralObjectClass: olcSchemaConfig
entryUUID: c18fda0f-b2c6-4662-b277-94eb4ce97bbf
creatorsName: cn=config
createTimestamp: 20260830072511Z
entryCSN: 20260830072511.415100Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20260830072511Z
schema/custom.schema
+55
View File
@@ -0,0 +1,55 @@
##
## Schema for account management extra attributes in LDAP
## by Wproject 2022
## OIDs are owned by Cogent Innovators, LLC
##
## 1.3.6.1.4.1.19937.1.1.x - attributetypes
## 1.3.6.1.4.1.19937.1.2.x - objectclasses
##
attributetype ( 1.3.6.1.4.1.19937.1.1.0 NAME 'active'
DESC 'True if account is active'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
attributetype ( 1.3.6.1.4.1.19937.1.1.1 NAME 'fakeCn'
DESC 'True if the CN or fullname was created randomly and is still fictitious'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
attributetype ( 1.3.6.1.4.1.19937.1.1.2 NAME 'devices'
DESC 'Trusted devices info from user-agent'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributetype ( 1.3.6.1.4.1.19937.1.1.3 NAME 'lastLogin'
DESC 'Last login timestamp'
EQUALITY generalizedTimeMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
SINGLE-VALUE )
attributetype ( 1.3.6.1.4.1.19937.1.1.4 NAME 'ip'
DESC 'ip address'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE )
attributetype ( 1.3.6.1.4.1.19937.1.1.5 NAME 'secureAuth'
DESC 'True if 2FA active'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
attributetype ( 1.3.6.1.4.1.19937.1.1.6 NAME 'authCode'
DESC 'Two factor authentication code'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE )
objectclass ( 1.3.6.1.4.1.19937.1.2.0 NAME 'accountsManagement'
SUP top AUXILIARY
DESC 'Accounts management'
MUST ( cn $ uid $ active $ fakeCn )
MAY ( userPassword $ description $ lastLogin $ ip $ devices $ secureAuth $ authCode ) )
secrets/passwords.txt
+1
View File
@@ -0,0 +1 @@
pasahitz_segurua
slapd.conf
+34
View File
@@ -0,0 +1,34 @@
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/custom.schema
pidfile /run/openldap/slapd.pid
argsfile /run/openldap/slapd.args
modulepath /usr/lib/openldap
moduleload auditlog.so
moduleload back_mdb.so
moduleload pw-pbkdf2.so
database config
rootdn "gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
database mdb
access to attrs=userPassword
by self write
by self read
by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by anonymous auth
by set="[cn=admins,ou=groups,${LDAP_SUFFIX}]/memberUid & user/uid" manage
by * none
access to *
by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by dn.exact="cn=readonly,${LDAP_SUFFIX}" read
by set="[cn=admins,ou=groups,${LDAP_SUFFIX}]/memberUid & user/uid" manage
by self read
by * none
maxsize 1073741824
suffix "${LDAP_SUFFIX}"
rootdn "${LDAP_ROOTDN}"
rootpw ${LDAP_ROOTPW_HASH}
password-hash {PBKDF2-SHA512}
directory ${LDAP_DATA_DIR}