From 37375b17030c0f7060ee71fb58192c2320e0f94c Mon Sep 17 00:00:00 2001 From: cvsdist Date: Thu, 9 Sep 2004 09:43:01 +0000 Subject: [PATCH] auto-import changelog data from openldap-2.2.13-2.src.rpm * Thu Aug 19 2004 Nalin Dahyabhai 2.2.13-2 - build a separate, static set of libraries for openldap-devel with the non-standard ntlm bind patch applied, for use by the evolution-connector package (#125579), and installing them under %{evolution_connector_prefix} (/usr/lib/evolution-openldap) - provide openldap-evolution-devel = %{version}-%{release} in openldap-devel so that evolution-connector's source package can require a version of openldap-devel which provides what it wants * Mon Jul 26 2004 Nalin Dahyabhai - update administrator guide --- README.evolution | 22 ++ guide.html | 651 +++++++++++++++++++++++++++------------------ openldap-ntlm.diff | 199 ++++++++++++++ openldap.spec | 142 +++++++--- 4 files changed, 721 insertions(+), 293 deletions(-) create mode 100644 README.evolution create mode 100644 openldap-ntlm.diff diff --git a/README.evolution b/README.evolution new file mode 100644 index 0000000..d1d1923 --- /dev/null +++ b/README.evolution @@ -0,0 +1,22 @@ +These files are here specifically for use in building the evolution-connector +package. + +In order to authenticate to older servers, an LDAP client must perform an +ntlm_bind operation instead of a simple or SASL bind. The ntlm_bind is not the +same thing as performing SASL authentication using NTLM as the mechanism, which +wouldn't require any patching. Newer servers properly support DIGEST-MD5, so +this requirement only applies to clients which want to authenticate to older +servers, and this requirement will hopefully go away at some point. + +Because the changes involved both modify the libldap ABI and add +non-standardized messages to the protocol, changed libraries are built +statically and stashed in a directory where they will not be found by a +compiler using the default search paths. + +The openldap-devel package provides "openldap-evolution-devel" if it includes a +patched version of these libraries in such a directory. Packages which depend +on these libraries should BuildRequire this virtual provision so that they +don't fail to compile or get miscompiled if the libraries are not present. + +If/when the evolution-connector package stops requiring these changes, the +changed libraries will simply disappear. diff --git a/guide.html b/guide.html index 7283c20..46a37f9 100644 --- a/guide.html +++ b/guide.html @@ -7,7 +7,7 @@ available from http://www.mincom.com/mtr/sdf. --> -OpenLDAP 2.1 Administrator's Guide +OpenLDAP 2.2 Administrator's Guide @@ -21,9 +21,9 @@
-

OpenLDAP 2.1 Administrator's Guide

+

OpenLDAP 2.2 Administrator's Guide

The OpenLDAP Project <http://www.openldap.org/>
-
10 January 2003
+
25 February 2004

@@ -136,12 +136,26 @@
13.5. Advanced slurpd Operation
+14. LDAP Sync Replication +
+15. The Proxy Cache Engine +
A. Generic configure Instructions
B. OpenLDAP Software Copyright Notices +B.2. Additional Copyright Notice +
+B.3. University of Michigan Copyright Notice
C. OpenLDAP Public License
@@ -222,7 +236,7 @@ Support Pages

Amendments

Suggested enhancements and corrections to this document should be submitted using the OpenLDAP Issue Tracking System (http://www.openldap.org/its/).

About this document

-

This document was produced using the Simple Document Format (http://www.mincom.com/mtr/sdf/) documentation system developed by Ian Clatworthy. Tools for SDF are available from CPAN (http://search.cpan.org/search?query=SDF).

+

This document was produced using the Simple Document Format (http://search.cpan.org/src/IANC/sdf-2.001/doc/) documentation system developed by Ian Clatworthy. Tools for SDF are available from CPAN (http://search.cpan.org/search?query=SDF).

1. Introduction to OpenLDAP Directory Services

@@ -231,7 +245,7 @@ Support Pages

A directory is a specialized database optimized for reading, browsing and searching. Directories tend to contain descriptive, attribute-based information and support sophisticated filtering capabilities. Directories generally do not support complicated transaction or roll-back schemes found in database management systems designed for handling high-volume complex updates. Directory updates are typically simple all-or-nothing changes, if they are allowed at all. Directories are tuned to give quick response to high-volume lookup or search operations. They may have the ability to replicate information widely in order to increase availability and reliability, while reducing response time. When directory information is replicated, temporary inconsistencies between the replicas may be okay, as long as they get in sync eventually.

There are many different ways to provide a directory service. Different methods allow different kinds of information to be stored in the directory, place different requirements on how that information can be referenced, queried and updated, how it is protected from unauthorized access, etc. Some directory services are local, providing service to a restricted context (e.g., the finger service on a single machine). Other services are global, providing service to a much broader context (e.g., the entire Internet). Global services are usually distributed, meaning that the data they contain is spread across many machines, all of which cooperate to provide the directory service. Typically a global service defines a uniform namespace which gives the same view of the data no matter where you are in relation to the data itself. The Internet Domain Name System (DNS) is an example of a globally distributed directory service.

1.2. What is LDAP?

-

LDAP stands for Lightweight Directory Access Protocol. As the name suggests, it is a lightweight protocol for accessing directory services, specifically X.500-based directory services. LDAP runs over TCP/IP or other connection oriented transfer services. The nitty-gritty details of LDAP are defined in RFC2251 "The Lightweight Directory Access Protocol (v3)" and other documents comprising the technical specification RFC3377. This section gives an overview of LDAP from a user's perspective.

+

LDAP stands for Lightweight Directory Access Protocol. As the name suggests, it is a lightweight protocol for accessing directory services, specifically X.500-based directory services. LDAP runs over TCP/IP or other connection oriented transfer services. The nitty-gritty details of LDAP are defined in RFC2251 "The Lightweight Directory Access Protocol (v3)" and other documents comprising the technical specification RFC3377. This section gives an overview of LDAP from a user's perspective.

What kind of information can be stored in the directory? The LDAP information model is based on entries. An entry is a collection of attributes that has a globally-unique Distinguished Name (DN). The DN is used to refer to the entry unambiguously. Each of the entry's attributes has a type and one or more values. The types are typically mnemonic strings, like "cn" for common name, or "mail" for email address. The syntax of values depend on the attribute type. For example, a cn attribute might contain the value Babs Jensen. A mail attribute might contain the value "babs@example.com". A jpegPhoto attribute would contain a photograph in the JPEG (binary) format.

How is the information arranged? In LDAP, directory entries are arranged in a hierarchical tree-like structure. Traditionally, this structure reflected the geographic and/or organizational boundaries. Entries representing countries appear at the top of the tree. Below them are entries representing states and national organizations. Below them might be entries representing organizational units, people, printers, documents, or just about anything else you can think of. Figure 1.1 shows an example LDAP directory tree using traditional naming.

@@ -240,7 +254,7 @@ Support Pages

Figure 1.2: LDAP directory tree (Internet naming)

In addition, LDAP allows you to control which attributes are required and allowed in an entry through the use of a special attribute called objectClass. The values of the objectClass attribute determine the schema rules the entry must obey.

-

How is the information referenced? An entry is referenced by its distinguished name, which is constructed by taking the name of the entry itself (called the Relative Distinguished Name or RDN) and concatenating the names of its ancestor entries. For example, the entry for Barbara Jensen in the Internet naming example above has an RDN of uid=babs and a DN of uid=babs,ou=People,dc=example,dc=com. The full DN format is described in RFC2253, "Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names."

+

How is the information referenced? An entry is referenced by its distinguished name, which is constructed by taking the name of the entry itself (called the Relative Distinguished Name or RDN) and concatenating the names of its ancestor entries. For example, the entry for Barbara Jensen in the Internet naming example above has an RDN of uid=babs and a DN of uid=babs,ou=People,dc=example,dc=com. The full DN format is described in RFC2253, "Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names."

How is the information accessed? LDAP defines operations for interrogating and updating the directory. Operations are provided for adding and deleting an entry from the directory, changing an existing entry, and changing the name of an entry. Most of the time, though, LDAP is used to search for information in the directory. The LDAP search operation allows some portion of the directory to be searched for entries that match some criteria specified by a search filter. Information can be requested from each entry that matches the criteria.

For example, you might want to search the entire directory subtree at and below dc=example,dc=com for people with the name Barbara Jensen, retrieving the email address of each entry found. LDAP lets you do this easily. Or you might want to search the entries directly below the st=California,c=US entry for organizations with the string Acme in their name, and that have a fax number. LDAP lets you do this too. The next section describes in more detail what you can do with LDAP and how it might be useful to you.

How is the information protected from unauthorized access? Some directory services provide no protection, allowing anyone to see the information. LDAP provides a mechanism for a client to authenticate, or prove its identity to a directory server, paving the way for rich access control to protect the information the server contains. LDAP also supports privacy and integrity security services.

@@ -261,25 +275,26 @@ Support Pages
  • Referrals and Continuations
  • Schema Discovery
  • Extensibility (controls, extended operations, and more) -

    LDAPv2 is considered historical. As deploying both LDAPv2 and LDAPv3 simultaneously can be quite problematic, LDAPv2 should be avoided. LDAPv2 is disabled by default.

    +

    LDAPv2 is historic (RFC3494). As most implementations (including slapd(8)) of LDAPv2 do not conform to the LDAPv2 technical specification, interoperatibility amongst implementations claiming LDAPv2 support will be limited. As LDAPv2 differs significantly from LDAPv3, deploying both LDAPv2 and LDAPv3 simultaneously can be quite problematic. LDAPv2 should be avoided. LDAPv2 is disabled by default.

    1.6. What is slapd and what can it do?

    slapd(8) is an LDAP directory server that runs on many different platforms. You can use it to provide a directory service of your very own. Your directory can contain pretty much anything you want to put in it. You can connect it to the global LDAP directory service, or run a service all by yourself. Some of slapd's more interesting features and capabilities include:

    -

    LDAPv3: slapd implements version 3 of Lightweight Directory Access Protocol. slapd supports LDAP over both IPv4 and IPv6.

    +

    LDAPv3: slapd implements version 3 of Lightweight Directory Access Protocol. slapd supports LDAP over both IPv4 and IPv6 and Unix IPC.

    Simple Authentication and Security Layer: slapd supports strong authentication services through the use of SASL. slapd's SASL implementation utilizes Cyrus SASL software which supports a number of mechanisms including DIGEST-MD5, EXTERNAL, and GSSAPI.

    Transport Layer Security: slapd provides privacy and integrity protections through the use of TLS (or SSL). slapd's TLS implementation utilizes OpenSSL software.

    -

    Topology control: slapd allows one to restrict access to the server based upon network topology. This feature utilizes TCP wrappers.

    +

    Topology control: slapd can be configured to restrict access at the socket layer based upon network topology information. This feature utilizes TCP wrappers.

    Access control: slapd provides a rich and powerful access control facility, allowing you to control access to the information in your database(s). You can control access to entries based on LDAP authorization information, IP address, domain name and other criteria. slapd supports both static and dynamic access control information.

    Internationalization: slapd supports Unicode and language tags.

    -

    Choice of database backends: slapd comes with a variety of different database backends you can choose from. They include BDB, a high-performance transactional database backend; LDBM, a lightweight DBM based backend; SHELL, a backend interface to arbitrary shell scripts; and PASSWD, a simple backend interface to the passwd(5) file. BDB utilizes Sleepycat Berkeley DB. LDBM utilizes either Berkeley DB or GDBM.

    +

    Choice of database backends: slapd comes with a variety of different database backends you can choose from. They include BDB, a high-performance transactional database backend; LDBM, a lightweight DBM based backend; SHELL, a backend interface to arbitrary shell scripts; and PASSWD, a simple backend interface to the passwd(5) file. The BDB backend utilizes Sleepycat Berkeley DB. The LDBM utilizes either Berkeley DB or GDBM.

    Multiple database instances: slapd can be configured to serve multiple databases at the same time. This means that a single slapd server can respond to requests for many logically different portions of the LDAP tree, using the same or different database backends.

    -

    Generic modules API: If you require even more customization, slapd lets you write your own modules easily. slapd consists of two distinct parts: a front end that handles protocol communication with LDAP clients; and modules which handle specific tasks such as database operations. Because these two pieces communicate via a well-defined C API, you can write your own customized modules which extend slapd in numerous ways. Also, a number of programmable database modules are provided. These allow you to expose external data sources to slapd using popular programming languages (Perl, shell, SQL, and TCL).

    +

    Generic modules API: If you require even more customization, slapd lets you write your own modules easily. slapd consists of two distinct parts: a front end that handles protocol communication with LDAP clients; and modules which handle specific tasks such as database operations. Because these two pieces communicate via a well-defined C API, you can write your own customized modules which extend slapd in numerous ways. Also, a number of programmable database modules are provided. These allow you to expose external data sources to slapd using popular programming languages (Perl, shell, SQL, and TCL).

    Threads: slapd is threaded for high performance. A single multi-threaded slapd process handles all incoming requests using a pool of threads. This reduces the amount of system overhead required while providing high performance.

    -

    Replication: slapd can be configured to maintain replica copies of its database. This single-master/multiple-slave replication scheme is vital in high-volume environments where a single slapd just doesn't provide the necessary availability or reliability. slapd also includes experimental support for multi-master replication.

    +

    Replication: slapd can be configured to maintain shadow copies of directory information. This single-master/multiple-slave replication scheme is vital in high-volume environments where a single slapd just doesn't provide the necessary availability or reliability. slapd also includes experimental support for multi-master replication (for use where strong ACID properties are not required). slapd supports two replication methods: LDAP Sync-based and slurpd(8)-based replication .

    +

    Proxy Cache: slapd can be configured as a caching LDAP proxy service.

    Configuration: slapd is highly configurable through a single configuration file which allows you to change just about everything you'd ever want to change. Configuration options have reasonable defaults, making your job much easier.

    -

    slapd also has its limitations, of course. The main BDB backend does not handle range queries or negation queries very well.

    1.7. What is slurpd and what can it do?

    -

    slurpd(8) is a daemon that helps slapd provide replicated service. It is responsible for distributing changes made to the master slapd database out to the various slapd replicas. It frees slapd from having to worry that some replicas might be down or unreachable when a change comes through; slurpd handles retrying failed requests automatically. slapd and slurpd communicate through a simple text file that is used to log changes.

    +

    slurpd(8) is a daemon that, with slapd help, provides replicated service. It is responsible for distributing changes made to the master slapd database out to the various slapd replicas. It frees slapd from having to worry that some replicas might be down or unreachable when a change comes through; slurpd handles retrying failed requests automatically. slapd and slurpd communicate through a simple text file that is used to log changes.

    See the Replication with slurpd chapter for information about how to configure and run slurpd(8).

    +

    Alternatively, LDAP-Sync-based replication may be used to provide a replicated service. See the LDAP Sync Replication chapter for details.

    2. A Quick-Start Guide

    @@ -528,7 +543,7 @@ This command will search for and retrieve every entry in the database.

