Merge lp:~asommer/openldap-dit/openldap-dit-split into lp:openldap-dit

[Adam Sommer]

My attempt to solve the split-dit-package blueprint: https://blueprints.launchpad.net/openldap-dit/+spec/split-dit-package

Created subdirectories in the schemas, acls, databases, contents, modules, and overlays directories for the various "services" that can be added to the DIT. Doing this also allows users to easily create a base DIT if that is all they desire.

Code is also updated for latest slapd package which makes changes to the cn=localroot,cn=config authentication method.

[Bruce Edge (bruce-edge)]

Is this available as a pre-built package?

-Bruce

On Wed, Apr 28, 2010 at 6:54 AM, Adam Sommer <email address hidden> wrote:

> Adam Sommer has proposed merging
> lp:~asommer/openldap-dit/openldap-dit-split into lp:openldap-dit.
>
> Requested reviews:
> Andreas Hasenack (ahasenack)
>
>
> My attempt to solve the split-dit-package blueprint:
> https://blueprints.launchpad.net/openldap-dit/+spec/split-dit-package
>
> Created subdirectories in the schemas, acls, databases, contents, modules,
> and overlays directories for the various "services" that can be added to the
> DIT. Doing this also allows users to easily create a base DIT if that is
> all they desire.
>
> Code is also updated for latest slapd package which makes changes to the
> cn=localroot,cn=config authentication method.
>
> --
>
> https://code.launchpad.net/~asommer/openldap-dit/openldap-dit-split/+merge/24321
> You are subscribed to branch lp:openldap-dit.
>
> === added directory 'acls/base'
> === added file 'acls/base/config-acl.ldif'
> --- acls/base/config-acl.ldif 1970-01-01 00:00:00 +0000
> +++ acls/base/config-acl.ldif 2010-04-28 13:54:17 +0000
> @@ -0,0 +1,6 @@
> +dn: olcDatabase={0}config,cn=config
> +changetype: modify
> +add: olcAccess
> +olcAccess: to *
> + by group/groupOfMembers/member.exact="cn=LDAP Admins,ou=System
> Groups,@SUFFIX@" manage
> + by * break
>
> === removed file 'acls/config-acl.ldif'
> --- acls/config-acl.ldif 2009-09-17 13:38:20 +0000
> +++ acls/config-acl.ldif 1970-01-01 00:00:00 +0000
> @@ -1,6 +0,0 @@
> -dn: olcDatabase={0}config,cn=config
> -changetype: modify
> -add: olcAccess
> -olcAccess: to *
> - by group/groupOfMembers/member.exact="cn=LDAP Admins,ou=System
> Groups,@SUFFIX@" manage
> - by * break
>
> === removed file 'acls/frontend-acl.ldif'
> --- acls/frontend-acl.ldif 2009-09-14 20:38:42 +0000
> +++ acls/frontend-acl.ldif 1970-01-01 00:00:00 +0000
> @@ -1,7 +0,0 @@
> -# see bug #427842
> -dn: olcDatabase={-1}frontend,cn=config
> -changetype: modify
> -add: olcAccess
> -olcAccess: to dn.base="" by * read
> -olcAccess: to dn.base="cn=subschema" by * read
> -
>
> === added directory 'contents/base'
> === added file 'contents/base/base-dit.ldif'
> --- contents/base/base-dit.ldif 1970-01-01 00:00:00 +0000
> +++ contents/base/base-dit.ldif 2010-04-28 13:54:17 +0000
> @@ -0,0 +1,160 @@
> +# base tree
> +dn: @SUFFIX@
> +dc: @DC@
> +objectClass: domain
> +objectClass: domainRelatedObject
> +associatedDomain: @DOMAIN@
> +
> +dn: ou=People,@SUFFIX@
> +ou: People
> +objectClass: organizationalUnit
> +
> +dn: ou=Group,@SUFFIX@
> +ou: Group
> +objectClass: organizationalUnit
> +description: Container for user accounts
> +
> +dn: ou=System Accounts,@SUFFIX@
> +ou: System Accounts
> +objectClass: organizationalUnit
> +description: Container for System and Services privileged accounts
> +
> +dn: ou=System Groups,@SUFFIX@
> +ou: System Groups
> +objectClass: organizationalUnit
> +description: Container for System and Services privileged groups
> +
> +dn: ou=Hosts,@SUFFIX@
> +ou: Hosts
> +objectClass: organizationalUnit
> +description: Container for Samba machine accounts
> +
> +dn: ou=Idmap,@SUFFIX@
> +ou: Idmap
> +objectCla...

[Adam Sommer (asommer)]

On Wed, Apr 28, 2010 at 10:30 PM, Thag <email address hidden> wrote:

> Is this available as a pre-built package?
>
> -Bruce
>

Not at this time that I know of, but it should be pretty simple to setup a
PPA for the package or to create a local build using pbuilder.

Thanks.
--
Party On,
Adam

[lp:~asommer/openldap-dit/openldap-dit-split]

68. By Adam Sommer on 2010-05-18

Reorganizing files into minimal core scheme.

69. By Adam Sommer on 2010-05-18

Moved syncprov overlay into it's own directory.

70. By Adam Sommer on 2010-05-18

Moved syncrepl module out of core-modules.ldif

71. By Adam Sommer on 2010-05-18

Updated package for new modular approach.

72. By Adam Sommer on 2010-05-19

More Makefile updates to implement the new directory layout.

73. By Adam Sommer on 2010-05-19

Finally have the correct loop to install the ldifs.

74. By Adam Sommer on 2010-05-20

Got package working under openldap-dit-core directories.

75. By Adam Sommer on 2010-05-24

Reorganizing into simple service directories with service-LDIFTYPE.ldif files.

76. By Adam Sommer on 2010-05-24

Creation of openldap-dit-usersandgroups package.

77. By Adam Sommer on 2010-05-24

Finished second directory reorganization.

78. By Adam Sommer on 2010-05-25

Cleaning up postinst scripts.

79. By Adam Sommer on 2010-05-27

Working toward using debconf to get suffix (from domain) and admin password.

80. By Adam Sommer on 2010-05-27

Using openldap-dit.sripts-common to hold common postinst functions that will be added using openldap-dit-.postinst.in for earch package.

81. By Adam Sommer on 2010-05-28

Get domain and admin password from debconf, but still need to do sanity checks on password.

82. By Adam Sommer on 2010-05-31

New while loop to check password confirmation.

83. By Adam Sommer on 2010-06-01

 * Fixed ACL replacement code.
 * Updated usersandgroups postinst.in working on checking for previous DIT.

84. By Adam Sommer on 2010-06-01

Removed unused functions and cleaned up comments.

85. By Adam Sommer on 2010-06-01

Adjusted ACL to allow LDAP Admin full control.

86. By Adam Sommer on 2010-06-01

More ACL adjustments, groups should now work as advertised.

87. By Adam Sommer on 2010-06-01

 * Fixed dsc lintian errors by using pot files for the templates,
   creating the debian/source/format file, updated standards version,
   and changed version number.
 * Removed openldap-dit-setup.sh.

88. By Adam Sommer on 2010-06-01

Fixing lintian errors in .deb file.

89. By Adam Sommer on 2010-06-01

Removed LICENSE install to fix lintian error.

90. By Adam Sommer on 2010-06-01

Created Lucid package.

91. By Adam Sommer on 2010-06-02

Forgot to remove comments.

[Mathias Gug (mathiaz)]

Hi Adam,

Thanks for working on this. As this is a big diff I'll split the review in multiple passes.

Here are a few comments about the upstream code changes (ie outside the debian/ directory):

> === modified file 'Makefile'
> --- Makefile 2009-12-02 21:04:38 +0000
> +++ Makefile 2010-06-17 16:58:16 +0000
> @@ -43,7 +36,7 @@
>
> tarball: clean
> mkdir $(NAME)-$(VERSION)
> - cp -a Makefile *.sh schemas doc TODO LICENSE COPYRIGHT acls databases overlays modules contents $(NAME)-$(VERSION)
> + cp -a Makefile *.sh schemas doc TODO COPYRIGHT acls databases overlays modules contents $(NAME)-$(VERSION)

Why is the LICENSE file removed from the tarball?

> === added directory 'core'
> === added file 'core/core-acl.ldif'
> --- core/core-acl.ldif 1970-01-01 00:00:00 +0000
> +++ core/core-acl.ldif 2010-06-17 16:58:16 +0000
> @@ -0,0 +1,34 @@

I would split the acl parts from the database defintion. Every parts that other
modules (eg usersandgruops) could define should be part of their own file.

The actual database definition could be put in core/database.ldif.

> +olcDbDirectory: /var/lib/ldap

I would use a sub-directory of /var/lib/ldap/ such as openldap-dit/ so that
other packages could also use /var/lib/ldap/ for their own database backend.

> +olcDbIndex: objectClass eq
> +olcDbIndex: entryUUID eq
> +olcDbIndex: entryCSN eq
> +olcDbIndex: cn eq,subinitial

I would suggest to put all the indexes definition in an core/indexes.ldif file.

> +olcDbIndex: uid eq,subinitial
> +olcDbIndex: uidNumber eq
> +olcDbIndex: gidNumber eq
> +olcDbIndex: sn eq,subinitial
> +olcDbIndex: member eq
> +olcDbIndex: mail eq,subinitial
> +olcDbIndex: givenName eq,subinitial
> +olcDbIndex: displayName eq
> +olcDbIndex: uniqueMember pres,eq

All of these indexes are actually related to the user and group module. So move them to usersandgroups/indexes.ldif.

> +olcAccess: {0}to dn.subtree="@SUFFIX@"
> + by dn.exact="uid=LDAP Admin,ou=System Accounts,@SUFFIX@" manage
> + by * break
> +olcAccess: {1}to dn.subtree="@SUFFIX@"
> + by * read

I'd suggest that all the acl definition should go in the core/acl.ldif file.

> +olcAddContentAcl: TRUE
> +olcLastMod: TRUE

These should be part of the core database configuration in core/database.ldif.

> === added file 'core/core-dit.ldif'
> --- core/core-dit.ldif 1970-01-01 00:00:00 +0000
> +++ core/core-dit.ldif 2010-06-17 16:58:16 +0000

I would name the file dit.ldif instead of core-dit.ldif since core is already in the directory name.

> === added file 'core/core-modules.ldif'
> --- core/core-modules.ldif 1970-01-01 00:00:00 +0000
> +++ core/core-modules.ldif 2010-06-17 16:58:16 +0000

I would rename core-modules to modules.ldif since core is already part of the directory name.

> @@ -0,0 +1,9 @@
> +dn: cn=module,cn=config

[...]

> +olcModuleLoad: back_bdb.la

You don't need back_bdb as long as you're using back_hdb only.

> +olcModuleLoad: ppolicy.la
> +olcModuleLoad: unique.la

These two modules are part of usersandgroups. I'd move them to usersandgroups/modules.ldif.

[...]

> +olcModuleLoad: refint.la

I think this module should also be part of userandgroups.

> === added file 'core/cosine-schema.ldif'
> === added file ...

review: Needs Fixing

[lp:~asommer/openldap-dit/openldap-dit-split]

92. By Adam Sommer on 2010-07-12

Adjusted file content and naming per Mathias good suggestions.

93. By Adam Sommer on 2010-07-12

New check to find suffix database to add LDIFs to.

94. By Adam Sommer on 2010-07-19

Finished changes to dynamically find suffix database.

95. By Adam Sommer on 2010-07-19

Find index of module suffix.

[Adam Sommer (asommer)]

Hello Mathias,

Sorry for taking so long to get back to you... got jammed up in the day job,
but should have a lot of time to focus on this. Thank you very much for
reviewing my submission.

> > === modified file 'Makefile'
> > --- Makefile 2009-12-02 21:04:38 +0000
> > +++ Makefile 2010-06-17 16:58:16 +0000
> > @@ -43,7 +36,7 @@
> >
> > tarball: clean
> > mkdir $(NAME)-$(VERSION)
> > - cp -a Makefile *.sh schemas doc TODO LICENSE COPYRIGHT acls
> databases overlays modules contents $(NAME)-$(VERSION)
> > + cp -a Makefile *.sh schemas doc TODO COPYRIGHT acls databases
> overlays modules contents $(NAME)-$(VERSION)
>
> Why is the LICENSE file removed from the tarball?
>

It was removed to fix a lintian error... this was probably the wrong way to
fix that, so I'll revisit and come up with the correct solution.

>
> I would use a sub-directory of /var/lib/ldap/ such as openldap-dit/ so that
> other packages could also use /var/lib/ldap/ for their own database
> backend.
>

Not sure I agree with this point. What other packages use /var/lib/ldap?
 Besides slapd that is (which doesn't actually add anything by default)?
 Just wondering why it'd be better to use a subdirectory... my impression of
openldap-dit was for it to configure the main LDAP directory tree for an
organizations server/network.

Also, doing so would require adjusting the AppArmor profile... I'm sure that
isn't a big deal, but something else to keep in mind.

>
> I'd try not to use indexes here as we're not sure the index number of the
> database. Computing the actual index should be left to the script that is
> actually responsible for loading these overlays in the correct database.
>
>

Renamed the directories as you suggested... I like it better too. Coded a
way to find the database that contains the suffix. Also, added a check to
find the cn=module suffix.

I think that covers everything, but if not just let me know.

Thanks again Mathias.

--
Party On,
Adam

Unmerged revisions

95. By Adam Sommer on 2010-07-19

Find index of module suffix.

94. By Adam Sommer on 2010-07-19

Finished changes to dynamically find suffix database.

93. By Adam Sommer on 2010-07-12

New check to find suffix database to add LDIFs to.

92. By Adam Sommer on 2010-07-12

Adjusted file content and naming per Mathias good suggestions.

91. By Adam Sommer on 2010-06-02

Forgot to remove comments.

90. By Adam Sommer on 2010-06-01

Created Lucid package.

89. By Adam Sommer on 2010-06-01

Removed LICENSE install to fix lintian error.

88. By Adam Sommer on 2010-06-01

Fixing lintian errors in .deb file.

87. By Adam Sommer on 2010-06-01

 * Fixed dsc lintian errors by using pot files for the templates,
   creating the debian/source/format file, updated standards version,
   and changed version number.
 * Removed openldap-dit-setup.sh.

86. By Adam Sommer on 2010-06-01

More ACL adjustments, groups should now work as advertised.

=== modified file 'Makefile'
--- Makefile	2009-12-02 21:04:38 +0000
+++ Makefile	2010-07-19 21:25:56 +0000
@@ -1,7 +1,7 @@
 # Makefile for openldap-dit
 
 NAME = openldap-dit
-VERSION = 0.21
+VERSION = 0.22
 DESTDIR =
 prefix = /usr
 bindir = $(prefix)/bin
@@ -14,24 +14,17 @@
 mydir = $(ldapdatadir)/$(NAME)
 ldapscriptdir = $(ldapdatadir)
 
-install:
+install-core:
 	mkdir -p $(DESTDIR)$(mydir)
 	mkdir -p $(DESTDIR)$(docdir)
 	mkdir -p $(DESTDIR)$(ldapscriptdir)
-	mkdir -p $(DESTDIR)$(mydir)/acls
-	mkdir -p $(DESTDIR)$(mydir)/databases
-	mkdir -p $(DESTDIR)$(mydir)/overlays
-	mkdir -p $(DESTDIR)$(mydir)/schemas
-	mkdir -p $(DESTDIR)$(mydir)/modules
-	mkdir -p $(DESTDIR)$(mydir)/contents
-	install -m 0755 *.sh $(DESTDIR)$(ldapscriptdir)
-	install -m 0644 schemas/* $(DESTDIR)$(mydir)/schemas
-	install -m 0644 doc/* TODO LICENSE COPYRIGHT $(DESTDIR)$(docdir)
-	install -m 0644 acls/* $(DESTDIR)$(mydir)/acls/
-	install -m 0644 databases/* $(DESTDIR)$(mydir)/databases/
-	install -m 0644 overlays/* $(DESTDIR)$(mydir)/overlays/
-	install -m 0644 modules/* $(DESTDIR)$(mydir)/modules/
-	install -m 0644 contents/* $(DESTDIR)$(mydir)/contents/
+	install -m 0644 TODO COPYRIGHT $(DESTDIR)$(docdir)
+	mkdir -p $(DESTDIR)$(mydir)/core
+	install -m 0644 core/* $(DESTDIR)$(mydir)/core
+
+install-usersandgroups:
+	mkdir -p $(DESTDIR)$(mydir)/usersandgroups
+	install -m 0644 usersandgroups/* $(DESTDIR)$(mydir)/usersandgroups
 
 clean:
 	rm -rf *~ $(NAME)-$(VERSION) $(NAME)-$(VERSION).tar.bz2 debian/$(NAME)
@@ -43,7 +36,7 @@
 
 tarball: clean
 	mkdir $(NAME)-$(VERSION)
-	cp -a Makefile *.sh schemas doc TODO LICENSE COPYRIGHT acls databases overlays modules contents $(NAME)-$(VERSION)
+	cp -a Makefile *.sh schemas doc TODO COPYRIGHT acls databases overlays modules contents $(NAME)-$(VERSION)
 	cp -a debian $(NAME)-$(VERSION)
 	tar czf $(NAME)-$(VERSION).tar.gz $(NAME)-$(VERSION)
 	rm -rf $(NAME)-$(VERSION)

=== removed directory 'acls'
=== removed file 'acls/config-acl.ldif'
--- acls/config-acl.ldif	2009-09-17 13:38:20 +0000
+++ acls/config-acl.ldif	1970-01-01 00:00:00 +0000
@@ -1,6 +0,0 @@
-dn: olcDatabase={0}config,cn=config
-changetype: modify
-add: olcAccess
-olcAccess: to *
-  by group/groupOfMembers/member.exact="cn=LDAP Admins,ou=System Groups,@SUFFIX@" manage
-  by * break

=== removed file 'acls/frontend-acl.ldif'
--- acls/frontend-acl.ldif	2009-09-14 20:38:42 +0000
+++ acls/frontend-acl.ldif	1970-01-01 00:00:00 +0000
@@ -1,7 +0,0 @@
-# see bug #427842
-dn: olcDatabase={-1}frontend,cn=config
-changetype: modify
-add: olcAccess
-olcAccess: to dn.base="" by * read
-olcAccess: to dn.base="cn=subschema" by * read
-

=== added directory 'autofs'
=== added file 'autofs/autofs.ldif'
--- autofs/autofs.ldif	1970-01-01 00:00:00 +0000
+++ autofs/autofs.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,11 @@
+dn: cn=autofs,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: autofs
+olcAttributeTypes: {0}( 1.3.6.1.1.1.1.25 NAME 'automountInformation' DESC 'Inf
+ ormation used by the autofs automounter' EQUALITY caseExactIA5Match SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+olcObjectClasses: {0}( 1.3.6.1.1.1.1.13 NAME 'automount' DESC 'An entry in an 
+ automounter map' SUP top STRUCTURAL MUST ( cn $ automountInformation ) MAY de
+ scription )
+olcObjectClasses: {1}( 1.3.6.1.4.1.2312.4.2.2 NAME 'automountMap' DESC 'An gro
+ up of related automount objects' SUP top STRUCTURAL MUST ou )

=== removed directory 'contents'
=== removed file 'contents/dit.ldif'
--- contents/dit.ldif	2009-10-06 18:58:32 +0000
+++ contents/dit.ldif	1970-01-01 00:00:00 +0000
@@ -1,270 +0,0 @@
-# base tree
-dn: @SUFFIX@
-dc: @DC@
-objectClass: domain
-objectClass: domainRelatedObject
-associatedDomain: @DOMAIN@
-
-dn: ou=People,@SUFFIX@
-ou: People
-objectClass: organizationalUnit
-
-dn: ou=Group,@SUFFIX@
-ou: Group
-objectClass: organizationalUnit
-description: Container for user accounts
-
-dn: ou=System Accounts,@SUFFIX@
-ou: System Accounts
-objectClass: organizationalUnit
-description: Container for System and Services privileged accounts
-
-dn: ou=System Groups,@SUFFIX@
-ou: System Groups
-objectClass: organizationalUnit
-description: Container for System and Services privileged groups
-
-dn: ou=Hosts,@SUFFIX@
-ou: Hosts
-objectClass: organizationalUnit
-description: Container for Samba machine accounts
-
-dn: ou=Idmap,@SUFFIX@
-ou: Idmap
-objectClass: organizationalUnit
-description: Container for Samba Winbind ID mappings
-
-dn: ou=Address Book,@SUFFIX@
-ou: Address Book
-objectClass: organizationalUnit
-description: Container for global address book entries
-
-dn: ou=sudoers,@SUFFIX@
-ou: sudoers
-objectClass: organizationalUnit
-description: Container for sudo related entries
-
-dn: cn=defaults,ou=sudoers,@SUFFIX@
-cn: defaults
-objectClass: sudoRole
-sudoOption: authenticate
-description: Default options for sudo roles
-
-dn: ou=dhcp,@SUFFIX@
-ou: dhcp
-objectClass: organizationalUnit
-description: Container for DHCP related entries
-
-dn: ou=dns,@SUFFIX@
-ou: dns
-objectClass: organizationalUnit
-description: Container for DNS related entries
-
-dn: ou=Kerberos Realms,@SUFFIX@
-ou: Kerberos Realms
-objectClass: organizationalUnit
-description: Container for Kerberos Realms
-
-dn: ou=Password Policies,@SUFFIX@
-ou: Password Policies
-objectClass: organizationalUnit
-description: Container for OpenLDAP password policies
-
-dn: cn=default,ou=Password Policies,@SUFFIX@
-cn: default
-objectClass: pwdPolicy
-objectClass: namedObject
-pwdAttribute: userPassword
-pwdCheckQuality: 1
-
-# System Accounts
-dn: uid=Account Admin,ou=System Accounts,@SUFFIX@
-uid: Account Admin
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used to administer all users, groups, machines and general accounts
-
-dn: uid=nssldap,ou=System Accounts,@SUFFIX@
-uid: nssldap
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Unprivileged account which can be used by nss_ldap for when anonymous searches are disabled
-
-dn: uid=MTA Admin,ou=System Accounts,@SUFFIX@
-uid: MTA Admin
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used to administer email related attributes
-
-dn: uid=DHCP Admin,ou=System Accounts,@SUFFIX@
-uid: DHCP Admin
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used to administer DHCP related entries and attributes
-
-dn: uid=DHCP Reader,ou=System Accounts,@SUFFIX@
-uid: DHCP Reader
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used to read entries and attributes under ou=dhcp
-
-dn: uid=DNS Admin,ou=System Accounts,@SUFFIX@
-uid: DNS Admin
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used to administer DNS related entries and attributes
-
-dn: uid=DNS Reader,ou=System Accounts,@SUFFIX@
-uid: DNS Reader
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used to read entries and attributes under ou=dns
-
-dn: uid=Sudo Admin,ou=System Accounts,@SUFFIX@
-uid: Sudo Admin
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used to administer Sudo related entries and attributes
-
-dn: uid=Address Book Admin,ou=System Accounts,@SUFFIX@
-uid: Address Book Admin
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used to administer global Address Book related entries and attributes
-
-dn: uid=LDAP Admin,ou=System Accounts,@SUFFIX@
-uid: LDAP Admin
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used to administer all parts of the Directory
-
-dn: uid=LDAP Replicator,ou=System Accounts,@SUFFIX@
-uid: LDAP Replicator
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used by consumer servers for replication
-
-dn: uid=LDAP Monitor,ou=System Accounts,@SUFFIX@
-uid: LDAP Monitor
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used to read cn=monitor entries
-
-dn: uid=Idmap Admin,ou=System Accounts,@SUFFIX@
-uid: Idmap Admin
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used to administer Samba Winbind ID mapping related entries and attributes
-
-dn: uid=kdc-service,ou=System Accounts,@SUFFIX@
-uid: kdc-service
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used for the Kerberos KDC
-
-dn: uid=kadmin-service,ou=System Accounts,@SUFFIX@
-uid: kadmin-service
-objectClass: account
-objectClass: simpleSecurityObject
-userPassword: {CRYPT}x
-description: Account used for the Kerberos Admin server
-
-# Groups associated with system accounts
-dn: cn=LDAP Admins,ou=System Groups,@SUFFIX@
-cn: LDAP Admins
-objectClass: groupOfMembers
-description: Members can administer all parts of the Directory
-owner: uid=LDAP Admin,ou=System Accounts,@SUFFIX@
-member: uid=LDAP Admin,ou=System Accounts,@SUFFIX@
-
-dn: cn=Account Admins,ou=System Groups,@SUFFIX@
-cn: Account Admins
-objectClass: groupOfMembers
-description: Members can administer all user, group and machine accounts
-owner: uid=Account Admin,ou=System Accounts,@SUFFIX@
-member: uid=Account Admin,ou=System Accounts,@SUFFIX@
-
-dn: cn=Sudo Admins,ou=System Groups,@SUFFIX@
-cn: Sudo Admins
-objectClass: groupOfMembers
-description: Members can administer ou=sudoers entries and attributes
-owner: uid=Sudo Admin,ou=System Accounts,@SUFFIX@
-member: uid=Sudo Admin,ou=System Accounts,@SUFFIX@
-
-dn: cn=DNS Admins,ou=System Groups,@SUFFIX@
-cn: DNS Admins
-objectClass: groupOfMembers
-description: Members can administer ou=DNS entries and attributes
-owner: uid=DNS Admin,ou=System Accounts,@SUFFIX@
-member: uid=DNS Admin,ou=System Accounts,@SUFFIX@
-
-dn: cn=DNS Readers,ou=System Groups,@SUFFIX@
-cn: DNS Readers
-objectClass: groupOfMembers
-description: Members can read entries and attributes under ou=dns
-owner: uid=DNS Admin,ou=System Accounts,@SUFFIX@
-member: uid=DNS Reader,ou=System Accounts,@SUFFIX@
-
-dn: cn=DHCP Admins,ou=System Groups,@SUFFIX@
-cn: DHCP Admins
-objectClass: groupOfMembers
-description: Members can administer ou=DHCP entries and attributes
-owner: uid=DHCP Admin,ou=System Accounts,@SUFFIX@
-member: uid=DHCP Admin,ou=System Accounts,@SUFFIX@
-
-dn: cn=DHCP Readers,ou=System Groups,@SUFFIX@
-cn: DHCP Readers
-objectClass: groupOfMembers
-description: Members can read entries and attributes under ou=dhcp
-owner: uid=DHCP Admin,ou=System Accounts,@SUFFIX@
-member: uid=DHCP Reader,ou=System Accounts,@SUFFIX@
-
-dn: cn=Address Book Admins,ou=System Groups,@SUFFIX@
-cn: Address Book Admins
-objectClass: groupOfMembers
-description: Members can administer ou=Address Book entries and attributes
-owner: uid=Address Book Admin,ou=System Accounts,@SUFFIX@
-member: uid=Address Book Admin,ou=System Accounts,@SUFFIX@
-
-dn: cn=LDAP Replicators,ou=System Groups,@SUFFIX@
-cn: LDAP Replicators
-objectClass: groupOfMembers
-description: Members can be used for syncrepl replication
-owner: uid=LDAP Replicator,ou=System Accounts,@SUFFIX@
-member: uid=LDAP Replicator,ou=System Accounts,@SUFFIX@
-
-dn: cn=MTA Admins,ou=System Groups,@SUFFIX@
-cn: MTA Admins
-objectClass: groupOfMembers
-description: Members can administer email related attributes
-owner: uid=MTA Admin,ou=System Accounts,@SUFFIX@
-member: uid=MTA Admin,ou=System Accounts,@SUFFIX@
-
-dn: cn=LDAP Monitors,ou=System Groups,@SUFFIX@
-cn: LDAP Monitors
-objectClass: groupOfMembers
-description: Members can read the cn=monitor backend
-owner: uid=LDAP Monitor,ou=System Accounts,@SUFFIX@
-member: uid=LDAP Monitor,ou=System Accounts,@SUFFIX@
-
-dn: cn=Idmap Admins,ou=System Groups,@SUFFIX@
-cn: Idmap Admins
-objectClass: groupOfMembers
-description: Members can administer ou=Idmap entries and attributes
-owner: uid=Idmap Admin,ou=System Accounts,@SUFFIX@
-member: uid=Idmap Admin,ou=System Accounts,@SUFFIX@
-

