#
# $Id$
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
# Portions Copyright 2013 Jens Elkner.
#############################################################################
# Main global vars
#############################################################################
LIC='[-?$Id$ ]
[-copyright?Portions Copyright (c) 2013 Jens Elkner.]
[-license?CDDL 1.0]'
typeset -T LogObj_t=(
function log {
}
function verbose {
}
function info {
}
function warn {
}
function fatal {
}
function printMarker {
print "${L}"
}
)
typeset -T ManObj_t=(
function addVar {
_.VAR[$1]="[+$1?$2]"
}
function addFunc {
typeset fname=$1
typeset X="$2"
[[ -z $X ]] && X="$LIC"
shift 2
while [[ -n $1 ]]; do
X+="$1"
shift
done
}
typeset -fh $'Add usage info (arg3 ...) for the given function name (arg1). If implementation details (arg2) is empty, the value of \a$LIC\a gets used instead' addFunc
function varUsage {
typeset X=""
while [[ -n $1 ]]; do
X+="${_.VAR[$1]}"
shift
done
print "$X"
}
typeset -fh $'Get the variable usage info for the named variables (arg2 ...) if available as a concatenated string. See \baddVar()\b' varUsage
function funcUsage {
}
function listVars {
typeset -n X=$VNAME
print "$VNAME=$X"
done
unset -n X
}
typeset -fh 'List all registered environment variables and its current value, except for OLDENV and LASTENV.' listVars
)
[+DESCRIPTION?Shows usage info for the given \afname\a if available.]
\n\n\afname\a
'
function showUsage {
typeset WHAT="$2"
else
fi
}
typeset -A -i INT=( )
typeset -A STR=( )
Man.addVar TMPF 'Associative array of Integers. Int values with a more or less a global character in this script.'
typeset -A -i TMPF=( )
Man.addVar TMP 'Associative array of Strings. String values whith a more or less a global character in this script.'
typeset -A TMP=( )
typeset CON_ARGS=''
Man.addVar AUTH_ARGS 'Indexed array of Strings. Contains authentification related options for ldap commands.'
typeset -a AUTH_ARGS=( )
typeset -a SSD=( )
# NOTE: The ACI names are retained to be compatible to previous releases. If one
# installs a completely new LDAP infrastructure changing the names should
# not be a problem as long as they do not collide with existing aci names!
Man.addVar SFX_ANYONE_ACI_NAME 'String constant. The name of the suffix ACI rule, which allows anyone to read, search, compare.'
typeset -r SFX_ANYONE_ACI_NAME='Anonymous access'
Man.addVar SFX_SELF_ACI_NAME 'String constant. The name of the suffix ACI rule, which allows a principal to modify its own attributes except those related to password state information and policy.'
typeset -r SFX_SELF_ACI_NAME='Limited self entry modification'
Man.addVar SFX_ADMIN_ACI_NAME 'String constant. The name of the suffix ACI rule, which allows the directory configuration administrator all operations on any entry.'
typeset -r SFX_ADMINGRP_ACI_NAME='Configuration Administrator access'
Man.addVar SFX_ADMINGRP_ACI_NAME 'String constant. The name of the suffix ACI rule, which allows the directory configuration administrator group all operations on any entry.'
typeset -r SFX_ADMIN_ACI_NAME='Configuration Administrator Group access'
Man.addVar PROXY_ACI_NAME 'String constant. The name of the ACI rule, which allows proxies to read passwords.'
typeset -r PROXY_ACI_NAME='LDAP Naming Services proxy_password_read'
Man.addVar HOST_ACI_NAME 'String constant. The name of the ACI rule, which allows host principals to write passwords.'
typeset -r HOST_ACI_NAME='LDAP Naming Services host_shadow_write'
Man.addVar NON_HOST_ACI_NAME 'String constant. The name of the ACI rule, which denies non-host principals access to shadow data.'
typeset -r NON_HOST_ACI_NAME='LDAP Naming Services deny_non_host_shadow_access'
Man.addVar ADMIN_ACI_NAME 'String constant. The name of the ACI rule, which allows Admin principals access to shadow, rbac and mount data.'
typeset -r ADMIN_ACI_NAME='LDAP Naming Services admin_shadow_write'
Man.addVar NON_ADMIN_ACI_NAME 'String constant. The name of the ACI rule, which denies non-Admin principals access to shadow data.'
typeset -r NON_ADMIN_ACI_NAME='LDAP Naming Services deny_non_admin_shadow_access'
Man.addVar USER_ACI_NAME 'String constant. The name of the ACI rule, which prevents a user from changing administrative fields like uidNumber, homeDirectory, shadowExpire, etc..'
typeset -r USER_ACI_NAME='LDAP Naming Services deny_write_access'
Man.addVar VLV_ACI_NAME 'String constant. The name of the global ACI rule, which allows any user to use VLVs for read, search and compare.'
typeset -r VLV_ACI_NAME='VLV Request Control'
Man.addVar SELF_GSS_ACI_NAME 'String constant. The name of the ou=people ACI rule, which allows a via SASL/GSSAPI authenticated user read and search on passwords.'
typeset -r SELF_GSS_ACI_NAME='self-read-pwd'
Man.addVar HOST_GSS_ACI_NAME 'String constant. The name of the ou=people ACI rule, which allows a via SASL/GSSAPI authenticated hosts read and search on passwords.'
typeset -r HOST_GSS_ACI_NAME='host-read-pwd'
Man.addVar AUTH_METHODS 'Indexed array of Strings. A list of currently supported authentication methods.'
typeset -a -r AUTH_METHODS=(
'none' 'simple' 'sasl/DIGEST-MD5'
'tls:simple' 'tls:sasl/DIGEST-MD5' 'sasl/GSSAPI'
) # order is important
Man.addVar CRED_LEVELS 'Indexed array of Strings. A list of currently supported client credential levels.'
Man.addVar OID2ADEF 'Associative array of Strings. Key: OID, Value: attribute definition. Used to cache attribute definitions of schemas currently installed on the DS. Gets lazy initialized, i.e. populated when needed.'
typeset -A OID2ADEF=( )
Man.addVar ANAME2OID 'Associative array of Strings. Key: attribute name (lowercase), Value: OID. Used to cache name to OID mappings. Gets initialized, when \bOID2ADEF\b gets populated.'
typeset -A ANAME2OID=( )
Man.addVar OID2ODEF 'Associative array of Strings. Key: OID, Value: objectclass definition. Used to cache objectclass definitions of schemas currently installed on the DS. Gets lazy initialized, i.e. populated when needed.'
typeset -A OID2ODEF=( )
[+DESCRIPTION?Check the standard path, whether it contains \acmd\a and if not, use \aPATH\a to lookup the command. If found the full path of the command gets printed to stdout, otherwise an error message to stderr.]
[+RETURN VALUES]{
[+0?\acmd\a found.]
[+1?\acmd\a not found.]
}
[+SEE ALSO?\bwhence\b(1).]
\n\n\acmd\a
'
function checkBinary {
typeset CMD=$1 X=''
done
[[ -n $X ]] && print "${X}" && return 0
X="${.sh.file%/*}/${CMD}"
[[ -x ${X} ]] && print "$X" && return 0
print -u2 "Missing command '${CMD}'."
return 1
}
[+DESCRIPTION?Does some basic binary-avail checks and initializes certain values of \bSTR[]]\b, \bINT[]]\b and \bTMP[]]\b.]
'
function init {
integer ERR=0
# General commands
# LDAP COMMANDS
Log.fatal 'Please adjust your PATH and try again'
return 66
fi
LDAPSEARCH+=' -r'
# If DNS domain (resolv.conf) exists use that, otherwise use domainname.
if [[ -f /etc/resolv.conf ]]; then
X=${VAL}
break;
fi
done < /etc/resolv.conf
fi
# If for any reason the DOMAIN did not get set (error'd resolv.conf) set
# X to the domainname or getent command's output.
[[ -z $X ]] && X=${ domainname ; }
if [[ -z $X ]]; then
integer I
for (( I=${#AX[@]}-1; I > 0; I++ )); do
X=${AX[$I]#*.}
[[ -n $X ]] && break
done
fi
# to have the keys registered ...
# idsconfig specific variables.
INT[NEED_PROXY]=0 # 0 = No Proxy, 1 = Create Proxy.
INT[NEED_ADMIN]=0 # 0 = No Admin, 1 = Create Admin.
INT[NEED_HOSTACL]=0 # 0 = No Host ACL, 1 = Create Host ACL.
STR[LDAP_PROXYAGENT]=''
STR[LDAP_ADMINDN]=''
STR[LDAP_DOMAIN]=${X%%.} # domainname on Server (default value)
# DS specific information
INT[DS_TIMELIMIT]=0
INT[DS_SIZELIMIT]=0
# LDAP PROFILE related defaults
STR[LDAP_PROFILE_NAME]='default'
STR[LDAP_BASEDN]=''
STR[LDAP_SERVER_LIST]=''
STR[LDAP_AUTHMETHOD]=''
INT[NEED_CRYPT]=0
STR[LDAP_SEARCH_SCOPE]='one'
STR[LDAP_PREF_SRVLIST]=''
INT[LDAP_PROFILE_TTL]=43200
STR[LDAP_CRED_LEVEL]='proxy'
INT[LDAP_BIND_LIMIT]=10
# Service Search Descriptors (just make sure it is empty)
# GSSAPI setup
INT[GSSAPI_ENABLE]=0
STR[LDAP_KRB_REALM]=''
# temp settings
TMPF[DEL_OLD_PROFILE]=0 # 0 = don't, 1 = delete old profile
TMPF[GSSAPI_AUTH_MAY_BE_USED]=0 # DS GSSAPI SASL support
TMPF[NEED_CREATE_SUFFIX]=0 # see add_suffix()
TMPF[NEED_CREATE_BACKEND]=0 # see add_suffix()
# schema completion syntax to use:
# 0 .. detect, 1 .. force OpenDJ, 2 .. force DSEE
TMP[LDAP_ROOTPWF]=${TMP[DIR]}/rootPWD # filename containing the root PW
# Set via getopts - just make sure, they are registered
# redirect ldap output to file instead of stdout
fi
return 0
}
# internal
function showProgress {
Log.info "${NUM}. " "$*"
}
# internal
function nextFile {
esac
}
Man.addFunc show_vars '' '[+NAME?show_vars - List of all config variables and their values.]
[+DESCRIPTION?Lists all config variables and their current values in a more or less human readable manner.]
'
function show_vars {
done
S=${!INT[@]}
done
if (( ${#SSD[@]} )); then
OUT+="\t\t${S}\n"
done
OUT+='\t)\n'
fi
print -u2 "${OUT}"
}
Man.addFunc save_password '' '[+NAME?save_password - Save password to temporary file.]
[+DESCRIPTION?Save the current password from \bSTR[LDAP_ROOTPWD]]\b to the file \bTMP[LDAP_ROOTPWF]]\b.]
'
function save_password {
print "${STR[LDAP_ROOTPWD]}" >"${TMP[LDAP_ROOTPWF]}"
}
#############################################################################
# EOG
#############################################################################
#############################################################################
# config file stuff
#############################################################################
Man.addFunc create_config_file '' '[+NAME?create_config_file - Write config data to the specified file.]
[+DESCRIPTION?Write config data to \afile\a.]
[+RETURN VALUES]{
[+0?file was written successfully.]
[+>= 1?otherwise.]
}
[+SEE ALSO?\bload_config_file()\b.]
\n\n\afile\a
'
function create_config_file {
[[ -z ${OUT} ]] && return 1
# Create output file.
(
print '
# '"${OUT}"' - This file contains configuration information for
# LDAP naming services. Use the '"${PROG}"' tool to load it.
#
# WARNING: This file was generated by '"${PROG}"', and is intended to
# be loaded by '"${PROG}"' as is. DO NOT EDIT THIS FILE!
'
print 'typeset -A -i IIN=( )'
print "IIN[${KEY}]=${INT[${KEY}]}"
done
print '\ntypeset -A SIN=( )'
printf "SIN[${KEY}]=%q\n" "${STR[${KEY}]}"
done
print '\ntypeset -a SIN_SSD=( )'
done
print "\n# End of ${OUT}"
) >"${OUT}"
}
# for backward compatibilty, but not documented: old format is bogus and should
# not be used anymore.
function source_old_config {
typeset -A OLDMAP=(
)
TODO+="${VNAME} "
done
TODO+="${VNAME} "
done
while read LINE; do
VAL="${LINE:19}"
fi
done < "${IN}"
# cleanup "global" namespace
[[ -n ${TODO} ]] && eval "unset ${TODO}"
}
[+DESCRIPTION?Loads the initial config from \afile\a, which has been generated in a previous run by '"${PROG}"'. Sets \bTMPF[DEL_OLD_PROFILE]]\b to 1 on success.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66? \afile\a is not a file or unreadable.]
}
[+SEE ALSO?\bsave_password()\b, \bshow_vars()\b.]
\n\n\afile\a
'
function load_config_file {
integer I
# source in the stuff - not nice but less work ;-)
. "${IN}"
if [[ -z ${KEY} ]]; then
else
done
done
done
# cleanup "global" namespace
fi
return 0
}
#############################################################################
# End Of config file stuff
#############################################################################
############################################################################
# Basic [menu] stuff
############################################################################
Man.addFunc display_msg '' '[+NAME?display_msg - display a message]
[+DESCRIPTION?Display a message corresponding to the \atag\a passed in.]
\n\n\atag\a
'
function display_msg {
typeset X
integer I
print '
It is strongly recommended that you BACKUP the directory server
before running '"${PROG}"'.
Hit Ctrl-C at any time before the final confirmation to exit.\n'
;;
print 'The following are the supported credential levels:'
for (( I=0; I < ${#CRED_LEVELS[@]}; I++ )); do
done
;;
print 'The following are the supported Client Authentication Methods:'
for (( I=0; I < ${#AUTH_METHODS[@]}; I++ )); do
done
;;
print 'The following are the supported Service Authentication Methods:'
# skip 'none'
for (( I=1; I < ${#AUTH_METHODS[@]}; I++ )); do
done
;;
print ' A Add a Service Search Descriptor (SSD)
D Delete a SSD
M Modify a SSD
P Display all SSDs
H Help
X Clear all SSDs
Q Exit menu'
;;
typeset SUFFIX_INFO=''
typeset DB_INFO=''
Suffix to create : '"${STR[LDAP_SUFFIX]}"'\n'
Database to create : '"${STR[DS_DB]}"'\n'
fi
typeset BASEDN
BASEDN="${STR[LDAP_BASEDN]}${STR[SUFFIX_INFO]}${STR[DB_INFO]}"
print ' Summary of Configuration
1 Domain to serve : '"${STR[LDAP_DOMAIN]}"'
2 Base DN to setup : '"${BASEDN}"'
3 Profile name to create : '"${STR[LDAP_PROFILE_NAME]}"'
4 Default Server List : '"${STR[LDAP_SERVER_LIST]}"'
5 Preferred Server List : '"${STR[LDAP_PREF_SRVLIST]}"'
6 Default Search Scope : '"${STR[LDAP_SEARCH_SCOPE]}"'
7 Credential Level : '"${STR[LDAP_CRED_LEVEL]}"'
8 Authentication Method : '"${STR[LDAP_AUTHMETHOD]}"'
9 Enable Follow Referrals : '"${INT[LDAP_FOLLOWREF]}"'
10 DS Time Limit : '"${INT[DS_TIMELIMIT]}"'
11 DS Size Limit : '"${INT[DS_SIZELIMIT]}"'
12 Enable crypt password storage : '"${INT[NEED_CRYPT]}"'
13 Service Auth Method pam_ldap : '"${STR[LDAP_SRV_AUTHMETHOD_PAM]}"'
14 Service Auth Method keyserv : '"${STR[LDAP_SRV_AUTHMETHOD_KEY]}"'
15 Service Auth Method passwd-cmd: '"${STR[LDAP_SRV_AUTHMETHOD_CMD]}"'
16 Search Time Limit : '"${INT[LDAP_SEARCH_TIME_LIMIT]}"'
17 Profile Time to Live : '"${INT[LDAP_PROFILE_TTL]}"'
18 Bind Limit : '"${INT[LDAP_BIND_LIMIT]}"'
19 Enable shadow update : '"${INT[LDAP_ENABLE_SHADOW_UPDATE]}"'
20 Service Search Descriptors Menu\n'
;;
print '
HELP - No help is available for this topic.\n'
;;
print '
HELP - Our Base DN is "'"${STR[LDAP_BASEDN]}"'"
and we need to create a Directory Suffix,
which can be equal to Base DN itself or be any of Base DN parents.
All intermediate entries up to suffix will be created on demand.\n'
;;
print '
HELP - database backend is an internal database for storage of our suffix data.
Backend name must be alphanumeric due to Directory Server restriction.
'
;;
print '
HELP - Since '"${PROG}"' modifies the directory server configuration,
it is strongly recommended that you backup the server prior
to running this utility. This is especially true if the server
being configured is a production server.\n'
;;
print '
HELP - Enter the port number the directory server is configured to
use for LDAP.\n'
;;
print '
HELP - Enter the Admin port number the directory server is configured to
use for for DS administration commands.\n'
;;
print '
HELP - This is the DNS domain name this server will be serving. You
must provide this name even if the server is not going to be populated
with hostnames. Any unqualified hostname stored in the directory
will be fully qualified using this DNS domain name.\n'
;;
print '
HELP - This parameter defines the default location in the directory tree for
the naming services entries. You can override this default by using
Service Search Descriptors (SSD). You will be given the option to set up
an SSD later on in the setup.\n'
;;
print '
HELP - Name of the configuration profile with which the clients will be
configured. A directory server can store various profiles for multiple
groups of clients. The initialization tool, (ldapclient(1M)), assumes
"default" unless another is specified.\n'
;;
print '
HELP - Provide a list of directory servers to serve clients using this profile.
All these servers should contain consistent data and provide similar
functionality. This list is not ordered, and clients might change the
order given in this list. Note that this is a space separated list of
*IP addresses* (not host names). Providing port numbers is optional.\n'
;;
print '
HELP - Provide a list of directory servers to serve this client profile.
Unlike the default server list, which is not ordered, the preferred
servers must be entered IN THE ORDER you wish to have them contacted.
If you do specify a preferred server list, clients will always contact
them before attempting to contact any of the servers on the default
server list. Note that you must enter the preferred server list as a
space-separated list of *IP addresses* (not host names). Providing port
numbers is optional.\n'
;;
print '
HELP - Default search scope to be used for all searches unless they are
overwritten using serviceSearchDescriptors. The valid options
are "one", which would specify the search will only be performed
at the base DN for the given service, or "sub", which would specify
the search will be performed through *all* levels below the base DN
for the given service. If you use the default DIT layout, "one" should
be ok and probably a little bit faster.\n'
;;
print '
HELP - This parameter defines what credentials (identity) the clients use to
authenticate (bind) to the directory server. This list might contain
multiple credential levels and is ordered. If a proxy level is
configured, you will also be prompted to enter a bind DN for the
proxy agent along with a password. This proxy agent will be created
if it does not exist. See also ldapclient(1M).\n'
;;
print '
HELP - The default authentication (bind) method(s) to be used by all services
in the client using this profile. This is a ordered list of
authentication methods separated by a ";". The supported methods are
provided in a menu. Note that sasl/DIGEST-MD5 binds require passwords
to be stored un-encrypted on the server. See also ldapclient(1M).\n'
;;
print '
HELP - The non-default authentication (bind) methods to be used by certain
services (for now pam_ldap, keyserv, and passwd-cmd are supported).
The authentication methods specified in this attribute overrides
the default authentication method defined in the profile. This
feature can be used to select stronger authentication methods for
services which require increased security.\n'
;;
print '
HELP - The authentication (bind) method(s) to be used by pam_ldap when
contacting the directory server. This is a ordered list, and, if
provided, will override the default authentication method parameter.\n'
;;
print '
HELP - The authentication (bind) method(s) to be used by newkey(1M) and chkey(1)
when contacting the directory server. This is a ordered list and if
provided will override the default authentication method parameter.\n'
;;
print '
HELP - The authentication (bind) method(s) to be used by passwd(1) command when
contacting the directory server. This is a ordered list and if
provided will override the default authentication method parameter.\n'
;;
print '
HELP - This parameter indicates whether the client should follow
ldap referrals if it encounters one during naming lookups.\n'
;;
print '
HELP - The server time limit value indicates the maximum amount of time the
server would spend on a query from the client before abandoning it.
A value of "-1" indicates no limit.\n'
;;
print '
HELP - The server sizelimit value indicates the maximum number of entries
the server would return in respond to a query from the client. A
value of "-1" indicates no limit.\n'
;;
print '
HELP - By default a DS does not store userPassword attribute values using
unix "crypt" formats (like bsdmd5, sunmd5, sha256, sha512, old crypt,
etc. - see crypt.conf(4)). If you need to keep your passwords in the
crypt formats for backward or pam_unix compatibility, choose "yes".
If any other password storage scheme than crypt is used, pam_ldap
MUST be used by clients to authenticate users to the system. Note
that if you wish to use sasl/*-MD5 in conjunction with pam_ldap,
;;
print '
HELP - The search time limit the client will enforce for directory lookups.\n'
;;
print '
HELP - The time to live value for profile. The client will refresh its
cached version of the configuration profile at this TTL interval.\n'
;;
print '
HELP - The time limit for the bind operation to the directory. This
value controls the responsiveness of the client in case a server
becomes unavailable. The smallest timeout value for a given
network architecture/conditions would work best. This is very
similar to setting TCP timeout, but only for LDAP bind operation.\n'
;;
print '
HELP - Using Service Search Descriptors (SSD), you can override the
default configuration for a given service. The SSD can be
used to override the default search base DN, the default search
scope, and the default search filter to be used for directory
lookups. SSD are supported for all services (databases)
defined in nsswitch.conf(4). See also ldapclient(1M).
Note: SSD are powerful tools in defining configuration profiles
and provide a great deal of flexibility. However, care
must be taken in creating them. If you decide to make use
of SSDs, consult the documentation first.\n'
;;
print '
HELP - Using this menu SSD can be added, updated, or deleted from
the profile.
A - This option creates a new SSD by prompting for the
service name, base DN, and scope. Service name is
any valid service as defined in ldap(1). base is
either the distinguished name to the container where
this service will use, or a relative DN followed
by a ",". For more information see ldapclient(1M).
D - Delete a previously created SSD.
M - Modify a previously created SSD.
P - Display a list of all the previously created SSD.
X - Delete all of the previously created SSD.
Q - Exit the menu and continue with the server configuration.\n'
;;
print '
HELP - Enter "y" to set up the LDAP server for shadow update.
The setup will add an administrator identity/credential
and modify the necessary access controls for the client
to update shadow(4), auth_attr(4), exec_attr(4), prof_attr(4),
user_attr(4), and project(4) data on the LDAP server. If
as the administrator identity.
Shadow data is used for password aging and account locking.
