summaryrefslogtreecommitdiff
path: root/source4/setup/slapd.conf
AgeCommit message (Collapse)AuthorFilesLines
2013-09-18OpenLDAP provisioning tweaksHoward Chu1-1/+1
Remove BerkeleyDB-specific setup. Streamline cn=samba partition initialization - allow any backend type for it. Use back-mdb instead of back-ldif for cn=samba partition Signed-off-by: Howard Chu <hyc@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com> Autobuild-User(master): Nadezhda Ivanova <nivanova@samba.org> Autobuild-Date(master): Wed Sep 18 21:39:51 CEST 2013 on sn-devel-104
2013-09-18Use SASL/EXTERNAL over ldapi://Howard Chu1-0/+4
The provision script will map the uid of the user running the script to the samba-admin LDAP DN. Signed-off-by: Howard Chu <hyc@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2013-09-17Fix OpenLDAP partition configsHoward Chu1-3/+50
Update to use LMDB backend, BDB is deprecated Update to support DomainDNSZones and ForestDNSZones partitions. Signed-off-by: Howard Chu <hyc@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2010-10-18s4-openldap-backend Don't set 'dbnosync' on cn=configAndrew Bartlett1-1/+0
This isn't valid in current OpenLDAP versions. Andrew Bartlett
2010-04-22s4:provision Remove moduleload for 'hdb' (wrong name).Andrew Bartlett1-1/+0
The backends are not normally modules anyway
2010-04-22s4:provision Make OpenLDAP backend more robustAndrew Bartlett1-1/+11
With the extra moduleload lines (which succeed if it's already staticly linked), we now work with OpenLDAP overlays as modules. Andrew Bartlett
2010-04-22s4:provison Pass nosync in for the OpenLDAP cn=config tooAndrew Bartlett1-0/+1
2010-04-22s4:OpenLDAP-backend Use the new rdnval module in OpenLDAPAndrew Bartlett1-0/+3
This is rather than rdn_name, which tries to do the job on the client side. We need to leave this module in the stack for Fedora DS (and of course the LDB backend). Andrew Bartlett
2009-08-17s4:provision Rework provision-backend into provisionAndrew Bartlett1-2/+8
This removes a *lot* of duplicated code and the cause of much administrator frustration. We now handle starting and stopping the slapd (at least for the provision), and ensure that there is only one 'right' way to configure the OpenLDAP and Fedora DS backend We now run OpenLDAP in 'cn=config' mode for online configuration. To test what was the provision-backend code, a new --ldap-dryrun-mode option has been added to provision. It quits the provision just before it would start the LDAP binaries Andrew Bartlett
2009-08-12s4:provision Assume the OpenLDAP backend can find it's own modulesAndrew Bartlett1-2/+0
2009-08-12s4:provision Rework and further automate setup of OpenLDAP backendOliver Liebel1-34/+6
heres the summary of all changes/extensions: - Andrew Bartlett's patch to generate indext - Howard Chu's idea to use nosync on the DB included, but made optional - slaptest-path is not needed any more (slapd -Ttest is used instead) and is therefore removed. slapd-path is now recommended when openldap-backend is chosen. its also used for olc-conversion - slapd-detection is now always done by ldapsearch (ldb module), looking anonymous for objectClass: OpenLDAProotDSE via our ldapi_uri. - if ldapsearch was not successfull, (no slapd listening on our socket) slapd is started via special generated slapdcommand_prov (ldapi_uri only) - slapd-"provision-process" startup is done via pythons subprocess. - the slapd-provision-pid is stored under paths.ldapdir/slapd_provision_pid. - after provision-backend is finished: --- slapd.pid is compared with our stored slapd_provision_pid. if the are unique, slapd.pid will be read out, and the slapd "provison"-process will be shut down. --- proper slapd-shutdown is verified again with ldb-search -> ldapi_uri -> rootDSE. --- if the pids are different or one of the pid-files is missing, slapd will not be shut down, instead an error message is displayed to locate slapd manually --- extended help-messages (relevant to slapd) are always displayed, e.g. the commandline with which slapd has to be started when everythings finished (slapd-commandline is stored under paths.ldapdir/slapd_command_file.txt)) - upgraded the content of the mini-howto (howto-ol-backend-s4.txt)
