include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema

schemacheck     on
pidfile         /var/run/slapd/slapd.pid
argsfile        /var/run/slapd.args
loglevel        0

modulepath      /usr/lib/ldap
moduleload      back_bdb
backend         bdb
checkpoint 512 30


database        bdb
suffix          "dc=ldap,dc=student,dc=cs,dc=uwaterloo,dc=ca"
directory       "/var/lib/ldap"
index           objectClass eq
index           cn,uid pres,eq,approx,sub

lastmod         on

rootdn "cn=diradmin,dc=ldap,dc=student,dc=cs,dc=uwaterloo,dc=ca"
rootpw SOME-PASSWORD-IN-SOME-FORMAT

# Map host service principals to entries in this directory
sasl-regexp
  uid=host/(.*).student.cs.uwaterloo.ca,cn=gssapi,cn=auth
  cn=$1,ou=Hosts,dc=ldap,dc=student,dc=cs,dc=uwaterloo,dc=ca

# Map AD users to their entries in this directory
sasl-regexp
  uid=(.*),cn=student.cs.uwaterloo.ca,cn=gssapi,cn=auth
  uid=$1,ou=People,dc=ldap,dc=student,dc=cs,dc=uwaterloo,dc=ca
sasl-regexp
  uid=(.*),cn=gssapi,cn=auth
  uid=$1,ou=People,dc=ldap,dc=student,dc=cs,dc=uwaterloo,dc=ca

# Good to have this, even though we don't use it.
access to attrs=userPassword
        by anonymous auth
        by self write
        by * none

# Users should be able to choose their own login shell
access to attrs=gecos,loginShell
        by self write
        by users read

access to dn.base="" by * read

# Authenticated users, by default, can read anything in the directory.
access to *
        by users read