Please refer to the shadow(4) manual page for details.\n'
;;
print '
HELP - Start the setup to add an administrator identity/credential
and to modify access controls for the client to update
shadow(4), auth_attr(4), exec_attr(4), prof_attr(4),
user_attr(4), and project(4) data on the LDAP server.
Shadow data is used for password aging and account locking.
Please refer to the shadow(4) manual page for details.\n'
;;
print '
credential level is detected, enter "y" to modify the necessary
access controls for allowing the client to update shadow(4) data
on the LDAP server.
Shadow data is used for password aging and account locking.
Please refer to the shadow(4) manual page for details.\n'
;;
esac
}
Man.addVar ANS 'Variable used to return the user input.'
Man.addFunc get_ans '' '[+NAME?get_ans - gets an answer from the user.]
[+DESCRIPTION?Read a string from stdin. Arguments:]{
[+prompt?instruction/comment/description/question to show.]
}
\n\n\aprompt\a [\adefault\a]
'
function get_ans {
typeset PROMPT="$1 "
[[ -n $2 ]] && PROMPT+="[$2] "
read ANS?"${PROMPT}"
}
Man.addFunc get_ans_req '' '[+NAME?get_ans_req - get a non-empty answer from the user.]
[+DESCRIPTION?Read a string from stdin. Does not return until the string is a non-empty string or a \adefault\a value is given. Arguments:]{
[+prompt?instruction/comment/description/question to show.]
}
[+SEE ALSO?\bget_ans()\b]
\n\n\aprompt\a [\adefault\a]
'
function get_ans_req {
ANS=''
while [[ -z ${ANS} ]]; do
get_ans "$@"
done
}
Man.addFunc is_numeric '' '[+NAME?is_numeric - check whether arg is a numeric string]
[+DESCRIPTION?Check whether the given \astring\a is a numeric string.]
[+RETURN VALUES]{
[+0?If the string is a numeric string.]
[+1?Otherwise.]
}
[+SEE ALSO?\bnot_numeric()\b]
\n\n\astring\a
'
function is_numeric {
(( $# != 1 )) && return 1
[[ $1 =~ ^[0-9]+$ ]] && return 0 || return 1
}
Man.addFunc not_numeric '' '[+NAME?not_numeric - check whether arg is NOT a numeric string]
[+DESCRIPTION?Check whether the given \astring\a is NOT a numeric string. Useful for if and while statements that want to test for non-numeric data.]
[+RETURN VALUES]{
[+0?If the string is NOT a numeric string.]
[+1?Otherwise.]
}
[+SEE ALSO?\bis_numeric()\b]
\n\n\astring\a
'
function not_numeric {
is_numeric $1 && return 1 || return 0
}
Man.addVar NUM 'Variable used to return the user input as a number.'
integer NUM
Man.addFunc get_number '' '[+NAME?get_number - get a number from the user.]
[+DESCRIPTION?Read a string from stdin until it represents a number. Arguments:]
{
[+prompt?instruction/comment/description/question to show.]
[+helpTag?Tag of the help message to show, when the string read is h|H|?|help|Help.]
}
[+SEE ALSO?\bget_ans()\b, \bis_numeric()\b, \bdisplay_msg()\b]
\n\n\aprompt\a \adefault\a [\ahelpTag\a]
'
function get_number {
ANS=''
get_ans "$1" "$2"
while not_numeric $ANS ; do
[Hh?] | help | Help) display_msg ${3:-sorry} ;;
esac
done
}
Man.addFunc get_negone_num '' '[+NAME?get_negone_num - get a number >= -1 from the user.]
[+DESCRIPTION?Read a string from stdin until it represents a number >= -1. Arguments:]
{
[+prompt?instruction/comment/description/question to show.]
[+helpTag?Tag of the help message to show, when the string read is h|H|?|help|Help.]
}
[+SEE ALSO?\bget_number()\b]
\n\n\aprompt\a \adefault\a [\ahelpTag\a]
'
function get_negone_num {
while : ; do
get_number "$1" "$2" "$3"
Log.warn 'Invalid number! Enter a number >= -1'
done
}
Man.addFunc get_passwd '' '[+NAME?get_passwd - get a password from the user.]
[+DESCRIPTION?Read a password from stdin and verify with second until both match. Password gets not echoed to stdout. Arguments:]
{
[+prompt?instruction/comment/description/question to show.]
}
[+SEE ALSO?\bget_ans()\b]
\n\n\aprompt\a [\adefault\a]
'
function get_passwd {
${STTY} -echo # Turn echo OFF
# continue until passwd and re-entered passwd match
while : ; do
ANS=''
# Don't allow NULL for first try.
while [[ -z ${ANS} ]]; do
get_ans "$@"
[[ -z ${ANS} ]] && \
done
print
get_ans 'Re-enter password:'
_PASS2="${ANS}"
done
${STTY} echo # Turn echo ON
print
}
Man.addFunc get_passwd_nochk '' '[+NAME?get_passwd_nochk - get a password from the user w/o check.]
[+DESCRIPTION?Read a password from stdin. Actually the same as \bget_ans()\b but echoing characters read to stdout is switched off. Arguments:]
{
[+prompt?instruction/comment/description/question to show.]
}
[+SEE ALSO?\bget_ans()\b]
\n\n\aprompt\a [\adefault\a]
'
function get_passwd_nochk {
${STTY} -echo # Turn echo OFF
get_ans "$@"
${STTY} echo # Turn echo ON
print
}
Man.addFunc get_menu_choice '' '[+NAME?get_menu_choice - get a valid menu choice number.]
[+DESCRIPTION?Get a menu choice from user. Continue prompting until the choice is in required range. Arguments:]
{
[+prompt?Message text.]
[+min?Min value.]
[+max?Max value.]
[+helpTag?If given, "h" is allowed as well and the help message for this tag gets shown, when it got typed and before the prompt is shown the first time. The prompt should contain a hint in this case.]
[+menuTag?If given the menu choices for the given menu gest displayed at start and after each help text.]
}
[+RETURN VALUES]{
[+-1?on error (invalid parameters).]
[+>= \amin\a?the selected value.]
}
[+SEE ALSO?\bis_numeric()\b, \bget_ans()\b, \bdisplay_msg()\b.]
\n\n\aprompt\a \amin\a \amax\a [\adefault\a [\ahelpTag\a]]
'
function get_menu_choice {
if (( $# < 3 )); then
return -1
fi
[[ -n $6 ]] && display_msg "$6"
while : ; do
get_ans "$1" "$4"
then
return ${NUM}
fi
display_msg "$5"
[[ -n $6 ]] && display_msg "$6"
continue
fi
Log.warn "Invalid choice! Enter a number in the range $2 .. $3"
done
return -1
}
Man.addFunc get_confirm '' '[+NAME?get_confirm - Get confirmation from the user.]
[+DESCRIPTION?Read a string from stdin until it matches Y|y|Yes|yes|YES|N|n|No|no|NO or an empty string. Arguments:]
{
[+prompt?instruction/comment/description/question to show.]
[+helpTag?Tag of the help message to show, when the string read is h|H|?|help|Help.]
}
[+RETURN VALUES]{
[+0?for NO]
[+1?for YES]
}
[+SEE ALSO?\bdisplay_msg()\b]
\n\n\aprompt\a \adefault\a [\ahelpTag\a]
'
function get_confirm {
typeset _ANSWER=''
if [[ -z $2 ]]; then
exit 2
fi
while : ; do
read _ANSWER?"$1 [$2] "
[Hh?] | help | Help) display_msg ${3:-sorry} ;;
esac
done
}
Man.addFunc get_confirm_nodef '' '[+NAME?get_confirm_nodef - Get confirmation from the user.]
[+DESCRIPTION?Read a string from stdin until it matches Y|y|Yes|yes|YES|N|n|No|no|NO. No default value and help tag supported. Arguments:]
{
[+prompt?instruction/comment/description/question to show.]
}
[+RETURN VALUES]{
[+0?for NO]
[+1?for YES]
}
\n\n[\aprompt\a]...
'
function get_confirm_nodef {
typeset _ANSWER=''
while : ; do
read _ANSWER?"$@ "
esac
done
}
############################################################################
# End of basic [menu] stuff
############################################################################
######################################################################
# FUNCTIONS FOR prompt_config_info() START HERE.
######################################################################
Man.addFunc get_ids_server '' '[+NAME?get_ids_server - Prompt for DS server name.]
[+DESCRIPTION?Ask the user for the DS hostname, store it into \bSTR[DS_HOST]]\b and adjusts \bCON_ARGS\b.]
[+SEE ALSO?\bget_ans()\b, \bget_ids_port()\b, \bping\b(1M).]
'
function get_ids_server {
typeset SRV="${STR[DS_HOST]}"
while : ; do
"${STR[DS_HOST]}"
SRV="${ANS}"
# Ping server to see if alive. If reachable break out of loop
else
# assume Linux
fi
Log.warn "Server '${SRV}' is invalid or unreachable"
done
# Set CON_ARGS since values might have changed
CON_ARGS="-h ${SRV} -p ${INT[DS_PORT]}"
}
Man.addFunc get_ids_port '' '[+NAME?get_ids_port - Prompt for DS port number.]
[+DESCRIPTION?Ask the user for the DS port number and host, store it into \bINT[DS_PORT]]\b, \bSTR[DS_HOST]]\b and adjust \bCON_ARGS\b.]
[+SEE ALSO?\bget_number()\b, \bget_ids_server()\b, \bldapsearch\b(1).]
\n\n\aarg\a'
function get_ids_port {
typeset ASK='Enter the port number for the directory server (h=help):'
integer PORT
while : ; do
# Enter port number
# Do a simple search to check hostname and LDAP port number
if [[ -z $1 ]]; then
then
break
fi
Log.warn "Invalid host or port '${STR[DS_HOST]}:${PORT}'"
else
break
fi
done
[[ -n $1 ]] && return
# Set CON_ARGS since values might have changed
CON_ARGS="-h ${STR[DS_HOST]} -p ${PORT}"
}
Man.addFunc chk_ids_version '' '[+NAME?chk_ids_version - Read the DS version info.]
[+DESCRIPTION?Query the DS for version info and store it into \bTMP[DS_INFO]]\b as "ProductName MajorVersionNum MinorVersionNum". If the DS is OpenDS or OpenDJ \bTMPF[IS_OPENDJ]]\b gets set to 1, 0 otherwise. If the DS seems to be unsupported by this script, an appropriate message gets stored into \bTMP[WARN]]\b.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?on fatal error (got no info).]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function chk_ids_version {
typeset -a SPLIT=( )
while read LINE ; do
# OpenD*
X=${LINE:14}
PROD=${X%% *}
break
# *DSEE
X=${LINE:8}
PROD=${X%%/*}
X=${.sh.match#/}
SPLIT=( ${X//./ } )
break
fi
done
Log.fatal 'Can not determine the version number of the DS'
return 66
fi
# for easier maintainance we don't put it into a single expr
X=''
# not a supported DSEE version
X='1'
fi
if [[ -n ${X} ]]; then
Log.warn "${TMP[WARN]}"
fi
Log.info "Detected DS: ${PROD} ${MAJOR}.${MINOR}"
return 0
}
Man.addFunc get_dirmgr_dn '' '[+NAME?get_dirmgr_dn - get the directory manger DN.]
[+DESCRIPTION?Ask the user for the directory manger DN and store it into \bSTR[LDAP_ROOTDN]]\b and adjust \bAUTH_ARGS\b.]
[+SEE ALSO?\bget_ans()\b.]
'
function get_dirmgr_dn {
STR[LDAP_ROOTDN]="${ANS}"
}
Man.addFunc get_dirmgr_pw '' '[+NAME?get_dirmgr_pw - get the Root DN password.]
[+DESCRIPTION?Ask the user for the Root DN (\bSTR[LDAP_ROOTDN]]\b), store it into \bSTR[LDAP_ROOTPWD]]\b as well as a temp file for later use. Finally adjust \bAUTH_ARGS\b and check, whether the changes work.]
[+SEE ALSO?\bget_passwd_nochk()\b, \bsave_password()\b, \bldapsearch\b(1).]
'
function get_dirmgr_pw {
typeset RES
while : ; do
get_passwd_nochk "Enter passwd for ${STR[LDAP_ROOTDN]} :"
# Verify that ROOTDN and ROOTPWD are valid
(( $? == 0 )) && break # Both are valid.
Log.warn 'Password for Root DN is invalid'
else
Log.warn "Root DN '${STR[LDAP_ROOTDN]}' is invalid"
fi
done
}
Man.addFunc get_domain '' '[+NAME?get_domain - Ask user for domain to be served.]
[+DESCRIPTION?Ask the user for the Domain that will be served by the LDAP server and store it into \bSTR[LDAP_DOMAIN]]\b.]
[+SEE ALSO?\bget_ans()\b.]
'
function get_domain {
while : ; do
"${STR[LDAP_DOMAIN]}"
esac
# check, whether it has at least 2 dot separated components
[[ ${ANS} =~ [^.]+\.[^.]+ ]] && break
Log.warn "Invalid domainname '${ANS}'"
done
STR[LDAP_DOMAIN]="${ANS}"
}
Man.addFunc getDSobjectclasses '' '[+NAME?getDSobjectclasses - get all DS schema objectclasses.]
[+DESCRIPTION?Fetch all objectclasses definitions of the DS via \bcn=schema\b and cache them into \bOID2ODEF\b. Once successfully fetched, this function does nothing but return 0.]
[+RETURN VALUES]{
[+0?on success.]
[+>0?failed to retrieve attribute definitions.]
}
'
function getDSobjectclasses {
(( ${#OID2ODEF[@]} )) && return 0
set -o pipefail
objectclasses 2>/dev/null | \
: # always return 0
done
}
Man.addFunc getDSattributes '' '[+NAME?getDSattributes - get all DS schema attributes.]
[+DESCRIPTION?Fetch all attribute definitions of the DS via \bcn=schema\b and cache them into \bOID2ADEF\b. Also populate the hash map \bANAME2OID\b for all the attributes definied. Once successfully fetched, this function does nothing but return 0.]
[+RETURN VALUES]{
[+0?on success.]
[+>0?failed to retrieve attribute definitions.]
}
'
function getDSattributes {
(( ${#ANAME2OID[@]} )) && return 0
typeset -l ALIAS
set -o pipefail
attributeTypes 2>/dev/null | \
# 'name'
continue
fi
# ( 'name' 'name 1' ... )
done
: # always return 0
done
}
Man.addFunc check_attrName '' '[+NAME?check_attrName - validate an attribute name.]
[+DESCRIPTION?Check that \akey\a is a valid attribute name.]
[+RETURN VALUES]{
[0?key is a valid name.]
[1?key is a invalid name.]
[66?failed to fetch attribute definitions from server.]
}
[+SEE ALSO?\bldapsearch\b(1).]
\n\n\akey\a
'
function check_attrName {
typeset KEY=$1
if ! getDSattributes ; then
Log.fatal 'Unable to fetch attribute definitions from server'
return 66
fi
[[ -z ${KEY} ]] && return 1
# OID value
else
# symbol. name
# if have a mapping, than we also have a definition for it - no need
# to double check
[[ -n ${KEY} ]] && return 0
fi
return 1
}
Man.addFunc check_baseDN '' '[+NAME?check_baseDN - check validity of the baseDN name.]
[+DESCRIPTION?Check that \abaseDN\a is a valid base DN.]
[+RETURN VALUES]{
[+0?baseDN is a valid.]
[+>= 1?baseDN is a invalid.]
}
[+SEE ALSO?\bcheck_attrName()\b.]
[+NOTES?This function does not catch all invalid DNs. Its purpose is to reduce the number of invalid DNs to get past the input routine. The invalid DNs will be caught by the LDAP server when they are attempted to be created.]
\n\n\abaseDN\a
'
function check_baseDN {
# NOTE: we preserve spaces! And try to report all errors instead of just one
Log.info 'Checking LDAP Base DN ...'
[[ -z $1 ]] && return 0
# NOTE: when fancy debug via trap is enabled, splitting via IFS does not
# work: IFS=',' PAIRS=( $1 ) - so we do it manually
integer ERR=0
while [[ -n ${TAIL} ]]; do
Log.warn "Invalid key=value pair '${PAIR}'"
continue
fi
done
Log.warn "Unknown attribute name '${KEY}'"
fi
done
return ${ERR}
}
Man.addFunc discover_serv_suffix '' '[+NAME?discover_serv_suffix - query the DS to find suffixes available.]
[+DESCRIPTION?Query the DS to find suffixes available. All suffixes found are stored into the variable \avname\a which must be an indexed array.]
[+RETURN VALUES]{
[+0?at least one suffix was found.]
[+1?no suffix found.]
}
[+SEE ALSO?\bldapsearch\b(1).]
\n\n\avname\a
'
function discover_serv_suffix {
typeset LINE
integer NUM_TOP=0
typeset -n DST=$1
# Search the server for the TOP of the TREE. Usually none for virgin DS
while read LINE ; do
fi
done
Log.verbose 'No suffix found in LDAP tree'
return 1
fi
Log.verbose "LDAP_SUFFIX_LIST = ${DST[@]}"
return 0
}
Man.addFunc get_backend '' '[+NAME?get_backend - get the relevant database backend for the Base DN.]
[+DESCRIPTION?Get the relevant database backend name for the Base DN and store it into \bSTR[DS_DB]]\b.]
[+?Prerequisite: \bSTR[LDAP_BASEDN]]\b must be set and valid.]
[+?backend is retrieved from suffixes and subsuffixes defined under "cn=mapping tree,cn=config". The nsslapd-state attribute of these suffixes entries is filled with either Backend, Disabled or referrals related values. We only want those that have a true backend database to select the relevant backend.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?an fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function get_backend {
typeset -a DB=( )
Log.verbose "Testing LDAP suffix: ${CUR_DN} ..."
FILTER+='))(objectClass=ds-cfg-local-db-backend))'
while read LINE ; do
done
else
-b "cn=${CUR_DN},cn=mapping tree,cn=config" \
while read LINE ; do
done
fi
if (( ${#DB[@]} == 0 )); then
# not a suffix, or suffix not activated; try next
CUR_DN="${CUR_DN#*,}"
elif (( ${#DB[@]} == 1 )); then
break
else
'more than one database is used for one suffix'
return 66
fi
done
if (( ${#DB[@]} == 0 )); then
# should not happen, since STR[LDAP_BASEDN] is supposed to be valid
Log.fatal "Could not find a valid backend for '${STR[LDAP_BASEDN]}'"
Log.fatal 'Check the "Creating a New Database Backend" section in the Administration Guide'
fi
return 67
fi
Log.verbose "DB backend '${STR[DS_DB]}' selected"
return 0
}
Man.addFunc normalizeDN '' '[+NAME?normalizeDN - normalize a [relative]] distinguished name.]
[+DESCRIPTION?Strip off unnecessary spaces around \b,\b and \b=\b as well as at the beginning and end of the given \adn\a, optionally convert it to lower or upper case (if either \bl\b or \bu\b is given) and print it to stdout.]
\n\n\adn\a [\bl\b|\bu\b]
'
function normalizeDN {
[[ -z $1 ]] && return
typeset VAL=",${1},"
VAL="${VAL//*( ),*( )/,}"
VAL="${VAL//*( )=*( )/=}"
if [[ $2 == 'l' ]]; then
typeset -l LC="${VAL}"
VAL="${LC}"
elif [[ $2 == 'u' ]]; then
typeset -u UC="${VAL}"
VAL="${UC}"
fi
print -- "${VAL:1:${#VAL}-2}"
}
Man.addFunc check_basedn_suffix '' '[+NAME?check_basedn_suffix - check that there is an existing valid suffix to hold current base DN.]
[+DESCRIPTION?Check that there is an existing valid suffix for \bSTR[LDAP_BASEDN]]\b. If one is found, store it into \bSTR[LDAP_SUFFIX]]\b and make a corresponding backend check.]
[+RETURN VALUES]{
[+0?valid suffix found or new one should be created (\bTMPF[NEED_CREATE_SUFFIX]]\b flag actually indicates that).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bdiscover_serv_suffix()\b, \bldapsearch\b(1), \bnormalizeDN()\b, \bget_backend()\b.]
'
function check_basedn_suffix {
Log.info 'Validating LDAP Base DN and Suffix ...'
# check that LDAP Base DN might be added
done
Log.info "No valid suffixes were found for Base DN '${STR[LDAP_BASEDN]}'"
return 0
fi
# find out existing suffixes
typeset -a SUFFIXES=( )
# Now looking for relevant suffix for this entry (using lower case - LC).
# STR[LDAP_SUFFIX] will then be used to add necessary base objects via
# add_base_objects().
Log.verbose "Testing suffix: ${SFX} ..."
# LC_DN ends with ,SFX ?
if [[ ${LC_DN: -${#LC_SFX}} == ${LC_SFX} ]]; then
STR[LDAP_SUFFIX]="${SFX}"
break
fi
done
if [[ -z ${STR[LDAP_SUFFIX]} ]]; then
# should not happen, since we found the entry
Log.fatal "Could not find a valid suffix for '${STR[LDAP_BASEDN]}'"
return 66
fi
# Getting relevant database (backend)
# DS_DB will then be used to create indexes.
get_backend || return 67
return 0
}
Man.addFunc get_objectclass '' '[+NAME?get_objectclass - get the objectclass for the given attribute name.]
[+DESCRIPTION?Get the objectclass for the given attribute name \aattrName\a and print it to stdout. Right now ou, dc, o, and c and related aliases/OIDs are supported, only. For all others nothing will be printed.]
[+NOTES?An attribute name can be valid but still we might not be able to determine the objectclass from the table. In such cases, the user needs to create the necessary object(s).]
\n\n\aattrName\a
'
function get_objectclass {
typeset -l ANAME="$1"
ou | organizationalunitname | 2.5.4.11)
print 'organizationalUnit'
;;
dc | domaincomponent | 0.9.2342.19200300.100.1.25)
print 'domain'
;;
o | organizationname | 2.5.4.10)
print 'organization'
;;
c | countryname | 2.5.4.6)
print 'country'
;;
esac
}
function checkSuffixRDN {
typeset RDN="${STR[LDAP_SUFFIX]%%,*}"
TMP[SUFFIX_VAL]="${RDN#*=}"
TMP[SUFFIX_ATT]="${.sh.match%=}"
# find out an objectclass for suffix entry if it is not defined yet
if [[ -z ${TMP[SUFFIX_OBJ]} ]]; then
'attribute'
return 1
fi
return 0
}
Man.addFunc prep_create_sfx_entry '' '[+NAME?prep_create_sfx_entry - prepare for the suffix entry creation.]
[+DESCRIPTION?Prepare suffix entry creation based on \bSTR[LDAP_BASEDN|LDAP_SUFFIX]]\b and \bTMP[SUFFIX_OBJ]]\b. If the latter are unset (no config file read), set them to defaults depending on the baseDN. Finally check, whether the suffix entry already exists and if so check for consistency with the current config. This function sets:]{
[+TMPF[NEED_CREATE_BACKEND]]?0 .. backend already exists. 1 .. create a backend.]
