openldap-2.4.45+dfsg/ 0000755 0001750 0001750 00000000000 13114071203 013023 5 ustar ryan ryan openldap-2.4.45+dfsg/doc/ 0000755 0001750 0001750 00000000000 13133277207 013605 5 ustar ryan ryan openldap-2.4.45+dfsg/doc/guide/ 0000755 0001750 0001750 00000000000 13114071203 014665 5 ustar ryan ryan openldap-2.4.45+dfsg/doc/guide/release/ 0000755 0001750 0001750 00000000000 13114071203 016305 5 ustar ryan ryan openldap-2.4.45+dfsg/doc/guide/release/autoconf.sdf 0000644 0001750 0001750 00000000335 13114071203 020622 0 ustar ryan ryan # $OpenLDAP$ # # Generic Autoconf INSTALL # H1: Generic configure Instructions #!block inline # #!endblock !include "../release/autoconf-install.txt" ; verbatim #!block inline # #!endblock openldap-2.4.45+dfsg/doc/guide/release/license.sdf 0000644 0001750 0001750 00000000431 13114071203 020423 0 ustar ryan ryan # $OpenLDAP$ # Copyright 2000-2017 The OpenLDAP Foundation, All Rights Reserved. # COPYING RESTRICTIONS APPLY, see COPYRIGHT. H1: OpenLDAP Public License #!block inline # #!endblock !include "../../../LICENSE" ; verbatim #!block inline # #!endblock openldap-2.4.45+dfsg/doc/guide/release/copyright-plain.sdf 0000644 0001750 0001750 00000000427 13114071203 022117 0 ustar ryan ryan # $OpenLDAP$ # Copyright 1999-2017 The OpenLDAP Foundation, All Rights Reserved. # COPYING RESTRICTIONS APPLY, see COPYRIGHT. # # Plain Copyright for Software Distribution # !define HTML_TITLE "OpenLDAP Copyright Notices" !include "../plain.sdf" !include "copyright.sdf"; plain openldap-2.4.45+dfsg/doc/guide/release/copyright.sdf 0000644 0001750 0001750 00000005655 13114071203 021026 0 ustar ryan ryan # $OpenLDAP$ # Copyright 1999-2017 The OpenLDAP Foundation, All Rights Reserved. # COPYING RESTRICTIONS APPLY, see COPYRIGHT. # This file should match ../../../COPYRIGHT (except in formating) !if OPT_PP_HTML !define copyright '[[c]] Copyright' !else !define copyright 'Copyright' !endif H1: OpenLDAP Software Copyright Notices H2: OpenLDAP Copyright Notice !block nofill [[copyright]] 1998-2012 The OpenLDAP Foundation. {{All rights reserved.}} !endblock Redistribution and use in source and binary forms, with or without modification, are permitted {{only as authorized}} by the {{SECT:OpenLDAP Public License}}. A copy of this license is available in file {{F:LICENSE}} in the top-level directory of the distribution or, alternatively, at <{{URL:http://www.OpenLDAP.org/license.html}}>. OpenLDAP is a registered trademark of the OpenLDAP Foundation. Individual files and/or contributed packages may be copyright by other parties and their use subject to additional restrictions. This work is derived from the University of Michigan LDAP v3.3 distribution. Information concerning this software is available at <{{URL:http://www.umich.edu/~dirsvcs/ldap/ldap.html}}>. This work also contains materials derived from public sources. Additional information about OpenLDAP software can be obtained at <{{URL:http://www.OpenLDAP.org/}}>. H2: Additional Copyright Notices !block nofill Portions [[copyright]] 1998-2012 Kurt D. Zeilenga. Portions [[copyright]] 1998-2006 Net Boolean Incorporated. Portions [[copyright]] 2001-2006 IBM Corporation. {{All rights reserved.}} !endblock Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the {{SECT:OpenLDAP Public License}}. !block nofill Portions [[copyright]] 1999-2008 Howard Y.H. Chu. Portions [[copyright]] 1999-2008 Symas Corporation. Portions [[copyright]] 1998-2003 Hallvard B. Furuseth. Portions [[copyright]] 2007-2011 Gavin Henry. Portions [[copyright]] 2007-2011 Suretec Systems Limited. {{All rights reserved.}} !endblock Redistribution and use in source and binary forms, with or without modification, are permitted provided that this notice is preserved. The names of the copyright holders may not be used to endorse or promote products derived from this software without their specific prior written permission. This software is provided ``as is'' without express or implied warranty. H2: University of Michigan Copyright Notice !block nofill Portions [[copyright]] 1992-1996 Regents of the University of Michigan. {{All rights reserved.}} !endblock Redistribution and use in source and binary forms are permitted provided that this notice is preserved and that due credit is given to the University of Michigan at Ann Arbor. The name of the University may not be used to endorse or promote products derived from this software without specific prior written permission. This software is provided ``as is'' without express or implied warranty. openldap-2.4.45+dfsg/doc/guide/release/license-plain.sdf 0000644 0001750 0001750 00000000422 13114071203 021524 0 ustar ryan ryan # $OpenLDAP$ # Copyright 1999-2017 The OpenLDAP Foundation, All Rights Reserved. # COPYING RESTRICTIONS APPLY, see COPYRIGHT. # # Plain Copyright for Software Distribution # !define HTML_TITLE "OpenLDAP Public License" !include "../plain.sdf" !include "license.sdf"; plain openldap-2.4.45+dfsg/doc/guide/release/install.sdf 0000644 0001750 0001750 00000007117 13114071203 020457 0 ustar ryan ryan # $OpenLDAP$ # Copyright 1999-2017 The OpenLDAP Foundation, All Rights Reserved. # COPYING RESTRICTIONS APPLY, see COPYRIGHT. P1: Making and Installing the OpenLDAP Distribution This file provides brief instructions on how to build and install OpenLDAP on UNIX (and UNIX-{{like}}) systems. More detailed information and instructions can be found in {{The OpenLDAP Administrator's Guide}} (available from {{URL:http://www.openldap.org/doc/}}). It is recommended that you read, or at least skim through, ALL of the instructions in this file before attempting to build the software. It is also recommended you review the {{Frequently Asked Questions}} ({{URL:http://www.openldap.org/faq/}}) pages, in particular the {{Installation section}} ({{URL:http://www.openldap.org/faq/index.cgi?file=8}}) and {{Platform Hints}} ({{URL:http://www.openldap.org/faq/index.cgi?file=9}}) should be examined. P2: Making and Installing the OpenLDAP Distribution ^ Unpack the distribution and change directory: E: % tar xfz openldap-VERSION.tgz E: % cd openldap-VERSION .