## OpenLDAP: slapd.conf for master server
##
## Template by: SATOH Fumiyasu @ OSS Technology Co.
##              http://www.osstech.co.jp/
## Date: 2007-01-29, since 2006-12-08

## Global configuration
## ======================================================================

include ##OPENLDAP_SYSCONF_DIR##/schema/core.schema
include ##OPENLDAP_SYSCONF_DIR##/schema/cosine.schema
include ##OPENLDAP_SYSCONF_DIR##/schema/nis.schema
include ##OPENLDAP_SYSCONF_DIR##/schema/inetorgperson.schema
include ##OPENLDAP_SYSCONF_DIR##/schema/samba.schema

pidfile ##OPENLDAP_RUN_DIR##/slapd/slapd.pid
argsfile ##OPENLDAP_RUN_DIR##/slapd/slapd.args
replica-pidfile ##OPENLDAP_RUN_DIR##/slurpd.pid
replica-argsfile ##OPENLDAP_RUN_DIR##/slurpd.args

threads 16
#tool-threads 1
loglevel 0
timelimit 10
idletimeout unlimited
sizelimit unlimited

#TLSCACertificateFile ##SSL_CERT_DIR##/ca.crt
#TLSCertificateFile ##OPENLDAP_CERT_DIR##/##LDAP_MASTER_NAME##.crt
#TLSCertificateKeyFile ##OPENLDAP_PRIVATE_DIR##/##LDAP_MASTER_NAME##.key

## Module
## ======================================================================

## For Debian
#modulepath ##OPENLDAP_LIB_DIR##
#moduleload back_bdb
#moduleload syncprov

## Database #1
## ======================================================================

database bdb
suffix "##LDAP_DIT_SUFFIX##"
directory ##OPENLDAP_DATA_DIR##

mode 0640
lastmod on
checkpoint 512 30

## BDB configurations
## Cache size
dbconfig set_cachesize 0 8388608 0
## Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 5000
## Number of locks (both requested and granted)
dbconfig set_lk_max_locks 5000
## Number of lockers
dbconfig set_lk_max_lockers 5000

## Index
## ----------------------------------------------------------------------

index objectClass		eq
index ou			eq
index cn			eq,sub
index sn			eq
index uid			eq
index displayName		eq
index mail			eq
index uidNumber			eq
index gidNumber			eq
index memberUID			eq

## For LDAP Sync provider
#index entryCSN			eq
#index entryUUID			eq

## For Samba
index sambaSID			eq,sub
index sambaPrimaryGroupSID	eq
index sambaDomainName		eq
## Samba 3.0.25? or later
#index sambaAcctFlags		sub

## Access control
## ----------------------------------------------------------------------

rootdn "##LDAP_ADMIN_DN##"
#rootpw {SSHA}xxxx

## Allow slave to syncrepl with master
access to *
	by dn="##LDAP_REPLICA_DN##" read
	by * break
## Allow master to update slave
#access to *
#	by dn="##LDAP_REPLICA_DN##" =xw
#	by * break

access to attrs=userPassword
	by dn="##SAMBA_ADMIN_DN##" write
	by anonymous auth
	by * none

access to attrs=sambaLMPassword,sambaNTPassword,sambaPasswordHistory
	by dn="##SAMBA_ADMIN_DN##" write
	by * none

access to *
	by dn="##SAMBA_ADMIN_DN##" write
	by * read

## Master configuration
## ----------------------------------------------------------------------

## Non-sync replication (slurpd)
replogfile ##OPENLDAP_DATA_DIR##/replog
replica uri="##LDAP_SLAVE_URI##"
	binddn="##LDAP_REPLICA_DN##"
	bindmethod=simple
	credentials=##LDAP_REPLICA_PASSWORD##

## Sync replication
#overlay syncprov
#syncprov-sessionlog 128

## Slave configuration
## ----------------------------------------------------------------------

#updatedn "##LDAP_REPLICA_DN##"
#updateref "##LDAP_MASTER_URI##"

## Sync replication
#syncrepl rid=1
#	provider="##LDAP_MASTER_URI##"
#	type=refreshAndPersist
#	interval=00:00:03:00
#	searchbase="##LDAP_DIT_SUFFIX##"
#	scope=sub
#	schemachecking=off
#	binddn="##LDAP_REPLICA_DN##"
#	bindmethod=simple
#	credentials=##LDAP_REPLICA_PASSWORD##