[+TMP[SUFFIX_ATT]]?The attribute name of the leading RDN of the suffix (ID).]
[+TMP[SUFFIX_VAL]]?The attribute value of the leading RDN of the suffix (ID).]
}
[+RETURN VALUES]{
[+0?on success.]
[+1?an attribute/consistence related error occured.]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bnormalizeDN()\b, \bdisplay_msg()\b, \badd_suffix()\b, \bldapsearch\b(1)]
'
function prep_create_sfx_entry {
# check whether suffix corresponds to base dn (i.e. baseDN ends with suffix)
typeset SFX=,${STR[LDAP_SUFFIX]}
if [[ ${X: -${#SFX}} != ${SFX} ]]; then
"Base DN '${STR[LDAP_BASEDN]}'"
return 1
fi
checkSuffixRDN || return 66
Log.verbose "Suffix entry object: '${TMP[SUFFIX_OBJ]}'"
# 1st just check, whether any backend matches the suffix
typeset FILTER='(&(objectClass=ds-cfg-local-db-backend)'
FILTER+="(|(ds-cfg-base-dn=${STR[LDAP_SUFFIX]})"
FILTER+="(ds-cfg-base-dn=*,${STR[LDAP_SUFFIX]})))"
if [[ -n ${X} ]]; then
Log.verbose 'Suffix backend already exists'
get_backend || return 66
return 0
fi
else
# DSEE: check the suffix mapping tree ...
# If mapping exists, suffix should work, otherwise DSEE inconsistent
# NOTE: -b 'cn=mapping tree,cn=config' -s one 'cn=\"$1\"' won't work
# in case of 'cn' value in LDAP is not quoted by '"',
# -b 'cn=\"$1\",cn=mapping tree,cn=config' works in all cases
-b "cn=\"${STR[LDAP_SUFFIX]}\",cn=mapping tree,cn=config" \
then
Log.verbose 'Suffix mapping already exists'
get_backend || return 66
return 0
fi
# no suffix mapping, just in case check ldbm backends consistency -
# there are must be NO any databases pointing to STR[LDAP_SUFFIX]
-b 'cn=ldbm database,cn=plugins,cn=config' \
if [[ -n ${X} ]]; then
"'${STR[LDAP_SUFFIX]}', while ldbm database exists, server" \
'configuration needs to be fixed manually, look at cn=mapping' \
'tree,cn=config and cn=ldbm database,cn=plugins,cn=config'
return 1
fi
fi
Log.verbose 'Backend needs to be created ...'
return 0
}
Man.addFunc prep_create_sfx_backend '' '[+NAME?prep_create_sfx_backend - prepare for the suffix backend creation.]
[+DESCRIPTION?Prepare for the suffix backend creation by checking available DBs starting with \bSTR[DS_DB]]\b. Sets \bTMP[DS_DB_AVAIL]]\b if not yet set or != \bSTR[DS_DB]]\b.]
[+RETURN VALUES]{
[+0?backend db name is ok.]
[+1?\bSTR[DS_DB]]\b exists, so \bTMP[DS_DB_AVAIL]]\b contains available name.]
[+2?unable to find any available name.]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function prep_create_sfx_backend {
# check if requested name available
[[ ${STR[DS_DB]} == ${TMP[DS_DBS_AVAIL]} ]] && return 0
# get the list of database names start with a requested name
typeset -a DBS=( )
typeset FILTER='(&(objectclass=ds-cfg-local-db-backend)'
FILTER+="(ds-cfg-backend-id=${STR[DS_DB]}*))"
while read LINE ; do
done
else
-b 'cn=ldbm database,cn=plugins,cn=config' \
while read LINE ; do
done
fi
if (( ${#DBS[@]} == 0 )); then
# no backend name starts with STR[DS_DB]
TMP[DS_DBS_AVAIL]="${STR[DS_DB]}"
return 0
fi
# find a non-existing db name based on a requested name
integer I FOUND
for (( I=0 ; I < 10; I++ )); do
FOUND=0
done
if (( I == 0 )); then
TMP[DS_DBS_AVAIL]="${STR[DS_DB]}"
return 0 # requested name is available
fi
TMP[DS_DBS_AVAIL]="${STR[DS_DB]}${I}"
break
fi
done
if [[ -n ${TMP[DS_DBS_AVAIL]} ]]; then
"however '${TMP[DS_DBS_AVAIL]}' is available"
return 1
fi
"'${STR[DS_DB]}'"
return 2
}
Man.addFunc get_suffix '' '[+NAME?get_suffix - Ask user for suffix and related backend.]
[+DESCRIPTION?Ask the user for the suffix (default: \bSTR[LDAP_BASEDN]]\b) to create and the db name if it does not yet exist. \bTMP[DS_DBS_AVAIL]]\b gets set to the given db name (if any), \bSTR[DS_DB]]\b to the prepared db name and \bSTR[LDAP_SUFFIX]]\b to the given suffix.]
[+RETURN VALUES]{
[+0?on success (user gave a correct suffix).]
[+1?unable to create suffix given by user.]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b, \bnormalizeDN()\b, \bprep_create_sfx_entry()\b, \bprep_create_sfx_backend()\b.]
'
function get_suffix {
while : ; do
"${STR[LDAP_BASEDN]}"
display_msg 'create_suffix_help'
continue
;;
return 1
;;
esac
integer REDO=$?
REDO=0
while : ; do
X=${TMP[DS_DBS_AVAIL]}
# Basically for OpenDJ we could use 'userRoot' as default aka
# TMP[SUFFIX_VAL], however, users may use it for trying out
# examples from the docs
"${X:-${TMP[SUFFIX_VAL]}}"
[Hh?])
display_msg 'enter_ldbm_db_help'
continue
;;
REDO=1
break
;;
esac
prep_create_sfx_backend && break
done
"${DS_DB}"
fi
# eventually everything is prepared
break
done
return 0
}
Man.addFunc domain_2_dc '' '[+NAME?domain_2_dc - Convert a domain name into dc string.]
[+DESCRIPTION?Convert a domain name \adomain\a into a dc=...,dc=... string and print it to stdout.]
\n\n\adomain\a
'
function domain_2_dc {
[[ -z $1 ]] && return
DC+=",dc=${SD}"
done
print -- "${DC:1}"
}
Man.addFunc get_basedn '' '[+NAME?get_basedn - Ask user for Base DN.]
[+DESCRIPTION?Ask the user for the BaseDN to use, check whether to create a suffix and store the value into \bSTR[LDAP_BASEDN]]\b.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bget_ans_req()\b, \bdisplay_msg()\b, \bcheck_baseDN()\b, \bcheck_basedn_suffix()\b, \bget_suffix()\b.]
'
function get_basedn {
typeset BASEDN=${ domain_2_dc ${STR[LDAP_DOMAIN]} ; }
integer RES
while : ; do
# Get Base DN.
while : ; do
esac
Log.warn "Invalid base DN: '${ANS}'"
done
# Set base DN and check its suffix
STR[LDAP_BASEDN]="${ANS}"
check_basedn_suffix || return 66
# suffix may need to be created, in that case get suffix from user
RES=$?
fi
# suffix is ok, break out of the base dn inquire loop
break
done
return 0
}
Man.addFunc chk_vlv_indexes '' '[+NAME?chk_vlv_indexes - check if server supports VLV.]
[+DESCRIPTION?Checks, whether the DS supports Virtual List Views (VLV).]
[+RETURN VALUES]{
[+0?if VLVs are supported.]
[+>= 66?if VLVs are not supported.]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function chk_vlv_indexes {
typeset ATTR=''
supportedControl 2>/dev/null | \
while read LINE ; do
if [[ ${LINE#*=} == '2.16.840.1.113730.3.4.9' ]]; then
break
fi
done
if [[ -z ${ATTR} ]]; then
# If the BDB backend is not yet loaded, related controls are not
# shown. Because we know, that it supports VLVs we just check, that
# this is true (no BDB configured/enabled)
-b 'cn=Backends,cn=config' -s sub \
'(&(objectclass=ds-cfg-local-db-backend)(ds-cfg-enabled=true))';
}
[[ -z ${ATTR} ]] && return 0
fi
Log.fatal 'VLV is not supported on LDAP server'
return 66
fi
return 0
}
Man.addFunc validate_suffix '' '[+NAME?validate_suffix - validate suffix obtained via config file.]
[+DESCRIPTION?This function validates STR[LDAP_SUFFIX]] AFTER THE LOAD OF A CONFIG FILE (should not be used for interactive use). Also does a consistency check wrt. \bSTR[LDAP_BASEDN]]\b.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bnormalizeDN()\b, \bldapsearch\b(1), \bprep_create_sfx_entry()\b, \bprep_create_sfx_backend()\b.]
'
function validate_suffix {
# Check STR[LDAP_SUFFIX] is not null
if [[ -z ${STR[LDAP_SUFFIX]} ]]; then
Log.fatal 'Invalid suffix (null suffix)'
return 66
fi
# STR[LDAP_SUFFIX] and STR[LDAP_BASEDN] are consistent ?
if [[ ${X: -${#SFX}} != ${SFX} ]]; then
Log.fatal "Invalid suffix '${SFX}' for Base DN '${X}'"
return 67
fi
# STR[LDAP_SUFFIX] does exist ?
then
checkSuffixRDN && return 0 || return 68
fi
# Well, suffix does not exist, try to prepare create it ...
prep_create_sfx_entry || return 69
'create the backend with the default DS tools'
return 70
fi
# too risky, even if a available backend name could be found
prep_create_sfx_backend || return 71
fi
Log.verbose "Suffix: '${STR[LDAP_SUFFIX]}' Database: '${STR[DS_DB]}'"
return 0
}
Man.addFunc validate_info '' '[+NAME?validate_info - validate basic info obtained via config file.]
[+DESCRIPTION?This function updates \bCON_ARGS\b as well as \bAUTH_ARGS\b, checks, whether they work so that some problems are caught right away AFTER THE LOAD OF A CONFIG FILE (should not be used for interactive use). It also validates the obtained suffix and whether the DS supports VLVs.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bchk_vlv_indexes()\b, \bvalidate_suffix()\b.]
'
function validate_info {
# Set CON_ARGS and AUTH_ARGS for the config file.
CON_ARGS="-h ${STR[DS_HOST]} -p ${INT[DS_PORT]}"
chk_ids_version || return 1 # Check DSEE version for compatibility
# Check the Root DN and Root DN passwd.o Same as for get_dirmgr_pw()
if (( $? )); then
if [[ ${RES} =~ credential ]]; then
Log.fatal 'Root DN passwd is invalid'
else
Log.fatal "Invalid Root DN '${STR[LDAP_ROOTDN]}'"
fi
return 66
fi
Log.verbose 'RootDN: ok RootDN passwd: ok'
# Check if the server supports the VLV
chk_vlv_indexes || return 67
Log.verbose 'VLV indexes ... ok'
# Check LDAP suffix
validate_suffix || return 66
Log.verbose 'LDAP suffix ... ok'
return 0
}
Man.addFunc gssapi_setup '' '[+NAME?gssapi_setup - set up GSSAPI if necessary.]
[+DESCRIPTION?Check, whether the DS supports the SASL mechanism \bGSSAPI\b. If so, ask the user whether it should be enabled and depending on the answer ask for related Kerberos realm info. \bINT[GSSAPI_ENABLE]]\b and \bTMPF[GSSAPI_AUTH_MAY_BE_USED]]\b and optionally \bSTR[LDAP_KRB_REALM]]\b are set accordingly.]
[+SEE ALSO?\bldapsearch\b(1), \bget_ans_req()\b.]
'
function gssapi_setup {
INT[GSSAPI_ENABLE]=0
supportedSASLMechanisms 2>/dev/null | \
while read LINE ; do
then
break
fi
done
return
fi
get_confirm 'GSSAPI is supported. Do you want to set up GSSAPI:(y/n)' 'n'
if (( $? )); then
INT[GSSAPI_ENABLE]=1
# get kerberos realm
typeset -u REALM=${STR[LDAP_DOMAIN]}
get_ans_req "Enter Kerberos Realm:" "${REALM}"
STR[LDAP_KRB_REALM]="${REALM}"
else
fi
}
Man.addFunc get_profile_name '' '[+NAME?get_profile_name - Ask user for client profile name.]
[+DESCRIPTION?Ask the user for the name of the client profile to create, check whether it already exists, and if so ask whether it should be overwritten. Sets \bSTR[LDAP_PROFILE_NAME]]\b, \bTMPF[DEL_OLD_PROFILE]]\b and if the user wants to just enable shadow update \bINT[LDAP_ENABLE_SHADOW_UPDATE]]\b and \bINT[EXISTING_PROFILE]]\b.]
[+SEE ALSO?\bget_ans()\b, \bldapsearch\b(1), \bget_confirm()\b, \bget_confirm_nodef()\b, \bdisplay_msg()\b.]
'
function get_profile_name {
TMPF[DEL_OLD_PROFILE]=0 # Reset since getting new profile name
typeset PNAME="${STR[LDAP_PROFILE_NAME]}"
# Loop until valid profile name, or replace.
while : ; do
esac
# Search to see if profile name already exists.
then
break # Unique profile name (does not yet exist)
fi
'enable shadow update now.' "${PROG}" 'will exit after shadow' \
'update is enabled. You can also continue to overwrite the' \
'profile or create a new one and be given the chance to enable' \
'shadow update later.'
'enable_shadow_update_help'
if (( $? )); then
# set up credentials for shadow update
# display alternate messages
break
fi
"Are you sure you want to overwrite profile 'cn=${ANS}'?"
if (( $? )); then
TMPF[DEL_OLD_PROFILE]=1 # Replace old profile name
break
fi
done
STR[LDAP_PROFILE_NAME]="${ANS}"
}
Man.addFunc getACIs '' '[+NAME?getACIs - get ACIs for the current base DN.]
[+DESCRIPTION?Get all ACIs for \abaseDN\a and append them to the indexed array of strings \avname\a. If \abaseDN\a is not given, \bSTR[LDAP_BASEDN]]\b will be used instead. If \ascope\a is set to \bGlobal\b this method queries for "ds-cfg-global-aci" instead of "aci" unless \bTMPF[IS_OPENDJ]]\b is \b0\b.]
[+RETURN VALUES]{
[+-1?invalid function usage.]
[+0?on success.]
[+1?an error occured when executing the ldapsearch operation.]
}
\n\n\avname\a [\abaseDN\a] [\ascope\a]
'
function getACIs {
set -o pipefail # wanna have the exit code of ldapsearch
return -1
typeset -n ACILIST=$1
typeset LINE
while read LINE ; do
# NOTE: the || : is required to always get success (pipe doesn't break)
[[ ${LINE:0:${#ACI}+1} == "${ACI}=" ]] && \
done
if (( $? )); then
Log.fatal "Unable to get aci list for '${STR[LDAP_BASEDN]}'"
return 1
fi
return 0
}
Man.addFunc findACI '' '[+NAME?findACI - find an ACI in the given list.]
[+DESCRIPTION?Find the first ACI which matches \aregex\a in the indexed array of ACIs \avname\a. If a match occurs, print out a message using the given \aaciName\a prefixed with \ascope\a. If \ascope\a is not given or empty, \bBaseDN\b will be used instead.]
[+RETURN VALUES]{
[+0?no ACI matched.]
[+>=1?the index+1 of the ACI matched.]
}
[+SEE ALSO?\bgetACIs()\b, \bfindACI()\b, \bfind_and_delete_ACI\b()]
\n\n\avname\a \aaciName\a \aregex\a [\ascope\a]
'
function findACI {
typeset -n LIST=$1
integer MAX=${#LIST[@]} I
showProgress "${SCOPE} ACI '${NAME}' exists."
return $((I+1))
fi
done
return 0
}
Man.addFunc allow_proxy_read_pw '' '[+NAME?allow_proxy_read_pw - add Proxy Agent read permission for password.]
[+DESCRIPTION?Add the ACI \bPROXY_ACI_NAME\b for \bSTR[LDAP_PROXYAGENT]]\b to \bSTR[LDAP_BASEDN]]\b if it not already exists.]
[+RETURN VALUES]{
[+0?on success (ACI already exists or added successfully).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bldapmodify\b(1).]
'
function allow_proxy_read_pw {
typeset -a LIST=( )
PATTERN='userPassword'
PATTERN+=' || authPassword'
# At least in OpenDJ specifying the same target as where the ACI gets
# attached is redundant wrt. the result and causes minimal overhead
TARGET=''
else
fi
print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: '"${TARGET}"'(targetattr = "'"${PATTERN}"'")
(
version 3.0; acl "'"${PROXY_ACI_NAME}"'";
allow (compare,read,search) userdn = "ldap:///'"${STR[LDAP_PROXYAGENT]}"'";
)
then
Log.fatal "Adding '${PROXY_ACI_NAME}' ACI failed"
return 66
fi
showProgress "ACI '${PROXY_ACI_NAME}' added."
return 0
}
Man.addFunc delete_proxy_read_pw '' '[+NAME?delete_proxy_read_pw - delete Proxy Agent read permission for password.]
[+DESCRIPTION?Remove the ACI \bPROXY_ACI_NAME\b from \bSTR[LDAP_BASEDN]]\b if such an ACI exists.]
[+RETURN VALUES]{
[+0?on success (no delete required or ACI deleted).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bget_menu_choice()\b, \bldapmodify\b(1).]
'
function delete_proxy_read_pw {
typeset -a LIST=( )
# Search for ACI_NAME - no findACI() because we need ALL matching ACIs
typeset -a ACILIST=( )
done
# We need to remove proxy agent's read access to user passwords,
# but We do not know the value of the ${LDAP_PROXYAGENT} here, so
# 1. if only one match found, delete it
# 2. if more than one matches found, ask the user which one to delete
if (( ${#ACILIST[@]} == 0 )); then
"'${STR[LDAP_BASEDN]}'"
return 0
fi
if (( ${#ACILIST[@]} == 1 ));then
PROXY_ACI="${ACI[0]}"
else
X='
Proxy agent is not allowed to read user passwords when shadow
update is enabled. There are more than one proxy agents found.
Please select the proxy agent currently being used, so that
'"${PROG}"' can remove its read access to user passwords.
The proxy agents are:
'
# print the list of ACIs for selection
integer I MAX
MAX=${#ACILIST[@]}
ACI="${ACILIST[${I}]}"
# older versions used
# sed -e 's|.*ldap:///.*ldap:///||' -e 's|";)||'
fi
done
Log.warn "${X}"
# ask the user to pick one
I=$(( $? - 1 ))
PROXY_ACI="${ACILIST[$I]}"
fi
print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
delete: aci
aci: '"${PROXY_ACI}"'
then
Log.fatal "Remove of '${PROXY_ACI_NAME}' ACI failed"
return 66
fi
Log.info "Removed '${PROXY_ACI_NAME}' ACI"
return 0
}
Man.addFunc allow_host_read_write_shadow '' '[+NAME?allow_host_read_write_shadow - add host principal read/write permission for shadow data.]
[+DESCRIPTION?Add the ACI \bHOST_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b unless it already exists.]
[+RETURN VALUES]{
[+0?on success (ACI already exists or added successfully).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bldapmodify\b(1).]
'
function allow_host_read_write_shadow {
typeset -a LIST=( )
print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: '"${TARGET}"'(targetattr = "shadowLastChange || shadowMin || shadowMax || shadowWarning || shadowInactive || shadowExpire || shadowFlag || userPassword || loginShell || homeDirectory || gecos")
(
version 3.0; acl '"${HOST_ACI_NAME}"';
allow (write,compare,read,search) authmethod = "sasl GSSAPI" and userdn = "ldap:///cn=*+ipHostNumber=*,ou=Hosts,'"${STR[LDAP_BASEDN]}"';
)
then
return 66
fi
showProgress "ACI '${ACI_NAME}' added."
return 0
}
Man.addFunc find_and_delete_ACI '' '[+NAME?find_and_delete_ACI - find and delete an ACI in the given list.]
[+DESCRIPTION?Find the first ACI which matches \aregex\a in the indexed array of ACIs \avname\a and delete it. If no ACI matches, the function does nothing and returns. Otherwise it tries to delete it from \bSTR[LDAP_BASEDN]]\b and prints out a message using \aaciName\a.]
[+RETURN VALUES]{
[+0?on success (no ACI matched or ACI removed successfully).]
[+66?an error occured when removing the matched ACI.]
}
[+SEE ALSO?\bgetACIs()\b, \bldapmodify\b(1)]
\n\n\avname\a \aaciName\a \aregex\a
'
function find_and_delete_ACI {
typeset -n LIST=$1
done
[[ -z ${DEL} ]] && return 0
print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
delete: aci
aci: '"${DEL}"'
then
Log.fatal "Remove of '${ACI_NAME}' ACI failed"
return 66
fi
showProgress "ACI '${ACI_NAME}' deleted."
return 0
}
Man.addFunc deny_non_host_shadow_access '' '[+NAME?deny_non_host_shadow_access - add a deny non-host access to shadow data.]
[+DESCRIPTION?Add the ACI \bNON_HOST_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b unless it already exists. If it does not exists the ACI \bNON_ADMIN_ACI_NAME\b gets deleted first if available.]
[+RETURN VALUES]{
[+0?on success (ACI already exists or added successfully).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfind_and_delete_ACI()\b, \bldapmodify\b(1).]
'
function deny_non_host_shadow_access {
typeset -a LIST=( )
# If an ACI with ${NON_HOST_ACI_NAME} already exists, we are done
# The deny_non_admin_shadow_access and deny_non_host_shadow_access ACIs
# should be mutually exclusive, so if the former exists, delete it
print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: '"${TARGET}"'(targetattr = "shadowLastChange || shadowMin || shadowMax ||shadowWarning || shadowInactive || shadowExpire || shadowFlag || userPassword")
(
version 3.0; acl "'"${NON_HOST_ACI_NAME}"'";
deny (write,read,search,compare) userdn != "ldap:///cn=*+ipHostNumber=*,ou=Hosts,'"${STR[LDAP_BASEDN]}"'";
)
then
Log.fatal "Adding ACI '${NON_HOST_ACI_NAME}' failed"
return 67
fi
showProgress "ACI '${NON_HOST_ACI_NAME}' added."
return 0
}
Man.addFunc get_adminDN '' '[+NAME?get_adminDN - ask user for Admin DN.]
[+DESCRIPTION?Ask the user for the Admin DN and store it into \bSTR[LDAP_BASEDN]]\b.]
[+SEE ALSO?\bget_ans()\b.]
'
function get_adminDN {
"cn=admin,ou=profile,${STR[LDAP_BASEDN]}"
STR[LDAP_ADMINDN]="${ANS}"
}
Man.addFunc get_admin_pw '' '[+NAME?get_admin_pw - ask user for Admin password]
[+DESCRIPTION?Ask the user for the Admin password and store it into \bSTR[LDAP_ADMIN_CRED]]\b.]
[+SEE ALSO?\bget_passwd()\b.]
'
function get_admin_pw {
get_passwd 'Enter passwd for the administrator:'
STR[LDAP_ADMIN_CRED]="${ANS}"
}
Man.addFunc add_admin '' '[+NAME?add_admin - Add administrator identity.]
