This directive causes a cached connection to be dropped an recreated after a given ttl, regardless of being idle or not.

This directive forces the backend to reject all those operations that must resolve to a single target in case none or multiple targets are selected. They include: add, delete, modify, modrdn; compare is not included, as well as bind since, as they don't alter entries, in case of multiple matches an attempt is made to perform the operation on any candidate target, with the constraint that at most one must succeed. This directive can also be used when processing targets to mark a specific target as default.

This directive sets the time-to-live of the DN cache. This caches the target that holds a given DN to speed up target selection in case multiple targets would result from an uncached search; forever means cache never expires; disabled means no DN caching; otherwise a valid ( > 0 ) ttl is required, in the format illustrated for the idle−timeout directive.

This directive allows to select the behavior in case an error is returned by one target during a search. The default, continue, consists in continuing the operation, trying to return as much data as possible. If the value is set to stop, the search is terminated as soon as an error is returned by one target, and the error is immediately propagated to the client. If the value is set to report, the search is continuated to the end but, in case at least one target returned an error code, the first non-success error code is returned.

If yes, do not return search reference responses. By default, they are returned unless request is LDAPv2. If set before any target specification, it affects all targets, unless overridden by any per-target directive.

If yes, return success instead of searching if a filter is undefined or contains undefined portions. By default, the search is propagated after replacing undefined portions with (!(objectClass=*)), which corresponds to the empty result set. If set before any target specification, it affects all targets, unless overridden by any per-target directive.

This directive indicates what protocol version must be used to contact the remote server. If set to 0 (the default), the proxy uses the same protocol version used by the client, otherwise the requested protocol is used. The proxy returns unwillingToPerform if an operation that is incompatible with the requested protocol is attempted. If set before any target specification, it affects all targets, unless overridden by any per-target directive.

This directive, when set to yes, causes the authentication to the remote servers with the pseudo-root identity (the identity defined in each idassert-bind directive) to be deferred until actually needed by subsequent operations. Otherwise, all binds as the rootdn are propagated to the targets.

Turns on quarantine of URIs that returned LDAP_UNAVAILABLE, so that an attempt to reconnect only occurs at given intervals instead of any time a client requests an operation. The pattern is: retry only after at least interval seconds elapsed since last attempt, for exactly num times; then use the next pattern. If num for the last pattern is "+", it retries forever; otherwise, no more retries occur. This directive must appear before any target specification; it affects all targets with the same pattern.

If this option is given, the client's bind credentials are remembered for rebinds, when trying to re-establish a broken connection, or when chasing a referral, if chase−referrals is set to yes.

Adds session tracking control for all requests. The client's IP and hostname, and the identity associated to each request, if known, are sent to the remote server for informational purposes. This directive is incompatible with setting protocol−version to 2. If set before any target specification, it affects all targets, unless overridden by any per-target directive.

Discards current cached connection when the client rebinds.

when set to yes, create a temporary connection whenever competing with other threads for a shared one; otherwise, wait until the shared connection is available.

The <protocol> part can be anything ldap_initialize(3) accepts ({ldap|ldaps|ldapi} and variants); the <host> may be omitted, defaulting to whatever is set in ldap.conf(5). The <naming context> part is mandatory for the first URI, but it must be omitted for subsequent ones, if any. The naming context part must be within the naming context defined for the backend, e.g.:

DN which is used to query the target server for acl checking, as in the LDAP backend; it is supposed to have read access on the target server to attributes used on the proxy for acl checking. There is no risk of giving away such values; they are only used to check permissions. The acl−authcDN identity is by no means implicitly used by the proxy when the client connects anonymously.

Password used with the acl−authcDN above.

This directive defines the timeout, in microseconds, used when polling for response after an asynchronous bind connection. The initial call to ldap_result(3) is performed with a trade-off timeout of 100000 us; if that results in a timeout exceeded, subsequent calls use the value provided with bind−timeout. The default value is used also for subsequent calls if bind−timeout is not specified. If set before any target specification, it affects all targets, unless overridden by any per-target directive.

enable/disable automatic referral chasing, which is delegated to the underlying libldap, with rebinding eventually performed if the rebind−as−user directive is used. The default is to chase referrals. If set before any target specification, it affects all targets, unless overridden by any per-target directive.

The "default−target" directive can also be used during target specification. With no arguments it marks the current target as the default. The optional number marks target <target> as the default one, starting from 1. Target <target> must be defined.

if defined, selects what local identities are authorized to exploit the identity assertion feature. The string <authz-regexp> follows the rules defined for the authzFrom attribute. See slapd.conf(5), section related to authz−policy, for details on the syntax of this field.

idassert−bind bindmethod=none|simple|sasl [binddn=<simple DN>] [credentials=<simple password>] [saslmech=<SASL mech>] [secprops=<properties>] [realm=<realm>] [authcId=<authentication ID>] [authzId=<authorization ID>] [authz={native|proxyauthz}] [mode=<mode>] [flags=<flags>] [starttls=no|yes|critical] [tls_cert=<file>] [tls_key=<file>] [tls_cacert=<file>] [tls_cacertdir=<path>] [tls_reqcert=never|allow|try|demand] [tls_ciphersuite=<ciphers>] [tls_protocol_min=<version>] [tls_crlcheck=none|peer|all]

This directive causes a cached connection to be dropped an recreated after it has been idle for the specified time. The value can be specified as

[<d>d][<h>h][<m>m][<s>[s]]

where <d>, <h>, <m> and <s> are respectively treated as days, hours, minutes and seconds. If set before any target specification, it affects all targets, unless overridden by any per-target directive.

This maps object classes and attributes as in the LDAP backend. See slapd-ldap(5).