=== added directory 'core'
=== added file 'core/README'
--- core/README	1970-01-01 00:00:00 +0000
+++ core/README	2010-07-19 21:25:56 +0000
@@ -0,0 +1,321 @@
+Introduction
+============
+
+This document aims to explain the Directory Information Tree (DIT) used in the
+openldap-dit-core package.
+
+The motivation for this new layout is the need for a better separation of
+privileges regarding access to the information stored in the directory. The
+super user account of the directory should be used rarely and delegation of
+privileges should be easier.
+
+We think this proposed layout accomplishes that by providing several groups
+which have distinctive access rules, providing a clear separation of
+privileges. In order to give an user a new privilege, all is needed is to add
+him/her to one of these specific groups.
+
+These are the characteristics of the proposed DIT:
+- several groups for common services
+- most access control rules based on group membership
+- several system accounts ready to use (just add a password) by many services
+  such as:
+  - sudo
+  - dns
+  - samba
+  - etc
+- simple installation script which prepares the tree asking very few questions
+  (just two, and one of them is just a password)
+- easy support for OpenLDAP's password policy overlay
+
+These accounts get their privileges by being associated to specific group(s).
+
+Administrators should note that we will probably find out that there are too
+few groups, or too many. Or that some ACLs are too restrictive, or too broad.
+It is difficult to come up with a one-size-fits-all DIT, but we can start here.
+
+By the way, there is no password set for the "rootdn" account as it (the
+account) is not used.
+
+If you just want to know how to use this DIT, skip to the end of the document
+to the section called "Enough with the theory: how to use this?".
+
+
+The Tree
+========
+
+                             dc=example,dc=com
+
+  ou=Hosts                        ou=System Groups            ou=System Accounts
+  ou=Idmap                          cn=LDAP Admins              uid=Ldap Admin
+  ou=Address Book                   cn=Sudo Admins              uid=Sudo Admin
+  ou=dhcp                           cn=DNS Admins               uid=DNS Admin
+  ou=dns                            cn=DNS Readers              uid=DNS Reader
+  ou=People                         cn=DHCP Admins              uid=DHCP Admin
+  ou=Group                          cn=Address Book Admins      uid=Address Book Admin
+  ou=Password Policies              cn=LDAP Replicators         uid=LDAP Replicator
+  ou=Sudoers                        cn=Account Admins           uid=Account Admin
+                                    cn=MTA Admins               uid=MTA Admin
+                                    cn=LDAP Monitors            uid=LDAP Monitor
+                                    cn=Idmap Admins             uid=Idmap Admin
+                                                                uid=smbldap-tools
+                                                                uid=nssldap
+
+The services
+============
+
+We created some entries for a few services that can use LDAP to store their
+information. More will probably be added in the future. For now, we have
+branches for:
+- dns (ou=dns)
+- sudo (ou=sudoers)
+- dhcp (ou=dhcp)
+
+The respective administrative groups have read/write access to these branches
+for specific entries.
+
+
+The groups
+==========
+
+Groups are the core of this proposed DIT layout, because most ACLs are
+constructed via group membership to allow for greater flexibility and
+delegation.
+
+The current default groups that are born with the new DIT layout are as
+follows:
+- LDAP Admins
+- Sudo Admins
+- DNS Admins
+- DNS Readers
+- DHCP Admins
+- Address Book Admins
+- LDAP Replicators
+- Account Admins
+- MTA Admins
+- LDAP Monitors
+- Idmap Admins
+
+Each entry has a description attribute filled in with a brief text describing
+the purpose of the members of each group. For example:
+
+dn: cn=Sudo Admins,ou=System Groups,dc=example,dc=com
+description: Members can administer ou=sudoers entries and attributes
+
+In order to use groups in ACLs, the objectClass used for these entries has to
+use attributes where membership is indicated distinguished names and not just
+names. In other words, the membership attribute has to use a full DN to
+indicate its member. The standard object class used for this by OpenLDAP is
+groupOfNames, and this is what we used. For example:
+
+dn: cn=Sudo Admins,ou=System Groups,dc=example,dc=com
+member: uid=Sudo Admin,ou=System Accounts,dc=example,dc=com
+
+A side effect of using groupOfNames is that we *have* to have at least one
+member in each group. So we needed to create standard accounts, which proved to
+be usefull anyway. The previous example showed the standard account for
+adminstering sudo entries and attributes.
+
+
+The accounts
+============
+
+As was the case with the groups, many standard system accounts were created.
+Each group has at least a corresponding system account as its membership. The
+current list is as follows:
+
+- Account Admin
+- smbldap-tools
+- nssldap
+- MTA Admin
+- DHCP Admin
+- DNS Admin
+- DNS Reader
+- Sudo Admin
+- Address Book Admin
+- LDAP Admin
+- LDAP Replicator
+- LDAP Monitor
+- Idmap Admin
+
+
+The privileges
+==============
+
+The idea is to give each group the needed privileges to complete its
+administration tasks. This usually means having access to the respective ou=foo
+branch of the directory. For example, the Sudo Admins group has rights over the
+ou=sudoers branch of the directory. 
+
+Whenever possible, however, these rights are limited to that specific service,
+i.e., it's not any kind of entry that can be created but just those relevant to
+the service. For example, the Sudo Admins members can only create entries one
+level below ou=sudoers, and only with the attributes allowed by the sudoRole
+object class.
+
+Other cases, however, are more complicated. We will list them here and the
+reasoning behind the chosen ACLs.
+
+
+Monitoring access
+-----------------
+The "LDAP Monitors" group is the only grop besides "LDAP Admins" which can read
+entries under cn=monitor. This base dn contains statistics about the server,
+such as operations performed, backends and overlays being used, etc. So, if you
+need an user to have read access to this kind of information, just put him/her
+in this group.
+
+
+Samba, Unix and Kerberos admins
+-------------------------------
+Samba needs to have corresponding unix accounts for its users and machine
+accounts. It will not by itself create those, however. For example, when
+running "smbpasswd -a foo", the "foo" user account will only be created if
+samba can find the corresponding unix attributes.  The same for group mappings
+and machine accounts.
+
+Earlier versions of openldap-dit had two separate privilege groups:
+one for Unix accounts and another for Samba accounts. This complicated ACLs,
+and it was worse when we later added Kerberos Admins to the mix because they
+also had to touch some of the account-related attributes.
+
+So, since version 0.11, we merged these groups into one called Account Admins
+(and the respective Account Admin account). This made the ACLs simplier and
+faster, at the expense of some granularity in privileges.
+
+The smbldap-tools account, uid=smbldap-tools,ou=System Accounts, still exists
+but is now a member of the Account Admins group.
+
+
+MTA
+---
+As of this moment, there is no clear scenario for usage of this account. For
+now, it can administer just a few attributes: all the ones from the
+inetLocalMailRecipient object class plus the single mail attribute.
+
+As more usage scenarios appear, these ACLs should be incremented.
+
+
+DNS Readers
+-----------
+Members of this group are allowed read access to all attributes of the dNSZone
+object class under ou=dns. Besides them and the members of the DNS Admins
+group, no other entity can read these entries. This was done so to avoid the
+"zone transfer" vulnerability scenario, where anonymous users could gather the
+whole DNS database.
+
+
+LDAP Admins
+-----------
+Members of this group can write to and read from all entries and attributes of
+the directory and have no size or time limits.
+
+
+LDAP Replicators
+----------------
+The members of the LDAP Replicators group have read access to all attributes
+and entries of the directory so that they can be used in a syncrepl replication
+setup. The bind dn used for the replication should be a member of this group.
+For example:
+
+syncrepl    rid=100
+            provider=ldap://dirserv.example.com
+            type=refreshAndPersist
+            retry="60 +"
+            searchbase="dc=example,dc=com"
+            starttls=critical
+            bindmethod=simple
+            binddn="uid=LDAP Replicator,ou=System Accounts,dc=example,dc=com"
+            credentials="secret"
+		
+Here, "uid=LDAP Replicator,ou=System Accounts,dc=example,dc=com" is a member of
+the "LDAP Replicators" group and is automatically granted read rights to all
+entries of the directory (assuming the provider was also installed with this
+base DIT and ACLs).
+
+
+Generic directory read accounts
+-------------------------------
+A few accounts were created for specific read access. Some administrators
+prefer to block anonymous read access to the directory, in which case these
+accounts would then be used. For the moment we have:
+- nssldap: nss_ldap can bind to the directory either anonymously or with a
+  specific account. The "uid=nssldap,ou=System Accounts" was created for this
+  purpose.  Currently no ACLs make use of this account. Were the administrator to
+  use it, he/she would also have to block anonymous read access to many
+  attributes.
+
+Currently anonymous read access is granted to many attributes. As of this
+moment, if the administrator wants to restrict anonymous access and use these
+accounts, the ACLs would have to be changed manually.
+
+
+The installation script
+=======================
+
+The openldap-dit package contains a shell script which can be used to
+install the accounts and ACLs described in this document. The script is
+installed at /usr/share/openldap/scripts/openldap-dit-setup.sh and performs the
+following:
+- asks the DNS domain (suggesting whatever was auto-detected)
+- constructs the top-level directory entry from this domain using dc style
+  attributes
+- creates and imports an ldif file with the accounts and groups described here
+- installs new slapd.conf and openldap-dit-access.conf files (making backups of
+  the previous ones) with the default ACLs and other useful configurations
+  (like cache)
+- loads the ldif file, backing up the previous database directory
+
+Even though the script performs many tests and backups many files before
+overwriting them, administrators are advised to backup all data before running
+this script.
+
+
+Enough with the theory: how to use this?
+========================================
+
+The installation script will overwrite some OpenLDAP files and directories.
+Specifically, it will backup and overwrite the following:
+- /etc/ldap/slapd.conf
+- /etc/ldap/ldap.conf
+- /etc/ldap/openldap-dit-access.conf (THIS ONE HAS NO BACKUP CURRENTLY)
+- /var/lib/ldap contents
+
+So, after you are satisfied that nothing important will be lost, run the
+script. Below is a sample run using the example.com domain:
+
+root@nsn2:~# /usr/share/slapd/openldap-dit-setup.sh 
+Please enter your DNS domain name [example.com]:
+
+
+Administrator account
+
+The administrator account for this directory is
+uid=LDAP Admin,ou=System Accounts,dc=example,dc=com
+
+Please choose a password for this account:
+New password: 
+Re-enter new password: 
+
+
+Summary
+=======
+
+Domain:        example.com
+LDAP suffix:   dc=example,dc=com
+Administrator: uid=LDAP Admin,ou=System Accounts,dc=example,dc=com
+
+Confirm? (Y/n)
+
+config file testing succeeded
+Stopping ldap service
+Finished, starting ldap service
+Starting OpenLDAP: slapd.
+
+Your previous database directory has been backed up as /var/lib/ldap.1228858266
+All files that were backed up got the suffix "1228858266".
+
+
+Now, fire up an LDAP browser and use the LDAP Admin account shown above to set
+up some passwords for the other less privileged accounts that you are going to
+use. Note that the "rootdn" account is not used.
+

=== added file 'core/acl.ldif'
--- core/acl.ldif	1970-01-01 00:00:00 +0000
+++ core/acl.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,16 @@
+dn: olcDatabase=@DATABASE@,cn=config
+changetype: modify
+add: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@" 
+  by dn.exact="uid=LDAP Admin,ou=System Accounts,@SUFFIX@" manage
+  by * break
+-
+add: olcAccess
+olcAccess: {1}to dn.subtree="@SUFFIX@"
+  by * read
+-
+add: olcAddContentAcl
+olcAddContentAcl: TRUE
+-
+add: olcLastMod
+olcLastMod: TRUE

=== added file 'core/cosine.schema.ldif'
--- core/cosine.schema.ldif	1970-01-01 00:00:00 +0000
+++ core/cosine.schema.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,200 @@
+# RFC1274: Cosine and Internet X.500 schema
+# $OpenLDAP: pkg/ldap/servers/slapd/schema/cosine.ldif,v 1.1.2.4 2009/01/22 00:01:14 kurt Exp $
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
+##
+## Copyright 1998-2009 The OpenLDAP Foundation.
+## All rights reserved.
+##
+## Redistribution and use in source and binary forms, with or without
+## modification, are permitted only as authorized by the OpenLDAP
+## Public License.
+##
+## A copy of this license is available in the file LICENSE in the
+## top-level directory of the distribution or, alternatively, at
+## <http://www.OpenLDAP.org/license.html>.
+#
+# RFC1274: Cosine and Internet X.500 schema
+#
+# This file contains LDAPv3 schema derived from X.500 COSINE "pilot"
+# schema.  As this schema was defined for X.500(89), some
+# oddities were introduced in the mapping to LDAPv3.  The
+# mappings were based upon: draft-ietf-asid-ldapv3-attributes-03.txt
+# (a work in progress)
+#
+# Note: It seems that the pilot schema evolved beyond what was
+# described in RFC1274.  However, this document attempts to describes
+# RFC1274 as published.
+#
+# Depends on core.ldif
+#
+# This file was automatically generated from cosine.schema; see that
+# file for complete background.
+#
+dn: cn=cosine,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: cosine
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress' 
+ EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: g
+ eneral information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteDri
+ nk' ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR caseIgno
+ reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RFC1
+ 274: room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274: 
+ photo (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC12
+ 74: category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: h
+ ost computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC127
+ 4: DN of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.12 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' D
+ ESC 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUBSTR 
+ caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC '
+ RFC1274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstri
+ ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' DES
+ C 'RFC1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu
+ bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DESC
+  'RFC1274: DN of author of document' EQUALITY distinguishedNameMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DE
+ SC 'RFC1274: location of document original' EQUALITY caseIgnoreMatch SUBSTR c
+ aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'homeTe
+ lephoneNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephoneNumb
+ erMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.50 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'RFC
+ 1274: DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.12 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.39 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY ca
+ seIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY c
+ aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY c
+ aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY c
+ aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALITY 
+ caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALIT
+ Y caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC
+  'RFC1274: DN of entry associated with domain' EQUALITY distinguishedNameMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress' D
+ ESC 'RFC1274: home postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIg
+ noreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.40 NAME 'personalTitle' DESC 
+ 'RFC1274: personal title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.41 NAME ( 'mobile' 'mobileTel
+ ephoneNumber' ) DESC 'RFC1274: mobile telephone number' EQUALITY telephoneNum
+ berMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.50 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.42 NAME ( 'pager' 'pagerTelep
+ honeNumber' ) DESC 'RFC1274: pager telephone number' EQUALITY telephoneNumber
+ Match SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .50 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.43 NAME ( 'co' 'friendlyCount
+ ryName' ) DESC 'RFC1274: friendly country name' EQUALITY caseIgnoreMatch SUBS
+ TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier' DE
+ SC 'RFC1274: unique identifer' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus
+ ' DESC 'RFC1274: organizational status' EQUALITY caseIgnoreMatch SUBSTR caseI
+ gnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox' DESC '
+ RFC1274: Janet mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOption
+ ' DESC 'RFC1274: mail preference option' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.48 NAME 'buildingName' DESC '
+ RFC1274: name of building' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality' DESC 'RF
+ C1274: DSA Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.19 SINGLE-VALUE )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality' 
+ DESC 'RFC1274: Single Level Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SIN
+ GLE-VALUE )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQualit
+ y' DESC 'RFC1274: Subtree Mininum Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 13 SINGLE-VALUE )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQualit
+ y' DESC 'RFC1274: Subtree Maximun Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 13 SINGLE-VALUE )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.53 NAME 'personalSignature' D
+ ESC 'RFC1274: Personal Signature (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 23 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect' DESC 'R
+ FC1274: DIT Redirect' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.12 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.55 NAME 'audio' DESC 'RFC1274
+ : audio (u-law)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.4{25000} )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher' D
+ ESC 'RFC1274: publisher of document' EQUALITY caseIgnoreMatch SUBSTR caseIgno
+ reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.4 NAME ( 'pilotPerson' 'newPilo
+ tPerson' ) SUP person STRUCTURAL MAY ( userid $ textEncodedORAddress $ rfc822
+ Mailbox $ favouriteDrink $ roomNumber $ userClass $ homeTelephoneNumber $ hom
+ ePostalAddress $ secretary $ personalTitle $ preferredDeliveryMethod $ busine
+ ssCategory $ janetMailbox $ otherMailbox $ mobileTelephoneNumber $ pagerTelep
+ honeNumber $ organizationalStatus $ mailPreferenceOption $ personalSignature 
+ ) )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCT
+ URAL MUST userid MAY ( description $ seeAlso $ localityName $ organizationNam
+ e $ organizationalUnitName $ host ) )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.6 NAME 'document' SUP top STRUC
+ TURAL MUST documentIdentifier MAY ( commonName $ description $ seeAlso $ loca
+ lityName $ organizationName $ organizationalUnitName $ documentTitle $ docume
+ ntVersion $ documentAuthor $ documentLocation $ documentPublisher ) )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.7 NAME 'room' SUP top STRUCTURA
+ L MUST commonName MAY ( roomNumber $ description $ seeAlso $ telephoneNumber 
+ ) )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.9 NAME 'documentSeries' SUP top
+  STRUCTURAL MUST commonName MAY ( description $ seeAlso $ telephonenumber $ l
+ ocalityName $ organizationName $ organizationalUnitName ) )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.13 NAME 'domain' SUP top STRUCT
+ URAL MUST domainComponent MAY ( associatedName $ organizationName $ descripti
+ on $ businessCategory $ seeAlso $ searchGuide $ userPassword $ localityName $
+  stateOrProvinceName $ streetAddress $ physicalDeliveryOfficeName $ postalAdd
+ ress $ postalCode $ postOfficeBox $ streetAddress $ facsimileTelephoneNumber 
+ $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIdentifier $ tel
+ exNumber $ preferredDeliveryMethod $ destinationIndicator $ registeredAddress
+  $ x121Address ) )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' SUP d
+ omain STRUCTURAL MAY ( commonName $ surname $ description $ seeAlso $ telepho
+ neNumber $ physicalDeliveryOfficeName $ postalAddress $ postalCode $ postOffi
+ ceBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNNumber $ 
+ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ preferredDelivery
+ Method $ destinationIndicator $ registeredAddress $ x121Address ) )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.15 NAME 'dNSDomain' SUP domain 
+ STRUCTURAL MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAME
+ Record ) )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.17 NAME 'domainRelatedObject' D
+ ESC 'RFC1274: an object related to an domain' SUP top AUXILIARY MUST associat
+ edDomain )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.18 NAME 'friendlyCountry' SUP c
+ ountry STRUCTURAL MUST friendlyCountryName )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.20 NAME 'pilotOrganization' SU
+ P ( organization $ organizationalUnit ) STRUCTURAL MAY buildingName )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.21 NAME 'pilotDSA' SUP dsa STR
+ UCTURAL MAY dSAQuality )
+olcObjectClasses: ( 0.9.2342.19200300.100.4.22 NAME 'qualityLabelledData' 
+ SUP top AUXILIARY MUST dsaQuality MAY ( subtreeMinimumQuality $ subtreeMaximu
+ mQuality ) )

=== added file 'core/database.ldif'
--- core/database.ldif	1970-01-01 00:00:00 +0000
+++ core/database.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,13 @@
+dn: olcDatabase=hdb,cn=config
+olcDatabase: hdb
+objectClass: olcDatabaseConfig
+objectClass: olcHdbConfig
+olcSuffix: @SUFFIX@
+olcDbDirectory: /var/lib/ldap
+olcDbCacheSize: 1000
+olcDbCheckpoint: 1024 10
+olcDbConfig: set_cachesize 0 10485760 0
+olcDbConfig: set_lg_bsize 2097152
+olcDbConfig: set_flags DB_LOG_AUTOREMOVE
+olcDbIDLcacheSize: 3000
+olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

=== added file 'core/dit.ldif'
--- core/dit.ldif	1970-01-01 00:00:00 +0000
+++ core/dit.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,19 @@
+# base tree
+dn: @SUFFIX@
+dc: @DC@
+objectClass: domain
+objectClass: domainRelatedObject
+associatedDomain: @DOMAIN@
+
+dn: ou=System Accounts,@SUFFIX@
+ou: System Accounts
+objectClass: organizationalUnit
+description: Container for System and Services privileged accounts
+
+dn: uid=LDAP Admin,ou=System Accounts,@SUFFIX@
+uid: LDAP Admin
+objectClass: account
+objectClass: simpleSecurityObject
+userPassword: @ADMINPASS@
+description: Account used to administer all parts of the Directory
+

=== added file 'core/inetorgperson.schema.ldif'
--- core/inetorgperson.schema.ldif	1970-01-01 00:00:00 +0000
+++ core/inetorgperson.schema.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,69 @@
+# InetOrgPerson (RFC2798)
+# $OpenLDAP: pkg/ldap/servers/slapd/schema/inetorgperson.ldif,v 1.1.2.4 2009/01/22 00:01:14 kurt Exp $
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
+##
+## Copyright 1998-2009 The OpenLDAP Foundation.
+## All rights reserved.
+##
+## Redistribution and use in source and binary forms, with or without
+## modification, are permitted only as authorized by the OpenLDAP
+## Public License.
+##
+## A copy of this license is available in the file LICENSE in the
+## top-level directory of the distribution or, alternatively, at
+## <http://www.OpenLDAP.org/license.html>.
+#
+# InetOrgPerson (RFC2798)
+#
+# Depends upon
+#   Definition of an X.500 Attribute Type and an Object Class to Hold
+#   Uniform Resource Identifiers (URIs) [RFC2079]
+#	(core.ldif)
+#
+#   A Summary of the X.500(96) User Schema for use with LDAPv3 [RFC2256]
+#	(core.ldif)
+#
+#   The COSINE and Internet X.500 Schema [RFC1274] (cosine.ldif)
+#
+# This file was automatically generated from inetorgperson.schema; see
+# that file for complete references.
+#
+dn: cn=inetorgperson,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: inetorgperson
+olcAttributeTypes: ( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC279
+ 8: vehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR cas
+ eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: ( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC '
+ RFC2798: identifies a department within an organization' EQUALITY caseIgnoreM
+ atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: ( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'RFC
+ 2798: preferred name to be used when displaying entries' EQUALITY caseIgnoreM
+ atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC 'RF
+ C2798: numerically identifies an employee within an organization' EQUALITY ca
+ seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RFC2
+ 798: type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgn
+ oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: ( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RFC2
+ 798: a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 )
+olcAttributeTypes: ( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DESC
+  'RFC2798: preferred written or spoken language for a person' EQUALITY caseIg
+ noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' D
+ ESC 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.5 )
+olcAttributeTypes: ( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RFC2
+ 798: personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.5 )
+olcObjectClasses: ( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2
+ 798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY 
+ ( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ em
+ ployeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ ini
+ tials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo 
+ $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ pre
+ ferredLanguage $ userSMIMECertificate $ userPKCS12 ) )

=== added file 'core/misc.schema.ldif'
--- core/misc.schema.ldif	1970-01-01 00:00:00 +0000
+++ core/misc.schema.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,25 @@
+# misc.ldif
+#
+# This is the ldif version of misc.schema to be used with cn=config.
+# The nss overlay requires rfc822MailMember which is defined here.
+#
+dn: cn=misc,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: misc
+olcAttributeTypes: ( 2.16.840.1.113730.3.1.13 NAME 'mailLocalAddress' DESC 
+ 'RFC822 email address of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.26{256} )
+olcAttributeTypes: ( 2.16.840.1.113730.3.1.18 NAME 'mailHost' DESC 'FQDN of
+  the SMTP/MTA of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.26{256} SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113730.3.1.47 NAME 'mailRoutingAddress' DES
+ C 'RFC822 routing address of this recipient' EQUALITY caseIgnoreIA5Match SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
+olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.2.1.15 NAME 'rfc822MailMember' DES
+ C 'rfc822 mail address of group member(s)' EQUALITY caseIgnoreIA5Match SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.26 )
+olcObjectClasses: ( 2.16.840.1.113730.3.2.147 NAME 'inetLocalMailRecipient'
+  DESC 'Internet local mail recipient' SUP top AUXILIARY MAY ( mailLocalAddres
+ s $ mailHost $ mailRoutingAddress ) )
+olcObjectClasses: ( 1.3.6.1.4.1.42.2.27.1.2.5 NAME 'nisMailAlias' DESC 'NIS
+  mail alias' SUP top STRUCTURAL MUST cn MAY rfc822MailMember )

=== added file 'core/modules.ldif'
--- core/modules.ldif	1970-01-01 00:00:00 +0000
+++ core/modules.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,4 @@
+dn: cn=module,cn=config
+cn: module
+objectClass: olcModuleList
+olcModuleLoad: back_hdb.la

=== added file 'core/namedObject.schema.ldif'
--- core/namedObject.schema.ldif	1970-01-01 00:00:00 +0000
+++ core/namedObject.schema.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,5 @@
+dn: cn=namedObject,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: namedObject
+olcObjectClasses: {0}( 1.3.6.1.4.1.5322.13.1.1 NAME 'namedObject' SUP top STRU
+ CTURAL MAY cn )