[+DESCRIPTION?Add the \bSTR[LDAP_ADMINDN]]\b entry with the password \bSTR[LDAP_ADMIN_CRED]]\b unless it already exists.]
[+RETURN VALUES]{
[+0?on success (entry already exists or added successfully).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_admin {
then
showProgress "Administrator identity exists."
return 0
fi
typeset CN="${STR[LDAP_ADMINDN]%%,*}"
CN="${CN#*=}"
print '
dn: '"${STR[LDAP_ADMINDN]}"'
cn: '"${CN}"'
sn: '"${CN}"'
objectclass: top
objectclass: person
userpassword: '"${STR[LDAP_ADMIN_CRED]}"'
then
Log.fatal 'Adding administrator identity failed'
return 66
fi
showProgress 'Administrator identity added.'
return 0
}
Man.addFunc allow_admin_read_write_shadow '' '[+NAME?allow_admin_read_write_shadow - add Admin read/write permission for shadow, rbac and mount data.]
[+DESCRIPTION?Add the ACI \bADMIN_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b unless it already exists. Also tries to remove old similar ACIs if they exist.]
[+RETURN VALUES]{
[+0?on success (aci already exists or addition was successfull).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfind_and_delete_ACI()\b, \bldapmodify\b(1).]
'
function allow_admin_read_write_shadow {
typeset -a LIST=( )
# If the ACI already exists, we are done
# If an ACI with ${ADMIN_ACI_NAME} and "(write|write,compare,read,search)"
# and ${LDAP_ADMINDN} exists, delete it
RBAC='objectClass || uid || uidNumber || gidNumber || cn'
RBAC+=' || SolarisAttrKeyValue || SolarisAttrShortDesc'
RBAC+=' || SolarisAttrLongDesc || SolarisKernelSecurityPolicy'
RBAC+=' || SolarisProfileType || SolarisProfileId || SolarisUserQualifier'
RBAC+=' || SolarisReserved1 || SolarisReserved2'
RBAC+=' || SolarisAttrReserved1 || SolarisAttrReserved2'
RBAC+=' || SolarisProjectID || SolarisProjectName'
RBAC+=' || SolarisProjectAttr || memberUid || memberGid || description'
RBAC+=' || automountKey || automountMapName || automountInformation'
RBAC+=' || ipTnetTemplateName || ipTnetNumber'
print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: '"${TARGET}"'(targetattr = "shadowLastChange || shadowMin || shadowMax || shadowWarning || shadowInactive || shadowExpire || shadowFlag || userPassword || loginShell || homeDirectory || gecos || '"${RBAC}"'")
(
allow ('"${PERMS}"') userdn = "ldap:///'"${STR[LDAP_ADMINDN]}"'";
)
then
Log.fatal "Adding '${ADMIN_ACI_NAME}' ACI failed"
return 69
fi
showProgress "ACI '${ADMIN_ACI_NAME}' added."
return 0
}
Man.addFunc deny_non_admin_shadow_access '' '[+NAME?deny_non_admin_shadow_access - add a deny Admin access to shadow data.]
[+DESCRIPTION?Add the ACI \bNON_ADMIN_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b unless it already exists. If it does not exists the ACI \bNON_HOST_ACI_NAME\b gets deleted first if available.]
[+RETURN VALUES]{
[+0?on success (ACI already exists or added successfully).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfind_and_delete_ACI()\b, \bldapmodify\b(1).]
'
function deny_non_admin_shadow_access {
typeset TARGET=''
typeset -a LIST=( )
# If the ACI already exists, we are done
# The deny_non_admin_shadow_access and deny_non_host_shadow_access ACIs
# should be mutually exclusive, so if the latter exists, delete it
print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: '"${TARGET}"'(targetattr = "shadowLastChange || shadowMin || shadowMax || shadowWarning || shadowInactive || shadowExpire || shadowFlag || userPassword")
(
version 3.0; acl "'"${NON_ADMIN_ACI_NAME}"'";
deny (write,read,search,compare,add,delete) userdn != "ldap:///'"${STR[LDAP_ADMINDN]}"'";
)
then
Log.fatal "Adding '${NON_ADMIN_ACI_NAME}' ACI failed"
return 68
fi
showProgress "ACI '${NON_ADMIN_ACI_NAME}' added."
return 0
}
Man.addFunc setup_shadow_update '' '[+NAME?setup_shadow_update - set up shadow update.]
[+DESCRIPTION?Check whether the profile \bSTR[LDAP_PROFILE_NAME]]\b for \bSTR[LDAP_BASEDN]]\b exists. If not simply notify the user and return. Otherwise check whether the profile uses authenticationMethod "GSSAPI" and credentialLevel "self". If so ask the user whether to use host or "Admin" user principal for shadow updates and collect the related info. Sets \bINT[NEED_HOSTACL]]\b if the host principal should be used for shadow update (requires that \bTMPF[GSSAPI_AUTH_MAY_BE_USED]]\b is already set).]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66? a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bget_confirm()\b, \bdelete_proxy_read_pw()\b, \ballow_host_read_write_shadow()\b, \bdeny_non_host_shadow_access()\b, \bget_adminDN()\b, \bget_admin_pw()\b, \badd_admin()\b, \ballow_admin_read_write_shadow()\b, \bdeny_non_admin_shadow_access()\b.]
'
function setup_shadow_update {
# get content of the profile
typeset -l LINE
-b "cn=${STR[LDAP_PROFILE_NAME]},ou=profile,${STR[LDAP_BASEDN]}" \
while read LINE ; do
&& GSSAPI=1
&& SELF=1
done
Log.verbose "Profile '${STR[LDAP_PROFILE_NAME]}' does not exist"
return 0
fi
# If authenticationMethod has 'GSSAPI' and credentialLevel
# has 'self', ask to use the host principal for shadow update
INT[NEED_HOSTACL]=1
fi
Log.verbose "NEED_HOSTACL = ${INT[NEED_HOSTACL]}"
'use_host_principal_help'
if (( $? )); then
delete_proxy_read_pw || return 66
allow_host_read_write_shadow || return 67
deny_non_host_shadow_access || return 68
Log.info 'Shadow update has been enabled'
else
Log.warn 'Shadow update may not work'
fi
return 0
fi
'add_admin_cred_help'
if (( $? )); then
add_admin || return 69
delete_proxy_read_pw || return 66
allow_admin_read_write_shadow || return 70
deny_non_admin_shadow_access || return 71
Log.info 'Shadow update has been enabled'
else
'work'
fi
return 0
}
Man.addFunc get_srv_list '' '[+NAME?get_srv_list - Ask user for default server list.]
[+DESCRIPTION?Ask the user for the default server list and store it into \bSTR[LDAP_SERVER_LIST]]\b.]
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_srv_list {
# If LDAP_SERVER_LIST is NULL, then set, otherwise leave alone
if [[ -z ${STR[LDAP_SERVER_LIST]} ]]; then
STR[LDAP_SERVER_LIST]=${ANS%%[[:space:]]*}
STR[LDAP_SERVER_LIST]="${STR[LDAP_SERVER_LIST]}:${INT[DS_PORT]}"
fi
fi
while : ; do
* ) break ;;
esac
done
STR[LDAP_SERVER_LIST]="${ANS}"
}
Man.addFunc get_pref_srv '' '[+NAME?get_pref_srv - Ask user for preferred server list.]
[+DESCRIPTION?Ask the user for the preferred server list and store it into \bSTR[LDAP_PREF_SRVLIST]]\b (overrides the server list).]
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_pref_srv {
while : ; do
* ) break ;;
esac
done
STR[LDAP_PREF_SRVLIST]="${ANS}"
}
Man.addFunc get_search_scope '' '[+NAME?get_search_scope - Ask user for search scope.]
[+DESCRIPTION?Ask the user for the search scope and store it into \bSTR[LDAP_SEARCH_SCOPE]]\b.]
[+RETURN VALUES]{
[+1?search scope "one" selected.]
[+2?search scope "sub" selected.]
}
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_search_scope {
integer RES
1 2 1 srch_scope_help
STR[LDAP_SEARCH_SCOPE]='one'
return 1
}
Man.addFunc get_cred_level '' '[+NAME?get_cred_level - Ask user for credential level.]
[+DESCRIPTION?Ask the user for the client credential level to use and store it into \bSTR[LDAP_CRED_LEVEL]]\b.]
[+RETURN VALUES?The index wrt. \bCRED_LEVELS\b of the selected credential level \b+1\b.]
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_cred_level {
integer RES
typeset PROMPT=''
PROMPT+='Choose Credential level (identity) [h=help]:'
RES=$?
STR[LDAP_CRED_LEVEL]="${CRED_LEVELS[RES-1]}"
return ${RES}
}
Man.addFunc get_auth '' '[+NAME?get_auth - ask user for authentication methods.]
[+DESCRIPTION?Ask the user for authentication methods to enable and store them as a semicolon separated list into \bSTR[LDAP_AUTHMETHOD | LDAP_SRV_AUTHMETHOD_{PAM|KEY|CMD}}]]\b and set \bINT[NEED_SRVAUTH_{PAM|KEY|CMD}]]\b to 0 depending on the given \atype\a (either "client", "pam_ldap", "keyserv", or "passwd-cmd") and selected methods.]
[+RETURN VALUES]{
[+0?on success.]
[+-1?if an invalid \atype\a was given.]
}
[+SEE ALSO?\bget_menu_choice()\b, \bget_confirm_nodef()\b.]
\n\n\atype\a
'
function get_auth {
typeset -a SELECTED=( )
esac
# client
ASK+='Choose DEFAULT authentication (bind) method (0=reset, h=help):'
MENU='auth_method_menu'
HELPTAG='auth_help'
else
ASK="Choose ${UTYPE} authentication (bind) method (0=reset, h=help):"
MENU='srvauth_method_menu'
HELPTAG='srvauth_help'
fi
while : ; do
RES=$?
M=${AUTH_METHODS[RES - OFFSET]}
# avoid doubles
VAL=" ${SELECTED[@]} "
M=${VAL// /\;}
M=${M#\;}
else
VAL=''
M=''
fi
print && Log.info "Current authentication method(s): ${M%\;}\n"
&& break
done
M=${M%\;}
M=${M//\;/\;${TYPE}:}
if [[ -n ${M} ]]; then
else
INT[NEED_SRVAUTH_${TYPE##*_}]=0
fi
else
fi
Log.verbose "Selected ${UTYPE} authentication methods: '${STR[${VNAME}]}'"
return 0
}
Man.addFunc get_followref '' '[+NAME?get_followref - Ask user whether or not to follow referrals.]
[+DESCRIPTION?Ask the user whether the client should follow referrals. Result gets stored into \bINT[LDAP_FOLLOWREF]]\b.]
[+SEE ALSO?\bget_confirm()\b, \bldapclient\b(1M).]
'
function get_followref {
'referrals_help'
INT[LDAP_FOLLOWREF]=$?
}
Man.addFunc get_timelimit '' '[+NAME?get_timelimit - Ask user for search time limit.]
[+DESCRIPTION?Ask the user for the max. time allowed to process a search operation and store it into \bINT[DS_TIMELIMIT]]\b.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bis_numeric()\b, \bget_negone_num()\b.]
'
function get_timelimit {
# Get current timeout value from cn=config
while read LINE; do
break
fi
done
if [[ -z ${VAL} ]]; then
Log.fatal 'Unable to check current search processing timeout of the DS'
return 66
fi
is_numeric ${VAL} && NUM=${VAL} || NUM=INT[DS_TIMELIMIT]
'30'
INT[DS_TIMELIMIT]=${NUM}
return 0
}
Man.addFunc get_sizelimit '' '[+NAME?get_sizelimit - Ask user for search size limit.]
[+DESCRIPTION?Ask the user for the max. number of entries to return for a single search operation and store it into \bINT[DS_SIZELIMIT]]\b.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bis_numeric()\b, \bget_negone_num()\b.]
'
function get_sizelimit {
# Get current search sizelimit
while read LINE; do
break
fi
done
if [[ -z ${VAL} ]]; then
Log.fatal 'Unable to check current search entry result limit of the DS'
return 66
fi
is_numeric ${VAL} && NUM=${VAL} || NUM=INT[DS_SIZELIMIT]
INT[DS_SIZELIMIT]=${NUM}
return 0
}
Man.addFunc get_want_crypt '' '[+NAME?get_want_crypt - Ask user whether to store passwords in crypt.]
[+DESCRIPTION?Ask the user whether the default password storage scheme should be set to "CRYPT" and stores the result into \bINT[NEED_CRYPT]]\b.]
[+SEE ALSO?\bget_confirm()\b.]
'
function get_want_crypt {
'n' 'crypt_help'
INT[NEED_CRYPT]=$?
}
Man.addFunc get_srch_time '' '[+NAME?get_srch_time - Ask user for client search time limit.]
[+DESCRIPTION?Ask the user for the max. time in seconds a client waits for a search result and store it into \bINT[LDAP_SEARCH_TIME_LIMIT]]\b.]
[+SEE ALSO?\bget_negone_num()\b, \bldapclient\b(1M).]
'
function get_srch_time {
${INT[LDAP_SEARCH_TIME_LIMIT]} 'srchtime_help'
}
Man.addFunc get_prof_ttl '' '[+NAME?get_prof_ttl - Ask user for client profile time to live (TTL).]
[+DESCRIPTION?Ask the user for the max. time in seconds a client may cache its profile before refreshing again and store it into \bINT[LDAP_PROFILE_TTL]]\b.]
[+SEE ALSO?\bget_negone_num()\b, \bldapclient\b(1M).]
'
function get_prof_ttl {
${INT[LDAP_PROFILE_TTL]} 'profttl_help'
INT[LDAP_PROFILE_TTL]=${NUM}
}
Man.addFunc get_bind_limit '' '[+NAME?get_bind_limit - Ask user for client bind time limit.]
[+DESCRIPTION?Ask the user for the max. time in seconds a client may try to bind to the server and store it into \bINT[LDAP_BIND_LIMIT]]\b.]
[+SEE ALSO?\bget_negone_num()\b, \bldapclient\b(1M).]
'
function get_bind_limit {
${INT[LDAP_BIND_LIMIT]} 'bindlim_help'
INT[LDAP_BIND_LIMIT]=${NUM}
}
Man.addFunc get_want_shadow_update '' '[+NAME?get_want_shadow_update - Ask user whether to enable shadow update.]
[+DESCRIPTION?Ask the user whether to enable shadow update. Set \bINT[LDAP_ENABLE_SHADOW_UPDATE]]\b to 0 if not desired, to 1 otherwise.]
[+SEE ALSO?\bget_confirm()\b.]
'
function get_want_shadow_update {
'enable_shadow_update_help'
}
######################################################################
# FUNCTIONS FOR Service Search Descriptor's START HERE.
######################################################################
Man.addFunc add_ssd '' '[+NAME?add_ssd - Ask user for SSD to add.]
[+DESCRIPTION?Ask the user for the ID:BASE:SCOPE and add it to \bSSD\b list.]
[+SEE ALSO?\bget_ans\b, \bget_ans_req()\b.]
'
function add_ssd {
typeset -l SCOPE=''
integer FOUND
while : ; do
[[ -z ${ANS} ]] && return
FOUND=0
done
Log.warn "An SSD for '${ANS}' already exists:\n${X}\n"
done
ID="${ANS}"
while : ; do
get_ans_req 'Enter the search base (e.g. ou=people,o=inet):'
done
BASE="${ANS}"
while : ; do
get_ans_req "Enter the search scope (one|sub):"
Log.warn "'${ANS}' is NOT valid - Enter 'one' or 'sub'"
done
}
Man.addFunc delete_ssd '' '[+NAME?delete_ssd - Ask user which SSD to delete.]
[+DESCRIPTION?Ask the user for the ID of the SSD to delete and remove it from \bSSD\b list.]
[+SEE ALSO?\bget_ans()\b.]
'
function delete_ssd {
[[ -z ${ANS} ]] && return
typeset X
X=${SSD[I]}
done
Log.warn "Invalid service name: '${ANS}' not present in list"
return
fi
# need to do a little bit more, since ksh allows to remove the 1st entry,
# only (i.e. like "shift 1" for positional params)
SSD[${I}]="${SSD[I-1]}"
done
unset SSD[0]
}
Man.addFunc modify_ssd '' '[+NAME?modify_ssd - Allow user to modify an SSD.]
[+DESCRIPTION?Ask the user for the ID of the SSD to modify, let the user modify it and finally save changes back to the \bSSD\b list.]
[+SEE ALSO?\bget_ans()\b, \bread\b(1).]
'
function modify_ssd {
get_ans 'Enter the service name of the SSD to modify:'
[[ -z ${ANS} ]] && return
typeset -l SCOPE
X=${SSD[I]}
done
Log.warn "Invalid service name: '${ANS}'"
return 0
fi
# most users expect emacs edit behavior (don't have a proper profile)
set -o emacs
read -v X?'Current SSD: '
# now verify
ID=${X%%:*}
then
Log.warn 'SSD is invalid. Change skipped'
return
fi
}
Man.addFunc reset_ssd '' '[+NAME?reset_ssd - Blank out current list of SSDs.]
[+DESCRIPTION?Clear the \bSSD\b array.]
'
function reset_ssd {
SSD=( )
unset SSD[0] # required otherwise it would contain a single '\n'. Bug?
}
Man.addFunc display_ssd '' '[+NAME?display_ssd - Display current SSD list.]
[+DESCRIPTION?Display the current \bSSD\b list and return, when the user hit the enter key.]
'
function display_ssd {
typeset X
print '
Current Service Search Descriptors:
=================================='
print " ${X}"
done
print '\nHit return to continue.'
read
}
Man.addFunc prompt_ssd '' '[+NAME?prompt_ssd - Get SSDs from user.]
[+DESCRIPTION?Ask the user whether to add/delete/modify/display one or more SSDs currently set and execute the corresponding action.]
[+SEE ALSO?\bdisplay_msg()\b, \bget_ans()\b, \badd_ssd()\b, \bdelete_ssd()\b, \bmodify_ssd()\b, \bdisplay_ssd()\b, \breset_ssd()\b.]
'
function prompt_ssd {
'n' 'ssd_help'
then
return
fi
# Display menu for SSD choices
while : ; do
get_ans 'Enter menu choice:' 'Quit'
[Dd] | delete) delete_ssd ;;
[Mm] | modify) modify_ssd ;;
[Pp] | print | display) display_ssd ;;
display_msg 'ssd_menu_help '
print ' Press return to continue.'
read
;;
esac
done
}
######################################################################
# End Of FUNCTIONS FOR Service Search Descriptor's
######################################################################
Man.addFunc prompt_config_info '' '[+NAME?prompt_config_info - Ask user for missing config info.]
[+DESCRIPTION?Ask the user for the config info not yet available/read from an '"${PROG}"' config file.]
[+RETURN VALUES]{
[+0?on success (all info aquired).]
[+>= 66?a fatal error occured.]
}
'
function prompt_config_info {
# Prompt for DS server name
# Prompt for DS port number
# Check DS version for compatibility
chk_ids_version || return 66
# Get the Directory manager DN and passwd
# Check if the DS supports the VLV
chk_vlv_indexes || return 67
get_confirm 'Do you want to modify the DS timelimit for processing searches (y/n/h)?' 'n' 'tlim_help'
get_timelimit || return 70
fi
get_confirm 'Do you want to modify the DS sizelimit - max. entries to return (y/n/h)?' 'n' 'slim_help'
get_sizelimit || return 71
fi
# LDAP CLIENT PROFILE SPECIFIC INFORMATION
# (i.e. the fields that show up in the profile)
get_basedn || return 68
setup_shadow_update || return 69
return 0
fi
# Store passwords in crypt format?
# If cred is "anonymous", make auth == "none"
[[ ${STR[LDAP_CRED_LEVEL]} != anonymous ]] && get_auth 'client'
get_confirm 'Do you want to setup any non-default Authentication Methods (y/n/h)?' 'n' 'srvauth_help'
if (( $? )); then
get_confirm 'Do you want to setup Authentication Methods for "pam_ldap" (y/n/h)?' 'n' 'pam_ldap_help'
INT[NEED_SRVAUTH_PAM]=$?
get_confirm 'Do you want to setup Authentication Methods for "keyserv" (y/n/h)?' 'n' 'keyserv_help'
INT[NEED_SRVAUTH_KEY]=$?
get_confirm 'Do you want to setup Authentication Methods for "passwd-cmd (y/n/h)?' 'n' 'passwd-cmd_help'
INT[NEED_SRVAUTH_CMD]=$?
fi
# Get client timeouts
return 0
}
######################################################################
# End Of FUNCTIONS FOR prompt_config_info()
######################################################################
######################################################################
# FUNCTIONS FOR display_summary() START HERE.
######################################################################
Man.addFunc get_proxyagent '' '[+NAME?get_proxyagent - Ask user for the proxy agent DN and password.]
[+DESCRIPTION?Ask the user for the proxy agent DN and password to use and store it into \bSTR[LDAP_PROXYAGENT]]\b, \bSTR[LDAP_PROXYAGENT_CRED]]\b.]
[+SEE ALSO?\bget_ans()\b.]
'
function get_proxyagent {
STR[LDAP_PROXYAGENT]="cn=proxyagent,ou=profile,${STR[LDAP_BASEDN]}"
STR[LDAP_PROXYAGENT]="${ANS}"
get_passwd 'Enter passwd for proxyagent:'
STR[LDAP_PROXYAGENT_CRED]="${ANS}"
}
Man.addFunc display_summary '' '[+NAME?display_summary - Display a summary of values entered and let the user modify values at will.]
[+DESCRIPTION?Display a summary of all configuration relevant info and let the user re-enter data if needed.]
'
function display_summary {
# Create lookup table for function names. Needs to be in sync with
# helpTag 'summary_menu' in display_msg()!
# Since menu prompt string is long, set here
typeset PROMPT='Enter config value to change: (1-20 0=commit changes)'
while : ; do
# Display menu and get value in range
RES=$?
# Make sure where not exiting
# Call appropriate function from function table
done
# If credlevel is still proxy see if user wants a change?
if [[ ${STR[LDAP_AUTHMETHOD]} != none ]]; then
INT[NEED_PROXY]=1
else
'credential level will be set to "anonymous"'
STR[LDAP_CRED_LEVEL]='anonymous'
fi
fi
# If shadow update is enabled, set up administrator credential
INT[NEED_ADMIN]=1
then
INT[NEED_HOSTACL]=1
INT[NEED_ADMIN]=0
fi
fi
fi
WARNING: About to start committing changes. (y=continue, n=EXIT)'
if (( ! $? )); then
Log.info 'Terminating setup without making changes at users request'
return 1
fi
return 0
}
######################################################################
# End Of FUNCTIONS FOR display_summary()
######################################################################
Man.addFunc modify_cn '' '[+NAME?modify_cn - modify objectclass "ipNetwork" to RFC 2307bis.]