    4.2.4. Database Software

    OpenLDAP's slapd(8) primary database backend, BDB, requires Sleepycat Software Berkeley DB, version 4. If not available at configure time, you will not be able build slapd(8) with this primary database backend.

    Your operating system may provide Berkeley DB, version 4, in the base system or as an optional software component. If not, you'll have to obtain and install it yourself.

    -

    Berkeley DB is available from Sleepycat Software's download page http://www.sleepycat.com/download.html. There are several versions available. At the time of this writing, the latest release, version 4.1, is recommended. This package is required if you wish to use the BDB database backend.

    +

    Berkeley DB is available from Sleepycat Software's download page http://www.sleepycat.com/download/. There are several versions available. At the time of this writing, the latest release, version 4.1, is recommended. This package is required if you wish to use the BDB database backend.

    OpenLDAP's slapd(8) LDBM backend supports a variety of data base managers including Berkeley DB and GDBM. GDBM is available from FSF's download site ftp://ftp.gnu.org/pub/gnu/gdbm/.

    4.2.5. Threads

    OpenLDAP is designed to take advantage of threads. OpenLDAP supports POSIX pthreads, Mach CThreads, and a number of other varieties. configure will complain if it cannot find a suitable thread subsystem. If this occurs, please consult the Software|Installation|Platform Hints section of the OpenLDAP FAQ http://www.openldap.org/faq/.

    @@ -645,7 +660,8 @@ Specify additional libraries

    An alternate configuration file can be specified via a command-line option to slapd(8) or slurpd(8). This chapter describes the general format of the config file, followed by a detailed description of commonly used config file directives.

    5.1. Configuration File Format

    The slapd.conf(5) file consists of three types of configuration information: global, backend specific, and database specific. Global information is specified first, followed by information associated with a particular backend type, which is then followed by information associated with a particular database instance. Global directives can be overridden in backend and/or database directives, and backend directives can be overridden by database directives.

    -

    Blank lines and comment lines beginning with a '#' character are ignored. If a line begins with white space, it is considered a continuation of the previous line. The general format of slapd.conf is as follows:

    +

    Blank lines and comment lines beginning with a '#' character are ignored. If a line begins with white space, it is considered a continuation of the previous line (even if the previous line is a comment).

    +

    The general format of slapd.conf is as follows:

             # global configuration directives
         <global config directives>
@@ -680,7 +696,7 @@ Specify additional libraries
 
    
 Note: If no access directives are specified, the default access control policy, access to * by * read, allows all both authenticated and anonymous users read access.
 
    
-
     5.2.1.2. attributetype <RFC2252 Attribute Type Description>
    
+
     5.2.1.2. attributetype <RFC2252 Attribute Type Description>
    
 
    This directive defines an attribute type. Please see the Schema Specification chapter for information regarding how to use this directive.
    
 
    5.2.1.3. idletimeout <integer>
    
 
    Specify the number of seconds to wait before forcibly closing an idle client connection.  An idletimeout of 0, the default, disables this feature.
    
@@ -824,7 +840,7 @@ print entry parsing debugging
 
      loglevel 256
 
    
-
     5.2.1.6. objectclass <RFC2252 Object Class Description>
    
+
     5.2.1.6. objectclass <RFC2252 Object Class Description>
    
 
    This directive defines an object class. Please see the Schema Specification chapter for information regarding how to use this directive.
    
 
    5.2.1.7. referral <URI>
    
 
    This directive specifies the referral to pass back when slapd cannot find a local database to handle a request.
    
@@ -963,26 +979,28 @@ SQL Programmable backend

    5.2.3.3. replica

    -        replica host=<hostname>[:<port>]
-                [bindmethod={ simple | kerberos | sasl }]
+        replica uri=ldap[s]://<hostname>[:<port>] | host=<hostname>[:<port>]
+                [bindmethod={simple|kerberos|sasl}]
                 ["binddn=<DN>"]
-                [mech=<mech>]
+                [saslmech=<mech>]
                 [authcid=<identity>]
                 [authzid=<identity>]
                 [credentials=<password>]
                 [srvtab=<filename>]
    -

    This directive specifies a replication site for this database. The host= parameter specifies a host and optionally a port where the slave slapd instance can be found. Either a domain name or IP address may be used for <hostname>. If <port> is not given, the standard LDAP port number (389) is used.

    -

    The binddn= parameter gives the DN to bind as for updates to the slave slapd. It should be a DN which has read/write access to the slave slapd's database, typically given as a rootdn in the slave's config file. It must also match the updatedn directive in the slave slapd's config file. Since DNs are likely to contain embedded spaces, the entire "binddn=<DN>" string should be enclosed in double quotes.

    +

    This directive specifies a replication site for this database. The uri= parameter specifies a scheme, a host and optionally a port where the slave slapd instance can be found. Either a domain name or IP address may be used for <hostname>. If <port> is not given, the standard LDAP port number (389 or 636) is used.

    +

    host is deprecated in favor of the uri parameter.

    +

    uri allows the replica LDAP server to be specified as an LDAP URI such as ldap://slave.example.com:389 or ldaps://slave.example.com:636.

    +

    The binddn= parameter gives the DN to bind as for updates to the slave slapd. It should be a DN which has read/write access to the slave slapd's database. It must also match the updatedn directive in the slave slapd's config file. Generally, this DN should not be the same as the rootdn of the master database. Since DNs are likely to contain embedded spaces, the entire "binddn=<DN>" string should be enclosed in double quotes.

    The bindmethod is simple or kerberos or sasl, depending on whether simple password-based authentication or Kerberos authentication or SASL authentication is to be used when connecting to the slave slapd.

    Simple authentication should not be used unless adequate integrity and privacy protections are in place (e.g. TLS or IPSEC). Simple authentication requires specification of binddn and credentials parameters.

    Kerberos authentication is deprecated in favor of SASL authentication mechanisms, in particular the KERBEROS_V4 and GSSAPI mechanisms. Kerberos authentication requires binddn and srvtab parameters.

    -

    SASL authentication is generally recommended. SASL authentication requires specification of a mechanism using the mech parameter. Depending on the mechanism, an authentication identity and/or credentials can be specified using authcid and credentials respectively. The authzid parameter may be used to specify an authorization identity.

    +

    SASL authentication is generally recommended. SASL authentication requires specification of a mechanism using the saslmech parameter. Depending on the mechanism, an authentication identity and/or credentials can be specified using authcid and credentials respectively. The authzid parameter may be used to specify an authorization identity.

    See the chapter entitled Replication with slurpd for more information on how to use this directive.

    5.2.3.4. replogfile <filename>

    This directive specifies the name of the replication log file to which slapd will log changes. The replication log is typically written by slapd and read by slurpd. Normally, this directive is only used if slurpd is being used to replicate the database. However, you can also use it to generate a transaction log, if slurpd is not running. In this case, you will need to periodically truncate the file, since it will grow indefinitely otherwise.

    See the chapter entitled Replication with slurpd for more information on how to use this directive.

    -

    5.2.3.5. rootdn <dn>

    +

    5.2.3.5. rootdn <DN>

    This directive specifies the DN that is not subject to access control or administrative limit restrictions for operations on this database. The DN need not refer to an entry in this database or even in the directory. The DN may refer to a SASL identity.

    Entry-based Example:

    @@ -1015,7 +1033,45 @@ SQL Programmable backend
 
    
 Note: When the backend to pass a query to is selected, slapd looks at the suffix line(s) in each database definition in the order they appear in the file. Thus, if one database suffix is a prefix of another, it must appear after it in the config file.
 
    
-
    5.2.3.8. updatedn <dn>
    
+
    5.2.3.8. syncrepl
    
+
    +        syncrepl rid=<replica ID>
+                provider=ldap[s]://<hostname>[:port]
+                [type=refreshOnly|refreshAndPersist]
+                [interval=dd:hh:mm:ss]
+                [searchbase=<base DN>]
+                [filter=<filter str>]
+                [scope=sub|one|base]
+                [attrs=<attr list>]
+                [attrsonly]
+                [sizelimit=<limit>]
+                [timelimit=<limit>]
+                [schemachecking=on|off]
+                [updatedn=<DN>]
+                [bindmethod=simple|sasl]
+                [binddn=<DN>]
+                [saslmech=<mech>]
+                [authcid=<identity>]
+                [authzid=<identity>]
+                [credentials=<passwd>]
+                [realm=<realm>]
+                [secprops=<properties>]
+
    
+
    This directive specifies the current database as a replica of the master content by establishing the current slapd(8) as a replication consumer site running a syncrepl replication engine. The master database is located at the replication provider site specified by the provider parameter. The replica database is kept up-to-date with the master content using the LDAP Content Synchronization protocol. See draft-zeilenga-ldup-sync-xx.txt (a work in progress) for more information on the protocol.
    
+
    The rid parameter is used for identification of the current syncrepl directive within the replication consumer server, where <replica ID> uniquely identifies the syncrepl specification described by the current syncrepl directive. <replica ID> is non-negative and is no more than three decimal digits in length.
    
+
    The provider parameter specifies the replication provider site containing the master content as an LDAP URI. The provider parameter specifies a scheme, a host and optionally a port where the provider slapd instance can be found. Either a domain name or IP address may be used for <hostname>. Examples are ldap://provider.example.com:389 or ldaps://192.168.1.1:636. If <port> is not given, the standard LDAP port number (389 or 636) is used. Note that the syncrepl uses a consumer-initiated protocol, and hence its specification is located at the consumer site, whereas the replica specification is located at the provider site. syncrepl and replica directives define two independent replication mechanisms. They do not represent the replication peers of each other.
    
+
    The content of the syncrepl replica is defined using a search specification as its result set. The consumer slapd will send search requests to the provider slapd according to the search specification. The search specification includes searchbase, scope, filter, attrs, attrsonly, sizelimit, and timelimit parameters as in the normal search specification. The syncrepl search specification has the same value syntax and the same default values as in the ldapsearch(1) client search tool.
    
+
    The LDAP Content Synchronization protocol has two operation types: refreshOnly and refreshAndPersist. The operation type is specified by the type parameter. In the refreshOnly operation, the next synchronization search operation is periodically rescheduled at an interval time after each synchronization operation finishes. The interval is specified by the interval parameter. It is set to one day by default. In the refreshAndPersist operation, a synchronization search remains persistent in the provider slapd. Further updates to the master replica will generate searchResultEntry to the consumer slapd as the search responses to the persistent synchronization search.
    
+
    The schema checking can be enforced at the LDAP Sync consumer site by turning on the schemachecking parameter. If it is turned on, every replicated entry will be checked for its schema as the entry is stored into the replica content. Every entry in the replica should contain those attributes required by the schema definition. If it is turned off, entries will be stored without checking schema conformance. The default is off.
    
+
    The updatedn parameter specifies the DN in the consumer site which is allowed to make changes to the replica. This DN is used locally by the syncrepl engine when updating the replica with the entries received from the provider site by using the internal operation mechanism. The update of the replica content is subject to the access control privileges of the DN.  The DN should have read/write access to the replica database.  Generally, this DN should not be the same as rootdn.
    
+
    The binddn parameter gives the DN to bind as for the syncrepl searches to the provider slapd. It should be a DN which has read access to the replication content in the master database.
    
+
    The bindmethod is simple or sasl, depending on whether simple password-based authentication or SASL authentication is to be used when connecting to the provider slapd.
    
+
    Simple authentication should not be used unless adequate integrity and privacy protections are in place (e.g. TLS or IPSEC). Simple authentication requires specification of binddn and credentials parameters.
    
+
    SASL authentication is generally recommended.  SASL authentication requires specification of a mechanism using the saslmech parameter. Depending on the mechanism, an authentication identity and/or credentials can be specified using authcid and credentials, respectively.  The authzid parameter may be used to specify an authorization identity.
    
+
    The realm parameter specifies a realm which a certain mechanisms authenticate the identity within. The secprops parameter specifies Cyrus SASL security properties.
    
+
    The syncrepl replication mechanism is supported by the three native backends: back-bdb, back-hdb, and back-ldbm.
    
+
    See the LDAP Sync Replication chapter of the admin guide for more information on how to use this directive.
    
+
    5.2.3.9. updatedn <DN>
    
 
    This directive is only applicable in a slave slapd. It specifies the DN allowed to make changes to the replica.  This may be the DN slurpd(8) binds as when making changes to the replica or the DN associated with a SASL identity.
    
 
    Entry-based Example:
    
 
    @@ -1026,7 +1082,7 @@ SQL Programmable backend
         updatedn "uid=slurpd,cn=example.com,cn=digest-md5,cn=auth"
 
    
 
    See the Replication with slurpd chapter for more information on how to use this directive.
    
-
    5.2.3.9. updateref <URL>
    
+
    5.2.3.10. updateref <URL>
    
 
    This directive is only applicable in a slave slapd. It specifies the URL to return to clients which submit update requests upon the replica. If specified multiple times, each URL is provided.
    
 
    Example:
    
 
    @@ -1040,6 +1096,9 @@ SQL Programmable backend
 
             directory /usr/local/var/openldap-data
 
    
+
    5.2.4.2. sessionlog <sid> <limit>
    
+
    This directive specifies a session log store in the syncrepl replication provider server which contains information on the entries that have been scoped out of the replication content identified by <sid>. The first syncrepl search request having the same <sid> value in the cookie establishes the session log store in the provider server. The number of the entries in the session log store is limited by <limit>. Excessive entries are removed from the store in the FIFO order. Both <sid> and <limit> are non-negative integers. <sid> has no more than three decimal digits.
    
+
    The LDAP Content Synchronization operation that falls into a pre-existing session can use the session log store in order to reduce the amount of synchronization traffic. If the replica is not so outdated that it can be made up-to-date by the information in the session store, the provider slapd will send the consumer slapd the identities of the scoped-out entries together with the in-scope entries added to or modified within the replication content. If the replica status is outdated too much and beyond the coverage of the history store, then the provider slapd will send the identities of the unchanged in-scope entries along with the changed in-scope entries. The consumer slapd will then remove those entries in the replica which are not identified as present in the provider content.
    
 
    5.2.5. LDBM Database Directives
    
 
    Directives in this category only apply to a LDBM database. That is, they must follow a "database ldbm" line and come before any subsequent "backend" or "database" line.  For a complete reference of LDBM configuration directives, see slapd-ldbm(5).
    
 
    5.2.5.1. cachesize <integer>
    
@@ -1094,7 +1153,7 @@ SQL Programmable backend
                 [filter=<ldapfilter>] [attrs=<attrlist>]
         <basic-style> ::= regex | exact
         <scope-style> ::= base | one | subtree | children
-        <attrlist> ::= <attr> | <attr> , <attrlist>
+        <attrlist> ::= <attr> [val[.<basic-style>]=<regex>] | <attr> , <attrlist>
         <attr> ::= <attrname> | entry | children
         <who> ::= * | [anonymous | users | self
                         | dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>]
@@ -1108,18 +1167,18 @@ SQL Programmable backend
                 [aci=<attrname>]
         <access> ::= [self]{<level>|<priv>}
         <level> ::= none | auth | compare | search | read | write
-        <priv> ::= {=|+|-}{w|r|s|c|x}+
+        <priv> ::= {=|+|-}{w|r|s|c|x|0}+
         <control> ::= [stop | continue | break]
 
    
 
    where the <what> part selects the entries and/or attributes to which the access applies, the <who> part specifies which entities are granted access, and the <access> part specifies the access granted. Multiple <who> <access> <control> triplets are supported, allowing many entities to be granted different access to the same set of entries and attributes. Not all of these access control options are described here; for more details see the slapd.access(5) man page.
    