=== removed directory 'databases'
=== removed file 'databases/add-hdb.ldif'
--- databases/add-hdb.ldif	2009-10-06 23:18:47 +0000
+++ databases/add-hdb.ldif	1970-01-01 00:00:00 +0000
@@ -1,152 +0,0 @@
-dn: olcDatabase=hdb,cn=config
-olcDatabase: hdb
-objectClass: olcDatabaseConfig
-objectClass: olcHdbConfig
-olcSuffix: @SUFFIX@
-olcDbDirectory: /var/lib/ldap
-olcDbCacheSize: 1000
-olcDbCheckpoint: 1024 10
-olcDbConfig: set_cachesize 0 10485760 0
-olcDbConfig: set_lg_bsize 2097152
-olcDbConfig: set_flags DB_LOG_AUTOREMOVE
-olcDbIDLcacheSize: 3000
-olcRootDN: cn=localroot,cn=config
-olcDbIndex: objectClass eq
-olcDbIndex: entryUUID eq
-olcDbIndex: entryCSN eq
-olcDbIndex: cn eq,subinitial
-olcDbIndex: uid eq,subinitial
-olcDbIndex: uidNumber eq
-olcDbIndex: gidNumber eq
-olcDbIndex: sn eq,subinitial
-olcDbIndex: member eq
-olcDbIndex: memberUid eq
-olcDbIndex: mail eq,subinitial
-olcDbIndex: givenName eq,subinitial
-olcDbIndex: sambaDomainName eq
-olcDbIndex: sambaSID eq,sub
-olcDbIndex: displayName eq
-olcDbIndex: sambaGroupType eq
-olcDbIndex: krbPrincipalName eq
-olcDbIndex: krbPwdPolicyReference eq
-olcDbIndex: sambaSIDList eq
-olcDbIndex: uniqueMember pres,eq
-olcDbIndex: zoneName eq
-olcDbIndex: dhcpClassData eq
-olcDbIndex: relativeDomainName eq
-olcDbIndex: dhcpHWAddress eq
-olcDbIndex: sudoUser eq,sub
-olcAccess: {0}to dn.subtree="@SUFFIX@" 
-  by group/groupOfMembers/member.exact="cn=ldap admins,ou=system groups,@SUFFIX@" manage
-  by group/groupOfMembers/member.exact="cn=ldap replicators,ou=system groups,@SUFFIX@" read
-  by * break
-olcAccess: {1}to dn.subtree="ou=people,@SUFFIX@"
-  attrs=shadowLastChange
-  by self write
-  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
-  by * read
-olcAccess: {2}to dn.subtree="ou=people,@SUFFIX@"
-  attrs=userPassword
-  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
-  by self write
-  by anonymous auth
-  by * none
-olcAccess: {3}to dn.subtree="@SUFFIX@"
-  attrs=userPassword
-  by self write
-  by anonymous auth
-  by * none
-olcAccess: {4}to dn.subtree="@SUFFIX@"
-  attrs=krbPrincipalKey
-  by self write
-  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
-  by dn.exact="uid=kdc-service,ou=System Accounts,@SUFFIX@" read
-  by dn.exact="uid=kadmin-service,ou=System Accounts,@SUFFIX@" write
-  by anonymous auth
-  by * none
-olcAccess: {5}to dn.subtree="ou=password policies,@SUFFIX@"
-  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
-  by * read
-olcAccess: {6}to dn.subtree="@SUFFIX@"
-  attrs=sambaLMPassword,sambaNTPassword
-  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
-  by anonymous auth
-  by self write
-  by * none
-olcAccess: {7}to dn.subtree="@SUFFIX@"
-  attrs=sambaPasswordHistory,pwdHistory
-  by self read
-  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
-  by * none
-olcAccess: {8}to dn.subtree="@SUFFIX@"
-  attrs=pwdReset
-  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
-  by * read
-olcAccess: {9}to dn.regex="^cn=[^,]+,ou=(System Groups|Group),@SUFFIX@$"
-  attrs=member
-  by dnattr=owner write
-  by * break
-olcAccess: {10}to dn.subtree="ou=people,@SUFFIX@"
-  attrs=carLicense,homePhone,homePostalAddress,mobile,pager,telephoneNumber
-  by self write
-  by * break
-olcAccess: {11}to dn.regex="^([^,]+,)?ou=(People|Group|Hosts),@SUFFIX@$"
-  attrs=children,entry
-  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
-  by * break
-olcAccess: {12}to dn.regex="^[^,]+,ou=(People|Hosts|Group),@SUFFIX@$"
-  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
-  by * break
-olcAccess: {13}to dn.regex="^(sambaDomainName=[^,]+,)?@SUFFIX@$"
-  attrs=children,entry,@sambaDomain,@sambaUnixIdPool
-  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
-  by * read
-olcAccess: {14}to dn.regex="^(sambaSID=[^,]+,)?ou=Idmap,@SUFFIX@$"
-  attrs=children,entry,@sambaIdmapEntry
-  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
-  by group/groupOfMembers/member.exact="cn=idmap admins,ou=system groups,@SUFFIX@" write
-  by * read
-olcAccess: {15}to dn.regex="^(.*,)?ou=Address Book,@SUFFIX@"
-  attrs=children,entry,@inetOrgPerson
-  by group/groupOfMembers/member.exact="cn=address book admins,ou=system groups,@SUFFIX@" write
-  by * read
-olcAccess: {16}to dn.subtree="ou=dhcp,@SUFFIX@"
-  attrs=children,entry,@dhcpService,@dhcpServer,@dhcpSharedNetwork,@dhcpSubnet,@dhcpPool,
- @dhcpGroup,@dhcpHost,@dhcpClass,@dhcpSubClass,@dhcpOptions,@dhcpLeases,@dhcpLog
-  by group/groupOfMembers/member.exact="cn=dhcp admins,ou=system groups,@SUFFIX@" write
-  by group/groupOfMembers/member.exact="cn=dhcp readers,ou=system groups,@SUFFIX@" read
-  by * read
-olcAccess: {17}to dn.regex="^([^,]+,)?ou=sudoers,@SUFFIX@$"
-  attrs=children,entry,@sudoRole
-  by group/groupOfMembers/member.exact="cn=sudo admins,ou=system groups,@SUFFIX@" write
-  by * read
-olcAccess: {18}to dn.base="ou=dns,@SUFFIX@"
-  attrs=entry,@extensibleObject
-  by group/groupOfMembers/member.exact="cn=dns admins,ou=system groups,@SUFFIX@" write
-  by * read
-olcAccess: {19}to dn.subtree="ou=dns,@SUFFIX@"
-  attrs=children,entry,@dNSZone
-  by group/groupOfMembers/member.exact="cn=dns admins,ou=system groups,@SUFFIX@" write
-  by group/groupOfMembers/member.exact="cn=dns readers,ou=system groups,@SUFFIX@" read
-  by * none
-olcAccess: {20}to dn.subtree="ou=Kerberos Realms,@SUFFIX@"
-  by dn.exact="uid=kdc-service,ou=System Accounts,@SUFFIX@" read
-  by dn.exact="uid=kadmin-service,ou=System Accounts,@SUFFIX@" write
-  by * none
-olcAccess: {21}to dn.one="ou=people,@SUFFIX@"
-  attrs=@inetLocalMailRecipient,mail
-  by group/groupOfMembers/member.exact="cn=mta admins,ou=system groups,@SUFFIX@" write
-  by * read
-olcAccess: {22}to dn.subtree="@SUFFIX@"
-  by * read
-olcAddContentAcl: TRUE
-olcLastMod: TRUE
-olcLimits: {0}group/groupOfMembers/member="cn=ldap replicators,ou=system groups,@SUFFIX@"
-  size=unlimited
-  time=unlimited
-olcLimits: {1}group/groupOfMembers/member="cn=ldap admins,ou=system groups,@SUFFIX@"
-  size=unlimited
-  time=unlimited
-olcLimits: {2}group/groupOfMembers/member="cn=account admins,ou=system groups,@SUFFIX@"
-  size=unlimited
-  time=unlimited

=== removed file 'databases/add-monitor.ldif'
--- databases/add-monitor.ldif	2009-09-17 14:09:01 +0000
+++ databases/add-monitor.ldif	1970-01-01 00:00:00 +0000
@@ -1,10 +0,0 @@
-dn: olcDatabase=monitor,cn=config
-objectClass: olcMonitorConfig
-objectClass: olcDatabaseConfig
-objectClass: olcConfig
-olcDatabase: monitor
-olcRootDN: cn=localroot,cn=config
-olcAccess: {0}to dn.subtree="" 
-  by group/groupOfMembers/member.exact="cn=LDAP Admins,ou=System Groups,@SUFFIX@" read 
-  by group/groupOfMembers/member.exact="cn=LDAP Monitors,ou=System Groups,@SUFFIX@" read
-  by * none

=== modified file 'debian/changelog'
--- debian/changelog	2008-06-04 20:17:58 +0000
+++ debian/changelog	2010-07-19 21:25:56 +0000
@@ -1,4 +1,47 @@
-openldap-dit (0.19-1) unstable; urgency=low
+openldap-dit (0.20-1) lucid; urgency=low
+
+  * Using debconf to ask for domain and admin password.
+  * Will create openldap-dit-$service.postinst during build time 
+    from openldap-dit.scripts-common.
+  * Remove last olcAccess and re-add at the end of ACL.
+  * Switch to dpkg-source 3.0 (quilt) format
+  * Updated standards-version.
+  * Changed version number, removed debian versions.
+  * Removed LICENSE from openldap-dit-core.docs because information
+    is covered in debian/copyright.
+  * Now using "invoke-rc.d slapd restart" to restart slapd.
+  * Removed path to slappasswd utility in debian/openldap-dit.scripts-common.
+  * Find index for main database, and index of module suffix.
+
+ -- Adam Sommer <[e-mail]>  Tue, 01 Jun 2010 13:41:30 -0400
+
+openldap-dit (0.19) unstable; urgency=low
+
+  * Another directory reorganization.
+  * Created openldap-dit-usersandgroups package.
+  * Updated Makefile and debian/rules for new package.
+
+ -- Adam Sommer <[e-mail]>  Mon, 24 May 2010 16:09:10 -0400
+
+openldap-dit (0.19) unstable; urgency=low
+
+  * Created openldap-dit-core package.
+  * Reorganized file structure to reflect core DIT.
+  * Changed openldap-dit-setup.sh to postinst scripts. 
+  * Updated Makefile for subdirectory layout.
+
+ -- Adam Sommer <[e-mail]>  Tue, 18 May 2010 11:29:38 -0400
+
+openldap-dit (0.19) unstable; urgency=low
+
+  * Adjusted README paths in debian/docs.
+  * Created empty doc/README.kde
+  * Changed "install-ubuntu" command in debian/rules to "install" 
+    which allows package to build.
+
+ -- Adam Sommer <[e-mail]>  Mon, 26 Apr 2010 15:35:42 -0400
+
+openldap-dit (0.19) unstable; urgency=low
 
   * Initial release 
 

=== modified file 'debian/control'
--- debian/control	2008-06-04 20:30:39 +0000
+++ debian/control	2010-07-19 21:25:56 +0000
@@ -1,14 +1,25 @@
 Source: openldap-dit
 Section: net
 Priority: extra
-Maintainer: Andreas Hasenack <[e-mail]>
+Maintainer: Adam Sommer <[e-mail]>
 Build-Depends: debhelper (>= 5)
-Standards-Version: 3.7.3
+Homepage: https://launchpad.net/openldap-dit
+Standards-Version: 3.8.4
 
-Package: openldap-dit
+Package: openldap-dit-core
+Section: net
+Priority: extra
 Architecture: all
 Depends: ${shlibs:Depends}, ${misc:Depends}, slapd, ldap-utils
-Description: Sample DIT for OpenLDAP
- This package contains a sample DIT for OpenLDAP which can be
- used together with many services and has a group based access
- control.
+Description: Simple DIT for OpenLDAP
+ This package contains a very simple DIT for OpenLDAP which can 
+ be extened for many services.
+
+Package: openldap-dit-usersandgroups
+Section: net
+Priority: extra
+Architecture: all
+Depends: ${shlibs:Depends}, ${misc:Depends}, slapd, ldap-utils, openldap-dit-core
+Description: Simple DIT Users and Groups
+ This package contains a simple DIT for OpenLDAP which can be
+ used for group based access control.

=== modified file 'debian/copyright'
--- debian/copyright	2008-06-04 20:37:03 +0000
+++ debian/copyright	2010-07-19 21:25:56 +0000
@@ -4,9 +4,11 @@
 Upstream Author: 
 
     Andreas Hasenack <[e-mail]>
+    Adam Sommer <[e-mail]>
 
 Copyright: 
 
+    Copyright (C) 2010 Adam Sommer
     Copyright (C) 2008 Andreas Hasenack
     Copyright (C) 2007 and before: Mandriva
 

=== removed file 'debian/dirs'
--- debian/dirs	2008-06-04 20:30:39 +0000
+++ debian/dirs	1970-01-01 00:00:00 +0000
@@ -1,1 +0,0 @@
-usr/share/slapd/openldap-dit

=== removed file 'debian/docs'
--- debian/docs	2008-06-04 20:17:58 +0000
+++ debian/docs	1970-01-01 00:00:00 +0000
@@ -1,10 +0,0 @@
-README
-README.dhcp
-README.dns
-README.heimdal
-README.kde
-README.samba
-README.sudo
-TODO
-COPYRIGHT
-LICENSE

=== removed file 'debian/files'
--- debian/files	2008-06-04 20:30:39 +0000
+++ debian/files	1970-01-01 00:00:00 +0000
@@ -1,1 +0,0 @@
-openldap-dit_0.19-1_all.deb net extra

=== added file 'debian/openldap-dit-core.config'
--- debian/openldap-dit-core.config	1970-01-01 00:00:00 +0000
+++ debian/openldap-dit-core.config	2010-07-19 21:25:56 +0000
@@ -0,0 +1,79 @@
+#!/bin/bash
+
+set -e
+
+. /usr/share/debconf/confmodule
+
+get_domain() {
+# Ask domain question.
+# Usage: get_domain
+    local invalid
+    invalid=""
+
+    db_input high openldap-dit-core/domain || true
+    db_go || true
+
+    # Make sure the domain name is valid.
+    db_get openldap-dit-core/domain
+    if [ -z "$RET" ] || ! echo "$RET" | grep -q '^[a-zA-Z0-9.-]*$'; then
+        db_fset openldap-dit-core/domain seen false
+        invalid=true
+    fi
+
+    if [ "$invalid" ]; then 
+        return 1
+    else
+        return 0
+    fi
+}
+
+crypt_admin_pass() {
+# Store the encrypted admin password into the debconf db
+# Usage: crypt_admin_pass
+
+    db_get openldap-dit-core/password1 
+    if [ ! -z "$RET" ]; then
+        db_set openldap-dit-core/internal/adminpw $(slappasswd -n -s "$RET")
+    fi
+    db_go || true
+}
+
+get_admin_password() {
+# Ask for admin password and confirmation.
+# Usage: get_admin_password
+
+    while :; do
+        RET=""
+        db_input high openldap-dit-core/password1 || true
+        db_input high openldap-dit-core/password2 || true
+        db_go
+
+        # Make sure the passwords match
+        local pass1 pass2
+        db_get openldap-dit-core/password1
+        pass1="$RET"
+        db_get openldap-dit-core/password2
+        pass2="$RET"
+        if [ $pass1 == $pass2 ]; then
+            #ROOT_PW=''
+            break
+        fi
+        db_fset openldap-dit-core/password_mismatch seen false
+        db_input critical openldap-dit-core/password_mismatch
+        db_set openldap-dit-core/password1 ""
+        db_set openldap-dit-core/password2 ""
+        db_fset openldap-dit-core/password1 seen false
+        db_fset openldap-dit-core/password2 seen false
+        db_go
+    done
+
+}
+
+
+get_domain    
+get_admin_password
+crypt_admin_pass
+
+db_go || true
+
+exit 0

=== added file 'debian/openldap-dit-core.dirs'
--- debian/openldap-dit-core.dirs	1970-01-01 00:00:00 +0000
+++ debian/openldap-dit-core.dirs	2010-07-19 21:25:56 +0000
@@ -0,0 +1,1 @@
+usr/share/slapd/openldap-dit/core

=== added file 'debian/openldap-dit-core.docs'
--- debian/openldap-dit-core.docs	1970-01-01 00:00:00 +0000
+++ debian/openldap-dit-core.docs	2010-07-19 21:25:56 +0000
@@ -0,0 +1,3 @@
+core/README
+TODO
+COPYRIGHT

=== added file 'debian/openldap-dit-core.postinst.in'
--- debian/openldap-dit-core.postinst.in	1970-01-01 00:00:00 +0000
+++ debian/openldap-dit-core.postinst.in	2010-07-19 21:25:56 +0000
@@ -0,0 +1,59 @@
+#!/bin/bash
+
+
+myservice="core"
+
+#COMMON-FUNCTIONS#
+
+
+# steps:
+# - add modules
+# - add schema
+# - add db + its acls
+# - modify frontend acls
+# - modify config acls
+# - add overlays
+# - populate db
+# - set password for admin
+
+add_modules
+check_result $?
+
+add_database
+check_result $?
+
+add_schemas 
+check_result $?
+
+modify_acls
+check_result $?
+
+add_overlays
+check_result $?
+
+populate_dit
+check_result $?
+
+echo
+echo "Finished, doing one last restart..."
+invoke-rc.d slapd restart
+check_result $?
+
+echo
+echo "Done, enjoy!"
+echo
+echo "Remember: this is your administrator bind dn:"
+echo "uid=LDAP Admin,ou=System Accounts,$mysuffix"
+echo
+echo "You can use it in double quotes in the command line, like:"
+echo "ldapwhoami -x -D \"uid=LDAP Admin,ou=System Accounts,$mysuffix\" -W "
+echo
+
+wipe_admin_pass
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0

=== added file 'debian/openldap-dit-core.postrm'
--- debian/openldap-dit-core.postrm	1970-01-01 00:00:00 +0000
+++ debian/openldap-dit-core.postrm	2010-07-19 21:25:56 +0000
@@ -0,0 +1,15 @@
+#! /bin/sh
+
+set -e
+
+  . /usr/share/debconf/confmodule
+
+db_purge 
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+

=== added file 'debian/openldap-dit-core.templates'
--- debian/openldap-dit-core.templates	1970-01-01 00:00:00 +0000
+++ debian/openldap-dit-core.templates	2010-07-19 21:25:56 +0000
@@ -0,0 +1,28 @@
+Template: openldap-dit-core/domain
+Type: string
+Description: DNS domain name:
+ The DNS domain name is used to construct the base DN of the LDAP directory.
+ For example, 'foo.example.org' will create the directory with
+ 'dc=foo, dc=example, dc=org' as base DN.
+
+Template: openldap-dit-core/password1
+Type: password
+Description: Administrator password:
+ Please enter the password for the admin entry in your LDAP directory.
+
+Template: openldap-dit-core/password2
+Type: password
+Description: Confirm password:
+ Please enter the admin password for your LDAP directory again to verify
+ that you have typed it correctly.
+
+Template: openldap-dit-core/password_mismatch
+Type: note
+Description: Password mismatch
+ The two passwords you entered were not the same. Please try again.
+
+Template: openldap-dit-core/internal/adminpw
+Type: password
+Description: Encrypted admin password:
+ Internal template, should never be displayed to users.
+

=== added file 'debian/openldap-dit-usersandgroups.dirs'
--- debian/openldap-dit-usersandgroups.dirs	1970-01-01 00:00:00 +0000
+++ debian/openldap-dit-usersandgroups.dirs	2010-07-19 21:25:56 +0000
@@ -0,0 +1,1 @@
+usr/share/slapd/openldap-dit/usersandgroups

=== added file 'debian/openldap-dit-usersandgroups.docs'
--- debian/openldap-dit-usersandgroups.docs	1970-01-01 00:00:00 +0000
+++ debian/openldap-dit-usersandgroups.docs	2010-07-19 21:25:56 +0000
@@ -0,0 +1,1 @@
+usersandgroups/README

=== added file 'debian/openldap-dit-usersandgroups.postinst.in'
--- debian/openldap-dit-usersandgroups.postinst.in	1970-01-01 00:00:00 +0000
+++ debian/openldap-dit-usersandgroups.postinst.in	2010-07-19 21:25:56 +0000
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+myservice="usersandgroups"
+
+#COMMON-FUNCTIONS#
+
+# steps:
+# - add modules
+# - add schema
+# - add db + its acls
+# - modify frontend acls
+# - modify config acls
+# - add overlays
+# - populate db
+# - set password for admin
+
+check_dit
+check_result $?
+
+echo "Adding modules..."
+add_modules
+check_result $?
+
+add_schemas 
+check_result $?
+
+add_overlays
+check_result $?
+
+add_indexes
+check_result $?
+
+populate_dit
+check_result $?
+
+modify_acls
+check_result $?
+
+echo
+echo "Finished, doing one last restart..."
+invoke-rc.d slapd restart
+check_result $?
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+

=== added file 'debian/openldap-dit.scripts-common'
--- debian/openldap-dit.scripts-common	1970-01-01 00:00:00 +0000
+++ debian/openldap-dit.scripts-common	2010-07-19 21:25:56 +0000
@@ -0,0 +1,217 @@
+
+set -e
+
+. /usr/share/debconf/confmodule
+
+LDAPWHOAMI="ldapwhoami -H ldapi:/// -Y EXTERNAL -Q"
+LDAPADD="ldapadd -H ldapi:/// -Y EXTERNAL -Q"
+LDAPMODIFY="ldapmodify -H ldapi:/// -Y EXTERNAL -Q"
+LDAPPASSWD="ldappasswd -H ldapi:/// -Y EXTERNAL -Q"
+LDAPSEARCH="ldapsearch -H ldapi:/// -Y EXTERNAL -Q -LLL"
+LASTACL='olcAccess: to dn.subtree="@SUFFIX@" by * read'
+
+now=`date +%s`
+myfqdn=`hostname -f`
+if [ -z "$myfqdn" ]; then
+	myfqdn="localhost"
+fi
+
+root="/usr/share/slapd/openldap-dit"
+
+# $1: domain
+# returns standard dc=foo,dc=bar suffix on stdout
+function calc_suffix() {
+	old_ifs=${IFS}
+	IFS="."
+	for component in $1; do
+		result="$result,dc=$component"
+	done
+	IFS="${old_ifs}"
+	echo "${result#,}"
+	return 0
+}
+
+function check_result() {
+    if [ "$1" -ne "0" ]; then
+        echo "ERROR, aborting"
+        exit 1
+    else
+        echo "Succeeded!"
+    fi
+}
+
+# $1: descriptive text of what is being added
+# $2: directory where the files are
+# $3: optional sed expression to use
+function add_ldif() {
+    echo "Adding $2 $1..."
+    for n in $(ls $2/ | grep "$1"); do
+        if [ ! -e "$2/$n" ]; then
+            echo "No additional $1 needed for this service!"
+            return 0
+        fi
+        if [ -z "$3" ]; then
+            cat "$2/$n" | $LDAPADD
+        else
+            cat "$2/$n" | sed -e "$3" | $LDAPADD
+        fi
+        if [ "$?" -ne "0" ]; then
+            echo "Error using \"$n\", aborting"
+            exit 1
+        fi
+    done
+    return 0
+}
+
+# $1: descriptive text of what is being added
+# $2: directory where the files are
+function modify_ldif() {
+    echo "Modifying $2 $1..."
+    for n in $(ls $2/ | grep "$1"); do
+        if [ ! -e "$2/$n" ]; then
+            echo "No additional $1 needed for this service!"
+            return 0
+        fi
+        if [ -z "$3" ]; then
+            cat "$2/$n" | $LDAPMODIFY
+        else
+            cat "$2/$n" | sed -e "$3" | $LDAPMODIFY
+        fi
+        if [ "$?" -ne "0" ]; then
+            echo "Error using \"$n\", aborting"
+            return 1
+        fi
+    done
+    return 0
+}
+
+# $1: index of last olcAccess attribute.
+function remove_last_acl() {
+$LDAPMODIFY <<REMOVE
+dn: olcDatabase={1}hdb,cn=config
+changetype: modify
+delete: olcAccess
+olcAccess: {$1}
+REMOVE
+}
+
+# $1: olcAccess string to be inserted last.
+function replace_last_acl() {
+    # Subfunction used for heredoc ldif.
+    echo "Replacing ACL..."
+    replace() {
+sed -e "s/{.*}to/to/g" <<ADD
+dn: olcDatabase={1}hdb,cn=config
+changetype: modify
+add: olcAccess
+$1
+ADD
+}
+
+    replace "$1" | $LDAPMODIFY
+}
+
+function add_database() {
+    add_ldif "database" "$root/$myservice" "s/@SUFFIX@/$mysuffix/g;"
+    return 0
+}
+
+function add_modules() {
+    if [ $myservice == 'core' ]; then
+        add_ldif "modules" "$root/$myservice"
+        return 0
+    else
+        mymodules=`$LDAPSEARCH -b "cn=config" objectClass=olcModuleList dn | egrep -o 'module[{][0123456789][}]'`
+        modify_ldif "modules" "$root/$myservice" "s/@SUFFIX@/$mysuffix/g;s/@MODULE@/$mymodules/g"
+    fi
+}
+
+# $1: sub directory containing schema LDIF files.
+function add_schemas() {
+    add_ldif "schema" "$root/$myservice"
+    return 0
+}
+
+function modify_acls() {
+    echo "Modifying ACLs..."
+    # Find database index number.
+    mydb=`find_main_db`
+
+    if [ $myservice != "core" ]; then
+        # Get last olcAccess index number.
+        indexs=$($LDAPSEARCH -b cn=config olcDatabase=$mydb olcaccess | grep olcAccess -c)
+        last_index=$(($indexs - 1))
+
+        # Store the last olcAccess string.
+        last_olcaccess=$($LDAPSEARCH -b cn=config olcDatabase=$mydb olcaccess | grep -A5 "olcAccess:.*$last_index")
+
+        remove_last_acl $last_index
+
+        modify_ldif "acl" "$root/$myservice" "s/@SUFFIX@/$mysuffix/g;s/@DATABASE@/$mydb/g"
+
+        replace_last_acl "$last_olcaccess"
+    else
+        modify_ldif "acl" "$root/$myservice" "s/@SUFFIX@/$mysuffix/g;s/@DATABASE@/$mydb/g"
+    fi
+
+    return 0
+}
+
+function add_overlays() {
+    mydb=`find_main_db`
+    add_ldif "overlay" "$root/$myservice" "s/@SUFFIX@/$mysuffix/g;s/@DATABASE@/$mydb/g"
+    return 0
+}
+
+function add_indexes() {
+    mydb=`find_main_db`
+    add_ldif "indexes" "$root/$myservice" "s/@SUFFIX@/$mysuffix/g;s/@DATABASE@/$mydb/g"
+    return 0
+}
+
+function populate_dit() {
+    mydb=`find_main_db`
+    if [ $myservice == "core" ]; then
+        # Set the uid="LDAP Admin" password.
+        db_get openldap-dit-core/internal/adminpw
+        adminpass="$RET"
+        add_ldif "dit" "$root/$myservice" "s/@SUFFIX@/$mysuffix/g;s/@DC@/${mydomain%%.[a-zA-Z0-9]*}/g;s/@DOMAIN@/${mydomain}/g;s#@ADMINPASS@#$adminpass#g;s/@DATABASE@/$mydb/g"
+    else
+        add_ldif "dit" "$root/$myservice" "s/@SUFFIX@/$mysuffix/g;s/@DC@/${mydomain%%.[a-zA-Z0-9]*}/g;s/@DOMAIN@/${mydomain}/g;s/@DATABASE@/$mydb/g"
+    fi
+    return 0
+}
+
+wipe_admin_pass() {
+# Remove passwords after creating the initial ldap database.
+# Usage: wipe_admin_pass
+    db_set openldap-dit-core/password1 ""
+    db_set openldap-dit-core/password2 ""
+    db_set openldap-dit-core/internal/adminpw ""
+}
+
+function find_main_db() {
+    if [ -z `$LDAPSEARCH -b "cn=config" olcSuffix="$mysuffix" dn | egrep -o '[{][0123456789][}]hdb'` ]; then
+        db='hdb'
+    else
+        db=`$LDAPSEARCH -b "cn=config" olcSuffix="$mysuffix" dn | egrep -o '[{][0123456789][}]hdb'`
+    fi
+    echo "$db"
+    return 0
+}
+
+function check_dit() {
+    base_dit=$($LDAPSEARCH -b $mysuffix associatedDomain=$mydomain dn 2>&1)
+    if [ "$base_dit" != "dn: $mysuffix" ]; then
+        return 1
+    fi
+
+}
+
+if [ -z "$mydomain" ]; then
+        db_get openldap-dit-core/domain
+        mydomain=$RET
+fi
+mysuffix=`calc_suffix $mydomain`
+
+