[+DESCRIPTION?Change the cn from MUST to MAY in ipNetwork objectclass.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_cn {
getDSobjectclasses || return 66
typeset NEWDEF="'ipNetwork' SUP top STRUCTURAL DESC 'Abstraction of a network. The distinguished value of the cn attribute denotes the canonical name of the network' MUST ipNetworkNumber MAY "'( cn $ ipNetmaskNumber $ l $ description $ manager )'" X-ORIGIN 'draft-howard-rfc2307bis'"
# bis-delta: MUST ( -cn ) MAY ( +cn )
if [[ -n ${DEF} ]]; then
# assume no need to fix, old definition would start with a '('
showProgress 'Schema definition of ipNetwork ok (RFC2307bis).'
return 0
fi
fi
print '
dn: cn=schema
changetype: modify
add: objectclasses
objectclasses: ( 1.3.6.1.1.1.2.7 NAME '"${NEWDEF}"')
then
Log.fatal 'Schema update of ipNetwork to RFC2307bis failed'
return 67
fi
showProgress 'Schema update of ipNetwork to RFC2307bis done.'
return 0
}
Man.addFunc modify_timelimit '' '[+NAME?modify_timelimit - Set the DS timelimit.]
[+DESCRIPTION?Set the DS timelimit to \bINT[DS_TIMELIMIT]]\b.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_timelimit {
typeset NAME='nsslapd-timelimit'
print '
dn: cn=config
changetype: modify
replace: '"${NAME}"'
'"${NAME}"': '"${INT[DS_TIMELIMIT]}"' s
then
Log.fatal 'Update of ${NAME} failed'
return 66
fi
showProgress "Changed ${NAME} to ${INT[DS_TIMELIMIT]} in 'cn=config'."
return 0
}
Man.addFunc modify_sizelimit '' '[+NAME?modify_sizelimit - Set the DS sizelimit.]
[+DESCRIPTION?Set the DS sizelimit to \bINT[DS_SIZELIMIT]]\b.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_sizelimit {
typeset NAME='nsslapd-sizelimit'
print '
dn: cn=config
changetype: modify
replace: '"${NAME}"'
'"${NAME}"': '"${INT[DS_SIZELIMIT]}"'
then
Log.fatal "Update of ${NAME} failed"
return 66
fi
showProgress "Changed ${NAME} to ${INT[DS_SIZELIMIT]} in 'cn=config'."
return 0
}
Man.addFunc modify_pwd_crypt '' '[+NAME?modify_pwd_crypt - modify the passwd storage scheme to use CRYPT.]
[+DESCRIPTION?Set the default password policy of the DS to CRYPT.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_pwd_crypt {
# DS 5.2 moved passwordchangescheme off to a new data structure
typeset FMT='dn: %s\nchangetype: modify\nreplace: %s\n%s: %s\n\n'
DN='cn=Default Password Policy,cn=Password Policies,cn=config'
TARGET='ds-cfg-default-password-storage-scheme'
VALUE='cn=CRYPT,cn=Password Storage Schemes,cn=config'
else
# DSEE
fi
MSG="Changed '${TARGET}' to 'CRYPT'"
TARGET='ds-cfg-allow-pre-encoded-passwords'
MSG+="and '${TARGET}' to 'true'"
fi
DN='cn=Password Policy Import,cn=Plugins,cn=config'
TARGET='ds-cfg-default-user-password-storage-scheme'
fi
then
Log.fatal 'Update of passwordStorageScheme failed'
return 66
fi
showProgress "${MSG}."
return 0
}
Man.addFunc update_schema_attr '' '[+NAME?update_schema_attr - Update DS schema to support Naming Services.]
[+DESCRIPTION?Update the schema of the DS with the attribute types required for the Solaris Naming Services. It just checks, whether the OID is defined in the server schema. If already defined, it is left as is, otherwise added.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1), \bgetDSattributes()\b.]
'
function update_schema_attr {
# incorporate former 'keep_backward_compatibility()'
getDSattributes || return 66
typeset MEMBERGID_OID='1.3.6.1.4.1.42.2.27.5.1.30'
[[ -n ${DEF} ]] && MEMBERGID_OID='memberGid-oid'
typeset RFC822MAILMEMBER_OID='1.3.6.1.4.1.42.2.27.2.1.15'
[[ -n ${DEF} ]] && RFC822MAILMEMBER_OID='rfc822mailMember-oid'
# EE and OD definitions seem to be compatible wrt. to Solaris. However, the
# OD defs usually specifies explicitly the server behavior (what happens, if
# EQUALITY|SUBSTR is not specified => caseIgnore[Substring]Match)) and
# sometimes a different kind of String to use (see RFC 4517):
# IA5 String: ASCII character in the range of 0..127
# Octet String: byte collection (0..255), usually not human readable,
# bytewise comparision
# Directory String: an UTF-8 string
# DN: basically an UTF-8 string, but with some constraints wrt. backslash
# escaping '\0', '"', '+', ',', ';', '<', '>', and '\'
# Boolean String: TRUE|FALSE
typeset -A EE=( )
typeset -A OD=( )
OD['1.3.6.1.1.1.1.28']="'nisPublicKey' DESC 'NIS public key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'" # Directory vs. Octet String
OD['1.3.6.1.1.1.1.29']="'nisSecretKey' DESC 'NIS secret key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'" # Directory vs. Octet String
OD['1.3.6.1.1.1.1.30']="'nisDomain' DESC 'NIS domain' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'draft-howard-rfc2307bis'" # Directory vs. IA5 String
EE['1.3.6.1.1.1.1.31']="'automountMapName' DESC 'automount Map Name' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
OD['1.3.6.1.1.1.1.31']="'automountMapName' DESC 'automount Map Name' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'"
EE['1.3.6.1.1.1.1.32']="'automountKey' DESC 'automount Key Value' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
OD['1.3.6.1.1.1.1.32']="'automountKey' DESC 'Automount Key value' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'"
EE['1.3.6.1.1.1.1.33']="'automountInformation' DESC 'automount information' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
OD['1.3.6.1.1.1.1.33']="'automountInformation' DESC 'Automount information' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'"
OD['1.3.6.1.4.1.42.2.27.1.1.12']="'nisNetIdUser' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"
OD['1.3.6.1.4.1.42.2.27.1.1.13']="'nisNetIdGroup' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"
OD['1.3.6.1.4.1.42.2.27.1.1.14']="'nisNetIdHost' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"
EE[${RFC822MAILMEMBER_OID}]="'rfc822mailMember' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
OD[${RFC822MAILMEMBER_OID}]="'rfc822mailMember' DESC 'rfc822 mail addresss of group member' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"
OD['2.16.840.1.113730.3.1.30']="'mgrpRFC822MailMember' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Solaris Specific'"
OD['1.3.6.1.4.1.42.2.27.5.1.15']="'SolarisLDAPServers' DESC 'LDAP Server address eg. 76.234.3.1:389' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.16']="'SolarisSearchBaseDN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.16']="'SolarisSearchBaseDN' DESC 'Search Base Distinguished Name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # DN vs. Directory String
EE['1.3.6.1.4.1.42.2.27.5.1.17']="'SolarisCacheTTL' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.17']="'SolarisCacheTTL' DESC 'TTL value for the Domain information eg. 1w, 2d, 3h, 10m, or 5s' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.18']="'SolarisBindDN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.18']="'SolarisBindDN' DESC 'DN to be used to bind to the directory as proxy' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # DN vs. Directory String
EE['1.3.6.1.4.1.42.2.27.5.1.19']="'SolarisBindPassword' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.19']="'SolarisBindPassword' DESC 'Password for bindDN to authenticate to the directory' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # IA5 vs. Octet String
OD['1.3.6.1.4.1.42.2.27.5.1.20']="'SolarisAuthMethod' DESC 'Authentication method to be used eg. \"NS_LDAP_AUTH_NONE\", \"NS_LDAP_AUTH_SIMPLE\" or \"NS_LDAP_AUTH_SASL_CRAM_MD5\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
OD['1.3.6.1.4.1.42.2.27.5.1.21']="'SolarisTransportSecurity' DESC 'Transport Level Security method to be used eg. \"NS_LDAP_SEC_NONE\" or \"NS_LDAP_SEC_SASL_TLS\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.22']="'SolarisCertificatePath' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.22']="'SolarisCertificatePath' DESC 'Path to certificate file/device' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.1.23']="'SolarisCertificatePassword' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.23']="'SolarisCertificatePassword' DESC 'Password or PIN that grants access to certificate.' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # IA5 vs. Octet String
OD['1.3.6.1.4.1.42.2.27.5.1.24']="'SolarisDataSearchDN' DESC 'Search DN for data lookup in \":(DN0),(DN1),...\" format' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.1.25']="'SolarisSearchScope' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.25']="'SolarisSearchScope' DESC 'Scope to be used for search operations eg. \"NS_LDAP_SCOPE_BASE\", \"NS_LDAP_SCOPE_ONELEVEL\" or \"NS_LDAP_SCOPE_SUBTREE\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.26']="'SolarisSearchTimeLimit' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.26']="'SolarisSearchTimeLimit' DESC 'Time Limit in seconds for search operations' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"
OD['1.3.6.1.4.1.42.2.27.5.1.27']="'SolarisPreferredServer' DESC 'Preferred LDAP Server address or network number' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.28']="'SolarisPreferredServerOnly' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.28']="'SolarisPreferredServerOnly' DESC 'Boolean flag for use of preferredServer or not' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. Boolean String
EE['1.3.6.1.4.1.42.2.27.5.1.29']="'SolarisSearchReferral' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.29']="'SolarisSearchReferral' DESC 'referral chasing option eg. \"NS_LDAP_NOREF\" or \"NS_LDAP_FOLLOWREF\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.4']="'SolarisAttrKeyValue' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.4']="'SolarisAttrKeyValue' DESC 'Semi-colon separated key=value pairs of attributes' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.5']="'SolarisAuditAlways' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.5']="'SolarisAuditAlways' DESC 'Always audited attributes per-user' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.6']="'SolarisAuditNever' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.6']="'SolarisAuditNever' DESC 'Never audited attributes per-user' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.7']="'SolarisAttrShortDesc' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.7']="'SolarisAttrShortDesc' DESC 'Short description about an entry, used by GUIs' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.8']="'SolarisAttrLongDesc' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.8']="'SolarisAttrLongDesc' DESC 'Detail description about an entry' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.9']="'SolarisKernelSecurityPolicy' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.9']="'SolarisKernelSecurityPolicy' DESC 'Solaris kernel security policy' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.10']="'SolarisProfileType' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.10']="'SolarisProfileType' DESC 'Type of object defined in profile'EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.11']="'SolarisProfileId' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.11']="'SolarisProfileId' DESC 'Identifier of object defined in profile' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.1.12']="'SolarisUserQualifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.12']="'SolarisUserQualifier' DESC 'Per-user login attributes' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.13']="'SolarisAttrReserved1' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.13']="'SolarisAttrReserved1' DESC 'Reserved for future use' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.14']="'SolarisAttrReserved2' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.14']="'SolarisAttrReserved2' DESC 'Reserved for future use' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.42.2.27.5.1.1']="'SolarisProjectID' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.1']="'SolarisProjectID' DESC 'Unique ID for a Solaris Project entry' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.1.2']="'SolarisProjectName' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.2']="'SolarisProjectName' DESC 'Name of a Solaris Project Entry' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"
OD['1.3.6.1.4.1.42.2.27.5.1.3']="'SolarisProjectAttr' DESC 'Attributes of a Solaris Project entry' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"
EE[${MEMBERGID_OID}]="'memberGid' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
OD[${MEMBERGID_OID}]="'memberGid' DESC 'Posix Group Name' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.11.1.3.1.1.0']="'defaultServerList' DESC 'Default LDAP server host address used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.11.1.3.1.1.0']="'defaultServerList' DESC 'List of default servers' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 4876'"
EE['1.3.6.1.4.1.11.1.3.1.1.1']="'defaultSearchBase' DESC 'Default LDAP base DN used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE"
OD['1.3.6.1.4.1.11.1.3.1.1.1']="'defaultSearchBase' DESC 'Default base for searches' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'RFC 4876'"
EE['1.3.6.1.4.1.11.1.3.1.1.2']="'preferredServerList' DESC 'Preferred LDAP server host addresses to be used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.11.1.3.1.1.2']="'preferredServerList' DESC 'List of preferred servers' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 4876'"
EE['1.3.6.1.4.1.11.1.3.1.1.3']="'searchTimeLimit' DESC 'Maximum time in seconds a DUA should allow for a search to complete' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
OD['1.3.6.1.4.1.11.1.3.1.1.3']="'searchTimeLimit' DESC 'Maximum time an agent or service allows for a search to complete' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 4876'"
EE['1.3.6.1.4.1.11.1.3.1.1.4']="'bindTimeLimit' DESC 'Maximum time in seconds a DUA should allow for the bind operation to complete' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
OD['1.3.6.1.4.1.11.1.3.1.1.4']="'bindTimeLimit' DESC 'Maximum time an agent or service allows for a bind operation to complete' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 4876'"
EE['1.3.6.1.4.1.11.1.3.1.1.5']="'followReferrals' DESC 'Tells DUA if it should follow referrals returned by a DSA search result' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.11.1.3.1.1.5']="'followReferrals' DESC 'An agent or service does or should follow referrals' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'RFC 4876'" # Directory vs. Boolean String
EE['1.3.6.1.4.1.11.1.3.1.1.6']="'authenticationMethod' DESC 'A keystring which identifies the type of authentication method used to contact the DSA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.11.1.3.1.1.6']="'authenticationMethod' DESC 'Identifies the types of authentication methods either used, required, or provided by a service or peer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 4876'"
EE['1.3.6.1.4.1.11.1.3.1.1.7']="'profileTTL' DESC 'Time to live before a client DUA should re-read this configuration profile' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
OD['1.3.6.1.4.1.11.1.3.1.1.7']="'profileTTL' DESC 'Time to live, in seconds, before a profile is considered stale' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 4876'"
EE['1.3.6.1.4.1.11.1.3.1.1.14']="'serviceSearchDescriptor' DESC 'LDAP search descriptor list used by Naming-DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
OD['1.3.6.1.4.1.11.1.3.1.1.14']="'serviceSearchDescriptor' DESC 'Specifies search descriptors required, used, or supported by a particular service or agent' EQUALITY caseExactMatch SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 4876'" # IA5 vs. Directory String
EE['1.3.6.1.4.1.11.1.3.1.1.9']="'attributeMap' DESC 'Attribute mappings used by a Naming-DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
OD['1.3.6.1.4.1.11.1.3.1.1.9']="'attributeMap' DESC 'Attribute mappings used, required, or supported by an agent or service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 4876'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.11.1.3.1.1.10']="'credentialLevel' DESC 'Identifies type of credentials a DUA should use when binding to the LDAP server' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.11.1.3.1.1.10']="'credentialLevel' DESC 'Identifies type of credentials either used, required, or supported by an agent or service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'RFC 4876'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.11.1.3.1.1.11']="'objectclassMap' DESC 'Objectclass mappings used by a Naming-DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
OD['1.3.6.1.4.1.11.1.3.1.1.11']="'objectclassMap' DESC 'Object class mappings used, required, or supported by an agent or service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 4876'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.11.1.3.1.1.12']="'defaultSearchScope' DESC 'Default search scope used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.11.1.3.1.1.12']="'defaultSearchScope' DESC 'Default scope used when performing a search' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'RFC 4876'" # Directory vs. IA5 String
EE['1.3.6.1.4.1.11.1.3.1.1.13']="'serviceCredentialLevel' DESC 'Search scope used by a service of the DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
OD['1.3.6.1.4.1.11.1.3.1.1.13']="'serviceCredentialLevel' DESC 'Specifies the type of credentials either used, required, or supported by a specific service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 4876'"
EE['1.3.6.1.4.1.11.1.3.1.1.15']="'serviceAuthenticationMethod' DESC 'Authentication Method used by a service of the DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
OD['1.3.6.1.4.1.11.1.3.1.1.15']="'serviceAuthenticationMethod' DESC 'Specifies types authentication methods either used, required, or supported by a particular service' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 4876'"
EE['1.3.18.0.2.4.1140']="'printer-uri' DESC 'A URI supported by this printer. This URI SHOULD be used as a relative distinguished name (RDN). If printer-xri-supported is implemented, then this URI value MUST be listed in a member value of printer-xri-supported.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.18.0.2.4.1140']="'printer-uri' DESC 'A URI supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1107']="'printer-xri-supported' DESC 'The unordered list of XRI (extended resource identifiers) supported by this printer. Each member of the list consists of a URI (uniform resource identifier) followed by optional authentication and security metaparameters.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
OD['1.3.18.0.2.4.1107']="'printer-xri-supported' DESC 'The unordered list of XRI (extended resource identifiers) supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1135']="'printer-name' DESC 'The site-specific administrative name of this printer, more end-user friendly than a URI.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
OD['1.3.18.0.2.4.1135']="'printer-name' DESC 'The site-specific administrative name of this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1119']="'printer-natural-language-configured' DESC 'The configured language in which error and status messages will be generated (by default) by this printer. Also, a possible language for printer string attributes set by operator, system administrator, or manufacturer. Also, the (declared) language of the \"printer-name\", \"printer-location\", \"printer-info\", and \"printer-make-and-model\" attributes of this printer. For example: \"en-us\" (US English) or \"fr-fr\" (French in France) Legal values of language tags conform to [RFC3066] \"Tags for the Identification of Languages\".' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
OD['1.3.18.0.2.4.1119']="'printer-natural-language-configured' DESC 'The configured natural language in which error and status messages will be generated (by default) by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1136']="'printer-location' DESC 'Identifies the location of the printer. This could include things like: \"in Room 123A\", \"second floor of building XYZ\".' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
OD['1.3.18.0.2.4.1136']="'printer-location' DESC 'The physical location of this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1139']="'printer-info' DESC 'Identifies the descriptive information about this printer. This could include things like: \"This printer can be used for printing color transparencies for HR presentations\", or \"Out of courtesy for others, please print only small (1-5 page) jobs at this printer\", or even \"This printer is going away on July 1, 1997, please find a new printer\".' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
OD['1.3.18.0.2.4.1139']="'printer-info' DESC 'Descriptive information about this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1134']="'printer-more-info' DESC 'A URI used to obtain more information about this specific printer. For example, this could be an HTTP type URI referencing an HTML page accessible to a Web Browser. The information obtained from this URI is intended for end user consumption.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.18.0.2.4.1134']="'printer-more-info' DESC 'A URI for more information about this specific printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1138']="'printer-make-and-model' DESC 'Identifies the make and model of the device. The device manufacturer MAY initially populate this attribute.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
OD['1.3.18.0.2.4.1138']="'printer-make-and-model' DESC 'Make and model of this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1133']="'printer-ipp-versions-supported' DESC 'Identifies the IPP protocol version(s) that this printer supports, including major and minor versions, i.e., the version numbers for which this Printer implementation meets the conformance requirements.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}"
OD['1.3.18.0.2.4.1133']="'printer-ipp-versions-supported' DESC 'IPP protocol version(s) that this printer supports.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1132']="'printer-multiple-document-jobs-supported' DESC 'Indicates whether or not the printer supports more than one document per job, i.e., more than one Send-Document or Send-Data operation with document data.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE"
OD['1.3.18.0.2.4.1132']="'printer-multiple-document-jobs-supported' DESC 'Indicates whether or not this printer supports more than one document per job.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1109']="'printer-charset-configured' DESC 'The configured charset in which error and status messages will be generated (by default) by this printer. Also, a possible charset for printer string attributes set by operator, system administrator, or manufacturer. For example: \"utf-8\" (ISO 10646/Unicode) or \"iso-8859-1\" (Latin1). Legal values are defined by the IANA Registry of Coded Character Sets and the \"(preferred MIME name)\" SHALL be used as the tag. For coherence with IPP Model, charset tags in this attribute SHALL be lowercase normalized. This attribute SHOULD be static (time of registration) and SHOULD NOT be dynamically refreshed attributetypes: (subsequently).' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{63} SINGLE-VALUE"
OD['1.3.18.0.2.4.1109']="'printer-charset-configured' DESC 'The configured charset in which error and status messages will be generated (by default) by this printer.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{63} SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1131']="'printer-charset-supported' DESC 'Identifies the set of charsets supported for attribute type values of type Directory String for this directory entry. For example: \"utf-8\" (ISO 10646/Unicode) or \"iso-8859-1\" (Latin1). Legal values are defined by the IANA Registry of Coded Character Sets and the preferred MIME name.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{63}"
OD['1.3.18.0.2.4.1131']="'printer-charset-supported' DESC 'Set of charsets supported for the attribute values of syntax DirectoryString for this directory entry.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{63} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1137']="'printer-generated-natural-language-supported' DESC 'Identifies the natural language(s) supported for this directory entry. For example: \"en-us\" (US English) or \"fr-fr\" (French in France). Legal values conform to [RFC3066], Tags for the Identification of Languages.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{63}"
OD['1.3.18.0.2.4.1137']="'printer-generated-natural-language-supported' DESC 'Natural language(s) supported for this directory entry.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{63} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1130']="'printer-document-format-supported' DESC 'The possible document formats in which data may be interpreted and printed by this printer. Legal values are MIME types come from the IANA Registry of Internet Media Types.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}"
