| # Copyright © Joshua Tree Software, LLC, 2009-2013 All Rights Reserved. |
| # Fortress slapd.conf default settings. |
| # Note: Directives that begin with '@' are substitution parms for Fortress' build.xml 'init-slapd' target. |
| include @SCHEMA_PATH@/core.schema |
| include @SCHEMA_PATH@/ppolicy.schema |
| include @SCHEMA_PATH@/cosine.schema |
| include @SCHEMA_PATH@/inetorgperson.schema |
| include @SCHEMA_PATH@/nis.schema |
| include @SCHEMA_PATH@/openldap.schema |
| include @SCHEMA_PATH@/fortress.schema |
| |
| disallow bind_anon |
| idletimeout 0 |
| sizelimit 5000 |
| timelimit 60 |
| threads 8 |
| loglevel 32768 |
| gentlehup on |
| pidfile @PID_PATH@/slapd.pid |
| argsfile @PID_PATH@/slapd.args |
| modulepath @SLAPD_MODULE_PATH@ |
| moduleload @DB_MODULE_NM@ |
| moduleload ppolicy.la |
| moduleload accesslog.la |
| |
| ### ACLs |
| ### Allow users to read permission records (needed for OAM authorization): |
| access to dn.sub="ou=Permissions,ou=RBAC,@SUFFIX@" by users read |
| access to dn.sub="ou=AdminPerms,ou=ARBAC,@SUFFIX@" by users read |
| |
| access to dn.sub="ou=Permissions,ou=RBAC,ou=client123,@SUFFIX@" by users read |
| access to dn.sub="ou=AdminPerms,ou=ARBAC,ou=client123,@SUFFIX@" by users read |
| |
| access to dn.sub="ou=Permissions,ou=RBAC,ou=client456,@SUFFIX@" by users read |
| access to dn.sub="ou=AdminPerms,ou=ARBAC,ou=client456,@SUFFIX@" by users read |
| |
| access to dn.sub="ou=Permissions,ou=RBAC,ou=client789,@SUFFIX@" by users read |
| access to dn.sub="ou=AdminPerms,ou=ARBAC,ou=client789,@SUFFIX@" by users read |
| |
| ### This one allows user to modify their own password (needed for pw policies): |
| ### This also allows user to modify their own ftmod attributes (needed for audit): |
| access to attrs=userpassword,ftModCode,ftModId,ftModifier |
| by self write |
| by * auth |
| |
| ### Must allow access to dn.base to read supported features on this directory: |
| access to dn.base="" by * read |
| access to dn.base="cn=Subschema" by * read |
| access to * |
| by self write |
| by anonymous auth |
| |
| ### Disable null base search of rootDSE |
| ### This disables auto-discovery capabilities of clients. |
| # Changed -> access to dn.base="" by * read <- to the following: |
| access to dn.base="" |
| by * none |
| password-hash {SSHA} |
| |
| ####################################################################### |
| # History DB Settings |
| ####################################################################### |
| database @DB_TYPE@ |
| @LOG_RDRS@ |
| @LOG_SIZE@ |
| suffix "@LOG_SUFFIX@" |
| rootdn "@LOG_ROOT_DN@" |
| rootpw "@LOG_ROOT_PW@" |
| index objectClass,reqDN,reqAuthzID,reqStart,reqAttr eq |
| directory @HISTORY_DB_PATH@ |
| access to * |
| by dn.base="@LOG_ROOT_DN@" write |
| @LOG_DBNOSYNCH@ |
| @LOG_CHECKPOINT@ |
| @LOG_BDB_CACHE_SIZE@ |
| |
| ####################################################################### |
| # Default DB Settings |
| ####################################################################### |
| database @DB_TYPE@ |
| @DFLT_RDRS@ |
| @DFLT_SIZE@ |
| suffix "@SUFFIX@" |
| rootdn "@ROOT_DN@" |
| rootpw "@ROOT_PW@" |
| #index ou,uid,uidNumber,gidNumber,objectclass eq,pres |
| #index cn,sn eq,sub |
| #index ftId,ftPermName,ftObjNm,ftOpNm,ftRoles,ftUsers,ftRA,ftARA,ftRoleName eq |
| |
| index uidNumber,gidNumber,objectclass eq,pres |
| index cn,sn,ftObjNm,ftOpNm,ftRoleName,uid,ou eq,sub |
| index ftId,ftPermName,ftRoles,ftUsers,ftRA,ftARA eq |
| |
| directory @DEFAULT_DB_PATH@ |
| overlay accesslog |
| logdb "@LOG_SUFFIX@" |
| @DFLT_DBNOSYNCH@ |
| @DFLT_CHECKPOINT@ |
| @DFLT_BDB_CACHE_SIZE@ |
| @DFLT_BDB_CACHE_IDLE_SIZE@ |
| |
| ####################################################################### |
| # Audit Log Settings |
| ####################################################################### |
| @LOGOPS@ |
| logoldattr ftModifier ftModCode ftModId ftRC ftRA ftARC ftARA ftCstr ftId ftPermName ftObjNm ftOpNm ftObjId ftGroups ftRoles ftUsers ftType |
| logpurge 5+00:00 1+00:00 |
| |
| ####################################################################### |
| # PW Policy Settings |
| ####################################################################### |
| # Enable the Password Policy overlay to enforce password policies on this database. |
| overlay ppolicy |
| ppolicy_default "cn=PasswordPolicy, ou=Policies, @SUFFIX@" |
| ppolicy_use_lockout |
| ppolicy_hash_cleartext |