Sets the network timeout value after which poll(2)/select(2) following a connect(2) returns in case of no activity. The value is in seconds, and it can be specified as for idle−timeout. If set before any target specification, it affects all targets, unless overridden by any per-target directive.

This directive defines how many times a bind should be retried in case of temporary failure in contacting a target. If defined before any target specification, it applies to all targets (by default, 3 times); the global value can be overridden by redefinitions inside each target specification.

Deprecated; use idassert−bind instead.

Deprecated; use idassert−bind instead.

The rewrite options are described in the "REWRITING" section.

This directive instructs back-meta to ignore the current target for operations whose requestDN is subordinate to DN. There may be multiple occurrences of the subtree−exclude directive for each of the targets.

All the directives starting with "rewrite" refer to the rewrite engine that has been added to slapd. The "suffixmassage" directive was introduced in the LDAP backend to allow suffix massaging while proxying. It has been obsoleted by the rewriting tools. However, both for backward compatibility and for ease of configuration when simple suffix massage is required, it has been preserved. It wraps the basic rewriting instructions that perform suffix massaging. See the "REWRITING" section for a detailed list of the rewrite rules it implies.

enable if the remote server supports absolute filters (see draft-zeilenga-ldap-t-f for details). If set to discover, support is detected by reading the remote server's root DSE. If set before any target specification, it affects all targets, unless overridden by any per-target directive.

This directive allows to set per-operation timeouts. Operations can be

<op> ::= bind, add, delete, modrdn, modify, compare, search

The overall duration of the search operation is controlled either by the timelimit parameter or by server-side enforced time limits (see timelimit and limits in slapd.conf(5) for details). This timeout parameter controls how long the target can be irresponsive before the operation is aborted. Timeout is meaningless for the remaining operations, unbind and abandon, which do not imply any response, while it is not yet implemented in currently supported extended operations. If no operation is specified, the timeout val affects all supported operations. If specified before any target definition, it affects all targets unless overridden by per-target directives.

	Note
	If the timeout is exceeded, the operation is cancelled (according to the cancel directive); the protocol does not provide any means to rollback operations, so the client will not be notified about the result of the operation, which may eventually succeeded or not. In case the timeout is exceeded during a bind operation, the connection is destroyed, according to RFC4511.

execute the StartTLS extended operation when the connection is initialized; only works if the URI directive protocol scheme is not ldaps://. propagate issues the StartTLS operation only if the original connection did. The try− prefix instructs the proxy to continue operations if the StartTLS operation failed; its use is highly deprecated. If set before any target specification, it affects all targets, unless overridden by any per-target directive.

honors case in matching (default is case insensitive)

use POSIX ''basic'' regular expressions (default is ''extended'')

allow no more than n recursive passes for a specific rule; does not alter the max total count of passes, so it can only enforce a stricter limit for a specific rule.

apply the rule once only (default is recursive)

stop applying rules in case of match; the current rule is still applied recursively; combine with `:' to apply the current rule only once and then stop.

stop current operation if the rule matches, and issue an `unwilling to perform' error.

jump n rules back and forth (watch for loops!). Note that `G{1}' is implicit in every rule.

ignores errors in rule; this means, in case of error, e.g. issued by a map, the error is treated as a missed match. The `unwilling to perform' is not overridden.

uses n as return code if the rule matches; the flag does not alter the recursive behavior of the rule, so, to have it performed only once, it must be used in combination with `:', e.g. `:U{16}' returns the value `16' after exactly one execution of the rule, if the pattern matches. As a consequence, its behavior is equivalent to `@', with the return code set to n; or, in other words, `@' is equivalent to `U{0}'. By convention, the freely available codes are above 16 included; the others are reserved.

sub context invocation; <name> must be a legal, already defined rewrite context name

external command invocation; <name> must refer to a legal, already defined command name (NOT IMPL.)

variable assignment; <name> defines a variable in the running operation structure which can be dereferenced later; operator & assigns a variable in the rewrite context scope; operator && assigns a variable that scopes the entire session, e.g. its value can be dereferenced later by other rewrite contexts

variable dereferencing; <name> must refer to a variable that is defined and assigned for the running operation; operator * dereferences a variable scoping the rewrite context; operator ** dereferences a variable scoping the whole session, e.g. the value is passed across rewrite contexts

parameter dereferencing; <name> must refer to an existing parameter; the idea is to make some run-time parameters set by the system available to the rewrite engine, as the client host name, the bind DN if any, constant parameters initialized at config time, and so on; no parameter is currently set by either back−ldap or back−meta, but constant parameters can be defined in the configuration file by using the rewriteParam directive.

If `on', the requested rewriting is performed; if `off', no rewriting takes place (an easy way to stop rewriting without altering too much the configuration file).

<Context name> is the name that identifies the context, i.e. the name used by the application to refer to the set of rules it contains. It is used also to reference sub contexts in string rewriting. A context may alias another one. In this case the alias context contains no rule, and any reference to it will result in accessing the aliased one.

Determines how a string can be rewritten if a pattern is matched. Examples are reported below.

Allows to define a map that transforms substring rewriting into something else. The map is referenced inside the substitution pattern of a rule.

Sets a value with global scope, that can be dereferenced by the command `%{$paramName}'.

Sets the maximum number of total rewriting passes that can be performed in a single rewrite operation (to avoid loops). A safe default is set to 100; note that reaching this limit is still treated as a success; recursive invocation of rules is simply interrupted. The count applies to the rewriting operation as a whole, not to any single rule; an optional per-rule limit can be set. This limit is overridden by setting specific per-rule limits with the `M{n}' flag.

default slapd configuration file