| # |
| # Licensed to the Apache Software Foundation (ASF) under one |
| # or more contributor license agreements. See the NOTICE file |
| # distributed with this work for additional information |
| # regarding copyright ownership. The ASF licenses this file |
| # to you under the Apache License, Version 2.0 (the |
| # "License"); you may not use this file except in compliance |
| # with the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, |
| # software distributed under the License is distributed on an |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| # KIND, either express or implied. See the License for the |
| # specific language governing permissions and limitations |
| # under the License. |
| # |
| # |
| # Apache Fortress OpenLDAP slapd.conf default settings. |
| # Note: Directives that begin with '@' are substitution parms that get automatically replaced. |
| |
| include @SCHEMA_PATH@/core.schema |
| include @SCHEMA_PATH@/ppolicy.schema |
| include @SCHEMA_PATH@/cosine.schema |
| include @SCHEMA_PATH@/inetorgperson.schema |
| include @SCHEMA_PATH@/rfc2307bis.schema |
| include @SCHEMA_PATH@/openldap.schema |
| include @SCHEMA_PATH@/fortress.schema |
| @IS_RBAC_ACCELERATOR@include @SCHEMA_PATH@/rbac.schema |
| |
| ### SSL Configuration |
| @IS_SSL@TLSCACertificateFile @CA_CERT_FILEW@ |
| @IS_SSL@TLSCertificateFile @CERT_FILEW@ |
| @IS_SSL@TLSCertificateKeyFile @CERT_KEY_FILEW@ |
| |
| disallow bind_anon |
| idletimeout 0 |
| sizelimit 5000 |
| timelimit 60 |
| threads 8 |
| loglevel 32768 |
| gentlehup on |
| sortvals roleOccupant |
| pidfile @PID_PATH@/slapd.pid |
| argsfile @PID_PATH@/slapd.args |
| modulepath @SLAPD_MODULE_PATH@ |
| moduleload @DB_MODULE_NM@ |
| moduleload ppolicy.la |
| moduleload accesslog.la |
| @RBAC_MODULE@ |
| @DDS_MODULE@ |
| @MONITOR_MODULE@ |
| |
| # Global ACLS: |
| # RootDSE is always readable |
| access to dn.base="" by * read |
| |
| # For tooling: |
| access to dn.base="cn=subschema" |
| by * read |
| |
| password-hash {SSHA} |
| |
| ####################################################################### |
| # Access Log DB Settings |
| ####################################################################### |
| database @DB_TYPE@ |
| @LOG_RDRS@ |
| @LOG_SIZE@ |
| suffix "@LOG_SUFFIX@" |
| rootdn "@LOG_ROOT_DN@" |
| rootpw "@LOG_ROOT_PW@" |
| index objectClass,reqDN,reqAuthzID,reqStart,reqAttr eq |
| directory "@HISTORY_DB_PATH@" |
| access to * |
| by dn.base="@LOG_ROOT_DN@" write |
| @LOG_DBNOSYNCH@ |
| @LOG_CHECKPOINT@ |
| @LOG_BDB_CACHE_SIZE@ |
| |
| # Accesslog is readable by replicator and fortress: |
| access to dn.subtree="@LOG_SUFFIX@" |
| by dn.exact="cn=replicator,dc=admin,@SUFFIX@" read |
| by dn.exact="cn=fortress-admin,dc=admin,@SUFFIX@" read |
| by * break |
| |
| ####################################################################### |
| # Default DB Settings |
| ####################################################################### |
| database @DB_TYPE@ |
| @DFLT_RDRS@ |
| @DFLT_SIZE@ |
| suffix "@SUFFIX@" |
| rootdn "@ROOT_DN@" |
| rootpw "@ROOT_PW@" |
| |
| index uidNumber,gidNumber,objectclass eq |
| index cn,sn,ftObjNm,ftOpNm,ftRoleName,uid,ou eq,sub |
| index ftId,ftPermName,ftRoles,ftUsers,ftRA,ftARA eq |
| index roleOccupant eq |
| |
| directory "@DEFAULT_DB_PATH@" |
| overlay accesslog |
| logdb "@LOG_SUFFIX@" |
| @DFLT_DBNOSYNCH@ |
| @DFLT_CHECKPOINT@ |
| @DFLT_BDB_CACHE_SIZE@ |
| @DFLT_BDB_CACHE_IDLE_SIZE@ |
| |
| # The fortress admin needs write access to the whole DIT |
| access to dn.subtree="@SUFFIX@" |
| by dn.exact="cn=fortress-admin,dc=admin,@SUFFIX@" write |
| by * break |
| |
| # Accesslog is readable by replicator and fortress: |
| access to dn.subtree="@LOG_SUFFIX@" |
| by dn.exact="cn=replicator,dc=admin,@SUFFIX@" read |
