From patchwork Wed Nov 20 21:49:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 8270 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature RSA-PSS (4096 bits)) (Client CN "mail01.haj.ipfire.org", Issuer "R11" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4Xtw4P42RVz3x4f for ; Wed, 20 Nov 2024 21:49:25 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "E6" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4Xtw4L4xhlz4ff; Wed, 20 Nov 2024 21:49:22 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4Xtw4L2Q3pz34Gg; Wed, 20 Nov 2024 21:49:22 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature RSA-PSS (4096 bits)) (Client CN "mail01.haj.ipfire.org", Issuer "R11" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4Xtw4F2tXBz34Bc for ; Wed, 20 Nov 2024 21:49:17 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4Xtw4D5dJLzfX; Wed, 20 Nov 2024 21:49:16 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1732139357; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qMNck/5EnmyLYXhKNgKS3UtoOSpcFqszhUqaH3NW5Vg=; b=Tadgi1h+eMkblj4O8E1OhWsa2HFq/RRvJJs3Tyx6QOuyTcYrkcqSeMqW9GwppGEihZa1fx keZdDOEXcF2gstCg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1732139357; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qMNck/5EnmyLYXhKNgKS3UtoOSpcFqszhUqaH3NW5Vg=; b=AlW2AdJpzWkO+ZtsrD1wNCE6HGwZpczWo7tKZDL3ydZH38xzDt5hDawN9LGyxIdp6owhXR 6+juPs4Om3DaYvjkkCLkYVPTm36w8N1bEXHYXBelMFkVfuRFvhTPyP/lfuG/eKVbuVRnuZ xUzk7t9Y47KimXr7fLwV6gRwJtCfWfo1kgSczcK2O4+y+wwSsCTY3zTcPsWenlRpi/Sd99 sCpXEu4nEALdXRBOym5V5jju+yhX/MhCTsiQYV6m3qaJI1E4hP0jsYXcTWjX6CeA/LEOoD NZJvFUzQRgdOjEVROKw5uA4tId6xJ8uVZ6Uq/8XL6MW9e+/6z7t1eqRPqq2ClQ== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH] openldap: Update to version 2.6.8 Date: Wed, 20 Nov 2024 22:49:08 +0100 Message-ID: <20241120214909.2717383-6-adolf.belka@ipfire.org> In-Reply-To: <20241120214909.2717383-1-adolf.belka@ipfire.org> References: <20241120214909.2717383-1-adolf.belka@ipfire.org> MIME-Version: 1.0 Message-ID-Hash: WJ5JOREJHUI75FWQV5QPNC3FG6QGFEPW X-Message-ID-Hash: WJ5JOREJHUI75FWQV5QPNC3FG6QGFEPW X-MailFrom: adolf.belka@ipfire.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list List-Id: IPFire development talk Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: - Update from version 2.6.5 to 2.6.8 - Update of rootfile - Replacement of previous 2.6.5-consolideated patch with 2.6.8-consolidated patch - Changelog 2.6.8 Fixed libldap exit handling with OpenSSL3 again (ITS#9952) Fixed libldap OpenSSL channel binding digest (ITS#10216) Fixed slapd handling of large uid/gids peercred auth (ITS#10211) Fixed slapd-asyncmeta/meta target structure allocations (ITS#10197) Fixed slapd-meta with dynlist (ITS#10164) Fixed slapd-meta binds when proxying internal op (ITS#10165) Added slapo-nestgroup overlay (ITS#10161) Added slapo-memberof 'addcheck' option (ITS#10167) Fixed slapo-accesslog startup initialization (ITS#10170) Fixed slapo-constraint double free on invalid attr (ITS#10204) Fixed slapo-dynlist with abandoned operations (ITS#10044) Build Fixed build with gcc14.x (ITS#10166) Fixed back-perl with clang15 (ITS#10177) Fixed to reduce systemd dependencies (ITS#10214) Contrib Added slapo-alias contrib module (ITS#10104, ITS#10182) Fixed slapo-autogroup to work with slapo-dynlist (ITS#10185) Fixed smbk5pwd implicit function declaration (ITS#10206) Documentation Fixed slapo-memberof exattr requirements (ITS#7400) Fixed slapo-memberof is no longer deprecated (ITS#7400) Minor Cleanup ITS#9921 ITS#10103 ITS#10171 ITS#10172 ITS#10173 ITS#10179 ITS#10183 ITS#10186 ITS#10188 ITS#10193 ITS#10209 2.6.7 Added slapo-dynlist option to disable filter support (ITS#10025) Fixed liblber missing newline on long msg (ITS#10105) Fixed libldap exit handling with OpenSSL3 (ITS#9952) Fixed libldap with TLS and multiple ldap URIs (ITS#10101) Fixed libldap OpenSSL cipher suite handling (ITS#10094) Fixed libldap OpenSSL 3.0 and Diffie-Hellman param files (ITS#10124) Fixed libldap timestamps on Windows (ITS#10100) Fixed lloadd to work when resolv.conf is missing (ITS#10070) Fixed lloadd handling of closing connection (ITS#10083) Fixed lloadd tiers to be correctly linked on startup (ITS#10142) Fixed slapd to honour disclose in matchedDN handling (ITS#10139) Fixed slapd handling of regex testing in ACLs (ITS#10089) Fixed slapd sync replication with glued database (ITS#10080) Fixed slapd local logging on Windows (ITS#10092) Fixed slapd-asyncmeta when remote suffix is empty (ITS#10076) Fixed slapo-dynlist so it can't be global (ITS#10091) Build Fixed lloadd type mismatches (ITS#10074) Fixed builds for Windows (ITS#10117) Fixed build with clang16 (ITS#10123) Documentation Fixed slapo-homedir(5) attribute name for olcHomedirArchivePath (ITS#10057) Minor Cleanup ITS#10059 ITS#10068 ITS#10098 ITS#10109 ITS#10110 ITS#10129 ITS#10130 ITS#10135 ITS#10143 ITS#10144 ITS#10145 ITS#10153 2.6.6 Fixed slapd cn=config incorrect handling of paused (ITS#10045) Fixed slapd-meta to account for MOD ops being optional (ITS#10067) Fixed slapd-asyncmeta to account for MOD ops being optional (ITS#10067) Signed-off-by: Adolf Belka --- config/rootfiles/common/openldap | 1 + lfs/openldap | 20 +- .../openldap-2.6.5-consolidated-1.patch | 4640 ----------------- .../openldap-2.6.8-consolidated-1.patch | 175 + 4 files changed, 186 insertions(+), 4650 deletions(-) delete mode 100644 src/patches/openldap-2.6.5-consolidated-1.patch create mode 100644 src/patches/openldap-2.6.8-consolidated-1.patch diff --git a/config/rootfiles/common/openldap b/config/rootfiles/common/openldap index 45e731ee4..eb9961c0b 100644 --- a/config/rootfiles/common/openldap +++ b/config/rootfiles/common/openldap @@ -262,6 +262,7 @@ usr/lib/libldap.so.2.0.200 #usr/share/man/man5/slapo-dynlist.5 #usr/share/man/man5/slapo-homedir.5 #usr/share/man/man5/slapo-memberof.5 +#usr/share/man/man5/slapo-nestgroup.5 #usr/share/man/man5/slapo-otp.5 #usr/share/man/man5/slapo-pbind.5 #usr/share/man/man5/slapo-pcache.5 diff --git a/lfs/openldap b/lfs/openldap index c2c3e3f87..ce92bd950 100644 --- a/lfs/openldap +++ b/lfs/openldap @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team # +# Copyright (C) 2007-2024 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.6.5 +VER = 2.6.8 THISAPP = openldap-$(VER) DL_FILE = $(THISAPP).tgz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 20370fc620ed0c4ef96d68d306dc42b0d87d1716579904cc362f9d368a76b0c39919e248b32453526f5ba1612b74de6056df1cef406e94b01d0a70277692d2d8 +$(DL_FILE)_BLAKE2 = 2aefdcaca12776c70084aff7b3e216126d8305ed7f9ba444b673ee671c5ac6129eb5fa9519e832acfb3e695b2e4e9474bcff36a3b6406000e2ef1f057863b4f5 install : $(TARGET) @@ -72,15 +72,15 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openldap-2.6.5-consolidated-1.