#
#   Licensed to the Apache Software Foundation (ASF) under one
#   or more contributor license agreements.  See the NOTICE file
#   distributed with this work for additional information
#   regarding copyright ownership.  The ASF licenses this file
#   to you under the Apache License, Version 2.0 (the
#   "License"); you may not use this file except in compliance
#   with the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
#   Unless required by applicable law or agreed to in writing,
#   software distributed under the License is distributed on an
#   "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
#   KIND, either express or implied.  See the License for the
#   specific language governing permissions and limitations
#   under the License.
#

#
# Fortress slapd.conf default settings.
# Note: Directives that begin with '@' are substitution parms for Fortress' build.xml 'init-slapd' target.

include		@SCHEMA_PATH@/core.schema
include		@SCHEMA_PATH@/ppolicy.schema
include		@SCHEMA_PATH@/cosine.schema
include		@SCHEMA_PATH@/inetorgperson.schema
include		@SCHEMA_PATH@/nis.schema
include		@SCHEMA_PATH@/openldap.schema
include		@SCHEMA_PATH@/fortress.schema
@IS_RBAC_ACCELERATOR@include		@SCHEMA_PATH@/rbac.schema

### SSL Configuration
@IS_SSL@TLSCACertificateFile @CA_CERT_FILEW@
@IS_SSL@TLSCertificateFile @CERT_FILEW@
@IS_SSL@TLSCertificateKeyFile @CERT_KEY_FILEW@

disallow bind_anon
idletimeout 0
sizelimit 5000
timelimit 60
threads 8
loglevel 32768
gentlehup on
sortvals  roleOccupant
pidfile		@PID_PATH@/slapd.pid
argsfile	@PID_PATH@/slapd.args
modulepath	@SLAPD_MODULE_PATH@
moduleload	@DB_MODULE_NM@
moduleload	ppolicy.la
moduleload  accesslog.la
@RBAC_MODULE@
@DDS_MODULE@
@MONITOR_MODULE@

# ACLS:
access to dn.base=""
  by * read

# LDAPv3 Schema
access to dn.base="cn=subschema"
  by * read

# Internal OpenLDAP config backend
access to dn.subtree="cn=config"
  by * none

# Monitor backend
@IS_RBAC_ACCELERATOR@access to dn.subtree="cn=monitor"
@IS_RBAC_ACCELERATOR@  by dn.base="@ROOT_DN@" write
@IS_RBAC_ACCELERATOR@  by users read

# Generic overall privilege
access to *
  by anonymous auth
  by dn.base="@ROOT_DN@" manage
  by * break

# Password should be protected, allow user to modify their own audit attributes.
access to attrs=userPassword,ftModifier,ftModCode,ftModId
  by self =wx
  by * none

# Self-readable password policy info
access to attrs=pwdFailureTime,pwdChangedTime,pwdGraceUseTime,pwdReset,pwdPolicySubentry
  by self read
  by * none

# Admin-only password policy info
access to attrs=pwdAccountLockedTime,pwdHistory
  by * none

# Users may read their own attributes
access to attrs=@inetorgperson
  by users read
  by * none

access to attrs=@shadowAccount
  by * none

access to * by users read

password-hash {SSHA}

#######################################################################
# History DB Settings
#######################################################################
database	 @DB_TYPE@
@LOG_RDRS@
@LOG_SIZE@
suffix		"@LOG_SUFFIX@"
rootdn      "@LOG_ROOT_DN@"
rootpw      "@LOG_ROOT_PW@"
index objectClass,reqDN,reqAuthzID,reqStart,reqAttr eq
directory	"@HISTORY_DB_PATH@"
access to *
    by dn.base="@LOG_ROOT_DN@" write
@LOG_DBNOSYNCH@
@LOG_CHECKPOINT@
@LOG_BDB_CACHE_SIZE@

#######################################################################
# Default DB Settings
#######################################################################
database	@DB_TYPE@
@DFLT_RDRS@
@DFLT_SIZE@
suffix		"@SUFFIX@"
rootdn      "@ROOT_DN@"
rootpw      "@ROOT_PW@"

index uidNumber,gidNumber,objectclass eq
index cn,sn,ftObjNm,ftOpNm,ftRoleName,uid,ou eq,sub
index ftId,ftPermName,ftRoles,ftUsers,ftRA,ftARA eq

directory	"@DEFAULT_DB_PATH@"
overlay accesslog
logdb   "@LOG_SUFFIX@"
@DFLT_DBNOSYNCH@
@DFLT_CHECKPOINT@
@DFLT_BDB_CACHE_SIZE@
@DFLT_BDB_CACHE_IDLE_SIZE@