OD['1.3.18.0.2.4.1130']="'printer-document-format-supported' DESC 'The possible source document formats which may be interpreted and printed by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1129']="'printer-color-supported' DESC 'Indicates whether this printer is capable of any type of color printing at all, including highlight color.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE"
OD['1.3.18.0.2.4.1129']="'printer-color-supported' DESC 'Indicates whether this printer is capable of any type of color printing at all, including highlight color.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1128']="'printer-compression-supported' DESC 'Compression algorithms supported by this printer. For example: \"deflate, gzip\". Legal values include; \"none\", \"deflate\" attributetypes: (public domain ZIP), \"gzip\" (GNU ZIP), \"compress\" (UNIX).' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255}"
OD['1.3.18.0.2.4.1128']="'printer-compression-supported' DESC 'Compression algorithms supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1127']="'printer-pages-per-minute' DESC 'The nominal number of pages per minute which may be output by this printer (e.g., a simplex or black-and-white printer). This attribute is informative, NOT a service guarantee. Typically, it is the value used in marketing literature to describe this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
OD['1.3.18.0.2.4.1127']="'printer-pages-per-minute' DESC 'The nominal number of pages per minute which may be output by this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1126']="'printer-pages-per-minute-color' DESC 'The nominal number of color pages per minute which may be output by this printer (e.g., a simplex or color printer). This attribute is informative, NOT a service guarantee. Typically, it is the value used in marketing literature to describe this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
OD['1.3.18.0.2.4.1126']="'printer-pages-per-minute-color' DESC 'The nominal number of color pages per minute which may be output by this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1125']="'printer-finishings-supported' DESC 'The possible finishing operations supported by this printer. Legal values include; \"none\", \"staple\", \"punch\", \"cover\", \"bind\", \"saddle-stitch\", \"edge-stitch\", \"staple-top-left\", \"staple-bottom-left\", \"staple-top-right\", \"staple-bottom-right\", \"edge-stitch-left\", \"edge-stitch-top\", \"edge-stitch-right\", \"edge-stitch-bottom\", \"staple-dual-left\", \"staple-dual-top\", \"staple-dual-right\", \"staple-dual-bottom\".' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255}"
OD['1.3.18.0.2.4.1125']="'printer-finishings-supported' DESC 'The possible finishing operations supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1124']="'printer-number-up-supported' DESC 'The possible numbers of print-stream pages to impose upon a single side of an instance of a selected medium. Legal values include; 1, 2, and 4. Implementations may support other values.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27"
OD['1.3.18.0.2.4.1124']="'printer-number-up-supported' DESC 'The possible numbers of print-stream pages to impose upon a single side of an instance of a selected medium.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1123']="'printer-sides-supported' DESC 'The number of impression sides (one or two) and the two-sided impression rotations supported by this printer. Legal values include; \"one-sided\", \"two-sided-long-edge\", \"two-sided-short-edge\".' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}"
OD['1.3.18.0.2.4.1123']="'printer-sides-supported' DESC 'The number of impression sides (one or two) and the two-sided impression rotations supported by this printer.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1122']="'printer-media-supported' DESC 'The standard names/types/sizes (and optional color suffixes) of the media supported by this printer. For example: \"iso-a4\", \"envelope\", or \"na-letter-white\". Legal values conform to ISO 10175, Document Printing Application (DPA), and any IANA registered extensions.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255}"
OD['1.3.18.0.2.4.1122']="'printer-media-supported' DESC 'The standard names/types/sizes (and optional color suffixes) of the media supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1117']="'printer-media-local-supported' DESC 'Site-specific names of media supported by this printer, in the language in \"printer-natural-language-configured\". For example: \"purchasing-form\" (site-specific name) as opposed to (in \"printer-media-supported\"): \"na-letter\" (standard keyword from ISO 10175).' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255}"
OD['1.3.18.0.2.4.1117']="'printer-media-local-supported' DESC 'Site-specific names of media supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1121']="'printer-resolution-supported' DESC 'List of resolutions supported for printing documents by this printer. Each resolution value is a string with 3 fields: 1) Cross feed direction resolution (positive integer), 2) Feed direction resolution (positive integer), 3) Resolution unit. Legal values are \"dpi\" (dots per inch) and \"dpcm\" (dots per centimeter). Each resolution field is delimited by \">\". For example: \"300> 300> dpi>\".' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255}"
OD['1.3.18.0.2.4.1121']="'printer-resolution-supported' DESC 'List of resolutions supported for printing documents by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1120']="'printer-print-quality-supported' DESC 'List of print qualities supported for printing documents on this printer. For example: \"draft, normal\". Legal values include; \"unknown\", \"draft\", \"normal\", \"high\".' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}"
OD['1.3.18.0.2.4.1120']="'printer-print-quality-supported' DESC 'List of print qualities supported for printing documents on this printer.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1110']="'printer-job-priority-supported' DESC 'Indicates the number of job priority levels supported. An IPP conformant printer which supports job priority must always support a full range of priorities from \"1\" to \"100\" (to ensure consistent behavior), therefore this attribute describes the \"granularity\". Legal values of this attribute are from \"1\" to \"100\".' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
OD['1.3.18.0.2.4.1110']="'printer-job-priority-supported' DESC 'Indicates the number of job priority levels supported by this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1118']="'printer-copies-supported' DESC 'The maximum number of copies of a document that may be printed as a single job. A value of \"0\" indicates no maximum limit. A value of \"-1\" indicates unknown.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
OD['1.3.18.0.2.4.1118']="'printer-copies-supported' DESC 'The maximum number of copies of a document that may be printed as a single job on this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1111']="'printer-job-k-octets-supported' DESC 'The maximum size in kilobytes (1,024 octets actually) incoming print job that this printer will accept. A value of \"0\" indicates no maximum limit. A value of \"-1\" indicates unknown.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
OD['1.3.18.0.2.4.1111']="'printer-job-k-octets-supported' DESC 'The maximum size in kilobytes (1,024 octets actually) incoming print job that this printer will accept.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1112']="'printer-current-operator' DESC 'The name of the current human operator responsible for operating this printer. It is suggested that this string include information that would enable other humans to reach the operator, such as a phone number.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
OD['1.3.18.0.2.4.1112']="'printer-current-operator' DESC 'The identity of the current human operator responsible for operating this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1113']="'printer-service-person' DESC 'The name of the current human service person responsible for servicing this printer. It is suggested that this string include information that would enable other humans to reach the service person, such as a phone number.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
OD['1.3.18.0.2.4.1113']="'printer-service-person' DESC 'The identity of the current human service person responsible for servicing this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1114']="'printer-delivery-orientation-supported' DESC 'The possible delivery orientations of pages as they are printed and ejected from this printer. Legal values include; \"unknown\", \"face-up\", and \"face-down\".' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}"
OD['1.3.18.0.2.4.1114']="'printer-delivery-orientation-supported' DESC 'The possible delivery orientations of pages as they are printed and ejected from this printer.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1115']="'printer-stacking-order-supported' DESC 'The possible stacking order of pages as they are printed and ejected from this printer. Legal values include; \"unknown\", \"first-to-last\", \"last-to-first\".' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}"
OD['1.3.18.0.2.4.1115']="'printer-stacking-order-supported' DESC 'The possible stacking order of pages as they are printed and ejected from this printer.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1116']="'printer-output-features-supported' DESC 'The possible output features supported by this printer. Legal values include; \"unknown\", \"bursting\", \"decollating\", \"page-collating\", \"offset-stacking\".' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}"
OD['1.3.18.0.2.4.1116']="'printer-output-features-supported' DESC 'The possible output features supported by this printer.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.4.1108']="'printer-aliases' DESC 'Site-specific administrative names of this printer in addition the printer name specified for printer-name.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}"
OD['1.3.18.0.2.4.1108']="'printer-aliases' DESC 'List of site-specific administrative names of this printer in addition to the value specified for printer-name.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"
EE['1.3.6.1.4.1.42.2.27.5.1.63']="'sun-printer-bsdaddr' DESC 'Sets the server, print queue destination name and whether the client generates protocol extensions. \"Solaris\" specifies a Solaris print server extension. The value is represented by the following value: server \",\" destination \", Solaris\".' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.63']="'sun-printer-bsdaddr' DESC 'Sets the server, print queue destination name and whether the client generates protocol extensions. \"Solaris\" specifies a Solaris print server extension. The value is represented by the following value: server \",\" destination \", Solaris\".' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.1.64']="'sun-printer-kvp' DESC 'This attribute contains a set of key value pairs which may have meaning to the print subsystem or may be user defined. Each value is represented by the following: key \"=\" value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
OD['1.3.6.1.4.1.42.2.27.5.1.64']="'sun-printer-kvp' DESC 'This attribute contains a set of key value pairs which may have meaning to the print subsystem or may be user defined. Each value is represented by the following: key \"=\" value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.1.57']="'nisplusTimeZone' DESC 'tzone column from NIS+ timezone table' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.57']="'nisplusTimeZone' DESC 'tzone column from NIS+ timezone table' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.1.67']="'ipTnetTemplateName' DESC 'Trusted Solaris network template template_name' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.67']="'ipTnetTemplateName' DESC 'Trusted Solaris network template template_name' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.1.68']="'ipTnetNumber' DESC 'Trusted Solaris network template ip_address' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
OD['1.3.6.1.4.1.42.2.27.5.1.68']="'ipTnetNumber' DESC 'Trusted Solaris network template ip_address' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"
# obey CLI syntax force option (if any)
else
fi
X="${MAP[${OID}]}"
X=${X:1}
X=${X%%"'"*} # we have no aliases above
done
if [[ -z ${TODO} ]]; then
X='Schema contains all required attribute definitions'
else
print 'dn: cn=schema\nchangetype: modify\nadd: attributetypes' \
then
Log.fatal 'Adding attribute definitions to schema failed'
return 67
fi
X='Schema attribute definitions added'
fi
showProgress "${X}."
return 0
}
Man.addFunc update_schema_obj '' '[+NAME?update_schema_obj - Update DS schema to support Naming Services.]
[+DESCRIPTION?Update the schema of the DS with the objectclasses required for the Solaris Naming Services. It just checks, whether the OID is already defined on the server. If already defined, it is left as is, otherwise added.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bupdate_schema_attr()\b, \bldapmodify\b(1).]
'
function update_schema_obj {
getDSobjectclasses || return 66
typeset -A EE=( )
typeset -A OD=( )
EE['1.3.6.1.1.1.2.14']="'NisKeyObject' SUP top MUST "'( cn $ nisPublickey $ nisSecretkey ) MAY ( uidNumber $ description )'
OD['1.3.6.1.1.1.2.14']="'nisKeyObject' SUP top AUXILIARY DESC 'An object with a public and secret key' MUST "'( cn $ nisPublicKey $ nisSecretKey ) MAY ( uidNumber $ description )'" X-ORIGIN 'draft-howard-rfc2307bis'"
OD['1.3.6.1.1.1.2.15']="'nisDomainObject' SUP top AUXILIARY DESC 'Associates a NIS domain with a naming context' MUST nisDomain X-ORIGIN 'draft-howard-rfc2307bis'"
OD['1.3.6.1.1.1.2.16']="'automountMap' SUP top STRUCTURAL MUST ( automountMapName ) MAY description X-ORIGIN 'draft-howard-rfc2307bis'"
EE['1.3.6.1.1.1.2.17']="'automount' SUP top MUST "'( automountKey $ automountInformation ) MAY description'
OD['1.3.6.1.1.1.2.17']="'automount' SUP top STRUCTURAL DESC 'Automount information' MUST "'( automountKey $ automountInformation )'" MAY description X-ORIGIN 'draft-howard-rfc2307bis'"
EE['1.3.6.1.4.1.42.2.27.5.2.7']="'SolarisNamingProfile' SUP top MUST "'( cn $ SolarisLDAPservers $ SolarisSearchBaseDN ) MAY ( SolarisBindDN $ SolarisBindPassword $ SolarisAuthMethod $ SolarisTransportSecurity $ SolarisCertificatePath $ SolarisCertificatePassword $ SolarisDataSearchDN $ SolarisSearchScope $ SolarisSearchTimeLimit $ SolarisPreferredServer $ SolarisPreferredServerOnly $ SolarisCacheTTL $ SolarisSearchReferral )'
OD['1.3.6.1.4.1.42.2.27.5.2.7']="'SolarisNamingProfile' SUP top STRUCTURAL DESC 'Solaris LDAP Naming client profile objectClass' MUST "'( cn $ SolarisLDAPServers $ SolarisSearchBaseDN ) MAY ( SolarisBindDN $ SolarisBindPassword $ SolarisAuthMethod $ SolarisTransportSecurity $ SolarisCertificatePath $ SolarisCertificatePassword $ SolarisDataSearchDN $ SolarisSearchScope $ SolarisSearchTimeLimit $ SolarisPreferredServer $ SolarisPreferredServerOnly $ SolarisCacheTTL $ SolarisSearchReferral $ SolarisBindTimeLimit )'" X-ORIGIN 'Solaris Specific'"
OD['2.16.840.1.113730.3.2.4']="'mailGroup' SUP top STRUCTURAL MUST mail MAY "'( cn $ mgrpRFC822MailMember )'" X-ORIGIN 'Solaris Specific'"
OD['1.3.6.1.4.1.42.2.27.1.2.5']="'nisMailAlias' SUP top MUST cn MAY rfc822mailMember X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.1.2.6']="'nisNetId' SUP top MUST cn MAY "'( nisNetIdUser $ nisNetIdGroup $ nisNetIdHost )'
OD['1.3.6.1.4.1.42.2.27.1.2.6']="'nisNetId' SUP top MUST cn MAY "'( nisNetIdUser $ nisNetIdGroup $ nisNetIdHost )'" X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.2.2']="'SolarisAuditUser' SUP top AUXILIARY MAY "'( SolarisAuditAlways $ SolarisAuditNever )'
OD['1.3.6.1.4.1.42.2.27.5.2.2']="'SolarisAuditUser' SUP top AUXILIARY MAY "'( SolarisAuditAlways $ SolarisAuditNever )'" X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.2.3']="'SolarisUserAttr' SUP top AUXILIARY MAY "'( SolarisUserQualifier $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrKeyValue )'
OD['1.3.6.1.4.1.42.2.27.5.2.3']="'SolarisUserAttr' SUP top AUXILIARY DESC 'User attributes' MAY "'( SolarisUserQualifier $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.2.4']="'SolarisAuthAttr' SUP top MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrShortDesc $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'
OD['1.3.6.1.4.1.42.2.27.5.2.4']="'SolarisAuthAttr' SUP top STRUCTURAL DESC 'Authorizations data' MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrShortDesc $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.2.5']="'SolarisProfAttr' SUP top MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'
OD['1.3.6.1.4.1.42.2.27.5.2.5']="'SolarisProfAttr' SUP top STRUCTURAL DESC 'Profiles data' MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.2.6']="'SolarisExecAttr' SUP top AUXILIARY MAY "'( SolarisKernelSecurityPolicy $ SolarisProfileType $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisProfileID $ SolarisAttrKeyValue )'
OD['1.3.6.1.4.1.42.2.27.5.2.6']="'SolarisExecAttr' SUP top AUXILIARY DESC 'Profiles execution attributes' MAY "'( SolarisKernelSecurityPolicy $ SolarisProfileType $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisProfileId $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.2.1']="'SolarisProject' SUP top MUST "'( SolarisProjectID $ SolarisProjectName ) MAY ( memberUid $ memberGid $ description $ SolarisProjectAttr )'
OD['1.3.6.1.4.1.42.2.27.5.2.1']="'SolarisProject' SUP top STRUCTURAL MUST "'( SolarisProjectID $ SolarisProjectName ) MAY ( memberUid $ memberGid $ description $ SolarisProjectAttr )'" X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.11.1.3.1.2.4']="'DUAConfigProfile' SUP top DESC 'Abstraction of a base configuration for a DUA' MUST cn MAY "'( defaultServerList $ preferredServerList $ defaultSearchBase $ defaultSearchScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel $ authenticationMethod $ followReferrals $ serviceSearchDescriptor $ serviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $ attributeMap $ profileTTL )'
OD['1.3.6.1.4.1.11.1.3.1.2.5']="'DUAConfigProfile' SUP top STRUCTURAL DESC 'Abstraction of a base configuration for a DUA' MUST "'( cn ) MAY ( defaultServerList $ preferredServerList $ defaultSearchBase $ defaultSearchScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel $ authenticationMethod $ followReferrals $ dereferenceAliases $ serviceSearchDescriptor $ serviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $ attributeMap $ profileTTL )'" X-ORIGIN 'RFC 4876'"
OD['1.3.6.1.4.1.6252.2.27.6.2.1']="'slpService' DESC 'parent superclass for SLP services' SUP top ABSTRACT MUST "'( template-major-version-number $ template-minor-version-number $ description $ template-url-syntax $ service-advert-service-type $ service-advert-scopes ) MAY ( service-advert-url-authenticator $ service-advert-attribute-authenticator )'" X-ORIGIN 'RFC 2926'"
EE['1.3.18.0.2.6.254']="'slpServicePrinter' DESC 'Service Location Protocol (SLP) information.' SUP slpService AUXILIARY"
OD['1.3.18.0.2.6.254']="'slpServicePrinter' DESC 'Service Location Protocol (SLP) information.' SUP slpService AUXILIARY X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.6.258']="'printerAbstract' DESC 'Printer related information.' SUP top ABSTRACT MAY "'( printer-name $ printer-natural-language-configured $ printer-location $ printer-info $ printer-more-info $ printer-make-and-model $ printer-multiple-document-jobs-supported $ printer-charset-configured $ printer-charset-supported $ printer-generated-natural-language-supported $ printer-document-format-supported $ printer-color-supported $ printer-compression-supported $ printer-pages-per-minute $ printer-pages-per-minute-color $ printer-finishings-supported $ printer-number-up-supported $ printer-sides-supported $ printer-media-supported $ printer-media-local-supported $ printer-resolution-supported $ printer-print-quality-supported $ printer-job-priority-supported $ printer-copies-supported $ printer-job-k-octets-supported $ printer-current-operator $ printer-service-person $ printer-delivery-orientation-supported $ printer-stacking-order-supported $ printer-output-features-supported )'
OD['1.3.18.0.2.6.258']="'printerAbstract' DESC 'Printer related information.' SUP top ABSTRACT MAY "'( printer-name $ printer-natural-language-configured $ printer-location $ printer-info $ printer-more-info $ printer-make-and-model $ printer-multiple-document-jobs-supported $ printer-charset-configured $ printer-charset-supported $ printer-generated-natural-language-supported $ printer-document-format-supported $ printer-color-supported $ printer-compression-supported $ printer-pages-per-minute $ printer-pages-per-minute-color $ printer-finishings-supported $ printer-number-up-supported $ printer-sides-supported $ printer-media-supported $ printer-media-local-supported $ printer-resolution-supported $ printer-print-quality-supported $ printer-job-priority-supported $ printer-copies-supported $ printer-job-k-octets-supported $ printer-current-operator $ printer-service-person $ printer-delivery-orientation-supported $ printer-stacking-order-supported $ printer-output-features-supported )'" X-ORIGIN 'RFC 3712' )"
EE['1.3.18.0.2.6.255']="'printerService' DESC 'Printer information.' SUP printerAbstract STRUCTURAL MAY "'( printer-uri $ printer-xri-supported )'
OD['1.3.18.0.2.6.255']="'printerService' DESC 'Printer information.' SUP printerAbstract STRUCTURAL MAY "'( printer-uri $ printer-xri-supported )'" X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.6.257']="'printerServiceAuxClass' DESC 'Printer information.' SUP printerAbstract AUXILIARY MAY "'( printer-uri $ printer-xri-supported )'
OD['1.3.18.0.2.6.257']="'printerServiceAuxClass' DESC 'Printer information.' SUP printerAbstract AUXILIARY MAY "'( printer-uri $ printer-xri-supported )'" X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.6.256']="'printerIPP' DESC 'Internet Printing Protocol (IPP) information.' SUP top AUXILIARY MAY "'( printer-ipp-versions-supported $ printer-multiple-document-jobs-supported )'
OD['1.3.18.0.2.6.256']="'printerIPP' DESC 'Internet Printing Protocol (IPP) information.' SUP top AUXILIARY MAY "'( printer-ipp-versions-supported $ printer-multiple-document-jobs-supported )'" X-ORIGIN 'RFC 3712'"
EE['1.3.18.0.2.6.253']="'printerLPR' DESC 'LPR information.' SUP top AUXILIARY MUST printer-name MAY printer-aliases"
OD['1.3.18.0.2.6.253']="'printerLPR' DESC 'LPR information.' SUP top AUXILIARY MUST ( printer-name ) MAY ( printer-aliases ) X-ORIGIN 'RFC 3712'"
EE['1.3.6.1.4.1.42.2.27.5.2.14']="'sunPrinter' DESC 'Sun printer information' SUP top AUXILIARY MUST printer-name MAY "'( sun-printer-bsdaddr $ sun-printer-kvp )'
OD['1.3.6.1.4.1.42.2.27.5.2.14']="'sunPrinter' DESC 'Sun printer information' SUP top AUXILIARY MUST printer-name MAY "'(sun-printer-bsdaddr $ sun-printer-kvp)'" X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.2.12']="'nisplusTimeZoneData' DESC 'NIS+ timezone table data' SUP top STRUCTURAL MUST cn MAY "'( nisplusTimeZone $ description )'
OD['1.3.6.1.4.1.42.2.27.5.2.12']="'nisplusTimeZoneData' DESC 'NIS+ timezone table data' SUP top STRUCTURAL MUST cn MAY "'( nisplusTimeZone $ description )'" X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.2.8']="'ipTnetTemplate' DESC 'Object class for TSOL network templates' SUP top MUST ipTnetTemplateName MAY SolarisAttrKeyValue"
OD['1.3.6.1.4.1.42.2.27.5.2.8']="'ipTnetTemplate' DESC 'Object class for TSOL network templates' SUP top STRUCTURAL MUST ipTnetTemplateName MAY SolarisAttrKeyValue X-ORIGIN 'Solaris Specific'"
EE['1.3.6.1.4.1.42.2.27.5.2.9']="'ipTnetHost' DESC 'Associates an IP address or wildcard with a TSOL template_name' SUP top AUXILIARY MUST ipTnetNumber"
OD['1.3.6.1.4.1.42.2.27.5.2.9']="'ipTnetHost' DESC 'Associates an IP address or wildcard with a TSOL template_name' SUP top AUXILIARY MUST ipTnetNumber X-ORIGIN 'Solaris Specific'"
# obey CLI syntax force option (if any)
else
fi
# we need to preserve order, so 2 passes
TODO+="${OID} "
done
if [[ -z ${TODO} ]]; then
X='Schema contains all required objectclass defintions'
else
# 2nd pass
typeset X SORTED
X="${MAP[${OID}]}"
# 1.3.18.0.2.6.254 requires 1.3.18.0.2.6.2549
# 1.3.18.0.2.6.255,1.3.18.0.2.6.257 require 1.3.18.0.2.6.258
done
print 'dn: cn=schema\nchangetype: modify\nadd: objectclasses' \
then
Log.fatal 'Adding objectclass definitions to schema failed'
return 67
fi
X='Schema objectclass definitions added'
fi
showProgress "${X}."
return 0
}
Man.addFunc add_suffix '' '[+NAME?add_suffix - add suffix to DS if needed.]
[+DESCRIPTION?Add a suffix to the DS if needed (\bTMPF[NEED_CREATE_SUFFIX]]\b is set) and optionally create the backend for it (\bTMPF[NEED_CREATE_BACKEND]]\b is set). Suffix entry and backend MUST be prepared by \bprep_create_sfx_entry()\b and \bprep_create_sfx_backend()\b correspondingly to have the following vars set:]{
[+STR[LDAP_SUFFIX]] ]
[+STR[DS_DB]] ]
[+TMP[SUFFIX_OBJ]] ]
[+TMP[SUFFIX_ATT]] ]
[+TMP[SUFFIX_VAL]] ]
}
[+RETURN VALUES]{
[+0?on success (suffix not needed or created successfully).]
[+1?otherwise (unable to create suffix).]
}
[+SEE ALSO?\bldapadd\b(1), \bdisplay_msg()\b.]