=== added directory 'debian/po'
=== added file 'debian/po/POTFILES.in'
--- debian/po/POTFILES.in	1970-01-01 00:00:00 +0000
+++ debian/po/POTFILES.in	2010-07-19 21:25:56 +0000
@@ -0,0 +1,1 @@
+[type: gettext/rfc822deb] openldap-dit-core.templates

=== added file 'debian/po/templates.pot'
--- debian/po/templates.pot	1970-01-01 00:00:00 +0000
+++ debian/po/templates.pot	2010-07-19 21:25:56 +0000
@@ -0,0 +1,82 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: [e-mail]\n"
+"POT-Creation-Date: 2010-06-01 13:33-0400\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <[e-mail]>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../openldap-dit-core.templates:1001
+msgid "DNS domain name:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../openldap-dit-core.templates:1001
+msgid ""
+"The DNS domain name is used to construct the base DN of the LDAP directory. "
+"For example, 'foo.example.org' will create the directory with 'dc=foo, "
+"dc=example, dc=org' as base DN."
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../openldap-dit-core.templates:2001
+msgid "Administrator password:"
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../openldap-dit-core.templates:2001
+msgid "Please enter the password for the admin entry in your LDAP directory."
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../openldap-dit-core.templates:3001
+msgid "Confirm password:"
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../openldap-dit-core.templates:3001
+msgid ""
+"Please enter the admin password for your LDAP directory again to verify that "
+"you have typed it correctly."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openldap-dit-core.templates:4001
+msgid "Password mismatch"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openldap-dit-core.templates:4001
+msgid "The two passwords you entered were not the same. Please try again."
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../openldap-dit-core.templates:5001
+msgid "Encrypted admin password:"
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../openldap-dit-core.templates:5001
+msgid "Internal template, should never be displayed to users."
+msgstr ""

=== modified file 'debian/rules'
--- debian/rules	2008-06-04 20:49:11 +0000
+++ debian/rules	2010-07-19 21:25:56 +0000
@@ -21,6 +21,8 @@
 
 
 build: build-stamp
+	perl -pe 's~#COMMON-FUNCTIONS#~qx{cat debian/openldap-dit.scripts-common}~eg' < debian/openldap-dit-core.postinst.in > debian/openldap-dit-core.postinst
+	perl -pe 's~#COMMON-FUNCTIONS#~qx{cat debian/openldap-dit.scripts-common}~eg' < debian/openldap-dit-usersandgroups.postinst.in > debian/openldap-dit-usersandgroups.postinst
 
 build-stamp: configure-stamp 
 	dh_testdir
@@ -41,10 +43,12 @@
 	dh_testdir
 	dh_testroot
 	dh_clean -k 
-	dh_installdirs
+	dh_installdirs 
+	dh_installdebconf	
 
 	# Add here commands to install the package into debian/openldap-dit.
-	$(MAKE) DESTDIR=$(CURDIR)/debian/openldap-dit install-ubuntu
+	$(MAKE) DESTDIR=$(CURDIR)/debian/openldap-dit-core install-core
+	$(MAKE) DESTDIR=$(CURDIR)/debian/openldap-dit-usersandgroups install-usersandgroups
 
 
 # Build architecture-independent files here.
@@ -56,7 +60,6 @@
 	dh_installexamples
 #	dh_install
 #	dh_installmenu
-#	dh_installdebconf	
 #	dh_installlogrotate
 #	dh_installemacsen
 #	dh_installpam

=== added directory 'debian/source'
=== added file 'debian/source/format'
--- debian/source/format	1970-01-01 00:00:00 +0000
+++ debian/source/format	2010-07-19 21:25:56 +0000
@@ -0,0 +1,1 @@
+3.0 (quilt)

=== added directory 'dhcp'
=== added file 'dhcp/dhcp-acl.ldif'
--- dhcp/dhcp-acl.ldif	1970-01-01 00:00:00 +0000
+++ dhcp/dhcp-acl.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,21 @@
+dn: olcDatabase={1}hdb,cn=config
+changetype: modify
+add: olcDbIndex
+olcDbIndex: dhcpClassData eq
+-
+add: olcDbIndex
+olcDbIndex: dhcpHWAddress eq
+-
+delete: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@" by * read
+-
+add: olcAccess
+olcAccess: to dn.subtree="ou=dhcp,@SUFFIX@"
+  attrs=children,entry,@dhcpService,@dhcpServer,@dhcpSharedNetwork,@dhcpSubnet,@dhcpPool,
+ @dhcpGroup,@dhcpHost,@dhcpClass,@dhcpSubClass,@dhcpOptions,@dhcpLeases,@dhcpLog
+  by group/groupOfMembers/member.exact="cn=dhcp admins,ou=system groups,@SUFFIX@" write
+  by group/groupOfMembers/member.exact="cn=dhcp readers,ou=system groups,@SUFFIX@" read
+  by * read
+-
+add: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@" by * read

=== added file 'dhcp/dhcp-dit.ldif'
--- dhcp/dhcp-dit.ldif	1970-01-01 00:00:00 +0000
+++ dhcp/dhcp-dit.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,33 @@
+dn: ou=dhcp,@SUFFIX@
+ou: dhcp
+objectClass: organizationalUnit
+description: Container for DHCP related entries
+
+dn: uid=DHCP Admin,ou=System Accounts,@SUFFIX@
+uid: DHCP Admin
+objectClass: account
+objectClass: simpleSecurityObject
+userPassword: {CRYPT}x
+description: Account used to administer DHCP related entries and attributes
+
+dn: uid=DHCP Reader,ou=System Accounts,@SUFFIX@
+uid: DHCP Reader
+objectClass: account
+objectClass: simpleSecurityObject
+userPassword: {CRYPT}x
+description: Account used to read entries and attributes under ou=dhcp
+
+dn: cn=DHCP Admins,ou=System Groups,@SUFFIX@
+cn: DHCP Admins
+objectClass: groupOfMembers
+description: Members can administer ou=DHCP entries and attributes
+owner: uid=DHCP Admin,ou=System Accounts,@SUFFIX@
+member: uid=DHCP Admin,ou=System Accounts,@SUFFIX@
+
+dn: cn=DHCP Readers,ou=System Groups,@SUFFIX@
+cn: DHCP Readers
+objectClass: groupOfMembers
+description: Members can read entries and attributes under ou=dhcp
+owner: uid=DHCP Admin,ou=System Accounts,@SUFFIX@
+member: uid=DHCP Reader,ou=System Accounts,@SUFFIX@
+

=== added file 'dhcp/dhcp-schema.ldif'
--- dhcp/dhcp-schema.ldif	1970-01-01 00:00:00 +0000
+++ dhcp/dhcp-schema.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,224 @@
+dn: cn=dhcp,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: dhcp
+olcAttributeTypes: {0}( 2.16.840.1.113719.1.203.4.1 NAME 'dhcpPrimaryDN' DESC 
+ 'The DN of the dhcpServer which is the primary server for the configuration.'
+  EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-
+ VALUE )
+olcAttributeTypes: {1}( 2.16.840.1.113719.1.203.4.2 NAME 'dhcpSecondaryDN' DES
+ C 'The DN of dhcpServer(s) which provide backup service for the configuration
+ .' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: {2}( 2.16.840.1.113719.1.203.4.3 NAME 'dhcpStatements' DESC
+  'Flexible storage for specific data depending on what object this exists in.
+  Like conditional statements, server parameters, etc. This allows the standar
+ d to evolve without needing to adjust the schema.' EQUALITY caseIgnoreIA5Matc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {3}( 2.16.840.1.113719.1.203.4.4 NAME 'dhcpRange' DESC 'The
+  starting & ending IP Addresses in the range (inclusive), separated by a hyph
+ en; if the range only contains one address, then just the address can be spec
+ ified with no hyphen.  Each range is defined as a separate value.' EQUALITY c
+ aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {4}( 2.16.840.1.113719.1.203.4.5 NAME 'dhcpPermitList' DESC
+  'This attribute contains the permit lists associated with a pool. Each permi
+ t list is defined as a separate value.' EQUALITY caseIgnoreIA5Match SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {5}( 2.16.840.1.113719.1.203.4.6 NAME 'dhcpNetMask' DESC 'T
+ he subnet mask length for the subnet.  The mask can be easily computed from t
+ his length.' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGL
+ E-VALUE )
+olcAttributeTypes: {6}( 2.16.840.1.113719.1.203.4.7 NAME 'dhcpOption' DESC 'En
+ coded option values to be sent to clients.  Each value represents a single op
+ tion and contains (OptionTag, Length, OptionValue) encoded in the format used
+  by DHCP.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {7}( 2.16.840.1.113719.1.203.4.8 NAME 'dhcpClassData' DESC 
+ 'Encoded text string or list of bytes expressed in hexadecimal, separated by 
+ colons.  Clients match subclasses based on matching the class data with the r
+ esults of match or spawn with statements in the class name declarations.' EQU
+ ALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+olcAttributeTypes: {8}( 2.16.840.1.113719.1.203.4.9 NAME 'dhcpOptionsDN' DESC 
+ 'The distinguished name(s) of the dhcpOption objects containing the configura
+ tion options provided by the server.' EQUALITY distinguishedNameMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: {9}( 2.16.840.1.113719.1.203.4.10 NAME 'dhcpHostDN' DESC 't
+ he distinguished name(s) of the dhcpHost objects.' EQUALITY distinguishedName
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: {10}( 2.16.840.1.113719.1.203.4.11 NAME 'dhcpPoolDN' DESC '
+ The distinguished name(s) of pools.' EQUALITY distinguishedNameMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: {11}( 2.16.840.1.113719.1.203.4.12 NAME 'dhcpGroupDN' DESC 
+ 'The distinguished name(s)   of the groups.' EQUALITY distinguishedNameMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: {12}( 2.16.840.1.113719.1.203.4.13 NAME 'dhcpSubnetDN' DESC
+  'The distinguished name(s) of the subnets.' EQUALITY distinguishedNameMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: {13}( 2.16.840.1.113719.1.203.4.14 NAME 'dhcpLeaseDN' DESC 
+ 'The distinguished name of a client address.' EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+olcAttributeTypes: {14}( 2.16.840.1.113719.1.203.4.15 NAME 'dhcpLeasesDN' DESC
+  'The distinguished name(s) client addresses.' EQUALITY distinguishedNameMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: {15}( 2.16.840.1.113719.1.203.4.16 NAME 'dhcpClassesDN' DES
+ C 'The distinguished name(s) of a class(es) in a subclass.' EQUALITY distingu
+ ishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: {16}( 2.16.840.1.113719.1.203.4.17 NAME 'dhcpSubclassesDN' 
+ DESC 'The distinguished name(s) of subclass(es).' EQUALITY distinguishedNameM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: {17}( 2.16.840.1.113719.1.203.4.18 NAME 'dhcpSharedNetworkD
+ N' DESC 'The distinguished name(s) of sharedNetworks.' EQUALITY distinguished
+ NameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: {18}( 2.16.840.1.113719.1.203.4.19 NAME 'dhcpServiceDN' DES
+ C 'The DN of dhcpService object(s)which contain the configuration information
+ . Each dhcpServer object has this attribute identifying the DHCP configuratio
+ n(s) that the server is associated with.' EQUALITY distinguishedNameMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: {19}( 2.16.840.1.113719.1.203.4.20 NAME 'dhcpVersion' DESC 
+ 'The version attribute of this object.' EQUALITY caseIgnoreIA5Match SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+olcAttributeTypes: {20}( 2.16.840.1.113719.1.203.4.21 NAME 'dhcpImplementation
+ ' DESC 'Description of the DHCP Server implementation e.g. DHCP Servers vendo
+ r.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-V
+ ALUE )
+olcAttributeTypes: {21}( 2.16.840.1.113719.1.203.4.22 NAME 'dhcpAddressState' 
+ DESC 'This stores information about the current binding-status of an address.
+   For dynamic addresses managed by DHCP, the values should be restricted to t
+ he following: "FREE", "ACTIVE", "EXPIRED", "RELEASED", "RESET", "ABANDONED", 
+ "BACKUP".  For other addresses, it SHOULD be one of the following: "UNKNOWN",
+  "RESERVED" (an address that is managed by DHCP that is reserved for a specif
+ ic client), "RESERVED-ACTIVE" (same as reserved, but address is currently in 
+ use), "ASSIGNED" (assigned manually or by some other mechanism), "UNASSIGNED"
+ , "NOTASSIGNABLE".' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.26 SINGLE-VALUE )
+olcAttributeTypes: {22}( 2.16.840.1.113719.1.203.4.23 NAME 'dhcpExpirationTime
+ ' DESC 'This is the time the current lease for an address expires.' EQUALITY 
+ generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
+olcAttributeTypes: {23}( 2.16.840.1.113719.1.203.4.24 NAME 'dhcpStartTimeOfSta
+ te' DESC 'This is the time of the last state change for a leased address.' EQ
+ UALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE
+  )
+olcAttributeTypes: {24}( 2.16.840.1.113719.1.203.4.25 NAME 'dhcpLastTransactio
+ nTime' DESC 'This is the last time a valid DHCP packet was received from the 
+ client.' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 S
+ INGLE-VALUE )
+olcAttributeTypes: {25}( 2.16.840.1.113719.1.203.4.26 NAME 'dhcpBootpFlag' DES
+ C 'This indicates whether the address was assigned via BOOTP.' EQUALITY boole
+ anMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+olcAttributeTypes: {26}( 2.16.840.1.113719.1.203.4.27 NAME 'dhcpDomainName' DE
+ SC 'This is the name of the domain sent to the client by the server.  It is e
+ ssentially the same as the value for DHCP option 15 sent to the client, and r
+ epresents only the domain - not the full FQDN.  To obtain the full FQDN assig
+ ned to the client you must prepend the "dhcpAssignedHostName" to this value w
+ ith a ".".' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 
+ SINGLE-VALUE )
+olcAttributeTypes: {27}( 2.16.840.1.113719.1.203.4.28 NAME 'dhcpDnsStatus' DES
+ C 'This indicates the status of updating DNS resource records on behalf of th
+ e client by the DHCP server for this address.  The value is a 16-bit bitmask.
+ ' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {28}( 2.16.840.1.113719.1.203.4.29 NAME 'dhcpRequestedHostN
+ ame' DESC 'This is the hostname that was requested by the client.' EQUALITY c
+ aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+olcAttributeTypes: {29}( 2.16.840.1.113719.1.203.4.30 NAME 'dhcpAssignedHostNa
+ me' DESC 'This is the actual hostname that was assigned to a client. It may n
+ ot be the name that was requested by the client.  The fully qualified domain 
+ name can be determined by appending the value of "dhcpDomainName" (with a dot
+  separator) to this name.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.26 SINGLE-VALUE )
+olcAttributeTypes: {30}( 2.16.840.1.113719.1.203.4.31 NAME 'dhcpReservedForCli
+ ent' DESC 'The distinguished name of a "dhcpClient" that an address is reserv
+ ed for.  This may not be the same as the "dhcpAssignedToClient" attribute if 
+ the address is being reassigned but the current lease has not yet expired.' E
+ QUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VA
+ LUE )
+olcAttributeTypes: {31}( 2.16.840.1.113719.1.203.4.32 NAME 'dhcpAssignedToClie
+ nt' DESC 'This is the distinguished name of a "dhcpClient" that an address is
+  currently assigned to.  This attribute is only present in the class when the
+  address is leased.' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.12 SINGLE-VALUE )
+olcAttributeTypes: {32}( 2.16.840.1.113719.1.203.4.33 NAME 'dhcpRelayAgentInfo
+ ' DESC 'If the client request was received via a relay agent, this contains i
+ nformation about the relay agent that was available from the DHCP request.  T
+ his is a hex-encoded option value.' EQUALITY octetStringMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.40 SINGLE-VALUE )
+olcAttributeTypes: {33}( 2.16.840.1.113719.1.203.4.34 NAME 'dhcpHWAddress' DES
+ C 'The clients hardware address that requested this IP address.' EQUALITY oct
+ etStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+olcAttributeTypes: {34}( 2.16.840.1.113719.1.203.4.35 NAME 'dhcpHashBucketAssi
+ gnment' DESC 'HashBucketAssignment bit map for the DHCP Server, as defined in
+  DHC Load Balancing Algorithm [RFC 3074].' EQUALITY octetStringMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+olcAttributeTypes: {35}( 2.16.840.1.113719.1.203.4.36 NAME 'dhcpDelayedService
+ Parameter' DESC 'Delay in seconds corresponding to Delayed Service Parameter 
+ configuration, as defined in  DHC Load Balancing Algorithm [RFC 3074]. ' EQUA
+ LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {36}( 2.16.840.1.113719.1.203.4.37 NAME 'dhcpMaxClientLeadT
+ ime' DESC 'Maximum Client Lead Time configuration in seconds, as defined in D
+ HCP Failover Protocol [FAILOVR]' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {37}( 2.16.840.1.113719.1.203.4.38 NAME 'dhcpFailOverEndpoi
+ ntState' DESC 'Server (Failover Endpoint) state, as defined in DHCP Failover 
+ Protocol [FAILOVR]' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.26 SINGLE-VALUE )
+olcAttributeTypes: {38}( 2.16.840.1.113719.1.203.4.39 NAME 'dhcpErrorLog' DESC
+  'Generic error log attribute that allows logging error conditions within a d
+ hcpService or a dhcpSubnet, like no IP addresses available for lease.' EQUALI
+ TY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+olcObjectClasses: {0}( 2.16.840.1.113719.1.203.6.1 NAME 'dhcpService' DESC 'Se
+ rvice object that represents the actual DHCP Service configuration. This is a
+  container object.' SUP top STRUCTURAL MUST ( cn $ dhcpPrimaryDN ) MAY ( dhcp
+ SecondaryDN $ dhcpSharedNetworkDN $ dhcpSubnetDN $ dhcpGroupDN $ dhcpHostDN $
+  dhcpClassesDN $ dhcpOptionsDN $ dhcpStatements ) )
+olcObjectClasses: {1}( 2.16.840.1.113719.1.203.6.2 NAME 'dhcpSharedNetwork' DE
+ SC 'This stores configuration information for a shared network.' SUP top STRU
+ CTURAL MUST cn MAY ( dhcpSubnetDN $ dhcpPoolDN $ dhcpOptionsDN $ dhcpStatemen
+ ts ) X-NDS_CONTAINMENT 'dhcpService' )
+olcObjectClasses: {2}( 2.16.840.1.113719.1.203.6.3 NAME 'dhcpSubnet' DESC 'Thi
+ s class defines a subnet. This is a container object.' SUP top STRUCTURAL MUS
+ T ( cn $ dhcpNetMask ) MAY ( dhcpRange $ dhcpPoolDN $ dhcpGroupDN $ dhcpHostD
+ N $ dhcpClassesDN $ dhcpLeasesDN $ dhcpOptionsDN $ dhcpStatements ) X-NDS_CON
+ TAINMENT ( 'dhcpService' 'dhcpSharedNetwork' ) )
+olcObjectClasses: {3}( 2.16.840.1.113719.1.203.6.4 NAME 'dhcpPool' DESC 'This 
+ stores configuration information about a pool.' SUP top STRUCTURAL MUST ( cn 
+ $ dhcpRange ) MAY ( dhcpClassesDN $ dhcpPermitList $ dhcpLeasesDN $ dhcpOptio
+ nsDN $ dhcpStatements ) X-NDS_CONTAINMENT ( 'dhcpSubnet' 'dhcpSharedNetwork' 
+ ) )
+olcObjectClasses: {4}( 2.16.840.1.113719.1.203.6.5 NAME 'dhcpGroup' DESC 'Grou
+ p object that lists host DNs and parameters. This is a container object.' SUP
+  top STRUCTURAL MUST cn MAY ( dhcpHostDN $ dhcpOptionsDN $ dhcpStatements ) X
+ -NDS_CONTAINMENT ( 'dhcpSubnet' 'dhcpService' ) )
+olcObjectClasses: {5}( 2.16.840.1.113719.1.203.6.6 NAME 'dhcpHost' DESC 'This 
+ represents information about a particular client' SUP top STRUCTURAL MUST cn 
+ MAY ( dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements ) X-NDS_CO
+ NTAINMENT ( 'dhcpService' 'dhcpSubnet' 'dhcpGroup' ) )
+olcObjectClasses: {6}( 2.16.840.1.113719.1.203.6.7 NAME 'dhcpClass' DESC 'Repr
+ esents information about a collection of related clients.' SUP top STRUCTURAL
+  MUST cn MAY ( dhcpSubClassesDN $ dhcpOptionsDN $ dhcpStatements ) X-NDS_CONT
+ AINMENT ( 'dhcpService' 'dhcpSubnet' ) )
+olcObjectClasses: {7}( 2.16.840.1.113719.1.203.6.8 NAME 'dhcpSubClass' DESC 'R
+ epresents information about a collection of related classes.' SUP top STRUCTU
+ RAL MUST cn MAY ( dhcpClassData $ dhcpOptionsDN $ dhcpStatements ) X-NDS_CONT
+ AINMENT 'dhcpClass' )
+olcObjectClasses: {8}( 2.16.840.1.113719.1.203.6.9 NAME 'dhcpOptions' DESC 'Re
+ presents information about a collection of options defined.' SUP top AUXILIAR
+ Y MUST cn MAY dhcpOption X-NDS_CONTAINMENT ( 'dhcpService' 'dhcpSharedNetwork
+ ' 'dhcpSubnet' 'dhcpPool' 'dhcpGroup' 'dhcpHost' 'dhcpClass' ) )
+olcObjectClasses: {9}( 2.16.840.1.113719.1.203.6.10 NAME 'dhcpLeases' DESC 'Th
+ is class represents an IP Address, which may or may not have been leased.' SU
+ P top STRUCTURAL MUST ( cn $ dhcpAddressState ) MAY ( dhcpExpirationTime $ dh
+ cpStartTimeOfState $ dhcpLastTransactionTime $ dhcpBootpFlag $ dhcpDomainName
+  $ dhcpDnsStatus $ dhcpRequestedHostName $ dhcpAssignedHostName $ dhcpReserve
+ dForClient $ dhcpAssignedToClient $ dhcpRelayAgentInfo $ dhcpHWAddress ) X-ND
+ S_CONTAINMENT ( 'dhcpService' 'dhcpSubnet' 'dhcpPool' ) )
+olcObjectClasses: {10}( 2.16.840.1.113719.1.203.6.11 NAME 'dhcpLog' DESC 'This
+  is the object that holds past information about the IP address. The cn is th
+ e time/date stamp when the address was assigned or released, the address stat
+ e at the time, if the address was assigned or released.' SUP top STRUCTURAL M
+ UST cn MAY ( dhcpAddressState $ dhcpExpirationTime $ dhcpStartTimeOfState $ d
+ hcpLastTransactionTime $ dhcpBootpFlag $ dhcpDomainName $ dhcpDnsStatus $ dhc
+ pRequestedHostName $ dhcpAssignedHostName $ dhcpReservedForClient $ dhcpAssig
+ nedToClient $ dhcpRelayAgentInfo $ dhcpHWAddress $ dhcpErrorLog ) X-NDS_CONTA
+ INMENT ( 'dhcpLeases' 'dhcpPool' 'dhcpSubnet' 'dhcpSharedNetwork' 'dhcpServic
+ e' ) )
+olcObjectClasses: {11}( 2.16.840.1.113719.1.203.6.12 NAME 'dhcpServer' DESC 'D
+ HCP Server Object' SUP top STRUCTURAL MUST ( cn $ dhcpServiceDN ) MAY ( dhcpV
+ ersion $ dhcpImplementation $ dhcpHashBucketAssignment $ dhcpDelayedServicePa
+ rameter $ dhcpMaxClientLeadTime $ dhcpFailOverEndpointState $ dhcpStatements 
+ ) X-NDS_CONTAINMENT ( 'o' 'ou' 'dc' ) )

=== added directory 'dns'
=== added file 'dns/dns-acl.ldif'
--- dns/dns-acl.ldif	1970-01-01 00:00:00 +0000
+++ dns/dns-acl.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,26 @@
+dn: olcDatabase={1}hdb,cn=config
+changetype: modify
+add: olcDbIndex
+olcDbIndex: zoneName eq
+-
+add: olcDbIndex
+olcDbIndex: relativeDomainName eq
+-
+delete: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@" by * read
+-
+add: olcAccess
+olcAccess: to dn.base="ou=dns,@SUFFIX@"
+  attrs=entry,@extensibleObject
+  by group/groupOfMembers/member.exact="cn=dns admins,ou=system groups,@SUFFIX@" write
+  by * read
+-
+add: olcAccess
+olcAccess: to dn.subtree="ou=dns,@SUFFIX@"
+  attrs=children,entry,@dNSZone
+  by group/groupOfMembers/member.exact="cn=dns admins,ou=system groups,@SUFFIX@" write
+  by group/groupOfMembers/member.exact="cn=dns readers,ou=system groups,@SUFFIX@" read
+  by * none
+-
+add: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@" by * read

=== added file 'dns/dns-dit.ldif'
--- dns/dns-dit.ldif	1970-01-01 00:00:00 +0000
+++ dns/dns-dit.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,33 @@
+dn: ou=dns,@SUFFIX@
+ou: dns
+objectClass: organizationalUnit
+description: Container for DNS related entries
+
+dn: uid=DNS Admin,ou=System Accounts,@SUFFIX@
+uid: DNS Admin
+objectClass: account
+objectClass: simpleSecurityObject
+userPassword: {CRYPT}x
+description: Account used to administer DNS related entries and attributes
+
+dn: uid=DNS Reader,ou=System Accounts,@SUFFIX@
+uid: DNS Reader
+objectClass: account
+objectClass: simpleSecurityObject
+userPassword: {CRYPT}x
+description: Account used to read entries and attributes under ou=dns
+
+dn: cn=DNS Admins,ou=System Groups,@SUFFIX@
+cn: DNS Admins
+objectClass: groupOfMembers
+description: Members can administer ou=DNS entries and attributes
+owner: uid=DNS Admin,ou=System Accounts,@SUFFIX@
+member: uid=DNS Admin,ou=System Accounts,@SUFFIX@
+
+dn: cn=DNS Readers,ou=System Groups,@SUFFIX@
+cn: DNS Readers
+objectClass: groupOfMembers
+description: Members can read entries and attributes under ou=dns
+owner: uid=DNS Admin,ou=System Accounts,@SUFFIX@
+member: uid=DNS Reader,ou=System Accounts,@SUFFIX@
+