(replacing {{EX:VERSION}} with the appropriate version string). If you are reading this file, you probably have already done this! + Type: E: % ./configure --help .to list available configuration options. .The {{EX:configure}} script also looks for compiler/linker options on the command line and in the environment. These include: > Variable Description Example > CC C compiler gcc > CFLAGS C flags -O -g > CPPFLAGS cpp flags -I/path/include -D__FOO__=42 > LDFLAGS ld flags -L/usr/local/lib > LIBS libraries -llib > PATH command path /usr/local/bin:/usr/bin:/bin !if $var{'OPT_TARGET'} eq 'txt' .See doc/install/configure for generic configure documentation. !endif + Configure the build system: E: % ./configure [options] [var=value ...] .If all goes well, the {{EX:configure}} script will automatically detect the appropriate settings. If the {{EX:configure}} script fails, you should read the {{FILE:config.log}} file that it generated to see what it was trying to do and exactly what failed. You may need to specify additional options and/or variables besides those listed above to obtain desired results, depending on your operating system. The {{Platform Hints}} section of the {{FAQ}} provides help for operating system related problems. + Build dependencies: E: % make depend + Build the system: E: % make .If all goes well, the system will build as configured. If not, return to step 3 after reviewing the configuration settings. You may want to consult the {{Platform Hints}} subsection of the {{FAQ}} if you have not done so already. + Test the standalone system: .This step requires the standalone LDAP server, {{slapd}}(8), with {{HDB}} and/or {{BDB}} support. E: % make test .If all goes well, the system has been built as configured. If not, return to step 2 after reviewing your configuration settings. You may want to consult the {{Installation}} section of the {{FAQ}} if you have not done so already. + Install the software. You may need to become the {{super-user}} (e.g. {{EX:root}}) to do this (depending on where you are installing things): E: % su root -c 'make install' + That's it. Enjoy! See the {{OpenLDAP Administrator's Guide}} and the manual pages for the individual applications for configuration and use information. You may also want to edit the configuration files used by the various components. These configuration files are located in the OpenLDAP configuration directory (normally {{FILE:/usr/local/etc/openldap}}). > ldap.conf client defaults > slapd.conf Standalone LDAP daemon > schema/*.schema Schema Definitions openldap-2.4.45+dfsg/doc/guide/release/autoconf-install.txt 0000644 0001750 0001750 00000017230 13114071203 022333 0 ustar ryan ryan Basic Installation ================== These are generic installation instructions. The `configure' shell script attempts to guess correct values for various system-dependent variables used during compilation. It uses those values to create a `Makefile' in each directory of the package. It may also create one or more `.h' files containing system-dependent definitions. Finally, it creates a shell script `config.status' that you can run in the future to recreate the current configuration, a file `config.cache' that saves the results of its tests to speed up reconfiguring, and a file `config.log' containing compiler output (useful mainly for debugging `configure'). If you need to do unusual things to compile the package, please try to figure out how `configure' could check whether to do them, and mail diffs or instructions to the address given in the `README' so they can be considered for the next release. If at some point `config.cache' contains results you don't want to keep, you may remove or edit it. The file `configure.in' is used to create `configure' by a program called `autoconf'. You only need `configure.in' if you want to change it or regenerate `configure' using a newer version of `autoconf'. The simplest way to compile this package is: 1. `cd' to the directory containing the package's source code and type `./configure' to configure the package for your system. If you're using `csh' on an old version of System V, you might need to type `sh ./configure' instead to prevent `csh' from trying to execute `configure' itself. Running `configure' takes awhile. While running, it prints some messages telling which features it is checking for. 2. Type `make' to compile the package. 3. Optionally, type `make check' to run any self-tests that come with the package. 4. Type `make install' to install the programs and any data files and documentation. 