# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema

pidfile         /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args

loglevel        128

modulepath	/usr/lib/ldap
moduleload	back_hdb
moduleload	refint
moduleload	unique
moduleload	accesslog
moduleload	syncprov

sizelimit 500
tool-threads 1

backend		hdb
database        hdb
suffix          "dc=example.com"

rootdn	"cn=admin,dc=example.com"
rootpw mypassinplaintext

directory       "/var/lib/ldap"
dbconfig set_cachesize 0 20971520 0
dbconfig set_lk_max_objects 1500
dbconfig set_lk_max_locks 1500
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index           objectClass,uidNumber,gidNumber eq
index		cn	eq,sub,pres,approx
index		uid	eq,sub,pres
index		sn	eq,sub,approx
index		member,mail	eq
index		givenname	eq
index		entryCSN,entryUUID eq

lastmod         on
checkpoint      512 30

overlay syncprov
syncprov-checkpoint 50 10
syncprov-sessionlog 100

overlay unique
unique_base dc=example.com
unique_attributes uid mail uidNumber homeDirectory

access to attrs=userPassword,shadowLastChange
	by dn="uid=authenticate,ou=System,dc=example.com" read
	by dn="uid=myusername,ou=Users,ou=bca,dc=example.com" read
        by anonymous auth
        by self write

access to attrs=givenName,sn,cn,mail
	by dn="uid=syncrepl,ou=system,dc=example.com" read
	by anonymous peername.ip=some_static_ip read
	by anonymous peername.ip=some_static_ip read
	by anonymous peername.ip=some_static_ip read
	by anonymous peername.ip=some_static_ip read
	by self read
	by users auth
	by anonymous auth

access to attrs=uid
	by anonymous read
	by users read

access to dn.regex="^.*,uid=([^,]+),ou=Users,dc=example.com$"
        by dn.exact,expand="uid=$1,ou=Users,dc=example.com" write

access to *
	by dn.exact="uid=authenticate,ou=System,dc=example.com" none
	by users none break
	by self read
	by users read	
	by * none
