#!/bin/ksh93
#
# $Id$
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
# Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
# Portions Copyright 2013  Jens Elkner.


#############################################################################
# Main global vars
#############################################################################
LIC='[-?$Id$ ]
[-copyright?Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.]
[-copyright?Portions Copyright (c) 2013  Jens Elkner.]
[-license?CDDL 1.0]'

SDIR=${.sh.file%/*}
typeset -r FPROG=${.sh.file}
typeset -r PROG=${FPROG##*/}

typeset -T LogObj_t=(
	typeset -Sh 'Color for info messages' GREEN='38;5;232;48;5;118'	#'1;30;102';
	typeset -Sh 'Color for warning messages' BLUE='38;5;21;48;5;118' #'1;34;102';
	typeset -Sh 'Color for fatal messages' RED='38;5;9;48;5;118' #'1;31;102';
	typeset -Sih 'Flag, whether to use colored labels' COLORED=1
	typeset -Sih  'Flag, whether to print verbose infos' VERBOSE=0

	function log {
		(( _.COLORED )) && print -u2 "\E[1;$2m${ date +%T; } $1:\E[0m $3" || \
			print -u2 "${ date +%T; } ${1}: $3"
	}
	typeset -Sfh ' log a message to stderr' log
	function verbose {
		(( _.VERBOSE )) && _.log "VERB" ${_.GREEN} "      $*"
	}
	typeset -Sfh ' log a info message to stderr if verbose messages are enabled' info

	function info {
		_.log "INFO" ${_.GREEN} "$*"
	}
	typeset -Sfh ' log a info message to stderr' info
	function warn {
		_.log "WARN" ${_.BLUE} "$*"
	}
	typeset -Sfh ' log a warning message to stderr' warn
	function fatal {
		_.log "FATAL" ${_.RED} "$*"
	}
	typeset -Sfh ' log a fatal error message to stderr' fatal
	function printMarker {
		typeset COLOR="$1" L='----------------------------------------------------------------------------'
		(( _.COLORED )) && print "\E[1;${COLOR:-${_.GREEN}}m${L}\E[0m" || \
			print "${L}"
	}
	typeset -Sfh ' print a marker line to stdout' printMarker
)
LogObj_t Log

typeset -T ManObj_t=(
    typeset -Ah 'Variable descriptions. Key: variable name' VAR
    typeset -Ah 'Function usages. Key: function name' FUNC
    function addVar {
		[[ -n ${_.VAR[$1]} ]] && Log.warn "Overwriting previous description for $1"
        _.VAR[$1]="[+$1?$2]"
    }
    typeset -fh 'Add a description (arg2) for the given variable name (arg1)' addVar
    function addFunc {
        typeset fname=$1
        typeset X="$2"
		[[ -n ${_.FUNC[$fname]} ]] && Log.warn "Overwriting previous usage info for $1()"
        [[ -z $X ]] && X="$LIC"
        shift 2
        while [[ -n $1 ]]; do
            X+="$1"
            shift
        done
        _.FUNC[$fname]+="$X"
    }
    typeset -fh $'Add usage info (arg3 ...) for the given function name (arg1). If implementation details (arg2) is empty, the value of \a$LIC\a gets used instead' addFunc
    function varUsage {
        typeset X=""
		[[ "$1" == '@' || "$1" == '*' ]] && set -- ${!_.VAR[@]}
        while [[ -n $1 ]]; do
            X+="${_.VAR[$1]}"
            shift
        done
        print "$X"
    }
    typeset -fh $'Get the variable usage info for the named variables (arg2 ...) if available as a concatenated string. See \baddVar()\b' varUsage
	function funcUsage {
		printf "${_.FUNC[$1]}"
	}
	typeset -fh 'Get the function usage info for the named function (arg1)' funcUsage

	function listVars {
		typeset ALL="${ print ${!_.VAR[*]} | tr ' ' '\n' | sort -u; }" VNAME
		for VNAME in $ALL; do
			[[ $VNAME == OLDENV || $VNAME == LASTENV ]] && continue
			typeset -n X=$VNAME
			print "$VNAME=$X"
		done
		unset -n X
	}
	typeset -fh 'List all registered environment variables and its current value, except for OLDENV and LASTENV.' listVars
)
ManObj_t Man

Man.addFunc showUsage '' '[+NAME?showUsage - show usage info.]
[+DESCRIPTION?Shows usage info for the given \afname\a if available.]
\n\n\afname\a
'
function showUsage {
	typeset WHAT="$2"
	if (( Log.VERBOSE )) && [[ ${WHAT} == 'MAIN' ]]; then
		typeset PRE=${Man.FUNC[$WHAT]%%\[+NOTES*}
		typeset POST=${.sh.match}
		typeset E='[+ENVIRONMENT VARIABLES]{'"${ Man.varUsage '*' ; }"'}'
		getopts -a "${PROG}" "${ print ${PRE}${E}${POST} ; }" OPT --man
	else
		getopts -a "${PROG}" "${ print ${Man.FUNC[$WHAT]}; }" OPT --man
	fi
}

Man.addVar PROG 'String. The basename of this script.'

Man.addVar INT 'Associative array of Integers. Config relevant int values and flags.' 
typeset -A -i INT=( )
Man.addVar STR 'Associative array of Strings. Config relevant string values.'
typeset -A STR=( )

Man.addVar TMPF 'Associative array of Integers. Int values with a more or less a global character in this script.' 
typeset -A -i TMPF=( )
Man.addVar TMP 'Associative array of Strings. String values whith a more or less a global character in this script.' 
typeset -A TMP=( )

Man.addVar CON_ARGS 'String. Contains connection related options for ldap commands.'
typeset CON_ARGS=''

Man.addVar AUTH_ARGS 'Indexed array of Strings. Contains authentification related options for ldap commands.'
typeset -a AUTH_ARGS=( )

Man.addVar SSD 'Indexed array of Strings. Contains the Service Search Decsriptors to use.'
typeset -a SSD=( )

# NOTE: The ACI names are retained to be compatible to previous releases. If one
#       installs a completely new LDAP infrastructure changing the names should
#       not be a problem as long as they do not collide with existing aci names!

Man.addVar SFX_ANYONE_ACI_NAME 'String constant. The name of the suffix ACI rule, which allows anyone to read, search, compare.'
typeset -r SFX_ANYONE_ACI_NAME='Anonymous access'

Man.addVar SFX_SELF_ACI_NAME 'String constant. The name of the suffix ACI rule, which allows a principal to modify its own attributes except those related to password state information and policy.'
typeset -r SFX_SELF_ACI_NAME='Limited self entry modification'

Man.addVar SFX_ADMIN_ACI_NAME 'String constant. The name of the suffix ACI rule, which allows the directory configuration administrator all operations on any entry.'
typeset -r SFX_ADMINGRP_ACI_NAME='Configuration Administrator access'

Man.addVar SFX_ADMINGRP_ACI_NAME 'String constant. The name of the suffix ACI rule, which allows the directory configuration administrator group all operations on any entry.'
typeset -r SFX_ADMIN_ACI_NAME='Configuration Administrator Group access'

Man.addVar PROXY_ACI_NAME 'String constant. The name of the ACI rule, which allows proxies to read passwords.'
typeset -r PROXY_ACI_NAME='LDAP Naming Services proxy_password_read'

Man.addVar HOST_ACI_NAME 'String constant. The name of the ACI rule, which allows host principals to write passwords.'
typeset  -r HOST_ACI_NAME='LDAP Naming Services host_shadow_write'
Man.addVar NON_HOST_ACI_NAME 'String constant. The name of the ACI rule, which denies non-host principals access to shadow data.'
typeset -r NON_HOST_ACI_NAME='LDAP Naming Services deny_non_host_shadow_access'

Man.addVar ADMIN_ACI_NAME 'String constant. The name of the ACI rule, which allows Admin principals access to shadow, rbac and mount data.'
typeset -r ADMIN_ACI_NAME='LDAP Naming Services admin_shadow_write'
Man.addVar NON_ADMIN_ACI_NAME 'String constant. The name of the ACI rule, which denies non-Admin principals access to shadow data.'
typeset -r NON_ADMIN_ACI_NAME='LDAP Naming Services deny_non_admin_shadow_access'
Man.addVar USER_ACI_NAME 'String constant. The name of the ACI rule, which prevents a user from changing administrative fields like uidNumber, homeDirectory, shadowExpire, etc..'
typeset -r USER_ACI_NAME='LDAP Naming Services deny_write_access'

Man.addVar VLV_ACI_NAME 'String constant. The name of the global ACI rule, which allows any user to use VLVs for read, search and compare.'
typeset -r VLV_ACI_NAME='VLV Request Control'

Man.addVar SELF_GSS_ACI_NAME 'String constant. The name of the ou=people ACI rule, which allows a via SASL/GSSAPI authenticated user read and search on passwords.'
typeset -r SELF_GSS_ACI_NAME='self-read-pwd'

Man.addVar HOST_GSS_ACI_NAME 'String constant. The name of the ou=people ACI rule, which allows a via SASL/GSSAPI authenticated hosts read and search on passwords.'
typeset -r HOST_GSS_ACI_NAME='host-read-pwd'

Man.addVar AUTH_METHODS 'Indexed array of Strings. A list of currently supported authentication methods.'
typeset -a -r AUTH_METHODS=(
	'none'			'simple'				'sasl/DIGEST-MD5'
	'tls:simple'	'tls:sasl/DIGEST-MD5'	'sasl/GSSAPI'
) # order is important

Man.addVar CRED_LEVELS 'Indexed array of Strings. A list of currently supported client credential levels.'
typeset -a -r CRED_LEVELS=( 'anonymous' 'proxy' 'proxy anonymous' 'self' )

Man.addVar OID2ADEF 'Associative array of Strings. Key: OID, Value: attribute definition. Used to cache attribute definitions of schemas currently installed on the DS. Gets lazy initialized, i.e. populated when needed.' 
typeset -A OID2ADEF=( )
Man.addVar ANAME2OID 'Associative array of Strings. Key: attribute name (lowercase), Value: OID. Used to cache name to OID mappings. Gets initialized, when \bOID2ADEF\b gets populated.'
typeset -A ANAME2OID=( )

Man.addVar OID2ODEF 'Associative array of Strings. Key: OID, Value: objectclass definition. Used to cache objectclass definitions of schemas currently installed on the DS. Gets lazy initialized, i.e. populated when needed.' 
typeset -A OID2ODEF=( )

Man.addFunc checkBinary '' '[+NAME?checkBinary - lookup a command.]
[+DESCRIPTION?Check the standard path, whether it contains \acmd\a and if not, use \aPATH\a to lookup the command. If found the full path of the command gets printed to stdout, otherwise an error message to stderr.]
[+RETURN VALUES]{
	[+0?\acmd\a found.]
	[+1?\acmd\a not found.]
}
[+SEE ALSO?\bwhence\b(1).]
\n\n\acmd\a
'
function checkBinary {
	typeset CMD=$1 X=''
	for DIR in /usr/bin /usr/sbin ; do
		[[ -x ${DIR}/${CMD} ]] && print ${DIR}/${CMD} && return 0
	done
	X=${ whence -fp ${CMD} ; }
	[[ -n $X ]] && print "${X}" && return 0
	X="${.sh.file%/*}/${CMD}"
	[[ -x ${X} ]] && print "$X" && return 0
	print -u2 "Missing command '${CMD}'."
	return 1
}

Man.addFunc init '' '[+NAME?init - initializes variables and options.]
[+DESCRIPTION?Does some basic binary-avail checks and initializes certain values of \bSTR[]]\b, \bINT[]]\b and \bTMP[]]\b.]
'
function init {
	typeset X='' KEY VAL TAIL
	integer ERR=0

	# General commands
	HOST=${ hostname ; }
	PING=${ checkBinary ping || (( ERR++ )) ; }
	STTY=${ checkBinary stty || (( ERR++ )) ; }
	GETENT=${ checkBinary getent || (( ERR++ )) ; }

	# LDAP COMMANDS
	LDAPSEARCH=${ checkBinary ldapsearch || (( ERR++ )) ; }
	LDAPMODIFY=${ checkBinary ldapmodify || (( ERR++ )) ; }
	LDAPDELETE=${ checkBinary ldapdelete || (( ERR++ )) ; }
	LDAPCLIENT=${ checkBinary ldapclient || (( ERR++ )) ; }

	if (( ERR )); then
		Log.fatal 'Please adjust your PATH and try again'
		return 66
	fi
	LDAPSEARCH+=' -r'

	# If DNS domain (resolv.conf) exists use that, otherwise use domainname.
	if [[ -f /etc/resolv.conf ]]; then
		while read KEY VAL TAIL ; do
			if [[ ${KEY} == 'domain' || ${KEY} == 'search' ]]; then
				X=${VAL}
				break;
			fi
		done < /etc/resolv.conf
	fi

	# If for any reason the DOMAIN did not get set (error'd resolv.conf) set
	# X to the domainname or getent command's output.
	[[ -z $X ]] && X=${ domainname ; }
	if [[ -z $X ]]; then
		typeset -a AX=( ${ ${GETENT} hosts ${HOST} 2>/dev/null ; } )
		integer I
		for (( I=${#AX[@]}-1; I > 0; I++ )); do
			X=${AX[$I]#*.}
			[[ -n $X ]] && break
		done
	fi

	# Actually one needs to init non-null/zero values, only. However, we want
	# to have the keys registered ...

	# idsconfig specific variables.
	INT[LDAP_ENABLE_SHADOW_UPDATE]=0
	INT[NEED_PROXY]=0			# 0 = No Proxy,    1 = Create Proxy.
	INT[NEED_ADMIN]=0			# 0 = No Admin,    1 = Create Admin.
	INT[NEED_HOSTACL]=0			# 0 = No Host ACL, 1 = Create Host ACL.
	INT[EXISTING_PROFILE]=0
	(( INT[TASK_TIMEOUT] < 10 )) && INT[TASK_TIMEOUT]=60
	STR[LDAP_PROXYAGENT]=''
	STR[LDAP_PROXYAGENT_CRED]=''
	STR[LDAP_ADMINDN]=''
	STR[LDAP_ADMIN_CRED]=''		# enableShadowUpdate flag and Admin credential
	STR[DS_DB]=''				# storage backend name
	STR[LDAP_SUFFIX]=''			# suffix within the backend
	STR[LDAP_DOMAIN]=${X%%.}	# domainname on Server (default value)
	
	# DS specific information
	STR[DS_HOST]=''
	INT[DS_PORT]=389
	INT[NEED_TIME]=0
	INT[NEED_SIZE]=0
	INT[DS_TIMELIMIT]=0
	INT[DS_SIZELIMIT]=0

	# LDAP PROFILE related defaults
	STR[LDAP_ROOTDN]='cn=Directory Manager'	# Provide common default.
	STR[LDAP_ROOTPWD]=''					# NULL passwd (is invalid)
	STR[LDAP_PROFILE_NAME]='default'
	STR[LDAP_BASEDN]=''
	STR[LDAP_SERVER_LIST]=''
	STR[LDAP_AUTHMETHOD]=''
	INT[LDAP_FOLLOWREF]=0
	INT[NEED_CRYPT]=0
	INT[NEED_SRVAUTH_PAM]=0
	INT[NEED_SRVAUTH_KEY]=0
	INT[NEED_SRVAUTH_CMD]=0
	(( ! INT[NEED_CRYPT_IMPORT] )) && INT[NEED_CRYPT_IMPORT]=0
	STR[LDAP_SEARCH_SCOPE]='one'
	STR[LDAP_SRV_AUTHMETHOD_PAM]=''
	STR[LDAP_SRV_AUTHMETHOD_KEY]=''
	STR[LDAP_SRV_AUTHMETHOD_CMD]=''
	INT[LDAP_SEARCH_TIME_LIMIT]=30
	STR[LDAP_PREF_SRVLIST]=''
	INT[LDAP_PROFILE_TTL]=43200
	STR[LDAP_CRED_LEVEL]='proxy'
	INT[LDAP_BIND_LIMIT]=10

	# Service Search Descriptors (just make sure it is empty)
	SSD=( ); unset SSD[0]				# unset is required!

    # GSSAPI setup
    INT[GSSAPI_ENABLE]=0
    STR[LDAP_KRB_REALM]=''

	# temp settings
	TMPF[FCNT]=0						# internal file counter - see nextFile()
	TMPF[IS_OPENDJ]=0					# set if detected DS is OpenDS/OpenDJ
	TMPF[DEL_OLD_PROFILE]=0				# 0 = don't, 1 = delete old profile
	TMPF[STEP]=1						# simple progress indicator
	TMPF[GSSAPI_AUTH_MAY_BE_USED]=0		# DS GSSAPI SASL support
	TMPF[NEED_CREATE_SUFFIX]=0			# see add_suffix()
	TMPF[NEED_CREATE_BACKEND]=0			# see add_suffix()
	# schema completion syntax to use:
	# 0 .. detect, 1 .. force OpenDJ, 2 .. force DSEE
	(( TMPF[SYNTAX] < 0 || TMPF[SYNTAX] > 2 )) && TMPF[SYNTAX]=0

	TMP[FILE]=''						# tmp output filename - see nextFile()
    TMP[LDAP_ROOTPWF]=${TMP[DIR]}/rootPWD	# filename containing the root PW
	TMP[WARN]=''						# set if possibly incompatible DS
	TMP[SUFFIX_OBJ]=''					# suffix objectclass (long name)
	TMP[SUFFIX_ATT]=''					# suffix RDN attr name
    TMP[SUFFIX_VAL]=''					# suffix RDN attr value
	TMP[DS_DBS_AVAIL]=''				# next available suffix DBs
	TMP[VLV_CMDS]=''					# where VLV commands to exec are stored
	#	Set via getopts - just make sure, they are registered
	[[ -z ${TMP[IN]} ]] && TMP[IN]=''		# the config file to read
	[[ -z ${TMP[OUT]} ]] && TMP[OUT]='' 	# the config file to write
	# redirect ldap output to file instead of stdout
	if (( TMPF[FD] > 2 )); then
		exec 4>${TMP[DIR]}/ldap.out
		TMPF[FD]=4
	fi
	return 0
}

# internal
function showProgress {
	typeset NUM=${ printf "%3d" TMPF[STEP] ; }
	Log.info "${NUM}. " "$*"
	(( TMPF[STEP]++ ))
}

# internal
function nextFile {
	typeset CMD="$1" FN="${2// /_}" EXT='cmd'
	(( TMPF[FCNT]++ ))
	case "$1" in
		add|modify|delete) CMD="ldap$1" EXT='ldif' ;;
		sh) EXT='sh'
	esac
	TMP[FILE]=${ printf "${TMP[DIR]}/%03d_${CMD}_${FN}.${EXT}" ${TMPF[FCNT]} ; }
	[[ -e ${TMP[FILE]} ]] && Log.warn "Overwriting ${TMP[FILE]} ..."
}

Man.addFunc show_vars '' '[+NAME?show_vars - List of all config variables and their values.]
[+DESCRIPTION?Lists all config variables and their current values in a more or less human readable manner.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage INT STR SSD ; }" '}
'
function show_vars {
	(( ! VERBOSE )) && return

	typeset S=${!STR[@]} OUT='Current non-NULL values:\n'
	S=${ print ${S// /$'\n'} | sort ; }
	for KEY in $S ; do
		[[ -n ${STR[$KEY]} ]] && \
			OUT+=${ printf "%32s = '%s'" ${KEY} "${STR[$KEY]}" ; }'\n'
	done
	S=${!INT[@]}
	S=${ print ${S// /$'\n'} | sort ; }
	for KEY in $S ; do
		(( INT[$KEY] )) && \
			OUT+=${ printf "%32s = %d" ${KEY} "${INT[$KEY]}" ; }'\n'
	done
	if (( ${#SSD[@]} )); then
		OUT+=${ printf "%32s = (" 'SSD' ; }
		for S in "${SSD[@]}" ; do
			OUT+="\t\t${S}\n"
		done
		OUT+='\t)\n'
	fi
	print -u2 "${OUT}"
}

Man.addFunc save_password '' '[+NAME?save_password - Save password to temporary file.]
[+DESCRIPTION?Save the current password from \bSTR[LDAP_ROOTPWD]]\b to the file \bTMP[LDAP_ROOTPWF]]\b.]
'
function save_password {
	print "${STR[LDAP_ROOTPWD]}" >"${TMP[LDAP_ROOTPWF]}"
}
#############################################################################
# EOG
#############################################################################


#############################################################################
# config file stuff
#############################################################################
Man.addFunc create_config_file '' '[+NAME?create_config_file - Write config data to the specified file.]
[+DESCRIPTION?Write config data to \afile\a.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage INT STR SSD ; }" '}
[+RETURN VALUES]{
	[+0?file was written successfully.]
	[+>= 1?otherwise.]
}
[+SEE ALSO?\bload_config_file()\b.]
\n\n\afile\a
'
function create_config_file {
	typeset OUT="$1" KEY
	[[ -z ${OUT} ]] && return 1

	# Create output file.
	(
    	print '
# '"${OUT}"' - This file contains configuration information for
# LDAP naming services.  Use the '"${PROG}"' tool to load it.
#
# WARNING: This file was generated by '"${PROG}"', and is intended to
#          be loaded by '"${PROG}"' as is.  DO NOT EDIT THIS FILE!
'
		print 'typeset -A -i IIN=( )'
		for KEY in "${!INT[@]}" ; do
			print "IIN[${KEY}]=${INT[${KEY}]}"
		done
		print '\ntypeset -A SIN=( )'
		for KEY in "${!STR[@]}" ; do
			printf "SIN[${KEY}]=%q\n" "${STR[${KEY}]}"
		done
		print '\ntypeset -a SIN_SSD=( )'
		for KEY in "${SSD[@]}" ; do
			[[ -n ${KEY} ]] && printf "SIN_SSD+=( %q )\n" "${KEY}"
		done
		print "\n# End of ${OUT}"
	) >"${OUT}"
}

# for backward compatibilty, but not documented: old format is bogus and should
# not be used anymore.
function source_old_config {
	typeset IN="$1" TODO='' VNAME KEY VAL LINE
	typeset -A OLDMAP=(
		[DS_HOST]=IDS_SERVER
		[DS_PORT]=IDS_PORT
		[DS_DB]=IDS_DATABASE
		[DS_TIMELIMIT]=IDS_TIMELIMIT
		[DS_SIZELIMIT]=IDS_SIZELIMIT
		[SSD]=LDAP_SERV_SRCH_DES
	)

	for KEY in "${!INT[@]}" ; do
		VNAME=${OLDMAP[${KEY}]}
		[[ -z ${VNAME} ]] && VNAME=${KEY}
		typeset -n VAR=${VNAME}
		INT[${KEY}]=${VAR}
		TODO+="${VNAME} "
	done
	for KEY in "${!STR[@]}" ; do
		VNAME=${OLDMAP[${KEY}]}
		[[ -z ${VNAME} ]] && VNAME=${KEY}
		typeset -n VAR=${VNAME}
		STR[${KEY}]="${VAR}"
		TODO+="${VNAME} "
	done
	while read LINE; do
		if [[ ${LINE:0:19} == 'LDAP_SERV_SRCH_DES=' ]]; then
			VAL="${LINE:19}"
			[[ -n ${VAL} ]] && SSD+=( "${VAL}" )
		fi
	done < "${IN}"

	# cleanup "global" namespace
	[[ -n ${TODO} ]] && eval "unset ${TODO}"
}

Man.addFunc load_config_file '' '[+NAME?load_config_file - load an '"${PROG}"' config file.]
[+DESCRIPTION?Loads the initial config from \afile\a, which has been generated in a previous run by '"${PROG}"'. Sets \bTMPF[DEL_OLD_PROFILE]]\b to 1 on success.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage INT STR SSD ; }" '}
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66? \afile\a is not a file or unreadable.]
}
[+SEE ALSO?\bsave_password()\b, \bshow_vars()\b.]
\n\n\afile\a
'
function load_config_file {
	typeset IN="$1" KEY VAL
	integer I
	[[ ! -f ${IN} ]] && Log.fatal "${IN} is not a file" && return 66
	[[ ! -r ${IN} ]] && Log.fatal "${IN} is not readable" && return  67

	# source in the stuff - not nice but less work ;-)
	. "${IN}"

	KEY=${ typeset -p IIN ; }
	if [[ -z ${KEY} ]]; then
		source_old_config "${IN}" || return 68
	else
		for KEY in "${!INT[@]}" ; do
			INT[${KEY}]=${IIN[${KEY}]}
		done
		for KEY in "${!STR[@]}" ; do
			STR[${KEY}]="${SIN[${KEY}]}"
		done
		for KEY in "${SIN_SSD[@]}" ; do
			[[ -n ${KEY} ]] && SSD+=( "${KEY}" )
		done
		# cleanup "global" namespace
		unset IIN SIN SIN_SSD
	fi

	TMPF[DEL_OLD_PROFILE]=1
	save_password
	show_vars

	return 0
}
#############################################################################
# End Of  config file stuff
#############################################################################


############################################################################
# Basic [menu] stuff
############################################################################
Man.addFunc display_msg '' '[+NAME?display_msg - display a message]
[+DESCRIPTION?Display a message corresponding to the \atag\a passed in.]
[+ENVIRONMENT VARIABLES]{'"${ Man.varUsage INT STR TMP ; }" '}
\n\n\atag\a
'
function display_msg {
	typeset X
	integer I

	case "$1" in
		backup_server)
			print '
It is strongly recommended that you BACKUP the directory server
before running '"${PROG}"'.

Hit Ctrl-C at any time before the final confirmation to exit.\n'
			;;
		cred_level_menu)
			print 'The following are the supported credential levels:'
			for (( I=0; I < ${#CRED_LEVELS[@]}; I++ )); do
				printf ' %2d %s\n' $((I+1)) "${CRED_LEVELS[I]}"
			done
			;;
		auth_method_menu)
			print 'The following are the supported Client Authentication Methods:'
			for (( I=0; I < ${#AUTH_METHODS[@]}; I++ )); do
				printf ' %-2d  %s\n' $((I+1)) "${AUTH_METHODS[I]}"
			done
			;;
		srvauth_method_menu)
			print 'The following are the supported Service Authentication Methods:'
			# skip 'none'
			for (( I=1; I < ${#AUTH_METHODS[@]}; I++ )); do
				printf ' %-2d  %s\n' $((I)) "${AUTH_METHODS[I]}"
			done
			;;
		prompt_ssd_menu)
			print '  A  Add a Service Search Descriptor (SSD)
  D  Delete a SSD
  M  Modify a SSD
  P  Display all SSDs
  H  Help
  X  Clear all SSDs

  Q  Exit menu'
			;;
		summary_menu)
			typeset SUFFIX_INFO=''
			typeset DB_INFO=''

			if (( TMPF[NEED_CREATE_SUFFIX] )); then
				SUFFIX_INFO='
         Suffix to create          : '"${STR[LDAP_SUFFIX]}"'\n'
				(( TMPF[NEED_CREATE_BACKEND] )) && DB_INFO='
         Database to create        : '"${STR[DS_DB]}"'\n'
			fi
			typeset BASEDN
			BASEDN="${STR[LDAP_BASEDN]}${STR[SUFFIX_INFO]}${STR[DB_INFO]}"

			print '              Summary of Configuration

  1  Domain to serve               : '"${STR[LDAP_DOMAIN]}"'
  2  Base DN to setup              : '"${BASEDN}"'
  3  Profile name to create        : '"${STR[LDAP_PROFILE_NAME]}"'
  4  Default Server List           : '"${STR[LDAP_SERVER_LIST]}"'
  5  Preferred Server List         : '"${STR[LDAP_PREF_SRVLIST]}"'
  6  Default Search Scope          : '"${STR[LDAP_SEARCH_SCOPE]}"'
  7  Credential Level              : '"${STR[LDAP_CRED_LEVEL]}"'
  8  Authentication Method         : '"${STR[LDAP_AUTHMETHOD]}"'
  9  Enable Follow Referrals       : '"${INT[LDAP_FOLLOWREF]}"'
 10  DS Time Limit                 : '"${INT[DS_TIMELIMIT]}"'
 11  DS Size Limit                 : '"${INT[DS_SIZELIMIT]}"'
 12  Enable crypt password storage : '"${INT[NEED_CRYPT]}"'
 13  Service Auth Method pam_ldap  : '"${STR[LDAP_SRV_AUTHMETHOD_PAM]}"'
 14  Service Auth Method keyserv   : '"${STR[LDAP_SRV_AUTHMETHOD_KEY]}"'
 15  Service Auth Method passwd-cmd: '"${STR[LDAP_SRV_AUTHMETHOD_CMD]}"'
 16  Search Time Limit             : '"${INT[LDAP_SEARCH_TIME_LIMIT]}"'
 17  Profile Time to Live          : '"${INT[LDAP_PROFILE_TTL]}"'
 18  Bind Limit                    : '"${INT[LDAP_BIND_LIMIT]}"'
 19  Enable shadow update          : '"${INT[LDAP_ENABLE_SHADOW_UPDATE]}"'
 20  Service Search Descriptors Menu\n'
			;;
		sorry)
			print '
HELP - No help is available for this topic.\n'
			;;
		create_suffix_help)
			print '
HELP - Our Base DN is "'"${STR[LDAP_BASEDN]}"'"
       and we need to create a Directory Suffix,
       which can be equal to Base DN itself or be any of Base DN parents.
       All intermediate entries up to suffix will be created on demand.\n'
			;;
		enter_ldbm_db_help)
			print '
HELP - database backend is an internal database for storage of our suffix data.
       Backend name must be alphanumeric due to Directory Server restriction.
'
			;;
		backup_help)
			print '
HELP - Since '"${PROG}"' modifies the directory server configuration,
       it is strongly recommended that you backup the server prior
       to running this utility.  This is especially true if the server
       being configured is a production server.\n'
			;;
		port_help)
			print '
HELP - Enter the port number the directory server is configured to
       use for LDAP.\n'
			;;
		adminport_help)
			print '
HELP - Enter the Admin port number the directory server is configured to
       use for for DS administration commands.\n'
			;;
		domain_help)
			print '
HELP - This is the DNS domain name this server will be serving.  You
       must provide this name even if the server is not going to be populated
       with hostnames.  Any unqualified hostname stored in the directory
       will be fully qualified using this DNS domain name.\n'
			;;
		basedn_help)
			print '
HELP - This parameter defines the default location in the directory tree for
       the naming services entries.  You can override this default by using 
       Service Search Descriptors (SSD). You will be given the option to set up 
       an SSD later on in the setup.\n'
			;;
		profile_help)
			print '
HELP - Name of the configuration profile with which the clients will be
       configured. A directory server can store various profiles for multiple 
       groups of clients.  The initialization tool, (ldapclient(1M)), assumes 
       "default" unless another is specified.\n'
			;;
		def_srvlist_help)
			print '
HELP - Provide a list of directory servers to serve clients using this profile.
       All these servers should contain consistent data and provide similar 
       functionality.  This list is not ordered, and clients might change the 
       order given in this list. Note that this is a space separated list of 
       *IP addresses* (not host names).  Providing port numbers is optional.\n'
			;;
		pref_srvlist_help)
			print '
HELP - Provide a list of directory servers to serve this client profile. 
       Unlike the default server list, which is not ordered, the preferred 
       servers must be entered IN THE ORDER you wish to have them contacted. 
       If you do specify a preferred server list, clients will always contact 
       them before attempting to contact any of the servers on the default 
       server list. Note that you must enter the preferred server list as a 
       space-separated list of *IP addresses* (not host names).  Providing port 
       numbers is optional.\n'
			;;
		srch_scope_help)
			print '
HELP - Default search scope to be used for all searches unless they are
       overwritten using serviceSearchDescriptors.  The valid options
       are "one", which would specify the search will only be performed 
       at the base DN for the given service, or "sub", which would specify 
       the search will be performed through *all* levels below the base DN 
       for the given service. If you use the default DIT layout, "one" should
       be ok and probably a little bit faster.\n'
			;;
		cred_lvl_help)
			print '
HELP - This parameter defines what credentials (identity) the clients use to
       authenticate (bind) to the directory server.  This list might contain
       multiple credential levels and is ordered.  If a proxy level is
       configured, you will also be prompted to enter a bind DN for the
       proxy agent along with a password.  This proxy agent will be created
       if it does not exist. See also ldapclient(1M).\n'
			;;
		auth_help)
			print '
HELP - The default authentication (bind) method(s) to be used by all services
       in the client using this profile.  This is a ordered list of
       authentication methods separated by a ";".  The supported methods are
       provided in a menu.  Note that sasl/DIGEST-MD5 binds require passwords
       to be stored un-encrypted on the server. See also ldapclient(1M).\n'
			;;
		srvauth_help)
			print '
HELP - The non-default authentication (bind) methods to be used by certain
       services (for now pam_ldap, keyserv, and passwd-cmd are supported).
       The authentication methods specified in this attribute overrides
       the default authentication method defined in the profile.  This
       feature can be used to select stronger authentication methods for
       services which require increased security.\n'
			;;
		pam_ldap_help)
			print '
HELP - The authentication (bind) method(s) to be used by pam_ldap when
       contacting the directory server.  This is a ordered list, and, if
       provided, will override the default authentication method parameter.\n'
			;;
		keyserv_help)
			print '
HELP - The authentication (bind) method(s) to be used by newkey(1M) and chkey(1)
       when contacting the directory server.  This is a ordered list and if
       provided will override the default authentication method parameter.\n'
			;;
		passwd-cmd_help)
			print '
HELP - The authentication (bind) method(s) to be used by passwd(1) command when
       contacting the directory server.  This is a ordered list and if
       provided will override the default authentication method parameter.\n'
			;;
		referrals_help)
			print '
HELP - This parameter indicates whether the client should follow
       ldap referrals if it encounters one during naming lookups.\n'
			;;
		tlim_help)
			print '
HELP - The server time limit value indicates the maximum amount of time the
       server would spend on a query from the client before abandoning it.
       A value of "-1" indicates no limit.\n'
			;;
		slim_help)
			print '
HELP - The server sizelimit value indicates the maximum number of entries
       the server would return in respond to a query from the client.  A
       value of "-1" indicates no limit.\n'
			;;
		crypt_help)
			print '
HELP - By default a DS does not store userPassword attribute values using
       unix "crypt" formats (like bsdmd5, sunmd5, sha256, sha512, old crypt,
       etc. - see crypt.conf(4)).  If you need to keep your passwords in the
       crypt formats for backward or pam_unix compatibility, choose "yes".
       If any other password storage scheme than crypt is used, pam_ldap
       MUST be used by clients to authenticate users to the system. Note 
       that if you wish to use sasl/*-MD5 in conjunction with pam_ldap,
       user passwords are/must be stored in the clear text.\n'
			;;
		srchtime_help)
			print '
HELP - The search time limit the client will enforce for directory lookups.\n'
			;;
		profttl_help)
			print '
HELP - The time to live value for profile.  The client will refresh its
       cached version of the configuration profile at this TTL interval.\n'
			;;
		bindlim_help)
			print '
HELP - The time limit for the bind operation to the directory.  This
       value controls the responsiveness of the client in case a server
       becomes unavailable.  The smallest timeout value for a given
       network architecture/conditions would work best.  This is very
       similar to setting TCP timeout, but only for LDAP bind operation.\n'
			;;
		ssd_help)
			print '
HELP - Using Service Search Descriptors (SSD), you can override the
       default configuration for a given service.  The SSD can be
       used to override the default search base DN, the default search
       scope, and the default search filter to be used for directory
       lookups.  SSD are supported for all services (databases)
       defined in nsswitch.conf(4). See also ldapclient(1M).

