| # |
| # Licensed to the Apache Software Foundation (ASF) under one |
| # or more contributor license agreements. See the NOTICE file |
| # distributed with this work for additional information |
| # regarding copyright ownership. The ASF licenses this file |
| # to you under the Apache License, Version 2.0 (the |
| # "License"); you may not use this file except in compliance |
| # with the License. You may obtain a copy of the License at |
| # |
| # https://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, |
| # software distributed under the License is distributed on an |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| # KIND, either express or implied. See the License for the |
| # specific language governing permissions and limitations |
| # under the License. |
| # |
| # Note: Directives that begin with '@' are substitution parms that get automatically replaced. |
| |
| # Host name and port of LDAP DIT: |
| host=@LDAP_HOST@ |
| port=@LDAP_PORT@ |
| |
| # Used for SSL Connection to LDAP Server: |
| enable.ldap.ssl=@ENABLE_LDAP_SSL@ |
| enable.ldap.ssl.debug=@ENABLE_LDAP_SSL_DEBUG@ |
| trust.store=@TRUST_STORE@ |
| trust.store.password=@TRUST_STORE_PW@ |
| trust.store.onclasspath=@TRUST_STORE_ONCLASSPATHW@ |
| |
| # These credentials are used for read/write access to all nodes under suffix: |
| admin.user=@ROOT_DN@ |
| # LDAP admin root pass is encrypted using 'encrypt' target in build.xml: |
| admin.pw=@CFG_ROOT_PW@ |
| |
| # This is min/max connection pool settings for User's who access their accounts in ou=People: |
| # This is setting for ldap user's pool: |
| min.user.conn=@USR_MIN_CONN@ |
| max.user.conn=@USR_MAX_CONN@ |
| |
| # This is min/max settings for LDAP administrator pool which has read/write access to all nodes under suffix: |
| min.admin.conn=@ADM_MIN_CONN@ |
| max.admin.conn=@ADM_MAX_CONN@ |
| |
| # These credentials are used for read/write access to all nodes under slapd access log suffix: |
| log.admin.user=@LOG_ROOT_DN@ |
| # For corresponding log user: |
| log.admin.pw=@CFG_LOG_ROOT_PW@ |
| |
| # This is min/max settings for LDAP administrator pool connections that have read/write access to all nodes under suffix: |
| min.log.conn=@LOG_MIN_CONN@ |
| max.log.conn=@LOG_MAX_CONN@ |
| |
| # Applies to all pools, connection validated on retrieval with dummy ldapsearch. (default is false) |
| validate.conn.borrow=@VALIDATE_CONN_BORROW@ |
| # Applies to all pools, connection validated when idle with dummy ldapsearch. (default is false) |
| validate.conn.idle=@VALIDATE_CONN_IDLE@ |
| # Applies to all pools, when all connections are exhausted will block. (default is true) |
| max.conn.block=@MAX_CONN_BLOCK@ |
| # Applies to all pools, when all connections are exhausted will block for this many milliseconds. (default is 5000) |
| max.conn.block.time=@MAX_CONN_BLOCK_TIME@ |
| # The default TLS protocols support can be overridden here. Default is TLSv1, TLSv1.1, TLSv1.2: |
| #tls.enabled.protocols=TLSv1 |
| #tls.enabled.protocols=TLSv1.1 |
| #tls.enabled.protocols=TLSv1.2 |
| |
| validate.conn.borrow=@VALIDATE_CONN_BORROW@ |
| validate.conn.idle=@VALIDATE_CONN_IDLE@ |
| |
| # Disable storing user membership on role object, default is true: |
| role.occupants=@ROLE_OCCUPANTS@ |
| |
| # enable this to see trace statements when connection pool allocates new connections: |
| debug.ldap.pool=true |
| # Default for pool reconnect flag is false: |
| enable.pool.reconnect=true |