=== added file 'dns/dnszone-schema.ldif'
--- dns/dnszone-schema.ldif	1970-01-01 00:00:00 +0000
+++ dns/dnszone-schema.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,67 @@
+dn: cn=dnszone,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: dnszone
+olcAttributeTypes: {0}( 1.3.6.1.4.1.2428.20.0.0 NAME 'dNSTTL' DESC 'An integer
+  denoting time to live' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.27 )
+olcAttributeTypes: {1}( 1.3.6.1.4.1.2428.20.0.1 NAME 'dNSClass' DESC 'The clas
+ s of a resource record' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.26 )
+olcAttributeTypes: {2}( 1.3.6.1.4.1.2428.20.0.2 NAME 'zoneName' DESC 'The name
+  of a zone, i.e. the name of the highest node in the zone' EQUALITY caseIgnor
+ eIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.26 )
+olcAttributeTypes: {3}( 1.3.6.1.4.1.2428.20.0.3 NAME 'relativeDomainName' DESC
+  'The starting labels of a domain name' EQUALITY caseIgnoreIA5Match SUBSTR ca
+ seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {4}( 1.3.6.1.4.1.2428.20.1.12 NAME 'pTRRecord' DESC 'domain
+  name pointer, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subs
+ tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {5}( 1.3.6.1.4.1.2428.20.1.13 NAME 'hInfoRecord' DESC 'host
+  information, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {6}( 1.3.6.1.4.1.2428.20.1.14 NAME 'mInfoRecord' DESC 'mail
+ box or mail list information, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR ca
+ seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {7}( 1.3.6.1.4.1.2428.20.1.16 NAME 'tXTRecord' DESC 'text s
+ tring, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {8}( 1.3.6.1.4.1.2428.20.1.24 NAME 'SigRecord' DESC 'Signat
+ ure, RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {9}( 1.3.6.1.4.1.2428.20.1.25 NAME 'KeyRecord' DESC 'Key, R
+ FC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {10}( 1.3.6.1.4.1.2428.20.1.28 NAME 'aAAARecord' DESC 'IPv6
+  address, RFC 1886' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {11}( 1.3.6.1.4.1.2428.20.1.29 NAME 'LocRecord' DESC 'Locat
+ ion, RFC 1876' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {12}( 1.3.6.1.4.1.2428.20.1.30 NAME 'nXTRecord' DESC 'non-e
+ xistant, RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {13}( 1.3.6.1.4.1.2428.20.1.33 NAME 'sRVRecord' DESC 'servi
+ ce location, RFC 2782' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substr
+ ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {14}( 1.3.6.1.4.1.2428.20.1.35 NAME 'nAPTRRecord' DESC 'Nam
+ ing Authority Pointer, RFC 2915' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnor
+ eIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {15}( 1.3.6.1.4.1.2428.20.1.36 NAME 'kXRecord' DESC 'Key Ex
+ change Delegation, RFC 2230' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {16}( 1.3.6.1.4.1.2428.20.1.37 NAME 'certRecord' DESC 'cert
+ ificate, RFC 2538' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {17}( 1.3.6.1.4.1.2428.20.1.38 NAME 'a6Record' DESC 'A6 Rec
+ ord Type, RFC 2874' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {18}( 1.3.6.1.4.1.2428.20.1.39 NAME 'dNameRecord' DESC 'Non
+ -Terminal DNS Name Redirection, RFC 2672' EQUALITY caseIgnoreIA5Match SUBSTR 
+ caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcObjectClasses: {0}( 1.3.6.1.4.1.2428.20.3 NAME 'dNSZone' SUP top STRUCTURAL
+  MUST ( zoneName $ relativeDomainName ) MAY ( DNSTTL $ DNSClass $ ARecord $ M
+ DRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $ PTRRecord $ HINFORe
+ cord $ MINFORecord $ TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCReco
+ rd $ NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $ A6Record $
+  DNAMERecord ) )

=== removed file 'doc/README'
--- doc/README	2009-09-11 16:20:31 +0000
+++ doc/README	1970-01-01 00:00:00 +0000
@@ -1,321 +0,0 @@
-Introduction
-============
-
-This document aims to explain the Directory Information Tree (DIT) used in the
-openldap-dit package.
-
-The motivation for this new layout is the need for a better separation of
-privileges regarding access to the information stored in the directory. The
-super user account of the directory should be used rarely and delegation of
-privileges should be easier.
-
-We think this proposed layout accomplishes that by providing several groups
-which have distinctive access rules, providing a clear separation of
-privileges. In order to give an user a new privilege, all is needed is to add
-him/her to one of these specific groups.
-
-These are the characteristics of the proposed DIT:
-- several groups for common services
-- most access control rules based on group membership
-- several system accounts ready to use (just add a password) by many services
-  such as:
-  - sudo
-  - dns
-  - samba
-  - etc
-- simple installation script which prepares the tree asking very few questions
-  (just two, and one of them is just a password)
-- easy support for OpenLDAP's password policy overlay
-
-These accounts get their privileges by being associated to specific group(s).
-
-Administrators should note that we will probably find out that there are too
-few groups, or too many. Or that some ACLs are too restrictive, or too broad.
-It is difficult to come up with a one-size-fits-all DIT, but we can start here.
-
-By the way, there is no password set for the "rootdn" account as it (the
-account) is not used.
-
-If you just want to know how to use this DIT, skip to the end of the document
-to the section called "Enough with the theory: how to use this?".
-
-
-The Tree
-========
-
-                             dc=example,dc=com
-
-  ou=Hosts                        ou=System Groups            ou=System Accounts
-  ou=Idmap                          cn=LDAP Admins              uid=Ldap Admin
-  ou=Address Book                   cn=Sudo Admins              uid=Sudo Admin
-  ou=dhcp                           cn=DNS Admins               uid=DNS Admin
-  ou=dns                            cn=DNS Readers              uid=DNS Reader
-  ou=People                         cn=DHCP Admins              uid=DHCP Admin
-  ou=Group                          cn=Address Book Admins      uid=Address Book Admin
-  ou=Password Policies              cn=LDAP Replicators         uid=LDAP Replicator
-  ou=Sudoers                        cn=Account Admins           uid=Account Admin
-                                    cn=MTA Admins               uid=MTA Admin
-                                    cn=LDAP Monitors            uid=LDAP Monitor
-                                    cn=Idmap Admins             uid=Idmap Admin
-                                                                uid=smbldap-tools
-                                                                uid=nssldap
-
-The services
-============
-
-We created some entries for a few services that can use LDAP to store their
-information. More will probably be added in the future. For now, we have
-branches for:
-- dns (ou=dns)
-- sudo (ou=sudoers)
-- dhcp (ou=dhcp)
-
-The respective administrative groups have read/write access to these branches
-for specific entries.
-
-
-The groups
-==========
-
-Groups are the core of this proposed DIT layout, because most ACLs are
-constructed via group membership to allow for greater flexibility and
-delegation.
-
-The current default groups that are born with the new DIT layout are as
-follows:
-- LDAP Admins
-- Sudo Admins
-- DNS Admins
-- DNS Readers
-- DHCP Admins
-- Address Book Admins
-- LDAP Replicators
-- Account Admins
-- MTA Admins
-- LDAP Monitors
-- Idmap Admins
-
-Each entry has a description attribute filled in with a brief text describing
-the purpose of the members of each group. For example:
-
-dn: cn=Sudo Admins,ou=System Groups,dc=example,dc=com
-description: Members can administer ou=sudoers entries and attributes
-
-In order to use groups in ACLs, the objectClass used for these entries has to
-use attributes where membership is indicated distinguished names and not just
-names. In other words, the membership attribute has to use a full DN to
-indicate its member. The standard object class used for this by OpenLDAP is
-groupOfNames, and this is what we used. For example:
-
-dn: cn=Sudo Admins,ou=System Groups,dc=example,dc=com
-member: uid=Sudo Admin,ou=System Accounts,dc=example,dc=com
-
-A side effect of using groupOfNames is that we *have* to have at least one
-member in each group. So we needed to create standard accounts, which proved to
-be usefull anyway. The previous example showed the standard account for
-adminstering sudo entries and attributes.
-
-
-The accounts
-============
-
-As was the case with the groups, many standard system accounts were created.
-Each group has at least a corresponding system account as its membership. The
-current list is as follows:
-
-- Account Admin
-- smbldap-tools
-- nssldap
-- MTA Admin
-- DHCP Admin
-- DNS Admin
-- DNS Reader
-- Sudo Admin
-- Address Book Admin
-- LDAP Admin
-- LDAP Replicator
-- LDAP Monitor
-- Idmap Admin
-
-
-The privileges
-==============
-
-The idea is to give each group the needed privileges to complete its
-administration tasks. This usually means having access to the respective ou=foo
-branch of the directory. For example, the Sudo Admins group has rights over the
-ou=sudoers branch of the directory. 
-
-Whenever possible, however, these rights are limited to that specific service,
-i.e., it's not any kind of entry that can be created but just those relevant to
-the service. For example, the Sudo Admins members can only create entries one
-level below ou=sudoers, and only with the attributes allowed by the sudoRole
-object class.
-
-Other cases, however, are more complicated. We will list them here and the
-reasoning behind the chosen ACLs.
-
-
-Monitoring access
------------------
-The "LDAP Monitors" group is the only grop besides "LDAP Admins" which can read
-entries under cn=monitor. This base dn contains statistics about the server,
-such as operations performed, backends and overlays being used, etc. So, if you
-need an user to have read access to this kind of information, just put him/her
-in this group.
-
-
-Samba, Unix and Kerberos admins
--------------------------------
-Samba needs to have corresponding unix accounts for its users and machine
-accounts. It will not by itself create those, however. For example, when
-running "smbpasswd -a foo", the "foo" user account will only be created if
-samba can find the corresponding unix attributes.  The same for group mappings
-and machine accounts.
-
-Earlier versions of openldap-dit had two separate privilege groups:
-one for Unix accounts and another for Samba accounts. This complicated ACLs,
-and it was worse when we later added Kerberos Admins to the mix because they
-also had to touch some of the account-related attributes.
-
-So, since version 0.11, we merged these groups into one called Account Admins
-(and the respective Account Admin account). This made the ACLs simplier and
-faster, at the expense of some granularity in privileges.
-
-The smbldap-tools account, uid=smbldap-tools,ou=System Accounts, still exists
-but is now a member of the Account Admins group.
-
-
-MTA
----
-As of this moment, there is no clear scenario for usage of this account. For
-now, it can administer just a few attributes: all the ones from the
-inetLocalMailRecipient object class plus the single mail attribute.
-
-As more usage scenarios appear, these ACLs should be incremented.
-
-
-DNS Readers
------------
-Members of this group are allowed read access to all attributes of the dNSZone
-object class under ou=dns. Besides them and the members of the DNS Admins
-group, no other entity can read these entries. This was done so to avoid the
-"zone transfer" vulnerability scenario, where anonymous users could gather the
-whole DNS database.
-
-
-LDAP Admins
------------
-Members of this group can write to and read from all entries and attributes of
-the directory and have no size or time limits.
-
-
-LDAP Replicators
-----------------
-The members of the LDAP Replicators group have read access to all attributes
-and entries of the directory so that they can be used in a syncrepl replication
-setup. The bind dn used for the replication should be a member of this group.
-For example:
-
-syncrepl    rid=100
-            provider=ldap://dirserv.example.com
-            type=refreshAndPersist
-            retry="60 +"
-            searchbase="dc=example,dc=com"
-            starttls=critical
-            bindmethod=simple
-            binddn="uid=LDAP Replicator,ou=System Accounts,dc=example,dc=com"
-            credentials="secret"
-		
-Here, "uid=LDAP Replicator,ou=System Accounts,dc=example,dc=com" is a member of
-the "LDAP Replicators" group and is automatically granted read rights to all
-entries of the directory (assuming the provider was also installed with this
-base DIT and ACLs).
-
-
-Generic directory read accounts
--------------------------------
-A few accounts were created for specific read access. Some administrators
-prefer to block anonymous read access to the directory, in which case these
-accounts would then be used. For the moment we have:
-- nssldap: nss_ldap can bind to the directory either anonymously or with a
-  specific account. The "uid=nssldap,ou=System Accounts" was created for this
-  purpose.  Currently no ACLs make use of this account. Were the administrator to
-  use it, he/she would also have to block anonymous read access to many
-  attributes.
-
-Currently anonymous read access is granted to many attributes. As of this
-moment, if the administrator wants to restrict anonymous access and use these
-accounts, the ACLs would have to be changed manually.
-
-
-The installation script
-=======================
-
-The openldap-dit package contains a shell script which can be used to
-install the accounts and ACLs described in this document. The script is
-installed at /usr/share/openldap/scripts/openldap-dit-setup.sh and performs the
-following:
-- asks the DNS domain (suggesting whatever was auto-detected)
-- constructs the top-level directory entry from this domain using dc style
-  attributes
-- creates and imports an ldif file with the accounts and groups described here
-- installs new slapd.conf and openldap-dit-access.conf files (making backups of
-  the previous ones) with the default ACLs and other useful configurations
-  (like cache)
-- loads the ldif file, backing up the previous database directory
-
-Even though the script performs many tests and backups many files before
-overwriting them, administrators are advised to backup all data before running
-this script.
-
-
-Enough with the theory: how to use this?
-========================================
-
-The installation script will overwrite some OpenLDAP files and directories.
-Specifically, it will backup and overwrite the following:
-- /etc/ldap/slapd.conf
-- /etc/ldap/ldap.conf
-- /etc/ldap/openldap-dit-access.conf (THIS ONE HAS NO BACKUP CURRENTLY)
-- /var/lib/ldap contents
-
-So, after you are satisfied that nothing important will be lost, run the
-script. Below is a sample run using the example.com domain:
-
-root@nsn2:~# /usr/share/slapd/openldap-dit-setup.sh 
-Please enter your DNS domain name [example.com]:
-
-
-Administrator account
-
-The administrator account for this directory is
-uid=LDAP Admin,ou=System Accounts,dc=example,dc=com
-
-Please choose a password for this account:
-New password: 
-Re-enter new password: 
-
-
-Summary
-=======
-
-Domain:        example.com
-LDAP suffix:   dc=example,dc=com
-Administrator: uid=LDAP Admin,ou=System Accounts,dc=example,dc=com
-
-Confirm? (Y/n)
-
-config file testing succeeded
-Stopping ldap service
-Finished, starting ldap service
-Starting OpenLDAP: slapd.
-
-Your previous database directory has been backed up as /var/lib/ldap.1228858266
-All files that were backed up got the suffix "1228858266".
-
-
-Now, fire up an LDAP browser and use the LDAP Admin account shown above to set
-up some passwords for the other less privileged accounts that you are going to
-use. Note that the "rootdn" account is not used.
-

=== added file 'doc/README.kde'
=== added directory 'mit-kerberos'
=== added file 'mit-kerberos/mit-kerberos-acl.ldif'
--- mit-kerberos/mit-kerberos-acl.ldif	1970-01-01 00:00:00 +0000
+++ mit-kerberos/mit-kerberos-acl.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,29 @@
+dn: olcDatabase={1}hdb,cn=config
+changetype: modify
+add: olcDbIndex
+olcDbIndex: krbPrincipalName eq
+-
+add: olcDbIndex
+olcDbIndex: krbPwdPolicyReference eq
+-
+delete: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@" by * read
+-
+add: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@"
+  attrs=krbPrincipalKey
+  by self write
+  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
+  by dn.exact="uid=kdc-service,ou=System Accounts,@SUFFIX@" read
+  by dn.exact="uid=kadmin-service,ou=System Accounts,@SUFFIX@" write
+  by anonymous auth
+  by * none
+-
+add: olcAccess
+olcAccess: to dn.subtree="ou=Kerberos Realms,@SUFFIX@"
+  by dn.exact="uid=kdc-service,ou=System Accounts,@SUFFIX@" read
+  by dn.exact="uid=kadmin-service,ou=System Accounts,@SUFFIX@" write
+  by * none
+-
+add: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@" by * read

=== added file 'mit-kerberos/mit-kerberos-dit.ldif'
--- mit-kerberos/mit-kerberos-dit.ldif	1970-01-01 00:00:00 +0000
+++ mit-kerberos/mit-kerberos-dit.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,19 @@
+dn: ou=Kerberos Realms,@SUFFIX@
+ou: Kerberos Realms
+objectClass: organizationalUnit
+description: Container for Kerberos Realms
+
+dn: uid=kdc-service,ou=System Accounts,@SUFFIX@
+uid: kdc-service
+objectClass: account
+objectClass: simpleSecurityObject
+userPassword: {CRYPT}x
+description: Account used for the Kerberos KDC
+
+dn: uid=kadmin-service,ou=System Accounts,@SUFFIX@
+uid: kadmin-service
+objectClass: account
+objectClass: simpleSecurityObject
+userPassword: {CRYPT}x
+description: Account used for the Kerberos Admin server
+

=== added file 'mit-kerberos/mit-kerberos-schema.ldif'
--- mit-kerberos/mit-kerberos-schema.ldif	1970-01-01 00:00:00 +0000
+++ mit-kerberos/mit-kerberos-schema.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,473 @@
+# Novell Kerberos Schema Definitions
+# Novell Inc.
+# 1800 South Novell Place
+# Provo, UT 84606
+#
+# VeRsIoN=1.0
+# CoPyRiGhT=(c) Copyright 2006, Novell, Inc.  All rights reserved
+#
+# OIDs:
+#    joint-iso-ccitt(2)
+#      country(16)
+#        us(840)
+#          organization(1)
+#            Novell(113719)
+#              applications(1)
+#                kerberos(301)
+#                 Kerberos Attribute Type(4) attr# version#
+#                    specific attribute definitions
+#                 Kerberos Attribute Syntax(5)
+#                    specific syntax definitions
+#                 Kerberos Object Class(6) class# version#
+#                    specific class definitions
+#
+#    iso(1)
+#      member-body(2)
+#        United States(840)
+#          mit (113554)
+#            infosys(1)
+#              ldap(4)
+#                attributeTypes(1)
+#                  Kerberos(6)
+########################################################################
+########################################################################
+#         Attribute Type Definitions                       #
+########################################################################
+dn: cn=mit-kerberos,cn=schema,cn=config
+cn: kerberos
+objectClass: olcSchemaConfig
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.1.1
+  NAME 'krbPrincipalName'
+  EQUALITY caseExactIA5Match
+  SUBSTR caseExactSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26)
+##### If there are multiple krbPrincipalName values for an entry, this
+##### is the canonical principal name in the RFC 1964 specified
+##### format.  (If this attribute does not exist, then all
+##### krbPrincipalName values are treated as canonical.)
+olcAttributeTypes: ( 1.2.840.113554.1.4.1.6.1
+  NAME 'krbCanonicalName'
+  EQUALITY caseExactIA5Match
+  SUBSTR caseExactSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+  SINGLE-VALUE)
+##### This specifies the type of the principal, the types could be any of
+##### the types mentioned in section 6.2 of RFC 4120
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.3.1
+  NAME 'krbPrincipalType'
+  EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE)
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.5.1
+  NAME 'krbUPEnabled'
+  DESC 'Boolean'
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+  SINGLE-VALUE)
+##### The time at which the principal expires
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.6.1
+  NAME 'krbPrincipalExpiration'
+  EQUALITY generalizedTimeMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
+  SINGLE-VALUE)
+##### The krbTicketFlags attribute holds information about the kerberos flags for a principal
+##### The values (0x00000001 - 0x00800000) are reserved for standards and 
+##### values (0x01000000 - 0x80000000) can be used for proprietary extensions.
+##### The flags and values as per RFC 4120 and MIT implementation are,
+##### DISALLOW_POSTDATED  0x00000001
+##### DISALLOW_FORWARDABLE  0x00000002
+##### DISALLOW_TGT_BASED        0x00000004
+##### DISALLOW_RENEWABLE        0x00000008
+##### DISALLOW_PROXIABLE        0x00000010
+##### DISALLOW_DUP_SKEY         0x00000020
+##### DISALLOW_ALL_TIX          0x00000040
+##### REQUIRES_PRE_AUTH         0x00000080
+##### REQUIRES_HW_AUTH          0x00000100
+##### REQUIRES_PWCHANGE         0x00000200
+##### DISALLOW_SVR              0x00001000
+##### PWCHANGE_SERVICE          0x00002000
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.8.1
+  NAME 'krbTicketFlags'
+  EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE)
+##### The maximum ticket lifetime for a principal in seconds
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.9.1
+  NAME 'krbMaxTicketLife'
+  EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE)
+##### Maximum renewable lifetime for a principal's ticket in seconds
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.10.1
+  NAME 'krbMaxRenewableAge'
+  EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE)
+##### Forward reference to the Realm object.
+##### (FDN of the krbRealmContainer object).
+##### Example:   cn=ACME.COM, cn=Kerberos, cn=Security
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.14.1
+  NAME 'krbRealmReferences'
+  EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
+##### List of LDAP servers that kerberos servers can contact.
+##### The attribute holds data in the ldap uri format,
+##### Example: ldaps://acme.com:636
+#####
+##### The values of this attribute need to be updated, when
+##### the LDAP servers listed here are renamed, moved or deleted.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.15.1
+  NAME 'krbLdapServers'
+  EQUALITY caseIgnoreMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15)
+##### A set of forward references to the KDC Service objects.
+##### (FDNs of the krbKdcService objects).
+##### Example:   cn=kdc - server 1, ou=uvw, o=xyz
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.17.1
+  NAME 'krbKdcServers'
+  EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
+##### A set of forward references to the Password Service objects.
+##### (FDNs of the krbPwdService objects).
+##### Example:   cn=kpasswdd - server 1, ou=uvw, o=xyz
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.18.1
+  NAME 'krbPwdServers'
+  EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
+##### This attribute holds the Host Name or the ip address, 
+##### transport protocol and ports of the kerberos service host
+##### The format is host_name-or-ip_address#protocol#port
+##### Protocol can be 0 or 1. 0 is for UDP. 1 is for TCP.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.24.1
+  NAME 'krbHostServer'
+  EQUALITY caseExactIA5Match
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26)
+##### This attribute holds the scope for searching the principals
+##### under krbSubTree attribute of krbRealmContainer
+##### The value can either be 1 (ONE) or 2 (SUB_TREE).
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.25.1
+  NAME 'krbSearchScope'
+  EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE)
+##### FDNs pointing to Kerberos principals
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.26.1
+  NAME 'krbPrincipalReferences'
+  EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
+##### This attribute specifies which attribute of the user objects  
+##### be used as the principal name component for Kerberos.
+##### The allowed values are cn, sn, uid, givenname, fullname.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.28.1
+  NAME 'krbPrincNamingAttr'
+  EQUALITY caseIgnoreMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  SINGLE-VALUE)
+##### A set of forward references to the Administration Service objects.
+##### (FDNs of the krbAdmService objects).
+##### Example:   cn=kadmindd - server 1, ou=uvw, o=xyz
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.29.1
+  NAME 'krbAdmServers'
+  EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
+##### Maximum lifetime of a principal's password
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.30.1
+  NAME 'krbMaxPwdLife'
+  EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+  SINGLE-VALUE)
+##### Minimum lifetime of a principal's password
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.31.1
+  NAME 'krbMinPwdLife'
+  EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+  SINGLE-VALUE)
+##### Minimum number of character clases allowed in a password
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.32.1
+  NAME 'krbPwdMinDiffChars' 
+  EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+  SINGLE-VALUE)
+##### Minimum length of the password
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.33.1
+  NAME 'krbPwdMinLength' 
+  EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+  SINGLE-VALUE)
+##### Number of previous versions of passwords that are stored
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.34.1
+  NAME 'krbPwdHistoryLength' 
+  EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+  SINGLE-VALUE)
+##### FDN pointing to a Kerberos Password Policy object
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.36.1
+  NAME 'krbPwdPolicyReference'
+  EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
+  SINGLE-VALUE)
+##### The time at which the principal's password expires
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.37.1
+  NAME 'krbPasswordExpiration'
+  EQUALITY generalizedTimeMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
+  SINGLE-VALUE)
+##### This attribute holds the principal's key (krbPrincipalKey) that is encrypted with
+##### the master key (krbMKey). 
+##### The attribute is ASN.1 encoded.
+#####
+##### The format of the value for this attribute is explained below,
+##### KrbKeySet ::= SEQUENCE {
+##### attribute-major-vno       [0] UInt16,
+##### attribute-minor-vno       [1] UInt16,
+##### kvno                      [2] UInt32,
+##### mkvno                     [3] UInt32 OPTIONAL,
+##### keys                      [4] SEQUENCE OF KrbKey,
+##### ...
+##### }
+#####
+##### KrbKey ::= SEQUENCE {
+##### salt      [0] KrbSalt OPTIONAL,
+##### key       [1] EncryptionKey,
+##### s2kparams [2] OCTET STRING OPTIONAL,
+##### ...
+##### }
+#####
+##### KrbSalt ::= SEQUENCE {
+##### type      [0] Int32,
+##### salt      [1] OCTET STRING OPTIONAL
+##### }
+#####
+##### EncryptionKey ::= SEQUENCE {
+##### keytype   [0] Int32,
+##### keyvalue  [1] OCTET STRING
+##### }
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.39.1
+  NAME 'krbPrincipalKey'
+  EQUALITY octetStringMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40)
+##### FDN pointing to a Kerberos Ticket Policy object.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.40.1
+  NAME 'krbTicketPolicyReference'
+  EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
+  SINGLE-VALUE)
+##### Forward reference to an entry that starts sub-trees
+##### where principals and other kerberos objects in the realm are configured.
+##### Example:   ou=acme, ou=pq, o=xyz
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.41.1
+  NAME 'krbSubTrees'
+  EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
+##### Holds the default encryption/salt type combinations of principals for
+##### the Realm. Stores in the form of key:salt strings.
+##### Example: des-cbc-crc:normal
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.42.1
+  NAME 'krbDefaultEncSaltTypes'
+  EQUALITY caseIgnoreMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15)
+##### Holds the Supported encryption/salt type combinations of principals for
+##### the Realm. Stores in the form of key:salt strings.
+##### The supported encryption types are mentioned in RFC 3961
+##### The supported salt types are,
+##### NORMAL          
+##### V4              
+##### NOREALM         
+##### ONLYREALM       
+##### SPECIAL         
+##### AFS3            
+##### Example: des-cbc-crc:normal
+#####
+##### This attribute obsoletes the krbSupportedEncTypes and krbSupportedSaltTypes
+##### attributes.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.43.1
+  NAME 'krbSupportedEncSaltTypes'
+  EQUALITY caseIgnoreMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15)
+##### This attribute holds the principal's old keys (krbPwdHistory) that is encrypted with
+##### the kadmin/history key.
+##### The attribute is ASN.1 encoded.
+#####
+##### The format of the value for this attribute is explained below,
+##### KrbKeySet ::= SEQUENCE {
+##### attribute-major-vno       [0] UInt16,
+##### attribute-minor-vno       [1] UInt16,
+##### kvno                      [2] UInt32,
+##### mkvno                     [3] UInt32 OPTIONAL -- actually kadmin/history key,
+##### keys                      [4] SEQUENCE OF KrbKey,
+##### ...
+##### }
+#####
+##### KrbKey ::= SEQUENCE {
+##### salt      [0] KrbSalt OPTIONAL,
+##### key       [1] EncryptionKey,
+##### s2kparams [2] OCTET STRING OPTIONAL,
+##### ...
+##### }
+#####
+##### KrbSalt ::= SEQUENCE {
+##### type      [0] Int32,
+##### salt      [1] OCTET STRING OPTIONAL
+##### }
+#####
+##### EncryptionKey ::= SEQUENCE {
+##### keytype   [0] Int32,
+##### keyvalue  [1] OCTET STRING
+##### }
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.44.1
+  NAME 'krbPwdHistory'
+  EQUALITY octetStringMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40)
+##### The time at which the principal's password last password change happened.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.45.1
+  NAME 'krbLastPwdChange'
+  EQUALITY generalizedTimeMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
+  SINGLE-VALUE)
+##### This attribute holds the kerberos master key.
+##### This can be used to encrypt principal keys. 
+##### This attribute has to be secured in directory.
+#####
+##### This attribute is ASN.1 encoded.
+##### The format of the value for this attribute is explained below,
+##### KrbMKey ::= SEQUENCE {
+##### kvno    [0] UInt32,
+##### key     [1] MasterKey
+##### }
+#####
+##### MasterKey ::= SEQUENCE {
+##### keytype         [0] Int32,
+##### keyvalue        [1] OCTET STRING
+##### }
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.46.1
+  NAME 'krbMKey'
+  EQUALITY octetStringMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40)
+##### This stores the alternate principal names for the principal in the RFC 1961 specified format
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.47.1
+  NAME 'krbPrincipalAliases'
+  EQUALITY caseExactIA5Match
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26)
+##### The time at which the principal's last successful authentication happened.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.48.1
+  NAME 'krbLastSuccessfulAuth'
+  EQUALITY generalizedTimeMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
+  SINGLE-VALUE)
+##### The time at which the principal's last failed authentication happened.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.49.1
+  NAME 'krbLastFailedAuth'
+  EQUALITY generalizedTimeMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
+  SINGLE-VALUE)
+##### This attribute stores the number of failed authentication attempts
+##### happened for the principal since the last successful authentication.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.50.1
+  NAME 'krbLoginFailedCount' 
+  EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+  SINGLE-VALUE)
+##### This attribute holds the application specific data.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.51.1
+  NAME 'krbExtraData'
+  EQUALITY octetStringMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40)
+##### This attributes holds references to the set of directory objects.
+##### This stores the DNs of the directory objects to which the 
+##### principal object belongs to.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.52.1
+  NAME 'krbObjectReferences'
+  EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
+##### This attribute holds references to a Container object where 
+##### the additional principal objects and stand alone principal 
+##### objects (krbPrincipal) can be created.
+olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.53.1
+  NAME 'krbPrincContainerRef'
+  EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
+########################################################################
+########################################################################
+#           Object Class Definitions                       #
+########################################################################
+#### This is a kerberos container for all the realms in a tree.
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.1.1
+  NAME 'krbContainer'
+  SUP top
+  MUST ( cn ) )
+##### The krbRealmContainer is created per realm and holds realm specific data.
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.2.1
+  NAME 'krbRealmContainer'
+  SUP top
+  MUST ( cn )
+  MAY ( krbMKey $ krbUPEnabled $ krbSubTrees $ krbSearchScope $ krbLdapServers $ krbSupportedEncSaltTypes $ krbDefaultEncSaltTypes $ krbTicketPolicyReference $ krbKdcServers $ krbPwdServers $ krbAdmServers $ krbPrincNamingAttr $krbPwdPolicyReference $ krbPrincContainerRef ) )
+##### An instance of a class derived from krbService is created per
+##### kerberos authentication or administration server in an realm and holds
+##### references to the realm objects. These references is used to further read
+##### realm specific data to service AS/TGS requests. Additionally this object
+##### contains some server specific data like pathnames and ports that the
+##### server uses. This is the identity the kerberos server logs in with. A key
+##### pair for the same is created and the kerberos server logs in with the same.
+#####
+##### krbKdcService, krbAdmService and krbPwdService derive from this class.
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.3.1
+  NAME 'krbService'
+  ABSTRACT
+  SUP ( top )
+  MUST ( cn )
+  MAY ( krbHostServer $ krbRealmReferences ) )
+##### Representative object for the KDC server to bind into a LDAP directory
+##### and have a connection to access Kerberos data with the required 
+##### access rights.
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.4.1
+  NAME 'krbKdcService'
+  SUP ( krbService ) )
+##### Representative object for the Kerberos Password server to bind into a LDAP directory
+##### and have a connection to access Kerberos data with the required
+##### access rights.
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.5.1
+  NAME 'krbPwdService'
+  SUP ( krbService ) )
+###### The principal data auxiliary class. Holds principal information
+###### and is used to store principal information for Person, Service objects.
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.8.1
+  NAME 'krbPrincipalAux'
+  AUXILIARY
+  MAY ( krbPrincipalName $ krbCanonicalName $ krbUPEnabled $ krbPrincipalKey $ krbTicketPolicyReference $ krbPrincipalExpiration $ krbPasswordExpiration $ krbPwdPolicyReference $ krbPrincipalType $ krbPwdHistory $ krbLastPwdChange $ krbPrincipalAliases $ krbLastSuccessfulAuth $ krbLastFailedAuth $ krbLoginFailedCount $ krbExtraData ) )
+###### This class is used to create additional principals and stand alone principals.
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.9.1
+  NAME 'krbPrincipal'
+  SUP ( top )
+  MUST ( krbPrincipalName )
+  MAY ( krbObjectReferences ) )
+###### The principal references auxiliary class. Holds all principals referred
+###### from a service
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.11.1
+  NAME 'krbPrincRefAux'
+  SUP top
+  AUXILIARY
+  MAY krbPrincipalReferences )
+##### Representative object for the Kerberos Administration server to bind into a LDAP directory
+##### and have a connection Id to access Kerberos data with the required access rights.
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.13.1
+  NAME 'krbAdmService'
+  SUP ( krbService ) )
+##### The krbPwdPolicy object is a template password policy that 
+##### can be applied to principals when they are created. 
+##### These policy attributes will be in effect, when the Kerberos
+##### passwords are different from users' passwords (UP).
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.14.1
+  NAME 'krbPwdPolicy' 
+  SUP top
+  MUST ( cn )
+  MAY ( krbMaxPwdLife $ krbMinPwdLife $ krbPwdMinDiffChars $ krbPwdMinLength $ krbPwdHistoryLength ) )
+##### The krbTicketPolicyAux holds Kerberos ticket policy attributes.
+##### This class can be attached to a principal object or realm object.
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.16.1
+  NAME 'krbTicketPolicyAux'
+  AUXILIARY
+  MAY ( krbTicketFlags $ krbMaxTicketLife $ krbMaxRenewableAge ) )
+##### The krbTicketPolicy object is an effective ticket policy that is associated with a realm or a principal
+olcObjectClasses: ( 2.16.840.1.113719.1.301.6.17.1
+  NAME 'krbTicketPolicy'
+  SUP top
+  MUST ( cn ) )