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openldap-2.6.8-consolidated-1.patch cd $(DIR_APP) && autoconf cd $(DIR_APP) && ./configure \ - --prefix=/usr \ - --sysconfdir=/etc \ - --enable-dynamic \ - --disable-perl \ - --disable-static \ - --disable-slapd + --prefix=/usr \ + --sysconfdir=/etc \ + --enable-dynamic \ + --disable-perl \ + --disable-static \ + --disable-slapd cd $(DIR_APP) && make depend cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/openldap-2.6.5-consolidated-1.patch b/src/patches/openldap-2.6.5-consolidated-1.patch deleted file mode 100644 index d8a2d4b4c..000000000 --- a/src/patches/openldap-2.6.5-consolidated-1.patch +++ /dev/null @@ -1,4640 +0,0 @@ -diff -Naurp openldap-2.6.2.orig/doc/man/man5/slapd.conf.5 openldap-2.6.2/doc/man/man5/slapd.conf.5 ---- openldap-2.6.2.orig/doc/man/man5/slapd.conf.5 2022-05-04 16:55:23.000000000 +0200 -+++ openldap-2.6.2/doc/man/man5/slapd.conf.5 2022-05-05 12:05:53.309727745 +0200 -@@ -2122,7 +2122,7 @@ suffix "dc=our\-domain,dc=com" - # The database directory MUST exist prior to - # running slapd AND should only be accessible - # by the slapd/tools. Mode 0700 recommended. --directory LOCALSTATEDIR/openldap\-data -+directory LOCALSTATEDIR/lib/openldap - # Indices to maintain - index objectClass eq - index cn,sn,mail pres,eq,approx,sub -diff -Naurp openldap-2.6.2.orig/doc/man/man5/slapd.conf.5.orig openldap-2.6.2/doc/man/man5/slapd.conf.5.orig ---- openldap-2.6.2.orig/doc/man/man5/slapd.conf.5.orig 1970-01-01 01:00:00.000000000 +0100 -+++ openldap-2.6.2/doc/man/man5/slapd.conf.5.orig 2022-05-04 16:55:23.000000000 +0200 -@@ -0,0 +1,2167 @@ -+.TH SLAPD.CONF 5 "RELEASEDATE" "OpenLDAP LDVERSION" -+.\" Copyright 1998-2022 The OpenLDAP Foundation All Rights Reserved. -+.\" Copying restrictions apply. See COPYRIGHT/LICENSE. -+.\" $OpenLDAP$ -+.SH NAME -+slapd.conf \- configuration file for slapd, the stand-alone LDAP daemon -+.SH SYNOPSIS -+ETCDIR/slapd.conf -+.SH DESCRIPTION -+The file -+.B ETCDIR/slapd.conf -+contains configuration information for the -+.BR slapd (8) -+daemon. This configuration file is also used by the SLAPD tools -+.BR slapacl (8), -+.BR slapadd (8), -+.BR slapauth (8), -+.BR slapcat (8), -+.BR slapdn (8), -+.BR slapindex (8), -+.BR slapmodify (8), -+and -+.BR slaptest (8). -+.LP -+The -+.B slapd.conf -+file consists of a series of global configuration options that apply to -+.B slapd -+as a whole (including all backends), followed by zero or more database -+backend definitions that contain information specific to a backend -+instance. -+The configuration options are case-insensitive; -+their value, on a case by case basis, may be case-sensitive. -+.LP -+The general format of -+.B slapd.conf -+is as follows: -+.LP -+.nf -+ # comment - these options apply to every database -+ -+ # first database definition & configuration options -+ database -+ -+ # subsequent database definitions & configuration options -+ ... -+.fi -+.LP -+As many backend-specific sections as desired may be included. Global -+options can be overridden in a backend (for options that appear more -+than once, the last appearance in the -+.B slapd.conf -+file is used). -+.LP -+If a line begins with white space, it is considered a continuation -+of the previous line. No physical line should be over 2000 bytes -+long. -+.LP -+Blank lines and comment lines beginning with -+a `#' character are ignored. Note: continuation lines are unwrapped -+before comment processing is applied. -+.LP -+Arguments on configuration lines are separated by white space. If an -+argument contains white space, the argument should be enclosed in -+double quotes. If an argument contains a double quote (`"') or a -+backslash character (`\\'), the character should be preceded by a -+backslash character. -+.LP -+The specific configuration options available are discussed below in the -+Global Configuration Options, General Backend Options, and General Database -+Options. Backend-specific options are discussed in the -+.B slapd\-(5) -+manual pages. Refer to the "OpenLDAP Administrator's Guide" for more -+details on the slapd configuration file. -+.SH GLOBAL CONFIGURATION OPTIONS -+Options described in this section apply to all backends, unless specifically -+overridden in a backend definition. Arguments that should be replaced by -+actual text are shown in brackets <>. -+.TP -+.B access to "[ by ]+" -+Grant access (specified by ) to a set of entries and/or -+attributes (specified by ) by one or more requestors (specified -+by ). -+If no access controls are present, the default policy -+allows anyone and everyone to read anything but restricts -+updates to rootdn. (e.g., "access to * by * read"). -+The rootdn can always read and write EVERYTHING! -+See -+.BR slapd.access (5) -+and the "OpenLDAP's Administrator's Guide" for details. -+.TP -+.B allow -+Specify a set of features (separated by white space) to -+allow (default none). -+.B bind_v2 -+allows acceptance of LDAPv2 bind requests. Note that -+.BR slapd (8) -+does not truly implement LDAPv2 (RFC 1777), now Historic (RFC 3494). -+.B bind_anon_cred -+allows anonymous bind when credentials are not empty (e.g. -+when DN is empty). -+.B bind_anon_dn -+allows unauthenticated (anonymous) bind when DN is not empty. -+.B update_anon -+allows unauthenticated (anonymous) update operations to be processed -+(subject to access controls and other administrative limits). -+.B proxy_authz_anon -+allows unauthenticated (anonymous) proxy authorization control to be processed -+(subject to access controls, authorization and other administrative limits). -+.TP -+.B argsfile -+The (absolute) name of a file that will hold the -+.B slapd -+server's command line (program name and options). -+.TP -+.B attributeoptions [option-name]... -+Define tagging attribute options or option tag/range prefixes. -+Options must not end with `\-', prefixes must end with `\-'. -+The `lang\-' prefix is predefined. -+If you use the -+.B attributeoptions -+directive, `lang\-' will no longer be defined and you must specify it -+explicitly if you want it defined. -+ -+An attribute description with a tagging option is a subtype of that -+attribute description without the option. -+Except for that, options defined this way have no special semantics. -+Prefixes defined this way work like the `lang\-' options: -+They define a prefix for tagging options starting with the prefix. -+That is, if you define the prefix `x\-foo\-', you can use the option -+`x\-foo\-bar'. -+Furthermore, in a search or compare, a prefix or range name (with -+a trailing `\-') matches all options starting with that name, as well -+as the option with the range name sans the trailing `\-'. -+That is, `x\-foo\-bar\-' matches `x\-foo\-bar' and `x\-foo\-bar\-baz'. -+ -+RFC 4520 reserves options beginning with `x\-' for private experiments. -+Other options should be registered with IANA, see RFC 4520 section 