 
    5.3.1. What to control access to
    
 
    The <what> part of an access specification determines the entries and attributes to which the access control applies.  Entries are commonly selected in two ways: by DN and by filter.  The following qualifiers select entries by DN:
    
 
    -        by *
-        by dn[.<basic-style>]=<regex>
-        by dn.<scope-style>=<DN>
+        to *
+        to dn[.<basic-style>]=<regex>
+        to dn.<scope-style>=<DN>
 
    
-
    The first form is used to select all entries.  The second form may be used to select entries by matching a regular expression against the target entry's normalized DN.   (The second form is not discussed further in this document.)  The third form is used to select entries which are within the requested scope of DN.  The <DN> is a string representation of the Distinguished Name, as described in RFC2253.
    
+
    The first form is used to select all entries.  The second form may be used to select entries by matching a regular expression against the target entry's normalized DN.   (The second form is not discussed further in this document.)  The third form is used to select entries which are within the requested scope of DN.  The <DN> is a string representation of the Distinguished Name, as described in RFC2253.
    
 
    The scope can be either base, one, subtree, or children.  Where base matches only the entry with provided DN, one matches the entries whose parent is the provided DN, subtree matches all entries in the subtree whose root is the provided DN, and children matches all entries under the DN (but not the entry named by the DN).
    
 
    For example, if the directory contained entries named:
    
 
    @@ -1141,21 +1200,25 @@ SQL Programmable backend
 dn.children="ou=people,o=suffix" match 3, 4, and 5.
 
    Entries may also be selected using a filter:
    
 
    -        by filter=<ldap filter>
+        to filter=<ldap filter>
 
    
-
    where <ldap filter> is a string representation of an LDAP search filter, as described in RFC2254.  For example:
    
+
    where <ldap filter> is a string representation of an LDAP search filter, as described in RFC2254.  For example:
    
 
    -        by filter=(objectClass=person)
+        to filter=(objectClass=person)
 
    
-
    Note that entries by be select by both DN and filter by include both qualifiers in the <what> clause.
    
+
    Note that entries may be selected by both DN and filter by including both qualifiers in the <what> clause.
    
 
    -        by dn.one="ou=people,o=suffix" filter=(objectClass=person)
+        to dn.one="ou=people,o=suffix" filter=(objectClass=person)
 
    
 
    Attributes within an entry are selected by including a comma-separated list of attribute names in the <what> selector:
    
 
             attrs=<attribute list>
 
    
-
    There are two special psuedo attributes entry and children.  To read (and hence return) an target entry, the subject must have read access to the target's entry attribute.  To add or delete an entry, the subject must have write access to the entry's entry attribute AND must have write access to the entry's parent's children attribute.  To rename an entry, the subject must have write access to entry's entry attribute AND have write access to both the old parent's and new parent's children attributes.  The complete examples at the end of this section should help clear things up.
    
+
    A specific value of an attribute is selected by using a single attribute name and also using a value selector:
    
+
    +        attrs=<attribute> val[.<style>]=<regex>
+
    
+
    There are two special pseudo attributes entry and children.  To read (and hence return) a target entry, the subject must have read access to the target's entry attribute.  To add or delete an entry, the subject must have write access to the entry's entry attribute AND must have write access to the entry's parent's children attribute.  To rename an entry, the subject must have write access to entry's entry attribute AND have write access to both the old parent's and new parent's children attributes.  The complete examples at the end of this section should help clear things up.
    
 
    Lastly, there is a special entry selector "*" that is used to select any entry.  It is used when no other <what> selector has been provided.  It's equivalent to "dn=.*"
    
 
    5.3.2. Who to grant access to
    
 
    The <who> part identifies the entity or entities being granted access. Note that access is granted to "entities" not "entries." The following table summarizes entity specifiers:
    
@@ -1220,15 +1283,12 @@ Users within scope of a DN
 
 
 
    The DN specifier behaves much like <what> clause DN specifiers.
    
-
    Other control factors are also supported. For example, a <who> can be restricted by a regular expression matching the client's domain name:
    
-
    -        domain=<regular expression>
-
    
-
    or by an entry listed in a DN-valued attribute in the entry to which the access applies:
    
+
    Other control factors are also supported.  For example, a <who> can be restricted by an entry listed in a DN-valued attribute in the entry to which the access applies:
    
 
             dnattr=<dn-valued attribute name>
 
    
 
    The dnattr specification is used to give access to an entry whose DN is listed in an attribute of the entry (e.g., give access to a group entry to whoever is listed as the owner of the group entry).
    
+
    Some factors may not be appropriate in all environments (or any). For example, the domain factor relies on IP to domain name lookups. As these can easily spoofed, the domain factor should not be avoided.
    
 
    5.3.3. The access to grant
    
 
    The kind of <access> granted can be one of the following:
    
 
@@ -1249,7 +1309,7 @@ Users within scope of a DN
 none
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
    
 
 
    
- 
+=0
 
 
 no access
@@ -1330,7 +1390,7 @@ needed to modify/rename
                 by anonymous auth
                 by * read
 
-
    This directive allows users to modify their own entries, allows authenticate, and allows all others to read.  Note that only the first by <who> clause which matches applies.  Hence, the anonymous users are granted auth, not read.  The last clause could just as well have been "by users read".
    
+
    This directive allows the user to modify their entry, allows anonymous to authentication against these entries, and allows all others to read these entries.  Note that only the first by <who> clause which matches applies.  Hence, the anonymous users are granted auth, not read.  The last clause could just as well have been "by users read".
    
 
    It is often desirable to restrict operations based upon the level of protection in place.  The following shows how security strength factors (SSF) can be used.
    
 
             access to *
@@ -1338,8 +1398,8 @@ needed to modify/rename
                 by ssf=64 anonymous auth
                 by ssf=64 users read
 
    
-
    This directive allows users to modify their own entries if security protections have of strength 128 or better have been established, allows simple authentication and read access when 64 or better security protections have been established.
    
-
    The following example shows the use of a regular expression to select the entries by DN in two access directives where ordering is significant.
    
+
    This directive allows users to modify their own entries if security protections have of strength 128 or better have been established, allows authentication access to anonymous users, and read access when 64 or better security protections have been established.  If client has not establish sufficient security protections, the implicit by * none clause would be applied.
    
+
    The following example shows the use of a style specifiers to select the entries by DN in two access directives where ordering is significant.
    
 
             access to dn.children="dc=example,dc=com"
                 by * search
@@ -1353,13 +1413,13 @@ needed to modify/rename
         access to dn.subtree="dc=example,dc=com" attr=homePhone
                 by self write
                 by dn.children=dc=example,dc=com" search
-                by domain=.*\.example\.com read
+                by peername=IP:10\..+ read
         access to dn.subtree="dc=example,dc=com"
                 by self write
                 by dn.children="dc=example,dc=com" search
                 by anonymous auth
 
    
-
    This example applies to entries in the "dc=example,dc=com" subtree. To all attributes except homePhone, an entry can write to itself, entries under example.com entries can search by them, anybody else has no access (implicit by * none) excepting for authentication/authorization (which is always done anonymously).  The homePhone attribute is writable by the entry, searchable by entries under example.com, readable by clients connecting from somewhere in the example.com domain, and otherwise not readable (implicit by * none).  All other access is denied by the implicit access to * by * none.
    
+
    This example applies to entries in the "dc=example,dc=com" subtree. To all attributes except homePhone, an entry can write to itself, entries under example.com entries can search by them, anybody else has no access (implicit by * none) excepting for authentication/authorization (which is always done anonymously).  The homePhone attribute is writable by the entry, searchable by entries under example.com, readable by clients connecting from network 10, and otherwise not readable (implicit by * none).  All other access is denied by the implicit access to * by * none.
    
 
    Sometimes it is useful to permit a particular DN to add or remove itself from an attribute. For example, if you would like to create a group and allow people to add and remove only their own DN from the member attribute, you could accomplish it with an access directive like this:
    
 
             access to attr=member,entry
@@ -1386,10 +1446,10 @@ needed to modify/rename
  10.    rootpw secret
  11.    # replication directives
  12.    replogfile /usr/local/var/openldap/slapd.replog
- 13.    replica host=slave1.example.com:389
+ 13.    replica uri=ldap://slave1.example.com:389
  14.            binddn="cn=Replicator,dc=example,dc=com"
  15.            bindmethod=simple credentials=secret
- 16.    replica host=slave2.example.com
+ 16.    replica uri=ldaps://slave2.example.com:636
  17.            binddn="cn=Replicator,dc=example,dc=com"
  18.            bindmethod=simple credentials=secret
  19.    # indexed attribute definitions
@@ -1733,7 +1793,7 @@ print entry parsing debugging
 
    
 
    where -n or -b is used to select the database in the slapd.conf(5) specified using -f.  The corresponding LDIF output is written to standard output or to the file specified using the -l option.
    
 
    7.3. The LDIF text entry format
    
-
    The LDAP Data Interchange Format (LDIF) is used to represent LDAP entries in a simple text format.  This section provides a brief description of the LDIF entry format which complements ldif(5) and the technical specification RFC2849.
    
+
    The LDAP Data Interchange Format (LDIF) is used to represent LDAP entries in a simple text format.  This section provides a brief description of the LDIF entry format which complements ldif(5) and the technical specification RFC2849.
    
 
    The basic form of an entry is:
    
 
             # comment
@@ -1805,7 +1865,8 @@ print entry parsing debugging
 
    
 
    
 
    8. Schema Specification
    
-
    This chapter describes how to extend the user schema used by slapd(8). The first section, Distributed Schema Files details optional schema definitions provided in the distribution and where to obtain other definitions. The second section, Extending Schema, details how to define new schema items.
    
+
    This chapter describes how to extend the user schema used by slapd(8).  The chapter assumes the reader is familar with the LDAP/X.500 information model.
    
+
    The first section, Distributed Schema Files details optional schema definitions provided in the distribution and where to obtain other definitions. The second section, Extending Schema, details how to define new schema items.
    
 
    This chapter does not discuss how to extend system schema used by slapd(8) as this requires source code modification.  System schema includes all operational attribute types or any object class which allows or requires an operational attribute (directly or indirectly).
    
 
    8.1. Distributed Schema Files
    
 
    OpenLDAP is distributed with a set of schema specifications for your use.  Each set is defined in a file suitable for inclusion (using the include directive) in your slapd.conf(5) file.  These schema files are normally installed in the /usr/local/etc/openldap/schema directory.
    
@@ -1984,9 +2045,9 @@ myObjectClass
         include /usr/local/etc/openldap/schema/local.schema
 
    
 
    8.2.4. Attribute Type Specification
    
-
    The attributetype directive is used to define a new attribute type.  The directive uses the same Attribute Type Description (as defined in RFC2252) used by the attributeTypes attribute found in the subschema subentry, e.g.:
    
+
    The attributetype directive is used to define a new attribute type.  The directive uses the same Attribute Type Description (as defined in RFC2252) used by the attributeTypes attribute found in the subschema subentry, e.g.:
    
 
    -        attributetype <RFC2252 Attribute Type Description>
+        attributetype <RFC2252 Attribute Type Description>
 
    
 
    where Attribute Type Description is defined by the following BNF:
    
 
    @@ -2054,40 +2115,29 @@ boolean value
 
    
 
    
 
-distinguishedName
-
-1.3.6.1.4.1.1466.115.121.1.12
-
-DN
-
    
 directoryString
 
 
 1.3.6.1.4.1.1466.115.121.1.15
 
 
-UTF-8 string
+Unicode (UTF-8) string
 
 
    
 
    
 
-IA5String
+distinguishedName
 
 
-1.3.6.1.4.1.1466.115.121.1.26
+1.3.6.1.4.1.1466.115.121.1.12
 
 
-ASCII string
+LDAP DN
 
 
    
 
    
 
-Integer
+integer
 
 
 1.3.6.1.4.1.1466.115.121.1.27
@@ -2098,18 +2148,7 @@ integer
 
    
 
    
 
-Name and Optional UID
-
-1.3.6.1.4.1.1466.115.121.1.34
-
-DN plus UID
-
    
-Numeric String
+numericString
 
 
 1.3.6.1.4.1.1466.115.121.1.36
@@ -2131,7 +2170,7 @@ object identifier
 
    
 
    
 
-Octet String
+octetString
 
 
 1.3.6.1.4.1.1466.115.121.1.40
@@ -2140,17 +2179,6 @@ object identifier
 arbitary octets
 
 
    
-Printable String
-
-1.3.6.1.4.1.1466.115.121.1.44
-
-printable string
-
    
 
    
 
 
    @@ -2182,83 +2210,6 @@ boolean
 
 
 
-octetStringMatch
-
-
-equality
-
-
-octet string
-
-
-
-
-objectIdentiferMatch
-
-
-equality
-
-
-OID
-
-
-
-
-distinguishedNameMatch
-
-
-equality
-
-
-DN
-
-
-
-
-uniqueMemberMatch
-
-
-equality
-
-
-Name with optional UID
-
-
-
-
-numericStringMatch
-
-
-equality
-
-
-numerical
-
-
-
-
-numericStringOrderingMatch
-
-
-ordering
-
-
-numerical
-
-
-
-
-numericStringSubstringsMatch
-
-
-substrings
-
-
-numerical
-
-
-
-
 caseIgnoreMatch
 
 
@@ -2325,68 +2276,112 @@ case sensitive, space insensitive
 
 
 
-caseIgnoreIA5Match
+distinguishedNameMatch
 
 
 equality
 
 
-case insensitive, space insensitive
+distinguished name
 
 
 
 
-caseIgnoreIA5OrderingMatch
-
-
-ordering
-
-
-case insensitive, space insensitive
-
-
-
-
-caseIgnoreIA5SubstringsMatch
-
-
-substrings
-
-
-case insensitive, space insensitive
-
-
-
-
-caseExactIA5Match
+integerMatch
 
 
 equality
 
 
-case sensitive, space insensitive
+integer
 
 
 
 
-caseExactIA5OrderingMatch
+integerOrderingMatch
 
 
 ordering
 
 
-case sensitive, space insensitive
+integer
 
 
 
 
-caseExactIA5SubstringsMatch
+numericStringMatch
+
+
+equality
+
+
+numerical
+
+
+
+
+numericStringOrderingMatch
+
+
+ordering
+
+
+numerical
+
+
+
+
+numericStringSubstringsMatch
 
 
 substrings
 
 
-case sensitive, space insensitive
+numerical
+
+
+
+
+octetStringMatch
+
+
+equality
+
+
+octet string
+
+
+
+
+octetStringOrderingStringMatch
+
+
+ordering
+
+
+octet string
+
+
+
+
+octetStringSubstringsStringMatch
+
+
+ordering
+
+
+octet string
+
+
+
+
+objectIdentiferMatch
+
+
+equality
+
+
+object identifier
 
 
 
@@ -2395,7 +2390,7 @@ case sensitive, space insensitive
 
    Neither attribute is restricted to a single value.  Both are meant for usage by user applications.  Neither is obsolete nor collective.
    