2009-02-24Added mmr and olc to the OpenLDAP backend provisioning-scriptsOliver Liebel1-7/+13
These extensions add mmr (multi-master-replication) and olc (openldap-online-configuration) capabilities to the provisioning-scripts (provision-backend and provision.py), for use with the openldap-backend (only versions >=2.4.15!). Changes / additions made to the provision-backend -script: added new command-line-options: --ol-mmr-urls=<list of whitespace separated ldap-urls> for use with mmr (can be combined with --ol-olc=yes), --ol-olc=[yes/no] (activate automatic conversion from static slapd.conf to olc), --ol-slaptest=<path to slaptest binary> (needed in conjunction with --ol-olc=yes) Changes / additions made to the provision.py -script: added extensions, that will automatically generate the chosen mmr and/or olc setup for the openldap backend, according to the to chosen parameters set in the provision-backend script Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2008-12-17s4:provision: use extended_dn_out_ldb or extended_dn_out_dereference ↵Andrew Bartlett1-0/+2
depending on the backend This just changes the existing stratagy of loading different modules for the OpenLDAP backend to also include extended_dn_out_* When we provision the OpenLDAP backend, we make sure to include the 'deref' overlay (which must be made available by the OpenLDAP build) Signed-off-by: Stefan Metzmacher <metze@samba.org>
2008-09-08Use DIGEST-MD5 authentication for OpenLDAP replicationOliver Liebel1-4/+4
This avoids passing rootdn passwords or replicated data in cleartext across the network. Signed-of-by: Andrew Bartlett <abartlet@samba.org> (This used to be commit 67373c143a1d8a9f310fd116dbf81c1dd123b75f)
2008-08-19Fix up new OpenLDAP MMR code.Andrew Bartlett1-3/+3
This changes the MMR password from hard-coded value of 'linux', adds tests and fixes the Fedora DS backend. Currently the MMR password matches the admin password, but we can change this to be another random value if required. Also require the port to be specified on the command line, so we don't hard-code a port of 9000. Andrew Bartlett (This used to be commit 08257c6d6ce809fcd53f9b2b4d558fef616b74ce)
2008-08-19Generate Multi-Master Replication configuration for OpenLDAPOliver Liebel1-4/+32
This patches provision-backend and the related scripts to generate the correct configuration blobs for N-way multi-master replication using OpenLDAP. Signed-off-by: Andrew Bartlett <abartlet@samba.org> (This used to be commit 6ed0b3f2475022288f636605492ca27fde97cd52)
2008-07-21Make invalid 'member' detection work again.Andrew Bartlett1-0/+4
This defines a rootdn globally, and due to OpenLDAP bugs, gives it manage access to the whole database. This makes the memberOf module able to validate the links again, now we have database ACLs. Andrew Bartlett (This used to be commit 9fe3e9f09f89fd92f8a16768e53391ff5f8489ec)
2008-07-18Make a seperate template for the refint configuration tooAndrew Bartlett1-0/+2
(This used to be commit d2a527acc5ee6fe9b943657dc9c3ace920b2d619)
2008-07-18Put the memberof template into a seperate setup/ file.Andrew Bartlett1-0/+3
Set a memberof-dn in a fruitless attempt to fix the ACL problem I'm having with OpenLDAP Andrew Bartlett (This used to be commit 6d6e03834a1a77a8ceba41fbe8c9d49680065ba3)
2008-07-15Lock down the LDAP backend - only samba may read or writeAndrew Bartlett1-1/+1
(This used to be commit a3912801fb25f715725c06402d4bdff9a926f15d)
2008-07-15Connect to the LDAP backend with SASL credentials.Andrew Bartlett1-9/+30