3.5. -+OpenLDAP also has the `binary' option built in, but this is a transfer -+option, not a tagging option. -+.HP -+.hy 0 -+.B attributetype "(\ \ -+ [NAME\ ]\ -+ [DESC\ ]\ -+ [OBSOLETE]\ -+ [SUP\ ]\ -+ [EQUALITY\ ]\ -+ [ORDERING\ ]\ -+ [SUBSTR\ ]\ -+ [SYNTAX\ ]\ -+ [SINGLE\-VALUE]\ -+ [COLLECTIVE]\ -+ [NO\-USER\-MODIFICATION]\ -+ [USAGE\ ]\ )" -+.RS -+Specify an attribute type using the LDAPv3 syntax defined in RFC 4512. -+The slapd parser extends the RFC 4512 definition by allowing string -+forms as well as numeric OIDs to be used for the attribute OID and -+attribute syntax OID. -+(See the -+.B objectidentifier -+description.) -+.RE -+.TP -+.B authid\-rewrite -+Used by the authentication framework to convert simple user names -+to an LDAP DN used for authorization purposes. -+Its purpose is analogous to that of -+.BR authz-regexp -+(see below). -+The prefix \fIauthid\-\fP is followed by a set of rules analogous -+to those described in -+.BR slapo\-rwm (5) -+for data rewriting (replace the \fIrwm\-\fP prefix with \fIauthid\-\fP). -+.B authid\-rewrite -+and -+.B authz\-regexp -+rules should not be intermixed. -+.TP -+.B authz\-policy -+Used to specify which rules to use for Proxy Authorization. Proxy -+authorization allows a client to authenticate to the server using one -+user's credentials, but specify a different identity to use for authorization -+and access control purposes. It essentially allows user A to login as user -+B, using user A's password. -+The -+.B none -+flag disables proxy authorization. This is the default setting. -+The -+.B from -+flag will use rules in the -+.I authzFrom -+attribute of the authorization DN. -+The -+.B to -+flag will use rules in the -+.I authzTo -+attribute of the authentication DN. -+The -+.B any -+flag, an alias for the deprecated value of -+.BR both , -+will allow any of the above, whatever succeeds first (checked in -+.BR to , -+.B from -+sequence. -+The -+.B all -+flag requires both authorizations to succeed. -+.LP -+.RS -+The rules are mechanisms to specify which identities are allowed -+to perform proxy authorization. -+The -+.I authzFrom -+attribute in an entry specifies which other users -+are allowed to proxy login to this entry. The -+.I authzTo -+attribute in -+an entry specifies which other users this user can authorize as. Use of -+.I authzTo -+rules can be easily -+abused if users are allowed to write arbitrary values to this attribute. -+In general the -+.I authzTo -+attribute must be protected with ACLs such that -+only privileged users can modify it. -+The value of -+.I authzFrom -+and -+.I authzTo -+describes an -+.B identity -+or a set of identities; it can take five forms: -+.RS -+.TP -+.B ldap:///??[]? -+.RE -+.RS -+.B dn[.]: -+.RE -+.RS -+.B u[.[/]]: -+.RE -+.RS -+.B group[/objectClass[/attributeType]]: -+.RE -+.RS -+.B -+.RE -+.RS -+ -+.B :={exact|onelevel|children|subtree|regex} -+ -+.RE -+The first form is a valid LDAP -+.B URI -+where the -+.IR : , -+the -+.I -+and the -+.I -+portions must be absent, so that the search occurs locally on either -+.I authzFrom -+or -+.IR authzTo . -+ -+.LP -+The second form is a -+.BR DN . -+The optional -+.B dnstyle -+modifiers -+.IR exact , -+.IR onelevel , -+.IR children , -+and -+.I subtree -+provide exact, onelevel, children and subtree matches, which cause -+.I -+to be normalized according to the DN normalization rules. -+The special -+.B dnstyle -+modifier -+.I regex -+causes the -+.I -+to be treated as a POSIX (''extended'') regular expression, as -+discussed in -+.BR regex (7) -+and/or -+.BR re_format (7). -+A pattern of -+.I * -+means any non-anonymous DN. -+ -+.LP -+The third form is a SASL -+.BR id . -+The optional fields -+.I -+and -+.I -+allow specification of a SASL -+.BR mechanism , -+and eventually a SASL -+.BR realm , -+for those mechanisms that support one. -+The need to allow the specification of a mechanism is still debated, -+and users are strongly discouraged to rely on this possibility. -+ -+.LP -+The fourth form is a group specification. -+It consists of the keyword -+.BR group , -+optionally followed by the specification of the group -+.B objectClass -+and -+.BR attributeType . -+The -+.B objectClass -+defaults to -+.IR groupOfNames . -+The -+.B attributeType -+defaults to -+.IR member . -+The group with DN -+.B -+is searched with base scope, filtered on the specified -+.BR objectClass . -+The values of the resulting -+.B attributeType -+are searched for the asserted DN. -+ -+.LP -+The fifth form is provided for backwards compatibility. If no identity -+type is provided, i.e. only -+.B -+is present, an -+.I exact DN -+is assumed; as a consequence, -+.B -+is subjected to DN normalization. -+ -+.LP -+Since the interpretation of -+.I authzFrom -+and -+.I authzTo -+can impact security, users are strongly encouraged -+to explicitly set the type of identity specification that is being used. -+A subset of these rules can be used as third arg in the -+.B authz\-regexp -+statement (see below); significantly, the -+.IR URI , -+provided it results in exactly one entry, -+and the -+.I dn.exact: -+forms. -+.RE -+.TP -+.B authz\-regexp -+Used by the authentication framework to convert simple user names, -+such as provided by SASL subsystem, or extracted from certificates -+in case of cert-based SASL EXTERNAL, or provided within the RFC 4370 -+"proxied authorization" control, to an LDAP DN used for -+authorization purposes. Note that the resulting DN need not refer -+to an existing entry to be considered valid. When an authorization -+request is received from the SASL subsystem, the SASL -+.BR USERNAME , -+.BR REALM , -+and -+.B MECHANISM -+are taken, when available, and combined into a name of the form -+.RS -+.RS -+.TP -+.B UID=[[,CN=],CN=],CN=auth -+ -+.RE -+This name is then compared against the -+.B match -+POSIX (''extended'') regular expression, and if the match is successful, -+the name is replaced with the -+.B replace -+string. If there are wildcard strings in the -+.B match -+regular expression that are enclosed in parenthesis, e.g. -+.RS -+.TP -+.B UID=([^,]*),CN=.* -+ -+.RE -+then the portion of the name that matched the wildcard will be stored -+in the numbered placeholder variable $1. If there are other wildcard strings -+in parenthesis, the matching strings will be in $2, $3, etc. up to $9. The -+placeholders can then be used in the -+.B replace -+string, e.g. -+.RS -+.TP -+.B UID=$1,OU=Accounts,DC=example,DC=com -+ -+.RE -+The replaced name can be either a DN, i.e. a string prefixed by "dn:", -+or an LDAP URI. -+If the latter, the server will use the URI to search its own database(s) -+and, if the search returns exactly one entry, the name is -+replaced by the DN of that entry. The LDAP URI must have no -+hostport, attrs, or extensions components, but the filter is mandatory, -+e.g. -+.RS -+.TP -+.B ldap:///OU=Accounts,DC=example,DC=com??one?