Manual Pages for UNIX Darwin command on man slapo-chain

SLAPO-CHAIN(5) SLAPO-CHAIN(5)

NAME

slapo-chain - chain overlay

SYNOPSIS

/etc/openldap/slapd.conf

DESCRIPTION

The cchhaaiinn overlay to ssllaappdd(8) allows automatic referral chasing. Any time a referral is returned (except for bind operations), it chased by using an instance of the ldap backend. If operations are performed with an identity (i.e. after a bind), that identity can be asserted while chasing the referrals by means of the identity assertion feature

of back-ldap (see ssllaappdd-llddaapp(5) for details), which is essentially

based on the pprrooxxyyAAuutthhzz control (see draft-weltman-ldapv3-proxy for

details.) Referral chasing can be controlled by the client by issuing

the cchhaaiinniinngg control (see draft-sermersheim-ldap-chaining for details.)

The config directives that are specific to the cchhaaiinn overlay are pre-

fixed by cchhaaiinn-, to avoid potential conflicts with directives specific

to the underlying database or to other stacked overlays.

There are very few chain overlay specific directives; however, direc-

tives related to the instances of the ldap backend that may be implic-

itly instantiated by the overlay may assume a special meaning when used

in conjunction with this overlay. They are described in ssllaappdd-llddaapp(5),

and they also need be prefixed by cchhaaiinn-.

oovveerrllaayy cchhaaiinn This directive adds the chain overlay to the current backend. The chain overlay may be used with any backend, but it is mainly intended for use with local storage backends that may return

referrals. It is useless in conjunction with the slapd-ldap and

slapd-meta backends because they already exploit the libldap

specific referral chase feature. [Note: this may change in the future, as the llddaapp(5) and mmeettaa(5) backends might no longer chase referrals on their own.]

cchhaaiinn-cchhaaiinniinngg [[rreessoollvvee==<>]] [[ccoonnttiinnuuaattiioonn==<>]] [[ccrriittiiccaall]]

This directive enables the chaining control (see draft-sermer-

sheim-ldap-chaining for details) with the desired resolve and

continuation behaviors and criticality. The rreessoollvvee parameter refers to the behavior while discovering a resource, namely when

accessing the object indicated by the request DN; the ccoonnttiinnuuaa-

ttiioonn parameter refers to the behavior while handling intermedi-

ate responses, which is mostly significant for the search opera-

tion, but may affect extended operations that return intermedi-

ate responses. The values rr and cc can be any of cchhaaiinniinnggPPrree-

ffeerrrreedd, cchhaaiinniinnggRReeqquuiirreedd, rreeffeerrrraallssPPrreeffeerrrreedd, rreeffeerrrraallssRReeqquuiirreedd.

If the ccrriittiiccaall flag affects the control criticality if pro-

vided. [This control is experimental and its support may change in the future.]

cchhaaiinn-ccaacchhee-uurrii {{FFAALLSSEE||ttrruuee}}

This directive instructs the chain overlay to cache connections to URIs parsed out of referrals that are not predefined, to be reused for later chaining. These URIs inherit the properties

configured for the underlying ssllaappdd-llddaapp(5) before any occur-

rence of the cchhaaiinn-uurrii directive; in detail, they are essen-

tially chained anonymously.

cchhaaiinn-uurrii <>

This directive instantiates a new underlying ldap database and instructs it about which URI to contact to chase referrals. As

opposed to what stated in ssllaappdd-llddaapp(5), only one URI can appear

after this directive; all subsequent ssllaappdd-llddaapp(5) directives

prefixed by cchhaaiinn- refer to this specific instance of a remote

server. Directives for configuring the underlying ldap database may also be required, as shown in this example: overlay chain

chain-rebind-as-user FALSE

chain-uri "ldap://ldap1.example.com"

chain-rebind-as-user TRUE

chain-idassert-bind bindmethod="simple"

binddn="cn=Auth,dc=example,dc=com" credentials="secret" mode="self"

chain-uri "ldap://ldap2.example.com"

chain-idassert-bind bindmethod="simple"

binddn="cn=Auth,dc=example,dc=com" credentials="secret" mode="none"

Any valid directives for the ldap database may be used; see ssllaappdd-

llddaapp(5) for details. Multiple occurrences of the cchhaaiinn-uurrii directive

may appear, to define multiple "trusted" URIs where operations with

identity assertion are chained. All URIs not listed in the configura-

tion are chained anonymously. All ssllaappdd-llddaapp(5) directives appearing

before the first occurrence of cchhaaiinn-uurrii are inherited by all URIs,

unless specifically overridden inside each URI configuration. FILES /etc/openldap/slapd.conf default slapd configuration file