SLAPO-ADREMAP(5)

NAME
slapo-adremap - AD Remap overlay to slapd

SYNOPSIS
ETCDIR/slapd.conf

DESCRIPTION
The adremap overlay to slapd(8) remaps some attribute values for compatibility between Microsoft AD and older POSIX systems' PAM/NSS clients. It can be configured to convert values of given attributes to lower case, and it can be configured to generate RFC2307-compliant group memberships based on RFC2307bis groups. All mapping is only performed on entries returned as search responses.

CONFIGURATION
The config directives that are specific to the adremap overlay must be prefixed by adremap-, to avoid potential conflicts with directives specific to the underlying database or to other stacked overlays.

overlay adremap
    This directive adds the adremap overlay to the current database, see slapd.conf(5) for details.

These slapd.conf configuration options are defined for the adremap overlay. They must appear after the overlay directive. They can each be specified multiple times:

adremap-downcase <attr>
    Specify an attributeType whose values will all be mapped to lowercase when returned in search responses.

adremap-dnmap <dnattr> <targetattr> <newattr> <remoteOC> <localOC> <targetOC> <baseDN>
    Specify a DN-valued attributeType whose values will be dereferenced. The <targetattr> of the target entry will be retrieved and its value will be added to the <newattr> in the entry. In addition, searches using a filter of the form (&(objectClass=<localOC>)(<newattr>=xxx)) will be rewritten into the form (&(objectClass=<remoteOC>)(<dnattr>=xxx-DN)). This rewrite will accomplished by performing an additional internal search, with subtree scope, using the specified baseDN and a filter of the form (&(objectClass=<targetOC>)(<targetattr>=xxx)).

EXAMPLE
This example configures the adremap overlay to map all uid attributes to lowercase, and create memberUid values for group entries. The mapping will turn requests for posixGroup entries into requests for groupOfNames entries, and the internal search will use inetOrgPerson entries under the ou=People,dc=example,dc=com subtree. Add the following to slapd.conf(5):

    database <database>
    # ...
    overlay adremap
    adremap-downcase uid
    adremap-dnmap member uid memberUid groupOfNames posixGroup inetOrgPerson ou=people,dc=example,dc=com

slapd must also load adremap.la, if compiled as a run-time module;

FILES

ETCDIR/slapd.conf
    default slapd configuration file

SEE ALSO
slapd.conf(5), slapd(8). The slapo-adremap(5) overlay supports dynamic configuration via back-config.

ACKNOWLEDGEMENTS

This module was written in 2015 by Howard Chu.