(UID=$1) -+ -+.RE -+The protocol portion of the URI must be strictly -+.BR ldap . -+Note that this search is subject to access controls. Specifically, -+the authentication identity must have "auth" access in the subject. -+ -+Multiple -+.B authz\-regexp -+options can be given in the configuration file to allow for multiple matching -+and replacement patterns. The matching patterns are checked in the order they -+appear in the file, stopping at the first successful match. -+ -+.\".B Caution: -+.\"Because the plus sign + is a character recognized by the regular expression engine, -+.\"and it will appear in names that include a REALM, be careful to escape the -+.\"plus sign with a backslash \\+ to remove the character's special meaning. -+.RE -+.TP -+.B concurrency -+Specify a desired level of concurrency. Provided to the underlying -+thread system as a hint. The default is not to provide any hint. This setting -+is only meaningful on some platforms where there is not a one to one -+correspondence between user threads and kernel threads. -+.TP -+.B conn_max_pending -+Specify the maximum number of pending requests for an anonymous session. -+If requests are submitted faster than the server can process them, they -+will be queued up to this limit. If the limit is exceeded, the session -+is closed. The default is 100. -+.TP -+.B conn_max_pending_auth -+Specify the maximum number of pending requests for an authenticated session. -+The default is 1000. -+.TP -+.B defaultsearchbase -+Specify a default search base to use when client submits a -+non-base search request with an empty base DN. -+Base scoped search requests with an empty base DN are not affected. -+.TP -+.B disallow -+Specify a set of features (separated by white space) to -+disallow (default none). -+.B bind_anon -+disables acceptance of anonymous bind requests. Note that this setting -+does not prohibit anonymous directory access (See "require authc"). -+.B bind_simple -+disables simple (bind) authentication. -+.B tls_2_anon -+disables forcing session to anonymous status (see also -+.BR tls_authc ) -+upon StartTLS operation receipt. -+.B tls_authc -+disallows the StartTLS operation if authenticated (see also -+.BR tls_2_anon ). -+.B proxy_authz_non_critical -+disables acceptance of the proxied authorization control (RFC4370) -+with criticality set to FALSE. -+.B dontusecopy_non_critical -+disables acceptance of the dontUseCopy control (a work in progress) -+with criticality set to FALSE. -+.HP -+.hy 0 -+.B ditcontentrule "(\ \ -+ [NAME\ ]\ -+ [DESC\ ]\ -+ [OBSOLETE]\ -+ [AUX\ ]\ -+ [MUST\ ]\ -+ [MAY\ ]\ -+ [NOT\ ]\ )" -+.RS -+Specify an DIT Content Rule using the LDAPv3 syntax defined in RFC 4512. -+The slapd parser extends the RFC 4512 definition by allowing string -+forms as well as numeric OIDs to be used for the attribute OID and -+attribute syntax OID. -+(See the -+.B objectidentifier -+description.) -+.RE -+.TP -+.B gentlehup { on | off } -+A SIGHUP signal will only cause a 'gentle' shutdown-attempt: -+.B Slapd -+will stop listening for new connections, but will not close the -+connections to the current clients. Future write operations return -+unwilling-to-perform, though. Slapd terminates when all clients -+have closed their connections (if they ever do), or \- as before \- -+if it receives a SIGTERM signal. This can be useful if you wish to -+terminate the server and start a new -+.B slapd -+server -+.B with another database, -+without disrupting the currently active clients. -+The default is off. You may wish to use -+.B idletimeout -+along with this option. -+.TP -+.B idletimeout -+Specify the number of seconds to wait before forcibly closing -+an idle client connection. A setting of 0 disables this -+feature. The default is 0. You may also want to set the -+.B writetimeout -+option. -+.TP -+.B include -+Read additional configuration information from the given file before -+continuing with the next line of the current file. -+.TP -+.B index_hash64 { on | off } -+Use a 64 bit hash for indexing. The default is to use 32 bit hashes. -+These hashes are used for equality and substring indexing. The 64 bit -+version may be needed to avoid index collisions when the number of -+indexed values exceeds ~64 million. (Note that substring indexing -+generates multiple index values per actual attribute value.) -+Indices generated with 32 bit hashes are incompatible with the 64 bit -+version, and vice versa. Any existing databases must be fully reloaded -+when changing this setting. This directive is only supported on 64 bit CPUs. -+.TP -+.B index_intlen -+Specify the key length for ordered integer indices. The most significant -+bytes of the binary integer will be used for index keys. The default -+value is 4, which provides exact indexing for 31 bit values. -+A floating point representation is used to index too large values. -+.TP -+.B index_substr_if_maxlen -+Specify the maximum length for subinitial and subfinal indices. Only -+this many characters of an attribute value will be processed by the -+indexing functions; any excess characters are ignored. The default is 4. -+.TP -+.B index_substr_if_minlen -+Specify the minimum length for subinitial and subfinal indices. An -+attribute value must have at least this many characters in order to be -+processed by the indexing functions. The default is 2. -+.TP -+.B index_substr_any_len -+Specify the length used for subany indices. An attribute value must have -+at least this many characters in order to be processed. Attribute values -+longer than this length will be processed in segments of this length. The -+default is 4. The subany index will also be used in subinitial and -+subfinal index lookups when the filter string is longer than the -+.I index_substr_if_maxlen -+value. -+.TP -+.B index_substr_any_step -+Specify the steps used in subany index lookups. This value sets the offset -+for the segments of a filter string that are processed for a subany index -+lookup. The default is 2. For example, with the default values, a search -+using this filter "cn=*abcdefgh*" would generate index lookups for -+"abcd", "cdef", and "efgh". -+ -+.LP -+Note: Indexing support depends on the particular backend in use. Also, -+changing these settings will generally require deleting any indices that -+depend on these parameters and recreating them with -+.BR slapindex (8). -+ -+.HP -+.hy 0 -+.B ldapsyntax "(\ \ -+ [DESC\ ]\ -+ [X\-SUBST ]\ )" -+.RS -+Specify an LDAP syntax using the LDAPv3 syntax defined in RFC 4512. -+The slapd parser extends the RFC 4512 definition by allowing string -+forms as well as numeric OIDs to be used for the syntax OID. -+(See the -+.B objectidentifier -+description.) -+The slapd parser also honors the -+.B X\-SUBST -+extension (an OpenLDAP-specific