 
    The following subsections provide a couple of examples.
    
 
    8.2.4.1. myUniqueName
    
-
    Many organizations maintain a single unique name for each user. Though one could use displayName (RFC2798), this attribute is really meant to be controlled by the user, not the organization.  We could just copy the definition of displayName from inetorgperson.schema and replace the OID, name, and description, e.g:
    
+
    Many organizations maintain a single unique name for each user. Though one could use displayName (RFC2798), this attribute is really meant to be controlled by the user, not the organization.  We could just copy the definition of displayName from inetorgperson.schema and replace the OID, name, and description, e.g:
    
 
             attributetype ( 1.1.2.1.1 NAME 'myUniqueName'
                 DESC 'unique name with my organization'
@@ -2411,7 +2406,7 @@ case sensitive, space insensitive
                 SUP name )
 
    
 
    8.2.4.2. myPhoto
    
-
    Many organizations maintain a photo of each each user.  A myPhoto attribute type could be defined to hold a photo. Of course, one could use just use jpegPhoto (RFC2798) (or a subtype) to hold the photo.  However, you can only do this if the photo is in JPEG File Interchange Format. Alternatively, an attribute type which uses the Octet String syntax can be defined, e.g.:
    
+
    Many organizations maintain a photo of each each user.  A myPhoto attribute type could be defined to hold a photo. Of course, one could use just use jpegPhoto (RFC2798) (or a subtype) to hold the photo.  However, you can only do this if the photo is in JPEG File Interchange Format. Alternatively, an attribute type which uses the Octet String syntax can be defined, e.g.:
    
 
             attributetype ( 1.1.2.1.2 NAME 'myPhoto'
                 DESC 'a photo (application defined format)'
@@ -2420,16 +2415,16 @@ case sensitive, space insensitive
 
    
 
    In this case, the syntax doesn't specify the format of the photo. It's assumed (maybe incorrectly) that all applications accessing this attribute agree on the handling of values.
    
 
    If you wanted to support multiple photo formats, you could define a separate attribute type for each format, prefix the photo with some typing information, or describe the value using ASN.1 and use the ;binary transfer option.
    
-
    Another alternative is for the attribute to hold a URI pointing to the photo.  You can model such an attribute after labeledURI (RFC2079) or simply create a subtype, e.g.:
    
+
    Another alternative is for the attribute to hold a URI pointing to the photo.  You can model such an attribute after labeledURI (RFC2079) or simply create a subtype, e.g.:
    
 
             attributetype ( 1.1.2.1.3 NAME 'myPhotoURI'
                 DESC 'URI and optional label referring to a photo'
                 SUP labeledURI )
 
    
 
    8.2.5. Object Class Specification
    
-
    The objectclasses directive is used to define a new object class.  The directive uses the same Object Class Description (as defined in RFC2252) used by the objectClasses attribute found in the subschema subentry, e.g.:
    
+
    The objectclasses directive is used to define a new object class.  The directive uses the same Object Class Description (as defined in RFC2252) used by the objectClasses attribute found in the subschema subentry, e.g.:
    
 
    -        objectclass <RFC2252 Object Class Description>
+        objectclass <RFC2252 Object Class Description>
 
    
 
    where Object Class Description is defined by the following BNF:
    
 
    @@ -2455,7 +2450,7 @@ case sensitive, space insensitive
                 MAY myPhoto )
 
    
 
    8.2.5.2. myPerson
    
-
    If your organization would like have a private structural object class to instantiate users, you can subclass one of the existing person classes, such as inetOrgPerson (RFC2798), and add any additional attributes which you desire.
    
+
    If your organization would like have a private structural object class to instantiate users, you can subclass one of the existing person classes, such as inetOrgPerson (RFC2798), and add any additional attributes which you desire.
    
 
             objectclass ( 1.1.2.2.2 NAME 'myPerson'
                 DESC 'my person'
@@ -2541,21 +2536,45 @@ case sensitive, space insensitive
 
    
 
    
 
    10. Using SASL
    
-
    OpenLDAP clients and servers are capable of authenticating via the Simple Authentication and Security Layer (SASL) framework, which is detailed in RFC2222.   This chapter describes how to make use of SASL in OpenLDAP.
    
-
    There are several industry standard authentication mechanisms that can be used with SASL, including Kerberos V4, GSSAPI, and DIGEST-MD.  The standard client tools provided with OpenLDAP, such as ldapsearch(1) and ldapmodify(1), will by default attempt to authenticate the user to the slapd(8) server using SASL. Basic authentication service can be set up by the LDAP administrator with a few steps, allowing users to be authenticated to the slapd server as their LDAP entry.  With a few extra steps, some users and services can be allowed to exploit SASL's proxy authorization feature, allowing them to authenticate themselves and then switch their identity to that of another user or service.
    
-
    This chapter assumes you have read Cyrus SASL for System Administrators, provided with the Cyrus SASL package (in doc/sysadmin.html) and have a working Cyrus SASL installation.  You should use the Cyrus SASL sample_client and sample_server to test your SASL installation before attempting to make use of it in OpenLDAP.
    
+
    OpenLDAP clients and servers are capable of authenticating via the Simple Authentication and Security Layer (SASL) framework, which is detailed in RFC2222.   This chapter describes how to make use of SASL in OpenLDAP.
    
+
    There are several industry standard authentication mechanisms that can be used with SASL, including GSSAPI for Kerberos V, DIGEST-MD5, and PLAIN and EXTERNAL for use with Transport Layer Security (TLS).
    
+
    The standard client tools provided with OpenLDAP Software, such as ldapsearch(1) and ldapmodify(1), will by default attempt to authenticate the user to the slapd(8) server using SASL. Basic authentication service can be set up by the LDAP administrator with a few steps, allowing users to be authenticated to the slapd server as their LDAP entry.  With a few extra steps, some users and services can be allowed to exploit SASL's proxy authorization feature, allowing them to authenticate themselves and then switch their identity to that of another user or service.
    
+
    This chapter assumes you have read Cyrus SASL for System Administrators, provided with the Cyrus SASL package (in doc/sysadmin.html) and have a working Cyrus SASL installation.  You should use the Cyrus SASL sample_client and sample_server to test your SASL installation before attempting to make use of it with OpenLDAP Software.
    
 
    Note that in the following text the term user is used to describe a person or application entity who is connecting to the LDAP server via an LDAP client, such as ldapsearch(1).  That is, the term user not only applies to both an individual using an LDAP client, but to an application entity which issues LDAP client operations without direct user control.  For example, an e-mail server which uses LDAP operations to access information held in an LDAP server is an application entity.
    
 
    10.1. SASL Security Considerations
    
 
    SASL offers many different authentication mechanisms.  This section briefly outlines security considerations.
    
-
    Some mechanisms, such as PLAIN and LOGIN, offer no greater security over LDAP "simple" authentication.  Like "simple" authentication, such mechanisms should not be used unless you have adequate security protections in place.  It is recommended that these mechanisms be used only in conjunction with Transport Layer Security (TLS).  Use of PLAIN and LOGIN are not discussed further in this document.
    
-
    The DIGEST-MD5 mechanism is the mandatory-to-implement authentication mechanism for LDAPv3.  Though DIGEST-MD5 is not a strong authentication mechanism in comparison with trusted third party authentication systems (such as Kerberos or public key systems), yet it does offer significant protections against a number of attacks.  Unlike the CRAM-MD5 mechanism, it prevents chosen plaintext attacks.  DIGEST-MD5 is favored over the weaker and even more dangerous use of plaintext password mechanisms.  The CRAM-MD5 mechanism is deprecated in favor of DIGEST-MD5.  Use of DIGEST-MD5 is discussed below.
    
-
    The KERBEROS_V4 mechanism utilizes Kerberos IV to provide secure authentication services.  There is also a GSSAPI based mechanism which is generally used in conjunction with Kerberos V.  Kerberos is viewed as a secure, distributed authentication system suitable for both small and large enterprises.  Use of KERBEROS_V4 and GSSAPI are discussed below.
    
+
    Some mechanisms, such as PLAIN and LOGIN, offer no greater security over LDAP simple authentication.  Like LDAP simple authentication, such mechanisms should not be used unless you have adequate security protections in place.  It is recommended that these mechanisms be used only in conjunction with Transport Layer Security (TLS).  Use of PLAIN and LOGIN are not discussed further in this document.
    
+
    The DIGEST-MD5 mechanism is the mandatory-to-implement authentication mechanism for LDAPv3.  Though DIGEST-MD5 is not a strong authentication mechanism in comparison with trusted third party authentication systems (such as Kerberos or public key systems), it does offer significant protections against a number of attacks.  Unlike the CRAM-MD5 mechanism, it prevents chosen plaintext attacks.  DIGEST-MD5 is favored over the use of plaintext password mechanisms.  The CRAM-MD5 mechanism is deprecated in favor of DIGEST-MD5.  Use of DIGEST-MD5 is discussed below.
    
+
    The GSSAPI mechanism utilizes Kerberos V to provide secure authentication services.  The KERBEROS_V4 mechanism is available for those using Kerberos IV.  Kerberos is viewed as a secure, distributed authentication system suitable for both small and large enterprises.  Use of GSSAPI and KERBEROS_V4 are discussed below.
    
 
    The EXTERNAL mechanism utilizes authentication services provided by lower level network services such as TLS (TLS).  When used in conjunction with TLS X.509-based public key technology, EXTERNAL offers strong authentication.  Use of EXTERNAL is discussed in the Using TLS chapter.
    
-
    There are other strong authentication mechanisms to choose from, including OTP (one time passwords) and SRP (secure remote passwords). These mechanisms are not discussed in this document.
    
+
    There are other strong authentication mechanisms to choose from, including OTP (one time passwords) and SRP (secure remote passwords).  These mechanisms are not discussed in this document.
    
 
    10.2. SASL Authentication
    
 
    Getting basic SASL authentication running involves a few steps. The first step configures your slapd server environment so that it can communicate with client programs using the security system in place at your site. This usually involves setting up a service key, a public key, or other form of secret. The second step concerns mapping authentication identities to LDAP DN's, which depends on how entries are laid out in your directory. An explanation of the first step will be given in the next section using Kerberos V4 as an example mechanism. The steps necessary for your site's authentication mechanism will be similar, but a guide to every mechanism available under SASL is beyond the scope of this chapter. The second step is described in the section Mapping Authentication identities to LDAP entries.
    
-
    10.2.1. KERBEROS_V4
    
+
    10.2.1. GSSAPI
    
+
    This section describes the use of the SASL GSSAPI mechanism and Kerberos V with OpenLDAP.  It will be assumed that you have Kerberos V deployed, you are familiar with the operation of the system, and that your users are trained in its use.  This section also assumes you have familiarized yourself with the use of the GSSAPI mechanism by reading Configuring GSSAPI and Cyrus SASL (provided with Cyrus SASL in the doc/gssapi file) and successfully experimented with the Cyrus provided sample_server and sample_client applications.  General information about Kerberos is available at http://web.mit.edu/kerberos/www/.
    
+
    To use the GSSAPI mechanism with slapd(8) one must create a service key with a principal for ldap service within the realm for the host on which the service runs.  For example, if you run slapd on directory.example.com and your realm is EXAMPLE.COM, you need to create a service key with the principal:
    
+
    +        ldap/directory.example.com@EXAMPLE.COM
+
    
+
    When slapd(8) runs, it must have access to this key.  This is generally done by placing the key into a keytab, such as /etc/krb5.keytab.
    
+
    To use the GSSAPI mechanism to authenticate to the directory, the user obtains a Ticket Granting Ticket (TGT) prior to running the LDAP client.  When using OpenLDAP client tools, the user may mandate use of the GSSAPI mechanism by specifying -Y GSSAPI as a command option.
    
+
    For the purposes of authentication and authorization, slapd(8) associates a non-mapped authentication request DN of the form:
    
+
    +        uid=<primary[/instance]>,cn=<realm>,cn=gssapi,cn=auth
+
    
+
    Continuing our example, a user with the Kerberos principal kurt@EXAMPLE.COM would have the associated DN:
    
+
    +        uid=kurt,cn=example.com,cn=gssapi,cn=auth
+
    
+
    and the principal ursula/admin@FOREIGN.REALM would have the associated DN:
    
+
    +        uid=ursula/admin,cn=foreign.realm,cn=gssapi,cn=auth
+
    
+
    10.2.2. KERBEROS_V4
    
 
    This section describes the use of the SASL KERBEROS_V4 mechanism with OpenLDAP.  It will be assumed that you are familiar with the workings of the Kerberos IV security system, and that your site has Kerberos IV deployed.  Your users should be familiar with authentication policy, how to receive credentials in a Kerberos ticket cache, and how to refresh expired credentials.
    
+
    
+Note: KERBEROS_V4 and Kerberos IV are deprecated in favor of GSSAPI and Kerberos V.
+
    
 
    Client programs will need to be able to obtain a session key for use when connecting to your LDAP server. This allows the LDAP server to know the identity of the user, and allows the client to know it is connecting to a legitimate server. If encryption layers are to be used, the session key can also be used to help negotiate that option.
    
 
    The slapd server runs the service called "ldap", and the server will require a srvtab file with a service key.  SASL aware client programs will be obtaining an "ldap" service ticket with the user's ticket granting ticket (TGT), with the instance of the ticket matching the hostname of the OpenLDAP server. For example, if your realm is named EXAMPLE.COM and the slapd server is running on the host named directory.example.com, the /etc/srvtab file on the server will have a service key
    
 
    @@ -2575,30 +2594,10 @@ case sensitive, space insensitive
 
    
 
    This authentication request DN by itself could be placed into ACL's and groupOfNames "member" attributes, since it is of legitimate LDAP DN format. The section Mapping Authentication identities to LDAP entries, however, tells how to map that DN into the DN of a person's own LDAP entry.
    
 
    Also note that this example, being for Kerberos, shows the <realm> portion of the DN being filled in with the Kerberos realm of the company. Several other authentication mechanisms do not employ the concept of a realm, so the ",cn=<realm>" portion of the authentication request DN would not appear.
    
-
    10.2.2. GSSAPI
    
-
    This section describes the use of the SASL GSSAPI mechanism and Kerberos V with OpenLDAP. Since Kerberos V is being used, the information is very similar to the previous section.  It will be assumed that you have Kerberos V deployed, you are familiar with the operation of the system, and that your users are trained in its use.  This section also assumes you have familiarized yourself with the use of the GSSAPI mechanism by reading Configuring GSSAPI and Cyrus SASL (provided with Cyrus SASL in the doc/gssapi file) and successfully experimented with the Cyrus provided sample_server and sample_client applications.  General information about Kerberos is available at http://web.mit.edu/kerberos/www/.
    