5. You can remove the program binaries and object files from the source code directory by typing `make clean'. To also remove the files that `configure' created (so you can compile the package for a different kind of computer), type `make distclean'. There is also a `make maintainer-clean' target, but that is intended mainly for the package's developers. If you use it, you may have to get all sorts of other programs in order to regenerate files that came with the distribution. Compilers and Options ===================== Some systems require unusual options for compilation or linking that the `configure' script does not know about. You can give `configure' initial values for variables by setting them in the environment. Using a Bourne-compatible shell, you can do that on the command line like this: CC=c89 CFLAGS=-O2 LIBS=-lposix ./configure Or on systems that have the `env' program, you can do it like this: env CPPFLAGS=-I/usr/local/include LDFLAGS=-s ./configure Compiling For Multiple Architectures ==================================== You can compile the package for more than one kind of computer at the same time, by placing the object files for each architecture in their own directory. To do this, you must use a version of `make' that supports the `VPATH' variable, such as GNU `make'. `cd' to the directory where you want the object files and executables to go and run the `configure' script. `configure' automatically checks for the source code in the directory that `configure' is in and in `..'. If you have to use a `make' that does not supports the `VPATH' variable, you have to compile the package for one architecture at a time in the source code directory. After you have installed the package for one architecture, use `make distclean' before reconfiguring for another architecture. Installation Names ================== By default, `make install' will install the package's files in `/usr/local/bin', `/usr/local/man', etc. You can specify an installation prefix other than `/usr/local' by giving `configure' the option `--prefix=PATH'. You can specify separate installation prefixes for architecture-specific files and architecture-independent files. If you give `configure' the option `--exec-prefix=PATH', the package will use PATH as the prefix for installing programs and libraries. Documentation and other data files will still use the regular prefix. In addition, if you use an unusual directory layout you can give options like `--bindir=PATH' to specify different values for particular kinds of files. Run `configure --help' for a list of the directories you can set and what kinds of files go in them. If the package supports it, you can cause programs to be installed with an extra prefix or suffix on their names by giving `configure' the option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'. Optional Features ================= Some packages pay attention to `--enable-FEATURE' options to `configure', where FEATURE indicates an optional part of the package. They may also pay attention to `--with-PACKAGE' options, where PACKAGE is something like `gnu-as' or `x' (for the X Window System). The `README' should mention any `--enable-' and `--with-' options that the package recognizes. For packages that use the X Window System, `configure' can usually find the X include and library files automatically, but if it doesn't, you can use the `configure' options `--x-includes=DIR' and `--x-libraries=DIR' to specify their locations. Specifying the System Type ========================== There may be some features `configure' can not figure out automatically, but needs to determine by the type of host the package will run on. Usually `configure' can figure that out, but if it prints a message saying it can not guess the host type, give it the `--host=TYPE' option. TYPE can either be a short name for the system type, such as `sun4', or a canonical name with three fields: CPU-COMPANY-SYSTEM See the file `config.sub' for the possible values of each field. If `config.sub' isn't included in this package, then this package doesn't need to know the host type. If you are building compiler tools for cross-compiling, you can also use the `--target=TYPE' option to select the type of system they will produce code for and the `--build=TYPE' option to select the type of system on which you are compiling the package. Sharing Defaults ================ If you want to set default values for `configure' scripts to share, you can create a site shell script called `config.site' that gives default values for variables like `CC', `cache_file', and `prefix'. `configure' looks for `PREFIX/share/config.site' if it exists, then `PREFIX/etc/config.site' if it exists. Or, you can set the `CONFIG_SITE' environment variable to the location of the site script. A warning: not all `configure' scripts look for a site script. Operation Controls ================== `configure' recognizes the following options to control how it operates. `--cache-file=FILE' Use and save the results of the tests in FILE instead of `./config.cache'. Set FILE to `/dev/null' to disable caching, for debugging `configure'. `--help' Print a summary of the options to `configure', and exit. `--quiet' `--silent' `-q' Do not print messages saying which checks are being made. To suppress all normal output, redirect it to `/dev/null' (any error messages will still be shown). `--srcdir=DIR' Look for the package's source code in directory DIR. Usually `configure' can determine that directory automatically. `--version' Print the version of Autoconf used to generate the `configure' script, and exit. `configure' also accepts some other, not widely useful, options. openldap-2.4.45+dfsg/doc/guide/preamble.sdf 0000644 0001750 0001750 00000027277 13114071203 017171 0 ustar ryan ryan # $OpenLDAP$ # Copyright 1999-2017 The OpenLDAP Foundation, All Rights Reserved. # COPYING RESTRICTIONS APPLY, see COPYRIGHT. # # Preamble for all OpenLDAP SDF documents # !default VERSION 2.4 # # Paths are relative to the main subdirectories # !define DOC_AUTHOR "The OpenLDAP Project <{{URL:http://www.openldap.org/}}>" !define DOC_NAME "OpenLDAP Software 2.4" !define DOC_TYPE "Guide" !define DOC_LOGO "../images/LDAPlogo.gif" !define DOC_LOGO_BASE "../images/" !define DOC_HTML_LOGO "" !define DOC_LOF_TITLE "Figures" !define DOC_LOF !define HTML_URL_HOME "http://www.openldap.org/" !define HTML_URL_CATALOG "../index.html" !macro HTML_HEADER # !block inline # # !endblock !if DOC_LOGO !block inline !endblock !import DOC_LOGO; align="Left"; border="0"; base=$var{'DOC_LOGO_BASE'} !block inline !endblock !HTML_NAVIGATE !clear "Left" !else !HTML_NAVIGATE !endif !endmacro !macro HTML_FOOTER !HTML_PRE_SECTION !HTML_NAVIGATE # !block inline; expand # # !endblock !block inline; expand