       Note: SSD are powerful tools in defining configuration profiles
             and provide a great deal of flexibility.  However, care
             must be taken in creating them.  If you decide to make use
             of SSDs, consult the documentation first.\n'
			;;
		ssd_menu_help)
			print '
HELP - Using this menu SSD can be added, updated, or deleted from
       the profile.

       A - This option creates a new SSD by prompting for the
           service name, base DN, and scope.  Service name is
           any valid service as defined in ldap(1).  base is
           either the distinguished name to the container where
           this service will use, or a relative DN followed
           by a ",". For more information see ldapclient(1M).
       D - Delete a previously created SSD.
       M - Modify a previously created SSD.
       P - Display a list of all the previously created SSD.
       X - Delete all of the previously created SSD.

       Q - Exit the menu and continue with the server configuration.\n'
			;;
		enable_shadow_update_help)
			print '
HELP - Enter "y" to set up the LDAP server for shadow update.
       The setup will add an administrator identity/credential
       and modify the necessary access controls for the client
       to update shadow(4), auth_attr(4), exec_attr(4), prof_attr(4),
       user_attr(4), and project(4) data on the LDAP server. If
       sasl/GSSAPI is in use, the Kerberos host principal will be used
       as the administrator identity.

       Shadow data is used for password aging and account locking.
       Please refer to the shadow(4) manual page for details.\n'
			;;
		add_admin_cred_help)
			print '
HELP - Start the setup to add an administrator identity/credential
       and to modify access controls for the client to update
       shadow(4), auth_attr(4), exec_attr(4), prof_attr(4),
       user_attr(4), and project(4) data on the LDAP server.

       Shadow data is used for password aging and account locking.
       Please refer to the shadow(4) manual page for details.\n'
			;;
		use_host_principal_help)
			print '
HELP - A profile with a "sasl/GSSAPI" authentication method and a "self"
       credential level is detected, enter "y" to modify the necessary
       access controls for allowing the client to update shadow(4) data
       on the LDAP server.

       Shadow data is used for password aging and account locking.
       Please refer to the shadow(4) manual page for details.\n'
			;;
	esac
}

Man.addVar ANS 'Variable used to return the user input.'
Man.addFunc get_ans '' '[+NAME?get_ans - gets an answer from the user.]
[+DESCRIPTION?Read a string from stdin. Arguments:]{
	[+prompt?instruction/comment/description/question to show.]
	[+default?Default value to use if no answer/empty string was read.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ANS ; }" '}
\n\n\aprompt\a [\adefault\a]
'
function get_ans {
	typeset PROMPT="$1 "
    [[ -n $2 ]] && PROMPT+="[$2] "

	read ANS?"${PROMPT}"
	[[ -z ${ANS} ]] && ANS="$2"
}


Man.addFunc get_ans_req '' '[+NAME?get_ans_req - get a non-empty answer from the user.]
[+DESCRIPTION?Read a string from stdin. Does not return until the string is a non-empty string or a \adefault\a value is given. Arguments:]{
	[+prompt?instruction/comment/description/question to show.]
	[+default?Default value to use if no answer/empty string was read.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ANS ; }" '}
[+SEE ALSO?\bget_ans()\b]
\n\n\aprompt\a [\adefault\a]
'
function get_ans_req {
	ANS=''
	while [[ -z ${ANS} ]]; do
		get_ans "$@"
		[[ -z ${ANS} ]] && Log.warn 'NULL value not allowed'
	done
}

Man.addFunc is_numeric '' '[+NAME?is_numeric - check whether arg is a numeric string]
[+DESCRIPTION?Check whether the given \astring\a is a numeric string.]
[+RETURN VALUES]{
	[+0?If the string is a numeric string.]
	[+1?Otherwise.]
}
[+SEE ALSO?\bnot_numeric()\b]
\n\n\astring\a
'
function is_numeric {
	(( $# != 1 )) && return 1
    [[ $1 =~ ^[0-9]+$ ]] && return 0 || return 1
}

Man.addFunc not_numeric '' '[+NAME?not_numeric - check whether arg is NOT a numeric string]
[+DESCRIPTION?Check whether the given \astring\a is NOT a numeric string. Useful for if and while statements that want to test for non-numeric data.]
[+RETURN VALUES]{
	[+0?If the string is NOT a numeric string.]
	[+1?Otherwise.]
}
[+SEE ALSO?\bis_numeric()\b]
\n\n\astring\a
'
function not_numeric {
	is_numeric $1 && return 1 || return 0
}

Man.addVar NUM 'Variable used to return the user input as a number.'
integer NUM
Man.addFunc get_number '' '[+NAME?get_number - get a number from the user.]
[+DESCRIPTION?Read a string from stdin until it represents a number. Arguments:]
{
	[+prompt?instruction/comment/description/question to show.]
	[+default?Default value to use if no answer/empty string was read.]
	[+helpTag?Tag of the help message to show, when the string read is h|H|?|help|Help.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage NUM ANS ; }" '}
[+SEE ALSO?\bget_ans()\b, \bis_numeric()\b, \bdisplay_msg()\b]
\n\n\aprompt\a \adefault\a [\ahelpTag\a]
'
function get_number {
	ANS=''

	get_ans "$1" "$2"

	while not_numeric $ANS ; do
		case "${ANS}" in
			[Hh?] | help | Help) display_msg ${3:-sorry} ;;
			* ) Log.warn "Invalid value: '${ANS}'" ;;
		esac
		get_ans 'Enter a numeric value:' "$2"
	done
	NUM=${ANS}
}


Man.addFunc get_negone_num '' '[+NAME?get_negone_num - get a number >= -1 from the user.]
[+DESCRIPTION?Read a string from stdin until it represents a number >= -1. Arguments:]
{
	[+prompt?instruction/comment/description/question to show.]
	[+default?Default value to use if no answer/empty string was read.]
	[+helpTag?Tag of the help message to show, when the string read is h|H|?|help|Help.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage NUM ANS ; }" '}
[+SEE ALSO?\bget_number()\b]
\n\n\aprompt\a \adefault\a [\ahelpTag\a]
'
function get_negone_num {
	while : ; do
		get_number "$1" "$2" "$3"
		(( NUM >= -1 )) && break
		Log.warn 'Invalid number! Enter a number >= -1'
	done
}

Man.addFunc get_passwd '' '[+NAME?get_passwd - get a password from the user.]
[+DESCRIPTION?Read a password from stdin and verify with second until both match. Password gets not echoed to stdout. Arguments:]
{
    [+prompt?instruction/comment/description/question to show.]
    [+default?Default value to use if no answer/empty string was read.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ANS ; }" '}
[+SEE ALSO?\bget_ans()\b]
\n\n\aprompt\a [\adefault\a]
'
function get_passwd {
	typeset _PASS1='' _PASS2=''

	${STTY} -echo			# Turn echo OFF

	# continue until passwd and re-entered passwd match
	while : ; do
		ANS=''
		# Don't allow NULL for first try.
		while [[ -z ${ANS}  ]]; do
			get_ans "$@"
			[[ -z ${ANS} ]] && \
				print -u2 && Log.warn 'Empty password not allowed'
		done
		_PASS1="${ANS}"			# Store first try.

		print
		get_ans 'Re-enter password:'
		_PASS2="${ANS}"

		[[ ${_PASS1} == ${_PASS2} ]] && break
		print -u2 && Log.warn "passwords don't match - try again"
	done

	${STTY} echo			# Turn echo ON

	print
}

Man.addFunc get_passwd_nochk '' '[+NAME?get_passwd_nochk - get a password from the user w/o check.]
[+DESCRIPTION?Read a password from stdin. Actually the same as \bget_ans()\b but echoing characters read to stdout is switched off. Arguments:]
{
    [+prompt?instruction/comment/description/question to show.]
    [+default?Default value to use if no answer/empty string was read.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ANS ; }" '}
[+SEE ALSO?\bget_ans()\b]
\n\n\aprompt\a [\adefault\a]
'
function get_passwd_nochk {
	${STTY} -echo			# Turn echo OFF
	get_ans "$@"
	${STTY} echo			# Turn echo ON
	print
}

Man.addFunc get_menu_choice '' '[+NAME?get_menu_choice - get a valid menu choice number.]
[+DESCRIPTION?Get a menu choice from user. Continue prompting until the choice is in required range. Arguments:]
{
	[+prompt?Message text.]
	[+min?Min value.]
	[+max?Max value.]
	[+default?Default value to use if no answer/empty string was read.]
	[+helpTag?If given, "h" is allowed as well and the help message for this tag gets shown, when it got typed and before the prompt is shown the first time. The prompt should contain a hint in this case.]
	[+menuTag?If given the menu choices for the given menu gest displayed at start and after each help text.]
}
[+RETURN VALUES]{
	[+-1?on error (invalid parameters).]
	[+>= \amin\a?the selected value.]
}
[+SEE ALSO?\bis_numeric()\b, \bget_ans()\b, \bdisplay_msg()\b.]
\n\n\aprompt\a \amin\a \amax\a [\adefault\a [\ahelpTag\a]] 
'
function get_menu_choice {
	if (( $# < 3 )); then
		Log.warn "${.sh.fun}(): Did not get required parameters"
		return -1
	fi

	[[ -n $6 ]] && display_msg "$6"
	while : ; do
		get_ans "$1" "$4"
		if is_numeric ${ANS} && NUM=${ANS} && (( NUM >= $2 )) && (( NUM <= $3 ))
		then
			return ${NUM}
		fi
		if [[ -n $5 && ${ANS} == 'h' ]]; then
			display_msg "$5"
			[[ -n $6 ]] && display_msg "$6"
			continue
		fi
		Log.warn "Invalid choice! Enter a number in the range $2 .. $3"
	done
	return -1
}

Man.addFunc get_confirm '' '[+NAME?get_confirm - Get confirmation from the user.]
[+DESCRIPTION?Read a string from stdin until it matches Y|y|Yes|yes|YES|N|n|No|no|NO or an empty string. Arguments:]
{
    [+prompt?instruction/comment/description/question to show.]
    [+default?Default value to use if no answer/empty string was read.]
    [+helpTag?Tag of the help message to show, when the string read is h|H|?|help|Help.]
}
[+RETURN VALUES]{
	[+0?for NO]
	[+1?for YES]
}
[+SEE ALSO?\bdisplay_msg()\b]
\n\n\aprompt\a \adefault\a [\ahelpTag\a]
'
function get_confirm {
	typeset _ANSWER=''

	if [[ -z $2 ]]; then
		Log.fatal "INTERNAL ERROR: ${.sh.fun} requires 2 args, 3rd is optional"
		exit 2
	fi

	while : ; do
		read _ANSWER?"$1 [$2] "
		[[ -z ${_ANSWER} ]] && _ANSWER="$2"

		case "${_ANSWER}" in
		    [Yy] | yes | Yes | YES) return 1 ;;
			[Nn] | no  | No  | NO)  return 0 ;;
			[Hh?] | help | Help) display_msg ${3:-sorry} ;;
			* ) Log.warn 'Please enter y or n'  ;;
		esac
	done
}

Man.addFunc get_confirm_nodef '' '[+NAME?get_confirm_nodef - Get confirmation from the user.]
[+DESCRIPTION?Read a string from stdin until it matches Y|y|Yes|yes|YES|N|n|No|no|NO. No default value and help tag supported. Arguments:]
{
	[+prompt?instruction/comment/description/question to show.]
}
[+RETURN VALUES]{
	[+0?for NO]
	[+1?for YES]
}
\n\n[\aprompt\a]...
'
function get_confirm_nodef {
	typeset _ANSWER=''

	while : ; do
		read _ANSWER?"$@ "
		case "${_ANSWER}" in
			[Yy] | yes | Yes | YES) return 1 ;;
			[Nn] | no  | No  | NO)  return 0 ;;
			* ) Log.warn 'Please enter y or n'  ;;
		esac
	done
}
############################################################################
# End of basic [menu] stuff
############################################################################


######################################################################
# FUNCTIONS FOR prompt_config_info() START HERE.
######################################################################
Man.addFunc get_ids_server '' '[+NAME?get_ids_server - Prompt for DS server name.]
[+DESCRIPTION?Ask the user for the DS hostname, store it into \bSTR[DS_HOST]]\b and adjusts \bCON_ARGS\b.]
[+ENVIRONMENT VARIABLES]{'"${ Man.varUsage CON_ARGS ; }"'}
[+SEE ALSO?\bget_ans()\b, \bget_ids_port()\b, \bping\b(1M).]
'
function get_ids_server {
	typeset SRV="${STR[DS_HOST]}"
	typeset OS=${ uname -s ; }

	while : ; do
		get_ans "Enter the Directory Server's hostname to setup:" \
			"${STR[DS_HOST]}" 
		SRV="${ANS}"

		# Ping server to see if alive.  If reachable break out of loop
		if [[ ${OS} == 'SunOS' ]]; then
			${PING} "${SRV}" 3 >/dev/null 2>&1 && break
		else
			# assume Linux
			${PING} -W 3 "${SRV}" >/dev/null 2>&1 && break
		fi
		Log.warn "Server '${SRV}' is invalid or unreachable"
	done
	STR[DS_HOST]="${SRV}"

	# Set CON_ARGS since values might have changed
	CON_ARGS="-h ${SRV} -p ${INT[DS_PORT]}"
}

Man.addFunc get_ids_port '' '[+NAME?get_ids_port - Prompt for DS port number.]
[+DESCRIPTION?Ask the user for the DS port number and host, store it into \bINT[DS_PORT]]\b, \bSTR[DS_HOST]]\b and adjust \bCON_ARGS\b.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage CON_ARGS ; }" '}
[+SEE ALSO?\bget_number()\b, \bget_ids_server()\b, \bldapsearch\b(1).]
\n\n\aarg\a'
function get_ids_port {
	typeset ASK='Enter the port number for the directory server (h=help):'
	typeset HELP='port_help' KEY='DS_PORT'

	integer PORT
	while : ; do
		# Enter port number
		get_number "${ASK}" ${INT[${KEY}]} "${HELP}"
		PORT=${ANS}
		# Do a simple search to check hostname and LDAP port number
		if [[ -z $1 ]]; then
			if ${LDAPSEARCH} -h ${STR[DS_HOST]} -p ${PORT} -b '' \
				-s base 'objectclass=*' > /dev/null 2>&1
			then
				break
			fi
			Log.warn "Invalid host or port '${STR[DS_HOST]}:${PORT}'"
			get_ids_server
		else
			break
		fi
	done
	INT[${KEY}]=${PORT}
	[[ -n $1 ]] && return

	# Set CON_ARGS since values might have changed
	CON_ARGS="-h ${STR[DS_HOST]} -p ${PORT}"
}

Man.addFunc chk_ids_version '' '[+NAME?chk_ids_version - Read the DS version info.]
[+DESCRIPTION?Query the DS for version info and store it into \bTMP[DS_INFO]]\b as "ProductName MajorVersionNum MinorVersionNum". If the DS is OpenDS or OpenDJ \bTMPF[IS_OPENDJ]]\b gets set to 1, 0 otherwise. If the DS seems to be unsupported by this script, an appropriate message gets stored into \bTMP[WARN]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?on fatal error (got no info).]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function chk_ids_version {
	typeset PROD='' X LINE
	typeset  -a SPLIT=( )
	integer MAJOR=0 MINOR=0
    ${LDAPSEARCH} ${CON_ARGS} -b cn=monitor -s base 'objectclass=*' \
		2>/dev/null | \
	while read LINE ; do
		if [[ ${LINE:0:14} == 'vendorVersion=' ]]; then
			# OpenD*
			X=${LINE:14}
			X=${X//Directory Server }		# usually <= 2.3.x
			PROD=${X%% *}
			SPLIT=( ${.sh.match//./ } )
			MAJOR=${SPLIT[0]}
			MINOR=${SPLIT[1]}
			break
		elif [[ ${LINE:0:8} == 'version=' ]]; then
			# *DSEE
			X=${LINE:8}
			PROD=${X%%/*}
			X=${.sh.match#/}
			SPLIT=( ${X//./ } )
			MAJOR=${SPLIT[0]}
			MINOR=${SPLIT[1]}
			break
		fi
	done
	if [[ -z ${PROD} ]] || (( MAJOR == 0 )); then
		Log.fatal 'Can not determine the version number of the DS'
		return 66
	fi

	TMP[DS_INFO]="${PROD} ${MAJOR} ${MINOR}"

	# for easier maintainance we don't put it into a single expr
	X=''
	if [[ ${PROD} == 'OpenDS' || ${PROD} == 'OpenDJ' ]]; then
		TMPF[IS_OPENDJ]=1
		(( MAJOR < 2 )) && X='1'
	elif (( MAJOR < 5 || (7 < MAJOR && MAJOR < 11) )); then
		# not a supported DSEE version
		TMPF[IS_OPENDJ]=0
		X='1'
    fi
	if [[ -n ${X} ]]; then
		TMP[WARN]="$PROG only works with DSEE version 5.x, 6.x, 7.x, "
		TMP[WARN]+='ODSEE 11g and OpenDS/OpenDJ 2.x'
		Log.warn "${TMP[WARN]}"
	fi
	Log.printMarker
    Log.info "Detected DS:  ${PROD} ${MAJOR}.${MINOR}"
	Log.printMarker
	return 0
}

Man.addFunc get_dirmgr_dn '' '[+NAME?get_dirmgr_dn - get the directory manger DN.]
[+DESCRIPTION?Ask the user for the directory manger DN and store it into \bSTR[LDAP_ROOTDN]]\b and adjust \bAUTH_ARGS\b.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage AUTH_ARGS ; }" '}
[+SEE ALSO?\bget_ans()\b.]
'
function get_dirmgr_dn {
	get_ans 'Enter the directory manager DN:' "${STR[LDAP_ROOTDN]}"
    STR[LDAP_ROOTDN]="${ANS}"
	AUTH_ARGS=( '-D' "${STR[LDAP_ROOTDN]}" '-j' "${TMP[LDAP_ROOTPWF]}" )
}

Man.addFunc get_dirmgr_pw '' '[+NAME?get_dirmgr_pw - get the Root DN password.]
[+DESCRIPTION?Ask the user for the Root DN (\bSTR[LDAP_ROOTDN]]\b), store it into \bSTR[LDAP_ROOTPWD]]\b as well as a temp file for later use. Finally adjust \bAUTH_ARGS\b and check, whether the changes work.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage AUTH_ARGS ; }" '}
[+SEE ALSO?\bget_passwd_nochk()\b, \bsave_password()\b, \bldapsearch\b(1).]
'
function get_dirmgr_pw {
	typeset RES

	while : ; do
		get_passwd_nochk "Enter passwd for ${STR[LDAP_ROOTDN]} :"
		STR[LDAP_ROOTPWD]="${ANS}"	# stored for create_config_file(), only
		save_password
		AUTH_ARGS=( '-D' "${STR[LDAP_ROOTDN]}" '-j' "${TMP[LDAP_ROOTPWF]}" )

		# Verify that ROOTDN and ROOTPWD are valid
		RES=${ ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b '' -s base 'objectclass=*' supportedLDAPVersion 2>&1 ; }
		(( $? == 0 )) && break	# Both are valid.

		if [[ ${RES} =~ (credential|no password) ]]; then
			Log.warn 'Password for Root DN is invalid'
		else
			Log.warn "Root DN '${STR[LDAP_ROOTDN]}' is invalid"
			get_dirmgr_dn
		fi
    done
}

Man.addFunc get_domain '' '[+NAME?get_domain - Ask user for domain to be served.]
[+DESCRIPTION?Ask the user for the Domain that will be served by the LDAP server and store it into \bSTR[LDAP_DOMAIN]]\b.]
[+SEE ALSO?\bget_ans()\b.]
'
function get_domain {
	while : ; do
		get_ans 'Enter the domainname to be served (h=help):' \
			"${STR[LDAP_DOMAIN]}"
		case "${ANS}" in
			[Hh?] | help | Help) display_msg 'domain_help' ; continue ;;
		esac
		# check, whether it has at least 2 dot separated components
		[[ ${ANS} =~ [^.]+\.[^.]+ ]] && break
		Log.warn "Invalid domainname '${ANS}'"
    done
	STR[LDAP_DOMAIN]="${ANS}"
}

Man.addFunc getDSobjectclasses '' '[+NAME?getDSobjectclasses - get all DS schema objectclasses.]
[+DESCRIPTION?Fetch all objectclasses definitions of the DS via \bcn=schema\b and cache them into \bOID2ODEF\b. Once successfully fetched, this function does nothing but return 0.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>0?failed to retrieve attribute definitions.]
}
'
function getDSobjectclasses {
	(( ${#OID2ODEF[@]} )) && return 0

	typeset AT OID NAME TAIL
	set -o pipefail
	${LDAPSEARCH} ${CON_ARGS} -b cn=schema -s base 'objectclass=*' \
		objectclasses 2>/dev/null | \
	while read AT OID NAME TAIL ; do
		[[ ${AT} != 'objectclasses=(' ]] && continue
		TAIL=${TAIL%%+( )$')'};
		OID2ODEF["${OID}"]="${TAIL}"
		:			# always return 0
	done
}

Man.addFunc getDSattributes '' '[+NAME?getDSattributes - get all DS schema attributes.]
[+DESCRIPTION?Fetch all attribute definitions of the DS via \bcn=schema\b and cache them into \bOID2ADEF\b. Also populate the hash map \bANAME2OID\b for all the attributes definied. Once successfully fetched, this function does nothing but return 0.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>0?failed to retrieve attribute definitions.]
}
'
function getDSattributes {
	(( ${#ANAME2OID[@]} )) && return 0

	typeset AT OID NAME TAIL
	typeset -l ALIAS
	set -o pipefail
	${LDAPSEARCH} ${CON_ARGS} -b cn=schema -s base 'objectclass=*' \
		attributeTypes 2>/dev/null | \
	while read AT OID NAME TAIL ; do
		[[ ${AT} != 'attributeTypes=(' ]] && continue
		TAIL=${TAIL%%+( )$')'};
		OID2ADEF["${OID}"]="${TAIL}"
		# 'name'
		if [[ ${TAIL:0:1} == "'" ]]; then
			NAME=${TAIL:1}
			ALIAS=${NAME%%"'"*}
			ANAME2OID["${ALIAS}"]="${OID}"
			continue
		fi
		# ( 'name' 'name 1' ... )
		NAME=${TAIL%%$')'*}
		NAME=${NAME##$'('*([[:space:]])}
		while [[ ${NAME} == ~(E)"'"([^"'"]+)"'" ]]; do
			ALIAS=${.sh.match[1]}
			ANAME2OID["${ALIAS}"]="${OID}"
			NAME=${NAME:${#ALIAS}+2}
			NAME=${NAME#*([[:space:]])}
		done
		:			# always return 0
	done
}

Man.addFunc check_attrName '' '[+NAME?check_attrName - validate an attribute name.]
[+DESCRIPTION?Check that \akey\a is a valid attribute name.]
[+RETURN VALUES]{
	[0?key is a valid name.]
	[1?key is a invalid name.]
	[66?failed to fetch attribute definitions from server.]
}
[+SEE ALSO?\bldapsearch\b(1).]
\n\n\akey\a
'
function check_attrName {
	typeset KEY=$1

	if ! getDSattributes ; then
		Log.fatal 'Unable to fetch attribute definitions from server'
		return 66
	fi
	[[ -z ${KEY} ]] && return 1
	if [[ ${KEY} =~ ^[0-9]+(\.[0-9]+)*$ ]]; then	
		# OID value
		[[ -n ${OID2ADEF[${KEY}]} ]] && return 0
	else
		# symbol. name
		KEY=${ANAME2OID[${KEY}]}
		# if have a mapping, than we also have a definition for it - no need
		# to double check
		[[ -n  ${KEY} ]] && return 0
	fi
	return 1
}

Man.addFunc check_baseDN '' '[+NAME?check_baseDN - check validity of the baseDN name.]
[+DESCRIPTION?Check that \abaseDN\a is a valid base DN.]
[+RETURN VALUES]{
    [+0?baseDN is a valid.]
    [+>= 1?baseDN is a invalid.]
}
[+SEE ALSO?\bcheck_attrName()\b.]
[+NOTES?This function does not catch all invalid DNs. Its purpose is to reduce the number of invalid DNs to get past the input routine.  The invalid DNs will be caught by the LDAP server when they are attempted to be created.]
\n\n\abaseDN\a
'
function check_baseDN {
	# NOTE: we preserve spaces! And try to report all errors instead of just one
    Log.info 'Checking LDAP Base DN ...'
	[[ -z $1 ]] && return 0

	# NOTE: when fancy debug via trap is enabled, splitting via IFS does not
	# work: IFS=',' PAIRS=( $1 ) - so we do it manually

	typeset PAIR KEY VAL TAIL="${1},"
	typeset -A UNIQ_KEYS=( )	# avoid repeated lookup of the same attrName
	integer ERR=0
	while [[ -n ${TAIL} ]]; do
		TAIL=${TAIL#*,}
		PAIR=${.sh.match%,}
		VAL=${PAIR#*=}
		KEY=${.sh.match%=}
		if [[ -z ${KEY} || -z ${VAL} ]]; then
			Log.warn "Invalid key=value pair '${PAIR}'"
			(( ERR++ ))
			continue
		fi
		UNIQ_KEYS[${KEY}]=1
	done

	for KEY in "${!UNIQ_KEYS[@]}" ; do
		if ! check_attrName "${KEY}" ; then
			Log.warn "Unknown attribute name '${KEY}'"
		fi
	done
	return ${ERR}
}

Man.addFunc discover_serv_suffix '' '[+NAME?discover_serv_suffix - query the DS to find suffixes available.]
[+DESCRIPTION?Query the DS to find suffixes available. All suffixes found are stored into the variable \avname\a which must be an indexed array.]
[+RETURN VALUES]{
	[+0?at least one suffix was found.]
	[+1?no suffix found.]
}
[+SEE ALSO?\bldapsearch\b(1).]
\n\n\avname\a
'
function discover_serv_suffix {
	typeset LINE
	integer NUM_TOP=0
	typeset -n DST=$1
	DST=( ); unset DST[0]

	# Search the server for the TOP of the TREE. Usually none for virgin DS
	${LDAPSEARCH} ${CON_ARGS} -b '' -s base 'objectclass=*' namingContexts \
		2>/dev/null | \
	while read LINE ; do
		if [[ -n ${LINE} && ${LINE} != ~(Ei)NetscapeRoot ]]; then
			(( NUM_TOP++ ))
			DST+=( "${LINE#*=}\n" )		# strip off '^namingContexts='
		fi
	done

	if (( NUM_TOP == 0 )); then
		Log.verbose 'No suffix found in LDAP tree'
		return 1
	fi

	Log.verbose "LDAP_SUFFIX_LIST = ${DST[@]}"
	return 0
}

Man.addFunc get_backend '' '[+NAME?get_backend - get the relevant database backend for the Base DN.]
[+DESCRIPTION?Get the relevant database backend name for the Base DN and store it into \bSTR[DS_DB]]\b.]
[+?Prerequisite: \bSTR[LDAP_BASEDN]]\b must be set and valid.]
[+?backend is retrieved from suffixes and subsuffixes defined under "cn=mapping tree,cn=config". The nsslapd-state attribute of these suffixes entries is filled with either Backend, Disabled or referrals related values. We only want those that have a true backend database to select the relevant backend.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?an fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function get_backend {
	typeset CUR_DN=${STR[LDAP_BASEDN]} PREV_DN='' FILTER

	while [[ ${CUR_DN} != ${PREV_DN} ]]; do
		typeset -a DB=( )
		Log.verbose "Testing LDAP suffix: ${CUR_DN} ..."

		if (( TMPF[IS_OPENDJ] )); then
			FILTER='(&(&(objectclass=ds-cfg-backend)(ds-cfg-base-dn='"${CUR_DN}"
			FILTER+='))(objectClass=ds-cfg-local-db-backend))'
			${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
				-b 'cn=Backends,cn=config' -s one "${FILTER}" 2>/dev/null | \
			while read LINE ; do
				[[ ${LINE:0:18} == 'ds-cfg-backend-id=' && \
					${LINE: -10} != ',cn=config' ]] && DB+=( "${LINE:18}" )
			done
		else