-
    To use the GSSAPI mechanism with slapd(8) one must create a service key with a principal for ldap service within the realm for the host on which the service runs.  For example, if you run slapd on directory.example.com and your realm is EXAMPLE.COM, you need to create a service key with the principal:
    
-
    -        ldap/directory.example.com@EXAMPLE.COM
-
    
-
    When slapd(8) runs, it must have access to this key.  This is generally done by placing the key into a keytab, such as /etc/krb5.keytab.
    
-
    To use the GSSAPI mechanism to authenticate to the directory, the user obtains a Ticket Granting Ticket (TGT) prior to running the LDAP client.  When using OpenLDAP client tools, the user may mandate use of the GSSAPI mechanism by specifying -Y GSSAPI as a command option.
    
-
    For the purposes of authentication and authorization, slapd(8) associates a non-mapped authentication request DN of the form:
    
-
    -        uid=<principal>,cn=<realm>,cn=gssapi,cn=auth
-
    
-
    Continuing our example, a user with the Kerberos principal kurt@EXAMPLE.COM would have the associated DN:
    
-
    -        uid=kurt,cn=example.com,cn=gssapi,cn=auth
-
    
-
    and the principal ursula@FOREIGN.REALM would have the associated DN:
    
-
    -        uid=ursula,cn=foreign.realm,cn=gssapi,cn=auth
-
    
 
    10.2.3. DIGEST-MD5
    
 
    This section describes the use of the SASL DIGEST-MD5 mechanism using secrets stored either in the directory itself or in Cyrus SASL's own database. DIGEST-MD5 relies on the client and the server sharing a "secret", usually a password. The server generates a challenge and the client a response proving that it knows the shared secret. This is much more secure than simply sending the secret over the wire.
    
 
    Cyrus SASL supports several shared-secret mechanisms. To do this, it needs access to the plaintext password (unlike mechanisms which pass plaintext passwords over the wire, where the server can store a hashed version of the password).
    
-
    Secret passwords are normally stored in Cyrus SASL's own sasldb database, but if OpenLDAP has been compiled with Cyrus SASL 2.1 it is possible to store the secrets in the LDAP database itself. With Cyrus SASL 1.5, secrets may only be stored in the sasldb.  In either case it is very important to apply file access controls and LDAP access controls to prevent exposure of the passwords.
    
+
    Secret passwords are normally stored in Cyrus SASL's own sasldb database, but if OpenLDAP Software has been compiled with Cyrus SASL 2.1 it is possible to store the secrets in the LDAP database itself. With Cyrus SASL 1.5, secrets may only be stored in the sasldb.  In either case it is very important to apply file access controls and LDAP access controls to prevent exposure of the passwords.
    
 
    The configuration and commands discussed in this section assume the use of Cyrus SASL 2.1. If you are using version 1.5 then certain features will not be available, and the command names will not have the trailing digit "2".
    
 
    To use secrets stored in sasldb, simply add users with the saslpasswd2 command:
    
 
    @@ -2768,9 +2767,9 @@ case sensitive, space insensitive
         dn: cn=WebUpdate,dc=example,dc=com
         saslAuthzTo: ldap:///dc=example,dc=com??sub?(objectclass=Person)
 
    
-
    then any user who authenticated as cn=WebUpdate,dc=example,dc=com could authorize to any other LDAP entry under the search base "dc=example,dc=com" which has an objectClass of "Person".
    
+
    then any user who authenticated as cn=WebUpdate,dc=example,dc=com could authorize to any other LDAP entry under the search base dc=example,dc=com which has an objectClass of Person.
    
 
    10.3.3.1. Notes on Proxy Authorization Rules
    
-
    An LDAP URL in a saslAuthzTo or saslAuthzFrom attribute will return a set of DNs.  Each DN returned will be checked. Searches which return a large set can cause the authorization process to take an uncomfortably long time. Also, searches should be performed on attributes that have been indexed by slapd.
    
+
    An LDAP URL in a saslAuthzTo or saslAuthzFrom attribute will return a set of DNs.  Each DN returned will be checked.  Searches which return a large set can cause the authorization process to take an uncomfortably long time. Also, searches should be performed on attributes that have been indexed by slapd.
    
 
    To help produce more sweeping rules for saslAuthzFrom and saslAuthzTo, the values of these attributes are allowed to be DNs with regular expression characters in them. This means a source rule like
    
 
             saslAuthzTo: uid=.*,dc=example,dc=com
@@ -2780,7 +2779,7 @@ case sensitive, space insensitive
 
    10.3.3.2. Policy Configuration
    
 
    The decision of which type of rules to use, saslAuthzFrom or saslAuthzTo, will depend on the site's situation. For example, if the set of people who may become a given identity can easily be written as a search filter, then a single destination rule could be written. If the set of people is not easily defined by a search filter, and the set of people is small, it may be better to write a source rule in the entries of each of those people who should be allowed to perform the proxy authorization.
    
 
    By default, processing of proxy authorization rules is disabled. The sasl-authz-policy directive must be set in the slapd.conf(5) file to enable authorization. This directive can be set to none for no rules (the default), from for source rules, to for destination rules, or both for both source and destination rules.
    
-
    Destination rules are extremely powerful. If ordinary users have access to write the saslAuthzTo attribute in their own entries, then they can write rules that would allow them to authorize as anyone else. As such, when using destination rules, the saslAuthzTo attribute should be protected with an ACL that only allows privileged users to set its values.
    
+
    Destination rules are extremely powerful. If ordinary users have access to write the saslAuthzTo attribute in their own entries, then they can write rules that would allow them to authorize as anyone else.  As such, when using destination rules, the saslAuthzTo attribute should be protected with an ACL that only allows privileged users to set its values.
    
 
    
 
    
 
    11. Using TLS
    
@@ -2788,7 +2787,7 @@ case sensitive, space insensitive
 
    11.1. TLS Certificates
    
 
    TLS uses X.509 certificates to carry client and server identities. All servers are required to have valid certificates, whereas client certificates are optional. Clients must have a valid certificate in order to authenticate via SASL EXTERNAL. For more information on creating and managing certificates, see the OpenSSL documentation.
    
 
    11.1.1. Server Certificates
    
-
    The DN of a server certificate must use the CN attribute to name the server, and the CN must carry the server's fully qualified domain name. Additional alias names and wildcards may be present in the subjectAltName certificate extension. More details on server certificate names are in RFC2830.
    
+
    The DN of a server certificate must use the CN attribute to name the server, and the CN must carry the server's fully qualified domain name. Additional alias names and wildcards may be present in the subjectAltName certificate extension. More details on server certificate names are in RFC2830.
    
 
    11.1.2. Client Certificates
    
 
    The DN of a client certificate can be used directly as an authentication DN. Since X.509 is a part of the X.500 standard and LDAP is also based on X.500, both use the same DN formats and generally the DN in a user's X.509 certificate should be identical to the DN of their LDAP entry. However, sometimes the DNs may not be exactly the same, and so the mapping facility described in Mapping Authentication identities to LDAP entries can be applied to these DNs as well.
    
 
    11.2. TLS Configuration
    
@@ -2819,6 +2818,8 @@ case sensitive, space insensitive
 
    
 
    11.2.2. Client Configuration
    
 
    Most of the client configuration directives parallel the server directives. The names of the directives are different, and they go into ldap.conf(5) instead of slapd.conf(5), but their functionality is mostly the same. Also, while most of these options may be configured on a system-wide basis, they may all be overridden by individual users in their .ldaprc files.
    
+
    The LDAP Start TLS operation is used in LDAP to initiate TLS negotatation.  All OpenLDAP command line tools support a -Z and -ZZ flag to indicate whether a Start TLS operation is to be issued.  The latter flag indicates that the tool is to cease processing if TLS cannot be started while the former allows the command to continue.
    
+
    In LDAPv2 environments, TLS is normally started using the LDAP Secure URI scheme (ldaps://) instead of the normal LDAP URI scheme (ldap://).  OpenLDAP command line tools allow either scheme to used with the -U flag and with the URI ldap.conf(5) option.
    
 
    11.2.2.1. TLS_CACERT <filename>
    
 
    This is equivalent to the server's TLSCACertificateFile option. As noted in the TLS Configuration section, a client typically may need to know about more CAs than a server, but otherwise the same considerations apply.
    
 
    11.2.2.2. TLS_CACERTDIR <path>
    
@@ -2831,13 +2832,11 @@ case sensitive, space insensitive
 
    This directive is the same as the server's TLSRandFile option.
    
 
    11.2.2.6. TLS_REQCERT { never | allow | try | demand }
    
 
    This directive is equivalent to the server's TLSVerifyClient option. However, for clients the default value is demand and there generally is no good reason to change this setting.
    
-
    11.2.2.7. TLS { never | hard }
    
-
    This directive specifies whether client connections should use TLS by default. The default setting is never which specifies that connections will be opened in the clear unless TLS is explicitly specified using an "ldaps://" URL. When set to hard all connections will be established with TLS, as if an "ldaps://" URL was specified. Note that the use of ldaps is a holdover from LDAPv2 and this setting is incompatible with the LDAPv3 StartTLS request. As such, it's best not to use this option.
    
 
    
 
    
 
    12. Constructing a Distributed Directory Service
    
 
    For many sites, running one or more slapd(8) that hold an entire subtree of data is sufficient. But often it is desirable to have one slapd refer to other directory services for a certain part of the tree (which may or may not be running slapd).
    
-
    slapd supports subordinate and superior knowledge information. Subordinate knowledge information is held in referral objects (RFC3296).
    
+
    slapd supports subordinate and superior knowledge information. Subordinate knowledge information is held in referral objects (RFC3296).
    
 
    12.1. Subordinate Knowledge Information
    
 
    Subordinate knowledge information may be provided to delegate a subtree. Subordinate knowledge information is maintained in the directory as a special referral object at the delegate point. The referral object acts as a delegation point, gluing two services together. This mechanism allows for hierarchical directory services to be constructed.
    
 
    A referral object has a structural object class of referral and has the same Distinguished Name as the delegated subtree.  Generally, the referral object will also provide the auxiliary object class extensibleObject. This allows the entry to contain appropriate Relative Distinguished Name values.  This is best demonstrated by example.
    
@@ -2976,15 +2975,15 @@ enable all debugging
 
    13.4.1. Set up the master slapd
    
 
    The following section assumes you have a properly working slapd(8) instance. To configure your working slapd(8) server as a replication master, you need to make the following changes to your slapd.conf(5).
    
 
      
-
    1. Add a replica directive for each replica. The binddn= parameter should match the updatedn option in the corresponding slave slapd configuration file, and should name an entry with write permission to the slave database (e.g., an entry listed as rootdn, or allowed access via access directives in the slave slapd configuration file).
+
    2. Add a replica directive for each replica. The binddn= parameter should match the updatedn option in the corresponding slave slapd configuration file, and should name an entry with write permission to the slave database (e.g., an entry allowed access via access directives in the slave slapd configuration file). This DN generally should not be the same as the master's rootdn.
 
    3. Add a replogfile directive, which tells slapd where to log changes. This file will be read by slurpd.
    
 
    13.4.2. Set up the slave slapd
    
 
    Install the slapd software on the host which is to be the slave slapd server. The configuration of the slave server should be identical to that of the master, with the following exceptions:
    
 
      
 
    1. Do not include a replica directive. While it is possible to create "chains" of replicas, in most cases this is inappropriate.
 
    2. Do not include a replogfile directive.
-
    3. Do include an updatedn line. The DN given should match the DN given in the binddn= parameter of the corresponding replica= directive in the master slapd config file.
-
    4. Make sure the DN given in the updatedn directive has permission to write the database (e.g., it is listed as rootdn or is allowed access by one or more access directives).
+
    5. Do include an updatedn line. The DN given should match the DN given in the binddn= parameter of the corresponding replica= directive in the master slapd config file.  The updatedn generally should not be the same as the rootdn of the master database.
+
    6. Make sure the DN given in the updatedn directive has permission to write the database (e.g., it is is allowed access by one or more access directives).
 
    7. Use the updateref directive to define the URL the slave should return if an update request is received.
    
 
    13.4.3. Shut down the master server
    
 
    In order to ensure that the slave starts with an exact copy of the master's data, you must shut down the master slapd. Do this by sending the master slapd process an interrupt signal with kill -INT <pid>, where <pid> is the process-id of the master slapd process.
    
@@ -2996,12 +2995,25 @@ enable all debugging
 
    
 
    13.4.5. Configure the master slapd for replication
    
 
    To configure slapd to generate a replication logfile, you add a " replica" configuration option to the master slapd's config file. For example, if we wish to propagate changes to the slapd instance running on host slave.example.com:
    
+
    +        replica uri=ldap://slave.example.com:389
+                binddn="cn=Replicator,dc=example,dc=com"
+                bindmethod=simple credentials=secret
+
    
+
    In this example, changes will be sent to port 389 (the standard LDAP port) on host slave.example.com. The slurpd process will bind to the slave slapd as "cn=Replicator,dc=example,dc=com" using simple authentication with password "secret".
    
+
    If we wish to perform the same replication using ldaps on port 636:
    
+
    +        replica uri=ldaps://slave.example.com:636
+                binddn="cn=Replicator,dc=example,dc=com"
+                bindmethod=simple credentials=secret
+
    
+
    The host option is deprecated in favor of uri, but the following replica configuration is still supported:
    
 
             replica host=slave.example.com:389
                 binddn="cn=Replicator,dc=example,dc=com"
                 bindmethod=simple credentials=secret
 
    
-
    In this example, changes will be sent to port 389 (the standard LDAP port) on host slave.example.com. The slurpd process will bind to the slave slapd as "cn=Replicator,dc=example,dc=com" using simple authentication with password "secret".  Note that the DN given by the binddn= directive must exist in the slave slapd's database (or be the rootdn specified in the slapd config file) in order for the bind operation to succeed.  The DN should also be listed as the updatedn for the database in the slave's slapd.conf(5).
    
+
    Note that the DN given by the binddn= directive must exist in the slave slapd's database (or be the rootdn specified in the slapd config file) in order for the bind operation to succeed.  The DN should also be listed as the updatedn for the database in the slave's slapd.conf(5).  It is generally recommended that this DN be different than the rootdn of the master database.
    
 
    
 Note: The use of strong authentication and transport security is highly recommended.
 
    
@@ -3044,6 +3056,117 @@ enable all debugging
 
    
 
    
 
    
+
    14. LDAP Sync Replication
    
+
    The LDAP Sync replication engine, syncrepl for short, is a consumer-side replication engine that enables the consumer LDAP server to maintain a shadow copy of a DIT fragment. A syncrepl engine resides at the consumer-side as one of the slapd (8) threads. It creates and maintains a consumer replica by connecting to the replication provider to perform the initial DIT content load followed either by periodic content polling or by timely updates upon content changes.
    
+
    Syncrepl uses the LDAP Content Synchronization (or LDAP Sync for short) protocol as the replica synchronization protocol.
    