=== added file 'mit-kerberos/mit-refint-overlay.ldif'
--- mit-kerberos/mit-refint-overlay.ldif	1970-01-01 00:00:00 +0000
+++ mit-kerberos/mit-refint-overlay.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,7 @@
+dn: olcOverlay={3}refint,olcDatabase={1}hdb,cn=config
+changetype: modify
+add: olcRefintAttribute
+olcRefintAttribute: krbObjectReferences
+-
+add: olcRefintAttribute
+olcRefintAttribute: krbPwdPolicyReference

=== removed directory 'modules'
=== removed file 'modules/add-modules.ldif'
--- modules/add-modules.ldif	2009-09-11 14:28:41 +0000
+++ modules/add-modules.ldif	1970-01-01 00:00:00 +0000
@@ -1,10 +0,0 @@
-dn: cn=module,cn=config
-cn: module
-objectClass: olcModuleList
-olcModuleLoad: back_hdb.la
-olcModuleLoad: back_bdb.la
-olcModuleLoad: ppolicy.la
-olcModuleLoad: unique.la
-olcModuleLoad: back_monitor.la
-olcModuleLoad: refint.la
-olcModuleLoad: syncprov.la

=== added directory 'monitor'
=== added file 'monitor/README'
--- monitor/README	1970-01-01 00:00:00 +0000
+++ monitor/README	2010-07-19 21:25:56 +0000
@@ -0,0 +1,1 @@
+TODO

=== added file 'monitor/acl.ldif'
--- monitor/acl.ldif	1970-01-01 00:00:00 +0000
+++ monitor/acl.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,12 @@
+dn: olcDatabase=monitor,cn=config
+changetype: modify
+add: olcAccess
+olcAccess: to dn.subtree="" 
+  by dn.exact="uid=LDAP Monitor,ou=System Accounts,@SUFFIX@" read 
+  by * none
+-
+add: olcAccess
+olcAccess: to dn.subtree="" 
+  by group/groupOfMembers/member.exact="cn=LDAP Admins,ou=System Groups,@SUFFIX@" read 
+  by group/groupOfMembers/member.exact="cn=LDAP Monitors,ou=System Groups,@SUFFIX@" read
+  by * none

=== added file 'monitor/database.ldif'
--- monitor/database.ldif	1970-01-01 00:00:00 +0000
+++ monitor/database.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,7 @@
+dn: olcDatabase=monitor,cn=config
+changetype: add
+objectClass: olcMonitorConfig
+objectClass: olcDatabaseConfig
+objectClass: olcConfig
+olcDatabase: monitor
+olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

=== added file 'monitor/modules.ldif'
--- monitor/modules.ldif	1970-01-01 00:00:00 +0000
+++ monitor/modules.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,4 @@
+dn: cn=module,cn=config
+changetype: modify
+add: olcModuleLoad
+olcModuleLoad: back_monitor.la

=== removed file 'openldap-dit-setup.sh'
--- openldap-dit-setup.sh	2009-12-02 20:23:12 +0000
+++ openldap-dit-setup.sh	1970-01-01 00:00:00 +0000
@@ -1,394 +0,0 @@
-#!/bin/bash
-
-if [ "`id -u`" != "0" ]; then
-	echo "Error, must be root user"
-	exit 1
-fi
-
-LDAPWHOAMI="ldapwhoami -H ldapi:/// -Y EXTERNAL -Q"
-LDAPADD="ldapadd -H ldapi:/// -Y EXTERNAL -Q"
-LDAPMODIFY="ldapmodify -H ldapi:/// -Y EXTERNAL -Q"
-LDAPPASSWD="ldappasswd -H ldapi:/// -Y EXTERNAL -Q"
-
-function distro_guess()
-{
-#$ cat /etc/lsb-release 
-#DISTRIB_ID=Ubuntu
-#DISTRIB_RELEASE=8.04
-#DISTRIB_CODENAME=hardy
-#DISTRIB_DESCRIPTION="Ubuntu 8.04"
-    if [ -r "/etc/lsb-release" ]; then
-        source /etc/lsb-release
-    else
-        echo "Can't guess distro name (no /etc/lsb-release or it's not readable)"
-        exit 1
-    fi
-    if [ -z "$DISTRIB_ID" -o -z "$DISTRIB_RELEASE" ]; then
-        echo "No DISTRIB_ID or DISTRIB_RELEASE variable(s) in /etc/lsb-release"
-        exit 1
-    fi
-    DISTRIB_ID=`echo $DISTRIB_ID | tr A-Z a-z`
-    export DISTRIB_ID DISTRIB_RELEASE
-    echo $DISTRIB_ID
-    return 0
-}
-
-function ubuntu_setup()
-{
-    if [ -x /usr/sbin/invoke-rc.d ]; then
-        SERVICE="/usr/sbin/invoke-rc.d slapd"
-    else
-        SERVICE="/etc/init.d/slapd"
-    fi
-    export root="/usr/share/slapd/openldap-dit"
-    export databases_dir="$root/databases"
-    export schemas_dir="$root/schemas"
-    export acls_dir="$root/acls"
-    export modules_dir="$root/modules"
-    export overlays_dir="$root/overlays"
-    export contents_dir="$root/contents"
-
-    for package in slapd ldap-utils libsasl2-modules; do
-        if ! dpkg -l $package 2>/dev/null | grep -q ^ii; then
-            echo "Error, please install package $package"
-            exit 1
-        fi
-    done
-
-    return 0
-}
-
-function usage() {
-	echo "Usage:"
-	echo "$0 [-h | --help] [-v] [-d <dnsdomain>] [-p <password>] [-y]"
-	echo
-	echo "-h | --help    : shows this help"
-	echo "-v             : verbose mode"
-	echo "-d <dnsdomain> : use <dnsdomain> for dns domain"
-	echo "-p <password>  : use <password> for LDAP Admin password"
-	echo 
-	echo "-y             : assume default answer in all prompts "
-	echo "                 except the password one"
-}
-
-function echo_v() {
-	if [ -n "$verbose" ]; then
-		echo "== $@"
-	fi
-}
-
-# output: stdout: example.com or the possible detected domain
-function detect_domain() {
-	mydomain=`hostname -d`
-	if [ -z "$mydomain" ]; then
-		mydomain="example.com"
-	fi
-	echo "$mydomain"
-	return 0
-}
-
-# $1: domain
-# returns standard dc=foo,dc=bar suffix on stdout
-function calc_suffix() {
-	old_ifs=${IFS}
-	IFS="."
-	for component in $1; do
-		result="$result,dc=$component"
-	done
-	IFS="${old_ifs}"
-	echo "${result#,}"
-	return 0
-}
-
-# test if sasl external works and maps us to something
-function test_auth() {
-    out=$($LDAPWHOAMI)
-    [ "$?" -ne "0" ] && return 1
-    # XXX - too specific for ubuntu's ldap deployment...
-    # a better test would be slapacl, but I couldn't get it
-    # to work
-    if [ "$out" = "dn:cn=localroot,cn=config" ]; then
-        return 0
-    else
-        return 1
-    fi
-}
-
-function get_admin_password() {
-	echo
-	echo "Administrator account"
-	echo
-	echo "The administrator account for this directory is"
-	echo "uid=LDAP Admin,ou=System Accounts,$mysuffix"
-	echo
-	echo "Please choose a password for this account:"
-	while /bin/true; do
-        echo -n "New password: "
-        stty -echo
-        read pass1
-        stty echo
-        echo
-        if [ -z "$pass1" ]; then
-            echo "Error, password cannot be empty"
-            echo
-            continue
-        fi
-        echo -n "Repeat new password: "
-        stty -echo
-        read pass2
-        stty echo
-        echo
-        if [ "$pass1" != "$pass2" ]; then
-            echo "Error, passwords don't match"
-            echo
-            continue
-        fi
-        pass="$pass1"
-        break
-	done
-    if [ -n "$pass" ]; then
-        return 0
-    fi
-    return 1
-}
-
-function check_result() {
-    if [ "$1" -ne "0" ]; then
-        echo "ERROR, aborting"
-        exit 1
-    else
-        echo "Succeeded!"
-    fi
-}
-
-# $1: descriptive text of what is being added
-# $2: directory where the files are
-# $3: optional sed expression to use
-function add_ldif() {
-    echo "Adding $1..."
-    for n in $2/*.ldif; do
-        if [ -z "$n" ]; then
-            echo "Error, no file to use!"
-            return 1
-        fi
-        if [ -z "$3" ]; then
-            cat "$n" | $LDAPADD
-        else
-            cat "$n" | sed -e "$3" | $LDAPADD
-        fi
-        if [ "$?" -ne "0" ]; then
-            echo "Error using \"$n\", aborting"
-            exit 1
-        fi
-    done
-    return 0
-}
-
-# $1: descriptive text of what is being added
-# $2: directory where the files are
-# $3: optional sed expression to use
-function modify_ldif() {
-    echo "Modifying $1..."
-    for n in $2/*.ldif; do
-        if [ -z "$n" ]; then
-            echo "Error, no file to use!"
-            return 1
-        fi
-        if [ -z "$3" ]; then
-            cat "$n" | $LDAPMODIFY
-        else
-            cat "$n" | sed -e "$3" | $LDAPMODIFY
-        fi
-        if [ "$?" -ne "0" ]; then
-            echo "Error using \"$n\", aborting"
-            return 1
-        fi
-    done
-    return 0
-}
-
-function add_modules() {
-    add_ldif "modules" "$modules_dir"
-    return 0
-}
-
-function add_schemas() {
-    add_ldif "schemas" "$schemas_dir"
-    return 0
-}
-
-function add_db () {
-    add_ldif "database" "$databases_dir" "s/@SUFFIX@/$mysuffix/g"
-    return 0
-}
-
-function modify_acls() {
-    modify_ldif "ACLs" "$acls_dir" "s/@SUFFIX@/$mysuffix/g"
-    return 0
-}
-
-function add_overlays() {
-    add_ldif "overlays" "$overlays_dir" "s/@SUFFIX@/$mysuffix/g"
-    return 0
-}
-
-function populate_db() {
-    add_ldif "populated database" "$contents_dir" "s/@SUFFIX@/$mysuffix/g;s/@DC@/${mydomain%%.[a-zA-Z0-9]*}/g;s/@DOMAIN@/${mydomain}/g"
-    return 0
-}
-
-function set_admin_password() {
-    echo "Setting the admin password..."
-    # XXX - password will show up briefly in the command line and process
-    # list
-    $LDAPPASSWD -s "$pass" "uid=LDAP Admin,ou=System Accounts,$mysuffix"
-    return $?
-}
-
-
-now=`date +%s`
-myfqdn=`hostname -f`
-verbose=
-noprompt=
-if [ -z "$myfqdn" ]; then
-	myfqdn="localhost"
-fi
-distro=`distro_guess`
-${distro}_setup
-
-while [ -n "$1" ]; do
-	case "$1" in
-		-h | --help)
-		usage
-		exit 1
-		;;
-		-v)
-		verbose=1
-		shift
-		;;
-		-d)
-		shift
-		if [ -n "$1" -a "${1##-}" != "${1}" -o -z "${1}" ]; then
-			echo "Error, -d requires an argument"
-			exit 1
-		fi
-		mydomain="$1"
-		shift
-		;;
-		-p)
-		shift
-		if [ -n "$1" -a "${1##-}" != "${1}" -o -z "${1}" ]; then
-			echo "Error, -p requires an argument"
-			exit 1
-		fi
-		mypass="$1"
-		shift
-		;;
-		-y)
-		noprompt=1
-		shift
-		;;
-	esac
-done
-
-echo_v
-echo_v "Running in verbose mode"
-echo_v
-
-
-# testing
-echo "Testing administrative access to local ldap server"
-test_auth
-if [ "$?" -eq "0" ]; then
-    echo "Success!"
-else
-    echo "FAILURE!"
-    echo "Command \"$LDAPWHOAMI\" failed"
-    exit 1
-fi
-
-if [ -z "$mydomain" ]; then
-	mydomain=`detect_domain`
-	if [ -z "$noprompt" ]; then
-		echo "Please enter your DNS domain name [$mydomain]:"
-		read inputdomain
-		if [ -n "$inputdomain" ]; then
-			mydomain="$inputdomain"
-		fi
-	fi
-fi
-mysuffix=`calc_suffix $mydomain`
-
-if [ -z "$mypass" ]; then
-    get_admin_password
-else
-	pass="$mypass"
-fi
-
-# confirmation
-echo
-echo
-echo "Summary"
-echo "======="
-echo
-echo "Domain:        $mydomain"
-echo "LDAP suffix:   $mysuffix"
-echo "Administrator: uid=LDAP Admin,ou=System Accounts,$mysuffix"
-echo
-if [ -z "$noprompt" ]; then
-	echo "Confirm? (Y/n)"
-	read val
-	if [ "$val" = "n" -o "$val" = "N" ]; then
-		echo
-		echo "Cancelled."
-		exit 1
-	fi
-fi
-
-# steps:
-# - add modules
-# - add schema
-# - add db + its acls
-# - modify frontend acls
-# - modify config acls
-# - add overlays
-# - populate db
-# - set password for admin
-
-add_modules
-check_result $?
-
-add_schemas
-check_result $?
-
-add_db
-check_result $?
-
-modify_acls
-check_result $?
-
-add_overlays
-check_result $?
-
-populate_db
-check_result $?
-
-set_admin_password
-check_result $?
-
-echo
-echo "Finished, doing one last restart..."
-/etc/init.d/slapd restart
-check_result $?
-
-echo
-echo "Done, enjoy!"
-echo
-echo "Remember: this is your administrator bind dn:"
-echo "uid=LDAP Admin,ou=System Accounts,$mysuffix"
-echo
-echo "You can use it in double quotes in the command line, like:"
-echo "ldapwhoami -x -D \"uid=LDAP Admin,ou=System Accounts,$mysuffix\" -W "
-echo
-
-

=== removed directory 'overlays'
=== removed file 'overlays/1_add-ppolicy-overlay.ldif'
--- overlays/1_add-ppolicy-overlay.ldif	2009-12-02 19:40:56 +0000
+++ overlays/1_add-ppolicy-overlay.ldif	1970-01-01 00:00:00 +0000
@@ -1,6 +0,0 @@
-dn: olcOverlay=ppolicy,olcDatabase={1}hdb,cn=config
-objectClass: olcOverlayConfig
-objectClass: olcPPolicyConfig
-olcOverlay: ppolicy
-olcPPolicyDefault: cn=default,ou=password policies,@SUFFIX@
-

=== removed file 'overlays/2_add-unique-overlay.ldif'
--- overlays/2_add-unique-overlay.ldif	2009-12-02 19:40:56 +0000
+++ overlays/2_add-unique-overlay.ldif	1970-01-01 00:00:00 +0000
@@ -1,11 +0,0 @@
-dn: olcOverlay=unique,olcDatabase={1}hdb,cn=config
-objectClass: olcUniqueConfig
-objectClass: olcOverlayConfig
-objectClass: olcConfig
-objectClass: top
-olcOverlay: unique
-olcUniqueURI: ldap:///ou=People,@SUFFIX@?uidNumber
- ?one?(objectClass=posixAccount)
-olcUniqueURI: ldap:///ou=Group,@SUFFIX@?gidNumber?one?(objectClass=po
- sixGroup)
-

=== removed file 'overlays/3_add-syncprov-overlay.ldif'
--- overlays/3_add-syncprov-overlay.ldif	2009-12-02 19:40:56 +0000
+++ overlays/3_add-syncprov-overlay.ldif	1970-01-01 00:00:00 +0000
@@ -1,9 +0,0 @@
-dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config
-objectClass: olcSyncProvConfig
-objectClass: olcOverlayConfig
-objectClass: olcConfig
-objectClass: top
-olcOverlay: syncprov
-olcSpCheckpoint: 100 10
-olcSpSessionlog: 100
-

=== removed file 'overlays/4_add-refint-overlay.ldif'
--- overlays/4_add-refint-overlay.ldif	2009-12-02 19:40:56 +0000
+++ overlays/4_add-refint-overlay.ldif	1970-01-01 00:00:00 +0000
@@ -1,10 +0,0 @@
-dn: olcOverlay=refint,olcDatabase={1}hdb,cn=config
-olcOverlay: refint
-objectClass: olcConfig
-objectClass: olcOverlayConfig
-objectClass: olcRefintConfig
-olcRefintAttribute: member
-olcRefintAttribute: krbObjectReferences
-olcRefintAttribute: krbPwdPolicyReference
-olcRefintNothing: cn=localroot,cn=config
-

=== added directory 'replication'
=== added file 'replication/replication-acl.ldif'
--- replication/replication-acl.ldif	1970-01-01 00:00:00 +0000
+++ replication/replication-acl.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,7 @@
+olcAccess: {0}to dn.subtree="@SUFFIX@" 
+  by group/groupOfMembers/member.exact="cn=ldap replicators,ou=system groups,@SUFFIX@" read
+  by * break
+
+olcLimits: {0}group/groupOfMembers/member="cn=ldap replicators,ou=system groups,@SUFFIX@"
+  size=unlimited
+  time=unlimited

=== added file 'replication/replication-dit.ldif'
--- replication/replication-dit.ldif	1970-01-01 00:00:00 +0000
+++ replication/replication-dit.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,14 @@
+dn: uid=LDAP Replicator,ou=System Accounts,@SUFFIX@
+uid: LDAP Replicator
+objectClass: account
+objectClass: simpleSecurityObject
+userPassword: {CRYPT}x
+description: Account used by consumer servers for replication
+
+dn: cn=LDAP Replicators,ou=System Groups,@SUFFIX@
+cn: LDAP Replicators
+objectClass: groupOfMembers
+description: Members can be used for syncrepl replication
+owner: uid=LDAP Replicator,ou=System Accounts,@SUFFIX@
+member: uid=LDAP Replicator,ou=System Accounts,@SUFFIX@
+

=== added file 'replication/replication-modules.ldif'
--- replication/replication-modules.ldif	1970-01-01 00:00:00 +0000
+++ replication/replication-modules.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,4 @@
+dn: cn=module,cn=config
+changetype: add
+add: olcModuleLoad
+olcModuleLoad: syncprov.la

=== added file 'replication/syncprov-overlay.ldif'
--- replication/syncprov-overlay.ldif	1970-01-01 00:00:00 +0000
+++ replication/syncprov-overlay.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,9 @@
+dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config
+objectClass: olcSyncProvConfig
+objectClass: olcOverlayConfig
+objectClass: olcConfig
+objectClass: top
+olcOverlay: syncprov
+olcSpCheckpoint: 100 10
+olcSpSessionlog: 100
+

=== added directory 'samba'
=== added file 'samba/samba-acl.ldif'
--- samba/samba-acl.ldif	1970-01-01 00:00:00 +0000
+++ samba/samba-acl.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,47 @@
+dn: olcDatabase={1}hdb,cn=config
+changetype: modify
+add: olcDbIndex
+olcDbIndex: sambaDomainName eq
+-
+add: olcDbIndex
+olcDbIndex: sambaSID eq,sub
+-
+add: olcDbIndex
+olcDbIndex: sambaGroupType eq
+-
+add: olcDbIndex
+olcDbIndex: sambaSIDList eq
+-
+delete: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@" by * read
+-
+add: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@"
+  attrs=sambaLMPassword,sambaNTPassword
+  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
+  by anonymous auth
+  by self write
+  by * none
+-
+add: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@"
+  attrs=sambaPasswordHistory,pwdHistory
+  by self read
+  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
+  by * none
+-
+add: olcAccess
+olcAccess: to dn.regex="^(sambaDomainName=[^,]+,)?@SUFFIX@$"
+  attrs=children,entry,@sambaDomain,@sambaUnixIdPool
+  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
+  by * read
+-
+add: olcAccess
+olcAccess: to dn.regex="^(sambaSID=[^,]+,)?ou=Idmap,@SUFFIX@$"
+  attrs=children,entry,@sambaIdmapEntry
+  by group/groupOfMembers/member.exact="cn=account admins,ou=system groups,@SUFFIX@" write
+  by group/groupOfMembers/member.exact="cn=idmap admins,ou=system groups,@SUFFIX@" write
+  by * read
+-
+add: olcAccess
+olcAccess: to dn.subtree="@SUFFIX@" by * read