'
function add_suffix {
showProgress "Database backend exists."
else
print '
dn: ds-cfg-backend-id='"${STR[DS_DB]}"',cn=Backends,cn=config
ds-cfg-backend-id: '"${STR[DS_DB]}"'
ds-cfg-base-dn: '"${STR[LDAP_SUFFIX]}"'
objectclass: top
objectclass: ds-cfg-backend
objectclass: ds-cfg-local-db-backend
ds-cfg-java-class: org.opends.server.backends.jeb.BackendImpl
ds-cfg-enabled: true
ds-cfg-writability-mode: enabled
ds-cfg-preload-time-limit: 0 ms
ds-cfg-compact-encoding: true
ds-cfg-entries-compressed: false
ds-cfg-index-entry-limit: 4000
ds-cfg-db-directory: db
ds-cfg-db-directory-permissions: 700
ds-cfg-disk-low-threshold: 100 mb
ds-cfg-disk-full-threshold: 20 mb
ds-cfg-db-run-cleaner: true
ds-cfg-db-cleaner-min-utilization: 50
ds-cfg-db-logging-file-handler-on: true
ds-cfg-db-logging-level: CONFIG
ds-cfg-db-log-filecache-size: 100
ds-cfg-db-log-file-max: 10 mb
ds-cfg-db-cache-size: 0 b
ds-cfg-db-cache-percent: 50
ds-cfg-db-evictor-core-threads: 1
ds-cfg-db-evictor-max-threads: 10
ds-cfg-db-evictor-nodes-per-scan: 10
ds-cfg-db-evictor-lru-only: true
ds-cfg-db-evictor-keep-alive: 600 s
ds-cfg-db-txn-no-sync: false
ds-cfg-db-txn-write-no-sync: true
ds-cfg-db-checkpointer-wakeup-interval: 30 s
ds-cfg-db-checkpointer-bytes-interval: 20 mb
else
print '
dn: cn="'"${STR[LDAP_SUFFIX]}"'",cn=mapping tree,cn=config
objectclass: top
objectclass: extensibleObject
objectclass: nsMappingTree
cn: '"${STR[LDAP_SUFFIX]}"'
nsslapd-state: backend
nsslapd-backend: '"${STR[DS_DB]}"'
dn: cn='"${STR[DS_DB]}"',cn=ldbm database,cn=plugins,cn=config
objectclass: top
objectclass: extensibleObject
objectclass: nsBackendInstance
cn: '"${STR[DS_DB]}"'
nsslapd-suffix: '"${STR[LDAP_SUFFIX]}"'
fi
then
'with suffix' "'${STR[LDAP_SUFFIX]}'" 'due to server error.'
return 1
fi
showProgress "Database backend created."
fi
showProgress "Suffix exists."
else
print '
dn: '"${STR[LDAP_SUFFIX]}"'
objectclass: top
objectclass: '"${TMP[SUFFIX_OBJ]}"'
'"${TMP[SUFFIX_ATT]}: ${TMP[SUFFIX_VAL]}"'
then
"'${TMP[SUFFIX_OBJ]}'" 'class'
return 1
fi
showProgress "Suffix added."
fi
return 0
}
function add_suffix_aci {
typeset PW_STATE PW_STATE_RO ANY_NO_READ SELF_NO_WRITE
typeset ADMIN_DN ADMIN_GROUP_DN
# TBD: include Password Policy State extended ops ?
# password state information aka ds-pwp-*, pwd* and ds-pta-* WITHOUT
# attrs, which are schema flagged with NO-USER-MODIFICATION
PW_STATE=' ds-pwp-account-disabled || ds-pwp-account-expiration-time
|| ds-pwp-last-login-time || ds-pwp-password-changed-by-required-time
|| ds-pwp-password-policy-dn || ds-pwp-reset-time || ds-pwp-warned-time
|| ds-privilege-name || pwdReset'
# password state information flagged with NO-USER-MODIFICATION
# ds-pwp-password-expiration-time is the same as pwdExpirationTime
# so save some parse time ;-)
PW_STATE_RO=' pwdExpirationTime || pwdChangedTime || pwdGraceUseTime
|| pwdFailureTime || pwdHistory || pwdAccountLockedTime'
# People using PassThroughAuthentication probably wish that too:
#PW_STATE_RO+='|| ds-pta-cached-password || ds-pta-cached-password-time'
# passwords + password state
ANY_NO_READ="userPassword || authPassword ||${PW_STATE}||${PW_STATE_RO}"
SELF_NO_WRITE='aci || ds-rlim-idle-time-limit
|| ds-rlim-lookthrough-limit || ds-rlim-size-limit || ds-rlim-time-limit
|| pwdPolicySubentry ||'"${PW_STATE}"
ADMIN_DN='uid=admin,cn=Administrators'
ADMIN_GROUP_DN='cn=Administrators'
ADMIN_DN+=',cn=admin data'
ADMIN_GROUP_DN+=',cn=admin data'
else
# DSEE
# password state information aka passwordObject
PW_STATE=' accountUnlockTime || passwordAllowChangeTime
|| passwordExpWarned || passwordExpirationTime || passwordHistory
|| passwordRetryCount || retryCountResetTime'
# passwords + password state
ANY_NO_READ="userPassword ||${PW_STATE}"
SELF_NO_WRITE='aci || nsIdleTimeout || nsLookThroughLimit
|| nsSizeLimit || nsTimeLimit || nsroledn || passwordPolicySubentry
||'"${PW_STATE}"
ADMIN_DN='uid=admin,ou=Administrators'
ADMIN_GROUP_DN='cn=Configuration Administrators,ou=Groups'
ADMIN_DN+=',ou=TopologyManagement,o=NetscapeRoot'
ADMIN_GROUP_DN+=',ou=TopologyManagement,o=NetscapeRoot"'
fi
typeset -A RULES=(
(
version 3.0; acl "'"${SFX_ANYONE_ACI_NAME}"'";
allow (read, search, compare) userdn = "ldap:///anyone";
)'
(
version 3.0; acl "'"${SFX_SELF_ACI_NAME}"'";
allow (write) userdn = "ldap:///self";
)'
[SFX_ADMIN_ACI_NAME]='aci: (targetattr = "*")
(
version 3.0; acl "'"${SFX_ADMIN_ACI_NAME}"'";
allow (all) userdn = "ldap:///'"${ADMIN_DN}"'";
)'
[SFX_ADMINGRP_ACI_NAME]='aci: (targetattr ="*")
(
version 3.0; acl "'"${SFX_ADMINGRP_ACI_NAME}"'";
allow (all) groupdn = "ldap:///'"${ADMIN_GROUP_DN}"'";
)'
)
# Check and set if doesn't already exist
typeset -a LIST=( )
[[ -z ${NAME} ]] && continue # if it has no name, ignore it
print '
dn: '"${STR[LDAP_SUFFIX]}"'
changetype: modify
add: aci
'"${RULES[${ACI}]}"'
then
Log.warn "Adding '${NAME}' suffix ACI failed"
return 1
fi
showProgress "Suffix ACI '${NAME}' added."
done
return 0
}
Man.addFunc add_base_objects '' '[+NAME?add_base_objects - add possibly missing, necessary base objects.]
[+DESCRIPTION?Determine all RDNs required to form the \bSTR[LDAP_BASEDN]]\b using the suffix \bSTR[LDAP_SUFFIX]]\b (RDN1,RDN2,...,suffix == baseDN) and create the missing entries.]
[+RETURN VALUES]{
[+0?on success (all entries available or created successfully).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bnormalizeDN()\b, \bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_base_objects {
# typeset -A STR
# STR[LDAP_BASEDN]=dc=x,dc=my,dc=do,dc=main,dc=de
# STR[LDAP_SUFFIX]=dc=do,dc=main,dc=de
# Convert to lower case for basename.
# first, test that baseDN ends with suffix
if [[ ${LC_DN: -${#LC_SFX}} != ${LC_SFX} ]]; then
# should not happen since check_basedn_suffix() succeeded
Log.fatal "Invalid suffix '${LC_SFX}' for Base DN '${LC_DN}'"
return 66
fi
# Save the stuff before LC_SFX w/o leading ',' -> further called prefix
# Remove redundant spaces around ',' and '=' first from LDAP_BASEDN
typeset DN=${ normalizeDN ${STR[LDAP_BASEDN]} ; }
# Now LC_DN and DN differ at most in lower vs. uppercase character and
# we can get the prefix of the baseDN by just copying corresponding chars
DN=",${DN:0:${#LC_DN}}"
X='No need to create a DN component (baseDN equals suffix)'
else
X="Created DN components for ${DN#,}"
while [[ -n ${DN} ]]; do
# Get trailing key=val (DC) from DN and strip it off
LAST="${DC},${LAST}"
# Check if entry exists first, if so, skip to next.
# Determine the objectclass for the entry.
CLASS=${ get_objectclass ${KEY} ; }
if [[ -z ${CLASS} ]]; then
"Please create the following entry and re-run ${PROG}:" \
"${KEY}=${VAL},${LAST}"
return 66
fi
print '
dn: '"${LAST}"'
'"${KEY}: ${VAL}"'
objectClass: top
objectClass: '"${CLASS}"'
then
Log.fatal "Update of base objects '${DC}' failed"
return 66
fi
done
fi
showProgress "${X}."
return 0
}
Man.addFunc set_nisdomain '' '[+NAME?set_nisdomain - Add the NisDomainObject to the Base DN.]
[+DESCRIPTION?Add a NisDomainObject with nisdomain \bSTR[LDAP_DOMAIN]]\b to the \bSTR[LDAP_BASEDN]]\b unless there is already one.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function set_nisdomain {
# Check if nisDomain is already set
while read LINE ; do
"'${STR[LDAP_BASEDN]}'."
return 0
fi
done
print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
objectclass: nisDomainObject
nisdomain: '"${STR[LDAP_DOMAIN]}"'
then
Log.fatal "Update of NisDomainObject in '${STR[LDAP_BASEDN]}' failed"
return 66
fi
showProgress "NisDomainObject added to '${STR[LDAP_BASEDN]}'."
return 0
}
Man.addFunc add_new_containers '' '[+NAME?add_new_containers - Add top level containers to the base DN.]
[+DESCRIPTION?Add the Name Service Switch top level containers to the \bSTR[LDAP_BASEDN]]\b unless they already exist.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\b/etc/nsswitch.ldap\b, \bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_new_containers {
typeset OU
do
then
showProgress "'ou=${OU}' exists."
continue
fi
print '
dn: ou='"${OU},${STR[LDAP_BASEDN]}"'
ou: '"${OU}"'
objectClass: top
objectClass: organizationalUnit
then
Log.fatal "Adding 'ou=${OU}' failed"
return 66
fi
showProgress "'ou=${OU}' added."
done
return 0
}
Man.addFunc add_auto_maps '' '[+NAME?add_auto_maps - Add the automount map entries.]
[+DESCRIPTION?Add the automount maps \bauto_home\b, \bauto_direct\b, \bauto_master\b, \bauto_shared\b to \bSTR[LDAP_BASEDN]]\b unless they already exist.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_auto_maps {
# AUTO_MAPS for maps to create
# Check if automap already exist
then
showProgress "'${MAP}' automount exists."
continue
fi
print '
dn: automountMapName='"${MAP},${STR[LDAP_BASEDN]}"'
automountMapName: '"${MAP}"'
objectClass: top
objectClass: automountMap
then
Log.fatal "Adding '${MAP}' automount map failed"
return 66
fi
showProgress "'${MAP}' automount added."
done
return 0
}
Man.addFunc modify_top_aci '' '[+NAME?modify_top_aci - add a deny self modify ACI.]
[+DESCRIPTION?Add the ACI \bUSER_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b to disable self modify of user attributes like uid, uidNumber, gidNumber, shadowExpire, etc. This does nothing if an ACI with the same name already exists for this entry.]
[+RETURN VALUES]{
[+0?on success (ACI already exists or added successfully).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfindACI()\b, \bldapmodify\b(1).]
'
function modify_top_aci {
typeset PATTERN
typeset -a LIST=( )
# check, whether ACI already exists
# Create LDIF for top level ACI
print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: (targetattr = "cn || uid || uidNumber || gidNumber || homeDirectory || shadowLastChange || shadowMin || shadowMax || shadowWarning || shadowInactive || shadowExpire || shadowFlag || memberUid || SolarisAttrKeyValue || SolarisAttrReserved1 || SolarisAttrReserved2 || SolarisUserQualifier")
(
version 3.0; acl "'"${USER_ACI_NAME}"'";
deny (write) userdn = "ldap:///self";
)
then
Log.fatal 'Deny user to change non-password attributes failed'
return 66
fi
showProgress "Self modify for non-password attributes disabled."
return 0
}
Man.addFunc add_vlv_aci '' '[+NAME?add_vlv_aci - Add ACI for VLV.]
[+DESCRIPTION?Add the global ACI to allow everyone read-only access to VLVs.]
[+RETURN VALUES]{
[+0?on success (ACI added successfully).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function add_vlv_aci {
# VLV Request = 2.16.840.1.113730.3.4.9
RULE+='allow (read,search,compare) userdn = "ldap:///anyone";'
typeset DN='oid=2.16.840.1.113730.3.4.9,cn=features,cn=config'
typeset -a LIST=( )
print '
dn: '"${DN}"'
changetype: modify
add: ds-cfg-global-aci
ds-cfg-global-aci: (targetcontrol = "2.16.840.1.113730.3.4.9")(targetattr != "aci")
(
'"${RULE}"'
)
else
print '
dn: '"${DN}"'
changetype: modify
replace: aci
aci: (targetattr != "aci")
(
'"${RULE}"'
)
fi
then
Log.fatal "Adding '${VLV_ACI_NAME}' global ACI failed"
return 66
fi
showProgress "Global ACI '${VLV_ACI_NAME}' added."
return 0
}
Man.addFunc add_proxyagent '' '[+NAME?add_proxyagent - Add proxy agent user to DS.]
[+DESCRIPTION?Add the proxy agent user \bSTR[LDAP_PROXYAGENT]]\b to the DS unless it already exists to allow nameservice access to the server.]
[+RETURN VALUES]{
[+0?on success (entry already exists or added successfully).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function add_proxyagent {
# Check if proxy agent already exists
then
showProgress "Proxyagent identity exists."
return 0
fi
# Get cn and sn names from LDAP_PROXYAGENT.
typeset NAME="${STR[LDAP_PROXYAGENT]%%,*}"
# Add the entry
print '
dn: '"${STR[LDAP_PROXYAGENT]}"'
cn: '"${NAME}"'
sn: '"${NAME}"'
objectclass: top
objectclass: person
userpassword: '"${STR[LDAP_PROXYAGENT_CRED]}"'
then
Log.fatal 'Adding proxyagent identity failed'
return 66
fi
showProgress 'Proxyagent identity added.'
return 0
}
Man.addFunc add_entry_by_DN '' '[+NAME?add_entry_by_DN - Add an ldif file by DN.]
[+DESCRIPTION?Add the entries in the given LDIF \afile\a to the DS unless a base entry for \aDN\a already exists.]
[+RETURN VALUES]{
[+0?on success (\aDN\a already exists or added successfully).]
[+1?on error (failed to add entries).]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapadd\b(1).]
\n\n\aDN\a \afile\a
'
function add_entry_by_DN {
then
showProgress "'${1}' exists."
return 0
fi
then
showProgress "'${1}' added."
return 0
fi
Log.fatal "Adding '${1}' failed"
return 1
}
Man.addFunc add_id_mapping_rules '' '[+NAME?add_id_mapping_rules - Add Kerberos principal to DN mapping rules to the DS.]
[+DESCRIPTION?Add GSSAPI identity mapping rules for host credentails and user credentials to the DS config unless they already exists. Hosts are matched against \b*.STR[LDAP_DOMAIN]]@STR[LDAP_KRB_REALM]]\b and ou=hosts in \bSTR[LDAP_BASEDN]]\b, users against \b*.@STR[LDAP_KRB_REALM]]\b and uid=$1,ou=People in \bSTR[LDAP_BASEDN]]\b.]
[+SEE ALSO?\badd_entry_by_DN()\b.]
'
function add_id_mapping_rules {
Log.info 'Adding Kerberos principal to DN mapping rules ...'
# we create a new branch instead of reusing the default, possibly unused
# 'cn=Regular Expression,cn=Identity Mappers,cn=config' GSSAPI ID mapper
C_DN='cn=GSSAPI,cn=Identity Mappers,cn=config'
OC='ds-cfg-branch'
fi
print '
dn: cn='"${C_DN}"'
objectClass: top
objectClass: '"${OC}"'
cn: GSSAPI
typeset H_CN="host_auth_${STR[LDAP_KRB_REALM]}"
typeset H_DN="cn=${H_CN}, ${C_DN}"
print '
# For now (2.6.0) OpenDJ supports a single-valued ds-cfg-identity-mapper, only.
# So either you merge this and the next Identity Mapper to something more useful
# together or just enable one of them until it gets fixed. For more information
dn: '"${H_DN}"'
cn: '"${H_CN}"'
objectClass: top
objectClass=ds-cfg-identity-mapper
objectClass=ds-cfg-regular-expression-identity-mapper
ds-cfg-java-class=org.opends.server.extensions.RegularExpressionIdentityMapper
ds-cfg-enabled=false
ds-cfg-match-base-dn=ou=hosts,'"${STR[LDAP_BASEDN]}"'
ds-cfg-match-pattern=host\/(.*).'"${STR[LDAP_DOMAIN]}@${STR[LDAP_KRB_REALM]}"'
ds-cfg-replace-pattern=$1
ds-cfg-match-attribute=cn
else
print '
dn: '"${H_DN}"'
objectClass: top
objectClass: nsContainer
objectClass: dsIdentityMapping
objectClass: dsPatternMatching
cn: '"${H_CN}"'
dsMatching-pattern: ${Principal}
dsMatching-regexp: host\/(.*).'"${STR[LDAP_DOMAIN]}@${STR[LDAP_KRB_REALM]}"'
dsSearchBaseDN: ou=hosts,'"${STR[LDAP_BASEDN]}"'
dsSearchFilter: (&(objectClass=ipHost)(cn=$1))
dsSearchScope: one
fi
typeset U_CN="user_auth_${STR[LDAP_KRB_REALM]}"
typeset U_DN="cn=${U_CN}, ${C_DN}"
print '
dn: '"${U_DN}"'
cn: '"${U_CN}"'
objectClass: top
objectClass=ds-cfg-identity-mapper
objectClass=ds-cfg-regular-expression-identity-mapper
ds-cfg-java-class=org.opends.server.extensions.RegularExpressionIdentityMapper
ds-cfg-enabled=true
ds-cfg-match-base-dn=ou=People,'"${STR[LDAP_BASEDN]}"'
ds-cfg-match-pattern=(.*)@'"${STR[LDAP_KRB_REALM]}"'
ds-cfg-replace-pattern=$1
ds-cfg-match-attribute=uid
else
print '
dn: '"${U_DN}"'
objectClass: top
objectClass: nsContainer
objectClass: dsIdentityMapping
objectClass: dsPatternMatching
cn: '"${U_CN}"'
dsMatching-pattern: ${Principal}
dsMatching-regexp: (.*)@'"${STR[LDAP_KRB_REALM]}"'
dsMappedDN: uid=$1,ou=People,'"${STR[LDAP_BASEDN]}"'
fi
}
Man.addFunc modify_userpassword_acl_for_gssapi '' '[+NAME?modify_userpassword_acl_for_gssapi - Allow hosts and user to read password(s).]
[+DESCRIPTION?Modify ACL to allow hosts to read all and a user to read its own password only, when sasl/GSSAPI bind is used.]
[+RETURN VALUES]{
[+0?on success (entries already exist or added successfully).]
[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\badd_entry_by_DN()\b.]
'
function modify_userpassword_acl_for_gssapi {
typeset P_DN="ou=People,${STR[LDAP_BASEDN]}"
typeset H_DN="ou=Hosts,${STR[LDAP_BASEDN]}"
then
Log.verbose "'${P_DN}' does not exist"
print '
dn: '"${P_DN}"'
ou: People
objectClass: top
objectClass: organizationalUnit
else
Log.verbose "'${P_DN}' already exists"
fi
typeset -A RULES=(
(
version 3.0; acl self-read-pwd;
allow (read,search) userdn="ldap:///self" and authmethod="sasl GSSAPI";
)'
(
version 3.0; acl host-read-pwd;
allow (read,search) userdn="ldap:///cn=*+ipHostNumber=*,ou=Hosts,'"${STR[LDAP_BASEDN]}"'" and authmethod="sasl GSSAPI";
)'
)
typeset -a LIST=( )
[[ -z ${NAME} ]] && continue # if it has no name, ignore it
print '
dn: '"${P_DN}"'
changetype: modify
add: aci
'"${RULES[${ACI}]}"'
then
Log.warn "Adding '${NAME}' ou=people ACI failed."
return 67
fi
showProgress "ou=people ACI '${NAME}' added."
done
return 0
}
Man.addFunc add_profile '' '[+NAME?add_profile - Add client profile to server.]
[+DESCRIPTION?Generates a client profile and adds it to the DS as "\bcn=STR[LDAP_PROFILE_NAME]],ou=profile,STR[LDAP_BASEDN]]\b" unless it already exists and \bTMPF[DEL_OLD_PROFILE]]\b is not set. Other profile related variables are:]{
[+?STR[LDAP_SERVER_LIST]] ]
[+?STR[LDAP_SEARCH_SCOPE]] ]
[+?STR[LDAP_CRED_LEVEL]] ]
[+?STR[LDAP_AUTHMETHOD]] ]
[+?INT[LDAP_FOLLOWREF]] ]
[+?INT[LDAP_SEARCH_TIME_LIMIT]] ]
[+?INT[LDAP_PROFILE_TTL]] ]
[+?INT[LDAP_BIND_LIMIT]] ]
[+?STR[LDAP_PREF_SRVLIST]] ]
[+?STR[LDAP_SRV_AUTHMETHOD_PAM]] ]
[+?STR[LDAP_SRV_AUTHMETHOD_KEY]] ]
[+?STR[LDAP_SRV_AUTHMETHOD_CMD]] ]
[+?SSD]
}
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?fatal error.]
}
[+SEE ALSO?\bldapclient\b(1M), \bldapdelete\b(1), \bldapmodify\b(1).]
'
function add_profile {
# If profile name already exists, DELETE it, and add new one
-b "cn=${STR[LDAP_PROFILE_NAME]},ou=profile,${STR[LDAP_BASEDN]}" \
then
'failed (entry already exists)'
return 66
fi
print "cn=${STR[LDAP_PROFILE_NAME]},ou=profile,${STR[LDAP_BASEDN]}" \
then
"'${STR[LDAP_PROFILE_NAME]}' failed"
return 67
fi
fi
# Build the "ldapclient genprofile" command string to execute
typeset -a ARG=( )
# Add required argument defaultSearchBase
# Add optional parameters
[[ -n ${STR[LDAP_SERVER_LIST]} ]] && \
[[ -n ${STR[LDAP_SEARCH_SCOPE]} ]] && \
[[ -n ${STR[LDAP_CRED_LEVEL]} ]] && \
[[ -n ${STR[LDAP_AUTHMETHOD]} ]] && \
[[ -n ${INT[LDAP_BIND_LIMIT]} ]] && \
[[ -n ${STR[LDAP_PREF_SRVLIST]} ]] && \
[[ -n ${STR[LDAP_SRV_AUTHMETHOD_PAM]} ]] && \
[[ -n ${STR[LDAP_SRV_AUTHMETHOD_KEY]} ]] && \
[[ -n ${STR[LDAP_SRV_AUTHMETHOD_CMD]} ]] && \
# Add SSDs
typeset X
done
# Execute "ldapclient genprofile" to create profile
then
Log.fatal 'ldapclient genprofile failed'
return 68
fi
# Add the generated profile
then
log.fatal 'Attempt to add profile failed!'
return 69
fi
showProgress 'Client profile generated and pushed to the DS.'
return 0
}
Man.addFunc checkTaskCompletion '' '[+NAME?checkTaskCompletion - Wait and check completion of a DS task.]