________________
© Copyright 2011, OpenLDAP Foundation, info@OpenLDAP.org
!endblock
!endmacro
!macro HTML_TOPIC_HEADER
# !block inline; expand
#
# !endblock
!define DOC_TOPIC_LOGO $var{'DOC_LOGO'}
!if DOC_TOPIC_LOGO
!default DOC_TOPIC_LOGO_BASE $var{'DOC_LOGO_BASE'}
!block inline
!endblock
!import DOC_TOPIC_LOGO; align="Left"; border="0"; base=$var{'DOC_TOPIC_LOGO_BASE'}
!block inline
!endblock
!HTML_TOPIC_NAVIGATE
!clear "Left"
!else
!HTML_TOPIC_NAVIGATE
!endif
!endmacro
!macro HTML_TOPIC_FOOTER
!HTML_PRE_SECTION
!HTML_TOPIC_NAVIGATE
# !block inline; expand
#
# !endblock
!block inline; expand
________________
© Copyright 2011, OpenLDAP Foundation, info@OpenLDAP.org
!endblock
!endmacro
# OpenLDAP related organization
!block organisations; data; sort='Name'
Name|Long|Jump
ANSI|American National Standards Institute|http://www.ansi.org/
BSI|British Standards Institute|http://www.bsi-global.com/
COSINE|Co-operation and Open Systems Interconnection in Europe
CPAN|Comprehensive Perl Archive Network|http://cpan.org/
Cyrus|Project Cyrus|http://cyrusimap.web.cmu.edu/
FSF|Free Software Foundation|http://www.fsf.org/
GNU|GNU Not Unix Project|http://www.gnu.org/
IAB|Internet Architecture Board|http://www.iab.org/
IANA|Internet Assigned Numbers Authority|http://www.iana.org/
IEEE|Institute of Electrical and Electronics Engineers|http://www.ieee.org
IESG|Internet Engineering Steering Group|http://www.ietf.org/iesg/
IETF|Internet Engineering Task Force|http://www.ietf.org/
IRTF|Internet Research Task Force|http://www.irtf.org/
ISO|International Standards Organisation|http://www.iso.org/
ISOC|Internet Society|http://www.isoc.org/
ITU|International Telephone Union|http://www.itu.int/
OLF|OpenLDAP Foundation|http://www.openldap.org/foundation/
OLP|OpenLDAP Project|http://www.openldap.org/project/
OpenSSL|OpenSSL Project|http://www.openssl.org/
RFC Editor|RFC Editor|http://www.rfc-editor.org/
Oracle|Oracle Corporation|http://www.oracle.com/
UM|University of Michigan|http://www.umich.edu/
UMLDAP|University of Michigan LDAP Team|http://www.umich.edu/~dirsvcs/ldap/ldap.html
!endblock
!block products; data; sort='Name'
Name|Jump
Cyrus|http://cyrusimap.web.cmu.edu/generalinfo.html
Cyrus SASL|http://asg.web.cmu.edu/sasl/sasl-library.html
Git|http://git-scm.com/
GNU|http://www.gnu.org/software/
GnuTLS|http://www.gnu.org/software/gnutls/
Heimdal|http://www.pdc.kth.se/heimdal/
JLDAP|http://www.openldap.org/jldap/
MIT Kerberos|http://web.mit.edu/kerberos/www/
MozNSS|http://developer.mozilla.org/en/NSS
OpenLDAP|http://www.openldap.org/
OpenLDAP FAQ|http://www.openldap.org/faq/
OpenLDAP ITS|http://www.openldap.org/its/
OpenLDAP Software|http://www.openldap.org/software/
OpenSSL|http://www.openssl.org/
Perl|http://www.perl.org/
SDF|http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html
UMLDAP|http://www.umich.edu/~dirsvcs/ldap/ldap.html
!endblock
# Internet and X.500 terms
!block terms; data; sort='Term'
Term|Definition
3DES|Triple DES
ABNF|Augmented Backus-Naur Form
ACDF|Access Control Decision Function
ACE|ASCII Compatible Encoding
ASCII|American Standard Code for Information Interchange
ACID|Atomicity, Consistency, Isolation, and Durability
ACI|Access Control Information
ACL|Access Control List
AES|Advance Encryption Standard
ABI|Application Binary Interface
API|Application Program Interface
ASN.1|Abstract Syntax Notation - One
AVA|Attribute Value Assertion
AuthcDN|Authentication DN
AuthcId|Authentication Identity
AuthzDN|Authorization DN
AuthzId|Authorization Identity
BCP|Best Current Practice
BDB|Berkeley DB (Backend)
BER|Basic Encoding Rules
BNF|Backus-Naur Form
C|The C Programming Language
CA|Certificate Authority
CER|Canonical Encoding Rules
CLDAP|Connection-less LDAP
CN|Common Name
CRAM-MD5|SASL MD5 Challenge/Response Authentication Mechanism
CRL|Certificate Revocation List
DAP|Directory Access Protocol
DC|Domain Component
DER|Distinguished Encoding Rules
DES|Data Encryption Standard
DIB|Directory Information Base
DIGEST-MD5|SASL Digest MD5 Authentication Mechanism
DISP|Directory Information Shadowing Protocol
DIT|Directory Information Tree
DNS|Domain Name System
DN|Distinguished Name
DOP|Directory Operational Binding Management Protocol
DSAIT|DSA Information Tree
DSA|Directory System Agent
DSE|DSA-specific Entry
DSP|Directory System Protocol
DS|Draft Standard
DUA|Directory User Agent
EXTERNAL|SASL External Authentication Mechanism
FAQ|Frequently Asked Questions
FTP|File Transfer Protocol
FYI|For Your Information
GSER|Generic String Encoding Rules
GSS-API|Generic Security Service Application Program Interface
GSSAPI|SASL Kerberos V GSS-API Authentication Mechanism
HDB|Hierarchical Database (Backend)
I-D|Internet-Draft
IA5|International Alphabet 5
IDNA|Internationalized Domain Names in Applications
IDN|Internationalized Domain Name
ID|Identification
ID|Identifier
