#######################################################################
# Database <%= name %> config
#######################################################################

database			hdb
suffix				"<%= name %>"
checkpoint			1024 15
rootdn				"cn=manager,<%= name %>"

overlay				ppolicy
ppolicy_default			cn=pwdPolicy,cn=config,<%= name %>
ppolicy_hash_cleartext
ppolicy_use_lockout
password-hash			{CRYPT}
password-crypt-salt-format	"$6$%.8s"

overlay				syncprov
syncprov-checkpoint		100 10
syncprov-sessionlog		100

# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory	/srv/ldap/<%= name %>

# include acl and index configs
include		<%= scope.lookupvar('ldap::server::config') %>/slapd.conf.d/acl.<%= name %>.conf
include		<%= scope.lookupvar('ldap::server::config') %>/slapd.conf.d/index.<%= name %>.conf

# map local users connecting via ldapi:///
sasl-regexp "gidNumber=.*+uidNumber=0,cn=peercred,cn=external,cn=auth"
	"cn=manager,<%= name %>"
sasl-regexp "gidNumber=([\d]+)+uidNumber=([\d]+),cn=peercred,cn=external,cn=auth"
	ldap:///<%= name %>??sub?(&(uidNumber=$2)(objectClass=posixAccount))

# map sasl authenticated users
sasl-regexp "uid=(.*),cn=plain,cn=auth"
	ldap:///<%= name %>??sub?(&(uid=$1)(objectClass=posixAccount))
sasl-regexp "uid=(.*),cn=login,cn=auth"
	ldap:///<%= name %>??sub?(&(uid=$1)(objectClass=posixAccount))
sasl-regexp "uid=(.*),cn=gssapi,cn=auth"
	ldap:///<%= name %>??sub?(&(uid=$1)(|(objectClass=posixAccount)(objectClass=krb5Principal)))