			${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
				-b "cn=${CUR_DN},cn=mapping tree,cn=config" \
				-s base 'nsslapd-state=Backend' 'nsslapd-backend' 2>/dev/null |\
			while read LINE ; do
				[[ ${LINE:0:16} == 'nsslapd-backend=' ]] && DB+=( "${LINE:16}" )
			done
		fi

		if (( ${#DB[@]} == 0 )); then
			# not a suffix, or suffix not activated; try next
			PREV_DN=${CUR_DN}
			CUR_DN="${CUR_DN#*,}"
		elif (( ${#DB[@]} == 1 )); then
			break
		else
			Log.fatal "More than one database is configured for '${CUR_DN}'!" \
				"$PROG can not configure suffixes where" \
				'more than one database is used for one suffix'
			return 66
		fi
	done

	if (( ${#DB[@]} == 0 )); then
		# should not happen, since STR[LDAP_BASEDN] is supposed to be valid
		Log.fatal "Could not find a valid backend for '${STR[LDAP_BASEDN]}'"
		if (( TMPF[IS_OPENDJ] )); then
			Log.fatal 'Check the "Creating a New Database Backend" section in the Administration Guide'
		fi
		return 67
	fi
	STR[DS_DB]="${DB[0]}"

	Log.verbose "DB backend '${STR[DS_DB]}' selected"

	return 0
}

Man.addFunc normalizeDN '' '[+NAME?normalizeDN - normalize a [relative]] distinguished name.]
[+DESCRIPTION?Strip off unnecessary spaces around \b,\b and \b=\b as well as at the beginning and end of the given \adn\a, optionally convert it to lower or upper case (if either \bl\b or \bu\b is given) and print it to stdout.]
\n\n\adn\a [\bl\b|\bu\b]
'
function normalizeDN {
	[[ -z $1 ]] && return
	typeset VAL=",${1},"
	VAL="${VAL//*( ),*( )/,}"
	VAL="${VAL//*( )=*( )/=}"
	if [[ $2 == 'l' ]]; then
		typeset -l LC="${VAL}"
		VAL="${LC}"
	elif [[ $2 == 'u' ]]; then
		typeset -u UC="${VAL}"
		VAL="${UC}"
	fi
	print -- "${VAL:1:${#VAL}-2}"
}

Man.addFunc check_basedn_suffix '' '[+NAME?check_basedn_suffix - check that there is an existing valid suffix to hold current base DN.]
[+DESCRIPTION?Check that there is an existing valid suffix for \bSTR[LDAP_BASEDN]]\b. If one is found, store it into \bSTR[LDAP_SUFFIX]]\b and make a corresponding backend check.]
[+RETURN VALUES]{
	[+0?valid suffix found or new one should be created (\bTMPF[NEED_CREATE_SUFFIX]]\b flag actually indicates that).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bdiscover_serv_suffix()\b, \bldapsearch\b(1), \bnormalizeDN()\b, \bget_backend()\b.]
'
function check_basedn_suffix {
	Log.info 'Validating LDAP Base DN and Suffix ...'
	TMPF[NEED_CREATE_SUFFIX]=0

	# check that LDAP Base DN might be added
	typeset CUR_DN="${STR[LDAP_BASEDN]}" PREV_DN=''

	while [[ ${CUR_DN} != ${PREV_DN} ]]; do
		${LDAPSEARCH} ${CON_ARGS} -b "${CUR_DN}" -s one 'objectclass=*' \
			>/dev/null 2>&1 && break
		PREV_DN=${CUR_DN}
		CUR_DN="${CUR_DN#*,}"	# remove leading component
	done

	if [[ ${CUR_DN} == ${PREV_DN} ]]; then
		Log.info "No valid suffixes were found for Base DN '${STR[LDAP_BASEDN]}'"
		TMPF[NEED_CREATE_SUFFIX]=1
		return 0
	fi

	# find out existing suffixes
	typeset -a SUFFIXES=( )
	discover_serv_suffix SUFFIXES

	# Now looking for relevant suffix for this entry (using lower case - LC).
	# STR[LDAP_SUFFIX] will then be used to add necessary base objects via
	# add_base_objects().
	typeset LC_DN=,${ normalizeDN "${CUR_DN}" l ; }
	typeset SFX LC_SFX
	for SFX in "${SUFFIXES[@]}" ; do
		Log.verbose "Testing suffix: ${SFX} ..."
		# LC_DN ends with ,SFX ?
	    LC_SFX=,${ normalizeDN "${SFX}" l ; }
		if [[ ${LC_DN: -${#LC_SFX}} == ${LC_SFX} ]]; then
			STR[LDAP_SUFFIX]="${SFX}"
			break
		fi
	done

	if [[ -z ${STR[LDAP_SUFFIX]} ]]; then
		# should not happen, since we found the entry
		Log.fatal "Could not find a valid suffix for '${STR[LDAP_BASEDN]}'"
	    return 66
	fi
	
	# Getting relevant database (backend)
	# DS_DB will then be used to create indexes.
	get_backend || return 67

	return 0
}

Man.addFunc get_objectclass '' '[+NAME?get_objectclass - get the objectclass for the given attribute name.]
[+DESCRIPTION?Get the objectclass for the given attribute name \aattrName\a and print it to stdout. Right now ou, dc, o, and c and related aliases/OIDs are supported, only. For all others nothing will be printed.]
[+NOTES?An attribute name can be valid but still we might not be able to determine the objectclass from the table. In such cases, the user needs to create the necessary object(s).]
\n\n\aattrName\a
'
function get_objectclass {
    typeset -l ANAME="$1"

	case "${ANAME}" in
		ou | organizationalunitname | 2.5.4.11)
			print 'organizationalUnit'
			;;
		dc | domaincomponent | 0.9.2342.19200300.100.1.25)
			print 'domain'
			;;
		o | organizationname | 2.5.4.10)
			print 'organization'
			;;
		c | countryname | 2.5.4.6)
			print 'country'
			;;
	esac
}

function checkSuffixRDN {
	typeset RDN="${STR[LDAP_SUFFIX]%%,*}"
	TMP[SUFFIX_VAL]="${RDN#*=}"
	TMP[SUFFIX_ATT]="${.sh.match%=}"
	
	# find out an objectclass for suffix entry if it is not defined yet
	TMP[SUFFIX_OBJ]=${ get_objectclass "${TMP[SUFFIX_ATT]}" ; }
	if [[ -z ${TMP[SUFFIX_OBJ]} ]]; then
		Log.fatal 'Unable to find an objectclass for' "'${TMP[SUFFIX_ATT]}'" \
			'attribute'
		return 1
	fi
	return 0
}

Man.addFunc prep_create_sfx_entry '' '[+NAME?prep_create_sfx_entry - prepare for the suffix entry creation.]
[+DESCRIPTION?Prepare suffix entry creation based on \bSTR[LDAP_BASEDN|LDAP_SUFFIX]]\b and \bTMP[SUFFIX_OBJ]]\b. If the latter are unset (no config file read), set them to defaults depending on the baseDN. Finally check, whether the suffix entry already exists and if so check for consistency with the current config. This function sets:]{
	[+TMPF[NEED_CREATE_BACKEND]]?0 .. backend already exists. 1 .. create a backend.]
	[+TMP[SUFFIX_ATT]]?The attribute name of the leading RDN of the suffix (ID).]
	[+TMP[SUFFIX_VAL]]?The attribute value of the leading RDN of the suffix (ID).]
}
[+RETURN VALUES]{
	[+0?on success.]
	[+1?an attribute/consistence related error occured.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bnormalizeDN()\b, \bdisplay_msg()\b, \badd_suffix()\b, \bldapsearch\b(1)]
' 
function prep_create_sfx_entry {
	# check whether suffix corresponds to base dn (i.e. baseDN ends with suffix)
	typeset X=,${ normalizeDN "${STR[LDAP_BASEDN]}" l ; }
	typeset SFX=,${STR[LDAP_SUFFIX]}
	if [[ ${X: -${#SFX}} != ${SFX} ]]; then
		Log.warn "Sorry, suffix '${STR[LDAP_SUFFIX]}' is not suitable for" \
			"Base DN '${STR[LDAP_BASEDN]}'"
		return 1
	fi

	checkSuffixRDN || return 66
	Log.verbose "Suffix entry object: '${TMP[SUFFIX_OBJ]}'"

	TMPF[NEED_CREATE_BACKEND]=0

	if (( TMPF[IS_OPENDJ] )); then
		# 1st just check, whether any backend matches the suffix
		typeset FILTER='(&(objectClass=ds-cfg-local-db-backend)'
		FILTER+="(|(ds-cfg-base-dn=${STR[LDAP_SUFFIX]})"
		FILTER+="(ds-cfg-base-dn=*,${STR[LDAP_SUFFIX]})))"
		X=${ ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b 'cn=Backends,cn=config' -s one "${FILTER}" 2>/dev/null ; }
		if [[ -n ${X} ]]; then
			Log.verbose 'Suffix backend already exists'
			get_backend || return 66 
			return 0
		fi
	else
		# DSEE: check the suffix mapping tree ...
		# If mapping exists, suffix should work, otherwise DSEE inconsistent
		# NOTE: -b 'cn=mapping tree,cn=config' -s one 'cn=\"$1\"' won't work
		#       in case of 'cn' value in LDAP is not quoted by '"',
		#       -b 'cn=\"$1\",cn=mapping tree,cn=config' works in all cases
		if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b "cn=\"${STR[LDAP_SUFFIX]}\",cn=mapping tree,cn=config" \
			-s base 'objectclass=*' dn 2>/dev/null
		then
			Log.verbose 'Suffix mapping already exists'
			get_backend || return 66 
			return 0
		fi

		# no suffix mapping, just in case check ldbm backends consistency -
		# there are must be NO any databases pointing to STR[LDAP_SUFFIX] 
		X=${ ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b 'cn=ldbm database,cn=plugins,cn=config' \
			-s one "nsslapd-suffix=${STR[LDAP_SUFFIX]}" dn 2>/dev/null ; }
		if [[ -n ${X} ]]; then
			Log.warn 'Sorry, there is no suffix mapping for' \
				"'${STR[LDAP_SUFFIX]}', while ldbm database exists, server" \
				'configuration needs to be fixed manually, look at cn=mapping' \
				'tree,cn=config and cn=ldbm database,cn=plugins,cn=config'
			return 1
		fi
	fi

	Log.verbose 'Backend needs to be created ...'
	TMPF[NEED_CREATE_BACKEND]=1
	return 0
}

Man.addFunc prep_create_sfx_backend '' '[+NAME?prep_create_sfx_backend - prepare for the suffix backend creation.]
[+DESCRIPTION?Prepare for the suffix backend creation by checking available DBs starting with \bSTR[DS_DB]]\b. Sets \bTMP[DS_DB_AVAIL]]\b if not yet set or != \bSTR[DS_DB]]\b.]
[+RETURN VALUES]{
	[+0?backend db name is ok.]
	[+1?\bSTR[DS_DB]]\b exists, so \bTMP[DS_DB_AVAIL]]\b contains available name.]
	[+2?unable to find any available name.]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function prep_create_sfx_backend {
	# check if requested name available
	[[ ${STR[DS_DB]} == ${TMP[DS_DBS_AVAIL]} ]] && return 0

	# get the list of database names start with a requested name
	typeset -a DBS=( )
	if (( TMPF[IS_OPENDJ] )); then
		typeset FILTER='(&(objectclass=ds-cfg-local-db-backend)'
		FILTER+="(ds-cfg-backend-id=${STR[DS_DB]}*))"
		${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b 'cn=Backends,cn=config' -s one "${FILTER}" ds-cfg-backend-id \
			2>/dev/null | \
		while read LINE ; do
			[[ -n ${LINE} && ${LINE: -10} != ',cn=config' ]] && \
				DBS+=( "${LINE#ds-cfg-backend-id=}" )
		done
	else
		${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b 'cn=ldbm database,cn=plugins,cn=config' \
			-s one "cn=${STR[DS_DB]}*" cn 2>/dev/null | \
		while read LINE ; do
			[[ -n ${LINE} && ${LINE: -10} != ',cn=config' ]] && \
				DBS+=( "${LINE#cn=}" )
		done
	fi
	if (( ${#DBS[@]} == 0 )); then
		# no backend name starts with STR[DS_DB]
		TMP[DS_DBS_AVAIL]="${STR[DS_DB]}"
		return 0
	fi

	# find a non-existing db name based on a requested name
	integer I FOUND
	typeset -l NAME DB
	for (( I=0 ; I < 10; I++ )); do
		(( I )) && NAME="${STR[DS_DB]}${I}" || NAME="${STR[DS_DB]}"
		FOUND=0
		for DB in "${DBS[@]}" ; do
			[[ ${DB} == ${NAME} ]] && FOUND=1 && break
		done
		if (( ! FOUND )); then
			if (( I == 0 )); then
				TMP[DS_DBS_AVAIL]="${STR[DS_DB]}"
				return 0	# requested name is available
			fi
			TMP[DS_DBS_AVAIL]="${STR[DS_DB]}${I}"
			break
		fi
	done

    if [[ -n ${TMP[DS_DBS_AVAIL]} ]]; then
		Log.warn "Database backend '${STR[DS_DB]}' already exists," \
			"however '${TMP[DS_DBS_AVAIL]}' is available"
		return 1
	fi

	Log.warn 'Unable to find any available database backend close to' \
		"'${STR[DS_DB]}'"
    return 2
}

Man.addFunc get_suffix '' '[+NAME?get_suffix - Ask user for suffix and related backend.]
[+DESCRIPTION?Ask the user for the suffix (default: \bSTR[LDAP_BASEDN]]\b) to create and the db name if it does not yet exist. \bTMP[DS_DBS_AVAIL]]\b gets set to the given db name (if any), \bSTR[DS_DB]]\b to the prepared db name and \bSTR[LDAP_SUFFIX]]\b to the given suffix.]
[+RETURN VALUES]{
	[+0?on success (user gave a correct suffix).]
	[+1?unable to create suffix given by user.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b, \bnormalizeDN()\b, \bprep_create_sfx_entry()\b, \bprep_create_sfx_backend()\b.]
'
function get_suffix {
	while : ; do
		get_ans 'Enter suffix to be created (b=back/h=help):' \
			"${STR[LDAP_BASEDN]}"
		case "${ANS}" in
			[Hh?] | Help | help)
				display_msg 'create_suffix_help'
				continue
				;;
			[Bb] | '<' | Back | back)
				return 1
				;;
		esac
		STR[LDAP_SUFFIX]=${ normalizeDN "${ANS}" l ; }
		prep_create_sfx_entry
		integer REDO=$?
		(( REDO >= 66 )) && return 66
		(( REDO )) && continue

		if (( TMPF[NEED_CREATE_BACKEND] )); then
			TMP[DS_DBS_AVAIL]=''		# reset the available db name
			REDO=0
			while : ; do
				X=${TMP[DS_DBS_AVAIL]}
				# Basically for OpenDJ we could use 'userRoot' as default aka
				# TMP[SUFFIX_VAL], however, users may use it for trying out
				# examples from the docs
				get_ans 'Enter local database backend name (b=back/h=help):' \
					"${X:-${TMP[SUFFIX_VAL]}}"
				case "${ANS}" in
					[Hh?])
						display_msg 'enter_ldbm_db_help'
						continue
						;;
					[Bb] | '<')
						REDO=1
						break
						;;
				esac
				STR[DS_DB]="${ANS}"
				prep_create_sfx_backend && break
			done

			(( REDO )) && continue

			Log.verbose 'Databse backend name for suffix ${STR[LDAP_SUFFIX]}:' \
				"${DS_DB}"
		fi
		# eventually everything is prepared
		break
	done
	return 0
}

Man.addFunc domain_2_dc '' '[+NAME?domain_2_dc - Convert a domain name into dc string.]
[+DESCRIPTION?Convert a domain name \adomain\a into a dc=...,dc=... string and print it to stdout.]
\n\n\adomain\a
'
function domain_2_dc {
	[[ -z $1 ]] && return
	typeset DC='' SD
	for SD in ${1//./ } ; do	# removes leading && trailing && double dots
		DC+=",dc=${SD}"
	done
	print -- "${DC:1}"
}

Man.addFunc get_basedn  '' '[+NAME?get_basedn - Ask user for Base DN.]
[+DESCRIPTION?Ask the user for the BaseDN to use, check whether to create a suffix and store the value into \bSTR[LDAP_BASEDN]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bget_ans_req()\b, \bdisplay_msg()\b, \bcheck_baseDN()\b, \bcheck_basedn_suffix()\b, \bget_suffix()\b.]
'
function get_basedn {
	typeset BASEDN=${ domain_2_dc ${STR[LDAP_DOMAIN]} ; }
	integer RES

	while : ; do
		# Get Base DN.
		while : ; do
			get_ans_req 'Enter LDAP Base DN (h=help):' "${BASEDN}"
			case "${ANS}" in
				[Hh?] | help | Help) display_msg 'basedn_help' ; continue ;;
			esac
			check_baseDN "${ANS}" && break
			Log.warn "Invalid base DN: '${ANS}'"
		done

		# Set base DN and check its suffix
		STR[LDAP_BASEDN]="${ANS}"
		check_basedn_suffix || return 66

		# suffix may need to be created, in that case get suffix from user
		if (( TMPF[NEED_CREATE_SUFFIX] )); then
			get_suffix
			RES=$?
			(( RES >= 66 )) && return 67 
			(( RES )) && continue
		fi

		# suffix is ok, break out of the base dn inquire loop
		break
	done
	return 0
}

Man.addFunc chk_vlv_indexes '' '[+NAME?chk_vlv_indexes - check if server supports VLV.]
[+DESCRIPTION?Checks, whether the DS supports Virtual List Views (VLV).]
[+RETURN VALUES]{
	[+0?if VLVs are supported.]
	[+>= 66?if VLVs are not supported.]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function chk_vlv_indexes {
	typeset ATTR=''
	${LDAPSEARCH} ${CON_ARGS} -b '' -s base 'objectclass=*' \
		supportedControl 2>/dev/null | \
	while read LINE ; do
		if [[ ${LINE#*=} == '2.16.840.1.113730.3.4.9' ]]; then
			ATTR=${.sh.match%=}
			break
		fi
	done
	if [[ -z ${ATTR} ]]; then
		if (( TMPF[IS_OPENDJ] )); then
			# If the BDB backend is not yet loaded, related controls are not
			# shown. Because we know, that it supports VLVs we just check, that
			# this is true (no BDB configured/enabled)
			ATTR=${ ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
				-b 'cn=Backends,cn=config' -s sub \
				'(&(objectclass=ds-cfg-local-db-backend)(ds-cfg-enabled=true))';
			}
			[[ -z ${ATTR} ]] && return 0
		fi
		Log.fatal 'VLV is not supported on LDAP server'
		return 66
	fi
	return 0
}

Man.addFunc validate_suffix '' '[+NAME?validate_suffix - validate suffix obtained via config file.]
[+DESCRIPTION?This function validates STR[LDAP_SUFFIX]] AFTER THE LOAD OF A CONFIG FILE (should not be used for interactive use). Also does a consistency check wrt. \bSTR[LDAP_BASEDN]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bnormalizeDN()\b, \bldapsearch\b(1), \bprep_create_sfx_entry()\b, \bprep_create_sfx_backend()\b.]
'
function validate_suffix {
	# Check STR[LDAP_SUFFIX] is not null
	if [[ -z ${STR[LDAP_SUFFIX]} ]]; then
		Log.fatal 'Invalid suffix (null suffix)'
		return 66
	fi

	# STR[LDAP_SUFFIX] and STR[LDAP_BASEDN] are consistent ?
	typeset X=,${ normalizeDN "${STR[LDAP_BASEDN]}" l ; }
	typeset SFX=,${ normalizeDN "${STR[LDAP_SUFFIX]}" l ; }
	if [[ ${X: -${#SFX}} != ${SFX} ]]; then
		Log.fatal "Invalid suffix '${SFX}' for Base DN '${X}'"
		return 67
	fi

	# STR[LDAP_SUFFIX] does exist ?
	if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${STR[LDAP_SUFFIX]}" \
		-s base 'objectclass=*' >/dev/null 2>&1
	then
		checkSuffixRDN && return 0 || return 68
	fi

	# Well, suffix does not exist, try to prepare create it ...
	TMPF[NEED_CREATE_SUFFIX]=1
	prep_create_sfx_entry || return 69
	if (( TMPF[NEED_CREATE_BACKEND] )); then
		if [[ -z ${STR[DS_DB]} ]]; then
			Log.fatal 'Database backend name is not set. Either set SIN[DS_DB]'\
				'in the input file to a valid, i.e. non-existing DB name, or' \
				'create the backend with the default DS tools'
			return 70
		fi
		# too risky, even if a available backend name could be found
		prep_create_sfx_backend || return 71
	fi

    Log.verbose "Suffix: '${STR[LDAP_SUFFIX]}'   Database: '${STR[DS_DB]}'"
	return 0
}

Man.addFunc validate_info '' '[+NAME?validate_info - validate basic info obtained via config file.]
[+DESCRIPTION?This function updates \bCON_ARGS\b as well as \bAUTH_ARGS\b, checks, whether they work so that some problems are caught right away AFTER THE LOAD OF A CONFIG FILE (should not be used for interactive use). It also validates the obtained suffix and whether the DS supports VLVs.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bchk_vlv_indexes()\b, \bvalidate_suffix()\b.]
'
function validate_info {
	# Set CON_ARGS and AUTH_ARGS for the config file.
	CON_ARGS="-h ${STR[DS_HOST]} -p ${INT[DS_PORT]}"
	AUTH_ARGS=( '-D' "${STR[LDAP_ROOTDN]}" '-j' "${TMP[LDAP_ROOTPWF]}" )
	chk_ids_version || return 1	# Check DSEE version for compatibility

	# Check the Root DN and Root DN passwd.o Same as for get_dirmgr_pw()
	RES=${ ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b '' -s base \
		'objectclass=*' supportedLDAPVersion 2>&1 ; }
	if (( $? )); then
		if [[ ${RES} =~ credential ]]; then
			Log.fatal 'Root DN passwd is invalid'
		else
			Log.fatal "Invalid Root DN '${STR[LDAP_ROOTDN]}'"
		fi
		return 66
	fi
    Log.verbose 'RootDN: ok   RootDN passwd: ok'

	# Check if the server supports the VLV
	chk_vlv_indexes || return 67
	Log.verbose 'VLV indexes ... ok'

	# Check LDAP suffix
	validate_suffix || return 66
	Log.verbose 'LDAP suffix ... ok'
	return 0
}

Man.addFunc gssapi_setup '' '[+NAME?gssapi_setup - set up GSSAPI if necessary.]
[+DESCRIPTION?Check, whether the DS supports the SASL mechanism \bGSSAPI\b. If so, ask the user whether it should be enabled and depending on the answer ask for related Kerberos realm info. \bINT[GSSAPI_ENABLE]]\b and \bTMPF[GSSAPI_AUTH_MAY_BE_USED]]\b and optionally \bSTR[LDAP_KRB_REALM]]\b are set accordingly.]
[+SEE ALSO?\bldapsearch\b(1), \bget_ans_req()\b.]
'
function gssapi_setup {
	INT[GSSAPI_ENABLE]=0
	TMPF[GSSAPI_AUTH_MAY_BE_USED]=0

	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b '' -s base 'objectclass=*' \
		supportedSASLMechanisms 2>/dev/null | \
	while read LINE ; do
		if [[ ${LINE:0:24} == 'supportedSASLMechanisms=' && \
			${LINE:24} == 'GSSAPI' ]]
		then
			TMPF[GSSAPI_AUTH_MAY_BE_USED]=1
			break
		fi
	done
	if (( ! TMPF[GSSAPI_AUTH_MAY_BE_USED] )); then
		Log.info 'sasl/GSSAPI is not supported by this LDAP server'
		return
	fi

	get_confirm 'GSSAPI is supported. Do you want to set up GSSAPI:(y/n)' 'n'
	if (( $? )); then
		INT[GSSAPI_ENABLE]=1
		# get kerberos realm
		typeset -u REALM=${STR[LDAP_DOMAIN]}
		get_ans_req "Enter Kerberos Realm:" "${REALM}"
		REALM="${ANS}"		# make sure, it is upper case
		STR[LDAP_KRB_REALM]="${REALM}"
	else
		Log.info 'GSSAPI is not set up - ' \
			'sasl/GSSAPI bind may not work if it is not set up first'
	fi
}

Man.addFunc get_profile_name '' '[+NAME?get_profile_name - Ask user for client profile name.]
[+DESCRIPTION?Ask the user for the name of the client profile to create, check whether it already exists, and if so ask whether it should be overwritten. Sets \bSTR[LDAP_PROFILE_NAME]]\b, \bTMPF[DEL_OLD_PROFILE]]\b and if the user wants to just enable shadow update \bINT[LDAP_ENABLE_SHADOW_UPDATE]]\b and \bINT[EXISTING_PROFILE]]\b.]
[+SEE ALSO?\bget_ans()\b, \bldapsearch\b(1), \bget_confirm()\b, \bget_confirm_nodef()\b, \bdisplay_msg()\b.]
'
function get_profile_name {
	TMPF[DEL_OLD_PROFILE]=0		# Reset since getting new profile name

	typeset PNAME="${STR[LDAP_PROFILE_NAME]}"
	# Loop until valid profile name, or replace.
	while : ; do
		get_ans 'Enter the client profile name (h=help):' "${PNAME}"
		case "${ANS}" in
			[Hh] | help | Help | '?') display_msg 'profile_help' ; continue ;; 
		esac

		# Search to see if profile name already exists.
		if ! ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b "cn=${ANS},ou=profile,${STR[LDAP_BASEDN]}" -s base \
			'objectclass=*' >/dev/null 2>&1
		then
			break  # Unique profile name (does not yet exist)
		fi

		Log.info 'Profile "'"${ANS}"'" already exists, it is possible to' \
			'enable shadow update now.' "${PROG}" 'will exit after shadow' \
			'update is enabled. You can also continue to overwrite the' \
			'profile or create a new one and be given the chance to enable' \
			'shadow update later.'

	    get_confirm 'Just enable shadow update (y/n/h)?' 'n' \
			'enable_shadow_update_help'
	    if (( $? )); then
			# set up credentials for shadow update
			INT[LDAP_ENABLE_SHADOW_UPDATE]=1
			# display alternate messages
			INT[EXISTING_PROFILE]=1
			break
		fi

		get_confirm_nodef \
			"Are you sure you want to overwrite profile 'cn=${ANS}'?"
		if (( $? )); then
			TMPF[DEL_OLD_PROFILE]=1		# Replace old profile name
			break
		fi
	done

	STR[LDAP_PROFILE_NAME]="${ANS}"
}

Man.addFunc getACIs '' '[+NAME?getACIs - get ACIs for the current base DN.]
[+DESCRIPTION?Get all ACIs for \abaseDN\a and append them to the indexed array of strings \avname\a. If \abaseDN\a is not given, \bSTR[LDAP_BASEDN]]\b will be used instead. If \ascope\a is set to \bGlobal\b this method queries for "ds-cfg-global-aci" instead of "aci" unless \bTMPF[IS_OPENDJ]]\b is \b0\b.]
[+RETURN VALUES]{
	[+-1?invalid function usage.]
	[+0?on success.]
	[+1?an error occured when executing the ldapsearch operation.]
}
\n\n\avname\a [\abaseDN\a] [\ascope\a]
'
function getACIs {
	set -o pipefail		# wanna have the exit code of ldapsearch
	[[ -z $1 ]] && Log.warn "${.sh.fun}(): invalid function usage" && \
		return -1
	typeset -n ACILIST=$1
	typeset LINE
	typeset DN="$2" ACI='aci'
	[[ -z ${DN} ]] && DN="${STR[LDAP_BASEDN]}"
	[[ $3 == 'Global' ]] && (( TMPF[IS_OPENDJ] )) && ACI='ds-cfg-global-aci'

    ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${DN}" -s base \
		'objectclass=*' ${ACI} 2>/dev/null | \
	while read LINE ; do
		# NOTE: the || : is required to always get success (pipe doesn't break)
		[[ ${LINE:0:${#ACI}+1} == "${ACI}=" ]] && \
			ACILIST+=( "${LINE:${#ACI}+1}" ) || :
	done
	if (( $? )); then
		Log.fatal "Unable to get aci list for '${STR[LDAP_BASEDN]}'"
		return 1
	fi
	return 0
}

Man.addFunc findACI '' '[+NAME?findACI - find an ACI in the given list.]
[+DESCRIPTION?Find the first ACI which matches \aregex\a in the indexed array of ACIs \avname\a. If a match occurs, print out a message using the given \aaciName\a prefixed with \ascope\a. If \ascope\a is not given or empty, \bBaseDN\b will be used instead.]
[+RETURN VALUES]{
	[+0?no ACI matched.]
	[+>=1?the index+1 of the ACI matched.]
}
[+SEE ALSO?\bgetACIs()\b, \bfindACI()\b, \bfind_and_delete_ACI\b()]
\n\n\avname\a \aaciName\a \aregex\a [\ascope\a]
'
function findACI {
	typeset -n LIST=$1
	typeset NAME="$2" REGEX="$3" SCOPE="$4"
	integer MAX=${#LIST[@]} I
	[[ -z ${SCOPE} ]] && SCOPE='BaseDN'
	for (( I=0; I < MAX; I++ )); do
		if [[ ${LIST[${I}]} =~ ${REGEX} ]]; then
			showProgress "${SCOPE} ACI '${NAME}' exists."
			return $((I+1))
		fi
	done
	return 0
}

Man.addFunc allow_proxy_read_pw '' '[+NAME?allow_proxy_read_pw - add Proxy Agent read permission for password.]
[+DESCRIPTION?Add the ACI \bPROXY_ACI_NAME\b for \bSTR[LDAP_PROXYAGENT]]\b to \bSTR[LDAP_BASEDN]]\b if it not already exists.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage PROXY_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (ACI already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bldapmodify\b(1).]
'
function allow_proxy_read_pw {
	typeset ACI PATTERN TARGET

	typeset -a LIST=( )
	getACIs LIST || return 66

	PATTERN='acl[ ]+"?('"${PROXY_ACI_NAME}|${PROXY_ACI_NAME// /_}"')"?'
	findACI LIST "${PROXY_ACI_NAME}" "${PATTERN}" || return 0

	PATTERN='userPassword'
	if (( TMPF[IS_OPENDJ] )); then
		PATTERN+=' || authPassword'
		# At least in OpenDJ specifying the same target as where the ACI gets 
		# attached is redundant wrt. the result and causes minimal overhead
		TARGET=''
	else
		TARGET='(target = "ldap:///'"${STR[LDAP_BASEDN]}"'")'
	fi
	
	nextFile modify $0
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: '"${TARGET}"'(targetattr = "'"${PATTERN}"'")
 (
	version 3.0;  acl "'"${PROXY_ACI_NAME}"'";
	allow (compare,read,search) userdn = "ldap:///'"${STR[LDAP_PROXYAGENT]}"'";
 )
'		> ${TMP[FILE]}
    
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal "Adding '${PROXY_ACI_NAME}' ACI failed"
		return 66
	fi

	showProgress "ACI '${PROXY_ACI_NAME}' added."
	return 0
}

Man.addFunc delete_proxy_read_pw '' '[+NAME?delete_proxy_read_pw - delete Proxy Agent read permission for password.]
[+DESCRIPTION?Remove the ACI \bPROXY_ACI_NAME\b from \bSTR[LDAP_BASEDN]]\b if such an ACI exists.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage PROXY_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (no delete required or ACI deleted).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bget_menu_choice()\b, \bldapmodify\b(1).]
'
function delete_proxy_read_pw {
	typeset PROXY_ACI='' ACI PATTERN X

	typeset -a LIST=( )
	getACIs LIST || return 66

	# Search for ACI_NAME - no findACI() because we need ALL matching ACIs
	typeset -a ACILIST=( )
	PATTERN='acl[ ]+"?('"${PROXY_ACI_NAME}|${PROXY_ACI_NAME// /_}"')"?'
	for ACI in "${LIST[@]}" ; do
		[[ ${ACI} =~ ${PATTERN} ]] && ACILIST+=( "${ACI#*=}" )
	done

	# We need to remove proxy agent's read access to user passwords,
	# but We do not know the value of the ${LDAP_PROXYAGENT} here, so
	# 1. if only one match found, delete it
	# 2. if more than one matches found, ask the user which one to delete
	if (( ${#ACILIST[@]} == 0 )); then
		Log.warn "ACI '${PROXY_ACI_NAME}' does not exist for" \
			"'${STR[LDAP_BASEDN]}'"
		return 0
    fi
	if (( ${#ACILIST[@]} == 1 ));then
		PROXY_ACI="${ACI[0]}"
    else
		X='
Proxy agent is not allowed to read user passwords when shadow
update is enabled. There are more than one proxy agents found.
Please select the proxy agent currently being used, so that
'"${PROG}"' can remove its read access to user passwords.

