#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
# Schema files. Note that not all of these schemas co-exist peacefully.
# Use only those you need and leave the rest commented out.
include		/opt/symas/etc/openldap/schema/core.schema
include		/opt/symas/etc/openldap/schema/ppolicy.schema
#include		/opt/symas/etc/openldap/schema/connexitor.schema
#include		/opt/symas/etc/openldap/schema/corba.schema
include		/opt/symas/etc/openldap/schema/cosine.schema
include		/opt/symas/etc/openldap/schema/inetorgperson.schema
#include		/opt/symas/etc/openldap/schema/eduperson.schema
#include		/opt/symas/etc/openldap/schema/java.schema
#include		/opt/symas/etc/openldap/schema/krb5-kdc.schema
include		/opt/symas/etc/openldap/schema/misc.schema
include		/opt/symas/etc/openldap/schema/nis.schema
include		/opt/symas/etc/openldap/schema/openldap.schema
#include		/opt/symas/etc/openldap/schema/samba.schema

# TLS Setup Section
#
# TLSCACertificateFile <filename>
#   Specifies the file that contains certificates for all
#   of the Certificate Authorities that slapd will
#   recognize.
TLSCACertificateFile /opt/symas/ssl/certs/crmsldap.company_public.pem

#
# TLSCertificateFile <filename>
#   Specifies the  file  that  contains  the  slapd  server
#   certificate.
TLSCertificateFile /opt/symas/ssl/certs/crmsldap.company_public.pem

#
# TLSCertificateKeyFile <filename>
#   Specifies the  file that contains the slapd server
#   private  key that matches the certificate stored in the
#   TLSCertificateFile file.  Currently, the private key
#   must not be protected  with  a password, so it is of
#   critical importance that it is protected carefully.
TLSCertificateKeyFile /opt/symas/ssl/certs/crmsldap.company.pem

#
# TLSRandFile <filename>
#   Specifies the file from which to obtain random  bits when
#   /dev/[u]random is not available. Generally set to the
#   name of the EGD/PRNGD socket. The environment variable
#   RANDFILE can also be used to specify the filename.
#TLSRandFile	/var/symas/egd-pool

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

# Files in which to store the process id and startup arguments.
# These files are needed by the init scripts, so only change
# these if you are prepared to edit those scripts as well.
pidfile			/var/symas/slapd.pid
argsfile		/var/symas/slapd.args

# Symas OpenLDAP supports threaded slapadd.  This is only useful if running
# slapadd on a multi-cpu box.  Generally, assign 1 thread per
# cpu, so if it is a 4 cpu box, use tool-threads 4.  This
# specifically affects the creation of index databases, so if
# your database has fewer indices than CPUs, set it to the
# number of indices.
#tool-threads 2

# Choose the directory for loadable modules.
modulepath	/opt/symas/lib/openldap

# Uncomment the moduleloads as needed to enable backend
# functionality.
# Load dynamic backend modules:
moduleload	back_bdb.la
#moduleload	back_hdb.la
#moduleload	back_ldap.la
#moduleload	back_meta.la
moduleload	back_monitor.la

# Uncomment the following moduleload to add support for 
# referential integrity. Refer to the example below and to
# slapo-integrity(5) for additional information.
#moduleload	refint.la

# Uncomment the following moduleload to add support for 
# password policies. Refer to the example below and to
# slapo-ppolicy(5) for additional information.
moduleload	ppolicy.la

# Uncomment the following moduleload to add support for 
# attribute uniqueness. Refer to the example below and to
# slapo-unique(5) for additional information.
#moduleload	unique.la

# Uncomment the following moduleload to add support for NTLM
# hashes. This option is useful if you are importing passwords
# from an NT Domain Controller or want to replicate to an NT4
# PDC using hashed passwords.
#moduleload	pwntlm.la

# Uncomment the following moduleload to add support for
# dynamic groups. This module greatly simplifies group
# management.
#moduleload	dyngroup.la

# Uncomment the following moduleload to add support for
# the obsolete draft-weltman-ldapb3-proxy-05 revision of the
# LDAP Proxy Authorization control. This module is only 
# intended to provide compatibility in environments where
# other servers only recognize this old control.
# New installations should not use this code.
#moduleload 	proxyOld.la

# Sample access control policy:
#	Allow read access of root DSE
#	Allow self write access
#	Allow authenticated users read access
#	Allow anonymous users to authenticate
# Directives needed to implement policy:
#access to dn="" by * read
#access to *
#	by self write
#	by users read
#	by anonymous auth

access to attr=userPassword
        by self write
        by * auth

access to *
        by self write
        by * read


#
# if no access controls are present, the default policy is:
#	Allow read by all
#
# rootdn can always write!

#######################################################################
# Sample bdb database definitions
#######################################################################
database	bdb
suffix		"dc=crmsldap,dc=company"
rootdn		"cn=Manager,dc=crmsldap,dc=company"
# Cleartext passwords, especially for the rootdn, should
# be avoided. See slappasswd(8) and slapd.conf(5) for details describing
# the creation of encrypted passwords.
rootpw	secret

