slapd-sock man page on SmartOS

Man page or keyword search:  
man Server   16655 pages
apropos Keyword Search (all sections)
Output format
SmartOS logo
[printable version]

SLAPD-SOCK(5)							 SLAPD-SOCK(5)

NAME
       slapd-sock - Socket backend/overlay to slapd

SYNOPSIS
       /opt/local/share/examples/openldap/slapd.conf

DESCRIPTION
       The  Socket  backend  to	 slapd(8)  uses	 an external program to handle
       queries, similarly to slapd-shell(5).  However, in this case the exter‐
       nal program listens on a Unix domain socket.  This makes it possible to
       have a pool of processes, which persist between requests.  This	allows
       multithreaded  operation and a higher level of efficiency. The external
       program must have been started independently; slapd(8) itself will  not
       start it.

       This  module  may also be used as an overlay on top of some other data‐
       base.  Use as an overlay allows external actions	 to  be	 triggered  in
       response to operations on the main database.

CONFIGURATION
       These  slapd.conf options apply to the SOCK backend database.  That is,
       they must follow a "database sock" line and come before any  subsequent
       "backend" or "database" lines.  Other database options are described in
       the slapd.conf(5) manual page.

       Alternatively, to use this module as an overlay, these directives  must
       follow an "overlay sock" line within an existing database definition.

       extensions [ binddn | peername | ssf | connid ]*
	      Enables  the  sending  of	 additional  meta-attributes with each
	      request.
	      binddn: <bound DN>
	      peername: IP=<address>:<port>
	      ssf: <SSF value>
	      connid: <connection ID>

       socketpath <pathname>
	      Gives the path to a Unix domain socket  to  which	 the  commands
	      will be sent and from which replies are received.

	      When  used  as  an  overlay,  these  additional  directives  are
	      defined:

       sockops	 [ bind | unbind | search | compare | modify | modrdn | add  |
       delete ]*
	      Specify which request types to send to the external program. The
	      default is empty (no requests are sent).

       sockresps [ result | search ]*
	      Specify which response types to send to  the  external  program.
	      "result"	sends just the results of an operation. "search" sends
	      all entries that the database returned for a search request. The
	      default is empty (no responses are sent).

PROTOCOL
       The  protocol  is essentially the same as slapd-shell(5) with the addi‐
       tion of a newline to terminate the command  parameters.	The  following
       commands are sent:
	      ADD
	      msgid: <message id>
	      <repeat { "suffix:" <database suffix DN> }>
	      <entry in LDIF format>
	      <blank line>

	      BIND
	      msgid: <message id>
	      <repeat { "suffix:" <database suffix DN> }>
	      dn: <DN>
	      method: <method number>
	      credlen: <length of <credentials>>
	      cred: <credentials>
	      <blank line>

	      COMPARE
	      msgid: <message id>
	      <repeat { "suffix:" <database suffix DN> }>
	      dn: <DN>
	      <attribute>: <value>
	      <blank line>

	      DELETE
	      msgid: <message id>
	      <repeat { "suffix:" <database suffix DN> }>
	      dn: <DN>
	      <blank line>

	      MODIFY
	      msgid: <message id>
	      <repeat { "suffix:" <database suffix DN> }>
	      dn: <DN>
	      <repeat {
		  <"add"/"delete"/"replace">: <attribute>
		  <repeat { <attribute>: <value> }>
		  -
	      }>
	      <blank line>

	      MODRDN
	      msgid: <message id>
	      <repeat { "suffix:" <database suffix DN> }>
	      dn: <DN>
	      newrdn: <new RDN>
	      deleteoldrdn: <0 or 1>
	      <if new superior is specified: "newSuperior: <DN>">
	      <blank line>

	      SEARCH
	      msgid: <message id>
	      <repeat { "suffix:" <database suffix DN> }>
	      base: <base DN>
	      scope: <0-2, see ldap.h>
	      deref: <0-3, see ldap.h>
	      sizelimit: <size limit>
	      timelimit: <time limit>
	      filter: <filter>
	      attrsonly: <0 or 1>
	      attrs: <"all" or space-separated attribute list>
	      <blank line>

	      UNBIND
	      msgid: <message id>
	      <repeat { "suffix:" <database suffix DN> }>
	      <blank line>

       The commands - except unbind - should output:
	      RESULT
	      code: <integer>
	      matched: <matched DN>
	      info: <text>
       where  only RESULT is mandatory, and then close the socket.  The search
       RESULT should be preceded by the entries in  LDIF  format,  each	 entry
       followed	 by  a	blank  line.   Lines starting with `#' or `DEBUG:' are
       ignored.

       When used as an overlay, the external program should return a  CONTINUE
       response	 if  request processing should continue normally, or a regular
       RESULT response if the external program wishes to bypass the underlying
       database.

       If  the overlay is configured to send response messages to the external
       program, they will appear as an extended RESULT message or as an	 ENTRY
       message, defined below. The RESULT message is similar to the one above,
       but also includes the msgid and any configured extensions:
	      RESULT
	      msgid: <message id>
	      code: <integer>
	      matched: <matched DN>
	      info: <text>
	      <blank line>

       Typically both the msgid and the connid	will  be  needed  to  match  a
       result message to a request. The ENTRY message has the form
	      ENTRY
	      msgid: <message id>
	      <entry in LDIF format>
	      <blank line>

ACCESS CONTROL
       The  sock  backend  does	 not  honor  all ACL semantics as described in
       slapd.access(5).	 In general, access to objects is checked by  using  a
       dummy  object  that  contains only the DN, so access rules that rely on
       the contents of the object are not honored.  In detail:

       The add operation does not require write (=w) access  to	 the  children
       pseudo-attribute of the parent entry.

       The  bind  operation  requires  auth  (=x)  access to the entry pseudo-
       attribute of the entry whose identity  is  being	 assessed;  auth  (=x)
       access  to  the credentials is not checked, but rather delegated to the
       underlying program.

       The compare operation requires compare (=c) access to the entry pseudo-
       attribute  of  the  object  whose value is being asserted; compare (=c)
       access to the attribute whose value is being asserted is not checked.

       The delete operation does not require write (=w) access to the children
       pseudo-attribute of the parent entry.

       The  modify  operation  requires write (=w) access to the entry pseudo-
       attribute; write (=w) access to the specific attributes that are	 modi‐
       fied is not checked.

       The modrdn operation does not require write (=w) access to the children
       pseudo-attribute of the parent entry, nor to that of the new parent, if
       different;  write (=w) access to the distinguished values of the naming
       attributes is not checked.

       The search operation does not require search (=s) access to  the	 entry
       pseudo_attribute	  of   the  searchBase;	 search	 (=s)  access  to  the
       attributes and values used in the filter is not checked.

EXAMPLE
       There is an example script in the  slapd/back-sock/  directory  in  the
       OpenLDAP source tree.

FILES
       /opt/local/share/examples/openldap/slapd.conf
	      default slapd configuration file

SEE ALSO
       slapd.conf(5), slapd-config(5), slapd(8).

AUTHOR
       Brian Candler, with enhancements by Howard Chu

OpenLDAP 2.4.39			  2014/01/26			 SLAPD-SOCK(5)
[top]

List of man pages available for SmartOS

Copyright (c) for man pages and the logo by the respective OS vendor.

For those who want to learn more, the polarhome community provides shell access and support.

[legal] [privacy] [GNU] [policy] [cookies] [netiquette] [sponsors] [FAQ]
Tweet
Polarhome, production since 1999.
Member of Polarhome portal.
Based on Fawad Halim's script.
....................................................................
Vote for polarhome
Free Shell Accounts :: the biggest list on the net