[+DESCRIPTION?Checks the state of the DS task with the given \adn\a periodically until it got stopped due to an error or has been finished successfully, or the timeout has been hit. Timeout is an integer and specifies the number of seconds to max. wait for completion. If not given or invalid 60 will be used instead.]
[+RETURN VALUES]{
[+0?on success.]
[+1?task failed.]
[+2?timeout has been hit, task not yet finished or has an unknown state.]
}
[+See Also?\bldapsearch\b(1)]
\n\n\adn\a [\atimeout\a]
'
function checkTaskCompletion {
integer TIMEOUT=${2:-${INT[TASK_TIMEOUT]}} RESULT=2 SEEN
# Wait for task to finish, display current status.
SEEN=0 X=''
while read LINE ; do
[[ -z ${X} && ${LINE:0:${#STATUS}} == ${STATUS} ]] && \
X=${LINE:${#STATUS}}
done
print -n '.'
RESULT=0 && break
[[ ${X:0:12} == 'Index failed' || ${X:016} == 'STOPPED_BY_ERROR' ]] && \
RESULT=1 && break
sleep 1
done
# DSEE removes non-recurring tasks automagically, OpenDJ not
return ${RESULT}
}
Man.addFunc rebuildIndex '' '[+NAME?rebuildIndex - Rebuild a single index.]
[+DESCRIPTION?Instruct the DS to rebuild the index with the name \aname\a. If the \aname\a starts with "vlv." it indicates a Virtual List View, which is supported for OpenDJ, only. Wrt. to OpenDJ and VLVs a return code of \b0\b does not necessaryly mean, that the index is finally in a non-degraded state. It just means, the task has been executed successfully.]
[+RETURN VALUES]{
[+0?on success.]
[+2?if the task failed or did not complete within 60 seconds.]
[+66?if scheduling a rebuild task on the DS failed.]
}
[+SEE ALSO?\bcheckTaskCompletion()\b, \bldapsearch\b(1), \bldapmodify\b(1).]
\n\n\aname\a
'
function rebuildIndex {
typeset IDX=$1
Log.warn 'Non-OpenDJ/OpenDS servers do not support VLV rebuildTasks'
return 1
fi
# NOTE: rebuildTask requires ldif-import LDAP privilege.
# It's a little bit inefficient: one could schedule a single task at
# the end of the function and use 'rebuildall' or a space separated
# list of all attributes in ds-task-rebuild-index to do it at once.
print '
# rebuild-index --index '"${IDX}"' --baseDN '"${STR[LDAP_BASEDN]}"' \
# '"${CON_ARGS} ${AUTH_ARGS[@]}"' -X
dn: '"${DN}"'
ds-task-id: '"${TASKNAME}"'
objectClass: top
objectClass: ds-task
objectClass: ds-task-rebuild
ds-task-class-name: org.opends.server.tasks.RebuildTask
ds-task-rebuild-base-dn: '"${STR[LDAP_SUFFIX]}"'
ds-task-rebuild-index: '"${IDX}"'
#ds-task-rebuild-tmp-directory:
else
print '
dn: '"${DN}"'
cn: '"${TASKNAME}"'
objectclass: top
objectclass: extensibleObject
nsInstance: '"${STR[DS_DB]}"'
nsIndexAttribute: '"${IDX}"'
fi
then
Log.fatal "Adding task for '${IDX}' failed"
return 66
fi
return 0
}
Man.addFunc add_indexes '' '[+NAME?add_indexes - Add indexes.]
[+DESCRIPTION?Add indexes of the given \atypes\a (e.g. "pres eq") for the given \aattributes\a (e.g. "uidNumber gidnumber") and schedule corresponding tasks to actually create the indexes unless they already exist. Both arguments are handle as a whitespace separated list.]
[+RETURN VALUES]{
[+-1?syntax error (insufficient parameters).]
[+0?on success.]
[+>= 66?fatal error.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
\n\n\atypes\a \aattributes\a
'
function add_indexes {
get_backend || return 66
fi
typeset -l TYPES=${1//,/ } # we allow comma separated lists as well
typeset IDX=${2//,/ }
Log.verbose "Processing '${TYPES// /,}' indexes ..."
typeset DN="cn=index,cn=${STR[DS_DB]},cn=ldbm database,cn=plugins,cn=config"
typeset LTYPE="nsIndexType: ${TYPES// /$'\n'nsIndexType: }"
integer SEEN
OC='ds-cfg-branch'
DN="cn=Index,ds-cfg-backend-id=${STR[DS_DB]},cn=Backends,cn=config"
ATTR='ds-cfg-attribute'
LTYPE=''
done
fi
# check, whether Index container exists - if not, create it
then
X=${DN%%,*}
print '
dn: '"${DN}"'
objectClass: top
objectClass: '"${OC}"'
cn: '"${X#*=}"'
then
Log.fatal 'Failed to add backend Index base'
return 66
fi
fi
# Check if entry exists first. If so, skip to next
then
continue
fi
X=${X//: /:}
print '
# dsconfig create-local-db-index '"${CON_ARGS} ${AUTH_ARGS[@]}"' -X \
# '"${X//ds-cfg-/--set }"' \
# --backend-name '"${STR[DS_DB]}"' --index-name '"${DST}"'
dn: ds-cfg-attribute='"${DST},${DN}"'
ds-cfg-attribute: '"${DST}"'
objectClass: top
objectClass: ds-cfg-local-db-index
'"${LTYPE}"'
else
print '
dn: cn='"${DST},${DN}"'
objectClass: top
objectClass: nsIndex
cn: '"${DST}"'
nsSystemIndex: false
'"${LTYPE}"'
fi
then
Log.fatal "Adding '${DST}' backend index failed"
return 67
fi
showProgress "'${DST}' backend index added."
rebuildIndex ${DST}
done
return 0
}
Man.addFunc add_eq_indexes '' '[+NAME?add_eq_indexes - Add indexes of type pres and eq.]
[+DESCRIPTION?Add eq,pres indexes and schedule corresponding tasks to actually create the indexes unless they already exist.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?fatal error.]
}
[+SEE ALSO?\badd_indexes()\b.]
'
function add_eq_indexes {
"uidNumber ipNetworkNumber gidnumber oncrpcnumber automountKey"
}
Man.addFunc add_sub_indexes '' '[+NAME?add_sub_indexes - Add indexes of type pres, eq and sub.]
[+DESCRIPTION?Add eq,pres,sub indexes and schedule corresponding tasks to actually create the indexes unless they already exist.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?fatal error.]
}
[+SEE ALSO?\badd_indexes()\b.]
'
function add_sub_indexes {
"ipHostNumber membernisnetgroup nisnetgrouptriple"
}
Man.addFunc add_vlv_indexes_OpenDJ '' '[+NAME?add_vlv_indexes_OpenDJ - Add VLV indexes to OpenDS/OpenDJ.]
[+DESCRIPTION?OpenDS/OpenDJ specialized part of \badd_vlv_indexes()\b (pulled out for easier maintenance).]
[+SEE ALSO?\badd_vlv_indexes()\b, https://blogs.oracle.com/kanthi/entry/ldap_paged_results_more]
[+NOTES?\bpagedResultsControl\b and \bVLV\b is per default allowed for authenticated users, only. To check, try something like this:]{
[+? -b "cn=Access Control Handler,cn=config" "objectclass=*" | \]
[+? egrep "1.2.840.113556.1.4.319|2.16.840.1.113730.3.4.9"]
}
\n\n\avname\a \afile\a
'
function add_vlv_indexes_OpenDJ {
typeset -n INDEX_TABLE=$1
[[ ${STR[LDAP_SEARCH_SCOPE]} == sub ]] && SCOPE='subordinate-subtree'
BACKEND="cn=VLV Index,ds-cfg-backend-id=${STR[DS_DB]},cn=Backends,cn=config"
# check, whether VLV Index container exists - if not, create it
then
print '
dn: '"${BACKEND}"'
objectClass: top
objectClass: ds-cfg-branch
cn: VLV Index
then
Log.fatal 'Adding VLV Index base'
return 66
fi
fi
integer COUNT=0
# create index entries
IDX_NAME="${STR[LDAP_DOMAIN]}.get${F[0]}"
BASE="ou=${F[2]},${STR[LDAP_BASEDN]}"
FILTER="objectClass=${F[3]}"
-b "ds-cfg-name=${IDX_NAME},${BACKEND}" 'objectclass=*' \
then
showProgress "'${IDX_NAME}' VLV index exists."
continue
fi
print '
# dsconfig create-local-db-vlv-index '"${CON_ARGS} ${AUTH_ARGS[@]}"' -X \
# --backend-name "'"${STR[DS_DB]}"'" \
# --set "base-dn:'"${BASE}"'" \
# --index-name '"${IDX_NAME}"' --set "sort-order:cn uid" \
# --set "scope:'"${SCOPE}"'" --set "filter:'"${FILTER}"'"
dn: ds-cfg-name='"${IDX_NAME},${BACKEND}"'
objectClass: top
objectClass: ds-cfg-local-db-vlv-index
ds-cfg-name: '"${IDX_NAME}"'
ds-cfg-base-dn: '"${BASE}"'
ds-cfg-scope: '"${SCOPE}"'
ds-cfg-filter: '"${FILTER}"'
ds-cfg-sort-order: cn uid
aci: (targetattr = "*")
(
version 3.0; acl "Config";
allow (read,search,compare) userdn="ldap:///anyone";
)
then
Log.fatal "Adding '${IDX_NAME}' VLV index failed"
return 67
fi
showProgress "'${IDX_NAME}' VLV index added."
else
print "rebuild-index -b '${STR[LDAP_SUFFIX]}' " \
fi
done
# Bug or feature: Even if scheduled as task, VLV idx rebuild leaves
# the index in degraded state. So:
showProgress 'Rebuilding degraded indexes.'
if ! rebuildIndex rebuilddegraded ; then
print "svcadm disable opendj@VERS@\n" \
"rebuild-index -b '${STR[LDAP_SUFFIX]}' --rebuildDegraded\n" \
"svcadm enable opendj@VERS@"
>>${OUT}
fi
fi
}
Man.addFunc add_vlv_indexes_DSEE '' '[+NAME?add_vlv_indexes_DSEE - Add VLV indexes to DSEE.]
[+DESCRIPTION?DSEE specialized part of \badd_vlv_indexes()\b (pulled out for easier maintenance).]
[+SEE ALSO?\b\badd_vlv_indexes()\b.]
\n\n\avname\a \afile\a
'
function add_vlv_indexes_DSEE {
typeset -n INDEX_TABLE=$1
while read LINE ; do
done
# DSEE 5.x only.
else
# 6+ - the instance path
INSTANCE="${LINE}"
fi
[[ ${STR[LDAP_SEARCH_SCOPE]} == sub ]] && SCOPE=2
BACKEND="cn=${STR[DS_DB]},cn=ldbm database,cn=plugins,cn=config"
# create index entries
IDX_NAME="${STR[LDAP_DOMAIN]}.get${F[0]}"
CN="${STR[LDAP_DOMAIN]}_${F[1]}_vlv_index"
BASE="ou=${F[2]},${STR[LDAP_BASEDN]}"
FILTER="objectClass=${F[3]}"
-b "cn=${IDX_NAME},cn=${CN},${BACKEND}" 'objectclass=*' \
then
showProgress "'${IDX_NAME}' VLV index exists."
continue
fi
print '
dn: '"cn=${CN},${BACKEND}"'
objectClass: top
objectClass: vlvSearch
cn: '"${CN}"'
vlvbase: '"${BASE}"'
vlvfilter: ('"${FILTER}"')
aci: (target = "ldap:///'"cn=${CN},${BACKEND}"'") (targetattr = "*")
(
version 3.0; acl "Config";
allow (read,search,compare) userdn="ldap:///anyone";
)
dn: cn='"${IDX_NAME},cn=${CN},${BACKEND}"'
cn: '"${IDX_NAME}"'
vlvSort: cn uid
objectclass: top
objectclass: vlvIndex
then
Log.fatal "Adding '${IDX_NAME}' VLV index failed"
return 66
fi
showProgress "'${IDX_NAME}' VLV index added."
# DSEE 5.x
print "directoryserver -s '${INSTANCE}' vlvindex" \
else
# assume DSEE 6+
print "dsadm reindex -l -t '${IDX_NAME}'" \
fi
done
}
Man.addFunc add_vlv_indexes '' '[+NAME?add_vlv_indexes - Add VLV indexes.]
[+DESCRIPTION?Create VLV indexes entries on the \bSTR[DS_DB]]\b for \bSTR[LDAP_DOMAIN]]\b with \bSTR[LDAP_SEARCH_SCOPE]]\b and create the script \bTMP[DIR]]/do_vlv_index\b to be started on the DS to actually re-index the DB.]
[+RETURN VALUES]{
[+0?on success.]
[+>= 66?fatal error.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_vlv_indexes {
Log.verbose 'Processing VLV indexes ...'
# F[0] F[1] F[2] F[3]
# ${LDAP_DOMAIN}.get ${LDAP_DOMAIN}_%s_vlv_index ou=%s objectClass=$1||&(%s)
typeset -a INDEXES=(
'grent group group posixGroup'
'hostent hosts hosts ipHost'
'netent networks networks ipNetwork'
'pwent passwd people posixAccount'
'rpcent rpc rpc oncRpc'
'spent shadow people shadowAccount'
# Indexes added during NIS to LDAP transition
'auhoent auho automountMapName=auto_home automount'
'soluent solu people SolarisUserAttr'
'authent auth SolarisAuthAttr SolarisAuthAttr'
'execent exec SolarisProfAttr &(SolarisExecAttr)(SolarisKernelSecurityPolicy=*)'
'profent prof SolarisProfAttr &(SolarisProfAttr)(SolarisAttrLongDesc=*)'
'mailent mail aliases mailGroup'
'bootent _boot ethers &(bootableDevice)(bootParameter=*)'
'ethent ethers ethers &(ieee802Device)(macAddress=*)'
'ngrpent netgroup netgroup nisNetgroup'
'ipnent ipn networks &(ipNetwork)(cn=*)'
'maskent mask networks &(ipNetwork)(ipNetmaskNumber=*)'
'prent pr printers printerService'
'ip4ent ip4 hosts &(ipHost)(ipHostNumber=*.*)'
'ip6ent ip6 hosts &(ipHost)(ipHostNumber=*:*)'
)
# temp file for vlvindex commands
else
fi
}
Man.addFunc display_vlv_cmds '' '[+NAME?display_vlv_cmds - Display VLV index commands to run on server.]
[+DESCRIPTION?Display VLV index commands to run on server and save the file to /var/tmp/doIndexVLV-\bSTR[DS_HOST]].sh\b.]
'
function display_vlv_cmds {
typeset SAV="/var/tmp/doIndexVLV-${STR[DS_HOST]}.sh"
# some problems occured, so the file is not empty
MSG+='
To create the actual VLV indexes, you need to stop the DS on the host
or, if manually started, "ds-stop" and than run the commands shown in the file
"svcadm enable opendj@VERS@" or "ds-start".
'
else
MSG+='
Use the dsadm command delivered with the DS on the host '"'${STR[DS_HOST]}'"'
to stop the server. Then, using dsadm, follow the dsadm examples shown in the
file '"'${SAV}'"' to create the actual VLV indexes.
'
else
MSG+='
Use the directoryserver(1m) script on the host '"'${STR[DS_HOST]}'"'
to stop the server. Then, using directoryserver, follow the directoryserver
examples shown in the file '"'${SAV}'"' to create the
actual VLV indexes.
'
fi
fi
Log.info "\n\n${MSG}"
}
Man.addFunc doMain '' '[+NAME?doMain - the main entry point.]
[+DESCRIPTION?The entry point, where the real work starts.]
'
function doMain {
# Initialize the variables that need to be set to NULL, or some
# other initial value before the rest of the functions can be called
init || return 1
# Print extra line to separate from prompt
print
# Either load the user specified config file or prompt user for config info
load_config_file "${TMP[IN]}"
validate_info || return 1 # Validate basic info in file
else
display_msg 'backup_server'
'n' 'backup_help' && return 1
# Ask for all required infos
prompt_config_info || return 1
return 0 # just enabled shadow update in an existing profile
# Allow user to modify results
integer RES
RES=$?
[[ -n ${TMP[OUT]} ]] && create_config_file "${TMP[OUT]}"
fi
modify_timelimit || return 1
fi
modify_sizelimit || return 1
fi
# Modify the password storage scheme to support CRYPT
modify_pwd_crypt || return 1
fi
# schema modifications
modify_cn || return 1
update_schema_attr || return 1
update_schema_obj || return 1
add_suffix || return 1
# Add missing suffix ACIs
add_suffix_aci || return 1
# Add base objects (if needed)
add_base_objects || return 1
# Update the NisDomainObject.
# The Base DN might of just been created, so this MUST happen after
# the base objects have been added!
set_nisdomain || return 1
# Add top level classes (new containers)
add_new_containers || return 1
add_auto_maps || return 1
modify_top_aci || return 1
add_vlv_aci || return 1
add_proxyagent || return 1
allow_proxy_read_pw || return 1
fi
fi
add_admin || return 1
allow_admin_read_write_shadow || return 1
deny_non_admin_shadow_access || return 1
fi
then
modify_userpassword_acl_for_gssapi || return 1
else
'in profile'
fi
fi
allow_host_read_write_shadow || return 66
deny_non_host_shadow_access || return 67
fi
# Generate client profile and add it to the server
add_profile || return 1
# Add Indexes to improve search performance
add_eq_indexes || return 1
add_sub_indexes || return 1
add_vlv_indexes || return 1
# Display setup complete message
# Display VLV index commands to be executed on server (if any)
# Create final config file if requested
[[ -n ${TMP[OUT]} ]] && create_config_file "${TMP[OUT]}"
return 0
}
Man.addFunc cleanup '' '[+NAME?cleanup - cleanup tempfiles, tty and exit.]
[+DESCRIPTION?Removes \aTMP[DIR]]\a unless \aTMPF[DEBUG]]\a is set and restores the echo for the tty.]
'
function cleanup {
if [[ -z $X || $X == 'rootPWD' ]]; then
else
Log.info "Leaving temp dir ${TMP[DIR]} as is. Remove it manually"
fi
if [[ -z $X || $X == 'rootPWD' ]]; then
else
Log.info "Keeping setup scripts and files in ${TMP[DIR]}"
fi
fi
trap - EXIT 1 2 3 6 15
# Might be trapped in the scope of a function which will stop executing
# the function itself but not the script. So:
[[ -z $1 ]] && kill $$
TMPF[CLEANUP_DONE]=1
}
# debug helper function. Required to be not a 'function'!
typeset CMD="${.sh.command}"
[[ -z ${CMD} ]] && return
print -n -u2 '\E[0;30;47m'
print '\E[0m'
}
Man.addFunc MAIN '' '[+NAME?'"${PROG}"' - setup the infrastructure of a directory server to provide data and security required by the Solaris (or similar OS) LDAP Naming Services.]
[+DESCRIPTION?This script assumes that the Sun/Oracle Directory Server Enterprise Edition (DSEE), or Sun OpenDS or Forgerock OpenDJ is installed and that its setup has been run. This script takes the directory server from that point and sets up the infrastructure for LDAP Naming Services. After running this script, \bldapaddent\b(1M) or some other tools can be used to populate data.]
[h:help?Print this help and exit.]
[F:functions?Print out a list of names of all currently defined script functions and exit (see \btypeset +f\b).]
[H:usage]:[function?Show the usage info for the function with the given name if available and exit. (see also option \b-F\b).]
[T:trace]:[fname_list?A comma or whitespace separated list of function names, which should be traced when running this script. If the list consist of the single word "ALL" or "*" all known functions get traced. "MAIN" is the special word to enable the trace of the main script. Gets activated as soon as this option gets processed, so option order might be important.]
[d:debug?Enable really verbose debug info.]
[C:no-color?Do not use ANSI escape codes to color the output.]
[k:keep?Keep the files used to modify the DS. Files are enumerated and prefixed with the command to use for executing it so that one is able to do the same manually what this script did and thus may help to fine tune the setup of your DS. Actually it is recommended to run this script against a virgin DS and than re-use/adjust everything you need on your production system.]
[I:importpwp?If specified, the storage scheme for Password Policy Import will be changed in the same way as the storage scheme for the Default Password Policy. If not specified, the storage scheme for Password Policy Import stays untouched. This option gets ignored for non-OpenDS/OpenDJ directory servers.]
[i:in]:[file?Get setup info from the given file.]
[o:out]:[file?Generate a server configuration output file.]
[s:djSyntax?If given, the OpenDJ schema defintions will be used to complement the servers schema if needed, no matter which kind of server has been detected.]
[S:eeSyntax?If given, the Sun DSEE schema defintions will be used to complement the servers schema if needed, no matter which kind of server has been detected.
Wrt. Solaris it should not make a difference, whether OpenDJ or DSEE syntax is used. OpenDJ syntax is usually a little bit more precise.]
[t:timeout]:[seconds:=60?When this script creates an index, it also schedules a task to rebuild the index immediately. The \atimeout\a specifies, how long to wait for task completion. If the task gets not finished within the given time, the script treats that as an error and continues its work.]
[v:verbose?Verbose mode - makes the script a little bit more chatty.]
[+NOTES?This script should work for the following DS:]{
[+?Sun DS 5.x]
[+?Oracle ODSEE 11g]
[+?Sun OpenDS 2.x]
[+?Forgerock OpenDJ 2.x]
}
'
F) typeset +f ; exit 0 ;;
typeset -ft ${ typeset +f ; }
set -x
else
fi
;;
else
fi
exit 0
;;
C) Log.COLORED=0 ;;
I) INT[NEED_CRYPT_IMPORT]=1 ;;
v) Log.VERBOSE=1 ; TMPF[FD]=1 ;;
*) Log.fatal '**Internal ERROR: Supported option missing handler'
exit 1
;;
esac
done
shift $X
export LC_CTYPE=C # avoid any surprises
# Create TMP[DIR]
Log.fatal 'Unable to create a safe temporary directory'
exit 1
fi
trap 'typeset _CMD_="${.sh.command}"
print -u2 -n "\E[0;30;47m"
print -u2 -n -r "${.sh.fun:-MAIN}(): ${_CMD_}"
print -u2 "\E[0m"
fi
# Prevent new files from being read by group or others
umask 077
X=$?
exit ${X}
# vim:ts=4 filetype=sh
# :syntax sync fromstart