SLAPO_RBAC(5)

NAME
slapo-rbac - RBAC0 overlay to slapd

SYNOPSIS
ETCDIR/slapd.conf

DESCRIPTION

The slapo-rbac overlay is an implementation of the ANSI INCITS 359 Role-Based Access Control (RBAC) Core. When instantiated, it intercepts, decodes and enforces specific RBAC policies per the Apache Fortress RBAC data formats.

The overlay provides a set of extended operations. They include session create/delete, checkAccess, addActiveRole, dropActiveRole and sessionRoles.

CONFIGURATION
These slapd.conf configuration options apply to the slapo-rbac overlay.

overlay rbac
    This tag gets applied to the RBAC configuration db (see example below).

rbac-default-users-base-dn ou=People,dc=example,dc=com
    Points to the container that contains the Apache Fortress users.

rbac-default-roles-base-dn ou=Roles,ou=RBAC,dc=example,dc=com
    Points to the container that contains the Apache Fortress roles.

rbac-default-permissions-base-dn ou=Permissions,ou=RBAC,dc=example,dc=com
    Points to the container that contains the Apache Fortress perms.

rbac-default-sessions-base-dn cn=rbac
    Points to the suffix of the RBAC sessions.

rbac-default-audit-base-dn cn=audit
    Points to the suffix where the audit records are stored.

rbac-admin cn=manager,dc=example,dc=com
    A service account that has read access to the entire Apache Fortress DIT.

rbac-pwd {SSHA}pSOV2TpCxj2NMACijkcMko4fGrFopctU
    The password according to the service account.

rbac-session-admin cn=manager,cn=rbac
    The root dn of the RBAC sessions database.

rbac-session-admin-pwd {SSHA}pSOV2TpCxj2NMACijkcMko4fGrFopctU
    The password corresponding with the session database.

EXAMPLES

    This overlay requires the
        rbac.schema
        loaded and three additional database config sections, one to store rbac
        sessions, second to store the audit records and third to hold the overlay's
        config parameters. They should appear after the existing Apache Fortress db
        config.

    1. Session Database: Used to store the RBAC sessions corresponding to a logged in user.
        database mdb
        suffix cn=rbac
        rootdn cn=manager,cn=rbac
        rootpw {SSHA}pSOV2TpCxj2NMACijkcMko4fGrFopctU
        index rbacSessid eq
        directory /var/openldap/rbacsess
        overlay dds
        dds-default-ttl 3600
        dds-max-dynamicObjects 100000
        dbnosync
        checkpoint 64 5

    2. Audit Database: Stores records that track user's activities.
        database mdb
        suffix cn=audit
        rootdn cn=manager,cn=audit
        rootpw {SSHA}pSOV2TpCxj2NMACijkcMko4fGrFopctU
        directory /var/openldap/rbacaudit
        dbnosync
        checkpoint 64 5

    3. Config Database: Stores the parameters needed for this overlay to work.
        database mdb
        suffix dc=rbac
        rootdn cn=manager,dc=rbac
        rootpw {SSHA}pSOV2TpCxj2NMACijkcMko4fGrFopctU
        directory /var/openldap/rbacoverlay
        overlay rbac
        rbac-default-tenant-id example
        rbac-default-users-base-dn ou=People,dc=example,dc=com
        rbac-default-roles-base-dn ou=Roles,ou=RBAC,dc=example,dc=com
        rbac-default-permissions-base-dn ou=Permissions,ou=RBAC,dc=example,dc=com
        rbac-default-sessions-base-dn cn=rbac
        rbac-default-audit-base-dn cn=audit
        rbac-admin cn=manager,dc=example,dc=com
        rbac-pwd {SSHA}pSOV2TpCxj2NMACijkcMko4fGrFopctU
        rbac-session-admin cn=manager,cn=rbac
        rbac-session-admin-pwd {SSHA}pSOV2TpCxj2NMACijkcMko4fGrFopctU

SEE ALSO
ldap(3), slapd.conf(5), slapd-config(5), slapo-chain(5).

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

ldap(3), slapd.conf(5), slapd-config(5), slapo-chain(5).

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

https://profsandhu.com/journals/tissec/ANSI+INCITS+359-2004.pdfANSI INCITS 359 Role-Based Access Control specification https://github.com/apache/directory-fortress-core/blob/master/README.mdApache Fortress README https://github.com/apache/directory-fortress-core/blob/master/README-QUICKSTART-SLAPD.mdApache Fortress OpenLDAP Quickstart https://github.com/apache/directory-fortress-core/blob/master/ldap/schema/fortress.schemaApache Fortress RBAC schema

BUGS
This overlay is experimental.

ACKNOWLEDGEMENTS

This module was written in 2013 by Ted Cheng of Symas Corporation with a little help from Matt Hardin, Howard Chu, Shawn McKinney.