# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.8.8.6 2001/04/20 23:32:43 kurt Exp $
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include		/opt/openldap/etc/openldap/schema/core.schema
include		/opt/openldap/etc/openldap/schema/cosine.schema
include		/opt/openldap/etc/openldap/schema/inetorgperson.schema
include		/opt/openldap/etc/openldap/schema/nis.schema
include		/opt/openldap/etc/openldap/schema/mailrouter.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

pidfile		/opt/openldap/var/slapd.pid
argsfile	/opt/openldap/var/slapd.args

# Load dynamic backend modules:
# modulepath	/opt/openldap/libexec/openldap
# moduleload	back_ldap.la
# moduleload	back_ldbm.la
# moduleload	back_passwd.la
# moduleload	back_shell.la

TLSCertificateFile /opt/certs/mx1.foo.net.pem
TLSCertificateKeyFile /opt/certs/mx1.foo.net.pem

#######################################################################
# ldbm database definitions
#######################################################################

database	ldbm
suffix		"o=top"
rootdn		"cn=manager,o=top"
rootpw		null
directory	/opt/openldap/db

# Indices to maintain
index	objectClass	eq
index 	uid	eq
index	alias	eq
index	cn	eq

access to attr=userPassword
  by self write
  by anonymous auth

# domain access
access to dn="dc=([^,]+),o=([^,]+)"
  by dn="uid=postmaster,dc=$1,o=$2" write
  by group="cn=admin,dc=$1,o=$2" write
  by group="cn=admin,o=$2" write
  by users read
  by anonymous read

# root access
access to dn="o=([^,]+)"
  by group="cn=admin,o=$1" write
  by users read
  by anonymous read

# user modifyable attributes
access to attrs=cn,sn
  by self write
  by users read
  by anonymous read

# generic access
access to *
  by self write
  by users read
  by anonymous read