extension), which allows one to use the -+.B ldapsyntax -+statement to define a non-implemented syntax along with another syntax, -+the extension value -+.IR substitute-syntax , -+as its temporary replacement. -+The -+.I substitute-syntax -+must be defined. -+This allows one to define attribute types that make use of non-implemented syntaxes -+using the correct syntax OID. -+Unless -+.B X\-SUBST -+is used, this configuration statement would result in an error, -+since no handlers would be associated to the resulting syntax structure. -+.RE -+ -+.TP -+.B listener-threads -+Specify the number of threads to use for the connection manager. -+The default is 1 and this is typically adequate for up to 16 CPU cores. -+The value should be set to a power of 2. -+.TP -+.B localSSF -+Specifies the Security Strength Factor (SSF) to be given local LDAP sessions, -+such as those to the ldapi:// listener. For a description of SSF values, -+see -+.BR sasl-secprops 's -+.B minssf -+option description. The default is 71. -+.TP -+.B logfile -+Specify a file for recording slapd debug messages. By default these messages -+only go to stderr, are not recorded anywhere else, and are unrelated to -+messages exposed by the -+.B loglevel -+configuration parameter. Specifying a logfile copies messages to both stderr -+and the logfile. -+.TP -+.B logfile-format debug | syslog-utc | syslog-localtime -+Specify the prefix format for messages written to the logfile. The debug -+format is the normal format used for slapd debug messages, with a timestamp -+in hexadecimal, followed by a thread ID. The other options are to -+use syslog(3) style prefixes, with timestamps either in UTC or in the -+local timezone. The default is debug format. -+.TP -+.B logfile-only on | off -+Specify that debug messages should only go to the configured logfile, and -+not to stderr. -+.TP -+.B logfile-rotate -+Specify automatic rotation for the configured logfile as the maximum -+number of old logfiles to retain, a maximum size in megabytes to allow a -+logfile to grow before rotation, and a maximum age in hours for a logfile -+to be used before rotation. The maximum number must be in the range 1-99. -+Setting Mbytes or hours to zero disables the size or age check, respectively. -+At least one of Mbytes or hours must be non-zero. By default no automatic -+rotation will be performed. -+.TP -+.B loglevel [...] -+Specify the level at which debugging statements and operation -+statistics should be syslogged (currently logged to the -+.BR syslogd (8) -+LOG_LOCAL4 facility). -+They must be considered subsystems rather than increasingly verbose -+log levels. -+Some messages with higher priority are logged regardless -+of the configured loglevel as soon as any logging is configured. -+Log levels are additive, and available levels are: -+.RS -+.RS -+.PD 0 -+.TP -+.B 1 -+.B (0x1 trace) -+trace function calls -+.TP -+.B 2 -+.B (0x2 packets) -+debug packet handling -+.TP -+.B 4 -+.B (0x4 args) -+heavy trace debugging (function args) -+.TP -+.B 8 -+.B (0x8 conns) -+connection management -+.TP -+.B 16 -+.B (0x10 BER) -+print out packets sent and received -+.TP -+.B 32 -+.B (0x20 filter) -+search filter processing -+.TP -+.B 64 -+.B (0x40 config) -+configuration file processing -+.TP -+.B 128 -+.B (0x80 ACL) -+access control list processing -+.TP -+.B 256 -+.B (0x100 stats) -+connections, LDAP operations, results (recommended) -+.TP -+.B 512 -+.B (0x200 stats2) -+stats2 log entries sent -+.TP -+.B 1024 -+.B (0x400 shell) -+print communication with shell backends -+.TP -+.B 2048 -+.B (0x800 parse) -+entry parsing -+\".TP -+\".B 4096 -+\".B (0x1000 cache) -+\"caching (unused) -+\".TP -+\".B 8192 -+\".B (0x2000 index) -+\"data indexing (unused) -+.TP -+.B 16384 -+.B (0x4000 sync) -+LDAPSync replication -+.TP -+.B 32768 -+.B (0x8000 none) -+only messages that get logged whatever log level is set -+.PD -+.RE -+The desired log level can be input as a single integer that combines -+the (ORed) desired levels, both in decimal or in hexadecimal notation, -+as a list of integers (that are ORed internally), -+or as a list of the names that are shown between parentheses, such that -+.LP -+.nf -+ loglevel 129 -+ loglevel 0x81 -+ loglevel 128 1 -+ loglevel 0x80 0x1 -+ loglevel acl trace -+.fi -+.LP -+are equivalent. -+The keyword -+.B any -+can be used as a shortcut to enable logging at all levels (equivalent to \-1). -+The keyword -+.BR none , -+or the equivalent integer representation, causes those messages -+that are logged regardless of the configured loglevel to be logged. -+In fact, if loglevel is set to 0, no logging occurs, -+so at least the -+.B none -+level is required to have high priority messages logged. -+ -+Note that the -+.BR packets , -+.BR BER , -+and -+.B parse -+levels are only available as debug output on stderr, and are not -+sent to syslog. -+ -+The loglevel defaults to \fBstats\fP. -+This level should usually also be included when using other loglevels, to -+help analyze the logs. -+.RE -+.TP -+.B maxfilterdepth -+Specify the maximum depth of nested filters in search requests. -+The default is 1000. -+.TP -+.B moduleload [...] -+Specify the name of a dynamically loadable module to load and any -+additional arguments if supported by the module. The filename -+may be an absolute path name or a simple filename. Non-absolute names -+are searched for in the directories specified by the -+.B modulepath -+option. This option and the -+.B modulepath -+option are only usable if slapd was compiled with \-\-enable\-modules. -+.TP -+.B modulepath -+Specify a list of directories to search for loadable modules. Typically -+the path is colon-separated but this depends on the operating system. -+The default is MODULEDIR, which is where the standard OpenLDAP install -+will place its modules. -+.HP -+.hy 0 -+.B objectclass "(\ \ -+ [NAME\ ]\ -+ [DESC\ ]\ -+ [OBSOLETE]\ -+ [SUP\ ]\ -+ [{ ABSTRACT | STRUCTURAL | AUXILIARY }]\ -+ [MUST\ ] [MAY\ ] )" -+.RS -+Specify an objectclass using the LDAPv3 syntax defined in RFC 4512. -+The slapd parser extends the RFC 4512 definition by allowing string -+forms as well as numeric OIDs to be used for the object class OID. -+(See the -+.B -+objectidentifier -+description.) Object classes are "STRUCTURAL" by default. -+.RE -+.TP -+.B objectidentifier "{ | [:] }" -+Define a string name that equates to the given OID. The string can be used -+in place of the numeric OID in objectclass and attribute definitions. The -+name can also be used with a suffix of the form ":xx" in which case the -+value "oid.xx" will be used. -+.TP -+.B password\-hash [...] -+This option configures one or more hashes to be used in generation of user -+passwords stored in the userPassword attribute during processing of -+LDAP Password Modify Extended Operations (RFC 3062). -+The