IDL|Index Data Lookups
IP|Internet Protocol
IPC|Inter-process communication
IPsec|Internet Protocol Security
IPv4|Internet Protocol, version 4
IPv6|Internet Protocol, version 6
ITS|Issue Tracking System
JPEG|Joint Photographic Experts Group
Kerberos|Kerberos Authentication Service
LBER|Lightweight BER
LDAP|Lightweight Directory Access Protocol
LDAP Sync|LDAP Content Synchronization
LDAPv3|LDAP, version 3
LDIF|LDAP Data Interchange Format
LMDB|Lightning Memory-Mapped Database
MD5|Message Digest 5
MDB|Memory-Mapped Database (Backend)
MIB|Management Information Base
MODDN|Modify DN
MODRDN|Modify RDN
NSSR|Non-specific Subordinate Reference
OID|Object Identifier
OSI|Open Systems Interconnect
OTP|One Time Password
PDU|Protocol Data Unit
PEM|Privacy Enhanced eMail
PEN|Private Enterprise Number
PKCS|Public Key Cryptosystem
PKI|Public Key Infrastructure
PKIX|Public Key Infrastructure (X.509)
PLAIN|SASL Plaintext Password Authentication Mechanism
POSIX|Portable Operating System Interface
PS|Proposed Standard
RDN|Relative Distinguished Name
RFC|Request for Comments
RPC|Remote Procedure Call
RXER|Robust XML Encoding Rules
SASL|Simple Authentication and Security Layer
SDF|Simple Document Format
SDSE|Shadowed DSE
SHA1|Secure Hash Algorithm 1
SLAPD|Standalone LDAP Daemon
SLURPD|Standalone LDAP Update Replication Daemon
SMTP|Simple Mail Transfer Protocol
SNMP|Simple Network Management Protocol
SQL|Structured Query Language
SRP|Secure Remote Password
SSF|Security Strength Factor
SSL|Secure Socket Layer
STD|Internet Standard
TCP|Transmission Control Protocol
TLS|Transport Layer Security
UCS|Universal Multiple-Octet Coded Character Set
UDP|User Datagram Protocol
UID|User Identifier
Unicode|The Unicode Standard
UNIX|Unix
URI|Uniform Resource Identifier
URL|Uniform Resource Locator
URN|Uniform Resource Name
UTF-8|8-bit UCS/Unicode Transformation Format
UTR|Unicode Technical Report
UUID|Universally Unique Identifier
WWW|World Wide Web
X.500|X.500 Directory Services
X.509|X.509 Public Key and Attribute Certificate Frameworks
XED|XML Enabled Directory
XER|XML Encoding Rules
XML|Extensible Markup Language
syncrepl|LDAP Sync-based Replication
!endblock
!block references; data; sort=Reference; style=grid
Reference|Status|Document|Jump
UM-GUIDE|O|The SLAPD and SLURPD Administrators Guide|http://www.umich.edu/~dirsvcs/ldap/doc/guides/slapd/guide.pdf
RFC2079|PS|Definition of an X.500 Attribute Type and an Object Class to Hold Uniform Resource Identifers|http://www.rfc-editor.org/rfc/rfc2079.txt
RFC2296|PS|Use of Language Codes in LDAP|http://www.rfc-editor.org/rfc/rfc2296.txt
RFC2307|X|An Approach for Using LDAP as a Network Information Service|http://www.rfc-editor.org/rfc/rfc2307.txt
RFC2589|PS|Lightweight Directory Access Protocol (v3): Extensions for Dynamic Directory Services|http://www.rfc-editor.org/rfc/rfc2589.txt
RFC2798|I|Definition of the inetOrgPerson LDAP Object Class|http://www.rfc-editor.org/rfc/rfc2798.txt
RFC2831|PS|Using Digest Authentication as a SASL Mechanism|http://www.rfc-editor.org/rfc/rfc2831.txt
RFC2849|PS|The LDAP Data Interchange Format|http://www.rfc-editor.org/rfc/rfc2849.txt
RFC3088|X|OpenLDAP Root Service|http://www.rfc-editor.org/rfc/rfc3088.txt
RFC3296|PS|Named Subordinate References in LDAP|http://www.rfc-editor.org/rfc/rfc3296.txt
RFC3384|I|Lightweight Directory Access Protocol (version 3) Replication Requirements|http://www.rfc-editor.org/rfc/rfc3384.txt
RFC3494|I|Lightweight Directory Access Protocol version 2 (LDAPv2) to Historic Status|http://www.rfc-editor.org/rfc/rfc3494.txt
RFC4013|PS|SASLprep: Stringprep Profile for User Names and Passwords|http://www.rfc-editor.org/rfc/rfc4013.txt
RFC4346|PS|The Transport Layer Security (TLS) Protocol, Version 1.1|http://www.rfc-editor.org/rfc/rfc4346.txt
RFC4422|PS|Simple Authentication and Security Layer (SASL)|http://www.rfc-editor.org/rfc/rfc4422.txt
RFC4510|PS|Lightweight Directory Access Protocol (LDAP): Technical Specification Roadmap|http://www.rfc-editor.org/rfc/rfc4510.txt
RFC4511|PS|Lightweight Directory Access Protocol (LDAP): The Protocol|http://www.rfc-editor.org/rfc/rfc4511.txt
RFC4512|PS|Lightweight Directory Access Protocol (LDAP): Directory Information Models|http://www.rfc-editor.org/rfc/rfc4512.txt
RFC4513|PS|Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms|http://www.rfc-editor.org/rfc/rfc4513.txt
RFC4514|PS|Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names|http://www.rfc-editor.org/rfc/rfc4514.txt
RFC4515|PS|Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters|http://www.rfc-editor.org/rfc/rfc4515.txt
RFC4516|PS|Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator|http://www.rfc-editor.org/rfc/rfc4516.txt
RFC4517|PS|Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules|http://www.rfc-editor.org/rfc/rfc4517.txt
RFC4518|PS|Lightweight Directory Access Protocol (LDAP): Internationalized String Preparation|http://www.rfc-editor.org/rfc/rfc4518.txt
RFC4519|PS|Lightweight Directory Access Protocol (LDAP): Schema for User Applications|http://www.rfc-editor.org/rfc/rfc4519.txt
RFC4520|BCP|IANA Considerations for LDAP|http://www.rfc-editor.org/rfc/rfc4520.txt
RFC4533|X|The Lightweight Directory Access Protocol (LDAP) Content Synchronization Operation|http://www.rfc-editor.org/rfc/rfc4533.txt
Chu-LDAPI|ID|Using LDAP Over IPC Mechanisms|http://tools.ietf.org/html/draft-chu-ldap-ldapi-00
!endblock
openldap-2.4.45+dfsg/doc/guide/README 0000644 0001750 0001750 00000001213 13114071203 015542 0 ustar ryan ryan This module contains OpenLDAP guides in Simple Document Format (SDF).