+
    Syncrepl provides a stateful replication which supports both the pull-based and the push-based synchronizations and does not mandate the use of the history store.
    
+
    Syncrepl keeps track of the status of the replication content by maintaining and exchanging synchronization cookies. Because the syncrepl consumer and provider maintain their content status, the consumer can poll the provider content to perform incremental synchronization by asking the entries required to make the consumer replica up-to-date with the provider content. Syncrepl also enables convenient management of replicas by maintaining replica status. The consumer replica can be constructed from a consumer-side or a provider-side backup at any synchronization status. Syncrepl can automatically resynchronize the consumer replica up-to-date with the current provider content.
    
+
    Syncrepl supports both the pull-based and the push-based synchronization. In its basic refreshOnly mode synchronization, the provider uses a pull-based synchronization where the consumer servers need not be tracked and no history information is maintained. The information required for the provider to process periodic polling requests is contained in the synchronization cookie of the request itself. To optimize the pull-based synchronization, syncrepl utilizes the present phase of the LDAP Sync protocol as well as its delete phase, instead of falling back on frequent full reloads. To further optimize the pull-based synchronization, the provider can maintain a per-scope session log as the history store. In its refreshAndPersist mode of synchronization, the provider uses a push-based synchronization. The provider keeps track of the consumer servers that have requested the persistent search and sends them necessary updates as the provider replication content gets modified.
    
+
    With syncrepl, a consumer server can create a replica without changing provider's configurations and without restarting the provider server, if the consumer server has appropriate access privileges for the DIT fragment to be replicated. The consumer server can stop the replication also without the need for provider-side changes and restart.
    
+
    Syncrepl supports both partial and sparse replications. The shadow DIT fragment is defined by a general search criteria consisting of base, scope, filter, and attribute list. The replica content is also subject to the access privileges of the bind identity of the syncrepl replication connection.
    
+
    14.1. The LDAP Content Synchronization Protocol
    
+
    The LDAP Sync protocol allows a client to maintain a synchronized copy of a DIT fragment. The LDAP Sync operation is defined as a set of controls and other protocol elements which extend the LDAP search operation. This section introduces the LDAP Content Sync protocol only briefly. For more information, refer to the Internet Draft The LDAP Content Synchronization Operation <draft-zeilenga-ldup-sync-05.txt>.
    
+
    The LDAP Sync protocol supports both polling and listening for changes by defining two respective synchronization operations: refreshOnly and refreshAndPersist. The polling is implemented by the refreshOnly operation. The client copy is synchronized to the server copy at the time of polling. The server finishes the search operation by returning SearchResultDone at the end of the search operation as in the normal search. The listening is implemented by the refreshAndPersist operation. Instead of finishing the search after returning all entries currently matching the search criteria, the synchronization search remains persistent in the server. Subsequent updates to the synchronization content in the server have additional entry updates be sent to the client.
    
+
    The refreshOnly operation and the refresh stage of the refreshAndPersist operation can be performed by a present phase or a delete phase.
    
+
    In the present phase, the server sends the client the entries updated within the search scope since the last synchronization. The server sends all requested attributes, be it changed or not, of the updated entries. For each unchanged entry which remains in the scope, the server sends a present message consisting only of the name of the entry and the synchronization control representing state present. The present message does not contain any attributes of the entry. After the client receives all update and present entries, it can reliably determine the new client copy by adding the entries added to the server, by replacing the entries modified at the server, and by deleting entries in the client copy which have not been updated nor specified as being present at the server.
    
+
    The transmission of the updated entries in the delete phase is the same as in the present phase. The server sends all the requested attributes of the entries updated within the search scope since the last synchronization to the client. In the delete phase, however, the server sends a delete message for each entry deleted from the search scope, instead of sending present messages. The delete message consists only of the name of the entry and the synchronization control representing state delete. The new client copy can be determined by adding, modifying, and removing entries according to the synchronization control attached to the SearchResultEntry message.
    
+
    In the case that the LDAP Sync server maintains a history store and can determine which entries are scoped out of the client copy since the last synchronization time, the server can use the delete phase. If the server does not maintain any history store, cannot determine the scoped-out entries from the history store, or the history store does not cover the outdated synchronization state of the client, the server should use the present phase. The use of the present phase is much more efficient than a full content reload in terms of the synchronization traffic. To reduce the synchronization traffic further, the LDAP Sync protocol also provides several optimizations such as the transmission of the normalized entryUUIDs and the transmission of the multiple entryUUIDs in a single syncIdSet message.
    
+
    At the end of the refreshOnly synchronization, the server sends a synchronization cookie to the client as a state indicator of the client copy after the synchronization is completed. The client will present the received cookie when it requests the next incremental synchronization to the server.
    
+
    When refreshAndPersist synchronization is used, the server sends a synchronization cookie at the end of the refresh stage by sending a Sync Info message with TRUE refreshDone. It also sends a synchronization cookie by attaching it to SearchResultEntry generated in the persist stage of the synchronization search. During the persist stage, the server can also send a Sync Info message containing the synchronization cookie at any time the server wants to update the client-side state indicator.  The server also updates a synchronization indicator of the client at the end of the persist stage.
    
+
    In the LDAP Sync protocol, entries are uniquely identified by the entryUUID attribute value. It can function as a reliable identifier of the entry. The DN of the entry, on the other hand, can be changed over time and hence cannot be considered as the reliable identifier.  The entryUUID is attached to each SearchResultEntry or SearchResultReference as a part of the synchronization control.
    
+
    14.2. Syncrepl Details
    
+
    The syncrepl engine utilizes both the refreshOnly and the refreshAndPersist operations of the LDAP Sync protocol. If a syncrepl specification is included in a database definition, slapd (8) launches a syncrepl engine as a slapd (8) thread and schedules its execution. If the refreshOnly operation is specified, the syncrepl engine will be rescheduled at the interval time after a synchronization operation is completed. If the refreshAndPersist operation is specified, the engine will remain active and process the persistent synchronization messages from the provider.
    
+
    The syncrepl engine utilizes both the present phase and the delete phase of the refresh synchronization. It is possible to configure a per-scope session log in the provider server which stores the entryUUIDs and the names of a finite number of entries deleted from a replication content. Multiple replicas of single provider content share the same per-scope session log. The syncrepl engine uses the delete phase if the session log is present and the state of the consumer server is recent enough that no session log entries are truncated after the last synchronization of the client. The syncrepl engine uses the present phase if no session log is configured for the replication content or if the consumer replica is too outdated to be covered by the session log. The current design of the session log store is memory based, so the information contained in the session log is not persistent over multiple provider invocations. It is not currently supported to access the session log store by using LDAP operations. It is also not currently supported to impose access control to the session log.
    
+
    As a further optimization, even in the case the synchronization search is not associated with any session log, no entries will be transmitted to the consumer server when there has been no update in the replication context.
    
+
    While slapd (8) can function as the LDAP Sync provider only when it is configured with either back-bdb or back-hdb backend, the syncrepl engine, which is a consumer-side replication engine, can work with any backends.
    
+
    The LDAP Sync provider maintains contextCSN for each database as the current synchronization state indicator of the provider content.  It is the largest entryCSN in the provider context such that no transactions for an entry having smaller entryCSN value remains outstanding. contextCSN could not just be set to the largest issued entryCSN because entryCSN is obtained before a transaction starts and transactions are not committed in the issue order.
    
+
    The provider stores the contextCSN of a context in the syncreplCookie attribute of the immediate child entry of the context suffix whose DN is cn=ldapsync,<suffix> and object class is syncProviderSubentry.
    
+
    The consumer stores its replica state, which is the provider's contextCSN received as a synchronization cookie, in the syncreplCookie attribute of the immediate child of the context suffix whose DN is cn=syncrepl<rid>,<suffix> and object class is syncConsumerSubentry. The replica state maintained by a consumer server is used as the synchronization state indicator when it performs subsequent incremental synchronization with the provider server. It is also used as a provider-side synchronization state indicator when it functions as a secondary provider server in a cascading replication configuration. <rid> is the replica ID uniquely identifying the replica locally in the syncrepl consumer server. <rid> is an integer which has no more than three decimal digits.
    
+
    Because a general search filter can be used in the syncrepl specification, not all entries in the context will be returned as the synchronization content. The syncrepl engine creates a glue entry to fill in the holes in the replica context if any part of the replica content is subordinate to the holes. The glue entries will not be returned as the search result unless ManageDsaIT control is provided.
    
+
    It is possible to retrieve syncProviderSubentry and syncConsumerSubentry by performing an LDAP search with the respective entries as the base object and with the base scope.
    
+
    14.3. Configuring Syncrepl
    
+
    Because syncrepl is a consumer-side replication engine, the syncrepl specification is defined in slapd.conf (5) of the consumer server, not in the provider server's configuration file. The initial loading of the replica content can be performed either by starting the syncrepl engine with no synchronization cookie or by populating the consumer replica by adding and demoting an LDIF file dumped as a backup at the provider. slapadd (8) supports the replica promotion and demotion.
    
+
    When loading from a backup, it is not required to perform the initial loading from the up-to-date backup of the provider content. The syncrepl engine will automatically synchronize the initial consumer replica to the current provider content. As a result, it is not required to stop the provider server in order to avoid the replica inconsistency caused by the updates to the provider content during the content backup and loading process.
    
+
    When replicating a large scale directory, especially in a bandwidth constrained environment, it is advised to load the consumer replica from a backup instead of performing a full initial load using syncrepl.
    
+
    14.3.1. Set up the provider slapd
    
+
    There is no special slapd.conf (5) directive for the provider syncrepl server except for the session log directive.  Because the LDAP Sync search is subject to access control, proper access control privileges should be set up for the replicated content.
    
+
    When creating a provider database from the LDIF file using slapadd (8), contextCSN and the syncProviderSubentry entry must be created. slapadd -p -w will create a new contextCSN from the entryCSNs of the added entries. It is also possible to create the syncProviderSubentry with an appropriate contextCSN value by directly including it in the ldif file. slapadd -p will preserve the provider's contextCSN or will change it to the consumer's contextCSN if it is to promote a replica to the provider's content. The syncProviderSubentry can be included in the ldif output when slapcat (8) is given the -m flag; the syncConsumerSubentry can be retrieved by the -k flag of slapcat (8).
    
+
    The session log is configured by
    
+
    +        sessionlog <sid> <limit>
+
    
+
    directive, where <sid> is the ID of the per-scope session log in the provider server and <limit> is the maximum number of session log entries the session log store can record. <sid> is an integer no longer than 3 decimal digits. If the consumer server sends a synchronization cookie containing sid=<sid> where <sid> matches the session log ID specified in the directive, the LDAP Sync search is to utilize the session log store.
    
+
    14.3.2. Set up the consumer slapd
    
+
    The syncrepl replication is specified in the database section of slapd.conf (5) for the replica context. The syncrepl engine is backend independent and the directive can be defined with any database type.
    
+
    +        syncrepl rid=123
+                provider=ldap://provider.example.com:389
+                type=refreshOnly
+                interval=01:00:00:00
+                searchbase="dc=example,dc=com"
+                filter="(objectClass=organizationalPerson)"
+                scope=sub
+                attrs="cn,sn,ou,telephoneNumber,title,l"
+                schemachecking=off
+                updatedn="cn=replica,dc=example,dc=com"
+                bindmethod=simple
+                binddn="cn=syncuser,dc=example,dc=com"
+                credentials=secret
+
    
+
    In this example, the consumer will connect to the provider slapd at port 389 of ldap://provider.example.com to perform a polling (refreshOnly) mode of synchronization once a day.  It will bind as cn=syncuser,dc=example,dc=com using simple authentication with password "secret".  Note that the access control privilege of cn=syncuser,dc=example,dc=com should be set appropriately in the provider to retrieve the desired replication content. The consumer will write to its database with the privilege of the cn=replica,dc=example,dc=com entry as specified in the updatedn= directive. The updatedn entry should have write permission to the replica content.
    
+
    The synchronization search in the above example will search for the entries whose objectClass is organizationalPerson in the entire subtree rooted at dc=example,dc=com. The requested attributes are cn, sn, ou, telephoneNumber, title, and l. The schema checking is turned off, so that the consumer slapd (8) will not enforce entry schema checking when it process updates from the provider slapd (8).
    
+
    For more detailed information on the syncrepl directive, see the syncrepl section of The slapd Configuration File chapter of this admin guide.
    
+
    14.3.3. Start the provider and the consumer slapd
    
+
    The provider slapd (8) is not required to be restarted. contextCSN is automatically generated as needed: it might originally contained in the LDIF file, generated by slapadd (8), generated upon changes in the context, or generated when the first LDAP Sync search arrived at the provider.
    
+
    When starting a consumer slapd (8), it is possible to provide a synchronization cookie as the -c cookie command line option in order to start the synchronization from a specific state. The cookie is a comma separated list of name=value pairs. Currently supported syncrepl cookie fields are csn=<csn>, sid=<sid>, and rid=<rid>. <csn> represents the current synchronization state of the consumer replica. <sid> is the identity of the per-scope session log to which this consumer will be associated. <rid> identifies a consumer replica locally within the consumer server. It is used to relate the cookie to the syncrepl definition in slapd.conf (5) which has the matching replica identifier. Both <sid> and <rid> have no more than 3 decimal digits. The command line cookie overrides the synchronization cookie stored in the consumer replica database.
    
+
    
+
    
+
    15. The Proxy Cache Engine
    
+
    LDAP servers typically hold one or more subtrees of a DIT. Replica (or shadow) servers hold shadow copies of entries held by one or more master servers.  Changes are propagated from the master server to replica (slave) servers using LDAP Sync or slurpd(8). An LDAP cache is a special type of replica which holds entries corresponding to search filters instead of subtrees.
    
+
    15.1. Overview
    
+
    The proxy cache extension of slapd is designed to improve the responseiveness of the ldap and meta backends. It handles a search request (query) by first determining whether it is contained in any cached search filter. Contained requests are answered from the proxy cache's local database. Other requests are passed on to the underlying ldap or meta backend and processed as usual.
    
+
    E.g. (shoesize>=9) is contained in (shoesize>=8) and (sn=Richardson) is contained in (sn=Richards*)
    
+
    Correct matching rules and syntaxes are used while comparing assertions for query containment. To simplify the query containment problem, a list of cacheable "templates" (defined below) is specified at configuration time. A query is cached or answered only if it belongs to one of these templates. The entries corresponding to cached queries are stored in the proxy cache local database while its associated meta information (filter, scope, base, attributes) is stored in main memory.
    
+
    A template is a prototype for generating LDAP search requests. Templates are described by a prototype search filter and a list of attributes which are required in queries generated from the template. The representation for prototype filter is similar to RFC 2254, except that the assertion values are missing. Examples of prototype filters are: (sn=),(&(sn=)(givenname=)) which are instantiated by search filters (sn=Doe) and (&(sn=Doe)(givenname=John)) respectively.
    
+
    The cache replacement policy removes the least recently used (LRU) query and entries belonging to only that query. Queries are allowed a maximum time to live (TTL) in the cache thus providing weak consistency. A background task periodically checks the cache for expired queries and removes them.
    