must be one of -+.BR {SSHA} , -+.BR {SHA} , -+.BR {SMD5} , -+.BR {MD5} , -+.BR {CRYPT} , -+and -+.BR {CLEARTEXT} . -+The default is -+.BR {SSHA} . -+ -+.B {SHA} -+and -+.B {SSHA} -+use the SHA-1 algorithm (FIPS 160-1), the latter with a seed. -+ -+.B {MD5} -+and -+.B {SMD5} -+use the MD5 algorithm (RFC 1321), the latter with a seed. -+ -+.B {CRYPT} -+uses the -+.BR crypt (3). -+ -+.B {CLEARTEXT} -+indicates that the new password should be -+added to userPassword as clear text. -+ -+Note that this option does not alter the normal user applications -+handling of userPassword during LDAP Add, Modify, or other LDAP operations. -+.TP -+.B password\-crypt\-salt\-format -+Specify the format of the salt passed to -+.BR crypt (3) -+when generating {CRYPT} passwords (see -+.BR password\-hash ) -+during processing of LDAP Password Modify Extended Operations (RFC 3062). -+ -+This string needs to be in -+.BR sprintf (3) -+format and may include one (and only one) %s conversion. -+This conversion will be substituted with a string of random -+characters from [A\-Za\-z0\-9./]. For example, "%.2s" -+provides a two character salt and "$1$%.8s" tells some -+versions of crypt(3) to use an MD5 algorithm and provides -+8 random characters of salt. The default is "%s", which -+provides 31 characters of salt. -+.TP -+.B pidfile -+The (absolute) name of a file that will hold the -+.B slapd -+server's process ID (see -+.BR getpid (2)). -+.TP -+.B pluginlog: -+The ( absolute ) name of a file that will contain log -+messages from -+.B SLAPI -+plugins. See -+.BR slapd.plugin (5) -+for details. -+.TP -+.B referral -+Specify the referral to pass back when -+.BR slapd (8) -+cannot find a local database to handle a request. -+If specified multiple times, each url is provided. -+.TP -+.B require -+Specify a set of conditions (separated by white space) to -+require (default none). -+The directive may be specified globally and/or per-database; -+databases inherit global conditions, so per-database specifications -+are additive. -+.B bind -+requires bind operation prior to directory operations. -+.B LDAPv3 -+requires session to be using LDAP version 3. -+.B authc -+requires authentication prior to directory operations. -+.B SASL -+requires SASL authentication prior to directory operations. -+.B strong -+requires strong authentication prior to directory operations. -+The strong keyword allows protected "simple" authentication -+as well as SASL authentication. -+.B none -+may be used to require no conditions (useful to clear out globally -+set conditions within a particular database); it must occur first -+in the list of conditions. -+.TP -+.B reverse\-lookup on | off -+Enable/disable client name unverified reverse lookup (default is -+.BR off -+if compiled with \-\-enable\-rlookups). -+.TP -+.B rootDSE -+Specify the name of an LDIF(5) file containing user defined attributes -+for the root DSE. These attributes are returned in addition to the -+attributes normally produced by slapd. -+ -+The root DSE is an entry with information about the server and its -+capabilities, in operational attributes. -+It has the empty DN, and can be read with e.g.: -+.ti +4 -+ldapsearch \-x \-b "" \-s base "+" -+.br -+See RFC 4512 section 5.1 for details. -+.TP -+.B sasl\-auxprops [...] -+Specify which auxprop plugins to use for authentication lookups. The -+default is empty, which just uses slapd's internal support. Usually -+no other auxprop plugins are needed. -+.TP -+.B sasl\-auxprops\-dontusecopy [...] -+Specify which attribute(s) should be subject to the don't use copy control. This -+is necessary for some SASL mechanisms such as OTP to work in a replicated -+environment. The attribute "cmusaslsecretOTP" is the default value. -+.TP -+.B sasl\-auxprops\-dontusecopy\-ignore on | off -+Used to disable replication of the attribute(s) defined by -+sasl-auxprops-dontusecopy and instead use a local value for the attribute. This -+allows the SASL mechanism to continue to work if the provider is offline. This can -+cause replication inconsistency. Defaults to off. -+.TP -+.B sasl\-host -+Used to specify the fully qualified domain name used for SASL processing. -+.TP -+.B sasl\-realm -+Specify SASL realm. Default is empty. -+.TP -+.B sasl\-cbinding none | tls-unique | tls-endpoint -+Specify the channel-binding type, see also LDAP_OPT_X_SASL_CBINDING. -+Default is none. -+.TP -+.B sasl\-secprops -+Used to specify Cyrus SASL security properties. -+The -+.B none -+flag (without any other properties) causes the flag properties -+default, "noanonymous,noplain", to be cleared. -+The -+.B noplain -+flag disables mechanisms susceptible to simple passive attacks. -+The -+.B noactive -+flag disables mechanisms susceptible to active attacks. -+The -+.B nodict -+flag disables mechanisms susceptible to passive dictionary attacks. -+The -+.B noanonymous -+flag disables mechanisms which support anonymous login. -+The -+.B forwardsec -+flag require forward secrecy between sessions. -+The -+.B passcred -+require mechanisms which pass client credentials (and allow -+mechanisms which can pass credentials to do so). -+The -+.B minssf= -+property specifies the minimum acceptable -+.I security strength factor -+as an integer approximate to effective key length used for -+encryption. 0 (zero) implies no protection, 1 implies integrity -+protection only, 128 allows RC4, Blowfish and other similar ciphers, -+256 will require modern ciphers. The default is 0. -+The -+.B maxssf= -+property specifies the maximum acceptable -+.I security strength factor -+as an integer (see minssf description). The default is INT_MAX. -+The -+.B maxbufsize= -+property specifies the maximum security layer receive buffer -+size allowed. 0 disables security layers. The default is 65536. -+.TP -+.B schemadn -+Specify the distinguished name for the subschema subentry that -+controls the entries on this server. The default is "cn=Subschema". -+.TP -+.B security -+Specify a set of security strength factors (separated by white space) -+to require (see -+.BR sasl\-secprops 's -+.B minssf -+option for a description of security strength factors). -+The directive may be specified globally and/or per-database. -+.B ssf= -+specifies the overall security strength factor. -+.B transport= -+specifies the transport security strength factor. -+.B tls= -+specifies the TLS security strength factor. -+.B sasl= -+specifies the SASL security strength factor. -+.B update_ssf= -+specifies the overall security strength factor to require for -+directory updates. -+.B update_transport= -+specifies the transport security strength factor to require for -+directory updates. -+.B update_tls= -+specifies the TLS security strength factor to require for -+directory updates. -+.B update_sasl= -+specifies the SASL security strength factor to require for -+directory updates. -+.B simple_bind= -+specifies the security strength factor required for -+.I simple -+username/password authentication. -+Note that the -+.B transport -+factor is measure of security provided by the underlying transport, -+e.g. ldapi:// (and eventually IPSEC). It is not normally used. -+.TP -+.B serverID [] -+Specify an integer ID from 0 to 4095 for this server. The ID may also be -+specified as a hexadecimal ID by prefixing the value with "0x". -+Non-zero IDs are required when using multi-provider replication and each -+provider must have a unique non-zero ID. Note that this requirement also -+applies to separate providers contributing to a glued set of databases. -+If the URL is provided, this directive may be specified -+multiple times, providing a complete list of participating servers -+and their IDs. The fully qualified hostname of each server should be -+used in the supplied URLs. The IDs are used in the "replica id" field -+of all CSNs generated by the specified server. The default value is zero, which -+is only valid for single provider replication. -+Example: -+.LP -+.nf -+ serverID 1 ldap://ldap1.example.com -+ serverID 2 ldap://ldap2.example.com -+.fi -+.TP -+.B sizelimit {|unlimited} -+.TP -+.B sizelimit size[.{soft|hard}]= [...] -+Specify the maximum number of entries to return from a search operation. -+The default size limit is 500. -+Use -+.B unlimited -+to specify no limits. -+The second format allows a fine grain setting of the size limits. -+If no special qualifiers are specified, both soft and hard limits are set. -+Extra args can be added on the same line. -+Additional qualifiers are available; see -+.BR limits -+for an explanation of all of the different flags. -+.TP -+.B sockbuf_max_incoming -+Specify the maximum incoming LDAP PDU size for anonymous sessions. -+The default is 262143. -+.TP -+.B sockbuf_max_incoming_auth -+Specify the maximum incoming LDAP PDU size for authenticated sessions. -+The default is 4194303. -+.TP -+.B sortvals [...] -+Specify a list of multi-valued attributes whose values will always -+be maintained in sorted order. Using this option will allow Modify, -+Compare, and filter evaluations on these attributes to be performed -+more efficiently. The resulting sort order depends on the -+attributes' syntax and matching rules and may not correspond to -+lexical order or any other recognizable order. -+.TP -+.B tcp-buffer [listener=] [{read|write}=] -+Specify the size of the TCP buffer. -+A global value for both read and write TCP buffers related to any listener -+is defined, unless the listener is explicitly specified, -+or either the read or write qualifiers are used. -+See -+.BR tcp (7) -+for details. -+Note that some OS-es implement automatic TCP buffer tuning. -+.TP -+.B threads -+Specify the maximum size of the primary thread pool. -+The default is 16; the minimum value is 2. -+.TP -+.B threadqueues -+Specify the number of work queues to use for the primary thread pool. -+The default is 1 and this is typically adequate for up to 8 CPU cores. -+The value should not exceed the number of CPUs in the system. -+.TP -+.B timelimit {|unlimited} -+.TP -+.B timelimit time[.{soft|hard}]= [...] -+Specify the maximum number of seconds (in real time) -+.B slapd -+will spend answering a search request. The default time limit is 3600. -+Use -+.B unlimited -+to specify no limits. -+The second format allows a fine grain setting of the time limits. -+Extra args can be added on the same line. See -+.BR limits -+for an explanation of the different flags. -+.TP -+.B tool\-threads -+Specify the maximum number of threads to use in tool mode. -+This should not be greater than the number of CPUs in the system. -+The default is 1. -+.TP -+.B writetimeout -+Specify the number of seconds to wait before forcibly closing -+a connection with an outstanding write. This allows recovery from -+various network hang conditions. A writetimeout of 0 disables this -+feature. The default is 0. -+.SH TLS OPTIONS -+If -+.B slapd -+is built with support for Transport Layer Security, there are more options -+you can specify. -+.TP -+.B TLSCipherSuite -+Permits configuring what ciphers will be accepted and the preference order. -+ should be a cipher specification for the TLS library -+in use (OpenSSL or GnuTLS). -+Example: -+.RS -+.RS -+.TP -+.I OpenSSL: -+TLSCipherSuite HIGH:MEDIUM:+SSLv2 -+.TP -+.I GnuTLS: -+TLSCiphersuite SECURE256:!AES-128-CBC -+.RE -+ -+To check what ciphers a given spec selects in OpenSSL, use: -+ -+.nf -+ openssl ciphers \-v -+.fi -+ -+With GnuTLS the available specs can be found in the manual page of -+.BR gnutls\-cli (1) -+(see the description of the -+option -+.BR \-\-priority ). -+ -+In older versions of GnuTLS, where gnutls\-cli does not support the option -+\-\-priority, you can obtain the \(em more limited \(em list of ciphers by calling: -+ -+.nf -+ gnutls\-cli \-l -+.fi -+.RE -+.TP -+.B TLSCACertificateFile -+Specifies the file that contains certificates for all of the Certificate -+Authorities that -+.B slapd -+will recognize. The certificate for -+the CA that signed the server certificate must(GnuTLS)/may(OpenSSL) be included among -+these certificates. If the signing CA was not a top-level (root) CA, -+certificates for the entire sequence of CA's from the signing CA to -+the top-level CA should be present. Multiple certificates are simply -+appended to the file; the order is not significant. -+.TP -+.B TLSCACertificatePath -+Specifies the path of directories that contain Certificate Authority -+certificates in separate individual files. Usually only one of this -+or the TLSCACertificateFile is used. If both are specified, both -+locations will be used. Multiple directories may be specified, -+separated by a semi-colon. -+.TP -+.B TLSCertificateFile -+Specifies the file that contains the -+.B slapd -+server certificate. -+ -+When using OpenSSL that file may also contain any number of intermediate -+certificates after the server certificate. -+.TP -+.B TLSCertificateKeyFile -+Specifies the file that contains the -+.B slapd -+server private key that matches the certificate stored in the -+.B TLSCertificateFile -+file. Currently, the private key must not be protected with a password, so -+it is of critical importance that it is protected carefully. -+.TP -+.B TLSDHParamFile -+This directive specifies the file that contains parameters for Diffie-Hellman -+ephemeral key exchange. This is required in order to use a DSA certificate on -+the server, or an RSA certificate missing the "key encipherment" key usage. -+Note that setting this option may also enable -+Anonymous Diffie-Hellman key exchanges in certain non-default cipher suites. -+Anonymous key exchanges should generally be avoided since they provide no -+actual client or server authentication and provide no protection against -+man-in-the-middle attacks. -+You should append "!ADH" to your cipher suites to ensure that these suites -+are not used. -+.TP -+.B TLSECName -+Specify the name of the curve(s) to use for Elliptic curve Diffie-Hellman -+ephemeral key exchange. This option is only used for OpenSSL. -+This option is not used with GnuTLS; the curves may be -+chosen in the GnuTLS ciphersuite specification. -+.TP -+.B TLSProtocolMin [.] -+Specifies minimum SSL/TLS protocol version that will be negotiated. -+If the server doesn't support at least that version, -+the SSL handshake will fail. -+To require TLS 1.x or higher, set this option to 3.