This reworks our LDAP backend code to move from anonymous access to a shared-secret SASL-protected connection. (SASL selects NTLM or DIGEST-MD5 on my system). To get this working, we must pre-populate the LDAP backend with a DN to store ths SASL secret on, and we use back-ldif for this. This gives us a reasonable basis to deploy a replicated OpenLDAP backend solution. Andrew Bartlett (This used to be commit cd0745253c4a9ec59a035e830e54d74a05b71aaa)
2008-07-10Avoid the use of extensibleObject in ldap mapping backend.Andrew Bartlett1-2/+0
Instead of extensibleObject, we use the new (more correct) ad2oLschema tool, and a new objectClass called 'samba4Top', which we add and remove in the same way we did extensibleObject. Andrew Bartlett (This used to be commit 5ab20aa8b43415751f77602fff3a3008bf2186db)
2008-03-15Rework memberof handling in slapd.conf (used for OpenLDAP backend)Andrew Bartlett1-3/+5
Instead of using an include file, put the generated configurationd directly into slapd.conf. Andrew Bartlett (This used to be commit 95ac786136aebfe5ededeb3fb81cbd4e296e3988)
2008-01-18Use syncrepl on all OpenLDAP databases (creates contextCSN attribute)Andrew Bartlett1-0/+12
This module needs to be loaded on each database, not just the main partition. We use it to create the usn for the entries. Andrew Bartlett (This used to be commit ffb12aad8a80bb90d66dc66baba81b856622a6bb)
2007-12-31r26636: Remove useless 'backend' parameter, and make the memberof overlay ↵Andrew Bartlett1-3/+2
use global. Andrew Bartlett (This used to be commit 3b6f461e9a1b0fee7a589b8d171f4fcec6340ca4)
2007-12-26r26610: Write out a memberof.conf, to run the memberof plugin on all linkedAndrew Bartlett1-0/+5
attributes, as found in the schema. Index 'cn', as otherwise exact match searches on this attribute always fail (need to figure out what is so special about cn in OpenLDAP). Andrew Bartlett (This used to be commit 5a4a2d10bc5729d4adac4b173b0dc05e2e076c32)
2007-12-21r26424: Patch and hits from Howard Chu <hyc@symas.com> for our automated setupAndrew Bartlett1-1/+1
of OpenLDAP. This makes it consistant with the Fedora DS setup, and doesn't mix both hdb and bdb. Andrew Bartlett (This used to be commit 1ffada95d269c8f7d054bec7f6eaff8449995d40)
2007-12-21r26305: Update template files and testsuite to try and work with currentAndrew Bartlett1-4/+4
openldap, and fully support different LDAP server locations. Andrew Bartlett (This used to be commit a00bb942537f0f638c2a8295770749cb4b5d9ef3)
2007-10-10r25450: Make it easier to test with a particular version of OpenLDAP, byAndrew Bartlett1-3/+3
setting OPENLDAP_PATH, move to using hdb as the backend (allows subtree renames), and re-enable the --quiet option. Andrew Bartlett (This used to be commit a186a0fa68cdcfb3abd430534657e5e278a5ebda)
2007-10-10r23717: We need to remove the _ in LDAP_MANAGERPASS for theAndrew Bartlett1-2/+2
--ldap-manager-pass= option to work. Andrew Bartlett (This used to be commit fbcb1ec14125a4ca57922ec75b01af9a99dcd954)
2007-10-10r23716: Clarify LDAP Manager DN and fix slapd startup syntax.Andrew Bartlett1-2/+2
Andrew Bartlett (This used to be commit 17dad5d8c345c2c3a7643bff7a43473339a22d40)
2007-10-10r23189: Work towards a totally scripted setup of LDAP backends, so others canAndrew Bartlett1-6/+6
easily try this out. I also intend to use this for the selftest, but I'm chasing issues with the OpenlDAP (but not Fedora DS) backend. Andrew Bartlett (This used to be commit 0f457b1d2e20c36ab220b4a6711ce7930c4c7d21)
2007-10-10r23177: Add in a new provision-backend script. This helps set up the ↵Andrew Bartlett1-0/+73
OpenLDAP or Fedora DS backend. This required a new mkdir() call in ejs. We can now provision just the schema for ad2oLschema to operate on (with provision_schema(), without performing the whole provision, just to wipe it again (adjustments to 'make test' to come soon). Andrew Bartlett (This used to be commit 01d54d13dc66ef2127ac52c64ede53d0790738ec)
generated by cgit (git 2.34.1) at 2024-05-20 14:49:32 +0000