+
    The Proxy Cache paper (http://www.openldap.org/pub/kapurva/proxycaching.pdf) provides design and implementation details.
    
+
    15.2. Proxy Cache Configuration
    
+
    The cache configuration specific directives described below must appear after a overlay proxycache directive within a "database meta" or database ldap section of the server's slapd.conf(5) file.
    
+
    15.2.1. Setting cache parameters
    
+
    + proxyCache <DB> <maxentries> <nattrsets> <entrylimit> <period>
+
    
+
    This directive enables proxy caching and sets general cache parameters. The <DB> parameter specifies which underlying database is to be used to hold cached entries.  It should be set to bdb, hdb, or ldbm.  The <maxentries> parameter specifies the total number of entries which may be held in the cache.  The <nattrsets> parameter specifies the total number of attribute sets (as specified by the proxyAttrSet directive) that may be defined. The <entrylimit> parameter specifies the maximum number of entries in a cachable query.  The <period> specifies the consistency check period (in seconds).  In each period, queries with expired TTLs are removed.
    
+
    15.2.2. Defining attribute sets
    
+
    + proxyAttrset <index> <attrs...>
+
    
+
    Used to associate a set of attributes to an index. Each attribute set is associated with an index number from 0 to <numattrsets>-1. These indices are used by the addtemplate directive to define cacheable templates.
    
+
    15.2.3. Specifying cacheable templates
    
+
    + proxyTemplate <prototype_string> <attrset_index> <TTL>
+
    
+
    Specifies a cacheable template and the "time to live" (in sec) <TTL> for queries belonging to the template. A template is described by its prototype filter string and set of required attributes identified by <attrset_index>.
    
+
    15.2.4. Example
    
+
    An example slapd.conf(5) database section for a caching server which proxies for the "dc=example,dc=com" subtree held at server ldap.example.com.
    
+
    +        database        ldap
+        suffix          "dc=example,dc=com"
+        uri             ldap://ldap.example.com/dc=example%2cdc=com
+        overlay proxycache
+        proxycache    bdb 100000 1 1000 100
+        proxyAttrset  0 mail postaladdress telephonenumber
+        proxyTemplate (sn=) 0 3600
+        proxyTemplate (&(sn=)(givenName=)) 0 3600
+        proxyTemplate (&(departmentNumber=)(secretary=*)) 0 3600
+
+        cachesize 20
+        directory ./testrun/db.2.a
+        index       objectClass eq
+        index       cn,sn,uid,mail  pres,eq,sub
+
    
+
    
+
    
 
    A. Generic configure Instructions
    
 
     Basic Installation
@@ -3234,28 +3357,34 @@ operates.
 
    
 
    B. OpenLDAP Software Copyright Notices
    
 
    B.1. OpenLDAP Copyright Notice
    
-
    Copyright 1998-2003 The OpenLDAP Foundation, Redwood City, California, USA All rights reserved.
    
-
    Redistribution and use in source and binary forms are permitted only as authorized by the OpenLDAP Public License.  A copy of this license is available at http://www.OpenLDAP.org/license.html or in file LICENSE in the top-level directory of the distribution.
    
+
    Copyright 1998-2003 The OpenLDAP Foundation.
    All rights reserved.
    
+
    Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the OpenLDAP Public License.
    
+
    A copy of this license is available in file LICENSE in the top-level directory of the distribution or, alternatively, at <http://www.OpenLDAP.org/license.html>.
    
 
    OpenLDAP is a registered trademark of the OpenLDAP Foundation.
    
 
    Individual files and/or contributed packages may be copyright by other parties and their use subject to additional restrictions.
    
 
    This work is derived from the University of Michigan LDAP v3.3 distribution.  Information concerning this software is available at <http://www.umich.edu/~dirsvcs/ldap/>.
    
 
    This work also contains materials derived from public sources.
    
 
    Additional information about OpenLDAP software can be obtained at <http://www.OpenLDAP.org/>.
    
-
    B.2. University of Michigan Copyright Notice
    
-
    Portions Copyright 1992-1996 Regents of the University of Michigan. All rights reserved.
    
+
    B.2. Additional Copyright Notice
    
+
    Portions Copyright 1998-2003 Kurt D. Zeilenga.
    Portions Copyright 1998-2003 Net Boolean Incorporated.
    Portions Copyright 2001-2003 IBM Corporation.
    All rights reserved.
    
+
    Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the OpenLDAP Public License.
    
+
    Portions Copyright 1999-2003 Howard Y.H. Chu.
    Portions Copyright 1999-2003 Symas Corporation.
    Portions Copyright 1998-2003 Hallvard B. Furuseth.
    All rights reserved.
    
+
    Redistribution and use in source and binary forms, with or without modification, are permitted provided that this notice is preserved. The names of the copyright holders may not be used to endorse or promote products derived from this software without their specific prior written permission.  This software is provided ``as is'' without express or implied warranty.
    
+
    B.3. University of Michigan Copyright Notice
    
+
    Portions Copyright 1992-1996 Regents of the University of Michigan.
    All rights reserved.
    
 
    Redistribution and use in source and binary forms are permitted provided that this notice is preserved and that due credit is given to the University of Michigan at Ann Arbor. The name of the University may not be used to endorse or promote products derived from this software without specific prior written permission. This software is provided ``as is'' without express or implied warranty.
    
 
    
 
    
 
    C. OpenLDAP Public License
    
 
     The OpenLDAP Public License
-  Version 2.7, 7 September 2001
+  Version 2.8.1, 25 November 2003
 
 Redistribution and use of this software and associated documentation
 ("Software"), with or without modification, are permitted provided
 that the following conditions are met:
 
-1. Redistributions of source code must retain copyright statements
+1. Redistributions in source form must retain copyright statements
    and notices,
 
 2. Redistributions in binary form must reproduce applicable copyright
@@ -3287,13 +3416,13 @@ POSSIBILITY OF SUCH DAMAGE.
 The names of the authors and copyright holders must not be used in
 advertising or otherwise to promote the sale, use or other dealing
 in this Software without specific, written prior permission.  Title
-to copyright in this Software shall at all times remain with
-copyright holders.
+to copyright in this Software shall at all times remain with copyright
+holders.
 
 OpenLDAP is a registered trademark of the OpenLDAP Foundation.
 
-Copyright 1999-2001 The OpenLDAP Foundation, Redwood City,
-California, USA.  All Rights Reserved.  Permission to copy and
+Copyright 1999-2003 The OpenLDAP Foundation, Redwood City,
+California, USA.  All rights reserved.  Permission to copy and
 distribute verbatim copies of this document is granted.
 
    
 
@@ -3305,7 +3434,7 @@ distribute verbatim copies of this document is granted.
 
    
 
 ________________
    
-© Copyright 2003, OpenLDAP Foundation, info@OpenLDAP.org    
+© Copyright 2004, OpenLDAP Foundation, info@OpenLDAP.org
 
 
 
diff --git a/openldap-ntlm.diff b/openldap-ntlm.diff
new file mode 100644
index 0000000..1e52f99
--- /dev/null
+++ b/openldap-ntlm.diff
@@ -0,0 +1,199 @@
+(Note that this patch is not useful on its own... it just adds some
+hooks to work with the LDAP authentication process at a lower level
+than the API otherwise allows. The code that calls these hooks and
+actually drives the NTLM authentication process is in
+lib/e2k-global-catalog.c, and the code that actually implements the
+NTLM algorithms is in xntlm/.)
+
+This is a patch against OpenLDAP 2.2.6. Apply with -p0
+
+
+--- include/ldap.h.orig	2004-01-01 13:16:28.000000000 -0500
++++ include/ldap.h	2004-07-14 11:58:49.000000000 -0400
+@@ -1753,5 +1753,26 @@
+ 	LDAPControl **cctrls ));
+ 
+ 
++/*
++ * hacks for NTLM
++ */
++#define LDAP_AUTH_NTLM_REQUEST	((ber_tag_t) 0x8aU)
++#define LDAP_AUTH_NTLM_RESPONSE	((ber_tag_t) 0x8bU)
++LDAP_F( int )
++ldap_ntlm_bind LDAP_P((
++	LDAP		*ld,
++	LDAP_CONST char	*dn,
++	ber_tag_t	tag,
++	struct berval	*cred,
++	LDAPControl	**sctrls,
++	LDAPControl	**cctrls,
++	int		*msgidp ));
++LDAP_F( int )
++ldap_parse_ntlm_bind_result LDAP_P((
++	LDAP		*ld,
++	LDAPMessage	*res,
++	struct berval	*challenge));
++
++
+ LDAP_END_DECL
+ #endif /* _LDAP_H */
+--- libraries/libldap/Makefile.in.orig	2004-01-01 13:16:29.000000000 -0500
++++ libraries/libldap/Makefile.in	2004-07-14 13:37:23.000000000 -0400
+@@ -20,7 +20,7 @@
+ SRCS	= bind.c open.c result.c error.c compare.c search.c \
+ 	controls.c messages.c references.c extended.c cyrus.c \
+ 	modify.c add.c modrdn.c delete.c abandon.c \
+-	sasl.c sbind.c kbind.c unbind.c cancel.c  \
++	sasl.c ntlm.c sbind.c kbind.c unbind.c cancel.c  \
+ 	filter.c free.c sort.c passwd.c whoami.c \
+ 	getdn.c getentry.c getattr.c getvalues.c addentry.c \
+ 	request.c os-ip.c url.c sortctrl.c vlvctrl.c \
+@@ -29,7 +29,7 @@
+ OBJS	= bind.lo open.lo result.lo error.lo compare.lo search.lo \
+ 	controls.lo messages.lo references.lo extended.lo cyrus.lo \
+ 	modify.lo add.lo modrdn.lo delete.lo abandon.lo \
+-	sasl.lo sbind.lo kbind.lo unbind.lo cancel.lo \
++	sasl.lo ntlm.lo sbind.lo kbind.lo unbind.lo cancel.lo \
+ 	filter.lo free.lo sort.lo passwd.lo whoami.lo \
+ 	getdn.lo getentry.lo getattr.lo getvalues.lo addentry.lo \
+ 	request.lo os-ip.lo url.lo sortctrl.lo vlvctrl.lo \
+--- /dev/null	2004-06-30 15:04:37.000000000 -0400
++++ libraries/libldap/ntlm.c	2004-07-14 13:44:18.000000000 -0400
+@@ -0,0 +1,137 @@
++/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */
++/*
++ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
++ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
++ */
++
++/* Mostly copied from sasl.c */
++
++#include "portable.h"
++
++#include 
++#include 
++
++#include 
++#include 
++#include 
++#include 
++
++#include "ldap-int.h"
++
++int
++ldap_ntlm_bind(
++	LDAP		*ld,
++	LDAP_CONST char	*dn,
++	ber_tag_t	tag,
++	struct berval	*cred,
++	LDAPControl	**sctrls,
++	LDAPControl	**cctrls,
++	int		*msgidp )
++{
++	BerElement	*ber;
++	int rc;
++	ber_int_t id;
++
++	Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 );
++
++	assert( ld != NULL );
++	assert( LDAP_VALID( ld ) );
++	assert( msgidp != NULL );
++
++	if( msgidp == NULL ) {
++		ld->ld_errno = LDAP_PARAM_ERROR;
++		return ld->ld_errno;
++	}
++
++	/* create a message to send */
++	if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
++		ld->ld_errno = LDAP_NO_MEMORY;
++		return ld->ld_errno;
++	}
++
++	assert( LBER_VALID( ber ) );
++
++	LDAP_NEXT_MSGID( ld, id );
++	rc = ber_printf( ber, "{it{istON}" /*}*/,
++			 id, LDAP_REQ_BIND,
++			 ld->ld_version, dn, tag,
++			 cred );
++
++	/* Put Server Controls */
++	if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
++		ber_free( ber, 1 );
++		return ld->ld_errno;
++	}
++
++	if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
++		ld->ld_errno = LDAP_ENCODING_ERROR;
++		ber_free( ber, 1 );
++		return ld->ld_errno;
++	}
++
++	/* send the message */
++	*msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id );
++
++	if(*msgidp < 0)
++		return ld->ld_errno;
++
++	return LDAP_SUCCESS;
++}
++
++int
++ldap_parse_ntlm_bind_result(
++	LDAP		*ld,
++	LDAPMessage	*res,
++	struct berval	*challenge)
++{
++	ber_int_t	errcode;
++	ber_tag_t	tag;
++	BerElement	*ber;
++	ber_len_t	len;
++
++	Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 );
++
++	assert( ld != NULL );
++	assert( LDAP_VALID( ld ) );
++	assert( res != NULL );
++
++	if ( ld == NULL || res == NULL ) {
++		return LDAP_PARAM_ERROR;
++	}
++
++	if( res->lm_msgtype != LDAP_RES_BIND ) {
++		ld->ld_errno = LDAP_PARAM_ERROR;
++		return ld->ld_errno;
++	}
++
++	if ( ld->ld_error ) {
++		LDAP_FREE( ld->ld_error );
++		ld->ld_error = NULL;
++	}
++	if ( ld->ld_matched ) {
++		LDAP_FREE( ld->ld_matched );
++		ld->ld_matched = NULL;
++	}
++
++	/* parse results */
++
++	ber = ber_dup( res->lm_ber );
++
++	if( ber == NULL ) {
++		ld->ld_errno = LDAP_NO_MEMORY;
++		return ld->ld_errno;
++	}
++
++	tag = ber_scanf( ber, "{ioa" /*}*/,
++			 &errcode, challenge, &ld->ld_error );
++	ber_free( ber, 0 );
++
++	if( tag == LBER_ERROR ) {
++		ld->ld_errno = LDAP_DECODING_ERROR;
++		return ld->ld_errno;
++	}
++
++	ld->ld_errno = errcode;
++
++	return( ld->ld_errno );
++}
diff --git a/openldap.spec b/openldap.spec
index f4224e0..5fb1f92 100644
--- a/openldap.spec
+++ b/openldap.spec
@@ -4,17 +4,21 @@
 %define ldbm_backend berkeley
 %define version_20 2.0.27
 %define version_21 2.1.30
-# For Fedora, we want 2.1 compatibility.  For RHEL or RHL9, we want 2.0.
+%define version_22 2.2.13
+%define evolution_connector_prefix %{_libdir}/evolution-openldap
+%define evolution_connector_includedir %{evolution_connector_prefix}/include
+%define evolution_connector_libdir %{evolution_connector_prefix}/%{_lib}
+# For Fedora, we want 2.1 compatibility.  For RHEL or RHL9, we may want 2.0.
 %define compat_version %{version_21}
 %define nptl_arches %{ix86} ia64 ppc ppc64 s390 s390x sparcv9 x86_64
 