The proxy agents are:
'
		# print the list of ACIs for selection
		integer I MAX
		MAX=${#ACILIST[@]}
		for (( I=0; I < MAX; I++ )) ; do
			ACI="${ACILIST[${I}]}"
			if (( ! Log.VERBOSE )); then
	    		# older versions used
				# sed -e 's|.*ldap:///.*ldap:///||' -e 's|";)||'
				ACI=${ACI##*ldap:///}
				ACI=${ACI%\"*}
			fi
			X+=${ printf '%2d: %s\n' $((I+1)) "${ACI}" ; }
		done
		Log.warn "${X}"

	    # ask the user to pick one
		get_menu_choice "Select the proxy agent (1-${MAX}): " 1 ${MAX}
		I=$(( $? - 1 ))
		PROXY_ACI="${ACILIST[$I]}"
	fi

	nextFile modify $0
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
delete: aci
aci: '"${PROXY_ACI}"'
'		>${TMP[FILE]}

	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal "Remove of '${PROXY_ACI_NAME}' ACI failed"
		cat ${TMP[FILE]}
		return 66
	fi

    Log.info "Removed '${PROXY_ACI_NAME}' ACI"
	return 0
}

Man.addFunc allow_host_read_write_shadow '' '[+NAME?allow_host_read_write_shadow - add host principal read/write permission for shadow data.]
[+DESCRIPTION?Add the ACI \bHOST_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b  unless it already exists.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage HOST_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (ACI already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bldapmodify\b(1).]
'
function allow_host_read_write_shadow {
	typeset ACI PATTERN TARGET=''

	typeset -a LIST=( )
	getACIs LIST || return 66

	PATTERN='acl[ ]+"?('"${HOST_ACI_NAME}|${HOST_ACI_NAME// /_}"')"?'
	findACI LIST "${HOST_ACI_NAME}" "${PATTERN}" || return 0

	(( ! TMPF[IS_OPENDJ] )) && \
		TARGET='(target = "ldap:///'"${STR[LDAP_BASEDN]}"'")'	# OD: redundant

	nextFile modify $0
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: '"${TARGET}"'(targetattr = "shadowLastChange || shadowMin || shadowMax || shadowWarning || shadowInactive || shadowExpire || shadowFlag || userPassword || loginShell || homeDirectory || gecos")
 (
	version 3.0;  acl '"${HOST_ACI_NAME}"';
	allow (write,compare,read,search) authmethod = "sasl GSSAPI" and userdn = "ldap:///cn=*+ipHostNumber=*,ou=Hosts,'"${STR[LDAP_BASEDN]}"';
 )
'		> ${TMP[FILE]}
    
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal 'Remove of '${ACI_NAME}' ACI failed'
		return 66
	fi

	showProgress "ACI '${ACI_NAME}' added."
	return 0
}

Man.addFunc find_and_delete_ACI '' '[+NAME?find_and_delete_ACI - find and delete an ACI in the given list.]
[+DESCRIPTION?Find the first ACI which matches \aregex\a in the indexed array of ACIs \avname\a and delete it. If no ACI matches, the function does nothing and returns. Otherwise it tries to delete it from \bSTR[LDAP_BASEDN]]\b and prints out a message using \aaciName\a.]
[+RETURN VALUES]{
	[+0?on success (no ACI matched or ACI removed successfully).]
	[+66?an error occured when removing the matched ACI.]
}
[+SEE ALSO?\bgetACIs()\b, \bldapmodify\b(1)]
\n\n\avname\a \aaciName\a \aregex\a
'
function find_and_delete_ACI {
	typeset -n LIST=$1
	typeset ACI_NAME="$2" REGEX="$3" DEL='' ACI

	for ACI in "${LIST[@]}" ; do
		[[ ${ACI} =~ ${REGEX} ]] && DEL="${ACI}" && break
	done
	[[ -z ${DEL} ]] && return 0

	nextFile modify "${0}-${ACI_NAME}"
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
delete: aci
aci: '"${DEL}"'
'		> ${TMP[FILE]}

	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal "Remove of '${ACI_NAME}' ACI failed"
		return 66
	fi

	showProgress "ACI '${ACI_NAME}' deleted."
	return 0
}

Man.addFunc deny_non_host_shadow_access '' '[+NAME?deny_non_host_shadow_access - add a deny non-host access to shadow data.]
[+DESCRIPTION?Add the ACI \bNON_HOST_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b  unless it already exists. If it does not exists the ACI \bNON_ADMIN_ACI_NAME\b gets deleted first if available.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage NON_HOST_ACI_NAME NON_ADMIN_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (ACI already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfind_and_delete_ACI()\b, \bldapmodify\b(1).]
'
function deny_non_host_shadow_access {
	typeset ACI PATTERN TARGET=''

	typeset -a LIST=( )
	getACIs LIST || return 66

    # If an ACI with ${NON_HOST_ACI_NAME} already exists, we are done
	PATTERN='acl[ ]+"?('"${NON_HOST_ACI_NAME}|${NON_HOST_ACI_NAME// /_}"')"?'
	findACI LIST "${NON_HOST_ACI_NAME}" "${PATTERN}" || return 0

	# The deny_non_admin_shadow_access and deny_non_host_shadow_access ACIs
	# should be mutually exclusive, so if the former exists, delete it
	PATTERN='acl[ ]+"?('"${NON_ADMIN_ACI_NAME}|${NON_ADMIN_ACI_NAME// /_}"')"?'
	find_and_delete_ACI LIST "${NON_ADMIN_ACI_NAME}" "${PATTERN}" || return 67

	(( ! TMPF[IS_OPENDJ] )) && \
		TARGET='(target = "ldap:///'"${STR[LDAP_BASEDN]}"'")'	# OD: redundant

	nextFile modify $0
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: '"${TARGET}"'(targetattr = "shadowLastChange || shadowMin || shadowMax ||shadowWarning || shadowInactive || shadowExpire || shadowFlag || userPassword")
 (
	version 3.0;  acl "'"${NON_HOST_ACI_NAME}"'";
	deny (write,read,search,compare) userdn != "ldap:///cn=*+ipHostNumber=*,ou=Hosts,'"${STR[LDAP_BASEDN]}"'";
 )
'		> ${TMP[FILE]}
    
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal "Adding ACI '${NON_HOST_ACI_NAME}' failed"
		return 67
	fi

	showProgress "ACI '${NON_HOST_ACI_NAME}' added."
	return 0
}

Man.addFunc get_adminDN '' '[+NAME?get_adminDN - ask user for Admin DN.]
[+DESCRIPTION?Ask the user for the Admin DN and store it into \bSTR[LDAP_BASEDN]]\b.]
[+SEE ALSO?\bget_ans()\b.]
'
function get_adminDN {
    get_ans 'Enter DN for the administrator:' \
		"cn=admin,ou=profile,${STR[LDAP_BASEDN]}"
	STR[LDAP_ADMINDN]="${ANS}"
}

Man.addFunc get_admin_pw '' '[+NAME?get_admin_pw - ask user for Admin password]
[+DESCRIPTION?Ask the user for the Admin password and store it into \bSTR[LDAP_ADMIN_CRED]]\b.]
[+SEE ALSO?\bget_passwd()\b.]
'
function get_admin_pw {
	get_passwd 'Enter passwd for the administrator:'
	STR[LDAP_ADMIN_CRED]="${ANS}"
}

Man.addFunc add_admin '' '[+NAME?add_admin - Add administrator identity.]
[+DESCRIPTION?Add the \bSTR[LDAP_ADMINDN]]\b entry with the password \bSTR[LDAP_ADMIN_CRED]]\b unless it already exists.]
[+RETURN VALUES]{
	[+0?on success (entry already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_admin {
	if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${STR[LDAP_ADMINDN]}" \
		-s base 'objectclass=*' >/dev/null 2>&1
	then
		showProgress "Administrator identity exists."
		return 0
	fi

	typeset CN="${STR[LDAP_ADMINDN]%%,*}"
	CN="${CN#*=}"

	nextFile add $0
	print '
dn: '"${STR[LDAP_ADMINDN]}"'
cn: '"${CN}"'
sn: '"${CN}"'
objectclass: top
objectclass: person
userpassword: '"${STR[LDAP_ADMIN_CRED]}"'
'		> ${TMP[FILE]}

	if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal 'Adding administrator identity failed'
		return 66
	fi

	showProgress 'Administrator identity added.'
	return 0
}

Man.addFunc allow_admin_read_write_shadow '' '[+NAME?allow_admin_read_write_shadow - add Admin read/write permission for shadow, rbac and mount data.]
[+DESCRIPTION?Add the ACI \bADMIN_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b  unless it already exists. Also tries to remove old similar ACIs if they exist.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ADMIN_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (aci already exists or addition was successfull).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfind_and_delete_ACI()\b, \bldapmodify\b(1).]
'
function allow_admin_read_write_shadow {
	typeset PERMS='write,compare,read,search,add,delete' \
		ACI RBAC PATTERN TARGET=''

	typeset -a LIST=( )
	getACIs LIST || return 66

    # If the ACI already exists, we are done
	PATTERN='acl[ ]+"?('"${ADMIN_ACI_NAME}|${ADMIN_ACI_NAME// /_}"')"?'
	PATTERN+='.*\('"${PERMS}"'\).*'"${STR[LDAP_ADMINDN]}"
	findACI LIST "${ADMIN_ACI_NAME}" "${PATTERN}" || return 0

    # If an ACI with ${ADMIN_ACI_NAME} and "(write|write,compare,read,search)"
	# and ${LDAP_ADMINDN} exists, delete it
	PATTERN='acl[ ]+"?('"${ADMIN_ACI_NAME}|${ADMIN_ACI_NAME// /_}"')"?'
	PATTERN+='.*\(write\).*'"${STR[LDAP_ADMINDN]}"
    find_and_delete_ACI LIST "${ADMIN_ACI_NAME}" "${PATTERN}" || return 67

	PATTERN='acl[ ]+"?('"${ADMIN_ACI_NAME}|${ADMIN_ACI_NAME// /_}"')"?'
	PATTERN+='.*\(write,compare,read,search\).*'"${STR[LDAP_ADMINDN]}"
    find_and_delete_ACI LIST "${ADMIN_ACI_NAME}" "${PATTERN}" || return 68

    RBAC='objectClass || uid || uidNumber || gidNumber || cn'
    RBAC+=' || SolarisAttrKeyValue || SolarisAttrShortDesc'
	RBAC+=' || SolarisAttrLongDesc || SolarisKernelSecurityPolicy'
	RBAC+=' || SolarisProfileType || SolarisProfileId || SolarisUserQualifier'
    RBAC+=' || SolarisReserved1 || SolarisReserved2'
    RBAC+=' || SolarisAttrReserved1 || SolarisAttrReserved2'
    RBAC+=' || SolarisProjectID || SolarisProjectName'
    RBAC+=' || SolarisProjectAttr || memberUid || memberGid || description'
    RBAC+=' || automountKey || automountMapName || automountInformation'
    RBAC+=' || ipTnetTemplateName || ipTnetNumber'

	(( ! TMPF[IS_OPENDJ] )) && \
		TARGET='(target = "ldap:///'"${STR[LDAP_BASEDN]}"'")'	# OD: redundant

	nextFile modify $0
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: '"${TARGET}"'(targetattr = "shadowLastChange || shadowMin || shadowMax || shadowWarning || shadowInactive || shadowExpire || shadowFlag || userPassword || loginShell || homeDirectory || gecos || '"${RBAC}"'")
 (
	version 3.0;  acl "'${ADMIN_ACI_NAME}'";
	allow ('"${PERMS}"') userdn = "ldap:///'"${STR[LDAP_ADMINDN]}"'";
 )
'		> ${TMP[FILE]}
    
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal "Adding '${ADMIN_ACI_NAME}' ACI failed"
		return 69
	fi

	showProgress "ACI '${ADMIN_ACI_NAME}' added."
	return 0
}

Man.addFunc deny_non_admin_shadow_access '' '[+NAME?deny_non_admin_shadow_access - add a deny Admin access to shadow data.]
[+DESCRIPTION?Add the ACI \bNON_ADMIN_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b  unless it already exists. If it does not exists the ACI \bNON_HOST_ACI_NAME\b gets deleted first if available.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage NON_ADMIN_ACI_NAME NON_HOST_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (ACI already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfind_and_delete_ACI()\b, \bldapmodify\b(1).]
'
function deny_non_admin_shadow_access {
	typeset TARGET=''
	typeset -a LIST=( )
	getACIs LIST || return 66

    # If the ACI already exists, we are done
	PATTERN='acl[ ]+"?('"${NON_ADMIN_ACI_NAME}|${NON_ADMIN_ACI_NAME// /_}"')"?'
	findACI LIST "${NON_ADMIN_ACI_NAME}" "${PATTERN}" || return 0

	# The deny_non_admin_shadow_access and deny_non_host_shadow_access ACIs
	# should be mutually exclusive, so if the latter exists, delete it
	PATTERN='acl[ ]+"?('"${NON_HOST_ACI_NAME}|${NON_HOST_ACI_NAME// /_}"')"?'
	find_and_delete_ACI LIST "${NON_HOST_ACI_NAME}" "${PATTERN}" || return 67

	(( ! TMPF[IS_OPENDJ] )) && \
		TARGET='(target = "ldap:///'"${STR[LDAP_BASEDN]}"'")'	# OD: redundant

	nextFile modify $0
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: '"${TARGET}"'(targetattr = "shadowLastChange || shadowMin ||  shadowMax || shadowWarning || shadowInactive || shadowExpire || shadowFlag || userPassword")
 (
	version 3.0;  acl "'"${NON_ADMIN_ACI_NAME}"'";
	deny (write,read,search,compare,add,delete) userdn != "ldap:///'"${STR[LDAP_ADMINDN]}"'";
 )
'		> ${TMP[FILE]}
    
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal "Adding '${NON_ADMIN_ACI_NAME}' ACI failed"
		${CAT} ${TMP[FILE]}
		return 68
	fi

	showProgress "ACI '${NON_ADMIN_ACI_NAME}' added."
	return 0
}

Man.addFunc setup_shadow_update '' '[+NAME?setup_shadow_update - set up shadow update.]
[+DESCRIPTION?Check whether the profile \bSTR[LDAP_PROFILE_NAME]]\b for \bSTR[LDAP_BASEDN]]\b exists. If not simply notify the user and return. Otherwise check whether the profile uses authenticationMethod "GSSAPI" and credentialLevel "self". If so ask the user whether to use host or "Admin" user principal for shadow updates and collect the related info. Sets \bINT[NEED_HOSTACL]]\b if the host principal should be used for shadow update (requires that \bTMPF[GSSAPI_AUTH_MAY_BE_USED]]\b is already set).]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66? a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bget_confirm()\b, \bdelete_proxy_read_pw()\b, \ballow_host_read_write_shadow()\b, \bdeny_non_host_shadow_access()\b, \bget_adminDN()\b, \bget_admin_pw()\b, \badd_admin()\b, \ballow_admin_read_write_shadow()\b, \bdeny_non_admin_shadow_access()\b.]
'
function setup_shadow_update {
	# get content of the profile
	integer CN=0 GSSAPI=0 SELF=0
	typeset -l LINE

	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-b "cn=${STR[LDAP_PROFILE_NAME]},ou=profile,${STR[LDAP_BASEDN]}" \
		-s base 'objectclass=*' 2>/dev/null | \
	while read LINE ; do
		[[ ${LINE:0:3} == 'cn=' ]] && CN=1
		[[ ${LINE:0:21} == 'authenticationmethod=' && ${LINE:21} == 'GSSAPI' ]]\
			&& GSSAPI=1
		[[ ${LINE:0:16} == 'credentiallevel=' && ${LINE:16} == 'self' ]] \
			&& SELF=1
	done
	if (( ! CN )); then
		Log.verbose "Profile '${STR[LDAP_PROFILE_NAME]}' does not exist"
		return 0
	fi

	# If authenticationMethod has 'GSSAPI' and credentialLevel
	# has 'self', ask to use the host principal for shadow update
	if (( TMPF[GSSAPI_AUTH_MAY_BE_USED] && GSSAPI && SELF )); then
		INT[NEED_HOSTACL]=1
	fi
	Log.verbose "NEED_HOSTACL = ${INT[NEED_HOSTACL]}"

	if (( INT[NEED_HOSTACL] )); then
		get_confirm 'Use host principal for shadow data update (y/n/h)?' 'y' \
			'use_host_principal_help'
		if (( $? )); then
			delete_proxy_read_pw || return 66
			allow_host_read_write_shadow || return 67
			deny_non_host_shadow_access || return 68
			Log.info 'Shadow update has been enabled'
		else
			Log.warn 'Shadow update may not work'
		fi
		return 0
	fi

	get_confirm 'Add the administrator identity (y/n/h)?' 'y' \
		'add_admin_cred_help'
	if (( $? )); then
		get_adminDN
		get_admin_pw
		add_admin || return 69
		delete_proxy_read_pw || return 66
		allow_admin_read_write_shadow || return 70
		deny_non_admin_shadow_access || return 71
		Log.info 'Shadow update has been enabled'
	else
		Log.warn 'No administrator identity specified, shadow update may not' \
			'work'
	fi
	return 0
}

Man.addFunc get_srv_list '' '[+NAME?get_srv_list - Ask user for default server list.]
[+DESCRIPTION?Ask the user for the default server list and store it into \bSTR[LDAP_SERVER_LIST]]\b.]
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_srv_list {
	# If LDAP_SERVER_LIST is NULL, then set, otherwise leave alone
	if [[ -z ${STR[LDAP_SERVER_LIST]} ]]; then
		ANS=${ ${GETENT} hosts ${STR[DS_HOST]} ; }
		STR[LDAP_SERVER_LIST]=${ANS%%[[:space:]]*}
		if (( INT[DS_PORT] != 389 )); then
			STR[LDAP_SERVER_LIST]="${STR[LDAP_SERVER_LIST]}:${INT[DS_PORT]}"
		fi
	fi

	while : ; do
		get_ans 'Default server list (h=help):' "${STR[LDAP_SERVER_LIST]}"
		case "${ANS}" in
			[Hh] | help | Help | '?') display_msg 'def_srvlist_help' ;;
			* ) break ;;
		esac
	done
	STR[LDAP_SERVER_LIST]="${ANS}"
}

Man.addFunc get_pref_srv '' '[+NAME?get_pref_srv - Ask user for preferred server list.]
[+DESCRIPTION?Ask the user for the preferred server list and store it into \bSTR[LDAP_PREF_SRVLIST]]\b (overrides the server list).]
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_pref_srv {
	while : ; do
		get_ans 'Preferred server list (h=help):' "${STR[LDAP_PREF_SRVLIST]}"
		case "${ANS}" in
			[Hh] | help | Help | '?') display_msg 'pref_srvlist_help' ;;
			* ) break ;;
		esac
	done
	STR[LDAP_PREF_SRVLIST]="${ANS}"
}

Man.addFunc get_search_scope '' '[+NAME?get_search_scope - Ask user for search scope.]
[+DESCRIPTION?Ask the user for the search scope and store it into \bSTR[LDAP_SEARCH_SCOPE]]\b.]
[+RETURN VALUES]{
	[+1?search scope "one" selected.]
	[+2?search scope "sub" selected.]
}
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_search_scope {
	integer RES
	get_menu_choice 'Choose desired search scope (1=one, 2=sub, h=help): ' \
		1 2 1 srch_scope_help
	(( $? == 2 )) && { STR[LDAP_SEARCH_SCOPE]='sub' ; return 2 ; }
	STR[LDAP_SEARCH_SCOPE]='one'
	return 1
}

Man.addFunc get_cred_level '' '[+NAME?get_cred_level - Ask user for credential level.]
[+DESCRIPTION?Ask the user for the client credential level to use and store it into \bSTR[LDAP_CRED_LEVEL]]\b.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage CRED_LEVELS STR ; }" '}
[+RETURN VALUES?The index wrt. \bCRED_LEVELS\b of the selected credential level \b+1\b.]
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_cred_level {
	integer RES
	typeset PROMPT=''
	(( INT[GSSAPI_ENABLE] )) && PROMPT='"self" is needed for GSSAPI profile.\n'
	PROMPT+='Choose Credential level (identity) [h=help]:'

	get_menu_choice "${PROMPT}" 1 4 1 'cred_lvl_help' 'cred_level_menu'
	RES=$?
	STR[LDAP_CRED_LEVEL]="${CRED_LEVELS[RES-1]}"
	return ${RES}
}

Man.addFunc get_auth '' '[+NAME?get_auth - ask user for authentication methods.]
[+DESCRIPTION?Ask the user for authentication methods to enable and store them  as a semicolon separated list into \bSTR[LDAP_AUTHMETHOD | LDAP_SRV_AUTHMETHOD_{PAM|KEY|CMD}}]]\b and set \bINT[NEED_SRVAUTH_{PAM|KEY|CMD}]]\b to 0 depending on the given \atype\a (either "client", "pam_ldap", "keyserv", or "passwd-cmd") and selected methods.]
[+ENVIRONMENT VARIABLES]{' "${  Man.varUsage AUTH_METHODS STR ; }" '}
[+RETURN VALUES]{
	[+0?on success.]
	[+-1?if an invalid \atype\a was given.]
}
[+SEE ALSO?\bget_menu_choice()\b, \bget_confirm_nodef()\b.]
\n\n\atype\a
'
function get_auth {
	typeset TYPE=$1 VNAME HELPTAG MENU
	integer RES MAX=${#AUTH_METHODS[@]} OFFSET=0
	typeset -a SELECTED=( )
	typeset -u UTYPE=${TYPE}

	case "${TYPE}" in
		client) VNAME=LDAP_AUTHMETHOD ; OFFSET=1 ; UTYPE='DEFAULT' ;;
		pam_ldap) VNAME=LDAP_SRV_AUTHMETHOD_PAM ;;
		keyserv) VNAME=LDAP_SRV_AUTHMETHOD_KEY ;;
		passwd-cmd) VNAME=LDAP_SRV_AUTHMETHOD_CMD ;;
		*) print -u2 "${.sh.fun}() bug: invalid type argument" && return -1 ;;
	esac
		
	typeset ASK='' VAL='' M=''
	if (( OFFSET )); then
		# client
		(( INT[GSSAPI_ENABLE] )) && \
			ASK='"sasl/GSSAPI" is needed for GSSAPI profile.\n'
		ASK+='Choose DEFAULT authentication (bind) method (0=reset, h=help):'
		MENU='auth_method_menu'
		HELPTAG='auth_help'
	else
		ASK="Choose ${UTYPE} authentication (bind) method (0=reset, h=help):"
		(( MAX-- ))
		MENU='srvauth_method_menu'
		HELPTAG='srvauth_help'
	fi

	while : ; do
		get_menu_choice "${ASK}" 0 ${MAX} 1 ${HELPTAG} ${MENU}
		RES=$?
		if (( RES )); then
			M=${AUTH_METHODS[RES - OFFSET]}
			# avoid doubles
			[[ ${VAL} != ~(E)[ ]${M}[ ] ]] && SELECTED+=( ${M} )
			VAL=" ${SELECTED[@]} "
			M=${VAL// /\;}
			M=${M#\;}
		else
			typeset -a SELECTED=( )		# reset
			VAL=''
			M=''
		fi
		print && Log.info "Current authentication method(s): ${M%\;}\n"

		get_confirm_nodef "Do you want to add another ${UTYPE} authentication method (y/n)?" \
			&& break
	done
	M=${M%\;}
	if (( ! OFFSET )); then
		M=${M//\;/\;${TYPE}:}
		if [[ -n ${M} ]]; then
			STR[${VNAME}]="${TYPE}:${M}"
		else
			STR[${VNAME}]=''
			INT[NEED_SRVAUTH_${TYPE##*_}]=0
		fi
	else
		STR[${VNAME}]="${M}"
	fi
	Log.verbose "Selected ${UTYPE} authentication methods: '${STR[${VNAME}]}'"
	return 0
}

Man.addFunc get_followref '' '[+NAME?get_followref - Ask user whether or not to follow referrals.]
[+DESCRIPTION?Ask the user whether the client should follow referrals. Result gets stored into \bINT[LDAP_FOLLOWREF]]\b.]
[+SEE ALSO?\bget_confirm()\b, \bldapclient\b(1M).]
'
function get_followref {
	get_confirm 'Do you want the clients to follow referrals (y/n/h)?' 'n' \
		'referrals_help'
	INT[LDAP_FOLLOWREF]=$?
}

Man.addFunc get_timelimit '' '[+NAME?get_timelimit - Ask user for search time limit.]
[+DESCRIPTION?Ask the user for the max. time allowed to process a search operation and store it into \bINT[DS_TIMELIMIT]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bis_numeric()\b, \bget_negone_num()\b.]
'
function get_timelimit {
	typeset NAME='nsslapd-timelimit' VAL=''
	(( TMPF[IS_OPENDJ] )) && NAME='ds-cfg-time-limit'	# min val = 0

	# Get current timeout value from cn=config
	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b 'cn=config' -s base \
		'objectclass=*' "${NAME}" 2>/dev/null | \
	while read LINE; do
		if [[ ${LINE%%=*} == ${NAME} ]]; then
			VAL=${LINE#*=}
			break
		fi
	done
	if [[ -z ${VAL} ]]; then
		Log.fatal 'Unable to check current search processing timeout of the DS'
		return 66
	fi
	VAL=${VAL%%[[:space:]]*}
	is_numeric ${VAL} && NUM=${VAL} || NUM=INT[DS_TIMELIMIT]
    
	get_negone_num "Enter the DS search processing time limit in seconds (current=${NUM})" \
		'30'
	(( TMPF[IS_OPENDJ] && NUM < 0 )) && NUM=0	# unlimited

	INT[DS_TIMELIMIT]=${NUM}
	return 0
}

Man.addFunc get_sizelimit '' '[+NAME?get_sizelimit - Ask user for search size limit.]
[+DESCRIPTION?Ask the user for the max. number of entries to return for a single search operation and store it into \bINT[DS_SIZELIMIT]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bis_numeric()\b, \bget_negone_num()\b.]
'
function get_sizelimit {
	typeset NAME='nsslapd-sizelimit' VAL=''
	(( TMPF[IS_OPENDJ] )) && NAME='ds-cfg-size-limit'	# min val = 0

	# Get current search sizelimit
	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b 'cn=config' -s base \
		'objectclass=*' "${NAME}" 2>/dev/null | \
	while read LINE; do
		if [[ ${LINE%%=*} == ${NAME} ]]; then
			VAL=${LINE#*=}
			break
		fi
	done
	if [[ -z ${VAL} ]]; then
		Log.fatal 'Unable to check current search entry result limit of the DS'
		return 66
	fi
	is_numeric ${VAL} && NUM=${VAL} || NUM=INT[DS_SIZELIMIT]

	get_negone_num "Enter max. entries per search the DS returns (current=${NUM})" '1000'
	(( TMPF[IS_OPENDJ] && NUM < 0 )) && NUM=0	# unlimited
	INT[DS_SIZELIMIT]=${NUM}
	return 0
}

Man.addFunc get_want_crypt '' '[+NAME?get_want_crypt - Ask user whether to store passwords in crypt.]
[+DESCRIPTION?Ask the user whether the default password storage scheme should be set to "CRYPT" and stores the result into \bINT[NEED_CRYPT]]\b.]
[+SEE ALSO?\bget_confirm()\b.]
'
function get_want_crypt {
	get_confirm 'Do you want to store passwords in "CRYPT" formats (y/n/h)?' \
		'n' 'crypt_help'
	INT[NEED_CRYPT]=$?
}

Man.addFunc get_srch_time '' '[+NAME?get_srch_time - Ask user for client search time limit.]
[+DESCRIPTION?Ask the user for the max. time in seconds a client waits for a search result and store it into \bINT[LDAP_SEARCH_TIME_LIMIT]]\b.]
[+SEE ALSO?\bget_negone_num()\b, \bldapclient\b(1M).]
'
function get_srch_time {
	get_negone_num 'Client search time limit in seconds (h=help):' \
		${INT[LDAP_SEARCH_TIME_LIMIT]} 'srchtime_help'
	INT[LDAP_SEARCH_TIME_LIMIT]=${NUM}
}

Man.addFunc get_prof_ttl '' '[+NAME?get_prof_ttl - Ask user for client profile time to live (TTL).]
[+DESCRIPTION?Ask the user for the max. time in seconds a client may cache its profile before refreshing again and store it into \bINT[LDAP_PROFILE_TTL]]\b.]
[+SEE ALSO?\bget_negone_num()\b, \bldapclient\b(1M).]
'
function get_prof_ttl {
	get_negone_num 'Client Profile Time To Live in seconds (h=help):' \
		${INT[LDAP_PROFILE_TTL]} 'profttl_help'
	INT[LDAP_PROFILE_TTL]=${NUM}
}

Man.addFunc get_bind_limit '' '[+NAME?get_bind_limit - Ask user for client bind time limit.]
[+DESCRIPTION?Ask the user for the max. time in seconds a client may try to bind to the server and store it into \bINT[LDAP_BIND_LIMIT]]\b.]
[+SEE ALSO?\bget_negone_num()\b, \bldapclient\b(1M).]
'
function get_bind_limit {
	get_negone_num 'Client bind time limit in seconds (h=help):' \
		${INT[LDAP_BIND_LIMIT]} 'bindlim_help'
	INT[LDAP_BIND_LIMIT]=${NUM}
}

Man.addFunc get_want_shadow_update '' '[+NAME?get_want_shadow_update - Ask user whether to enable shadow update.]
[+DESCRIPTION?Ask the user whether to enable shadow update. Set \bINT[LDAP_ENABLE_SHADOW_UPDATE]]\b to 0 if not desired, to 1 otherwise.]
[+SEE ALSO?\bget_confirm()\b.]
'
function get_want_shadow_update {
	get_confirm 'Do you want to enable shadow update (y/n/h)?' 'n' \
		'enable_shadow_update_help'
	INT[LDAP_ENABLE_SHADOW_UPDATE]=$?
}

	######################################################################
	# FUNCTIONS  FOR Service Search Descriptor's START HERE.
	######################################################################
Man.addFunc add_ssd '' '[+NAME?add_ssd - Ask user for SSD to add.]
[+DESCRIPTION?Ask the user for the ID:BASE:SCOPE and add it to \bSSD\b list.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage SSD ; }" '}
[+SEE ALSO?\bget_ans\b, \bget_ans_req()\b.]
'
function add_ssd {
	typeset ID='' BASE='' X
	typeset -l SCOPE=''
	integer FOUND

	while : ; do
		get_ans 'Enter the service name (e.g. passwd):'
		[[ -z ${ANS} ]] && return
		[[ ${ANS} =~ [:] ]] && print 'Invalid service name' && continue