SDF is a freely available documentation system. Based on a
simple, readable markup language, SDF generates high quality
output in multiple formats.
cd admin # OpenLDAP Administrator's Guide
sdf -2topics index.sdf # generate HTML for WWW publishing
sdf -2html guide.sdf # generate HTML for release
sdf -2txt guide.sdf # generate TXT for release
More information about STF can be obtained from the CPAN at:
http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html
SDF itself can be obtained at:
http://search.cpan.org/~ianc/sdf-2.001/
openldap-2.4.45+dfsg/doc/guide/plain.sdf 0000644 0001750 0001750 00000001044 13114071203 016465 0 ustar ryan ryan # $OpenLDAP$
# Copyright 1999-2017 The OpenLDAP Foundation, All Rights Reserved.
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
# template for plain documents
!macro HTML_PRE_SECTION
!endmacro
!macro HTML_POST_SECTION
!endmacro
!macro HTML_HEADER
!endmacro
!macro HTML_FOOTER
{{INLINE:}}
{{INLINE:________________
}}
[[c]] Copyright 2011,
{{INLINE:OpenLDAP Foundation}},
{{EMAIL: info@OpenLDAP.org}}
{{INLINE:
}}
!endmacro
openldap-2.4.45+dfsg/doc/guide/admin/ 0000755 0001750 0001750 00000000000 13114071613 015762 5 ustar ryan ryan openldap-2.4.45+dfsg/doc/guide/admin/appendix-recommended-versions.sdf 0000644 0001750 0001750 00000001543 13114071203 024414 0 ustar ryan ryan # $OpenLDAP$
# Copyright 1999-2017 The OpenLDAP Foundation, All Rights Reserved.
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
H1: Recommended OpenLDAP Software Dependency Versions
This appendix details the recommended versions of the software
that OpenLDAP depends on.
Please read the {{SECT:Prerequisite software}} section for more
information on the following software dependencies.
H2: Dependency Versions
!block table; align=Center; coltags="N,EX,EX"; title="Table 8.5: OpenLDAP Software Dependency Versions"
Feature|Software|Version
{{TERM[expand]TLS}}:
|{{PRD:OpenSSL}}|0.9.7+
|{{PRD:GnuTLS}}|2.12.0
|{{PRD:MozNSS}}|3.12.9
{{TERM[expand]SASL}}|{{PRD:Cyrus SASL}}|2.1.21+
{{TERM[expand]Kerberos}}:
|{{PRD:Heimdal}}|Version
|{{PRD:MIT Kerberos}}|Version
Threads:
|POSIX {{pthreads}}|Version
|Mach {{CThreads}}|Version
TCP Wrappers|Name|Version
!endblock
openldap-2.4.45+dfsg/doc/guide/admin/appendix-ldap-result-codes.sdf 0000644 0001750 0001750 00000017027 13114071203 023617 0 ustar ryan ryan # $OpenLDAP$
# Copyright 2007-2017 The OpenLDAP Foundation, All Rights Reserved.
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
H1: LDAP Result Codes
For the purposes of this guide, we have incorporated the standard LDAP result
codes from {{Appendix A. LDAP Result Codes}} of {{REF:RFC4511}}, a copy of which can
be found in {{F:doc/rfc}} of the OpenLDAP source code.
We have expanded the description of each error in relation to the OpenLDAP
toolsets.
LDAP extensions may introduce extension-specific result codes, which are not part
of RFC4511.
OpenLDAP returns the result codes related to extensions it implements.
Their meaning is documented in the extension they are related to.
H2: Non-Error Result Codes
These result codes (called "non-error" result codes) do not indicate
an error condition:
> success (0),
> compareFalse (5),
> compareTrue (6),
> referral (10), and
> saslBindInProgress (14).
The {{success}}, {{compareTrue}}, and {{compareFalse}} result codes indicate
successful completion (and, hence, are referred to as "successful"
result codes).
The {{referral}} and {{saslBindInProgress}} result codes indicate the client
needs to take additional action to complete the operation.
H2: Result Codes
Existing LDAP result codes are described as follows:
H2: success (0)
Indicates the successful completion of an operation.
Note: this code is not used with the Compare operation. See {{SECT:compareFalse (5)}}
and {{SECT:compareTrue (6)}}.
H2: operationsError (1)
Indicates that the operation is not properly sequenced with
relation to other operations (of same or different type).
For example, this code is returned if the client attempts to
StartTLS ({{REF:RFC4511}} Section 4.14) while there are other uncompleted operations
or if a TLS layer was already installed.