 Summary: The configuration files, libraries, and documentation for OpenLDAP.
 Name: openldap
-Version: 2.2.13
-Release: 1
+Version: %{version_22}
+Release: 2
 License: OpenLDAP
 Group: System Environment/Daemons
-Source0: ftp://ftp.OpenLDAP.org/pub/OpenLDAP/openldap-release/openldap-%{version}.tgz
+Source0: ftp://ftp.OpenLDAP.org/pub/OpenLDAP/openldap-release/openldap-%{version_22}.tgz
 Source1: ftp://ftp.OpenLDAP.org/pub/OpenLDAP/openldap-release/openldap-%{version_20}.tgz
 Source2: ftp://ftp.OpenLDAP.org/pub/OpenLDAP/openldap-release/openldap-%{version_21}.tgz
 Source3: ftp://ftp.OpenLDAP.org/pub/tools/autoconf-2.13.1.tar.gz
@@ -28,6 +32,7 @@ Source10: autofs.schema
 Source11: README.upgrading
 Source12: http://www.OpenLDAP.org/doc/admin/guide.html
 Source13: nptl-abi-note.S
+Source14: README.evolution
 Patch0: openldap-2.2.13-config.patch
 Patch2: openldap-1.2.11-cldap.patch
 Patch3: openldap-2.1.17-syslog.patch
@@ -46,8 +51,9 @@ Patch24: MigrationTools-26-suffix.patch
 Patch25: MigrationTools-44-schema.patch
 Patch30: http://www.sleepycat.com/update/4.2.52/patch.4.2.52.1
 Patch31: http://www.sleepycat.com/update/4.2.52/patch.4.2.52.2
+Patch40: openldap-ntlm.diff
 URL: http://www.openldap.org/
-BuildRoot: %{_tmppath}/%{name}-%{version}-root
+BuildRoot: %{_tmppath}/%{name}-%{version_22}-root
 BuildPreReq: cyrus-sasl-devel >= 2.1, gdbm-devel, libtool >= 1.5.6-2, krb5-devel
 BuildPreReq: openssl-devel, pam-devel, perl, pkgconfig, tcp_wrappers,
 BuildPreReq: unixODBC-devel
@@ -65,7 +71,8 @@ libraries, and documentation for OpenLDAP.
 %package devel
 Summary: OpenLDAP development libraries and header files.
 Group: Development/Libraries
-Requires: openldap = %{version}-%{release}, cyrus-sasl-devel >= 2.1
+Requires: openldap = %{version_22}-%{release}, cyrus-sasl-devel >= 2.1
+Provides: openldap-evolution-devel = %{version_22}-%{release}
 
 %description devel
 The openldap-devel package includes the development libraries and
@@ -77,7 +84,7 @@ customized LDAP clients.
 
 %package servers
 Summary: OpenLDAP servers and related files.
-Prereq: fileutils, make, openldap = %{version}-%{release}, openssl, /usr/sbin/useradd, /sbin/chkconfig
+Prereq: fileutils, make, openldap = %{version_22}-%{release}, openssl, /usr/sbin/useradd, /sbin/chkconfig
 Group: System Environment/Daemons
 
 %description servers
@@ -91,7 +98,7 @@ migration scripts, and related files.
 
 %package servers-sql
 Summary: OpenLDAP server SQL support module.
-Prereq: openldap-servers = %{version}-%{release}
+Prereq: openldap-servers = %{version_22}-%{release}
 Group: System Environment/Daemons
 
 %description servers-sql
@@ -105,7 +112,7 @@ slapd server can use to read data from an RDBMS.
 
 %package clients
 Summary: Client programs for OpenLDAP.
-Prereq: openldap = %{version}-%{release}
+Prereq: openldap = %{version_22}-%{release}
 Group: Applications/Internet
 
 %description clients
@@ -118,11 +125,11 @@ over the Internet. The openldap-clients package contains the client
 programs needed for accessing and modifying OpenLDAP directories.
 
 # Declare this subpackage LAST.  This version tag redefines %%{version}, so
-# any future use in a Requires: tag would reference the wrong version.
+# any future use would reference the wrong version.
 %package -n compat-openldap
 Summary: OpenLDAP compatibility shared libraries.
 Group: System Environment/Libraries
-Requires: openldap = %{version}-%{release}, cyrus-sasl >= 2.1
+Requires: openldap = %{version_22}-%{release}, cyrus-sasl >= 2.1
 Version: %{compat_version}
 
 %description -n compat-openldap
@@ -132,8 +139,9 @@ includes older versions of the OpenLDAP shared libraries which may be
 required by some applications.
 
 %prep
-%setup -q -a 1 -a 2 -a 3 -a 4 -a 5 -a 6 -a 8
+%setup -q -c -a 1 -a 2 -a 3 -a 4 -a 5 -a 6 -a 8
 
+pushd openldap-%{version_22}
 %patch0 -p1 -b .config
 %patch2 -p1 -b .cldap
 %patch3 -p1 -b .syslog
@@ -142,6 +150,17 @@ required by some applications.
 %patch6 -p1 -b .pie
 %patch7 -p1 -b .toollinks
 %patch8 -p1 -b .nosql
+cp %{_datadir}/libtool/config.{sub,guess} build/
+popd
+
+# Set up a build tree for a static version of libldap with the hooks for the
+# non-standard NTLM bind type which is needed to connect to Win2k GC servers
+# (Win2k3 supports SASL with DIGEST-MD5, so this shouldn't be needed for those
+# servers, though as of version 1.4 the connector doesn't try SASL first).
+cp -a openldap-%{version_22} evo-openldap-%{version_22}
+pushd evo-openldap-%{version_22}
+%patch40 -p0 -b .evolution-ntlm
+popd
 
 pushd db-%{db_version_40}
 %patch12 -p1 -b .disable-mutex
@@ -178,12 +197,12 @@ pushd openldap-%{version_21}
 	done
 popd
 
-for subdir in build-servers build-clients ; do
-	mkdir $subdir
-	ln -s ../configure $subdir
-done
-
-cp %{_datadir}/libtool/config.{sub,guess} build/
+pushd openldap-%{version_22}
+	for subdir in build-servers build-clients ; do
+		mkdir $subdir
+		ln -s ../configure $subdir
+	done
+popd
 
 autodir=`pwd`/auto-instroot
 pushd autoconf-2.13.1
@@ -331,6 +350,7 @@ pushd openldap-%{version_21}/build-servers
 LIBS=-lpthread; export LIBS
 %configure \
 	--disable-shared \
+	--disable-dynamic \
 	--without-cyrus-sasl \
 	--without-kerberos \
 	--without-threads \
@@ -348,7 +368,7 @@ popd
 pushd openldap-%{compat_version}/build-compat
 %configure \
 	--disable-slapd --disable-slurpd \
-	--with-threads=posix --enable-static --enable-dynamic \
+	--with-threads=posix --disable-static --enable-shared --enable-dynamic \
 	--enable-local --enable-rlookups --with-tls --with-cyrus-sasl \
 	--without-kerberos
 make %{_smp_mflags}
@@ -358,7 +378,7 @@ popd
 build() {
 %configure \
 	--disable-slapd --disable-slurpd \
-	--with-threads=posix --enable-static --enable-dynamic \
+	--with-threads=posix --enable-static --enable-shared --enable-dynamic \
 	\
 	--enable-local --enable-rlookups \
 	\
@@ -382,7 +402,7 @@ make %{_smp_mflags} LIBTOOL="$libtool"
 
 # Build the servers with Kerberos support (for password checking, mainly).
 LIBS=-lpthread; export LIBS
-pushd build-servers
+pushd openldap-%{version_22}/build-servers
 build \
 	--enable-plugins \
 	--enable-slapd \
@@ -399,23 +419,41 @@ build \
 	--enable-sql=mod \
 	--disable-perl \
 	--disable-shared \
+	--disable-dynamic \
 	--with-kerberos=k5only
 unset LIBS
 popd
 
 # Build clients without Kerberos password-checking support, which is only
 # useful in the server anyway, to avoid stray dependencies.
-pushd build-clients
+pushd openldap-%{version_22}/build-clients
 build \
 	--disable-slapd \
 	--disable-slurpd \
 	--enable-shared \
+	--enable-dynamic \
 	--enable-static \
 	--without-kerberos \
 	--with-cyrus-sasl \
 	--with-pic
 popd
 
+# Build evolution-specific clients just as we would normal clients, except with
+# a different installation directory in mind and no shared libraries.
+pushd evo-openldap-%{version_22}
+build \
+	--disable-slapd \
+	--disable-slurpd \
+	--disable-shared \
+	--disable-dynamic \
+	--enable-static \
+	--without-kerberos \
+	--with-cyrus-sasl \
+	--with-pic \
+	--includedir=%{evolution_connector_includedir} \
+	--libdir=%{evolution_connector_libdir}
+popd
+
 %install
 [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
 libtool='%{_bindir}/libtool'
@@ -468,7 +506,7 @@ install -d $RPM_BUILD_ROOT/%{_libdir}/
 install -m755 libslapd_db-*.*.so $RPM_BUILD_ROOT/%{_libdir}/
 popd
 
-pushd build-servers
+pushd openldap-%{version_22}/build-servers
 make install DESTDIR=$RPM_BUILD_ROOT libdir=%{_libdir} LIBTOOL="$libtool"
 popd
 
@@ -479,8 +517,18 @@ for binary in db_* ; do
 done
 popd
 
-# Install clients and shared libraries.
-pushd build-clients
+# Install clients and shared libraries.  Install the evo-specific versions
+# first so that any conflicting files are overwritten by generic versions.
+pushd evo-openldap-%{version_22}
+make install DESTDIR=$RPM_BUILD_ROOT \
+	includedir=%{evolution_connector_includedir} \
+	libdir=%{evolution_connector_libdir} \
+	LIBTOOL="$libtool"
+install -m644 \
+	$RPM_SOURCE_DIR/README.evolution \
+	$RPM_BUILD_ROOT/%{evolution_connector_prefix}/
+popd
+pushd openldap-%{version_22}/build-clients
 make install DESTDIR=$RPM_BUILD_ROOT libdir=%{_libdir} LIBTOOL="$libtool"
 popd
 
@@ -505,8 +553,9 @@ perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/*/*.*
 
 # We don't need the default files -- RPM handles changes.
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/openldap/*.default
+rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/openldap/schema/*.default
 
-# Install an init script for the server.
+# Install an init script for the servers.
 mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d
 install -m 755 $RPM_SOURCE_DIR/ldap.init $RPM_BUILD_ROOT/etc/rc.d/init.d/ldap
 
@@ -528,6 +577,8 @@ chmod 644 $RPM_BUILD_ROOT/%{_libdir}/lib*.*a
 # Remove files which we don't want packaged.
 rm -f $RPM_BUILD_ROOT/%{_datadir}/openldap/migration/*.{instdir,simple,schema,mktemp,suffix}
 rm -f $RPM_BUILD_ROOT/%{_libdir}/*.la
+rm -f $RPM_BUILD_ROOT/%{evolution_connector_libdir}/*.la
+rm -f $RPM_BUILD_ROOT/%{evolution_connector_libdir}/*.so*
 rm -f $RPM_BUILD_ROOT/%{_sbindir}/openldap/*.a
 rm -f $RPM_BUILD_ROOT/%{_sbindir}/openldap/*.so
 
@@ -587,7 +638,11 @@ fi
 
 %files
 %defattr(-,root,root)
-%doc ANNOUNCEMENT CHANGES COPYRIGHT LICENSE README
+%doc openldap-%{version_22}/ANNOUNCEMENT
+%doc openldap-%{version_22}/CHANGES
+%doc openldap-%{version_22}/COPYRIGHT
+%doc openldap-%{version_22}/LICENSE
+%doc openldap-%{version_22}/README
 %attr(0755,root,root) %dir /etc/openldap
 %attr(0644,root,root) %config(noreplace) /etc/openldap/ldap*.conf
 %attr(0755,root,root) %{_libdir}/liblber-*.so.*
@@ -599,14 +654,17 @@ fi
 
 %files -n compat-openldap
 %defattr(-,root,root)
-%doc ANNOUNCEMENT COPYRIGHT LICENSE
+%doc openldap-%{compat_version}/ANNOUNCEMENT
+%doc openldap-%{compat_version}/COPYRIGHT
+%doc openldap-%{compat_version}/LICENSE
 %attr(0755,root,root) %{_libdir}/liblber.so.*
 %attr(0755,root,root) %{_libdir}/libldap.so.*
 %attr(0755,root,root) %{_libdir}/libldap_r.so.*
 
 %files servers
 %defattr(-,root,root)
-%doc README.migration TOOLS.migration
+%doc README.migration
+%doc TOOLS.migration
 %doc $RPM_SOURCE_DIR/README.upgrading $RPM_SOURCE_DIR/guide.html
 %attr(0755,root,root) %config /etc/rc.d/init.d/ldap
 %attr(0640,root,ldap) %config(noreplace) /etc/openldap/slapd.conf
@@ -634,8 +692,8 @@ fi
 
 %files servers-sql
 %defattr(-,root,root)
-%doc servers/slapd/back-sql/docs/*
-%doc servers/slapd/back-sql/rdbms_depend
+%doc openldap-%{version_22}/servers/slapd/back-sql/docs/*
+%doc openldap-%{version_22}/servers/slapd/back-sql/rdbms_depend
 %attr(0755,root,root) %{_sbindir}/openldap/back_sql.la
 %attr(0755,root,root) %{_sbindir}/openldap/back_sql*.so.*
 
@@ -646,15 +704,35 @@ fi
 
 %files devel
 %defattr(-,root,root)
-%doc doc/drafts doc/rfc
+%doc openldap-%{version_22}/doc/drafts openldap-%{version_22}/doc/rfc
 %attr(0755,root,root) %{_libdir}/libl*.so
 %attr(0644,root,root) %{_libdir}/libl*.a
 %attr(0644,root,root) %{_includedir}/*
 %attr(0644,root,root) %{_mandir}/man3/*
+%attr(0755,root,root) %dir %{evolution_connector_prefix}
+%attr(0644,root,root)      %{evolution_connector_prefix}/README*
+%attr(0755,root,root) %dir %{evolution_connector_includedir}
+%attr(0644,root,root)      %{evolution_connector_includedir}/*.h
+%attr(0755,root,root) %dir %{evolution_connector_libdir}
+%attr(0644,root,root)      %{evolution_connector_libdir}/*.a
 
 %changelog
+* Thu Aug 19 2004 Nalin Dahyabhai  2.2.13-2
+- build a separate, static set of libraries for openldap-devel with the
+  non-standard ntlm bind patch applied, for use by the evolution-connector
+  package (#125579), and installing them under
+  %%{evolution_connector_prefix} (%{evolution_connector_prefix})
+- provide openldap-evolution-devel = %%{version}-%%{release} in openldap-devel
+  so that evolution-connector's source package can require a version of
+  openldap-devel which provides what it wants
+
+* Mon Jul 26 2004 Nalin Dahyabhai 
+- update administrator guide
+
 * Wed Jun 16 2004 Nalin Dahyabhai  2.2.13-1
 - add compat-openldap subpackage
+- default to bdb, as upstream does, gambling that we're only going to be
+  on systems with nptl now
 
 * Tue Jun 15 2004 Nalin Dahyabhai  2.2.13-0
 - preliminary 2.2.13 update