=== added file 'samba/samba-dit.ldif'
--- samba/samba-dit.ldif	1970-01-01 00:00:00 +0000
+++ samba/samba-dit.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,19 @@
+dn: ou=Idmap,@SUFFIX@
+ou: Idmap
+objectClass: organizationalUnit
+description: Container for Samba Winbind ID mappings
+
+dn: uid=Idmap Admin,ou=System Accounts,@SUFFIX@
+uid: Idmap Admin
+objectClass: account
+objectClass: simpleSecurityObject
+userPassword: {CRYPT}x
+description: Account used to administer Samba Winbind ID mapping related entries and attributes
+
+dn: cn=Idmap Admins,ou=System Groups,@SUFFIX@
+cn: Idmap Admins
+objectClass: groupOfMembers
+description: Members can administer ou=Idmap entries and attributes
+owner: uid=Idmap Admin,ou=System Accounts,@SUFFIX@
+member: uid=Idmap Admin,ou=System Accounts,@SUFFIX@
+

=== added file 'samba/samba-schema.ldif'
--- samba/samba-schema.ldif	1970-01-01 00:00:00 +0000
+++ samba/samba-schema.ldif	2010-07-19 21:25:56 +0000
@@ -0,0 +1,175 @@
+dn: cn=samba,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: samba
+olcAttributeTypes: {0}( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'L
+ anManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.26{32} SINGLE-VALUE )
+olcAttributeTypes: {1}( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'M
+ D4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.26{32} SINGLE-VALUE )
+olcAttributeTypes: {2}( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Ac
+ count Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+ {16} SINGLE-VALUE )
+olcAttributeTypes: {3}( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet' DESC 'T
+ imestamp of the last password update' EQUALITY integerMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {4}( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange' DESC 
+ 'Timestamp of when the user is allowed to update the password' EQUALITY integ
+ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {5}( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange' DESC
+  'Timestamp of when the password will expire' EQUALITY integerMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {6}( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime' DESC 'Ti
+ mestamp of last logon' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE )
+olcAttributeTypes: {7}( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime' DESC 'T
+ imestamp of last logoff' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.27 SINGLE-VALUE )
+olcAttributeTypes: {8}( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime' DESC '
+ Timestamp of when the user will be logged off automatically' EQUALITY integer
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {9}( 1.3.6.1.4.1.7165.2.1.48 NAME 'sambaBadPasswordCount' D
+ ESC 'Bad password attempt count' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {10}( 1.3.6.1.4.1.7165.2.1.49 NAME 'sambaBadPasswordTime' D
+ ESC 'Time of the last bad password attempt' EQUALITY integerMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {11}( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours' DESC '
+ Logon Hours' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+ {42} SINGLE-VALUE )
+olcAttributeTypes: {12}( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'D
+ river letter of home directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE )
+olcAttributeTypes: {13}( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC 
+ 'Logon script path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15{255} SINGLE-VALUE )
+olcAttributeTypes: {14}( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC 
+ 'Roaming profile path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15{255} SINGLE-VALUE )
+olcAttributeTypes: {15}( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' 
+ DESC 'List of user workstations the user is allowed to logon to' EQUALITY cas
+ eIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
+olcAttributeTypes: {16}( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Ho
+ me directory UNC path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15{128} )
+olcAttributeTypes: {17}( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC '
+ Windows NT domain to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15{128} )
+olcAttributeTypes: {18}( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial' DESC '
+ Base64 encoded user parameter string' EQUALITY caseExactMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.15{1050} )
+olcAttributeTypes: {19}( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory' D
+ ESC 'Concatenated MD4 hashes of the unicode passwords used on this account' E
+ QUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} )
+olcAttributeTypes: {20}( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Securit
+ y ID' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
+olcAttributeTypes: {21}( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' D
+ ESC 'Primary Group Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.26{64} SINGLE-VALUE )
+olcAttributeTypes: {22}( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList' DESC 'Sec
+ urity ID List' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 26{64} )
+olcAttributeTypes: {23}( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType' DESC 'N
+ T Group Type' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SING
+ LE-VALUE )
+olcAttributeTypes: {24}( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid' DESC 
+ 'Next NT rid to give our for users' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {25}( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid' DESC
+  'Next NT rid to give out for groups' EQUALITY integerMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {26}( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid' DESC 'Nex
+ t NT rid to give out for anything' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {27}( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase
+ ' DESC 'Base at which the samba RID generation algorithm should operate' EQUA
+ LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {28}( 1.3.6.1.4.1.7165.2.1.41 NAME 'sambaShareName' DESC 'S
+ hare Name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SING
+ LE-VALUE )
+olcAttributeTypes: {29}( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName' DESC '
+ Option Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: {30}( 1.3.6.1.4.1.7165.2.1.43 NAME 'sambaBoolOption' DESC '
+ A boolean option' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 S
+ INGLE-VALUE )
+olcAttributeTypes: {31}( 1.3.6.1.4.1.7165.2.1.44 NAME 'sambaIntegerOption' DES
+ C 'An integer option' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .27 SINGLE-VALUE )
+olcAttributeTypes: {32}( 1.3.6.1.4.1.7165.2.1.45 NAME 'sambaStringOption' DESC
+  'A string option' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.26 SINGLE-VALUE )
+olcAttributeTypes: {33}( 1.3.6.1.4.1.7165.2.1.46 NAME 'sambaStringListOption' 
+ DESC 'A string list option' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15 )
+olcAttributeTypes: {34}( 1.3.6.1.4.1.7165.2.1.53 NAME 'sambaTrustFlags' DESC '
+ Trust Password Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.26 )
+olcAttributeTypes: {35}( 1.3.6.1.4.1.7165.2.1.58 NAME 'sambaMinPwdLength' DESC
+  'Minimal password length (default: 5)' EQUALITY integerMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {36}( 1.3.6.1.4.1.7165.2.1.59 NAME 'sambaPwdHistoryLength' 
+ DESC 'Length of Password History Entries (default: 0 => off)' EQUALITY intege
+ rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {37}( 1.3.6.1.4.1.7165.2.1.60 NAME 'sambaLogonToChgPwd' DES
+ C 'Force Users to logon for password change (default: 0 => off, 2 => on)' EQU
+ ALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {38}( 1.3.6.1.4.1.7165.2.1.61 NAME 'sambaMaxPwdAge' DESC 'M
+ aximum password age, in seconds (default: -1 => never expire passwords)' EQUA
+ LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {39}( 1.3.6.1.4.1.7165.2.1.62 NAME 'sambaMinPwdAge' DESC 'M
+ inimum password age, in seconds (default: 0 => allow immediate password chang
+ e)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {40}( 1.3.6.1.4.1.7165.2.1.63 NAME 'sambaLockoutDuration' D
+ ESC 'Lockout duration in minutes (default: 30, -1 => forever)' EQUALITY integ
+ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {41}( 1.3.6.1.4.1.7165.2.1.64 NAME 'sambaLockoutObservation
+ Window' DESC 'Reset time after lockout in minutes (default: 30)' EQUALITY int
+ egerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {42}( 1.3.6.1.4.1.7165.2.1.65 NAME 'sambaLockoutThreshold' 
+ DESC 'Lockout users after bad logon attempts (default: 0 => off)' EQUALITY in
+ tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {43}( 1.3.6.1.4.1.7165.2.1.66 NAME 'sambaForceLogoff' DESC 
+ 'Disconnect Users outside logon hours (default: -1 => off, 0 => on)' EQUALITY
+  integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {44}( 1.3.6.1.4.1.7165.2.1.67 NAME 'sambaRefuseMachinePwdCh
+ ange' DESC 'Allow Machine Password changes (default: 0 => off)' EQUALITY inte
+ gerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcObjectClasses: {0}( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' DESC 'Sam
+ ba 3.0 Auxilary SAM Account' SUP top AUXILIARY MUST ( uid $ sambaSID ) MAY ( 
+ cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ s
+ ambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $ 
+ sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScr
+ ipt $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPrimaryGr
+ oupSID $ sambaDomainName $ sambaMungedDial $ sambaBadPasswordCount $ sambaBad
+ PasswordTime $ sambaPasswordHistory $ sambaLogonHours ) )
+olcObjectClasses: {1}( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' DESC 'S
+ amba Group Mapping' SUP top AUXILIARY MUST ( gidNumber $ sambaSID $ sambaGrou
+ pType ) MAY ( displayName $ description $ sambaSIDList ) )
+olcObjectClasses: {2}( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' DESC 
+ 'Samba Trust Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaNTPas
+ sword $ sambaTrustFlags ) MAY ( sambaSID $ sambaPwdLastSet ) )
+olcObjectClasses: {3}( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' DESC 'Samba D
+ omain Information' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID ) MAY
+  ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidB
+ ase $ sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgPwd $ sambaM
+ axPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ sambaLockoutObservationWin
+ dow $ sambaLockoutThreshold $ sambaForceLogoff $ sambaRefuseMachinePwdChange 
+ ) )
+olcObjectClasses: {4}( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' DESC 'Poo
+ l for allocating UNIX uids/gids' SUP top AUXILIARY MUST ( uidNumber $ gidNumb
+ er ) )
+olcObjectClasses: {5}( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' DESC 'Map
+ ping from a SID to an ID' SUP top AUXILIARY MUST sambaSID MAY ( uidNumber $ g
+ idNumber ) )
+olcObjectClasses: {6}( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' DESC 'Struc
+ tural Class for a SID' SUP top STRUCTURAL MUST sambaSID )
+olcObjectClasses: {7}( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' DESC 'Samba 
+ Configuration Section' SUP top AUXILIARY MAY description )
+olcObjectClasses: {8}( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' DESC 'Samba S
+ hare Section' SUP top STRUCTURAL MUST sambaShareName MAY description )
+olcObjectClasses: {9}( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' DESC '
+ Samba Configuration Option' SUP top STRUCTURAL MUST sambaOptionName MAY ( sam
+ baBoolOption $ sambaIntegerOption $ sambaStringOption $ sambaStringListoption
+  $ description ) )

=== removed directory 'schemas'
=== removed file 'schemas/autofs.ldif'
--- schemas/autofs.ldif	2009-09-11 14:25:59 +0000
+++ schemas/autofs.ldif	1970-01-01 00:00:00 +0000
@@ -1,11 +0,0 @@
-dn: cn=autofs,cn=schema,cn=config
-objectClass: olcSchemaConfig
-cn: autofs
-olcAttributeTypes: {0}( 1.3.6.1.1.1.1.25 NAME 'automountInformation' DESC 'Inf
- ormation used by the autofs automounter' EQUALITY caseExactIA5Match SYNTAX 1.
- 3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
-olcObjectClasses: {0}( 1.3.6.1.1.1.1.13 NAME 'automount' DESC 'An entry in an 
- automounter map' SUP top STRUCTURAL MUST ( cn $ automountInformation ) MAY de
- scription )
-olcObjectClasses: {1}( 1.3.6.1.4.1.2312.4.2.2 NAME 'automountMap' DESC 'An gro
- up of related automount objects' SUP top STRUCTURAL MUST ou )

=== removed file 'schemas/cosine.ldif'
--- schemas/cosine.ldif	2009-09-11 14:25:59 +0000
+++ schemas/cosine.ldif	1970-01-01 00:00:00 +0000
@@ -1,200 +0,0 @@
-# RFC1274: Cosine and Internet X.500 schema
-# $OpenLDAP: pkg/ldap/servers/slapd/schema/cosine.ldif,v 1.1.2.4 2009/01/22 00:01:14 kurt Exp $
-## This work is part of OpenLDAP Software <http://www.openldap.org/>.
-##
-## Copyright 1998-2009 The OpenLDAP Foundation.
-## All rights reserved.
-##
-## Redistribution and use in source and binary forms, with or without
-## modification, are permitted only as authorized by the OpenLDAP
-## Public License.
-##
-## A copy of this license is available in the file LICENSE in the
-## top-level directory of the distribution or, alternatively, at
-## <http://www.OpenLDAP.org/license.html>.
-#
-# RFC1274: Cosine and Internet X.500 schema
-#
-# This file contains LDAPv3 schema derived from X.500 COSINE "pilot"
-# schema.  As this schema was defined for X.500(89), some
-# oddities were introduced in the mapping to LDAPv3.  The
-# mappings were based upon: draft-ietf-asid-ldapv3-attributes-03.txt
-# (a work in progress)
-#
-# Note: It seems that the pilot schema evolved beyond what was
-# described in RFC1274.  However, this document attempts to describes
-# RFC1274 as published.
-#
-# Depends on core.ldif
-#
-# This file was automatically generated from cosine.schema; see that
-# file for complete background.
-#
-dn: cn=cosine,cn=schema,cn=config
-objectClass: olcSchemaConfig
-cn: cosine
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress' 
- EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.
- 1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: g
- eneral information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteDri
- nk' ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR caseIgno
- reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RFC1
- 274: room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S
- YNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274: 
- photo (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC12
- 74: category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat
- ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: h
- ost computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA
- X 1.3.6.1.4.1.1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC127
- 4: DN of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115
- .121.1.12 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' D
- ESC 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUBSTR 
- caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC '
- RFC1274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstri
- ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' DES
- C 'RFC1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu
- bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DESC
-  'RFC1274: DN of author of document' EQUALITY distinguishedNameMatch SYNTAX 1
- .3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DE
- SC 'RFC1274: location of document original' EQUALITY caseIgnoreMatch SUBSTR c
- aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'homeTe
- lephoneNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephoneNumb
- erMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121
- .1.50 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'RFC
- 1274: DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.146
- 6.115.121.1.12 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX
-  1.3.6.1.4.1.1466.115.121.1.39 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY ca
- seIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY c
- aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY c
- aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY c
- aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALITY 
- caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALIT
- Y caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC
-  'RFC1274: DN of entry associated with domain' EQUALITY distinguishedNameMatc
- h SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress' D
- ESC 'RFC1274: home postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIg
- noreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.40 NAME 'personalTitle' DESC 
- 'RFC1274: personal title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
- sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.41 NAME ( 'mobile' 'mobileTel
- ephoneNumber' ) DESC 'RFC1274: mobile telephone number' EQUALITY telephoneNum
- berMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
- 1.1.50 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.42 NAME ( 'pager' 'pagerTelep
- honeNumber' ) DESC 'RFC1274: pager telephone number' EQUALITY telephoneNumber
- Match SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
- .50 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.43 NAME ( 'co' 'friendlyCount
- ryName' ) DESC 'RFC1274: friendly country name' EQUALITY caseIgnoreMatch SUBS
- TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier' DE
- SC 'RFC1274: unique identifer' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.14
- 66.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus
- ' DESC 'RFC1274: organizational status' EQUALITY caseIgnoreMatch SUBSTR caseI
- gnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox' DESC '
- RFC1274: Janet mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst
- ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOption
- ' DESC 'RFC1274: mail preference option' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.48 NAME 'buildingName' DESC '
- RFC1274: name of building' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrin
- gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality' DESC 'RF
- C1274: DSA Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.19 SINGLE-VALUE )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality' 
- DESC 'RFC1274: Single Level Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SIN
- GLE-VALUE )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQualit
- y' DESC 'RFC1274: Subtree Mininum Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
- 13 SINGLE-VALUE )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQualit
- y' DESC 'RFC1274: Subtree Maximun Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
- 13 SINGLE-VALUE )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.53 NAME 'personalSignature' D
- ESC 'RFC1274: Personal Signature (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
- 23 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect' DESC 'R
- FC1274: DIT Redirect' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466
- .115.121.1.12 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.55 NAME 'audio' DESC 'RFC1274
- : audio (u-law)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.4{25000} )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher' D
- ESC 'RFC1274: publisher of document' EQUALITY caseIgnoreMatch SUBSTR caseIgno
- reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.4 NAME ( 'pilotPerson' 'newPilo
- tPerson' ) SUP person STRUCTURAL MAY ( userid $ textEncodedORAddress $ rfc822
- Mailbox $ favouriteDrink $ roomNumber $ userClass $ homeTelephoneNumber $ hom
- ePostalAddress $ secretary $ personalTitle $ preferredDeliveryMethod $ busine
- ssCategory $ janetMailbox $ otherMailbox $ mobileTelephoneNumber $ pagerTelep
- honeNumber $ organizationalStatus $ mailPreferenceOption $ personalSignature 
- ) )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCT
- URAL MUST userid MAY ( description $ seeAlso $ localityName $ organizationNam
- e $ organizationalUnitName $ host ) )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.6 NAME 'document' SUP top STRUC
- TURAL MUST documentIdentifier MAY ( commonName $ description $ seeAlso $ loca
- lityName $ organizationName $ organizationalUnitName $ documentTitle $ docume
- ntVersion $ documentAuthor $ documentLocation $ documentPublisher ) )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.7 NAME 'room' SUP top STRUCTURA
- L MUST commonName MAY ( roomNumber $ description $ seeAlso $ telephoneNumber 
- ) )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.9 NAME 'documentSeries' SUP top
-  STRUCTURAL MUST commonName MAY ( description $ seeAlso $ telephonenumber $ l
- ocalityName $ organizationName $ organizationalUnitName ) )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.13 NAME 'domain' SUP top STRUCT
- URAL MUST domainComponent MAY ( associatedName $ organizationName $ descripti
- on $ businessCategory $ seeAlso $ searchGuide $ userPassword $ localityName $
-  stateOrProvinceName $ streetAddress $ physicalDeliveryOfficeName $ postalAdd
- ress $ postalCode $ postOfficeBox $ streetAddress $ facsimileTelephoneNumber 
- $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIdentifier $ tel
- exNumber $ preferredDeliveryMethod $ destinationIndicator $ registeredAddress
-  $ x121Address ) )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' SUP d
- omain STRUCTURAL MAY ( commonName $ surname $ description $ seeAlso $ telepho
- neNumber $ physicalDeliveryOfficeName $ postalAddress $ postalCode $ postOffi
- ceBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNNumber $ 
- telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ preferredDelivery
- Method $ destinationIndicator $ registeredAddress $ x121Address ) )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.15 NAME 'dNSDomain' SUP domain 
- STRUCTURAL MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAME
- Record ) )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.17 NAME 'domainRelatedObject' D
- ESC 'RFC1274: an object related to an domain' SUP top AUXILIARY MUST associat
- edDomain )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.18 NAME 'friendlyCountry' SUP c
- ountry STRUCTURAL MUST friendlyCountryName )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.20 NAME 'pilotOrganization' SU
- P ( organization $ organizationalUnit ) STRUCTURAL MAY buildingName )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.21 NAME 'pilotDSA' SUP dsa STR
- UCTURAL MAY dSAQuality )
-olcObjectClasses: ( 0.9.2342.19200300.100.4.22 NAME 'qualityLabelledData' 
- SUP top AUXILIARY MUST dsaQuality MAY ( subtreeMinimumQuality $ subtreeMaximu
- mQuality ) )

