# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

#######################################################################
# Global Directives:

# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/samba3.schema

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile         /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile        /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values
#loglevel        none
loglevel        none

# The maximum number of entries that is returned for a search operation
sizelimit unlimited

# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
tool-threads 1

# Where the dynamically loaded modules are stored
modulepath	/usr/lib/ldap
moduleload	back_mdb
moduleload      smbk5pwd

#######################################################################
# Specific Backend Directives for mdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend		mdb

#######################################################################
# Specific Directives for database #1, of type mdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database        mdb

# The base of your directory in database #1
suffix          "{{ basedn }}"

# Where the database file are physically stored for database #1
directory       "/var/lib/ldap"

# Default password encryption
password-hash   {CRYPT}
password-crypt-salt-format "$6$%.16s"

# MDB max size
maxsize  1073741824

# Save the time that the entry gets modified, for database #1
lastmod         on

# Checkpoint the database periodically in case of system
# failure and to speed slapd shutdown.
checkpoint      512 30

# rootdn directive for specifying a superuser on the database.
# From bookworm this is mandatory 
rootdn        "cn=admin,{{ basedn }}"
rootpw        {{ hashed_pass.stdout }}

#################################################################
# Indexing options for database #1
index           objectClass eq
# Added indexing
index 	cn,sn,displayName,givenName,mail		eq,sub
index 	uid,uidNumber,gidNumber,memberUid		eq
index	uniqueMember					eq
index	ou					        eq
index 	sambaSID					eq,sub
index 	sambaPrimaryGroupSID,sambaDomainName 		eq
index   sambaSIDList,sambaGroupType			eq

# overlay smbk5pwd configuration
overlay			smbk5pwd
smbk5pwd-enable	        samba shadow
{% if pass_age != '' %}
smbk5pwd-must-change	{{ pass_age }}
{% else %}
# enable the following you want to enforce Samba password aging
#smbk5pwd-must-change  180 
{% endif %}

##################################################################
# Access control directives

# Direct access from unix root user by -Y EXTERNAL -H ldapi:///
access to *
  by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
  by * break

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword
        by anonymous auth
        by self write
        by * none

# Some other attributes should be changed by the owner, and
# others should be able to see it
access to attrs=description,telephoneNumber,shadowLastChange,loginShell,gecos
	by self write
	by * read

# Samba password attributes
access to attrs=sambaNTPassword,sambaLMPassword
        by anonymous auth
        by self write
        by * none

# Samba user modifiable attributes
access to attrs=sambaPasswordHistory,sambaPwdLastSet,sambaPwdMustChange
	by self write
	by * read

# Ensure read access to the base for things like
# supportedSASLMechanisms.  Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work 
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by * read


#######################################################################
# Specific Directives for database #2, of type 'other' (can be hdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database        <other>

# The base of your directory for database #2
#suffix		"dc=debian,dc=org"

################################################################
# Adding SSL directives
TLSCertificateFile {{ ldap_cert_dir }}/{{host}}-cert.pem
TLSCertificateKeyFile {{ ldap_key_dir }}/{{host}}-key.pem
TLSCACertificateFile {{ ldap_cert_dir }}/{{domain}}-cacert.pem