		FOUND=0
		for X  in "${SSD[@]}" ; do
			[[ ${X%%:*} == ${ANS} ]] && FOUND=1 && break
		done
		(( ! FOUND )) && break
		Log.warn "An SSD for '${ANS}' already exists:\n${X}\n"
	done
	ID="${ANS}"
    
	while : ; do
		get_ans_req 'Enter the search base (e.g. ou=people,o=inet):'
		[[ ${ANS} != ~(E)[:] ]] && break
		Log.warn 'Invalid search base' && continue
	done
	BASE="${ANS}"

	while : ; do
		get_ans_req "Enter the search scope (one|sub):"
		SCOPE=${ANS}
		[[ ${SCOPE} == 'one' || ${SCOPE} == 'sub' ]] && break
		Log.warn "'${ANS}' is NOT valid - Enter 'one' or 'sub'"
	done

	SSD+=( "${ID}:${BASE}?${SCOPE}" )
}

Man.addFunc delete_ssd '' '[+NAME?delete_ssd - Ask user which SSD to delete.]
[+DESCRIPTION?Ask the user for the ID of the SSD to delete and remove it from \bSSD\b list.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage SSD ; }" '}
[+SEE ALSO?\bget_ans()\b.]
'
function delete_ssd {
	get_ans 'Enter the service name of the SSD to delete (e.g. passwd):'
	[[ -z ${ANS} ]] && return

	typeset X
	integer I FOUND=-1 MAX=${#SSD[@]}

	for (( I=0; I < MAX ; I++ )); do
		X=${SSD[I]}
		[[ ${X%%:*} == ${ANS} ]] && FOUND=$I && break
	done
	if (( FOUND == -1 )); then
		Log.warn "Invalid service name: '${ANS}' not present in list"
		return
	fi
	(( FOUND == 0 )) && unset SSD[0] && return

	# need to do a little bit more, since ksh allows to remove the 1st entry,
	# only (i.e. like "shift 1" for positional params)
	for (( I=FOUND; I > 0; I-- )); do
		SSD[${I}]="${SSD[I-1]}"
	done
	unset SSD[0]
}

Man.addFunc modify_ssd '' '[+NAME?modify_ssd - Allow user to modify an SSD.]
[+DESCRIPTION?Ask the user for the ID of the SSD to modify, let the user modify it and finally save changes back to the \bSSD\b list.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage SSD ; }" '}
[+SEE ALSO?\bget_ans()\b, \bread\b(1).]
'
function modify_ssd {
	get_ans 'Enter the service name of the SSD to modify:'
	[[ -z ${ANS} ]] && return
    
	typeset ID BASE
	typeset -l SCOPE
	integer I FOUND=-1 MAX=${#SSD[@]}
	for (( I=0; I < MAX ; I++ )); do
		X=${SSD[I]}
		[[ ${X%%:*} == ${ANS} ]] && FOUND=$I && break
	done
	if (( FOUND == -1 )); then
		Log.warn "Invalid service name: '${ANS}'"
		return 0
	fi

	# most users expect emacs edit behavior (don't have a proper profile)
	set -o emacs
	read -v X?'Current SSD: '

	# now verify
	ID=${X%%:*}
	BASE=${.sh.match#:}
	SCOPE=${BASE#*$'?'}
	BASE=${.sh.match%$'?'}
	if [[ -z ${ID} || -z ${BASE} || -z ${SCOPE} ]] || \
		[[ ${SCOPE} != 'one' && ${SCOPE} != 'sub' ]]
	then
		Log.warn 'SSD is invalid. Change skipped'
		return
	fi
	SSD[${FOUND}]="${ID}:${BASE}?${SCOPE}"
}

Man.addFunc reset_ssd '' '[+NAME?reset_ssd - Blank out current list of SSDs.]
[+DESCRIPTION?Clear the \bSSD\b array.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage SSD ; }" '}
'
function reset_ssd {
    SSD=( )
	unset SSD[0]	# required otherwise it would contain a single '\n'. Bug?
}

Man.addFunc display_ssd '' '[+NAME?display_ssd -  Display current SSD list.]
[+DESCRIPTION?Display the current \bSSD\b list and return, when the user hit the enter key.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage SSD ; }" '}
'
function display_ssd {
	typeset X
	print '
Current Service Search Descriptors:
=================================='
	for X in "${SSD[@]}" ; do
		print "  ${X}"
	done
    print '\nHit return to continue.'
	read
}

Man.addFunc prompt_ssd '' '[+NAME?prompt_ssd - Get SSDs from user.]
[+DESCRIPTION?Ask the user whether to add/delete/modify/display one or more SSDs currently set and execute the corresponding action.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ANS ; }" '}
[+SEE ALSO?\bdisplay_msg()\b, \bget_ans()\b, \badd_ssd()\b, \bdelete_ssd()\b, \bmodify_ssd()\b, \bdisplay_ssd()\b, \breset_ssd()\b.]
'
function prompt_ssd {
	if get_confirm 'Do you wish to setup Service Search Descriptors (y/n/h)?' \
		'n' 'ssd_help'
	then
		return
	fi

	# Display menu for SSD choices
	while : ; do
		display_msg prompt_ssd_menu
		get_ans 'Enter menu choice:' 'Quit'
		case "${ANS}" in
			[Qq] | Quit | quit)		return ;;
			[Aa] | add)				add_ssd ;;
			[Dd] | delete)			delete_ssd ;;
			[Mm] | modify)			modify_ssd ;;
			[Pp] | print | display)	display_ssd ;;
			[Xx] | reset | clear)	reset_ssd ;;
			[Hh] | Help | help)
				display_msg 'ssd_menu_help '
				print ' Press return to continue.'
				read
				;;
			*) Log.warn "Invalid choice: '${ANS}' please re-enter from menu!" ;;
		esac
	done
}

	######################################################################
	# End Of FUNCTIONS FOR Service Search Descriptor's
	######################################################################
Man.addFunc prompt_config_info '' '[+NAME?prompt_config_info - Ask user for missing config info.]
[+DESCRIPTION?Ask the user for the config info not yet available/read from an '"${PROG}"' config file.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage INT STR SSD ; }" '}
[+RETURN VALUES]{
	[+0?on success (all info aquired).]
	[+>= 66?a fatal error occured.]
}
'
function prompt_config_info {
	# Prompt for DS server name
	get_ids_server

	# Prompt for DS port number
	get_ids_port

	# Check DS version for compatibility
	chk_ids_version || return 66

	# Get the Directory manager DN and passwd
	get_dirmgr_dn
	get_dirmgr_pw

	# Check if the DS supports the VLV
	chk_vlv_indexes || return 67

	get_confirm 'Do you want to modify the DS timelimit for processing searches (y/n/h)?' 'n' 'tlim_help'
	INT[NEED_TIME]=$?
	if (( INT[NEED_TIME] )); then
		get_timelimit || return 70
	fi

	get_confirm 'Do you want to modify the DS sizelimit - max. entries to return (y/n/h)?' 'n' 'slim_help'
	INT[NEED_SIZE]=$?
	if (( INT[NEED_SIZE] )); then
		get_sizelimit || return 71
	fi


	# LDAP CLIENT PROFILE SPECIFIC INFORMATION
	#   (i.e. the fields that show up in the profile)
	get_domain
	get_basedn || return 68

	# Check/Get Kerberos infos
    gssapi_setup

    get_profile_name

	if (( INT[LDAP_ENABLE_SHADOW_UPDATE] ));then
		setup_shadow_update || return 69
		return 0
	fi

	get_srv_list
	get_pref_srv
	get_search_scope
    get_followref

	# Store passwords in crypt format?
	get_want_crypt

	# If cred is "anonymous", make auth == "none"
	get_cred_level
	[[ ${STR[LDAP_CRED_LEVEL]} != anonymous ]] && get_auth 'client'

	get_confirm 'Do you want to setup any non-default Authentication Methods (y/n/h)?' 'n' 'srvauth_help'
	if (( $? )); then
		get_confirm 'Do you want to setup Authentication Methods for "pam_ldap" (y/n/h)?' 'n' 'pam_ldap_help'
		INT[NEED_SRVAUTH_PAM]=$?
		(( INT[NEED_SRVAUTH_PAM] )) && get_auth 'pam_ldap'

		get_confirm 'Do you want to setup Authentication Methods for "keyserv" (y/n/h)?' 'n' 'keyserv_help'
		INT[NEED_SRVAUTH_KEY]=$?
		(( INT[NEED_SRVAUTH_KEY] )) && get_auth 'keyserv'

		get_confirm 'Do you want to setup Authentication Methods for "passwd-cmd (y/n/h)?' 'n' 'passwd-cmd_help'
		INT[NEED_SRVAUTH_CMD]=$?
		(( INT[NEED_SRVAUTH_CMD] )) && get_auth 'passwd-cmd'
	fi

	# Get client timeouts
	get_srch_time
	get_prof_ttl
	get_bind_limit

	get_want_shadow_update

	reset_ssd
	prompt_ssd

	show_vars

	Log.printMarker
	return 0
}
######################################################################
# End Of FUNCTIONS FOR prompt_config_info()
######################################################################


######################################################################
# FUNCTIONS  FOR display_summary() START HERE.
######################################################################
Man.addFunc get_proxyagent '' '[+NAME?get_proxyagent - Ask user for the proxy agent DN and password.]
[+DESCRIPTION?Ask the user for the proxy agent DN and password to use and store it into \bSTR[LDAP_PROXYAGENT]]\b, \bSTR[LDAP_PROXYAGENT_CRED]]\b.]
[+SEE ALSO?\bget_ans()\b.]
'
function get_proxyagent {
	STR[LDAP_PROXYAGENT]="cn=proxyagent,ou=profile,${STR[LDAP_BASEDN]}"
	get_ans 'Enter DN for proxy agent:' "${STR[LDAP_PROXYAGENT]}"
	STR[LDAP_PROXYAGENT]="${ANS}"
	get_passwd 'Enter passwd for proxyagent:'
	STR[LDAP_PROXYAGENT_CRED]="${ANS}"
}

Man.addFunc display_summary '' '[+NAME?display_summary - Display a summary of values entered and let the user modify values at will.]
[+DESCRIPTION?Display a summary of all configuration relevant info and let the user re-enter data if needed.]
'
function display_summary {
	# Create lookup table for function names. Needs to be in sync with 
	# helpTag 'summary_menu' in display_msg()!
	typeset -a FN=( 'dummy' )					# dummy for commit and quit
	FN+=( 'get_domain' 'get_basedn' 'get_profile_name' )
	FN+=( 'get_srv_list' 'get_pref_srv' 'get_search_scope' 'get_cred_level' )
	FN+=( 'get_auth client' 'get_followref' )
    FN+=( 'get_timelimit' 'get_sizelimit' 'get_want_crypt' )
    FN+=( 'get_auth pam_ldap' 'get_auth keyserv' 'get_auth passwd-cmd' )
    FN+=( 'get_srch_time' 'get_prof_ttl' 'get_bind_limit' )
    FN+=( 'get_want_shadow_update' )
    FN+=( 'prompt_ssd' )

    # Since menu prompt string is long, set here
    typeset PROMPT='Enter config value to change: (1-20 0=commit changes)'
	integer RES MAX=${#FN[@]}
	(( MAX-- ))

	while : ; do
		# Display menu and get value in range
		get_menu_choice "${PROMPT}" '0' ${MAX} '0' '' 'summary_menu'
		RES=$?
	
		# Make sure where not exiting
		(( RES == 0 )) && break			# quit selected

		# Call appropriate function from function table
		${FN[RES]}
	done

    # If credlevel is still proxy see if user wants a change?
	if [[ ${STR[LDAP_CRED_LEVEL]:0:5} == 'proxy' ]]; then
		if [[ ${STR[LDAP_AUTHMETHOD]} != none ]]; then
			INT[NEED_PROXY]=1
			get_proxyagent
		else
			Log.warn 'Since Authentication method is "none",' \
				'credential level will be set to "anonymous"'
			STR[LDAP_CRED_LEVEL]='anonymous'
		fi
	fi

	# If shadow update is enabled, set up administrator credential
	if (( INT[LDAP_ENABLE_SHADOW_UPDATE] )); then
		INT[NEED_ADMIN]=1
		if [[ ${STR[LDAP_CRED_LEVEL]} == 'self' && \
			${STR[LDAP_AUTHMETHOD]} == 'sasl/GSSAPI' ]];
		then
				INT[NEED_HOSTACL]=1
				INT[NEED_ADMIN]=0
		fi
		if (( INT[NEED_ADMIN] )); then
			get_adminDN
			get_admin_pw
		fi
	fi

	show_vars

	get_confirm_nodef '
WARNING: About to start committing changes. (y=continue, n=EXIT)'
	if (( ! $? )); then
		Log.info 'Terminating setup without making changes at users request'
		return 1
	fi

	Log.printMarker
	return 0
}
######################################################################
# End Of FUNCTIONS  FOR display_summary()
######################################################################

Man.addFunc modify_cn '' '[+NAME?modify_cn - modify objectclass "ipNetwork" to RFC 2307bis.]
[+DESCRIPTION?Change the cn from MUST to MAY in ipNetwork objectclass.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_cn {
	getDSobjectclasses || return 66
	typeset NEWDEF="'ipNetwork' SUP top STRUCTURAL DESC 'Abstraction of a network. The distinguished value of the cn attribute denotes the canonical name of the network' MUST ipNetworkNumber MAY "'( cn $ ipNetmaskNumber $ l $ description $ manager )'" X-ORIGIN 'draft-howard-rfc2307bis'"

	# bis-delta: MUST ( -cn )  MAY ( +cn )
	typeset DEF=${OID2ODEF['1.3.6.1.1.1.2.7']}
	if [[ -n ${DEF} ]]; then
		DEF=${DEF##*MUST*([[:space:]])}
		if [[ ${DEF:0:9} == 'ipNetwork' ]]; then
			# assume no need to fix, old definition would start with a '(' 
			showProgress 'Schema definition of ipNetwork ok (RFC2307bis).'
			return 0
		fi
	fi

	nextFile modify $0
	print '
dn: cn=schema
changetype: modify
add: objectclasses
objectclasses: ( 1.3.6.1.1.1.2.7 NAME '"${NEWDEF}"')
'	> ${TMP[FILE]}

	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal 'Schema update of ipNetwork to RFC2307bis failed'
		return 67
	fi
	showProgress 'Schema update of ipNetwork to RFC2307bis done.'
	OID2ODEF['1.3.6.1.1.1.2.7']="${NEWDEF}"
	return 0
}

Man.addFunc modify_timelimit '' '[+NAME?modify_timelimit - Set the DS timelimit.]
[+DESCRIPTION?Set the DS timelimit to \bINT[DS_TIMELIMIT]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_timelimit {
	typeset NAME='nsslapd-timelimit'
	(( TMPF[IS_OPENDJ] )) && NAME='ds-cfg-time-limit'

	nextFile modify $0
	print '
dn: cn=config
changetype: modify
replace: '"${NAME}"'
'"${NAME}"': '"${INT[DS_TIMELIMIT]}"' s
'		> ${TMP[FILE]}

	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal 'Update of ${NAME} failed'
		return 66
	fi

	showProgress "Changed ${NAME} to ${INT[DS_TIMELIMIT]} in 'cn=config'."
	return 0
}

Man.addFunc modify_sizelimit '' '[+NAME?modify_sizelimit - Set the DS sizelimit.]
[+DESCRIPTION?Set the DS sizelimit to \bINT[DS_SIZELIMIT]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_sizelimit {
	typeset NAME='nsslapd-sizelimit'
	(( TMPF[IS_OPENDJ] )) && NAME='ds-cfg-size-limit'

	nextFile modify $0
	print '
dn: cn=config
changetype: modify
replace: '"${NAME}"'
'"${NAME}"': '"${INT[DS_SIZELIMIT]}"'
'		> ${TMP[FILE]}

	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal "Update of ${NAME} failed"
		return 66
	fi

	showProgress "Changed ${NAME} to ${INT[DS_SIZELIMIT]} in 'cn=config'."
	return 0
}

Man.addFunc modify_pwd_crypt '' '[+NAME?modify_pwd_crypt - modify the passwd storage scheme to use CRYPT.]
[+DESCRIPTION?Set the default password policy of the DS to CRYPT.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_pwd_crypt {
    # DS 5.2 moved passwordchangescheme off to a new data structure
	typeset -a INFO=( ${TMP[DS_INFO]} )
	typeset DN='cn=config' TARGET='passwordStorageScheme' VALUE='CRYPT' MSG=''
	typeset FMT='dn: %s\nchangetype: modify\nreplace: %s\n%s: %s\n\n'
	nextFile modify $0

	if (( TMPF[IS_OPENDJ] )); then
		DN='cn=Default Password Policy,cn=Password Policies,cn=config'
		TARGET='ds-cfg-default-password-storage-scheme'
		VALUE='cn=CRYPT,cn=Password Storage Schemes,cn=config'
	else
		# DSEE
		integer VER=$(( ${INFO[1]} * 1000 + ${INFO[2]} ))
		(( VER >= 5002 )) && DN='cn=Password Policy,cn=config'
	fi
	printf "${FMT}" "${DN}" "${TARGET}" "${TARGET}" "${VALUE}" >${TMP[FILE]}
	MSG="Changed '${TARGET}' to 'CRYPT'"

	if (( TMPF[IS_OPENDJ] )); then
		if (( INT[NEED_CRYPT_IMPORT] )); then 
			TARGET='ds-cfg-allow-pre-encoded-passwords'
			printf "${FMT}" "${DN}" "${TARGET}" "${TARGET}" 'true'>>${TMP[FILE]}
			MSG+="and '${TARGET}' to 'true'"
		fi
		DN='cn=Password Policy Import,cn=Plugins,cn=config'
		TARGET='ds-cfg-default-user-password-storage-scheme'
		printf "${FMT}" "${DN}" "${TARGET}" "${TARGET}" "${VALUE}">>${TMP[FILE]}
	fi

	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal 'Update of passwordStorageScheme failed'
		return 66
	fi

	showProgress "${MSG}."
	return 0
}

Man.addFunc update_schema_attr '' '[+NAME?update_schema_attr -  Update DS schema to support Naming Services.]
[+DESCRIPTION?Update the schema of the DS with the attribute types required for the Solaris Naming Services. It just checks, whether the OID is defined in the server schema. If already defined, it is left as is, otherwise added.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1), \bgetDSattributes()\b.]
'
function update_schema_attr {

	# incorporate former 'keep_backward_compatibility()'
	getDSattributes || return 66
	typeset MEMBERGID_OID='1.3.6.1.4.1.42.2.27.5.1.30'
	typeset DEF=${ANAME2OID['membergid-oid']}
	[[ -n ${DEF} ]] && MEMBERGID_OID='memberGid-oid'
	typeset RFC822MAILMEMBER_OID='1.3.6.1.4.1.42.2.27.2.1.15'
	DEF=${ANAME2OID['rfc822mailmember-oid']}
	[[ -n ${DEF} ]] && RFC822MAILMEMBER_OID='rfc822mailMember-oid'

	# EE and OD definitions seem to be compatible wrt. to Solaris. However, the
	# OD defs usually specifies explicitly the server behavior (what happens, if
	# EQUALITY|SUBSTR is not specified => caseIgnore[Substring]Match)) and 
	# sometimes a different kind of String to use (see RFC 4517):
	# IA5 String: ASCII character in the range of 0..127
	# Octet String: byte collection (0..255), usually not human readable,
	#               bytewise comparision
	# Directory String: an UTF-8 string
	# DN: basically an UTF-8 string, but with some constraints wrt. backslash
	#     escaping '\0', '"', '+', ',', ';', '<', '>',  and '\'
	# Boolean String: TRUE|FALSE
	typeset -A EE=( )
	typeset -A OD=( )
	EE['1.3.6.1.1.1.1.28']="'nisPublickey' DESC 'NIS public key' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.1.1.1.28']="'nisPublicKey' DESC 'NIS public key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'" # Directory vs. Octet String

	EE['1.3.6.1.1.1.1.29']="'nisSecretkey' DESC 'NIS secret key' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.1.1.1.29']="'nisSecretKey' DESC 'NIS secret key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'"	# Directory vs. Octet String

	EE['1.3.6.1.1.1.1.30']="'nisDomain' DESC 'NIS domain' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.1.1.1.30']="'nisDomain' DESC 'NIS domain' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'draft-howard-rfc2307bis'"	# Directory vs. IA5 String

	EE['1.3.6.1.1.1.1.31']="'automountMapName' DESC 'automount Map Name' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.1.1.1.31']="'automountMapName' DESC 'automount Map Name' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.1.1.1.32']="'automountKey' DESC 'automount Key Value' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.1.1.1.32']="'automountKey' DESC 'Automount Key value' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.1.1.1.33']="'automountInformation' DESC 'automount information' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.1.1.1.33']="'automountInformation' DESC 'Automount information' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.4.1.42.2.27.1.1.12']="'nisNetIdUser' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.42.2.27.1.1.12']="'nisNetIdUser' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.1.1.13']="'nisNetIdGroup' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.42.2.27.1.1.13']="'nisNetIdGroup' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.1.1.14']="'nisNetIdHost' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.42.2.27.1.1.14']="'nisNetIdHost' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"

	EE[${RFC822MAILMEMBER_OID}]="'rfc822mailMember' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD[${RFC822MAILMEMBER_OID}]="'rfc822mailMember' DESC 'rfc822 mail addresss of group member' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"

	EE['2.16.840.1.113730.3.1.30']="'mgrpRFC822MailMember' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['2.16.840.1.113730.3.1.30']="'mgrpRFC822MailMember' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.15']="'SolarisLDAPServers' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.15']="'SolarisLDAPServers' DESC 'LDAP Server address eg. 76.234.3.1:389' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.16']="'SolarisSearchBaseDN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.16']="'SolarisSearchBaseDN' DESC 'Search Base Distinguished Name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# DN vs. Directory String

	EE['1.3.6.1.4.1.42.2.27.5.1.17']="'SolarisCacheTTL' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.17']="'SolarisCacheTTL' DESC 'TTL value for the Domain information eg. 1w, 2d, 3h, 10m, or 5s' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.18']="'SolarisBindDN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.18']="'SolarisBindDN' DESC 'DN to be used to bind to the directory as proxy' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# DN vs. Directory String

	EE['1.3.6.1.4.1.42.2.27.5.1.19']="'SolarisBindPassword' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.19']="'SolarisBindPassword' DESC 'Password for bindDN to authenticate to the directory' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# IA5 vs. Octet String

	EE['1.3.6.1.4.1.42.2.27.5.1.20']="'SolarisAuthMethod' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.20']="'SolarisAuthMethod' DESC 'Authentication method to be used eg. \"NS_LDAP_AUTH_NONE\", \"NS_LDAP_AUTH_SIMPLE\" or \"NS_LDAP_AUTH_SASL_CRAM_MD5\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.21']="'SolarisTransportSecurity' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.21']="'SolarisTransportSecurity' DESC 'Transport Level Security method to be used eg. \"NS_LDAP_SEC_NONE\" or \"NS_LDAP_SEC_SASL_TLS\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.22']="'SolarisCertificatePath' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.22']="'SolarisCertificatePath' DESC 'Path to certificate file/device' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.23']="'SolarisCertificatePassword' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.23']="'SolarisCertificatePassword' DESC 'Password or PIN that grants access to certificate.' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# IA5 vs. Octet String

	EE['1.3.6.1.4.1.42.2.27.5.1.24']="'SolarisDataSearchDN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.24']="'SolarisDataSearchDN' DESC 'Search DN for data lookup in \":(DN0),(DN1),...\" format' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.25']="'SolarisSearchScope' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.25']="'SolarisSearchScope' DESC 'Scope to be used for search operations eg. \"NS_LDAP_SCOPE_BASE\", \"NS_LDAP_SCOPE_ONELEVEL\" or \"NS_LDAP_SCOPE_SUBTREE\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.26']="'SolarisSearchTimeLimit' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.26']="'SolarisSearchTimeLimit' DESC 'Time Limit in seconds for search operations' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.27']="'SolarisPreferredServer' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.27']="'SolarisPreferredServer' DESC 'Preferred LDAP Server address or network number' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.28']="'SolarisPreferredServerOnly' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.28']="'SolarisPreferredServerOnly' DESC 'Boolean flag for use of preferredServer or not' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. Boolean String

	EE['1.3.6.1.4.1.42.2.27.5.1.29']="'SolarisSearchReferral' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.29']="'SolarisSearchReferral' DESC 'referral chasing option eg. \"NS_LDAP_NOREF\" or \"NS_LDAP_FOLLOWREF\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.4']="'SolarisAttrKeyValue' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.4']="'SolarisAttrKeyValue' DESC 'Semi-colon separated key=value pairs of attributes' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.5']="'SolarisAuditAlways' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.5']="'SolarisAuditAlways' DESC 'Always audited attributes per-user' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.6']="'SolarisAuditNever' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.6']="'SolarisAuditNever' DESC 'Never audited attributes per-user' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.7']="'SolarisAttrShortDesc' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.7']="'SolarisAttrShortDesc' DESC 'Short description about an entry, used by GUIs' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.8']="'SolarisAttrLongDesc' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.8']="'SolarisAttrLongDesc' DESC 'Detail description about an entry' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.9']="'SolarisKernelSecurityPolicy' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.9']="'SolarisKernelSecurityPolicy' DESC 'Solaris kernel security policy' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.10']="'SolarisProfileType' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.10']="'SolarisProfileType' DESC 'Type of object defined in profile'EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.11']="'SolarisProfileId' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.11']="'SolarisProfileId' DESC 'Identifier of object defined in profile' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.12']="'SolarisUserQualifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.12']="'SolarisUserQualifier' DESC 'Per-user login attributes' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.13']="'SolarisAttrReserved1' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.13']="'SolarisAttrReserved1' DESC 'Reserved for future use' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.14']="'SolarisAttrReserved2' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.14']="'SolarisAttrReserved2' DESC 'Reserved for future use' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.1']="'SolarisProjectID' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.1']="'SolarisProjectID' DESC 'Unique ID for a Solaris Project entry' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.2']="'SolarisProjectName' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.2']="'SolarisProjectName' DESC 'Name of a Solaris Project Entry' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.3']="'SolarisProjectAttr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.42.2.27.5.1.3']="'SolarisProjectAttr' DESC 'Attributes of a Solaris Project entry' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE[${MEMBERGID_OID}]="'memberGid' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD[${MEMBERGID_OID}]="'memberGid' DESC 'Posix Group Name' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.11.1.3.1.1.0']="'defaultServerList' DESC 'Default LDAP server host address used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.0']="'defaultServerList' DESC 'List of default servers' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.1']="'defaultSearchBase' DESC 'Default LDAP base DN used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.1']="'defaultSearchBase' DESC 'Default base for searches' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.2']="'preferredServerList' DESC 'Preferred LDAP server host addresses to be used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.2']="'preferredServerList' DESC 'List of preferred servers' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.3']="'searchTimeLimit' DESC 'Maximum time in seconds a DUA should allow for a search to complete' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.3']="'searchTimeLimit' DESC 'Maximum time an agent or service allows for a search to complete' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.4']="'bindTimeLimit' DESC 'Maximum time in seconds a DUA should allow for the bind operation to complete' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.4']="'bindTimeLimit' DESC 'Maximum time an agent or service allows for a bind operation to complete' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.5']="'followReferrals' DESC 'Tells DUA if it should follow referrals returned by a DSA search result' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.5']="'followReferrals' DESC 'An agent or service does or should follow referrals' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'RFC 4876'"	# Directory vs. Boolean String

	EE['1.3.6.1.4.1.11.1.3.1.1.6']="'authenticationMethod' DESC 'A keystring which identifies the type of authentication method used to contact the DSA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.6']="'authenticationMethod' DESC 'Identifies the types of authentication methods either used, required, or provided by a service or peer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.7']="'profileTTL' DESC 'Time to live before a client DUA should re-read this configuration profile' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.7']="'profileTTL' DESC 'Time to live, in seconds, before a profile is considered stale' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.14']="'serviceSearchDescriptor' DESC 'LDAP search descriptor list used by Naming-DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.11.1.3.1.1.14']="'serviceSearchDescriptor' DESC 'Specifies search descriptors required, used, or supported by a particular service or agent' EQUALITY caseExactMatch SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 4876'"	# IA5 vs. Directory String

	EE['1.3.6.1.4.1.11.1.3.1.1.9']="'attributeMap' DESC 'Attribute mappings used by a Naming-DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.11.1.3.1.1.9']="'attributeMap' DESC 'Attribute mappings used, required, or supported by an agent or service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 4876'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.11.1.3.1.1.10']="'credentialLevel' DESC 'Identifies type of credentials a DUA should use when binding to the LDAP server' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.10']="'credentialLevel' DESC 'Identifies type of credentials either used, required, or supported by an agent or service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'RFC 4876'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.11.1.3.1.1.11']="'objectclassMap' DESC 'Objectclass mappings used by a Naming-DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.11.1.3.1.1.11']="'objectclassMap' DESC 'Object class mappings used, required, or supported by an agent or service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 4876'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.11.1.3.1.1.12']="'defaultSearchScope' DESC 'Default search scope used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.12']="'defaultSearchScope' DESC 'Default scope used when performing a search' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'RFC 4876'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.11.1.3.1.1.13']="'serviceCredentialLevel' DESC 'Search scope used by a service of the DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.11.1.3.1.1.13']="'serviceCredentialLevel' DESC 'Specifies the type of credentials either used, required, or supported by a specific service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.15']="'serviceAuthenticationMethod' DESC 'Authentication Method used by a service of the DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.11.1.3.1.1.15']="'serviceAuthenticationMethod' DESC 'Specifies types authentication methods either used, required, or supported by a particular service' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 4876'"

