external/bsd/openldap/dist/tests/data/slapd-idassert.conf

   1 # master slapd config -- for testing
   2 # $OpenLDAP: pkg/ldap/tests/data/slapd-idassert.conf,v 1.16.2.5 2008/04/15 00:05:16 quanah Exp $
   3 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4 ##
   5 ## Copyright 1998-2008 The OpenLDAP Foundation.
   6 ## All rights reserved.
   7 ##
   8 ## Redistribution and use in source and binary forms, with or without
   9 ## modification, are permitted only as authorized by the OpenLDAP
  10 ## Public License.
  11 ##
  12 ## A copy of this license is available in the file LICENSE in the
  13 ## top-level directory of the distribution or, alternatively, at
  14 ## <http://www.OpenLDAP.org/license.html>.
  15
  16 #ucdata-path    ./ucdata
  17 include         @SCHEMADIR@/core.schema
  18 include         @SCHEMADIR@/cosine.schema
  19 include         @SCHEMADIR@/inetorgperson.schema
  20 include         @SCHEMADIR@/openldap.schema
  21 include         @SCHEMADIR@/nis.schema
  22 pidfile         @TESTDIR@/slapd.1.pid
  23 argsfile        @TESTDIR@/slapd.1.args
  24
  25 #mod#modulepath ../servers/slapd/back-@BACKEND@/
  26 #mod#moduleload back_@BACKEND@.la
  27 #ldapmod#modulepath ../servers/slapd/back-ldap/
  28 #ldapmod#moduleload back_ldap.la
  29 #monitormod#modulepath ../servers/slapd/back-monitor/
  30 #monitormod#moduleload back_monitor.la
  31 #rwmmod#modulepath ../servers/slapd/overlays/
  32 #rwmmod#moduleload rwm.la
  33
  34 #######################################################################
  35 # database definitions
  36 #######################################################################
  37
  38 authz-policy    both
  39 authz-regexp    "^uid=admin/([^,]+),.+" "ldap:///ou=Admin,dc=example,dc=com??sub?(cn=$1)"
  40 authz-regexp    "^uid=it/([^,]+),.+" "ldap:///ou=People,dc=example,dc=it??sub?(uid=$1)"
  41 authz-regexp    "^uid=(us/)?([^,]+),.+" "ldap:///ou=People,dc=example,dc=com??sub?(uid=$2)"
  42
  43 #
  44 # normal installations should protect root dse,
  45 # cn=monitor, cn=schema, and cn=config
  46 #
  47
  48 access to attrs=userpassword
  49         by self =wx
  50         by anonymous =x
  51
  52 access to dn.exact=""
  53         by * read
  54
  55 access to *
  56         by users read
  57         by * search
  58
  59 database        @BACKEND@
  60
  61 suffix          "dc=example,dc=com"
  62 directory       @TESTDIR@/db.1.a
  63 rootdn          "cn=Manager,dc=example,dc=com"
  64 rootpw          secret
  65 #bdb#index              objectClass     eq
  66 #bdb#index              cn,sn,uid       pres,eq,sub
  67 #hdb#index              objectClass     eq
  68 #hdb#index              cn,sn,uid       pres,eq,sub
  69
  70 access to dn.exact="cn=Proxy,ou=Admin,dc=example,dc=com"
  71                 attrs=authzTo
  72         by dn.exact="cn=Proxy,ou=Admin,dc=example,dc=com" =wx
  73         by * =x
  74
  75 database        @BACKEND@
  76
  77 suffix          "dc=example,dc=it"
  78 directory       @TESTDIR@/db.2.a
  79 rootdn          "cn=Manager,dc=example,dc=it"
  80 rootpw          secret
  81 #bdb#index              objectClass     eq
  82 #bdb#index              cn,sn,uid       pres,eq,sub
  83 #hdb#index              objectClass     eq
  84 #hdb#index              cn,sn,uid       pres,eq,sub
  85
  86 database        ldap
  87 suffix          "o=Example,c=US"
  88 uri             "@URI1@"
  89
  90 #sasl#idassert-bind     bindmethod=sasl binddn="cn=Proxy US,ou=Admin,dc=example,dc=com" authcId="admin/proxy US" credentials="proxy" @SASL_MECH@ mode=self
  91 #nosasl#idassert-bind   bindmethod=simple binddn="cn=Proxy US,ou=Admin,dc=example,dc=com" credentials="proxy" mode=self
  92
  93 # authorizes database
  94 idassert-authzFrom      "dn.subtree:dc=example,dc=it"
  95
  96 overlay         rwm
  97 rwm-suffixmassage       "dc=example,dc=com"
  98
  99 database        ldap
 100 suffix          "o=Esempio,c=IT"
 101 uri             "@URI1@"
 102
 103 acl-authcDN     "cn=Proxy IT,ou=Admin,dc=example,dc=com"
 104 acl-passwd      proxy
 105
 106 idassert-bind   bindmethod=simple binddn="cn=Proxy IT,ou=Admin,dc=example,dc=com" credentials="proxy" authzId="dn:cn=Sandbox,ou=Admin,dc=example,dc=com"
 107
 108 # authorizes database
 109 idassert-authzFrom      "dn.subtree:dc=example,dc=com"
 110 # authorizes anonymous
 111 idassert-authzFrom      "dn.exact:"
 112
 113 overlay         rwm
 114 rwm-suffixmassage       "dc=example,dc=com"
 115
 116 access to attrs=entry,cn,sn,mail
 117         by users read
 118
 119 access to *
 120         by dn.exact="cn=Proxy IT,ou=Admin,o=Esempio,c=IT" read
 121         by group.exact="cn=Authorizable,ou=Groups,o=Esempio,c=IT" read
 122         by dn.exact="cn=Sandbox,ou=Admin,dc=example,dc=com" search
 123         by * none
 124
 125 #monitor#database       monitor
 126 #monitor#rootdn         "cn=monitor"
 127 #monitor#rootpw         monitor