infra/roles/slapd/templates/slapd.conf.j2

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#

#######################################################################
# Schemas
#######################################################################

include		/etc/ldap/schema/core.schema
include		/etc/ldap/schema/cosine.schema
include		/etc/ldap/schema/inetorgperson.schema
include		/etc/ldap/schema/kitchen.schema
include		/etc/ldap/schema/misc.schema
include		/etc/ldap/schema/nis.schema
include		/etc/ldap/schema/openssh-lpk.schema
include		/etc/ldap/schema/radius.schema
include		/etc/ldap/schema/samba.schema


#######################################################################
# Files, logging, modules
#######################################################################

pidfile		/var/run/slapd/slapd.pid
argsfile	/var/run/slapd/slapd.args

#loglevel	stats sync
loglevel	sync

# Load dynamic backend modules:
modulepath	/usr/lib/ldap
moduleload	back_hdb.la
{% if slapd_role == 'master' %}
moduleload	syncprov.la
{% endif %}

# Sample security restrictions
#	Require integrity protection (prevent hijacking)
#	Require 112-bit (3DES or better) encryption for updates
#	Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64


#######################################################################
# ACL
#######################################################################

access to dn.base=""
	by * read
access to dn.base="cn=Subschema"
	by * read
access to dn.one="ou=people,dc=binary-kitchen,dc=de" attrs=userPassword
	by self write
	by group="cn=admin,dc=binary-kitchen,dc=de" write
	by anonymous auth
	by * none
access to dn.one="ou=people,dc=binary-kitchen,dc=de" attrs=loginShell
	by self write
	by group="cn=admin,dc=binary-kitchen,dc=de" write
	by users read
	by * none
access to dn.sub="ou=people,dc=binary-kitchen,dc=de"
	by group="cn=admin,dc=binary-kitchen,dc=de" write
	by self read
	by users read
	by * none
access to dn.one="ou=groups,dc=binary-kitchen,dc=de" attrs=memberUid
	by group="cn=admin,dc=binary-kitchen,dc=de" write
	by self read
	by users read
	by * none
access to attrs=userPassword
	by self write
	by anonymous auth
	by * none
access to attrs=loginShell
	by self write
	by users read
	by * none
access to *
	by self read
	by users read
	by * none


#######################################################################
# TLS
#######################################################################

TLSCertificateFile	/etc/ldap/ssl/srv.crt
TLSCertificateKeyFile	/etc/ldap/ssl/srv.key
TLSCACertificateFile	/etc/ssl/certs/ca-certificates.crt
TLSCACertificatePath	/etc/ssl/certs
TLSCipherSuite		NORMAL
TLSVerifyClient		never


#######################################################################
# BDB database definitions
#######################################################################

database	hdb
suffix		"{{ ldap_base }}"
#         <kbyte> <min>
checkpoint	32	30
rootdn		"cn=Manager,dc=binary-kitchen,dc=de"
rootpw		{{ slapd_root_hash }}
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory	/var/lib/ldap


#######################################################################
# Indices
#######################################################################

index	objectClass	eq

# Replication related
index	entryCSN	eq
index	entryUUID	eq

# Posix Users/Groups
index	cn		eq
index	gidNumber	eq
index	memberUid	eq
index	uid		eq
index	uidNumber	eq

# Mail
index	mail			eq
index	mailAlternateAddress	eq


{% if slapd_role == 'master' %}
#######################################################################
# Replication
#######################################################################

overlay syncprov
syncprov-checkpoint	10	1
syncprov-sessionlog	100


#######################################################################
# Samba Password Sync
#######################################################################

moduleload	smbk5pwd.so
overlay	smbk5pwd
smbk5pwd-enable	samba
smbk5pwd-must-change	0
{% elif slapd_role == 'slave' %}
#######################################################################
# Replication Consumer
#######################################################################

syncrepl	rid=1
		provider="ldaps://ldapm.binary.kitchen"
		searchbase="{{ ldap_base }}"
		type=refreshAndPersist
		retry="5 10 30 +"
		binddn="cn=Manager,dc=binary-kitchen,dc=de"
		bindmethod=simple
		credentials="{{ slapd_root_pass }}"
		tls_reqcert=demand
{% endif %}