	EE['1.3.18.0.2.4.1140']="'printer-uri' DESC 'A URI supported by this printer.  This URI SHOULD be used as a relative distinguished name (RDN).  If printer-xri-supported is implemented, then this URI value MUST be listed in a member value of printer-xri-supported.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1140']="'printer-uri' DESC 'A URI supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1107']="'printer-xri-supported' DESC 'The unordered list of XRI (extended resource identifiers) supported by this printer.  Each member of the list consists of a URI (uniform resource identifier) followed by optional authentication and security metaparameters.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.18.0.2.4.1107']="'printer-xri-supported' DESC 'The unordered list of XRI (extended resource identifiers) supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1135']="'printer-name' DESC 'The site-specific administrative name of this printer, more end-user friendly than a URI.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}  SINGLE-VALUE"
	OD['1.3.18.0.2.4.1135']="'printer-name' DESC 'The site-specific administrative name of this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1119']="'printer-natural-language-configured' DESC 'The configured language in which error and status messages will be generated (by default) by this printer.  Also, a possible language for printer string attributes set by operator, system administrator, or manufacturer.  Also, the (declared) language of the \"printer-name\", \"printer-location\", \"printer-info\", and \"printer-make-and-model\" attributes of this printer. For example: \"en-us\" (US English) or \"fr-fr\" (French in France) Legal values of language tags conform to [RFC3066] \"Tags for the Identification of Languages\".' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}  SINGLE-VALUE"
	OD['1.3.18.0.2.4.1119']="'printer-natural-language-configured' DESC 'The configured natural language in which error and status messages will be generated (by default) by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1136']="'printer-location' DESC 'Identifies the location of the printer. This could include things like: \"in Room 123A\", \"second floor of building XYZ\".' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
	OD['1.3.18.0.2.4.1136']="'printer-location' DESC 'The physical location of this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1139']="'printer-info' DESC 'Identifies the descriptive information about this printer.  This could include things like: \"This printer can be used for printing color transparencies for HR presentations\", or \"Out of courtesy for others, please print only small (1-5 page) jobs at this printer\", or even \"This printer is going away on July 1, 1997, please find a new printer\".' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
	OD['1.3.18.0.2.4.1139']="'printer-info' DESC 'Descriptive information about this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1134']="'printer-more-info' DESC 'A URI used to obtain more information about this specific printer.  For example, this could be an HTTP type URI referencing an HTML page accessible to a Web Browser.  The information obtained from this URI is intended for end user consumption.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1134']="'printer-more-info' DESC 'A URI for more information about this specific printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1138']="'printer-make-and-model' DESC 'Identifies the make and model of the device.  The device manufacturer MAY initially populate this attribute.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}  SINGLE-VALUE"
	OD['1.3.18.0.2.4.1138']="'printer-make-and-model' DESC 'Make and model of this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1133']="'printer-ipp-versions-supported' DESC 'Identifies the IPP protocol version(s) that this printer supports, including major and minor versions, i.e., the version numbers for which this Printer implementation meets the conformance requirements.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1133']="'printer-ipp-versions-supported' DESC 'IPP protocol version(s) that this printer supports.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1132']="'printer-multiple-document-jobs-supported' DESC 'Indicates whether or not the printer supports more than one document per job, i.e., more than one Send-Document or Send-Data operation with document data.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1132']="'printer-multiple-document-jobs-supported' DESC 'Indicates whether or not this printer supports more than one document per job.' EQUALITY booleanMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1109']="'printer-charset-configured' DESC 'The configured charset in which error and status messages will be generated (by default) by this printer.  Also, a possible charset for printer string attributes set by operator, system administrator, or manufacturer.  For example: \"utf-8\" (ISO 10646/Unicode) or \"iso-8859-1\" (Latin1).  Legal values are defined by the IANA Registry of Coded Character Sets and the \"(preferred MIME name)\" SHALL be used as the tag.  For coherence with IPP Model, charset tags in this attribute SHALL be lowercase normalized.  This attribute SHOULD be static (time of registration) and SHOULD NOT be dynamically refreshed attributetypes: (subsequently).' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63} SINGLE-VALUE"
	OD['1.3.18.0.2.4.1109']="'printer-charset-configured' DESC 'The configured charset in which error and status messages will be generated (by default) by this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1131']="'printer-charset-supported' DESC 'Identifies the set of charsets supported for attribute type values of type Directory String for this directory entry.  For example: \"utf-8\" (ISO 10646/Unicode) or \"iso-8859-1\" (Latin1).  Legal values are defined by the IANA Registry of Coded Character Sets and the preferred MIME name.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63}"
	OD['1.3.18.0.2.4.1131']="'printer-charset-supported' DESC 'Set of charsets supported for the attribute values of syntax DirectoryString for this directory entry.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1137']="'printer-generated-natural-language-supported' DESC 'Identifies the natural language(s) supported for this directory entry.  For example: \"en-us\" (US English) or \"fr-fr\" (French in France).  Legal values conform to [RFC3066], Tags for the Identification of Languages.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63}"
	OD['1.3.18.0.2.4.1137']="'printer-generated-natural-language-supported' DESC 'Natural language(s) supported for this directory entry.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1130']="'printer-document-format-supported' DESC 'The possible document formats in which data may be interpreted and printed by this printer.  Legal values are MIME types come from the IANA Registry of Internet Media Types.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1130']="'printer-document-format-supported' DESC 'The possible source document formats which may be interpreted and printed by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1129']="'printer-color-supported' DESC 'Indicates whether this printer is capable of any type of color printing at all, including highlight color.' EQUALITY booleanMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1129']="'printer-color-supported' DESC 'Indicates whether this printer is capable of any type of color printing at all, including highlight color.' EQUALITY booleanMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1128']="'printer-compression-supported' DESC 'Compression algorithms supported by this printer.  For example: \"deflate, gzip\".  Legal values include; \"none\", \"deflate\" attributetypes: (public domain ZIP), \"gzip\" (GNU ZIP), \"compress\" (UNIX).' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255}"
	OD['1.3.18.0.2.4.1128']="'printer-compression-supported' DESC 'Compression algorithms supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1127']="'printer-pages-per-minute' DESC 'The nominal number of pages per minute which may be output by this printer (e.g., a simplex or black-and-white printer).  This attribute is informative, NOT a service guarantee.  Typically, it is the value used in marketing literature to describe this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1127']="'printer-pages-per-minute' DESC 'The nominal number of pages per minute which may be output by this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1126']="'printer-pages-per-minute-color' DESC 'The nominal number of color pages per minute which may be output by this printer (e.g., a simplex or color printer).  This attribute is informative, NOT a service guarantee.  Typically, it is the value used in marketing literature to describe this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1126']="'printer-pages-per-minute-color' DESC 'The nominal number of color pages per minute which may be output by this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1125']="'printer-finishings-supported' DESC 'The possible finishing operations supported by this printer. Legal values include; \"none\", \"staple\", \"punch\", \"cover\", \"bind\", \"saddle-stitch\", \"edge-stitch\", \"staple-top-left\", \"staple-bottom-left\", \"staple-top-right\", \"staple-bottom-right\", \"edge-stitch-left\", \"edge-stitch-top\", \"edge-stitch-right\", \"edge-stitch-bottom\", \"staple-dual-left\", \"staple-dual-top\", \"staple-dual-right\", \"staple-dual-bottom\".' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255}"
	OD['1.3.18.0.2.4.1125']="'printer-finishings-supported' DESC 'The possible finishing operations supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1124']="'printer-number-up-supported' DESC 'The possible numbers of print-stream pages to impose upon a single side of an instance of a selected medium. Legal values include; 1, 2, and 4.  Implementations may support other values.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27"
	OD['1.3.18.0.2.4.1124']="'printer-number-up-supported' DESC 'The possible numbers of print-stream pages to impose upon a single side of an instance of a selected medium.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1123']="'printer-sides-supported' DESC 'The number of impression sides (one or two) and the two-sided impression rotations supported by this printer.  Legal values include; \"one-sided\", \"two-sided-long-edge\", \"two-sided-short-edge\".' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1123']="'printer-sides-supported' DESC 'The number of impression sides (one or two) and the two-sided impression rotations supported by this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1122']="'printer-media-supported' DESC 'The standard names/types/sizes (and optional color suffixes) of the media supported by this printer.  For example: \"iso-a4\",  \"envelope\", or \"na-letter-white\".  Legal values  conform to ISO 10175, Document Printing Application (DPA), and any IANA registered extensions.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255}"
	OD['1.3.18.0.2.4.1122']="'printer-media-supported' DESC 'The standard names/types/sizes (and optional color suffixes) of the media supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1117']="'printer-media-local-supported' DESC 'Site-specific names of media supported by this printer, in the language in \"printer-natural-language-configured\".  For example: \"purchasing-form\" (site-specific name) as opposed to (in \"printer-media-supported\"): \"na-letter\" (standard keyword from ISO 10175).' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255}"
	OD['1.3.18.0.2.4.1117']="'printer-media-local-supported' DESC 'Site-specific names of media supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1121']="'printer-resolution-supported' DESC 'List of resolutions supported for printing documents by this printer.  Each resolution value is a string with 3 fields:  1) Cross feed direction resolution (positive integer), 2) Feed direction resolution (positive integer), 3) Resolution unit.  Legal values are \"dpi\" (dots per inch) and \"dpcm\" (dots per centimeter).  Each resolution field is delimited by \">\".  For example:  \"300> 300> dpi>\".' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255}"
	OD['1.3.18.0.2.4.1121']="'printer-resolution-supported' DESC 'List of resolutions supported for printing documents by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1120']="'printer-print-quality-supported' DESC 'List of print qualities supported for printing documents on this printer.  For example: \"draft, normal\".  Legal values include; \"unknown\", \"draft\", \"normal\", \"high\".' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1120']="'printer-print-quality-supported' DESC 'List of print qualities supported for printing documents on this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1110']="'printer-job-priority-supported' DESC 'Indicates the number of job priority levels supported.  An IPP conformant printer which supports job priority must always support a full range of priorities from \"1\" to \"100\" (to ensure consistent behavior), therefore this attribute describes the \"granularity\".  Legal values of this attribute are from \"1\" to \"100\".' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1110']="'printer-job-priority-supported' DESC 'Indicates the number of job priority levels supported by this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1118']="'printer-copies-supported' DESC 'The maximum number of copies of a document that may be printed as a single job.  A value of \"0\" indicates no maximum limit.  A value of \"-1\" indicates unknown.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1118']="'printer-copies-supported' DESC 'The maximum number of copies of a document that may be printed as a single job on this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1111']="'printer-job-k-octets-supported' DESC 'The maximum size in kilobytes (1,024 octets actually) incoming print job that this printer will accept.  A value of \"0\" indicates no maximum limit.  A value of \"-1\" indicates unknown.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1111']="'printer-job-k-octets-supported' DESC 'The maximum size in kilobytes (1,024 octets actually) incoming print job that this printer will accept.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1112']="'printer-current-operator' DESC 'The name of the current human operator responsible for operating this printer.  It is suggested that this string include information that would enable other humans to reach the operator, such as a phone number.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
	OD['1.3.18.0.2.4.1112']="'printer-current-operator' DESC 'The identity of the current human operator responsible for operating this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1113']="'printer-service-person' DESC 'The name of the current human service person responsible for servicing this printer.  It is suggested that this string include information that would enable other humans to reach the service person, such as a phone number.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}  SINGLE-VALUE"
	OD['1.3.18.0.2.4.1113']="'printer-service-person' DESC 'The identity of the current human service person responsible for servicing this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1114']="'printer-delivery-orientation-supported' DESC 'The possible delivery orientations of pages as they are printed and ejected from this printer.  Legal values include; \"unknown\", \"face-up\", and \"face-down\".' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1114']="'printer-delivery-orientation-supported' DESC 'The possible delivery orientations of pages as they are printed and ejected from this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1115']="'printer-stacking-order-supported' DESC 'The possible stacking order of pages as they are printed and ejected from this printer. Legal values include; \"unknown\", \"first-to-last\", \"last-to-first\".' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1115']="'printer-stacking-order-supported' DESC 'The possible stacking order of pages as they are printed and ejected from this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1116']="'printer-output-features-supported' DESC 'The possible output features supported by this printer. Legal values include; \"unknown\", \"bursting\", \"decollating\", \"page-collating\", \"offset-stacking\".' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1116']="'printer-output-features-supported' DESC 'The possible output features supported by this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1108']="'printer-aliases' DESC 'Site-specific administrative names of this printer in addition the printer name specified for printer-name.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1108']="'printer-aliases' DESC 'List of site-specific administrative names of this printer in addition to the value specified for printer-name.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.6.1.4.1.42.2.27.5.1.63']="'sun-printer-bsdaddr' DESC 'Sets the server, print queue destination name and whether the client generates protocol extensions. \"Solaris\" specifies a Solaris print server extension. The value is represented by the following value: server \",\" destination \", Solaris\".' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.63']="'sun-printer-bsdaddr' DESC 'Sets the server, print queue destination name and whether the client generates protocol extensions. \"Solaris\" specifies a Solaris print server extension. The value is represented by the following value: server \",\" destination \", Solaris\".' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.64']="'sun-printer-kvp' DESC 'This attribute contains a set of key value pairs which may have meaning to the print subsystem or may be user defined. Each value is represented by the following: key \"=\" value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.64']="'sun-printer-kvp' DESC 'This attribute contains a set of key value pairs which may have meaning to the print subsystem or may be user defined. Each value is represented by the following: key \"=\" value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.57']="'nisplusTimeZone' DESC 'tzone column from NIS+ timezone table' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.57']="'nisplusTimeZone' DESC 'tzone column from NIS+ timezone table' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.67']="'ipTnetTemplateName' DESC 'Trusted Solaris network template template_name' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.67']="'ipTnetTemplateName' DESC 'Trusted Solaris network template template_name' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.68']="'ipTnetNumber' DESC 'Trusted Solaris network template ip_address' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.68']="'ipTnetNumber' DESC 'Trusted Solaris network template ip_address' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	# obey CLI syntax force option (if any)
	if (( TMPF[SYNTAX] == 1 )); then
		typeset -n MAP=OD
	elif (( TMPF[SYNTAX] == 2 )); then
		typeset -n MAP=EE
	elif (( TMPF[IS_OPENDJ] )); then
		typeset -n MAP=OD
	else
		typeset -n MAP=EE
	fi

	typeset TODO='' OID X
	for OID in ${!MAP[@]}; do
		[[ -n ${OID2ADEF[${OID}]} ]] && continue
		X="${MAP[${OID}]}"
		TODO+='attributetypes: ( '"${OID} NAME ${X}"' )\n'
		OID2ADEF["${OID}"]="${X}"
		X=${X:1}
		X=${X%%"'"*}	# we have no aliases above
		ANAME2OID["${X}"]="${OID}"
	done

	if [[ -z ${TODO} ]]; then
		X='Schema contains all required attribute definitions'
	else
		nextFile add $0
		print 'dn: cn=schema\nchangetype: modify\nadd: attributetypes' \
			"\n${TODO}" >${TMP[FILE]}
		if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.fatal 'Adding attribute definitions to schema failed'
			return 67
		fi
		X='Schema attribute definitions added'
	fi
	showProgress "${X}."
	return 0
}

Man.addFunc update_schema_obj '' '[+NAME?update_schema_obj -  Update DS schema to support Naming Services.]
[+DESCRIPTION?Update the schema of the DS with the objectclasses required for the Solaris Naming Services. It just checks, whether the OID is already defined on the server. If already defined, it is left as is, otherwise added.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bupdate_schema_attr()\b, \bldapmodify\b(1).]
'
function update_schema_obj {
	getDSobjectclasses || return 66

	typeset -A EE=( )
	typeset -A OD=( )
	EE['1.3.6.1.1.1.2.14']="'NisKeyObject' SUP top MUST "'( cn $ nisPublickey $ nisSecretkey ) MAY ( uidNumber $ description )'
	OD['1.3.6.1.1.1.2.14']="'nisKeyObject' SUP top AUXILIARY DESC 'An object with a public and secret key' MUST "'( cn $ nisPublicKey $ nisSecretKey ) MAY ( uidNumber $ description )'" X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.1.1.2.15']="'nisDomainObject' SUP top MUST nisDomain"
	OD['1.3.6.1.1.1.2.15']="'nisDomainObject' SUP top AUXILIARY DESC 'Associates a NIS domain with a naming context' MUST nisDomain X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.1.1.2.16']="'automountMap' SUP top MUST automountMapName MAY description"
	OD['1.3.6.1.1.1.2.16']="'automountMap' SUP top STRUCTURAL MUST ( automountMapName ) MAY description X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.1.1.2.17']="'automount' SUP top MUST "'( automountKey $ automountInformation ) MAY description'
	OD['1.3.6.1.1.1.2.17']="'automount' SUP top STRUCTURAL DESC 'Automount information' MUST "'( automountKey $ automountInformation )'" MAY description X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.4.1.42.2.27.5.2.7']="'SolarisNamingProfile' SUP top MUST "'( cn $ SolarisLDAPservers $ SolarisSearchBaseDN ) MAY ( SolarisBindDN $ SolarisBindPassword $ SolarisAuthMethod $ SolarisTransportSecurity $ SolarisCertificatePath $ SolarisCertificatePassword $ SolarisDataSearchDN $ SolarisSearchScope $ SolarisSearchTimeLimit $ SolarisPreferredServer $ SolarisPreferredServerOnly $ SolarisCacheTTL $ SolarisSearchReferral )'
	OD['1.3.6.1.4.1.42.2.27.5.2.7']="'SolarisNamingProfile' SUP top STRUCTURAL DESC 'Solaris LDAP Naming client profile objectClass' MUST "'( cn $ SolarisLDAPServers $ SolarisSearchBaseDN ) MAY ( SolarisBindDN $ SolarisBindPassword $ SolarisAuthMethod $ SolarisTransportSecurity $ SolarisCertificatePath $ SolarisCertificatePassword $ SolarisDataSearchDN $ SolarisSearchScope $ SolarisSearchTimeLimit $ SolarisPreferredServer $ SolarisPreferredServerOnly $ SolarisCacheTTL $ SolarisSearchReferral $ SolarisBindTimeLimit )'" X-ORIGIN 'Solaris Specific'"

	EE['2.16.840.1.113730.3.2.4']="'mailGroup' SUP top MUST mail MAY "'( cn $ mgrpRFC822MailMember )'
	OD['2.16.840.1.113730.3.2.4']="'mailGroup' SUP top STRUCTURAL MUST mail MAY "'( cn $ mgrpRFC822MailMember )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.1.2.5']="'nisMailAlias' SUP top MUST cn MAY rfc822mailMember"
	OD['1.3.6.1.4.1.42.2.27.1.2.5']="'nisMailAlias' SUP top MUST cn MAY rfc822mailMember X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.1.2.6']="'nisNetId' SUP top MUST cn MAY "'( nisNetIdUser $ nisNetIdGroup $ nisNetIdHost )'
	OD['1.3.6.1.4.1.42.2.27.1.2.6']="'nisNetId' SUP top MUST cn MAY "'( nisNetIdUser $ nisNetIdGroup $ nisNetIdHost )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.2']="'SolarisAuditUser' SUP top AUXILIARY MAY "'( SolarisAuditAlways $ SolarisAuditNever )'
	OD['1.3.6.1.4.1.42.2.27.5.2.2']="'SolarisAuditUser' SUP top AUXILIARY MAY "'( SolarisAuditAlways $ SolarisAuditNever )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.3']="'SolarisUserAttr' SUP top AUXILIARY MAY "'( SolarisUserQualifier $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrKeyValue )'
	OD['1.3.6.1.4.1.42.2.27.5.2.3']="'SolarisUserAttr' SUP top AUXILIARY DESC 'User attributes' MAY "'( SolarisUserQualifier $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.4']="'SolarisAuthAttr' SUP top MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrShortDesc $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'
	OD['1.3.6.1.4.1.42.2.27.5.2.4']="'SolarisAuthAttr' SUP top STRUCTURAL DESC 'Authorizations data' MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrShortDesc $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.5']="'SolarisProfAttr' SUP top MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'
	OD['1.3.6.1.4.1.42.2.27.5.2.5']="'SolarisProfAttr' SUP top STRUCTURAL DESC 'Profiles data' MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.6']="'SolarisExecAttr' SUP top AUXILIARY MAY "'( SolarisKernelSecurityPolicy $ SolarisProfileType $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisProfileID $ SolarisAttrKeyValue )'
	OD['1.3.6.1.4.1.42.2.27.5.2.6']="'SolarisExecAttr' SUP top AUXILIARY DESC 'Profiles execution attributes' MAY "'( SolarisKernelSecurityPolicy $ SolarisProfileType $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisProfileId $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.1']="'SolarisProject' SUP top MUST "'( SolarisProjectID $ SolarisProjectName ) MAY ( memberUid $ memberGid $ description $ SolarisProjectAttr )'
	OD['1.3.6.1.4.1.42.2.27.5.2.1']="'SolarisProject' SUP top STRUCTURAL MUST "'( SolarisProjectID $ SolarisProjectName ) MAY ( memberUid $ memberGid $ description $ SolarisProjectAttr )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.11.1.3.1.2.4']="'DUAConfigProfile' SUP top DESC 'Abstraction of a base configuration for a DUA' MUST cn MAY "'( defaultServerList $ preferredServerList $ defaultSearchBase $ defaultSearchScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel $ authenticationMethod $ followReferrals $ serviceSearchDescriptor $ serviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $ attributeMap $ profileTTL )'
	OD['1.3.6.1.4.1.11.1.3.1.2.5']="'DUAConfigProfile' SUP top STRUCTURAL DESC 'Abstraction of a base configuration for a DUA' MUST "'( cn ) MAY ( defaultServerList $ preferredServerList $ defaultSearchBase $ defaultSearchScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel $ authenticationMethod $ followReferrals $ dereferenceAliases $ serviceSearchDescriptor $ serviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $ attributeMap $ profileTTL )'" X-ORIGIN 'RFC 4876'"

	EE['1.3.18.0.2.6.2549']="'slpService' DESC 'DUMMY definition' SUP top MUST objectclass"
	OD['1.3.6.1.4.1.6252.2.27.6.2.1']="'slpService' DESC 'parent superclass for SLP services' SUP top ABSTRACT MUST  "'( template-major-version-number $ template-minor-version-number $ description $ template-url-syntax $ service-advert-service-type $ service-advert-scopes ) MAY ( service-advert-url-authenticator $ service-advert-attribute-authenticator )'" X-ORIGIN 'RFC 2926'"

	EE['1.3.18.0.2.6.254']="'slpServicePrinter' DESC 'Service Location Protocol (SLP) information.' SUP slpService AUXILIARY"
	OD['1.3.18.0.2.6.254']="'slpServicePrinter' DESC 'Service Location Protocol (SLP) information.' SUP slpService AUXILIARY X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.6.258']="'printerAbstract' DESC 'Printer related information.' SUP top ABSTRACT MAY "'( printer-name $ printer-natural-language-configured $ printer-location $ printer-info $ printer-more-info $ printer-make-and-model $ printer-multiple-document-jobs-supported $ printer-charset-configured $ printer-charset-supported $ printer-generated-natural-language-supported $ printer-document-format-supported $ printer-color-supported $ printer-compression-supported $ printer-pages-per-minute $ printer-pages-per-minute-color $ printer-finishings-supported $ printer-number-up-supported $ printer-sides-supported $ printer-media-supported $ printer-media-local-supported $ printer-resolution-supported $ printer-print-quality-supported $ printer-job-priority-supported $ printer-copies-supported $ printer-job-k-octets-supported $ printer-current-operator $ printer-service-person $ printer-delivery-orientation-supported $ printer-stacking-order-supported $ printer-output-features-supported )'
	OD['1.3.18.0.2.6.258']="'printerAbstract' DESC 'Printer related information.' SUP top ABSTRACT MAY "'( printer-name $ printer-natural-language-configured $ printer-location $ printer-info $ printer-more-info $ printer-make-and-model $ printer-multiple-document-jobs-supported $ printer-charset-configured $ printer-charset-supported $ printer-generated-natural-language-supported $ printer-document-format-supported $ printer-color-supported $ printer-compression-supported $ printer-pages-per-minute $ printer-pages-per-minute-color $ printer-finishings-supported $ printer-number-up-supported $ printer-sides-supported $ printer-media-supported $ printer-media-local-supported $ printer-resolution-supported $ printer-print-quality-supported $ printer-job-priority-supported $ printer-copies-supported $ printer-job-k-octets-supported $ printer-current-operator $ printer-service-person $ printer-delivery-orientation-supported $ printer-stacking-order-supported $ printer-output-features-supported )'" X-ORIGIN 'RFC 3712' )"

	EE['1.3.18.0.2.6.255']="'printerService' DESC 'Printer information.' SUP printerAbstract STRUCTURAL MAY "'( printer-uri $ printer-xri-supported )'
	OD['1.3.18.0.2.6.255']="'printerService' DESC 'Printer information.' SUP printerAbstract STRUCTURAL MAY "'( printer-uri $ printer-xri-supported )'" X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.6.257']="'printerServiceAuxClass' DESC 'Printer information.' SUP printerAbstract AUXILIARY MAY "'( printer-uri $ printer-xri-supported )'
	OD['1.3.18.0.2.6.257']="'printerServiceAuxClass' DESC 'Printer information.' SUP printerAbstract AUXILIARY MAY "'( printer-uri $ printer-xri-supported )'" X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.6.256']="'printerIPP' DESC 'Internet Printing Protocol (IPP) information.' SUP top AUXILIARY MAY "'( printer-ipp-versions-supported $ printer-multiple-document-jobs-supported )'
	OD['1.3.18.0.2.6.256']="'printerIPP' DESC 'Internet Printing Protocol (IPP) information.' SUP top AUXILIARY MAY "'( printer-ipp-versions-supported $ printer-multiple-document-jobs-supported )'" X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.6.253']="'printerLPR' DESC 'LPR information.' SUP top AUXILIARY MUST printer-name MAY printer-aliases"
	OD['1.3.18.0.2.6.253']="'printerLPR' DESC 'LPR information.' SUP top AUXILIARY MUST ( printer-name ) MAY ( printer-aliases ) X-ORIGIN 'RFC 3712'"

	EE['1.3.6.1.4.1.42.2.27.5.2.14']="'sunPrinter' DESC 'Sun printer information' SUP top AUXILIARY MUST printer-name MAY "'( sun-printer-bsdaddr $ sun-printer-kvp )'
	OD['1.3.6.1.4.1.42.2.27.5.2.14']="'sunPrinter' DESC 'Sun printer information' SUP top AUXILIARY MUST printer-name MAY "'(sun-printer-bsdaddr $ sun-printer-kvp)'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.12']="'nisplusTimeZoneData' DESC 'NIS+ timezone table data' SUP top STRUCTURAL MUST cn MAY "'( nisplusTimeZone $ description )'
	OD['1.3.6.1.4.1.42.2.27.5.2.12']="'nisplusTimeZoneData' DESC 'NIS+ timezone table data' SUP top STRUCTURAL MUST cn MAY "'( nisplusTimeZone $ description )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.8']="'ipTnetTemplate' DESC 'Object class for TSOL network templates' SUP top MUST ipTnetTemplateName MAY SolarisAttrKeyValue"
	OD['1.3.6.1.4.1.42.2.27.5.2.8']="'ipTnetTemplate' DESC 'Object class for TSOL network templates' SUP top STRUCTURAL MUST ipTnetTemplateName MAY SolarisAttrKeyValue X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.9']="'ipTnetHost' DESC 'Associates an IP address or wildcard with a TSOL template_name' SUP top AUXILIARY MUST ipTnetNumber"
	OD['1.3.6.1.4.1.42.2.27.5.2.9']="'ipTnetHost' DESC 'Associates an IP address or wildcard with a TSOL template_name' SUP top AUXILIARY MUST ipTnetNumber X-ORIGIN 'Solaris Specific'"

	# obey CLI syntax force option (if any)
	if (( TMPF[SYNTAX] == 1 )); then
		typeset -n MAP=OD
	elif (( TMPF[SYNTAX] == 2 )); then
		typeset -n MAP=EE
	elif (( TMPF[IS_OPENDJ] )); then
		typeset -n MAP=OD
	else
		typeset -n MAP=EE
	fi

	# we need to preserve order, so 2 passes
	typeset TODO='' OID
	for OID in ${!MAP[@]}; do
		[[ -n ${OID2ODEF[${OID}]} ]] && continue
		TODO+="${OID} "
	done

	if [[ -z ${TODO} ]]; then
		X='Schema contains all required objectclass defintions'
	else
		# 2nd pass
		typeset X SORTED
		SORTED=${ print ${TODO// /$'\n'} | sort -n -t. ; }
		TODO='' TODO2=''
		for OID in ${SORTED} ; do
			X="${MAP[${OID}]}"
			OID2ODEF["${OID}"]="${X}"
			# 1.3.18.0.2.6.254 requires 1.3.18.0.2.6.2549
			# 1.3.18.0.2.6.255,1.3.18.0.2.6.257 require 1.3.18.0.2.6.258
			[[ ${OID} == '1.3.18.0.2.6.254' \
				|| ${OID} == '1.3.18.0.2.6.255' \
				|| ${OID} == '1.3.18.0.2.6.257' ]] \
				&& TODO2+='objectclasses: ( '"${OID} NAME ${X}"' )\n' \
				|| TODO+='objectclasses: ( '"${OID} NAME ${X}"' )\n'
		done

		nextFile modify $0
		print 'dn: cn=schema\nchangetype: modify\nadd: objectclasses' \
			"\n${TODO}${TODO2}" >${TMP[FILE]}
		if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.fatal 'Adding objectclass definitions to schema failed'
			return 67
		fi
		X='Schema objectclass definitions added'
	fi

	showProgress "${X}."
	return 0
}

Man.addFunc add_suffix '' '[+NAME?add_suffix - add suffix to DS if needed.]
[+DESCRIPTION?Add a suffix to the DS if needed (\bTMPF[NEED_CREATE_SUFFIX]]\b is set) and optionally create the backend for it (\bTMPF[NEED_CREATE_BACKEND]]\b is set). Suffix entry and backend MUST be prepared by \bprep_create_sfx_entry()\b and \bprep_create_sfx_backend()\b correspondingly to have the following vars set:]{
	[+STR[LDAP_SUFFIX]] ]
	[+STR[DS_DB]] ]
	[+TMP[SUFFIX_OBJ]] ]
	[+TMP[SUFFIX_ATT]] ]
	[+TMP[SUFFIX_VAL]] ]
}
[+RETURN VALUES]{
	[+0?on success (suffix not needed or created successfully).]
	[+1?otherwise (unable to create suffix).]
}
[+SEE ALSO?\bldapadd\b(1), \bdisplay_msg()\b.]
'
function add_suffix {
	if (( ! TMPF[NEED_CREATE_BACKEND] )); then
		showProgress "Database backend exists."
	else
		nextFile add "${0}-backend"
		if (( TMPF[IS_OPENDJ] )); then
			print '
dn: ds-cfg-backend-id='"${STR[DS_DB]}"',cn=Backends,cn=config
ds-cfg-backend-id: '"${STR[DS_DB]}"'
ds-cfg-base-dn: '"${STR[LDAP_SUFFIX]}"'
objectclass: top
objectclass: ds-cfg-backend
objectclass: ds-cfg-local-db-backend
ds-cfg-java-class: org.opends.server.backends.jeb.BackendImpl
ds-cfg-enabled: true
ds-cfg-writability-mode: enabled
ds-cfg-preload-time-limit: 0 ms
ds-cfg-compact-encoding: true
ds-cfg-entries-compressed: false
ds-cfg-index-entry-limit: 4000
ds-cfg-db-directory: db
ds-cfg-db-directory-permissions: 700
ds-cfg-disk-low-threshold: 100 mb
ds-cfg-disk-full-threshold: 20 mb
ds-cfg-db-run-cleaner: true
ds-cfg-db-cleaner-min-utilization: 50
ds-cfg-db-logging-file-handler-on: true
ds-cfg-db-logging-level: CONFIG
ds-cfg-db-log-filecache-size: 100
ds-cfg-db-log-file-max: 10 mb
ds-cfg-db-cache-size: 0 b
ds-cfg-db-cache-percent: 50
ds-cfg-db-evictor-core-threads: 1
ds-cfg-db-evictor-max-threads: 10
ds-cfg-db-evictor-nodes-per-scan: 10
ds-cfg-db-evictor-lru-only: true
ds-cfg-db-evictor-keep-alive: 600 s
ds-cfg-db-txn-no-sync: false
ds-cfg-db-txn-write-no-sync: true
ds-cfg-db-checkpointer-wakeup-interval: 30 s
ds-cfg-db-checkpointer-bytes-interval: 20 mb
'			>${TMP[FILE]}
	else
			print '
dn: cn="'"${STR[LDAP_SUFFIX]}"'",cn=mapping tree,cn=config
objectclass: top
objectclass: extensibleObject
objectclass: nsMappingTree
cn: '"${STR[LDAP_SUFFIX]}"'
nsslapd-state: backend
nsslapd-backend: '"${STR[DS_DB]}"'

dn: cn='"${STR[DS_DB]}"',cn=ldbm database,cn=plugins,cn=config
objectclass: top
objectclass: extensibleObject
objectclass: nsBackendInstance
cn: '"${STR[DS_DB]}"'
nsslapd-suffix: '"${STR[LDAP_SUFFIX]}"'
'				>${TMP[FILE]}
		fi

		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.fatal 'Unable to create backend' "'${STR[DS_DB]}'" \
				'with suffix' "'${STR[LDAP_SUFFIX]}'" 'due to server error.'
			return 1
		fi
		showProgress "Database backend created."
	fi

	if (( ! TMPF[NEED_CREATE_SUFFIX] )); then
		showProgress "Suffix exists."
	else
		nextFile add $0
		print '
dn: '"${STR[LDAP_SUFFIX]}"'
objectclass: top
objectclass: '"${TMP[SUFFIX_OBJ]}"'
'"${TMP[SUFFIX_ATT]}: ${TMP[SUFFIX_VAL]}"'
'		>${TMP[FILE]}
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.warn 'Unable to create entry' "'${STR[LDAP_SUFFIX]}'" 'of' \
				"'${TMP[SUFFIX_OBJ]}'" 'class'
			return 1
		fi
		showProgress "Suffix added."
	fi
	return 0
}

function add_suffix_aci {
	typeset PW_STATE PW_STATE_RO ANY_NO_READ SELF_NO_WRITE
	typeset ADMIN_DN ADMIN_GROUP_DN
	if (( TMPF[IS_OPENDJ] )); then
		# TBD: include Password Policy State extended ops ?