H2: protocolError (2)
Indicates the server received data that is not well-formed.
For Bind operation only, this code is also used to indicate
that the server does not support the requested protocol
version.
For Extended operations only, this code is also used to
indicate that the server does not support (by design or
configuration) the Extended operation associated with the
{{requestName}}.
For request operations specifying multiple controls, this may
be used to indicate that the server cannot ignore the order
of the controls as specified, or that the combination of the
specified controls is invalid or unspecified.
H2: timeLimitExceeded (3)
Indicates that the time limit specified by the client was
exceeded before the operation could be completed.
H2: sizeLimitExceeded (4)
Indicates that the size limit specified by the client was
exceeded before the operation could be completed.
H2: compareFalse (5)
Indicates that the Compare operation has successfully
completed and the assertion has evaluated to FALSE or
Undefined.
H2: compareTrue (6)
Indicates that the Compare operation has successfully
completed and the assertion has evaluated to TRUE.
H2: authMethodNotSupported (7)
Indicates that the authentication method or mechanism is not
supported.
H2: strongerAuthRequired (8)
Indicates the server requires strong(er) authentication in
order to complete the operation.
When used with the Notice of Disconnection operation, this
code indicates that the server has detected that an
established security association between the client and
server has unexpectedly failed or been compromised.
H2: referral (10)
Indicates that a referral needs to be chased to complete the
operation (see {{REF:RFC4511}} Section 4.1.10).
H2: adminLimitExceeded (11)
Indicates that an administrative limit has been exceeded.
H2: unavailableCriticalExtension (12)
Indicates a critical control is unrecognized (see {{REF:RFC4511}} Section
4.1.11).
H2: confidentialityRequired (13)
Indicates that data confidentiality protections are required.
H2: saslBindInProgress (14)
Indicates the server requires the client to send a new bind
request, with the same SASL mechanism, to continue the
authentication process (see {{REF:RFC4511}} Section 4.2).
H2: noSuchAttribute (16)
Indicates that the named entry does not contain the specified
attribute or attribute value.
H2: undefinedAttributeType (17)
Indicates that a request field contains an unrecognized
attribute description.
H2: inappropriateMatching (18)
Indicates that an attempt was made (e.g., in an assertion) to
use a matching rule not defined for the attribute type
concerned.
H2: constraintViolation (19)
Indicates that the client supplied an attribute value that
does not conform to the constraints placed upon it by the
data model.
For example, this code is returned when multiple values are
supplied to an attribute that has a SINGLE-VALUE constraint.
H2: attributeOrValueExists (20)
Indicates that the client supplied an attribute or value to
be added to an entry, but the attribute or value already
exists.
H2: invalidAttributeSyntax (21)
Indicates that a purported attribute value does not conform
to the syntax of the attribute.
H2: noSuchObject (32)
Indicates that the object does not exist in the DIT.
H2: aliasProblem (33)
Indicates that an alias problem has occurred. For example,
the code may used to indicate an alias has been dereferenced
that names no object.
H2: invalidDNSyntax (34)
Indicates that an LDAPDN or RelativeLDAPDN field (e.g., search
base, target entry, ModifyDN newrdn, etc.) of a request does
not conform to the required syntax or contains attribute
values that do not conform to the syntax of the attribute's
type.
H2: aliasDereferencingProblem (36)
Indicates that a problem occurred while dereferencing an
alias. Typically, an alias was encountered in a situation
where it was not allowed or where access was denied.
H2: inappropriateAuthentication (48)
Indicates the server requires the client that had attempted
to bind anonymously or without supplying credentials to
provide some form of credentials.
H2: invalidCredentials (49)
Indicates that the provided credentials (e.g., the user's name
and password) are invalid.
H2: insufficientAccessRights (50)
Indicates that the client does not have sufficient access
rights to perform the operation.
H2: busy (51)
Indicates that the server is too busy to service the
operation.
H2: unavailable (52)
Indicates that the server is shutting down or a subsystem
necessary to complete the operation is offline.
H2: unwillingToPerform (53)
Indicates that the server is unwilling to perform the
operation.
H2: loopDetect (54)
Indicates that the server has detected an internal loop (e.g.,
while dereferencing aliases or chaining an operation).
H2: namingViolation (64)
Indicates that the entry's name violates naming restrictions.
H2: objectClassViolation (65)
Indicates that the entry violates object class restrictions.
H2: notAllowedOnNonLeaf (66)
Indicates that the operation is inappropriately acting upon a
non-leaf entry.
H2: notAllowedOnRDN (67)
Indicates that the operation is inappropriately attempting to
remove a value that forms the entry's relative distinguished
name.
H2: entryAlreadyExists (68)
Indicates that the request cannot be fulfilled (added, moved,
or renamed) as the target entry already exists.
H2: objectClassModsProhibited (69)
Indicates that an attempt to modify the object class(es) of
an entry's 'objectClass' attribute is prohibited.
For example, this code is returned when a client attempts to
modify the structural object class of an entry.
H2: affectsMultipleDSAs (71)
Indicates that the operation cannot be performed as it would
affect multiple servers (DSAs).