(x+1), -+e.g., -+ -+.nf -+ TLSProtocolMin 3.2 -+.fi -+ -+would require TLS 1.1. -+Specifying a minimum that is higher than that supported by the -+OpenLDAP implementation will result in it requiring the -+highest level that it does support. -+This directive is ignored with GnuTLS. -+.TP -+.B TLSRandFile -+Specifies the file to obtain random bits from when /dev/[u]random -+is not available. Generally set to the name of the EGD/PRNGD socket. -+The environment variable RANDFILE can also be used to specify the filename. -+This directive is ignored with GnuTLS. -+.TP -+.B TLSVerifyClient -+Specifies what checks to perform on client certificates in an -+incoming TLS session, if any. -+The -+.B -+can be specified as one of the following keywords: -+.RS -+.TP -+.B never -+This is the default. -+.B slapd -+will not ask the client for a certificate. -+.TP -+.B allow -+The client certificate is requested. If no certificate is provided, -+the session proceeds normally. If a bad certificate is provided, -+it will be ignored and the session proceeds normally. -+.TP -+.B try -+The client certificate is requested. If no certificate is provided, -+the session proceeds normally. If a bad certificate is provided, -+the session is immediately terminated. -+.TP -+.B demand | hard | true -+These keywords are all equivalent, for compatibility reasons. -+The client certificate is requested. If no certificate is provided, -+or a bad certificate is provided, the session is immediately terminated. -+ -+Note that a valid client certificate is required in order to use the -+SASL EXTERNAL authentication mechanism with a TLS session. As such, -+a non-default -+.B TLSVerifyClient -+setting must be chosen to enable SASL EXTERNAL authentication. -+.RE -+.TP -+.B TLSCRLCheck -+Specifies if the Certificate Revocation List (CRL) of the CA should be -+used to verify if the client certificates have not been revoked. This -+requires -+.B TLSCACertificatePath -+parameter to be set. This directive is ignored with GnuTLS. -+.B -+can be specified as one of the following keywords: -+.RS -+.TP -+.B none -+No CRL checks are performed -+.TP -+.B peer -+Check the CRL of the peer certificate -+.TP -+.B all -+Check the CRL for a whole certificate chain -+.RE -+.TP -+.B TLSCRLFile -+Specifies a file containing a Certificate Revocation List to be used -+for verifying that certificates have not been revoked. This directive is -+only valid when using GnuTLS. -+.SH GENERAL BACKEND OPTIONS -+Options in this section only apply to the configuration file section -+of all instances of the specified backend. All backends may support -+this class of options, but currently only back-mdb does. -+.TP -+.B backend -+Mark the beginning of a backend definition. -+should be one of -+.BR asyncmeta , -+.BR config , -+.BR dnssrv , -+.BR ldap , -+.BR ldif , -+.BR mdb , -+.BR meta , -+.BR monitor , -+.BR null , -+.BR passwd , -+.BR perl , -+.BR relay , -+.BR sock , -+.BR sql , -+or -+.BR wt . -+At present, only back-mdb implements any options of this type, so this -+setting is not needed for any other backends. -+ -+.SH GENERAL DATABASE OPTIONS -+Options in this section only apply to the configuration file section -+for the database in which they are defined. They are supported by every -+type of backend. Note that the -+.B database -+and at least one -+.B suffix -+option are mandatory for each database. -+.TP -+.B database -+Mark the beginning of a new database instance definition. -+should be one of -+.BR asyncmeta , -+.BR config , -+.BR dnssrv , -+.BR ldap , -+.BR ldif , -+.BR mdb , -+.BR meta , -+.BR monitor , -+.BR null , -+.BR passwd , -+.BR perl , -+.BR relay , -+.BR sock , -+.BR sql , -+or -+.BR wt , -+depending on which backend will serve the database. -+ -+LDAP operations, even subtree searches, normally access only one -+database. -+That can be changed by gluing databases together with the -+.B subordinate -+keyword. -+Access controls and some overlays can also involve multiple databases. -+.TP -+.B add_content_acl on | off -+Controls whether Add operations will perform ACL checks on -+the content of the entry being added. This check is off -+by default. See the -+.BR slapd.access (5) -+manual page for more details on ACL requirements for -+Add operations. -+.TP -+.B extra_attrs -+Lists what attributes need to be added to search requests. -+Local storage backends return the entire entry to the frontend. -+The frontend takes care of only returning the requested attributes -+that are allowed by ACLs. -+However, features like access checking and so may need specific -+attributes that are not automatically returned by remote storage -+backends, like proxy backends and so on. -+.B -+is a list of attributes that are needed for internal purposes -+and thus always need to be collected, even when not explicitly -+requested by clients. -+.TP -+.B hidden on | off -+Controls whether the database will be used to answer -+queries. A database that is hidden will never be -+selected to answer any queries, and any suffix configured -+on the database will be ignored in checks for conflicts -+with other databases. By default, hidden is off. -+.TP -+.B lastmod on | off -+Controls whether -+.B slapd -+will automatically maintain the -+modifiersName, modifyTimestamp, creatorsName, and -+createTimestamp attributes for entries. It also controls -+the entryCSN and entryUUID attributes, which are needed -+by the syncrepl provider. By default, lastmod is on. -+.TP -+.B lastbind on | off -+Controls whether -+.B slapd -+will automatically maintain the pwdLastSuccess attribute for -+entries. By default, lastbind is off. -+.TP -+.B lastbind-precision -+If lastbind is enabled, specifies how frequently pwdLastSuccess -+will be updated. More than -+.B integer -+seconds must have passed since the last successful bind. In a -+replicated environment with frequent bind activity it may be -+useful to set this to a large value. -+.TP -+.B limits [ [...]] -+Specify time and size limits based on the operation's initiator or -+base DN. -+The argument -+.B -+can be any of -+.RS -+.RS -+.TP -+anonymous | users | [=] | group[/oc[/at]]= -+ -+.RE -+with -+.RS -+.TP -+ ::= dn[.][.