include /usr/local/etc/openldap/schema/core.schema
include /usr/local/etc/openldap/schema/cosine.schema
include /usr/local/etc/openldap/schema/inetorgperson.schema
include /usr/local/etc/openldap/schema/nis.schema
include /usr/local/etc/openldap/schema/misc.schema
include /usr/local/etc/openldap/schema/samba.schema

pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args

modulepath /usr/local/libexec/openldap
moduleload back_bdb
moduleload back_ldap

loglevel sync
sizelimit -1
timelimit 60
idletimeout 20

TLSCipherSuite HIGH:MEDIUM:+SSLv2
TLSCACertificateFile /usr/local/etc/openldap/cacerts/ca.crt
TLSCertificateFile /usr/local/etc/openldap/cacerts/my.crt
TLSCertificateKeyFile /usr/local/etc/openldap/cacerts/my.key

database bdb
suffix "dc=foo,dc=com"
rootdn "cn=Manager,dc=foo,dc=com"
rootpw secret
directory /var/db/openldap-data
index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub
index entryCSN eq
lastmod on
checkpoint 128 15

overlay syncprov

overlay chain

overlay auditlog
auditlog /usr/local/etc/openldap/log/audit.ldif

syncrepl rid=4
 provider=ldap://ldap-01.foo.com
 starttls=critical
 type=refreshAndPersist
 retry=300,+
 searchbase="dc=foo,dc=com"
 filter="(objectClass=*)"
 attrs="*,+"
 scope=sub
 schemachecking=on
 bindmethod=simple
 binddn="uid=replicator,ou=People,dc=foo,dc=com"
 credentials=secret

chain-uri "ldaps://ldap-01.foo.com"
chain-rebind-as-user true
chain-idassert-bind
 bindmethod="simple"
 binddn="uid=replicator,ou=People,dc=foo,dc=com"
 credentials="secret"
 mode="self"

access to attrs=userPassword,sambaLMPassword,sambaNTPassword
 by dn="uid=replicator,ou=People,dc=foo,dc=com" read
 by group/groupOfNames/Member="cn=ldap-admins,ou=Group,dc=foo,dc=com" write
 by dn="uid=radius,ou=People,dc=foo,dc=com" read
 by self write
 by anonymous auth
 by * compare

access to attrs=loginShell
 by dn="uid=replicator,ou=People,dc=foo,dc=com" read
 by group/groupOfNames/Member="cn=ldap-admins,ou=Group,dc=foo,dc=com" write
 by self write
 by * read

access to *
 by dn="uid=replicator,ou=People,dc=foo,dc=com" read
 by group/groupOfNames/Member="cn=ldap-admins,ou=Group,dc=foo,dc=com" write
 by * read