#######################################################################
# Audit Log Settings
#######################################################################
@LOGOPS@
logoldattr ftModifier ftModCode ftModId ftRC ftRA ftARC ftARA ftCstr ftId ftPermName ftObjNm ftOpNm ftObjId ftGroups ftRoles ftUsers ftType
logpurge 5+00:00 1+00:00

#######################################################################
# PW Policy Settings
#######################################################################
# Enable the Password Policy overlay to enforce password policies on this database.
overlay     ppolicy
ppolicy_default "cn=PasswordPolicy,@POLICIES_DN@"
ppolicy_use_lockout
ppolicy_hash_cleartext

#######################################################################
# RBAC Session database
#######################################################################
@IS_RBAC_ACCELERATOR@database mdb
@IS_RBAC_ACCELERATOR@suffix     "@SESSIONS_DN@"
@IS_RBAC_ACCELERATOR@rootdn	    "cn=manager,@SESSIONS_DN@"
@IS_RBAC_ACCELERATOR@rootpw	    @LOG_ROOT_PW@
@IS_RBAC_ACCELERATOR@index  rbacSessid  eq
@IS_RBAC_ACCELERATOR@directory  "@RBACSESS_DB_PATH@"
@IS_RBAC_ACCELERATOR@overlay     dds
@IS_RBAC_ACCELERATOR@dds-default-ttl 3600
@IS_RBAC_ACCELERATOR@dds-max-dynamicObjects	100000
@IS_RBAC_ACCELERATOR@@DFLT_DBNOSYNCH@
@IS_RBAC_ACCELERATOR@@DFLT_CHECKPOINT@

#######################################################################
# RBAC audit database
#######################################################################
@IS_RBAC_ACCELERATOR@database	mdb
@IS_RBAC_ACCELERATOR@suffix		"@AUDITS_DN@"
@IS_RBAC_ACCELERATOR@rootdn		"cn=manager,@AUDITS_DN@"
@IS_RBAC_ACCELERATOR@rootpw		@LOG_ROOT_PW@
@IS_RBAC_ACCELERATOR@directory	"@AUDIT_DB_PATH@"
@IS_RBAC_ACCELERATOR@@DFLT_DBNOSYNCH@
@IS_RBAC_ACCELERATOR@@DFLT_CHECKPOINT@

#######################################################################
# RBAC database
#######################################################################
@IS_RBAC_ACCELERATOR@database	mdb
@IS_RBAC_ACCELERATOR@suffix		"@RBAC_DN@"
@IS_RBAC_ACCELERATOR@rootdn		"cn=manager,@RBAC_DN@"
@IS_RBAC_ACCELERATOR@rootpw		@LOG_ROOT_PW@
@IS_RBAC_ACCELERATOR@directory	"@RBACOVERLAY_DB_PATH@"
@IS_RBAC_ACCELERATOR@overlay	rbac
@IS_RBAC_ACCELERATOR@rbac-default-tenant-id "@SUFFIX_NAME@"
@IS_RBAC_ACCELERATOR@rbac-default-users-base-dn "@USERS_DN@"
@IS_RBAC_ACCELERATOR@rbac-default-roles-base-dn "@ROLES_DN@"
@IS_RBAC_ACCELERATOR@rbac-default-permissions-base-dn "@PERMS_DN@"
@IS_RBAC_ACCELERATOR@rbac-default-sessions-base-dn "@SESSIONS_DN@"
@IS_RBAC_ACCELERATOR@rbac-default-audit-base-dn "@AUDITS_DN@"
@IS_RBAC_ACCELERATOR@rbac-admin "@SUFFIX@"
@IS_RBAC_ACCELERATOR@rbac-pwd "secret"
@IS_RBAC_ACCELERATOR@rbac-session-admin "cn=manager,@SESSIONS_DN@"
@IS_RBAC_ACCELERATOR@rbac-session-admin-pwd secret

#######################################################################
# Monitor database
#######################################################################
@IS_RBAC_ACCELERATOR@database monitor