		# password state information aka ds-pwp-*, pwd* and ds-pta-* WITHOUT
		# attrs, which are schema flagged with NO-USER-MODIFICATION
		PW_STATE=' ds-pwp-account-disabled || ds-pwp-account-expiration-time
 || ds-pwp-last-login-time || ds-pwp-password-changed-by-required-time
 || ds-pwp-password-policy-dn || ds-pwp-reset-time || ds-pwp-warned-time
 || ds-privilege-name || pwdReset'
		# password state information flagged with NO-USER-MODIFICATION
		# ds-pwp-password-expiration-time is the same as pwdExpirationTime
		# so save some parse time ;-)
		PW_STATE_RO=' pwdExpirationTime || pwdChangedTime || pwdGraceUseTime
 || pwdFailureTime || pwdHistory || pwdAccountLockedTime'
		# People using PassThroughAuthentication probably wish that too:
		#PW_STATE_RO+='|| ds-pta-cached-password || ds-pta-cached-password-time'

		# passwords + password state
		ANY_NO_READ="userPassword || authPassword ||${PW_STATE}||${PW_STATE_RO}"
		# aci + search limits aka ds-rlim-*  + RW password state/policy
		SELF_NO_WRITE='aci || ds-rlim-idle-time-limit
 || ds-rlim-lookthrough-limit || ds-rlim-size-limit || ds-rlim-time-limit
 || pwdPolicySubentry ||'"${PW_STATE}"
		ADMIN_DN='uid=admin,cn=Administrators'
		ADMIN_GROUP_DN='cn=Administrators'
		ADMIN_DN+=',cn=admin data'
		ADMIN_GROUP_DN+=',cn=admin data'
	else
		# DSEE
		# password state information aka passwordObject
		PW_STATE=' accountUnlockTime || passwordAllowChangeTime
 || passwordExpWarned || passwordExpirationTime || passwordHistory
 || passwordRetryCount || retryCountResetTime'

		# passwords + password state
		ANY_NO_READ="userPassword ||${PW_STATE}"
		# aci + search limits + password state/policy
		SELF_NO_WRITE='aci || nsIdleTimeout || nsLookThroughLimit
 || nsSizeLimit || nsTimeLimit || nsroledn || passwordPolicySubentry
 ||'"${PW_STATE}"
		ADMIN_DN='uid=admin,ou=Administrators'
		ADMIN_GROUP_DN='cn=Configuration Administrators,ou=Groups'
		ADMIN_DN+=',ou=TopologyManagement,o=NetscapeRoot'
		ADMIN_GROUP_DN+=',ou=TopologyManagement,o=NetscapeRoot"'
	fi

	typeset -A RULES=(
		[SFX_ANYONE_ACI_NAME]='aci: (targetattr != "'"${ANY_NO_READ//$'\n'}"'")
 (
	version 3.0;  acl "'"${SFX_ANYONE_ACI_NAME}"'";
	allow (read, search, compare) userdn = "ldap:///anyone";
 )'
		[SFX_SELF_ACI_NAME]='aci: (targetattr != "'"${SELF_NO_WRITE//$'\n'}"'")
 (
	version 3.0;  acl "'"${SFX_SELF_ACI_NAME}"'";
	allow (write) userdn = "ldap:///self";
 )'
		[SFX_ADMIN_ACI_NAME]='aci: (targetattr = "*")
 (
	version 3.0;  acl "'"${SFX_ADMIN_ACI_NAME}"'";
	allow (all) userdn = "ldap:///'"${ADMIN_DN}"'";
 )'
		[SFX_ADMINGRP_ACI_NAME]='aci: (targetattr ="*")
 (
	version 3.0;  acl "'"${SFX_ADMINGRP_ACI_NAME}"'";
	allow (all) groupdn = "ldap:///'"${ADMIN_GROUP_DN}"'";
 )'
	)

	# Check and set if doesn't already exist
	typeset -a LIST=( )
	getACIs LIST "${STR[LDAP_SUFFIX]}"

	for ACI in "${!RULES[@]}" ; do
		typeset -n NAME=${ACI}
		[[ -z ${NAME} ]] && continue	# if it has no name, ignore it
		PATTERN='acl[ ]+"?'"${NAME}"'"?'
		findACI LIST "${NAME}" "${PATTERN}" 'Suffix' || continue	# exists
		nextFile add "${0}-${NAME}"
		print '
dn: '"${STR[LDAP_SUFFIX]}"'
changetype: modify
add: aci
'"${RULES[${ACI}]}"'
'			>${TMP[FILE]}
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.warn "Adding '${NAME}' suffix ACI failed"
			return 1
		fi
		showProgress "Suffix ACI '${NAME}' added."
	done
	return 0
}

Man.addFunc add_base_objects '' '[+NAME?add_base_objects - add possibly missing, necessary base objects.]
[+DESCRIPTION?Determine all RDNs required to form the \bSTR[LDAP_BASEDN]]\b using the suffix \bSTR[LDAP_SUFFIX]]\b (RDN1,RDN2,...,suffix == baseDN) and create the missing entries.]
[+RETURN VALUES]{
	[+0?on success (all entries available or created successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bnormalizeDN()\b, \bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_base_objects {
	# typeset -A STR
	# STR[LDAP_BASEDN]=dc=x,dc=my,dc=do,dc=main,dc=de
	# STR[LDAP_SUFFIX]=dc=do,dc=main,dc=de

	# Convert to lower case for basename.
	typeset LC_DN=','${ normalizeDN "${STR[LDAP_BASEDN]}" l ; }
	typeset LC_SFX=','${ normalizeDN "${STR[LDAP_SUFFIX]}" l ; }

	# first, test that baseDN ends with suffix
	if [[ ${LC_DN: -${#LC_SFX}} != ${LC_SFX} ]]; then
		# should not happen since check_basedn_suffix() succeeded
		Log.fatal "Invalid suffix '${LC_SFX}' for Base DN '${LC_DN}'"
		return 66
	fi
	# Save the stuff before LC_SFX w/o leading ',' -> further called prefix
	LC_DN=${LC_DN:1:${#LC_DN}-${#LC_SFX}-1}

	# Remove redundant spaces around ',' and '=' first from LDAP_BASEDN
	typeset DN=${ normalizeDN ${STR[LDAP_BASEDN]} ; }

	# Now LC_DN and DN differ at most in lower vs. uppercase character and
	# we can get the prefix of the baseDN by just copying corresponding chars
	DN=",${DN:0:${#LC_DN}}"

	if [[ ${DN} == ',' ]]; then
		X='No need to create a DN component (baseDN equals suffix)'
	else
		typeset LAST=${ normalizeDN ${STR[LDAP_SUFFIX]} ; } DC KEY VAL CLASS
		X="Created DN components for ${DN#,}"
		while [[ -n ${DN} ]]; do
		    # Get trailing key=val (DC) from DN and strip it off
			DN=${DN%,*}
			DC="${.sh.match#,}"
			LAST="${DC},${LAST}"
	
			# Check if entry exists first, if so, skip to next.
		    ${LDAPSEARCH} ${CON_ARGS} -b "${LAST}" -s base \
				'objectclass=*' >/dev/null 2>&1  &&  continue
	
			VAL=${DC#*=}
			KEY=${.sh.match%=}
			# Determine the objectclass for the entry.
			CLASS=${ get_objectclass ${KEY} ; }
			if [[ -z ${CLASS} ]]; then
				Log.fatal "Unable to determine objectClass for '${KEY}'." \
					"Please create the following entry and re-run ${PROG}:" \
					"${KEY}=${VAL},${LAST}"
				return 66
			fi

			nextFile add "${0}-${LAST}"
		    print '
dn: '"${LAST}"'
'"${KEY}: ${VAL}"'
objectClass: top
objectClass: '"${CLASS}"'
'				> ${TMP[FILE]}

		    if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]}\
				>&${TMPF[FD]} 2>&1
			then
				Log.fatal "Update of base objects '${DC}' failed"
				return 66
			fi
		done
	fi
	showProgress "${X}."
	return 0
}

Man.addFunc set_nisdomain '' '[+NAME?set_nisdomain - Add the NisDomainObject to the Base DN.]
[+DESCRIPTION?Add a NisDomainObject with nisdomain \bSTR[LDAP_DOMAIN]]\b to the \bSTR[LDAP_BASEDN]]\b unless there is already one.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function set_nisdomain {
	# Check if nisDomain is already set
	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${STR[LDAP_BASEDN]}" \
		-s base 'objectclass=*' 2>/dev/null | \
	while read LINE ; do
		if [[ ${LINE} == ~(Ei)^nisDomain= ]]; then
			showProgress 'NisDomainObject was already set for' \
				"'${STR[LDAP_BASEDN]}'."
			return 0
		fi
	done

	nextFile modify $0
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
objectclass: nisDomainObject
nisdomain: '"${STR[LDAP_DOMAIN]}"'
'		>${TMP[FILE]}

	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal "Update of NisDomainObject in '${STR[LDAP_BASEDN]}' failed"
		return 66
	fi

	showProgress "NisDomainObject added to '${STR[LDAP_BASEDN]}'."
	return 0
}

Man.addFunc add_new_containers '' '[+NAME?add_new_containers - Add top level containers to the base DN.]
[+DESCRIPTION?Add the Name Service Switch top level containers to the \bSTR[LDAP_BASEDN]]\b unless they already exist.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\b/etc/nsswitch.ldap\b, \bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_new_containers {
	typeset OU

	for OU in people group rpc protocols networks netgroup \
		aliases hosts services ethers profile printers projects \
		SolarisAuthAttr SolarisProfAttr Timezone ipTnet
	do
		if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b "ou=${OU},${STR[LDAP_BASEDN]}" -s base 'objectclass=*' \
			>/dev/null 2>&1
		then
			showProgress "'ou=${OU}' exists."
			continue
		fi

		nextFile add "${0}-${OU}"
		print '
dn: ou='"${OU},${STR[LDAP_BASEDN]}"'
ou: '"${OU}"'
objectClass: top
objectClass: organizationalUnit
'			> ${TMP[FILE]}

		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.fatal "Adding 'ou=${OU}' failed"
			return 66
		fi
		showProgress "'ou=${OU}' added."
	done

	return 0
}

Man.addFunc add_auto_maps '' '[+NAME?add_auto_maps - Add the automount map entries.]
[+DESCRIPTION?Add the automount maps \bauto_home\b, \bauto_direct\b, \bauto_master\b, \bauto_shared\b to \bSTR[LDAP_BASEDN]]\b unless they already exist.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_auto_maps {
	# AUTO_MAPS for maps to create
	typeset AUTO_MAPS="auto_home auto_direct auto_master auto_shared" MAP

	for MAP in ${AUTO_MAPS}; do
		# Check if automap already exist
		if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b "automountMapName=${MAP},${STR[LDAP_BASEDN]}" -s base \
			'objectclass=*' >/dev/null 2>&1
		then
			showProgress "'${MAP}' automount exists."
			continue
		fi

		nextFile add "${0}-${MAP}"
		print '
dn: automountMapName='"${MAP},${STR[LDAP_BASEDN]}"'
automountMapName: '"${MAP}"'
objectClass: top
objectClass: automountMap
'			> ${TMP[FILE]}
    
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.fatal "Adding '${MAP}' automount map failed"
			return 66
		fi
		showProgress "'${MAP}' automount added."
	done

	return 0
}

Man.addFunc modify_top_aci '' '[+NAME?modify_top_aci - add a deny self modify ACI.]
[+DESCRIPTION?Add the ACI \bUSER_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b to disable self modify of user attributes like uid, uidNumber, gidNumber, shadowExpire, etc. This does nothing if an ACI with the same name already exists for this entry.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage USER_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (ACI already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfindACI()\b, \bldapmodify\b(1).]
'
function modify_top_aci {
	typeset PATTERN

	typeset -a LIST=( )
	getACIs LIST || return 66

    # check, whether ACI already exists
	PATTERN='acl[ ]+"?('"${USER_ACI_NAME}|${USER_ACI_NAME// /_}"')"?'
	findACI LIST "${USER_ACI_NAME}" "${PATTERN}" || return 0	# exists

	# Create LDIF for top level ACI
	nextFile modify $0
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: (targetattr = "cn || uid || uidNumber || gidNumber || homeDirectory || shadowLastChange || shadowMin || shadowMax || shadowWarning || shadowInactive || shadowExpire || shadowFlag || memberUid || SolarisAttrKeyValue || SolarisAttrReserved1 || SolarisAttrReserved2 || SolarisUserQualifier")
 (
	version 3.0;  acl "'"${USER_ACI_NAME}"'";
	deny (write) userdn = "ldap:///self";
 )
'		> ${TMP[FILE]}

	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal 'Deny user to change non-password attributes failed'
		return 66
	fi

	showProgress "Self modify for non-password attributes disabled."
	return 0
}

Man.addFunc add_vlv_aci '' '[+NAME?add_vlv_aci - Add ACI for VLV.]
[+DESCRIPTION?Add the global ACI to allow everyone read-only access to VLVs.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage VLV_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (ACI added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function add_vlv_aci {
	# VLV Request = 2.16.840.1.113730.3.4.9
	typeset RULE='version 3.0;  acl "'"${VLV_ACI_NAME}"'";\n\t'
	RULE+='allow (read,search,compare) userdn = "ldap:///anyone";'
	typeset DN='oid=2.16.840.1.113730.3.4.9,cn=features,cn=config'
	(( TMPF[IS_OPENDJ] )) && DN='cn=Access Control Handler,cn=config'

	typeset -a LIST=( )
	getACIs LIST "${DN}" 'Global' || return 66

	PATTERN='acl[ ]+"?('"${VLV_ACI_NAME}|${VLV_ACI_NAME// /_}"')"?'
	findACI LIST "${VLV_ACI_NAME}" "${PATTERN}" 'Global' || return 0

	nextFile modify $0
	if (( TMPF[IS_OPENDJ] )); then
		print '
dn: '"${DN}"'
changetype: modify
add: ds-cfg-global-aci
ds-cfg-global-aci: (targetcontrol = "2.16.840.1.113730.3.4.9")(targetattr != "aci")
 (
	'"${RULE}"'
 )
'		> ${TMP[FILE]}
	else
		print '
dn: '"${DN}"'
changetype: modify
replace: aci
aci: (targetattr != "aci")
 (
	'"${RULE}"'
 )
'		> ${TMP[FILE]}
	fi

	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal "Adding '${VLV_ACI_NAME}' global ACI failed"
		return 66
	fi

	showProgress "Global ACI '${VLV_ACI_NAME}' added."
	return 0
}

Man.addFunc add_proxyagent '' '[+NAME?add_proxyagent - Add proxy agent user to DS.]
[+DESCRIPTION?Add the proxy agent user \bSTR[LDAP_PROXYAGENT]]\b to the DS unless it already exists to allow nameservice access to the server.]
[+RETURN VALUES]{
	[+0?on success (entry already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function add_proxyagent {
	# Check if proxy agent already exists
	if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-b "${STR[LDAP_PROXYAGENT]}" -s base 'objectclass=*' >/dev/null 2>&1
	then
		showProgress "Proxyagent identity exists."
		return 0
	fi

	# Get cn and sn names from LDAP_PROXYAGENT.
	typeset NAME="${STR[LDAP_PROXYAGENT]%%,*}"
	NAME=${NAME#*=}

	# Add the entry
	nextFile add $0
	print '
dn: '"${STR[LDAP_PROXYAGENT]}"'
cn: '"${NAME}"'
sn: '"${NAME}"'
objectclass: top
objectclass: person
userpassword: '"${STR[LDAP_PROXYAGENT_CRED]}"'
'		> ${TMP[FILE]}
    
	if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal 'Adding proxyagent identity failed'
		return 66
	fi

	showProgress 'Proxyagent identity added.'
	return 0
}

Man.addFunc add_entry_by_DN '' '[+NAME?add_entry_by_DN - Add an ldif file by DN.]
[+DESCRIPTION?Add the entries in the given LDIF \afile\a to the DS unless a base entry for \aDN\a already exists.]
[+RETURN VALUES]{
	[+0?on success (\aDN\a already exists or added successfully).]
	[+1?on error (failed to add entries).]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapadd\b(1).]
\n\n\aDN\a \afile\a
'
function add_entry_by_DN {
	if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "$1" -s base \
		'objectclass=*' >/dev/null 2>&1
	then
		showProgress "'${1}' exists."
		return 0
    fi
	if ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f "$2" >&${TMPF[FD]} 2>&1
	then
		showProgress "'${1}' added."
		return 0
	fi
	Log.fatal "Adding '${1}' failed"
	return 1
}

Man.addFunc add_id_mapping_rules '' '[+NAME?add_id_mapping_rules - Add Kerberos principal to DN mapping rules to the DS.]
[+DESCRIPTION?Add GSSAPI identity mapping rules for host credentails and user credentials to the DS config unless they already exists. Hosts are matched against \b*.STR[LDAP_DOMAIN]]@STR[LDAP_KRB_REALM]]\b and ou=hosts in \bSTR[LDAP_BASEDN]]\b, users against \b*.@STR[LDAP_KRB_REALM]]\b and uid=$1,ou=People in \bSTR[LDAP_BASEDN]]\b.]
[+SEE ALSO?\badd_entry_by_DN()\b.]
'
function add_id_mapping_rules {
	Log.info 'Adding Kerberos principal to DN mapping rules ...'
	typeset C_DN='cn=GSSAPI,cn=identity mapping,cn=config' OC='nsContainer'
	if (( TMPF[IS_OPENDJ] )); then
		# we create a new branch instead of reusing the default, possibly unused
		# 'cn=Regular Expression,cn=Identity Mappers,cn=config' GSSAPI ID mapper
		C_DN='cn=GSSAPI,cn=Identity Mappers,cn=config'
		OC='ds-cfg-branch'
	fi

	nextFile add "${0}-krbPrincipal"
	print '
dn: cn='"${C_DN}"'
objectClass: top
objectClass: '"${OC}"'
cn: GSSAPI
'		> ${TMP[FILE]}
	add_entry_by_DN "${C_DN}" ${TMP[FILE]} || return

	typeset H_CN="host_auth_${STR[LDAP_KRB_REALM]}"
	typeset H_DN="cn=${H_CN}, ${C_DN}"
	nextFile add "${0}-krbHostAuth"
	if (( TMPF[IS_OPENDJ] )); then
		print '
# For now (2.6.0) OpenDJ supports a single-valued ds-cfg-identity-mapper, only.
# So either you merge this and the next Identity Mapper to something more useful
# together or just enable one of them until it gets fixed. For more information
# see https://bugster.forgerock.org/jira/browse/OPENDJ-521
dn: '"${H_DN}"'
cn: '"${H_CN}"'
objectClass: top
objectClass=ds-cfg-identity-mapper
objectClass=ds-cfg-regular-expression-identity-mapper
ds-cfg-java-class=org.opends.server.extensions.RegularExpressionIdentityMapper
ds-cfg-enabled=false
ds-cfg-match-base-dn=ou=hosts,'"${STR[LDAP_BASEDN]}"'
ds-cfg-match-pattern=host\/(.*).'"${STR[LDAP_DOMAIN]}@${STR[LDAP_KRB_REALM]}"'
ds-cfg-replace-pattern=$1
ds-cfg-match-attribute=cn
'		> ${TMP[FILE]}
	else
		print '
dn: '"${H_DN}"'
objectClass: top
objectClass: nsContainer
objectClass: dsIdentityMapping
objectClass: dsPatternMatching
cn: '"${H_CN}"'
dsMatching-pattern: ${Principal}
dsMatching-regexp: host\/(.*).'"${STR[LDAP_DOMAIN]}@${STR[LDAP_KRB_REALM]}"'
dsSearchBaseDN: ou=hosts,'"${STR[LDAP_BASEDN]}"'
dsSearchFilter: (&(objectClass=ipHost)(cn=$1))
dsSearchScope: one
'		> ${TMP[FILE]}
	fi
	add_entry_by_DN "${H_DN}" ${TMP[FILE]}

	typeset U_CN="user_auth_${STR[LDAP_KRB_REALM]}"
	typeset U_DN="cn=${U_CN}, ${C_DN}"
	nextFile add "${0}-krbUserAuth"
	if (( TMPF[IS_OPENDJ] )); then
		print '
dn: '"${U_DN}"'
cn: '"${U_CN}"'
objectClass: top
objectClass=ds-cfg-identity-mapper
objectClass=ds-cfg-regular-expression-identity-mapper
ds-cfg-java-class=org.opends.server.extensions.RegularExpressionIdentityMapper
ds-cfg-enabled=true
ds-cfg-match-base-dn=ou=People,'"${STR[LDAP_BASEDN]}"'
ds-cfg-match-pattern=(.*)@'"${STR[LDAP_KRB_REALM]}"'
ds-cfg-replace-pattern=$1
ds-cfg-match-attribute=uid
'		> ${TMP[FILE]}
	else
		print '
dn: '"${U_DN}"'
objectClass: top
objectClass: nsContainer
objectClass: dsIdentityMapping
objectClass: dsPatternMatching
cn: '"${U_CN}"'
dsMatching-pattern: ${Principal}
dsMatching-regexp: (.*)@'"${STR[LDAP_KRB_REALM]}"'
dsMappedDN: uid=$1,ou=People,'"${STR[LDAP_BASEDN]}"'
'		> ${TMP[FILE]}
	fi
	add_entry_by_DN "${U_DN}" ${TMP[FILE]}
}

Man.addFunc modify_userpassword_acl_for_gssapi '' '[+NAME?modify_userpassword_acl_for_gssapi - Allow hosts and user to read password(s).]
[+DESCRIPTION?Modify ACL to allow hosts to read all and a user to read its own password only, when sasl/GSSAPI bind is used.]
[+RETURN VALUES]{
	[+0?on success (entries already exist or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\badd_entry_by_DN()\b.]
'
function modify_userpassword_acl_for_gssapi {
	typeset P_DN="ou=People,${STR[LDAP_BASEDN]}"
	typeset H_DN="ou=Hosts,${STR[LDAP_BASEDN]}"

	if ! ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${P_DN}" -s base \
		'objectclass=*' > /dev/null 2>&1
	then
		Log.verbose "'${P_DN}' does not exist"

		nextFile add $0
		print '
dn: '"${P_DN}"'
ou: People
objectClass: top
objectClass: organizationalUnit
'			> ${TMP[FILE]}

		add_entry_by_DN "${P_DN}" ${TMP[FILE]}
	else 
		Log.verbose "'${P_DN}' already exists"
	fi
	typeset TARGET='userPassword' PATTERN
	(( TMPF[IS_OPENDJ] )) && TARGET+=' || authPassword'

	typeset -A RULES=(
		[SELF_GSS_ACI_NAME]='aci: (targetattr = "'"${TARGET}"'")
 (
	version 3.0;  acl self-read-pwd;
	allow (read,search) userdn="ldap:///self" and authmethod="sasl GSSAPI";
 )'
		[HOST_GSS_ACI_NAME]='aci: (targetattr = "'"${TARGET}"'")
 (
	version 3.0;  acl host-read-pwd;
	allow (read,search) userdn="ldap:///cn=*+ipHostNumber=*,ou=Hosts,'"${STR[LDAP_BASEDN]}"'" and authmethod="sasl GSSAPI";
 )'
	)

	typeset -a LIST=( )
	getACIs LIST "${P_DN}" || return 66

	for ACI in "${!RULES[@]}" ; do
		typeset -n NAME=${ACI}
		[[ -z ${NAME} ]] && continue	# if it has no name, ignore it
		PATTERN='acl[ ]+"?'"${NAME}"'"?'
		findACI LIST "${NAME}" "${PATTERN}" 'ou=people' || continue	# exists
		nextFile add "${0}-${NAME}"
		print '
dn: '"${P_DN}"'
changetype: modify
add: aci
'"${RULES[${ACI}]}"'
'			> ${TMP[FILE]}

		if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.warn "Adding '${NAME}' ou=people ACI failed."
			return 67
		fi
		showProgress "ou=people ACI '${NAME}' added."
	done
	return 0
}

Man.addFunc add_profile '' '[+NAME?add_profile - Add client profile to server.]
[+DESCRIPTION?Generates a client profile and adds it to the DS as "\bcn=STR[LDAP_PROFILE_NAME]],ou=profile,STR[LDAP_BASEDN]]\b" unless it already exists and \bTMPF[DEL_OLD_PROFILE]]\b is not set. Other profile related variables are:]{
	[+?STR[LDAP_SERVER_LIST]] ]
	[+?STR[LDAP_SEARCH_SCOPE]] ]
	[+?STR[LDAP_CRED_LEVEL]] ]
	[+?STR[LDAP_AUTHMETHOD]] ]
	[+?INT[LDAP_FOLLOWREF]] ]
	[+?INT[LDAP_SEARCH_TIME_LIMIT]] ]
	[+?INT[LDAP_PROFILE_TTL]] ]
	[+?INT[LDAP_BIND_LIMIT]] ]
	[+?STR[LDAP_PREF_SRVLIST]] ]
	[+?STR[LDAP_SRV_AUTHMETHOD_PAM]] ]
	[+?STR[LDAP_SRV_AUTHMETHOD_KEY]] ]
	[+?STR[LDAP_SRV_AUTHMETHOD_CMD]] ]
	[+?SSD]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage INT STR SSD ; }" '}
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?fatal error.]
}
[+SEE ALSO?\bldapclient\b(1M), \bldapdelete\b(1), \bldapmodify\b(1).]
'
function add_profile {
	# If profile name already exists, DELETE it, and add new one
	if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-b "cn=${STR[LDAP_PROFILE_NAME]},ou=profile,${STR[LDAP_BASEDN]}" \
		-s base 'objectclass=*' >/dev/null 2>&1
	then
		if (( ! TMPF[DEL_OLD_PROFILE] )); then
			Log.fatal "Adding client profile name '${STR[LDAP_PROFILE_NAME]}'" \
				'failed (entry already exists)'
			return 66
		fi

		nextFile delete $0
		print "cn=${STR[LDAP_PROFILE_NAME]},ou=profile,${STR[LDAP_BASEDN]}" \
			>${TMP[FILE]}
		if ! ${LDAPDELETE} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.fatal 'Attempt to DELETE old client profile' \
				"'${STR[LDAP_PROFILE_NAME]}' failed"
			return 67
		fi
	fi

	# Build the "ldapclient genprofile" command string to execute
	typeset -a ARG=( )
	ARG+=( genprofile '-a' "profileName=${STR[LDAP_PROFILE_NAME]}" )

	# Add required argument defaultSearchBase
	ARG+=( -a "defaultSearchBase=${STR[LDAP_BASEDN]}" )

	# Add optional parameters
	[[ -n ${STR[LDAP_SERVER_LIST]} ]] && \
		ARG+=( -a "defaultServerList=${STR[LDAP_SERVER_LIST]}" )
	[[ -n ${STR[LDAP_SEARCH_SCOPE]} ]] && \
		ARG+=( -a "defaultSearchScope=${STR[LDAP_SEARCH_SCOPE]}" )
	[[ -n ${STR[LDAP_CRED_LEVEL]} ]] && \
		ARG+=( -a "credentialLevel=${STR[LDAP_CRED_LEVEL]}" )
	[[ -n ${STR[LDAP_AUTHMETHOD]} ]] && \
		ARG+=( -a "authenticationMethod=${STR[LDAP_AUTHMETHOD]}" )
    (( INT[LDAP_FOLLOWREF] )) && X='TRUE"' || X='FALSE"'
	ARG+=( -a "followReferrals=${X}" )
	(( INT[LDAP_SEARCH_TIME_LIMIT] )) && \
		ARG+=( -a "searchTimeLimit=${INT[LDAP_SEARCH_TIME_LIMIT]}" )
	(( INT[LDAP_PROFILE_TTL] )) && \
		ARG+=( -a "profileTTL=${INT[LDAP_PROFILE_TTL]}" )
	[[ -n ${INT[LDAP_BIND_LIMIT]} ]] && \
		ARG+=( -a "bindTimeLimit=${INT[LDAP_BIND_LIMIT]}" )
	[[ -n ${STR[LDAP_PREF_SRVLIST]} ]] && \
		ARG+=( -a "preferredServerList=${STR[LDAP_PREF_SRVLIST]}" )
	[[ -n ${STR[LDAP_SRV_AUTHMETHOD_PAM]} ]] && \
		ARG+=(-a "serviceAuthenticationMethod=${STR[LDAP_SRV_AUTHMETHOD_PAM]}")
	[[ -n ${STR[LDAP_SRV_AUTHMETHOD_KEY]} ]] && \
		ARG+=(-a "serviceAuthenticationMethod=${STR[LDAP_SRV_AUTHMETHOD_KEY]}")
	[[ -n ${STR[LDAP_SRV_AUTHMETHOD_CMD]} ]] && \
		ARG+=(-a "serviceAuthenticationMethod=${STR[LDAP_SRV_AUTHMETHOD_CMD]}")

	# Add SSDs
	typeset X
	for X in "${SSD[@]}" ; do
		ARG+=( -a "serviceSearchDescriptor=${X}" )
	done

    # Execute "ldapclient genprofile" to create profile
	nextFile add $0
	if ! ${LDAPCLIENT} "${ARG[@]}" >${TMP[FILE]} 2>${TMP[DIR]}/gen_profile.err
	then
		Log.fatal 'ldapclient genprofile failed'
		return 68
	fi

	# Add the generated profile
	if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		log.fatal 'Attempt to add profile failed!'
		return 69
	fi

	showProgress 'Client profile generated and pushed to the DS.'
	return 0
}

Man.addFunc checkTaskCompletion '' '[+NAME?checkTaskCompletion - Wait and check completion of a DS task.]
[+DESCRIPTION?Checks the state of the DS task with the given \adn\a periodically until it got stopped due to an error or has been finished successfully, or the timeout has been hit. Timeout is an integer and specifies the number of seconds to max. wait for completion. If not given or invalid 60 will be used instead.]
[+RETURN VALUES]{
	[+0?on success.]
	[+1?task failed.]
	[+2?timeout has been hit, task not yet finished or has an unknown state.]
}
[+See Also?\bldapsearch\b(1)]
\n\n\adn\a [\atimeout\a]
'
function checkTaskCompletion {
	typeset DN="$1" STATUS='nstaskstatus=' TASKID X
	integer TIMEOUT=${2:-${INT[TASK_TIMEOUT]}} RESULT=2 SEEN
	(( TIMEOUT < 10 )) && TIMEOUT=60
	(( TMPF[IS_OPENDJ] )) && STATUS='ds-task-state='
	TASKID=${DN%%,*}
	# Wait for task to finish, display current status.
	while (( TIMEOUT > 0 )) ; do
		SEEN=0 X=''
		${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b "${DN}" -s base 'objectclass=*' ${STATUS%=} 2>/dev/null | \
		while read LINE ; do
			[[ ${LINE%%,*} == ${TASKID} ]] && SEEN=1 && continue
			[[ -z ${X} && ${LINE:0:${#STATUS}} == ${STATUS} ]] && \
				X=${LINE:${#STATUS}}
		done
		(( ! SEEN )) && break	# an error occured
		print -n '.'
		[[ ${X} =~ Finished || ${X} == 'COMPLETED_SUCCESSFULLY' ]] && \
			RESULT=0 && break
		[[ ${X:0:12} == 'Index failed' || ${X:016} == 'STOPPED_BY_ERROR' ]] && \
			RESULT=1 && break
		sleep 1
		(( TIMEOUT-=1 ))
	done
	# DSEE removes non-recurring tasks automagically, OpenDJ not
	(( RESULT < 2 && TMPF[IS_OPENDJ] )) && \
		${LDAPDELETE} ${CON_ARGS} "${AUTH_ARGS[@]}" "${DN}" >&${TMPF[FD]} 2>&1
	return ${RESULT}
}