# Indices to maintain

# index default sets the basic type of indexing to perform if there isn't any indexing specified for a given attribute
index	default		eq
index	objectClass
index	cn

# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd/tools. Mode 700 recommended.
# One directory will be needed for each backend, so you should
# create a subdirectory beneath /var/symas/openldap-data for each
# new backend. This is also where the DB_CONFIG file needs to be
# placed.
directory	/var/symas/openldap-data/

# The cache size should be large enough to hold the working set of
# entries, if possible. The cache size is measured in number of
# entries and is distinct from the set_cachesize option in the
# DB_CONFIG file.
cachesize	5000

# Each IDL holds the search results from a given query, so the IDL
# cache will end up holding the most frequently requested search
# results.  Therefore, you want the idl cache size to be large
# enough to hold some good set of results
idlcachesize	5000

# Checkpoints cause the transaction log buffers to be flushed out
# to disk. This option takes the form:
#	checkpoint	<kbyte>	<minutes>
# This allows you to cause checkpoints to take place after a certain
# number of kbytes have been written to the log file or at certain
# certain time intervals. Small values cause checkpoints to be
# performed more often, and the chance of not being able to recover
# transactions after a system crash is relatively small. The downside
# is that write performance can suffer. Larger values will keep write
# performance up, but increase the chances of not being able to recover
# transactions after a system crash.
#
checkpoint	512	60

# Uncomment these lines if you want to use the Referential Integrity
# overlay to enforce referential integrity within a subtree:

# Load an instance of the RefInt overlay for the current database:
#overlay	integrity

# By default, integrity operates over the entire database for which it has
# been configured. To enforce integrity in a different tree, use the
# base parameter as shown here:
#integrity_base		"dc=subtree,dc=example,dc=com"

# Specify a list of attribute names for which referential integrity
# is enforced.
#integrity_attributes	manager secretary

# Uncomment these lines if you want to use the Attribute Uniqueness
# overlay to enforce attribute uniqueness within a subtree:

# Load an instance of the unique overlay for the current database:
#overlay	unique

# By default, unique operates over the entire database for which it has
# been configured. To enforce uniqueness against a different tree, use
# the base parameter as shown here:
#unique_base		"dc=subtree,dc=example,dc=com"

# Specify a list of attribute names which must be unique. If not
# configured, all non-operational (eg, system) and non-ignored (see
# below) attributes must be unique within the entire tree.
#unique_attributes	uid cn

# Specify a list of attribute names for which uniqueness is NOT
# enforced. Note: this example default is almost always required,
# as these attributes are not unique, nor are they operational.
#unique_ignore		objectClass dc ou o

# Require null values to be unique; by default, uniqueness is not
# enforced for a null value.
#unique_strict

# Uncomment these lines if you want to use the Password Policy
# overlay to enforce password policies on this database.

# Load an instance of the ppolicy overlay for the current database:
overlay	ppolicy

# Specify the default password policy subentry to use when none is
# specified in an account's entry
ppolicy_default	"cn=defaultPolicy,ou=policies,dc=crmsldap,dc=company"
ppolicy_hash_cleartext
#ppolicy_use_lockout

# Uncomment these lines if you want to use the Proxy Override
# overlay to provide translucent access to a remote LDAP server:

# Load an instance of the translucent overlay for the current database:
# NOTE: this overlay requires the "back-ldap" backend to be loaded!
#overlay	translucent

# Don't automatically create parent "glue" entries to anchor records
# created via add or modrdn operations. (Glue is always created for
# modify requests.)
#translucent_no_glue

# Strict mode causes any attempt to delete records or attributes from
# the remote database to result in an error. By default, these operations
# are silently ignored:
#translucent_strict

# The remainder of these directives are interpreted by back-ldap, and
# are described more fully in the slapd-ldap(5) manual page:
#
# Don't pass operational attributes related to entry creation/modification:
#lastmod		off
#
# URI of the remote server:
#uri		ldap://remote-server:9009
#
# DN used to query the remote server for ACL checking
#binddn		uid=binder,o=remote
#
# Password to be used with the above binddn:
#bindpw		bindtest
#
# Map all remote objectClasses and Attributes to the same objectClases and
# Attributes on the local server:
#map		objectclass	*	*
#map		attribute	*	*
#######################################################################
# Monitor database
#######################################################################
database	monitor
