The slapd.conf file consists of a series of global configuration options that apply to slapd as a whole (including all backends), followed by zero or more database backend definitions that contain information specific to a backend instance.
The general format of slapd.conf is as follows:
# comment - these options apply to every database
<global configuration options>
# first database definition & configuration options
database <backend 1 type>
<configuration options specific to backend 1>
# subsequent database definitions & configuration options
...
As many backend-specific sections as desired may be included. Global options can be overridden in a backend (for options that appear more than once, the last appearance in the slapd.conf file is used).
If a line begins with white space, it is considered a continuation of the previous line. Blank lines and comment lines beginning with a `#' character are ignored. (Note: continuation lines are unwrapped before comment processing is applied.)
Arguments on configuration lines are separated by white space. If an argument contains white space, the argument should be enclosed in double quotes. If an argument contains a double quote (`"') or a backslash character (`\'), the character should be preceded by a backslash character.
The specific configuration options available are discussed below in the Global Configuration Options, General Backend Options, and General Database Options. Backend-specific options are discussed in the slapd-<backend>(5) manual pages. Refer to the "OpenLDAP Administrator's Guide" for more details on the slapd configuration file.
An attribute description with a tagging option is a subtype of that attribute description without the option. Except for that, options defined this way have no special semantics. Prefixes defined this way work like the `lang-' options: They define a prefix for tagging options starting with the prefix. That is, if you define the prefix `x-foo-', you can use the option `x-foo-bar'. Furthermore, in a search or compare, a prefix or range name (with a trailing `-') matches all options starting with that name, as well as the option with the range name sans the trailing `-'. That is, `x-foo-bar-' matches `x-foo-bar' and `x-foo-bar-baz'.
RFC 2251 reserves options beginning with `x-' for private experiments. Other options should be registered with IANA, see RFC 3383 section 3.4. OpenLDAP also has the `binary' option built in, but this is a transfer option, not a tagging option.
{SHA} and {SSHA} use the SHA-1 algorithm (FIPS 160-1), the latter with a seed.
{MD5} and {SMD5} use the MD5 algorithm (RFC 1321), the latter with a seed.
{CRYPT} uses the crypt(3).
{CLEARTEXT} indicates that the new password should be added to userPassword as clear text.
Note that this option does not alter the normal user applications handling of userPassword during LDAP Add, Modify, or other LDAP operations.
This string needs to be in sprintf(3) format and may include one (and only one) %s conversion. This conversion will be substituted with a string random characters from [A-Za-z0-9./]. For example, "%.2s" provides a two character salt and "$1$%.8s" tells some versions of crypt(3) to use an MD5 algorithm and provides 8 random characters of salt. The default is "%s", which provides 31 characters of salt.
<dnstyle>:={exact|onelevel|children|subtree|regex}
TLSCipherSuite HIGH:MEDIUM:+SSLv2
To check what ciphers a given spec selects, use:
openssl ciphers -v <cipher-suite-spec>
Note that a valid client certificate is required in order to use the SASL EXTERNAL authentication mechanism with a TLS session. As such, a non-default TLSVerifyClient setting must be chosen to enable SASL EXTERNAL authentication.
The currently supported limits are size and time.
The syntax for time limits is time[.{soft|hard}]=<integer>, where integer is the number of seconds slapd will spend answering a search request. If no time limit is explicitly requested by the client, the soft limit is used; if the requested time limit exceeds the hard limit, an error is returned. If the hard limit is set to 0 or to the keyword soft, the soft limit is used in either case; if it is set to -1 or to the keyword none, no hard limit is enforced. Explicit requests for time limits smaller or equal to the hard limit are honored. If no flag is set, the value is assigned to the soft limit, and the hard limit is set to zero, to preserve the original behavior.
The syntax for size limits is size[.{soft|hard|unchecked}]=<integer>, where integer is the maximum number of entries slapd will return answering a search request. If no size limit is explicitly requested by the client, the soft limit is used; if the requested size limit exceeds the hard limit, an error is returned. If the hard limit is set to 0 or to the keyword soft, the soft limit is used in either case; if it is set to -1 or to the keyword none, no hard limit is enforced. Explicit requests for size limits smaller or equal to the hard limit are honored. The unchecked flag sets a limit on the number of candidates a search request is allowed to examine. If the selected candidates exceed the unchecked limit, the search will abort with If it is set to -1 or to the keyword none, no limit is applied (the default). If it is set to disable, the search is not even performed; this can be used to disallow searches for a specific set of users. If no flag is set, the value is assigned to the soft limit, and the hard limit is set to zero, to preserve the original behavior.
In case of no match, the global limits are used. The default values are the same of sizelimit and timelimit; no limit is set on unchecked.
If pagedResults control is requested, the hard size limit is used by default, because the request of a specific page size is considered as an explicit request for a limitation on the number of entries to be returned. However, the size limit applies to the total count of entries returned within the search, and not to a single page. Additional size limits may be enforced; the syntax is size.pr={<integer>|noEstimate|none}, where integer is the max page size if no explicit limit is set; the keyword noEstimate inhibits the server to return an estimate of the total number of entries that will be returned; the keyword none indicates that no limit is applied to the pagedResults control page size. The syntax size.prtotal={<integer>|none|disabled} allows to set a limit on the total number of entries that a pagedResults control allows to return. By default it is set to the hard limit. When set, integer is the max number of entries that the whole search with pagedResults control can return. Use none to allow unlimited number of entries to be returned, i.e. to use pagedResults as a means to allow clients to circumvent size limitations on regular searches; the keyword disabled disables the control, i.e. no paged results can be returned. Note that the total number of entries returned when the pagedResults control is requested cannot exceed the hard size limit of regular searches unless extended by the prtotal switch.
Here is a short example of a configuration file:
include /etc/openldap/schema/core.schema pidfile /var/openldap/slapd.pid # Subtypes of "name" (e.g. "cn" and "ou") with the # option ";x-hidden" can be searched for/compared, # but are not shown. See slapd.access(5). attributeoptions x-hidden lang- access to attr=name;x-hidden by * =cs database bdb suffix "dc=our-domain,dc=com" # The database directory MUST exist prior to # running slapd AND should only be accessible # by the slapd/tools. Mode 0700 recommended. directory /var/openldap/openldap-data # Indices to maintain index objectClass eq index cn,sn,mail pres,eq,approx,sub # We serve small clients that do not handle referrals, # so handle remote lookups on their behalf. database ldap suffix "" uri ldap://ldap.some-server.com/ lastmod off
"OpenLDAP Administrator's Guide" contains a longer annotated example of a configuration file. The original /etc/openldap/slapd.conf is another example.
"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)