| by dn.exact="cn=fortress-admin,dc=admin,@SUFFIX@" read |
| by * break |
| |
| # Allow anonymous ability to bind: |
| access to dn.subtree="@SUFFIX@" attrs=userPassword |
| by anonymous auth |
| by * break |
| |
| # For audit trail: |
| # Allow users access to modify their own pw & fortress audit attrs. |
| access to dn.subtree="@SUFFIX@" attrs=userPassword,ftModifier,ftModCode,ftModId |
| by self =wx |
| by * none |
| |
| # Allow users compare access to a fortress perm op name: |
| access to dn.subtree="@SUFFIX@" attrs=ftOpNm |
| by users compare |
| |
| ####################################################################### |
| # More Audit Log Settings |
| ####################################################################### |
| @LOGOPS@ |
| logoldattr ftModifier ftModCode ftModId ftRC ftRA ftARC ftARA ftCstr ftId ftPermName ftObjNm ftOpNm ftObjId ftGroups ftRoles ftUsers ftType |
| logpurge 5+00:00 1+00:00 |
| |
| ####################################################################### |
| # PW Policy Settings |
| ####################################################################### |
| # Enable the Password Policy overlay to enforce password policies on this database. |
| overlay ppolicy |
| ppolicy_default "cn=PasswordPolicy,@POLICIES_DN@" |
| ppolicy_use_lockout |
| ppolicy_hash_cleartext |
| |
| ####################################################################### |
| # RBAC Session database |
| ####################################################################### |
| @IS_RBAC_ACCELERATOR@database mdb |
| @IS_RBAC_ACCELERATOR@suffix "@SESSIONS_DN@" |
| @IS_RBAC_ACCELERATOR@rootdn "cn=manager,@SESSIONS_DN@" |
| @IS_RBAC_ACCELERATOR@rootpw @LOG_ROOT_PW@ |
| @IS_RBAC_ACCELERATOR@index rbacSessid eq |
| @IS_RBAC_ACCELERATOR@directory "@RBACSESS_DB_PATH@" |
| @IS_RBAC_ACCELERATOR@overlay dds |
| @IS_RBAC_ACCELERATOR@dds-default-ttl 3600 |
| @IS_RBAC_ACCELERATOR@dds-max-dynamicObjects 100000 |
| @IS_RBAC_ACCELERATOR@@DFLT_DBNOSYNCH@ |
| @IS_RBAC_ACCELERATOR@@DFLT_CHECKPOINT@ |
| |
| ####################################################################### |
| # RBAC audit database |
| ####################################################################### |
| @IS_RBAC_ACCELERATOR@database mdb |
| @IS_RBAC_ACCELERATOR@suffix "@AUDITS_DN@" |
| @IS_RBAC_ACCELERATOR@rootdn "cn=manager,@AUDITS_DN@" |
| @IS_RBAC_ACCELERATOR@rootpw @LOG_ROOT_PW@ |
| @IS_RBAC_ACCELERATOR@directory "@AUDIT_DB_PATH@" |
| @IS_RBAC_ACCELERATOR@@DFLT_DBNOSYNCH@ |
| @IS_RBAC_ACCELERATOR@@DFLT_CHECKPOINT@ |
| |
| ####################################################################### |
| # RBAC database |
| ####################################################################### |
| @IS_RBAC_ACCELERATOR@database mdb |
| @IS_RBAC_ACCELERATOR@suffix "@RBAC_DN@" |
| @IS_RBAC_ACCELERATOR@rootdn "cn=manager,@RBAC_DN@" |
| @IS_RBAC_ACCELERATOR@rootpw @LOG_ROOT_PW@ |
| @IS_RBAC_ACCELERATOR@directory "@RBACOVERLAY_DB_PATH@" |
| @IS_RBAC_ACCELERATOR@overlay rbac |
| @IS_RBAC_ACCELERATOR@rbac-default-users-base-dn "@USERS_DN@" |
| @IS_RBAC_ACCELERATOR@rbac-default-roles-base-dn "@ROLES_DN@" |
| @IS_RBAC_ACCELERATOR@rbac-default-permissions-base-dn "@PERMS_DN@" |
| @IS_RBAC_ACCELERATOR@rbac-default-sessions-base-dn "@SESSIONS_DN@" |
| @IS_RBAC_ACCELERATOR@rbac-default-audit-base-dn "@AUDITS_DN@" |
| @IS_RBAC_ACCELERATOR@rbac-admin "@ROOT_DN@" |
| @IS_RBAC_ACCELERATOR@rbac-pwd "@ROOT_PW@" |
| @IS_RBAC_ACCELERATOR@rbac-session-admin "cn=manager,@SESSIONS_DN@" |
| @IS_RBAC_ACCELERATOR@rbac-session-admin-pwd @LOG_ROOT_PW@ |
| #@IS_RBAC_ACCELERATOR@rbac-default-tenant-id "@SUFFIX_NAME@" |
| |
| ####################################################################### |
| # Monitor database |
| ####################################################################### |
| @IS_RBAC_ACCELERATOR@database monitor |