Man.addFunc rebuildIndex '' '[+NAME?rebuildIndex - Rebuild a single index.]
[+DESCRIPTION?Instruct the DS to rebuild the index with the name \aname\a. If the \aname\a starts with "vlv." it indicates a Virtual List View, which is supported for OpenDJ, only. Wrt. to OpenDJ and VLVs a return code of \b0\b does not necessaryly mean, that the index is finally in a non-degraded state. It just means, the task has been executed successfully.]
[+RETURN VALUES]{
	[+0?on success.]
	[+1?if a VLV index was specified, but the current DS is != OpenDJ/OpenDS.]
	[+2?if the task failed or did not complete within 60 seconds.]
	[+66?if scheduling a rebuild task on the DS failed.]
}
[+SEE ALSO?\bcheckTaskCompletion()\b, \bldapsearch\b(1), \bldapmodify\b(1).]
\n\n\aname\a
'
function rebuildIndex {
	typeset IDX=$1
	TASKNAME=${IDX}_${ date "+%Y_%m_%d_%H_%M_%S" ; }

	if [[ ${IDX:0:4} == 'vlv.' ]] && (( ! TMPF[IS_OPENDJ] )) ; then
		Log.warn 'Non-OpenDJ/OpenDS servers do not support VLV rebuildTasks'
		return 1
	fi

	nextFile add "${0}-task-${TASKNAME}"
	if (( TMPF[IS_OPENDJ] )); then
		# NOTE: rebuildTask requires ldif-import LDAP privilege.
		# It's a little bit inefficient: one could schedule a single task at
		# the end of the function and use 'rebuildall' or a space separated
		# list of all attributes in ds-task-rebuild-index to do it at once.
		DN='ds-task-id='"${TASKNAME}"',cn=Scheduled Tasks,cn=Tasks'
		print '
# rebuild-index --index '"${IDX}"' --baseDN '"${STR[LDAP_BASEDN]}"' \
#	 '"${CON_ARGS} ${AUTH_ARGS[@]}"' -X

dn: '"${DN}"'
ds-task-id: '"${TASKNAME}"'
objectClass: top
objectClass: ds-task
objectClass: ds-task-rebuild
ds-task-class-name: org.opends.server.tasks.RebuildTask
ds-task-rebuild-base-dn: '"${STR[LDAP_SUFFIX]}"'
ds-task-rebuild-index: '"${IDX}"'
#ds-task-rebuild-tmp-directory:
'		> ${TMP[FILE]}
	else
		DN='cn='"${TASKNAME}"',cn=index,cn=tasks,cn=config'
		print '
dn: '"${DN}"'
cn: '"${TASKNAME}"'
objectclass: top
objectclass: extensibleObject
nsInstance: '"${STR[DS_DB]}"'
nsIndexAttribute: '"${IDX}"'
'		> ${TMP[FILE]}
	fi

	if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
		>&${TMPF[FD]} 2>&1
	then
		Log.fatal "Adding task for '${IDX}' failed"
		return 66
	fi

	checkTaskCompletion "${DN}" && print "" || { Log.warn 'FAILED'; return 2; }
	return 0
}

Man.addFunc add_indexes '' '[+NAME?add_indexes - Add indexes.]
[+DESCRIPTION?Add indexes of the given \atypes\a (e.g. "pres eq") for the given \aattributes\a (e.g. "uidNumber gidnumber") and schedule corresponding tasks to actually create the indexes unless they already exist. Both arguments are handle as a whitespace separated list.]
[+RETURN VALUES]{
	[+-1?syntax error (insufficient parameters).]
	[+0?on success.]
	[+>= 66?fatal error.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
\n\n\atypes\a \aattributes\a
'
function add_indexes {
	if [[ -z ${STR[DS_DB]} ]]; then
		get_backend || return 66
	fi
	[[ -z $1 || -z $2 ]] && Log.warn "${.sh.fun}(): syntax error" && return -1

	typeset -l TYPES=${1//,/ }		# we allow comma separated lists as well
	typeset IDX=${2//,/ }

    Log.verbose "Processing '${TYPES// /,}' indexes ..."

	typeset DN="cn=index,cn=${STR[DS_DB]},cn=ldbm database,cn=plugins,cn=config"
	typeset LTYPE="nsIndexType: ${TYPES// /$'\n'nsIndexType: }"
	typeset ATTR='cn' OC='extensibleObject' DST TASKNAME LINE X
	integer SEEN
	if (( TMPF[IS_OPENDJ] )); then
		OC='ds-cfg-branch'
		DN="cn=Index,ds-cfg-backend-id=${STR[DS_DB]},cn=Backends,cn=config"
		ATTR='ds-cfg-attribute'
		LTYPE=''
		for X in ${TYPES}; do
			[[ $X == 'eq' ]] && LTYPE+='ds-cfg-index-type: equality\n'
			[[ $X == 'pres' ]] && LTYPE+='ds-cfg-index-type: presence\n'
			[[ $X == 'sub' ]] && LTYPE+='ds-cfg-index-type: substring\n'
		done
	fi

	# check, whether Index container exists - if not, create it
	if ! ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${DN}" \
		-s base 'objectclass=*' > /dev/null 2>&1
	then
		nextFile add $0
		X=${DN%%,*}
		print '
dn: '"${DN}"'
objectClass: top
objectClass: '"${OC}"'
cn: '"${X#*=}"'
'		>${TMP[FILE]}
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.fatal 'Failed to add backend Index base'
			return 66
		fi
	fi

	for DST in ${IDX} ; do
		# Check if entry exists first. If so, skip to next
		if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b "${ATTR}=${DST},${DN}" -s base 'objectclass=*' > /dev/null 2>&1
		then
			showProgress "'${DST}' index exists."	
			continue
		fi

		nextFile add "${0}-${DST}"
		if (( TMPF[IS_OPENDJ] )); then
			X=${LTYPE//'\n'/ }
			X=${X//: /:}
			print '
# dsconfig create-local-db-index '"${CON_ARGS} ${AUTH_ARGS[@]}"' -X \
#	'"${X//ds-cfg-/--set }"' \
#	--backend-name '"${STR[DS_DB]}"' --index-name '"${DST}"'

dn: ds-cfg-attribute='"${DST},${DN}"'
ds-cfg-attribute: '"${DST}"'
objectClass: top
objectClass: ds-cfg-local-db-index
'"${LTYPE}"'
'			> ${TMP[FILE]}
		else
			print '
dn: cn='"${DST},${DN}"'
objectClass: top
objectClass: nsIndex
cn: '"${DST}"'
nsSystemIndex: false
'"${LTYPE}"'
'			> ${TMP[FILE]}
		fi
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.fatal "Adding '${DST}' backend index failed"
			return 67
		fi
		showProgress "'${DST}' backend index added."
		rebuildIndex ${DST}
	done
	return 0
}

Man.addFunc add_eq_indexes '' '[+NAME?add_eq_indexes - Add indexes of type pres and eq.]
[+DESCRIPTION?Add eq,pres indexes and schedule corresponding tasks to actually create the indexes unless they already exist.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?fatal error.]
}
[+SEE ALSO?\badd_indexes()\b.]
'
function add_eq_indexes {
	add_indexes "pres eq" \
		"uidNumber ipNetworkNumber gidnumber oncrpcnumber automountKey"
}

Man.addFunc add_sub_indexes '' '[+NAME?add_sub_indexes - Add indexes of type pres, eq and sub.]
[+DESCRIPTION?Add eq,pres,sub indexes and schedule corresponding tasks to actually create the indexes unless they already exist.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?fatal error.]
}
[+SEE ALSO?\badd_indexes()\b.]
'
function add_sub_indexes {
	add_indexes "pres eq sub" \
		"ipHostNumber membernisnetgroup nisnetgrouptriple"
}

Man.addFunc add_vlv_indexes_OpenDJ '' '[+NAME?add_vlv_indexes_OpenDJ - Add VLV indexes to OpenDS/OpenDJ.]
[+DESCRIPTION?OpenDS/OpenDJ specialized part of \badd_vlv_indexes()\b (pulled out for easier maintenance).]
[+SEE ALSO?\badd_vlv_indexes()\b, https://blogs.oracle.com/kanthi/entry/ldap_paged_results_more]
[+NOTES?\bpagedResultsControl\b and \bVLV\b is per default allowed for authenticated users, only. To check, try something like this:]{
	[+?ldapsearch -r -j /tmp/pw -D "cn=Directory Manager" -h ldaphost \]
	[+?	-b "cn=Access Control Handler,cn=config" "objectclass=*" | \]
	[+?	egrep "1.2.840.113556.1.4.319|2.16.840.1.113730.3.4.9"]
}
\n\n\avname\a \afile\a
'
function add_vlv_indexes_OpenDJ {
	typeset -n INDEX_TABLE=$1
	typeset OUT="$2" ENTRY IDX_NAME CN SCOPE='single-level' BASE FILTER

	[[ ${STR[LDAP_SEARCH_SCOPE]} == sub ]] && SCOPE='subordinate-subtree'
	BACKEND="cn=VLV Index,ds-cfg-backend-id=${STR[DS_DB]},cn=Backends,cn=config"

	# check, whether VLV Index container exists - if not, create it
	if ! ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${BACKEND}" \
		-s base 'objectclass=*' > /dev/null 2>&1
	then
		nextFile add $0
		print '
dn: '"${BACKEND}"'
objectClass: top
objectClass: ds-cfg-branch
cn: VLV Index
'			>${TMP[FILE]}
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.fatal 'Adding VLV Index base'
			return 66
		fi
	fi

	integer COUNT=0
    # create index entries
    for ENTRY in "${INDEX_TABLE[@]}" ; do
		typeset -a F=( ${ENTRY} )					# split columns
		
		IDX_NAME="${STR[LDAP_DOMAIN]}.get${F[0]}"
		BASE="ou=${F[2]},${STR[LDAP_BASEDN]}"
		[[ ${F[2]} =~ = ]] && BASE="${BASE:3}"		# cut out ou=
		FILTER="objectClass=${F[3]}"
		[[ ${F[3]:0:1} == '&' ]] && FILTER="&(objectClass=${F[3]:2}"

		if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -s base \
			-b "ds-cfg-name=${IDX_NAME},${BACKEND}" 'objectclass=*' \
			> /dev/null 2>&1
		then
			showProgress "'${IDX_NAME}' VLV index exists."
			continue
		fi

		nextFile add "${0}-${IDX_NAME}"
		print '
# dsconfig create-local-db-vlv-index '"${CON_ARGS} ${AUTH_ARGS[@]}"' -X \
#	--backend-name "'"${STR[DS_DB]}"'" \
#	--set "base-dn:'"${BASE}"'" \
#	--index-name '"${IDX_NAME}"' --set "sort-order:cn uid" \
#	--set "scope:'"${SCOPE}"'" --set "filter:'"${FILTER}"'"

dn: ds-cfg-name='"${IDX_NAME},${BACKEND}"'
objectClass: top
objectClass: ds-cfg-local-db-vlv-index
ds-cfg-name: '"${IDX_NAME}"'
ds-cfg-base-dn: '"${BASE}"'
ds-cfg-scope: '"${SCOPE}"'
ds-cfg-filter: '"${FILTER}"'
ds-cfg-sort-order: cn uid
aci: (targetattr = "*")
 (
    version 3.0;  acl "Config";
    allow (read,search,compare) userdn="ldap:///anyone";
 )
'		> ${TMP[FILE]}

		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.fatal "Adding '${IDX_NAME}' VLV index failed"
			return 67
		fi
		showProgress "'${IDX_NAME}' VLV index added."

		if rebuildIndex "vlv.${IDX_NAME}" ; then
			(( COUNT++ ))
		else
			print "rebuild-index -b '${STR[LDAP_SUFFIX]}' " \
				"--index 'vlv.${IDX_NAME}'" >>${OUT}
		fi
	done
	if (( COUNT )); then
		# Bug or feature: Even if scheduled as task, VLV idx rebuild leaves
		# the index in degraded state. So:
		showProgress 'Rebuilding degraded indexes.'
		if ! rebuildIndex rebuilddegraded ; then
			print "svcadm disable opendj@VERS@\n" \
				"rebuild-index -b '${STR[LDAP_SUFFIX]}' --rebuildDegraded\n" \
				"svcadm enable opendj@VERS@"
				>>${OUT}
		fi
	fi
}

Man.addFunc add_vlv_indexes_DSEE '' '[+NAME?add_vlv_indexes_DSEE - Add VLV indexes to DSEE.]
[+DESCRIPTION?DSEE specialized part of \badd_vlv_indexes()\b (pulled out for easier maintenance).]
[+SEE ALSO?\b\badd_vlv_indexes()\b.]
\n\n\avname\a \afile\a
'
function add_vlv_indexes_DSEE {
	typeset -n INDEX_TABLE=$1
	typeset OUT="$2" ENTRY IDX_NAME CN SCOPE=1 BASE FILTER

	typeset INFO=( ${TMP[DS_INFO]} )
	integer MAJOR=${INFO[${#INFO[@]}-2]}
	typeset INSTANCE="@serverInstance@" LINE
	${LDAPSEARCH} -v ${CON_ARGS} "${AUTH_ARGS[@]}" -b 'cn=config' \
		-s base 'objectclass=*' nsslapd-instancedir 2>/dev/null | \
	while read LINE ; do
		[[ ${LINE:0:20} == 'nsslapd-instancedir=' ]] && LINE=${LINE:20} && break
	done
	if (( MAJOR < 6 )); then
		# DSEE 5.x only. 
		[[ ${LINE} =~ slapd- ]] && LINE=${LINE#*/} && INSTANCE=${LINE#*-}
	else
		# 6+ - the instance path
		INSTANCE="${LINE}"
	fi
	[[ ${STR[LDAP_SEARCH_SCOPE]} == sub ]] && SCOPE=2
	BACKEND="cn=${STR[DS_DB]},cn=ldbm database,cn=plugins,cn=config"

    # create index entries
    for ENTRY in "${INDEX_TABLE[@]}" ; do
		typeset -a F=( ${ENTRY} )					# split columns
		
		IDX_NAME="${STR[LDAP_DOMAIN]}.get${F[0]}"
		CN="${STR[LDAP_DOMAIN]}_${F[1]}_vlv_index"
		BASE="ou=${F[2]},${STR[LDAP_BASEDN]}"
		[[ ${F[2]} =~ = ]] && BASE="${BASE:3}"		# cut out ou=
		FILTER="objectClass=${F[3]}"
		[[ ${F[3]:0:1} == '&' ]] && FILTER="&(objectClass=${F[3]:2}"

		if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -s base \
			-b "cn=${IDX_NAME},cn=${CN},${BACKEND}" 'objectclass=*' \
			> /dev/null 2>&1
		then
			showProgress "'${IDX_NAME}' VLV index exists."
			continue
		fi

		nextFile add "${0}-${IDX_NAME}"
		print '
dn: '"cn=${CN},${BACKEND}"'
objectClass: top
objectClass: vlvSearch
cn: '"${CN}"'
vlvbase: '"${BASE}"'
vlvscope: '${SCOPE}'
vlvfilter: ('"${FILTER}"')
aci: (target = "ldap:///'"cn=${CN},${BACKEND}"'") (targetattr = "*")
 (
	version 3.0;  acl "Config";
	allow (read,search,compare) userdn="ldap:///anyone";
 )

dn: cn='"${IDX_NAME},cn=${CN},${BACKEND}"'
cn: '"${IDX_NAME}"'
vlvSort: cn uid
objectclass: top
objectclass: vlvIndex
'		> ${TMP[FILE]}

		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[FILE]} \
			>&${TMPF[FD]} 2>&1
		then
			Log.fatal "Adding '${IDX_NAME}' VLV index failed"
			return 66
		fi
		showProgress "'${IDX_NAME}' VLV index added."

		if (( MAJOR < 6 )); then
			# DSEE 5.x
			print "directoryserver -s '${INSTANCE}' vlvindex" \
				"-n '${STR[DS_DB]}' -T '${IDX_NAME}'" >> ${OUT}
		else
			# assume DSEE 6+
			print "dsadm reindex -l -t '${IDX_NAME}'" \
				"'${INSTANCE}' '${STR[LDAP_SUFFIX]}'" >> ${OUT}
		fi
	done
}

Man.addFunc add_vlv_indexes '' '[+NAME?add_vlv_indexes - Add VLV indexes.]
[+DESCRIPTION?Create VLV indexes entries on the \bSTR[DS_DB]]\b for \bSTR[LDAP_DOMAIN]]\b with \bSTR[LDAP_SEARCH_SCOPE]]\b and create the script \bTMP[DIR]]/do_vlv_index\b to be started on the DS to actually re-index the DB.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?fatal error.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_vlv_indexes {
    Log.verbose 'Processing VLV indexes ...'

	#         F[0]                   F[1]             F[2]           F[3]
	# ${LDAP_DOMAIN}.get ${LDAP_DOMAIN}_%s_vlv_index ou=%s objectClass=$1||&(%s)
	typeset -a INDEXES=( 
		'grent		group		group			posixGroup'
		'hostent	hosts		hosts			ipHost'
		'netent		networks	networks		ipNetwork'
		'pwent		passwd		people			posixAccount'
		'rpcent		rpc			rpc				oncRpc'
		'spent		shadow		people			shadowAccount'
		# Indexes added during NIS to LDAP transition
		'auhoent	auho		automountMapName=auto_home	automount'
		'soluent	solu		people			SolarisUserAttr'
		'authent	auth		SolarisAuthAttr	SolarisAuthAttr'
		'execent	exec		SolarisProfAttr	&(SolarisExecAttr)(SolarisKernelSecurityPolicy=*)'
		'profent	prof		SolarisProfAttr	&(SolarisProfAttr)(SolarisAttrLongDesc=*)'
		'mailent	mail		aliases			mailGroup'
		'bootent	_boot		ethers			&(bootableDevice)(bootParameter=*)'
		'ethent		ethers		ethers			&(ieee802Device)(macAddress=*)'
		'ngrpent	netgroup	netgroup		nisNetgroup'
		'ipnent		ipn			networks		&(ipNetwork)(cn=*)'
		'maskent	mask		networks		&(ipNetwork)(ipNetmaskNumber=*)'
		'prent		pr			printers		printerService'
		'ip4ent		ip4			hosts			&(ipHost)(ipHostNumber=*.*)'
		'ip6ent		ip6			hosts			&(ipHost)(ipHostNumber=*:*)'
	)

    # temp file for vlvindex commands
	typeset OUT=${TMP[DIR]}/tmp
	rm -f ${OUT} && touch ${OUT}

	if (( TMPF[IS_OPENDJ] )); then
		add_vlv_indexes_OpenDJ INDEXES ${OUT}
	else
		add_vlv_indexes_DSEE INDEXES ${OUT}
	fi
	nextFile sh
	mv ${OUT} ${TMP[FILE]}
	TMP[VLV_CMDS]=${TMP[FILE]}
}

Man.addFunc display_vlv_cmds '' '[+NAME?display_vlv_cmds - Display VLV index commands to run on server.]
[+DESCRIPTION?Display VLV index commands to run on server and save the file to /var/tmp/doIndexVLV-\bSTR[DS_HOST]].sh\b.]
'
function display_vlv_cmds {
	typeset SAV="/var/tmp/doIndexVLV-${STR[DS_HOST]}.sh"

	[[ -s ${TMP[VLV_CMDS]} ]] || return
	# some problems occured, so the file is not empty
	[[ -e ${SAV} ]] && SAV="${SAV%.sh}-$$.sh"
	cp -p ${TMP[VLV_CMDS]} "${SAV}"

	typeset MSG='NOTE: '"${PROG}"'configured the entries for VLV indexes.'
	if (( TMPF[IS_OPENDJ] )); then
		MSG+='
To create the actual VLV indexes, you need to stop the DS on the host
'"'${STR[DS_HOST]}'"', e.g. using "svcadm disable -t opendj@VERS@"
or, if manually started, "ds-stop" and than run the commands shown in the file
'"'${SAV}'"'.  Than restart the DS e.g. using
"svcadm enable opendj@VERS@" or "ds-start".
'
	else
		typeset INFO=( ${DS_INFO[@]} )
		if (( INFO[1] >= 6 )); then
			MSG+='
Use the dsadm command delivered with the DS on the host '"'${STR[DS_HOST]}'"'
to stop the server.  Then, using dsadm, follow the dsadm examples shown in the
file '"'${SAV}'"' to create the actual VLV indexes.
'
		else
			MSG+='
Use the directoryserver(1m) script on the host '"'${STR[DS_HOST]}'"'
to stop the server.  Then, using directoryserver, follow the directoryserver
examples shown in the file '"'${SAV}'"' to create the
actual VLV indexes.
'
		fi
    fi
	Log.info "\n\n${MSG}"
}

Man.addFunc doMain '' '[+NAME?doMain - the main entry point.]
[+DESCRIPTION?The entry point, where the real work starts.]
'
function doMain {
	# Initialize the variables that need to be set to NULL, or some 
	# other initial value before the rest of the functions can be called
	init || return 1
	show_vars

	# Print extra line to separate from prompt
	print

	# Either load the user specified config file or prompt user for config info
	if [[ -n ${TMP[IN]} ]]; then 
		load_config_file "${TMP[IN]}"
		validate_info || return 1	# Validate basic info in file
	else
		display_msg 'backup_server'
		get_confirm 'Do you wish to continue with server setup (y/n/h)?' \
			'n' 'backup_help' && return 1

		# Ask for all required infos
		prompt_config_info || return 1
		(( INT[LDAP_ENABLE_SHADOW_UPDATE] && INT[EXISTING_PROFILE] )) && \
			return 0	# just enabled shadow update in an existing profile
		# Allow user to modify results
		integer RES
		display_summary
		RES=$?
		# save the work for now, so that even on exit/errors it can be re-used
		[[ -n ${TMP[OUT]} ]] && create_config_file "${TMP[OUT]}"
		(( RES )) && return 1
	fi

	if (( INT[NEED_TIME] )); then
		modify_timelimit || return 1
	fi

	if (( INT[NEED_SIZE] )); then
		modify_sizelimit || return 1
	fi

	# Modify the password storage scheme to support CRYPT
	if (( INT[NEED_CRYPT] )); then
		modify_pwd_crypt || return 1
	fi

	# schema modifications
	modify_cn || return 1
	update_schema_attr || return 1
	update_schema_obj || return 1

	add_suffix || return 1

	# Add missing suffix ACIs
	add_suffix_aci || return 1

	# Add base objects (if needed)
	add_base_objects || return 1

	# Update the NisDomainObject.  
	#   The Base DN might of just been created, so this MUST happen after
	#   the base objects have been added!
	set_nisdomain || return 1

	# Add top level classes (new containers)
	add_new_containers || return 1

	add_auto_maps || return 1

	modify_top_aci || return 1

	add_vlv_aci || return 1

	if (( INT[NEED_PROXY] )); then
		add_proxyagent || return 1
		if (( ! INT[LDAP_ENABLE_SHADOW_UPDATE] )); then
			allow_proxy_read_pw || return 1
		fi
	fi

	if (( INT[NEED_ADMIN] )); then
		add_admin || return 1
		allow_admin_read_write_shadow || return 1
		deny_non_admin_shadow_access || return 1
	fi

	if (( INT[GSSAPI_ENABLE] )); then
		add_id_mapping_rules
		# do not modify ACI if "sasl/GSSAPI" and "self" are not selected
		if [[ ${STR[LDAP_CRED_LEVEL]} == 'self' && \
			${STR[LDAP_AUTHMETHOD]} == 'sasl/GSSAPI' ]]
		then
			modify_userpassword_acl_for_gssapi || return 1
		else
			Log.warn 'ACL for GSSAPI was not set because of  incompatibility' \
				'in profile'
		fi
	fi

	if (( INT[NEED_HOSTACL] )); then
		allow_host_read_write_shadow || return 66
		deny_non_host_shadow_access || return 67
	fi


	# Generate client profile and add it to the server
	add_profile || return 1

	# Add Indexes to improve search performance
	add_eq_indexes || return 1
	add_sub_indexes || return 1
	add_vlv_indexes || return 1

	# Display setup complete message
	Log.printMarker
	Log.info 'Setup of DS server' "'${STR[DS_HOST]}'" 'is complete.'
	Log.printMarker

	# Display VLV index commands to be executed on server (if any)
	display_vlv_cmds

	# Create final config file if requested
	[[ -n ${TMP[OUT]} ]] && create_config_file "${TMP[OUT]}"
	return 0
}

Man.addFunc cleanup '' '[+NAME?cleanup - cleanup tempfiles, tty and exit.]
[+DESCRIPTION?Removes \aTMP[DIR]]\a unless \aTMPF[DEBUG]]\a is set and restores the echo for the tty.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage TMP TMPF ; }" '}
'
function cleanup {
	(( TMPF[CLEANUP_DONE] )) && return
	if (( TMPF[DEBUG] )); then
		typeset X=${ ls -1 ${TMP[DIR]} 2>/dev/null ; }
		if [[ -z $X || $X == 'rootPWD' ]]; then
			rm -rf ${TMP[DIR]}
		else
			Log.info "Leaving temp dir ${TMP[DIR]} as is. Remove it manually"
		fi
	elif (( TMPF[KEEP] )); then
		typeset X=${ ls -1 ${TMP[DIR]} 2>/dev/null ; }
		if [[ -z $X || $X == 'rootPWD' ]]; then
			rm -rf ${TMP[DIR]}
		else
			Log.info "Keeping setup scripts and files in ${TMP[DIR]}"
		fi
	elif [[ -d ${TMP[DIR]} ]]; then
		rm -rf ${TMP[DIR]}
	fi
	${STTY:-/usr/bin/stty} echo
	trap - EXIT 1 2 3 6 15
	# Might be trapped in the scope of a function which will stop executing
	# the function itself but not the script. So:
	[[ -z $1 ]] && kill $$
	TMPF[CLEANUP_DONE]=1
}

# debug helper function. Required to be not a 'function'!
showCommand() {
	typeset CMD="${.sh.command}"
	[[ -z ${CMD} ]] && return
	print -n -u2 '\E[0;30;47m'
	print -u2 -r -n "DEBUG: ${.sh.fun} '${CMD}'"
	print '\E[0m'
}

Man.addFunc MAIN '' '[+NAME?'"${PROG}"' - setup the infrastructure of a directory server to provide data and security required by the Solaris (or similar OS) LDAP Naming Services.]
[+DESCRIPTION?This script assumes that the Sun/Oracle Directory Server Enterprise Edition (DSEE), or Sun OpenDS or Forgerock OpenDJ is installed and that its setup has been run.  This script takes the directory server from that point and sets up the infrastructure for LDAP Naming Services.  After running this script, \bldapaddent\b(1M) or some other tools can be used to populate data.]
[h:help?Print this help and exit.]
[F:functions?Print out a list of names of all currently defined script functions and exit (see \btypeset +f\b).]
[H:usage]:[function?Show the usage info for the function with the given name if available and exit. (see also option \b-F\b).]
[T:trace]:[fname_list?A comma or whitespace separated list of function names, which should be traced when running this script. If the list consist of the single word "ALL" or "*" all known functions get traced. "MAIN" is the special word to enable the trace of the main script. Gets activated as soon as this option gets processed, so option order might be important.]
[d:debug?Enable really verbose debug info.]
[C:no-color?Do not use ANSI escape codes to color the output.]
[k:keep?Keep the files used to modify the DS. Files are enumerated and prefixed with the command to use for executing it so that one is able to do the same manually what this script did and thus may help to fine tune the setup of your DS. Actually it is recommended to run this script against a virgin DS and than re-use/adjust everything you need on your production system.]
[I:importpwp?If specified, the storage scheme for Password Policy Import will be changed in the same way as the storage scheme for the Default Password Policy. If not specified, the storage scheme for Password Policy Import stays untouched. This option gets ignored for non-OpenDS/OpenDJ directory servers.]
[i:in]:[file?Get setup info from the given file.]
[o:out]:[file?Generate a server configuration output file.]
[s:djSyntax?If given, the OpenDJ schema defintions will be used to complement the servers schema if needed, no matter which kind of server has been detected.]
[S:eeSyntax?If given, the Sun DSEE schema defintions will be used to complement the servers schema if needed, no matter which kind of server has been detected. 
Wrt. Solaris it should not make a difference, whether OpenDJ or DSEE syntax is used. OpenDJ syntax is usually a little bit more precise.]
[t:timeout]:[seconds:=60?When this script creates an index, it also schedules a task to rebuild the index immediately. The \atimeout\a specifies, how long to wait for task completion. If the task gets not finished within the given time, the script treats that as an error and continues its work.]
[v:verbose?Verbose mode - makes the script a little bit more chatty.]
[+NOTES?This script should work for the following DS:]{
	[+?Sun DS 5.x]
	[+?Sun DSEE 6.x/7.x]
	[+?Oracle ODSEE 11g]
	[+?Sun OpenDS 2.x]
	[+?Forgerock OpenDJ 2.x]
}
'

TMPF[DEBUG]=0 TMPF[KEEP]=0 TMPF[FD]=4

X="${ print ${Man.FUNC[MAIN]} ; }"
while getopts "${X}" option ; do
	case "${option}" in
		'?'|h)	showUsage ${PROG} MAIN ; exit 0 ;;
		F) typeset +f ; exit 0 ;;
		T)	if [[ ${OPTARG} == '*' || ${OPTARG} == 'ALL' ]]; then
				typeset -ft ${ typeset +f ; }
			elif [[ ${OPTARG} == 'MAIN' ]]; then
				set -x
			else
				typeset -ft ${OPTARG//,/ }
			fi
			;;
		H)  if [[ ${OPTARG%_t} != $OPTARG ]]; then
				$OPTARG --man   # self-defined types
			else
				showUsage "$OPTARG" "$OPTARG"   # functions
			fi
			exit 0
			;;
		C)	Log.COLORED=0 ;;
		d)	TMPF[DEBUG]=1 ;;
		k)	TMPF[KEEP]=1 ;;
		I)	INT[NEED_CRYPT_IMPORT]=1 ;;
		i)	TMP[IN]="${OPTARG}" ;;
		o)	TMP[OUT]="${OPTARG}" ;;
		S)	TMPF[SYNTAX]=2 ; print DSEE ;;
		s)	TMPF[SYNTAX]=1 ; print DJ ;;
		t)	is_numeric "${OPTARG}" && INT[TASK_TIMEOUT]=${OPTARG} ;;
		v)	Log.VERBOSE=1 ; TMPF[FD]=1 ;;
	    *)	Log.fatal '**Internal ERROR: Supported option missing handler'
			exit 1
			;;
	esac
done
X=$(( OPTIND - 1 ))
shift $X
(( TMPF[DEBUG] )) && Man.listVars

unset LC_ALL LC_LANG
export LC_CTYPE=C	# avoid any surprises

# Create TMP[DIR]
TMP[DIR]=${ mktemp -d /tmp/${PROG}.XXXXX ; }
if [[ -z ${TMP[DIR]} ]]; then
	Log.fatal 'Unable to create a safe temporary directory'
	exit 1
fi
trap cleanup EXIT 1 2 3 6 15		# and register to cleanup on exit/signal
if (( TMPF[DEBUG] )); then
	trap 'typeset _CMD_="${.sh.command}"
	print -u2 -n "\E[0;30;47m"
	print -u2 -n -r "${.sh.fun:-MAIN}(): ${_CMD_}"
	print -u2 "\E[0m"
	' TMPF[DEBUG]
fi

# Prevent new files from being read by group or others
umask 077

doMain
X=$?

cleanup NOKILL

exit ${X}

# vim:ts=4 filetype=sh
# :syntax sync fromstart