| authn.type=default |
| #authNType=realm |
| ldap.server.type=@SERVER_TYPE@ |
| |
| # Define the high-level structure of LDAP DIT: |
| suffix=@SUFFIX@ |
| config.root=ou=Config,@SUFFIX@ |
| user.root=@USERS_DN@ |
| pwpolicy.root=@POLICIES_DN@ |
| role.root=@ROLES_DN@ |
| perm.root=@PERMS_DN@ |
| sdconstraint.root=@CONSTRAINTS_DN@ |
| userou.root=@USEROUS_DN@ |
| permou.root=@PERMOUS_DN@ |
| adminrole.root=@ADMINROLES_DN@ |
| adminperm.root=@ADMINPERMS_DN@ |
| group.root=@GROUPS_DN@ |
| example.root=ou=Examples,@SUFFIX@ |
| |
| |
| # these properties will enable temporal constraint checks on role activations: |
| temporal.validator.0=org.apache.directory.fortress.core.util.time.Date |
| temporal.validator.1=org.apache.directory.fortress.core.util.time.LockDate |
| temporal.validator.2=org.apache.directory.fortress.core.util.time.Timeout |
| temporal.validator.3=org.apache.directory.fortress.core.util.time.ClockTime |
| temporal.validator.4=org.apache.directory.fortress.core.util.time.Day |
| |
| # enabling this property will enable Dynamic Separation of Duty constraint checks on role activations: |
| temporal.validator.dsd=org.apache.directory.fortress.core.impl.DSDChecker |
| |
| # Users in the following list cannot be deleted using OAM admin functions (AdminMgr.deleteUser, AdminMgr.forceDeleteUser) |
| sys.user.1=oamTU6User1 |
| sys.user.2=oamTU6User2 |
| sys.user.3=oamTU6User3 |
| sys.user.4=oamTU6User4 |
| sys.user.5=oamTU6User5 |
| |
| # Fortress Class Definitions: NOT NEEDED UNLESS OVERIDING DEFAULT IMPLEMENTATIONS |
| accessmgr.implementation=org.apache.directory.fortress.core.impl.AccessMgrImpl |
| auditmgr.implementation=org.apache.directory.fortress.core.impl.AuditMgrImpl |
| |
| ehcache.config.file=ehcache.xml |
| |
| ## Fortress Data Validation settings |
| field.length=130 |
| |
| ######### This section is for filtering out LDAP meta characters from search field input: |
| ######### Ensure the chars are placed in ASCII value ascending order. |
| |
| # This must match the total number of items that need to be filtered in our list: |
| ldap.filter.size=15 |
| |
| #! 33 0041 0x21 |
| ldap.filter.1=! |
| ldap.sub.1=21 |
| #% 37 0045 0x25 |
| ldap.filter.2=% |
| ldap.sub.2=25 |
| #& 38 0046 0x26 |
| ldap.filter.3=& |
| ldap.sub.3=26 |
| #( 40 0050 0x28 |
| ldap.filter.4=( |
| ldap.sub.4=28 |
| #) 41 0051 0x29 |
| ldap.filter.5=) |
| ldap.sub.5=29 |
| #* 42 0052 0x2a |
| ldap.filter.6=* |
| ldap.sub.6=2a |
| #+ 43 0053 0x2b |
| ldap.filter.7=+ |
| ldap.sub.7=2b |
| #- 45 0055 0x2d |
| ldap.filter.8=- |
| ldap.sub.8=2d |
| #/ 47 0057 0x2f |
| ldap.filter.9=/ |
| ldap.sub.9=2f |
| #< 60 0074 0x3c |
| ldap.filter.10=< |
| ldap.sub.10=3c |
| #= 61 0075 0x3d |
| ldap.filter.11== |
| ldap.sub.11=3d |
| #> 62 0076 0x3e |
| ldap.filter.12=> |
| ldap.sub.12=3e |
| #\ 92 0134 0x5c |
| ldap.filter.13=\\ |
| ldap.sub.13=5c |
| #| 124 0174 0x7c |
| ldap.filter.14=| |
| ldap.sub.14=7c |
| #~ 126 0176 0x7e |
| ldap.filter.15=~ |
| ldap.sub.15=7e |
| |
| #keep alphanumerics and dashes |
| #regXSafetext=^A-Za-z0-9- . |
| |
| user.objectclass=inetOrgPerson |
| group.objectclass=@GROUP_OBJECT_CLASS@ |
| group.protocol=@GROUP_PROTOCOL@ |
| group.properties=@GROUP_PROPERTIES@ |
| crypto.prop=@CFG_CRYPTO_PROP@ |
| disable.audit=@IS_AUDIT@ |
| clientside.sorting=true |
| attr.delimiter=$ |
| |
| # These are used to enable RFC2307bis support on User and Role entities: |
| rfc2307=@IS_RFC2307@ |