H2: other (80)
Indicates the server has encountered an internal error.
openldap-2.4.45+dfsg/doc/guide/admin/master.sdf 0000644 0001750 0001750 00000004261 13114071203 017751 0 ustar ryan ryan # $OpenLDAP$
# Copyright 1999-2017 The OpenLDAP Foundation, All Rights Reserved.
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
#
# master file for the OpenLDAP Administrator's Guide
#
#
# To generate guide for distribution:
# sdf -2html guide.sdf
# sdf -2txt guide.sdf
# cp guide.{html,txt} $distribution/doc/guide
#
# To generate pages for web
# sdf -2topics index.sdf
#
!include "../preamble.sdf"; plain
# title information
!include "title.sdf"
PB:
# Document copyright, publishing info, acknowledgements, preface
!include "preface.sdf"; about
PB:
# Chapters
!include "intro.sdf"; chapter
PB:
!include "quickstart.sdf"; chapter
PB:
!include "config.sdf"; chapter
PB:
!include "install.sdf"; chapter
PB:
!include "slapdconf2.sdf"; chapter
PB:
!include "slapdconfig.sdf"; chapter
PB:
!include "runningslapd.sdf"; chapter
PB:
!include "access-control.sdf"; chapter
PB:
!include "limits.sdf"; chapter
PB:
!include "dbtools.sdf"; chapter
PB:
!include "backends.sdf"; chapter
PB:
!include "overlays.sdf"; chapter
PB:
!include "schema.sdf"; chapter
PB:
!include "security.sdf"; chapter
PB:
!include "sasl.sdf"; chapter
PB:
!include "tls.sdf"; chapter
PB:
!include "referrals.sdf"; chapter
PB:
!include "replication.sdf"; chapter
PB:
!include "maintenance.sdf"; chapter
PB:
!include "monitoringslapd.sdf"; chapter
PB:
!include "tuning.sdf"; chapter
PB:
!include "troubleshooting.sdf"; chapter
PB:
# Appendices
!include "appendix-changes.sdf"; appendix
PB:
# Upgrade from 2.3.x
!include "appendix-upgrading.sdf"; appendix
PB:
# Common Errors
!include "appendix-common-errors.sdf"; appendix
PB:
# What versions we recommend
!include "appendix-recommended-versions.sdf"; appendix
PB:
# Real Deployments
!include "appendix-deployments.sdf"; appendix
PB:
# Contributions
!include "appendix-contrib.sdf"; appendix
PB:
# Config file examples
!include "appendix-configs.sdf"; appendix
PB:
# LDAP Result Codes
!include "appendix-ldap-result-codes.sdf"; appendix
PB:
# Terms
!include "glossary.sdf"; appendix
PB:
# Autoconf
!include "../release/autoconf.sdf"; appendix
PB:
# Software Copyright/License
!include "../release/copyright.sdf"; appendix
PB:
!include "../release/license.sdf"; appendix
openldap-2.4.45+dfsg/doc/guide/admin/appendix-deployments.sdf 0000644 0001750 0001750 00000000312 13114071203 022620 0 ustar ryan ryan # $OpenLDAP$
# Copyright 2007-2017 The OpenLDAP Foundation, All Rights Reserved.
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
H1: Real World OpenLDAP Deployments and Examples
Examples and discussions
openldap-2.4.45+dfsg/doc/guide/admin/tls.sdf 0000644 0001750 0001750 00000031345 13114071203 017263 0 ustar ryan ryan # $OpenLDAP$
# Copyright 1999-2017 The OpenLDAP Foundation, All Rights Reserved.
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
H1: Using TLS
OpenLDAP clients and servers are capable of using the
{{TERM[expand]TLS}} ({{TERM:TLS}}) framework to provide
integrity and confidentiality protections and to support
LDAP authentication using the {{TERM:SASL}} {{TERM:EXTERNAL}} mechanism.
TLS is defined in {{REF:RFC4346}}.
Note: For generating certifcates, please reference {{URL:http://www.openldap.org/faq/data/cache/185.html}}
H2: TLS Certificates
TLS uses {{TERM:X.509}} certificates to carry client and server
identities. All servers are required to have valid certificates,
whereas client certificates are optional. Clients must have a
valid certificate in order to authenticate via SASL EXTERNAL.
For more information on creating and managing certificates,
see the {{PRD:OpenSSL}}, {{PRD:GnuTLS}}, or {{PRD:MozNSS}} documentation,
depending on which TLS implementation libraries you are using.
H3: Server Certificates
The {{TERM:DN}} of a server certificate must use the {{EX:CN}}
attribute to name the server, and the {{EX:CN}} must carry the
server's fully qualified domain name. Additional alias names and
wildcards may be present in the {{EX:subjectAltName}} certificate
extension. More details on server certificate names are in
{{REF:RFC4513}}.
H3: Client Certificates
The DN of a client certificate can be used directly as an
authentication DN.
Since X.509 is a part of the {{TERM:X.500}} standard and LDAP
is also based on X.500, both use the same DN formats and
generally the DN in a user's X.509 certificate should be
identical to the DN of their LDAP entry. However, sometimes
the DNs may not be exactly the same, and so the mapping
facility described in
{{SECT:Mapping Authentication Identities}}
can be applied to these DNs as well.
H2: TLS Configuration
After obtaining the required certificates, a number of options must
be configured on both the client and the server to enable TLS and
make use of the certificates. At a minimum, the clients must be
configured with the name of the file containing all of the
{{TERM[expand]CA}} (CA) certificates it will trust. The server must
be configured with the {{TERM:CA}} certificates and also its own
server certificate and private key.
Typically a single CA will have issued the server certificate
and all of the trusted client certificates, so the server only
needs to trust that one signing CA. However, a client may wish
to connect to a variety of secure servers managed by different
organizations, with server certificates generated by many
different CAs. As such, a client is likely to need a list of
many different trusted CAs in its configuration.
H3: Server Configuration
The configuration directives for slapd belong in the global directives
section of {{slapd.conf}}(5).
H4: TLSCACertificateFile