Refactored ldap::server class.

ldap/templates/slapd-database.conf.erb

@@ -0,0 +1,43 @@
+
+#######################################################################
+# Database <%= name %> config
+#######################################################################
+
+database			hdb
+suffix				"<%= name %>"
+checkpoint			1024 15
+rootdn				"cn=manager,<%= name %>"
+
+overlay				ppolicy
+ppolicy_default			cn=pwdPolicy,cn=config,<%= name %>
+ppolicy_hash_cleartext
+ppolicy_use_lockout
+password-hash			{CRYPT}
+password-crypt-salt-format	"$6$%.8s"
+
+overlay				syncprov
+syncprov-checkpoint		100 10
+syncprov-sessionlog		100
+
+# The database directory MUST exist prior to running slapd AND 
+# should only be accessible by the slapd and slap tools.
+# Mode 700 recommended.
+directory	/srv/ldap/<%= name %>
+
+# include acl and index configs
+include		<%= scope.lookupvar('ldap::server::config') %>/slapd.conf.d/acl.<%= name %>.conf
+include		<%= scope.lookupvar('ldap::server::config') %>/slapd.conf.d/index.<%= name %>.conf
+
+# map local users connecting via ldapi:///
+sasl-regexp "gidNumber=.*+uidNumber=0,cn=peercred,cn=external,cn=auth"
+	"cn=manager,<%= name %>"
+sasl-regexp "gidNumber=([\d]+)+uidNumber=([\d]+),cn=peercred,cn=external,cn=auth"
+	ldap:///<%= name %>??sub?(&(uidNumber=$2)(objectClass=posixAccount))
+
+# map sasl authenticated users
+sasl-regexp "uid=(.*),cn=plain,cn=auth"
+	ldap:///<%= name %>??sub?(&(uid=$1)(objectClass=posixAccount))
+sasl-regexp "uid=(.*),cn=login,cn=auth"
+	ldap:///<%= name %>??sub?(&(uid=$1)(objectClass=posixAccount))
+sasl-regexp "uid=(.*),cn=gssapi,cn=auth"
+	ldap:///<%= name %>??sub?(&(uid=$1)(|(objectClass=posixAccount)(objectClass=krb5Principal)))