=== removed file 'schemas/dhcp.ldif'
--- schemas/dhcp.ldif	2009-09-11 14:25:59 +0000
+++ schemas/dhcp.ldif	1970-01-01 00:00:00 +0000
@@ -1,224 +0,0 @@
-dn: cn=dhcp,cn=schema,cn=config
-objectClass: olcSchemaConfig
-cn: dhcp
-olcAttributeTypes: {0}( 2.16.840.1.113719.1.203.4.1 NAME 'dhcpPrimaryDN' DESC 
- 'The DN of the dhcpServer which is the primary server for the configuration.'
-  EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-
- VALUE )
-olcAttributeTypes: {1}( 2.16.840.1.113719.1.203.4.2 NAME 'dhcpSecondaryDN' DES
- C 'The DN of dhcpServer(s) which provide backup service for the configuration
- .' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: {2}( 2.16.840.1.113719.1.203.4.3 NAME 'dhcpStatements' DESC
-  'Flexible storage for specific data depending on what object this exists in.
-  Like conditional statements, server parameters, etc. This allows the standar
- d to evolve without needing to adjust the schema.' EQUALITY caseIgnoreIA5Matc
- h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {3}( 2.16.840.1.113719.1.203.4.4 NAME 'dhcpRange' DESC 'The
-  starting & ending IP Addresses in the range (inclusive), separated by a hyph
- en; if the range only contains one address, then just the address can be spec
- ified with no hyphen.  Each range is defined as a separate value.' EQUALITY c
- aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {4}( 2.16.840.1.113719.1.203.4.5 NAME 'dhcpPermitList' DESC
-  'This attribute contains the permit lists associated with a pool. Each permi
- t list is defined as a separate value.' EQUALITY caseIgnoreIA5Match SYNTAX 1.
- 3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {5}( 2.16.840.1.113719.1.203.4.6 NAME 'dhcpNetMask' DESC 'T
- he subnet mask length for the subnet.  The mask can be easily computed from t
- his length.' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGL
- E-VALUE )
-olcAttributeTypes: {6}( 2.16.840.1.113719.1.203.4.7 NAME 'dhcpOption' DESC 'En
- coded option values to be sent to clients.  Each value represents a single op
- tion and contains (OptionTag, Length, OptionValue) encoded in the format used
-  by DHCP.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {7}( 2.16.840.1.113719.1.203.4.8 NAME 'dhcpClassData' DESC 
- 'Encoded text string or list of bytes expressed in hexadecimal, separated by 
- colons.  Clients match subclasses based on matching the class data with the r
- esults of match or spawn with statements in the class name declarations.' EQU
- ALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
-olcAttributeTypes: {8}( 2.16.840.1.113719.1.203.4.9 NAME 'dhcpOptionsDN' DESC 
- 'The distinguished name(s) of the dhcpOption objects containing the configura
- tion options provided by the server.' EQUALITY distinguishedNameMatch SYNTAX 
- 1.3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: {9}( 2.16.840.1.113719.1.203.4.10 NAME 'dhcpHostDN' DESC 't
- he distinguished name(s) of the dhcpHost objects.' EQUALITY distinguishedName
- Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: {10}( 2.16.840.1.113719.1.203.4.11 NAME 'dhcpPoolDN' DESC '
- The distinguished name(s) of pools.' EQUALITY distinguishedNameMatch SYNTAX 1
- .3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: {11}( 2.16.840.1.113719.1.203.4.12 NAME 'dhcpGroupDN' DESC 
- 'The distinguished name(s)   of the groups.' EQUALITY distinguishedNameMatch 
- SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: {12}( 2.16.840.1.113719.1.203.4.13 NAME 'dhcpSubnetDN' DESC
-  'The distinguished name(s) of the subnets.' EQUALITY distinguishedNameMatch 
- SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: {13}( 2.16.840.1.113719.1.203.4.14 NAME 'dhcpLeaseDN' DESC 
- 'The distinguished name of a client address.' EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
-olcAttributeTypes: {14}( 2.16.840.1.113719.1.203.4.15 NAME 'dhcpLeasesDN' DESC
-  'The distinguished name(s) client addresses.' EQUALITY distinguishedNameMatc
- h SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: {15}( 2.16.840.1.113719.1.203.4.16 NAME 'dhcpClassesDN' DES
- C 'The distinguished name(s) of a class(es) in a subclass.' EQUALITY distingu
- ishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: {16}( 2.16.840.1.113719.1.203.4.17 NAME 'dhcpSubclassesDN' 
- DESC 'The distinguished name(s) of subclass(es).' EQUALITY distinguishedNameM
- atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: {17}( 2.16.840.1.113719.1.203.4.18 NAME 'dhcpSharedNetworkD
- N' DESC 'The distinguished name(s) of sharedNetworks.' EQUALITY distinguished
- NameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: {18}( 2.16.840.1.113719.1.203.4.19 NAME 'dhcpServiceDN' DES
- C 'The DN of dhcpService object(s)which contain the configuration information
- . Each dhcpServer object has this attribute identifying the DHCP configuratio
- n(s) that the server is associated with.' EQUALITY distinguishedNameMatch SYN
- TAX 1.3.6.1.4.1.1466.115.121.1.12 )
-olcAttributeTypes: {19}( 2.16.840.1.113719.1.203.4.20 NAME 'dhcpVersion' DESC 
- 'The version attribute of this object.' EQUALITY caseIgnoreIA5Match SYNTAX 1.
- 3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
-olcAttributeTypes: {20}( 2.16.840.1.113719.1.203.4.21 NAME 'dhcpImplementation
- ' DESC 'Description of the DHCP Server implementation e.g. DHCP Servers vendo
- r.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-V
- ALUE )
-olcAttributeTypes: {21}( 2.16.840.1.113719.1.203.4.22 NAME 'dhcpAddressState' 
- DESC 'This stores information about the current binding-status of an address.
-   For dynamic addresses managed by DHCP, the values should be restricted to t
- he following: "FREE", "ACTIVE", "EXPIRED", "RELEASED", "RESET", "ABANDONED", 
- "BACKUP".  For other addresses, it SHOULD be one of the following: "UNKNOWN",
-  "RESERVED" (an address that is managed by DHCP that is reserved for a specif
- ic client), "RESERVED-ACTIVE" (same as reserved, but address is currently in 
- use), "ASSIGNED" (assigned manually or by some other mechanism), "UNASSIGNED"
- , "NOTASSIGNABLE".' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
- 21.1.26 SINGLE-VALUE )
-olcAttributeTypes: {22}( 2.16.840.1.113719.1.203.4.23 NAME 'dhcpExpirationTime
- ' DESC 'This is the time the current lease for an address expires.' EQUALITY 
- generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
-olcAttributeTypes: {23}( 2.16.840.1.113719.1.203.4.24 NAME 'dhcpStartTimeOfSta
- te' DESC 'This is the time of the last state change for a leased address.' EQ
- UALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE
-  )
-olcAttributeTypes: {24}( 2.16.840.1.113719.1.203.4.25 NAME 'dhcpLastTransactio
- nTime' DESC 'This is the last time a valid DHCP packet was received from the 
- client.' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 S
- INGLE-VALUE )
-olcAttributeTypes: {25}( 2.16.840.1.113719.1.203.4.26 NAME 'dhcpBootpFlag' DES
- C 'This indicates whether the address was assigned via BOOTP.' EQUALITY boole
- anMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
-olcAttributeTypes: {26}( 2.16.840.1.113719.1.203.4.27 NAME 'dhcpDomainName' DE
- SC 'This is the name of the domain sent to the client by the server.  It is e
- ssentially the same as the value for DHCP option 15 sent to the client, and r
- epresents only the domain - not the full FQDN.  To obtain the full FQDN assig
- ned to the client you must prepend the "dhcpAssignedHostName" to this value w
- ith a ".".' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 
- SINGLE-VALUE )
-olcAttributeTypes: {27}( 2.16.840.1.113719.1.203.4.28 NAME 'dhcpDnsStatus' DES
- C 'This indicates the status of updating DNS resource records on behalf of th
- e client by the DHCP server for this address.  The value is a 16-bit bitmask.
- ' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
-olcAttributeTypes: {28}( 2.16.840.1.113719.1.203.4.29 NAME 'dhcpRequestedHostN
- ame' DESC 'This is the hostname that was requested by the client.' EQUALITY c
- aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
-olcAttributeTypes: {29}( 2.16.840.1.113719.1.203.4.30 NAME 'dhcpAssignedHostNa
- me' DESC 'This is the actual hostname that was assigned to a client. It may n
- ot be the name that was requested by the client.  The fully qualified domain 
- name can be determined by appending the value of "dhcpDomainName" (with a dot
-  separator) to this name.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.146
- 6.115.121.1.26 SINGLE-VALUE )
-olcAttributeTypes: {30}( 2.16.840.1.113719.1.203.4.31 NAME 'dhcpReservedForCli
- ent' DESC 'The distinguished name of a "dhcpClient" that an address is reserv
- ed for.  This may not be the same as the "dhcpAssignedToClient" attribute if 
- the address is being reassigned but the current lease has not yet expired.' E
- QUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VA
- LUE )
-olcAttributeTypes: {31}( 2.16.840.1.113719.1.203.4.32 NAME 'dhcpAssignedToClie
- nt' DESC 'This is the distinguished name of a "dhcpClient" that an address is
-  currently assigned to.  This attribute is only present in the class when the
-  address is leased.' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.
- 115.121.1.12 SINGLE-VALUE )
-olcAttributeTypes: {32}( 2.16.840.1.113719.1.203.4.33 NAME 'dhcpRelayAgentInfo
- ' DESC 'If the client request was received via a relay agent, this contains i
- nformation about the relay agent that was available from the DHCP request.  T
- his is a hex-encoded option value.' EQUALITY octetStringMatch SYNTAX 1.3.6.1.
- 4.1.1466.115.121.1.40 SINGLE-VALUE )
-olcAttributeTypes: {33}( 2.16.840.1.113719.1.203.4.34 NAME 'dhcpHWAddress' DES
- C 'The clients hardware address that requested this IP address.' EQUALITY oct
- etStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
-olcAttributeTypes: {34}( 2.16.840.1.113719.1.203.4.35 NAME 'dhcpHashBucketAssi
- gnment' DESC 'HashBucketAssignment bit map for the DHCP Server, as defined in
-  DHC Load Balancing Algorithm [RFC 3074].' EQUALITY octetStringMatch SYNTAX 1
- .3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
-olcAttributeTypes: {35}( 2.16.840.1.113719.1.203.4.36 NAME 'dhcpDelayedService
- Parameter' DESC 'Delay in seconds corresponding to Delayed Service Parameter 
- configuration, as defined in  DHC Load Balancing Algorithm [RFC 3074]. ' EQUA
- LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
-olcAttributeTypes: {36}( 2.16.840.1.113719.1.203.4.37 NAME 'dhcpMaxClientLeadT
- ime' DESC 'Maximum Client Lead Time configuration in seconds, as defined in D
- HCP Failover Protocol [FAILOVR]' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.146
- 6.115.121.1.27 SINGLE-VALUE )
-olcAttributeTypes: {37}( 2.16.840.1.113719.1.203.4.38 NAME 'dhcpFailOverEndpoi
- ntState' DESC 'Server (Failover Endpoint) state, as defined in DHCP Failover 
- Protocol [FAILOVR]' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
- 21.1.26 SINGLE-VALUE )
-olcAttributeTypes: {38}( 2.16.840.1.113719.1.203.4.39 NAME 'dhcpErrorLog' DESC
-  'Generic error log attribute that allows logging error conditions within a d
- hcpService or a dhcpSubnet, like no IP addresses available for lease.' EQUALI
- TY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
-olcObjectClasses: {0}( 2.16.840.1.113719.1.203.6.1 NAME 'dhcpService' DESC 'Se
- rvice object that represents the actual DHCP Service configuration. This is a
-  container object.' SUP top STRUCTURAL MUST ( cn $ dhcpPrimaryDN ) MAY ( dhcp
- SecondaryDN $ dhcpSharedNetworkDN $ dhcpSubnetDN $ dhcpGroupDN $ dhcpHostDN $
-  dhcpClassesDN $ dhcpOptionsDN $ dhcpStatements ) )
-olcObjectClasses: {1}( 2.16.840.1.113719.1.203.6.2 NAME 'dhcpSharedNetwork' DE
- SC 'This stores configuration information for a shared network.' SUP top STRU
- CTURAL MUST cn MAY ( dhcpSubnetDN $ dhcpPoolDN $ dhcpOptionsDN $ dhcpStatemen
- ts ) X-NDS_CONTAINMENT 'dhcpService' )
-olcObjectClasses: {2}( 2.16.840.1.113719.1.203.6.3 NAME 'dhcpSubnet' DESC 'Thi
- s class defines a subnet. This is a container object.' SUP top STRUCTURAL MUS
- T ( cn $ dhcpNetMask ) MAY ( dhcpRange $ dhcpPoolDN $ dhcpGroupDN $ dhcpHostD
- N $ dhcpClassesDN $ dhcpLeasesDN $ dhcpOptionsDN $ dhcpStatements ) X-NDS_CON
- TAINMENT ( 'dhcpService' 'dhcpSharedNetwork' ) )
-olcObjectClasses: {3}( 2.16.840.1.113719.1.203.6.4 NAME 'dhcpPool' DESC 'This 
- stores configuration information about a pool.' SUP top STRUCTURAL MUST ( cn 
- $ dhcpRange ) MAY ( dhcpClassesDN $ dhcpPermitList $ dhcpLeasesDN $ dhcpOptio
- nsDN $ dhcpStatements ) X-NDS_CONTAINMENT ( 'dhcpSubnet' 'dhcpSharedNetwork' 
- ) )
-olcObjectClasses: {4}( 2.16.840.1.113719.1.203.6.5 NAME 'dhcpGroup' DESC 'Grou
- p object that lists host DNs and parameters. This is a container object.' SUP
-  top STRUCTURAL MUST cn MAY ( dhcpHostDN $ dhcpOptionsDN $ dhcpStatements ) X
- -NDS_CONTAINMENT ( 'dhcpSubnet' 'dhcpService' ) )
-olcObjectClasses: {5}( 2.16.840.1.113719.1.203.6.6 NAME 'dhcpHost' DESC 'This 
- represents information about a particular client' SUP top STRUCTURAL MUST cn 
- MAY ( dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements ) X-NDS_CO
- NTAINMENT ( 'dhcpService' 'dhcpSubnet' 'dhcpGroup' ) )
-olcObjectClasses: {6}( 2.16.840.1.113719.1.203.6.7 NAME 'dhcpClass' DESC 'Repr
- esents information about a collection of related clients.' SUP top STRUCTURAL
-  MUST cn MAY ( dhcpSubClassesDN $ dhcpOptionsDN $ dhcpStatements ) X-NDS_CONT
- AINMENT ( 'dhcpService' 'dhcpSubnet' ) )
-olcObjectClasses: {7}( 2.16.840.1.113719.1.203.6.8 NAME 'dhcpSubClass' DESC 'R
- epresents information about a collection of related classes.' SUP top STRUCTU
- RAL MUST cn MAY ( dhcpClassData $ dhcpOptionsDN $ dhcpStatements ) X-NDS_CONT
- AINMENT 'dhcpClass' )
-olcObjectClasses: {8}( 2.16.840.1.113719.1.203.6.9 NAME 'dhcpOptions' DESC 'Re
- presents information about a collection of options defined.' SUP top AUXILIAR
- Y MUST cn MAY dhcpOption X-NDS_CONTAINMENT ( 'dhcpService' 'dhcpSharedNetwork
- ' 'dhcpSubnet' 'dhcpPool' 'dhcpGroup' 'dhcpHost' 'dhcpClass' ) )
-olcObjectClasses: {9}( 2.16.840.1.113719.1.203.6.10 NAME 'dhcpLeases' DESC 'Th
- is class represents an IP Address, which may or may not have been leased.' SU
- P top STRUCTURAL MUST ( cn $ dhcpAddressState ) MAY ( dhcpExpirationTime $ dh
- cpStartTimeOfState $ dhcpLastTransactionTime $ dhcpBootpFlag $ dhcpDomainName
-  $ dhcpDnsStatus $ dhcpRequestedHostName $ dhcpAssignedHostName $ dhcpReserve
- dForClient $ dhcpAssignedToClient $ dhcpRelayAgentInfo $ dhcpHWAddress ) X-ND
- S_CONTAINMENT ( 'dhcpService' 'dhcpSubnet' 'dhcpPool' ) )
-olcObjectClasses: {10}( 2.16.840.1.113719.1.203.6.11 NAME 'dhcpLog' DESC 'This
-  is the object that holds past information about the IP address. The cn is th
- e time/date stamp when the address was assigned or released, the address stat
- e at the time, if the address was assigned or released.' SUP top STRUCTURAL M
- UST cn MAY ( dhcpAddressState $ dhcpExpirationTime $ dhcpStartTimeOfState $ d
- hcpLastTransactionTime $ dhcpBootpFlag $ dhcpDomainName $ dhcpDnsStatus $ dhc
- pRequestedHostName $ dhcpAssignedHostName $ dhcpReservedForClient $ dhcpAssig
- nedToClient $ dhcpRelayAgentInfo $ dhcpHWAddress $ dhcpErrorLog ) X-NDS_CONTA
- INMENT ( 'dhcpLeases' 'dhcpPool' 'dhcpSubnet' 'dhcpSharedNetwork' 'dhcpServic
- e' ) )
-olcObjectClasses: {11}( 2.16.840.1.113719.1.203.6.12 NAME 'dhcpServer' DESC 'D
- HCP Server Object' SUP top STRUCTURAL MUST ( cn $ dhcpServiceDN ) MAY ( dhcpV
- ersion $ dhcpImplementation $ dhcpHashBucketAssignment $ dhcpDelayedServicePa
- rameter $ dhcpMaxClientLeadTime $ dhcpFailOverEndpointState $ dhcpStatements 
- ) X-NDS_CONTAINMENT ( 'o' 'ou' 'dc' ) )

=== removed file 'schemas/dnszone.ldif'
--- schemas/dnszone.ldif	2009-09-11 14:25:59 +0000
+++ schemas/dnszone.ldif	1970-01-01 00:00:00 +0000
@@ -1,67 +0,0 @@
-dn: cn=dnszone,cn=schema,cn=config
-objectClass: olcSchemaConfig
-cn: dnszone
-olcAttributeTypes: {0}( 1.3.6.1.4.1.2428.20.0.0 NAME 'dNSTTL' DESC 'An integer
-  denoting time to live' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121
- .1.27 )
-olcAttributeTypes: {1}( 1.3.6.1.4.1.2428.20.0.1 NAME 'dNSClass' DESC 'The clas
- s of a resource record' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.1
- 15.121.1.26 )
-olcAttributeTypes: {2}( 1.3.6.1.4.1.2428.20.0.2 NAME 'zoneName' DESC 'The name
-  of a zone, i.e. the name of the highest node in the zone' EQUALITY caseIgnor
- eIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121
- .1.26 )
-olcAttributeTypes: {3}( 1.3.6.1.4.1.2428.20.0.3 NAME 'relativeDomainName' DESC
-  'The starting labels of a domain name' EQUALITY caseIgnoreIA5Match SUBSTR ca
- seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {4}( 1.3.6.1.4.1.2428.20.1.12 NAME 'pTRRecord' DESC 'domain
-  name pointer, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subs
- tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {5}( 1.3.6.1.4.1.2428.20.1.13 NAME 'hInfoRecord' DESC 'host
-  information, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst
- ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {6}( 1.3.6.1.4.1.2428.20.1.14 NAME 'mInfoRecord' DESC 'mail
- box or mail list information, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR ca
- seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {7}( 1.3.6.1.4.1.2428.20.1.16 NAME 'tXTRecord' DESC 'text s
- tring, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
- tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {8}( 1.3.6.1.4.1.2428.20.1.24 NAME 'SigRecord' DESC 'Signat
- ure, RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc
- h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {9}( 1.3.6.1.4.1.2428.20.1.25 NAME 'KeyRecord' DESC 'Key, R
- FC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNT
- AX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {10}( 1.3.6.1.4.1.2428.20.1.28 NAME 'aAAARecord' DESC 'IPv6
-  address, RFC 1886' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substring
- sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {11}( 1.3.6.1.4.1.2428.20.1.29 NAME 'LocRecord' DESC 'Locat
- ion, RFC 1876' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc
- h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {12}( 1.3.6.1.4.1.2428.20.1.30 NAME 'nXTRecord' DESC 'non-e
- xistant, RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings
- Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {13}( 1.3.6.1.4.1.2428.20.1.33 NAME 'sRVRecord' DESC 'servi
- ce location, RFC 2782' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substr
- ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {14}( 1.3.6.1.4.1.2428.20.1.35 NAME 'nAPTRRecord' DESC 'Nam
- ing Authority Pointer, RFC 2915' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnor
- eIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {15}( 1.3.6.1.4.1.2428.20.1.36 NAME 'kXRecord' DESC 'Key Ex
- change Delegation, RFC 2230' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5
- SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {16}( 1.3.6.1.4.1.2428.20.1.37 NAME 'certRecord' DESC 'cert
- ificate, RFC 2538' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings
- Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {17}( 1.3.6.1.4.1.2428.20.1.38 NAME 'a6Record' DESC 'A6 Rec
- ord Type, RFC 2874' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substring
- sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcAttributeTypes: {18}( 1.3.6.1.4.1.2428.20.1.39 NAME 'dNameRecord' DESC 'Non
- -Terminal DNS Name Redirection, RFC 2672' EQUALITY caseIgnoreIA5Match SUBSTR 
- caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-olcObjectClasses: {0}( 1.3.6.1.4.1.2428.20.3 NAME 'dNSZone' SUP top STRUCTURAL
-  MUST ( zoneName $ relativeDomainName ) MAY ( DNSTTL $ DNSClass $ ARecord $ M
- DRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $ PTRRecord $ HINFORe
- cord $ MINFORecord $ TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCReco
- rd $ NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $ A6Record $
-  DNAMERecord ) )

=== removed file 'schemas/dyngroup.ldif'
--- schemas/dyngroup.ldif	2009-09-11 14:25:59 +0000
+++ schemas/dyngroup.ldif	1970-01-01 00:00:00 +0000
@@ -1,24 +0,0 @@
-dn: cn=dyngroup,cn=schema,cn=config
-objectClass: olcSchemaConfig
-cn: dyngroup
-olcObjectIdentifier: {0}NetscapeRoot 2.16.840.1.113730
-olcObjectIdentifier: {1}NetscapeLDAP NetscapeRoot:3
-olcObjectIdentifier: {2}NetscapeLDAPattributeType NetscapeLDAP:1
-olcObjectIdentifier: {3}NetscapeLDAPobjectClass NetscapeLDAP:2
-olcObjectIdentifier: {4}OpenLDAPExp11 1.3.6.1.4.1.4203.666.11
-olcObjectIdentifier: {5}DynGroupBase OpenLDAPExp11:8
-olcObjectIdentifier: {6}DynGroupAttr DynGroupBase:1
-olcObjectIdentifier: {7}DynGroupOC DynGroupBase:2
-olcAttributeTypes: {0}( NetscapeLDAPattributeType:198 NAME 'memberURL' DESC 'I
- dentifies an URL associated with each member of a group. Any type of labeled 
- URL can be used.' SUP labeledURI )
-olcAttributeTypes: {1}( DynGroupAttr:1 NAME 'dgIdentity' DESC 'Identity to use
-  when processing the memberURL' SUP distinguishedName SINGLE-VALUE )
-olcAttributeTypes: {2}( DynGroupAttr:2 NAME 'dgAuthz' DESC 'Optional authoriza
- tion rules that determine who is allowed to assume the dgIdentity' EQUALITY a
- uthzMatch SYNTAX 1.3.6.1.4.1.4203.666.2.7 X-ORDERED 'VALUES' )
-olcObjectClasses: {0}( NetscapeLDAPobjectClass:33 NAME 'groupOfURLs' SUP top S
- TRUCTURAL MUST cn MAY ( memberURL $ businessCategory $ description $ o $ ou $
-  owner $ seeAlso ) )
-olcObjectClasses: {1}( DynGroupOC:1 NAME 'dgIdentityAux' SUP top AUXILIARY MAY
-  ( dgIdentity $ dgAuthz ) )

=== removed file 'schemas/inetorgperson.ldif'
--- schemas/inetorgperson.ldif	2009-09-11 14:25:59 +0000
+++ schemas/inetorgperson.ldif	1970-01-01 00:00:00 +0000
@@ -1,69 +0,0 @@
-# InetOrgPerson (RFC2798)
-# $OpenLDAP: pkg/ldap/servers/slapd/schema/inetorgperson.ldif,v 1.1.2.4 2009/01/22 00:01:14 kurt Exp $
-## This work is part of OpenLDAP Software <http://www.openldap.org/>.
-##
-## Copyright 1998-2009 The OpenLDAP Foundation.
-## All rights reserved.
-##
-## Redistribution and use in source and binary forms, with or without
-## modification, are permitted only as authorized by the OpenLDAP
-## Public License.
-##
-## A copy of this license is available in the file LICENSE in the
-## top-level directory of the distribution or, alternatively, at
-## <http://www.OpenLDAP.org/license.html>.
-#
-# InetOrgPerson (RFC2798)
-#
-# Depends upon
-#   Definition of an X.500 Attribute Type and an Object Class to Hold
-#   Uniform Resource Identifiers (URIs) [RFC2079]
-#	(core.ldif)
-#
-#   A Summary of the X.500(96) User Schema for use with LDAPv3 [RFC2256]
-#	(core.ldif)
-#
-#   The COSINE and Internet X.500 Schema [RFC1274] (cosine.ldif)
-#
-# This file was automatically generated from inetorgperson.schema; see
-# that file for complete references.
-#
-dn: cn=inetorgperson,cn=schema,cn=config
-objectClass: olcSchemaConfig
-cn: inetorgperson
-olcAttributeTypes: ( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC279
- 8: vehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR cas
- eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
-olcAttributeTypes: ( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC '
- RFC2798: identifies a department within an organization' EQUALITY caseIgnoreM
- atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
-olcAttributeTypes: ( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'RFC
- 2798: preferred name to be used when displaying entries' EQUALITY caseIgnoreM
- atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
- NGLE-VALUE )
-olcAttributeTypes: ( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC 'RF
- C2798: numerically identifies an employee within an organization' EQUALITY ca
- seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
- 1.1.15 SINGLE-VALUE )
-olcAttributeTypes: ( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RFC2
- 798: type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgn
- oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
-olcAttributeTypes: ( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RFC2
- 798: a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 )
-olcAttributeTypes: ( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DESC
-  'RFC2798: preferred written or spoken language for a person' EQUALITY caseIg
- noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
- 15 SINGLE-VALUE )
-olcAttributeTypes: ( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' D
- ESC 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4.1.14
- 66.115.121.1.5 )
-olcAttributeTypes: ( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RFC2
- 798: personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.1466.1
- 15.121.1.5 )
-olcObjectClasses: ( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2
- 798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY 
- ( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ em
- ployeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ ini
- tials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo 
- $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ pre
- ferredLanguage $ userSMIMECertificate $ userPKCS12 ) )

=== removed file 'schemas/misc.ldif'
--- schemas/misc.ldif	2009-09-11 14:25:59 +0000
+++ schemas/misc.ldif	1970-01-01 00:00:00 +0000
@@ -1,25 +0,0 @@
-# misc.ldif
-#
-# This is the ldif version of misc.schema to be used with cn=config.
-# The nss overlay requires rfc822MailMember which is defined here.
-#
-dn: cn=misc,cn=schema,cn=config
-objectClass: olcSchemaConfig
-cn: misc
-olcAttributeTypes: ( 2.16.840.1.113730.3.1.13 NAME 'mailLocalAddress' DESC 
- 'RFC822 email address of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX 1
- .3.6.1.4.1.1466.115.121.1.26{256} )
-olcAttributeTypes: ( 2.16.840.1.113730.3.1.18 NAME 'mailHost' DESC 'FQDN of
-  the SMTP/MTA of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
- .1.1466.115.121.1.26{256} SINGLE-VALUE )
-olcAttributeTypes: ( 2.16.840.1.113730.3.1.47 NAME 'mailRoutingAddress' DES
- C 'RFC822 routing address of this recipient' EQUALITY caseIgnoreIA5Match SYNT
- AX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
-olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.2.1.15 NAME 'rfc822MailMember' DES
- C 'rfc822 mail address of group member(s)' EQUALITY caseIgnoreIA5Match SYNTAX
-  1.3.6.1.4.1.1466.115.121.1.26 )
-olcObjectClasses: ( 2.16.840.1.113730.3.2.147 NAME 'inetLocalMailRecipient'
-  DESC 'Internet local mail recipient' SUP top AUXILIARY MAY ( mailLocalAddres
- s $ mailHost $ mailRoutingAddress ) )
-olcObjectClasses: ( 1.3.6.1.4.1.42.2.27.1.2.5 NAME 'nisMailAlias' DESC 'NIS
-  mail alias' SUP top STRUCTURAL MUST cn MAY rfc822MailMember )

=== removed file 'schemas/mit-kerberos.ldif'
--- schemas/mit-kerberos.ldif	2009-10-06 20:36:12 +0000
+++ schemas/mit-kerberos.ldif	1970-01-01 00:00:00 +0000
@@ -1,473 +0,0 @@
-# Novell Kerberos Schema Definitions
-# Novell Inc.
-# 1800 South Novell Place
-# Provo, UT 84606
-#
-# VeRsIoN=1.0
-# CoPyRiGhT=(c) Copyright 2006, Novell, Inc.  All rights reserved
-#
-# OIDs:
-#    joint-iso-ccitt(2)
-#      country(16)
-#        us(840)
-#          organization(1)
-#            Novell(113719)
-#              applications(1)
-#                kerberos(301)
-#                 Kerberos Attribute Type(4) attr# version#
-#                    specific attribute definitions
-#                 Kerberos Attribute Syntax(5)
-#                    specific syntax definitions
-#                 Kerberos Object Class(6) class# version#
-#                    specific class definitions
-#
-#    iso(1)
-#      member-body(2)
-#        United States(840)
-#          mit (113554)
-#            infosys(1)
-#              ldap(4)
-#                attributeTypes(1)
-#                  Kerberos(6)
-########################################################################
-########################################################################
-#         Attribute Type Definitions                       #
-########################################################################
-dn: cn=mit-kerberos,cn=schema,cn=config
-cn: kerberos
-objectClass: olcSchemaConfig
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.1.1
-  NAME 'krbPrincipalName'
-  EQUALITY caseExactIA5Match
-  SUBSTR caseExactSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26)
-##### If there are multiple krbPrincipalName values for an entry, this
-##### is the canonical principal name in the RFC 1964 specified
-##### format.  (If this attribute does not exist, then all
-##### krbPrincipalName values are treated as canonical.)
-olcAttributeTypes: ( 1.2.840.113554.1.4.1.6.1
-  NAME 'krbCanonicalName'
-  EQUALITY caseExactIA5Match
-  SUBSTR caseExactSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
-  SINGLE-VALUE)
-##### This specifies the type of the principal, the types could be any of
-##### the types mentioned in section 6.2 of RFC 4120
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.3.1
-  NAME 'krbPrincipalType'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  SINGLE-VALUE)
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.5.1
-  NAME 'krbUPEnabled'
-  DESC 'Boolean'
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  SINGLE-VALUE)
-##### The time at which the principal expires
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.6.1
-  NAME 'krbPrincipalExpiration'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  SINGLE-VALUE)
-##### The krbTicketFlags attribute holds information about the kerberos flags for a principal
-##### The values (0x00000001 - 0x00800000) are reserved for standards and 
-##### values (0x01000000 - 0x80000000) can be used for proprietary extensions.
-##### The flags and values as per RFC 4120 and MIT implementation are,
-##### DISALLOW_POSTDATED  0x00000001
-##### DISALLOW_FORWARDABLE  0x00000002
-##### DISALLOW_TGT_BASED        0x00000004
-##### DISALLOW_RENEWABLE        0x00000008
-##### DISALLOW_PROXIABLE        0x00000010
-##### DISALLOW_DUP_SKEY         0x00000020
-##### DISALLOW_ALL_TIX          0x00000040
-##### REQUIRES_PRE_AUTH         0x00000080
-##### REQUIRES_HW_AUTH          0x00000100
-##### REQUIRES_PWCHANGE         0x00000200
-##### DISALLOW_SVR              0x00001000
-##### PWCHANGE_SERVICE          0x00002000
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.8.1
-  NAME 'krbTicketFlags'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  SINGLE-VALUE)
-##### The maximum ticket lifetime for a principal in seconds
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.9.1
-  NAME 'krbMaxTicketLife'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  SINGLE-VALUE)
-##### Maximum renewable lifetime for a principal's ticket in seconds
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.10.1
-  NAME 'krbMaxRenewableAge'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  SINGLE-VALUE)
-##### Forward reference to the Realm object.
-##### (FDN of the krbRealmContainer object).
-##### Example:   cn=ACME.COM, cn=Kerberos, cn=Security
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.14.1
-  NAME 'krbRealmReferences'
-  EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
-##### List of LDAP servers that kerberos servers can contact.
-##### The attribute holds data in the ldap uri format,
-##### Example: ldaps://acme.com:636
-#####
-##### The values of this attribute need to be updated, when
-##### the LDAP servers listed here are renamed, moved or deleted.
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.15.1
-  NAME 'krbLdapServers'
-  EQUALITY caseIgnoreMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15)
-##### A set of forward references to the KDC Service objects.
-##### (FDNs of the krbKdcService objects).
-##### Example:   cn=kdc - server 1, ou=uvw, o=xyz
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.17.1
-  NAME 'krbKdcServers'
-  EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
-##### A set of forward references to the Password Service objects.
-##### (FDNs of the krbPwdService objects).
-##### Example:   cn=kpasswdd - server 1, ou=uvw, o=xyz
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.18.1
-  NAME 'krbPwdServers'
-  EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
-##### This attribute holds the Host Name or the ip address, 
-##### transport protocol and ports of the kerberos service host
-##### The format is host_name-or-ip_address#protocol#port
-##### Protocol can be 0 or 1. 0 is for UDP. 1 is for TCP.
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.24.1
-  NAME 'krbHostServer'
-  EQUALITY caseExactIA5Match
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26)
-##### This attribute holds the scope for searching the principals
-##### under krbSubTree attribute of krbRealmContainer
-##### The value can either be 1 (ONE) or 2 (SUB_TREE).
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.25.1
-  NAME 'krbSearchScope'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  SINGLE-VALUE)
-##### FDNs pointing to Kerberos principals
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.26.1
-  NAME 'krbPrincipalReferences'
-  EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
-##### This attribute specifies which attribute of the user objects  
-##### be used as the principal name component for Kerberos.
-##### The allowed values are cn, sn, uid, givenname, fullname.
-olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.28.1
-  NAME 'krbPrincNamingAttr'
-  EQUALITY caseIgnoreMatch