1# master slapd config -- for testing 2# OpenLDAP: pkg/ldap/tests/data/slapd-idassert.conf,v 1.16.2.9 2010/04/19 19:14:28 quanah Exp 3## This work is part of OpenLDAP Software <http://www.openldap.org/>. 4## 5## Copyright 1998-2010 The OpenLDAP Foundation. 6## All rights reserved. 7## 8## Redistribution and use in source and binary forms, with or without 9## modification, are permitted only as authorized by the OpenLDAP 10## Public License. 11## 12## A copy of this license is available in the file LICENSE in the 13## top-level directory of the distribution or, alternatively, at 14## <http://www.OpenLDAP.org/license.html>. 15 16#ucdata-path ./ucdata 17include @SCHEMADIR@/core.schema 18include @SCHEMADIR@/cosine.schema 19include @SCHEMADIR@/inetorgperson.schema 20include @SCHEMADIR@/openldap.schema 21include @SCHEMADIR@/nis.schema 22pidfile @TESTDIR@/slapd.1.pid 23argsfile @TESTDIR@/slapd.1.args 24 25#mod#modulepath ../servers/slapd/back-@BACKEND@/ 26#mod#moduleload back_@BACKEND@.la 27#ldapmod#modulepath ../servers/slapd/back-ldap/ 28#ldapmod#moduleload back_ldap.la 29#monitormod#modulepath ../servers/slapd/back-monitor/ 30#monitormod#moduleload back_monitor.la 31#rwmmod#modulepath ../servers/slapd/overlays/ 32#rwmmod#moduleload rwm.la 33 34####################################################################### 35# database definitions 36####################################################################### 37 38authz-policy both 39authz-regexp "^uid=admin/([^,]+),.+" "ldap:///ou=Admin,dc=example,dc=com??sub?(cn=$1)" 40authz-regexp "^uid=it/([^,]+),.+" "ldap:///ou=People,dc=example,dc=it??sub?(uid=$1)" 41authz-regexp "^uid=(us/)?([^,]+),.+" "ldap:///ou=People,dc=example,dc=com??sub?(uid=$2)" 42 43# 44# normal installations should protect root dse, 45# cn=monitor, cn=schema, and cn=config 46# 47 48access to attrs=userpassword 49 by self =wx 50 by anonymous =x 51 52access to dn.exact="" 53 by * read 54 55access to * 56 by users read 57 by * search 58 59database @BACKEND@ 60 61suffix "dc=example,dc=com" 62rootdn "cn=Manager,dc=example,dc=com" 63rootpw secret 64#null#bind on 65#~null~#directory @TESTDIR@/db.1.a 66#bdb#index objectClass eq 67#bdb#index cn,sn,uid pres,eq,sub 68#hdb#index objectClass eq 69#hdb#index cn,sn,uid pres,eq,sub 70#ndb#dbname db_1 71#ndb#include @DATADIR@/ndb.conf 72 73access to dn.exact="cn=Proxy,ou=Admin,dc=example,dc=com" 74 attrs=authzTo 75 by dn.exact="cn=Proxy,ou=Admin,dc=example,dc=com" =wx 76 by * =x 77 78database @BACKEND@ 79 80suffix "dc=example,dc=it" 81rootdn "cn=Manager,dc=example,dc=it" 82rootpw secret 83#~null~#directory @TESTDIR@/db.2.a 84#bdb#index objectClass eq 85#bdb#index cn,sn,uid pres,eq,sub 86#hdb#index objectClass eq 87#hdb#index cn,sn,uid pres,eq,sub 88#ndb#dbname db_2 89#ndb#include @DATADIR@/ndb.conf 90 91database ldap 92suffix "o=Example,c=US" 93uri "@URI1@" 94 95#sasl#idassert-bind bindmethod=sasl binddn="cn=Proxy US,ou=Admin,dc=example,dc=com" authcId="admin/proxy US" credentials="proxy" @SASL_MECH@ mode=self 96#nosasl#idassert-bind bindmethod=simple binddn="cn=Proxy US,ou=Admin,dc=example,dc=com" credentials="proxy" mode=self 97 98# authorizes database 99idassert-authzFrom "dn.subtree:dc=example,dc=it" 100 101overlay rwm 102rwm-suffixmassage "dc=example,dc=com" 103 104database ldap 105suffix "o=Esempio,c=IT" 106uri "@URI1@" 107 108acl-authcDN "cn=Proxy IT,ou=Admin,dc=example,dc=com" 109acl-passwd proxy 110 111idassert-bind bindmethod=simple binddn="cn=Proxy IT,ou=Admin,dc=example,dc=com" credentials="proxy" authzId="dn:cn=Sandbox,ou=Admin,dc=example,dc=com" 112 113# authorizes database 114idassert-authzFrom "dn.subtree:dc=example,dc=com" 115# authorizes anonymous 116idassert-authzFrom "dn.exact:" 117 118overlay rwm 119rwm-suffixmassage "dc=example,dc=com" 120 121access to attrs=entry,cn,sn,mail 122 by users read 123 124access to * 125 by dn.exact="cn=Proxy IT,ou=Admin,o=Esempio,c=IT" read 126 by group.exact="cn=Authorizable,ou=Groups,o=Esempio,c=IT" read 127 by dn.exact="cn=Sandbox,ou=Admin,dc=example,dc=com" search 128 by * none 129 130#monitor#database monitor 131#monitor#rootdn "cn=monitor" 132#monitor#rootpw monitor 133