# Schemas.
include     PH_OPENLDAP_SCHEMA_DIR/core.schema
include     PH_OPENLDAP_SCHEMA_DIR/corba.schema
include     PH_OPENLDAP_SCHEMA_DIR/cosine.schema
include     PH_OPENLDAP_SCHEMA_DIR/inetorgperson.schema
include     PH_OPENLDAP_SCHEMA_DIR/nis.schema

# Include CalendarResource and calEntry object classes for resource management
# used in SOGo Groupware.
# FYI: https://docs.iredmail.org/sogo.manage.resources.html
#include     PH_OPENLDAP_SCHEMA_DIR/calentry.schema
#include     PH_OPENLDAP_SCHEMA_DIR/calresource.schema

# Amavisd-new schema.
include     PH_OPENLDAP_SCHEMA_DIR/PH_AMAVISD_LDAP_SCHEMA_NAME

# iRedMail schema.
include     PH_OPENLDAP_SCHEMA_DIR/iredmail.schema

# Where the pid file is put. The init.d script will not stop the
# server if you change this.
pidfile     PH_OPENLDAP_PID_FILE

# List of arguments that were passed to the server
argsfile    PH_OPENLDAP_ARGS_FILE

#modulepath PH_OPENLDAP_MODULE_PATH
#moduleload back_PH_OPENLDAP_DEFAULT_DBTYPE
#moduleload back_monitor

# Support password verification with SSHA512. Require OpenLDAP-2.4.32 or later.
#moduleload pw_sha2

# The syncprov overlay
#moduleload syncprov.la

# SSL cert files. if no need to access OpenLDAP from another host, it's ok to
# disable TLS/SSL support.
#TLSCACertificateFile PH_SSL_CERT_FILE
#TLSCertificateFile PH_SSL_CERT_FILE
#TLSCertificateKeyFile PH_SSL_KEY_FILE

# Disallow bind as anonymous.
disallow    bind_anon

# Uncomment below line to allow binding as anonymous.
#allow bind_anon_cred

# Specify LDAP protocol version.
require     LDAPv3
#allow       bind_v2

# Log level.
#   -1:     enable all debugging
#    0:     no debugging
#   128:    access control list processing
#   256:    stats log connections/operations/results
loglevel    0

# Access Control
# Allow users to change their own passwords and mail forwarding addresses.
access to attrs="userPassword,mailForwardingAddress,employeeNumber"
    by anonymous    auth
    by self         write
    by dn.exact="PH_LDAP_BINDDN"   read
    by dn.exact="PH_LDAP_ADMIN_DN"  write
    by users        none

# Allow to read others public info.
access to attrs="cn,sn,gn,givenName,telephoneNumber"
    by anonymous    auth
    by self         write
    by dn.exact="PH_LDAP_BINDDN"   read
    by dn.exact="PH_LDAP_ADMIN_DN"  write
    by users        read

# Domain attrs.
access to attrs="objectclass,domainName,mtaTransport,enabledService,domainSenderBccAddress,domainRecipientBccAddress,domainBackupMX,domainMaxQuotaSize,domainMaxUserNumber,domainPendingAliasName"
    by anonymous    auth
    by self         read
    by dn.exact="PH_LDAP_BINDDN"   read
    by dn.exact="PH_LDAP_ADMIN_DN"  write
    by users        read

access to attrs="domainAdmin,domainGlobalAdmin,domainSenderBccAddress,domainRecipientBccAddress"
    by anonymous    auth
    by self         read
    by dn.exact="PH_LDAP_BINDDN"   read
    by dn.exact="PH_LDAP_ADMIN_DN"  write
    by users        none

# User attrs.
access to attrs="mail,accountStatus,domainStatus,userSenderBccAddress,userRecipientBccAddress,mailQuota,backupMailAddress,shadowAddress,memberOfGroup,member,uniqueMember,storageBaseDirectory,homeDirectory,mailMessageStore,mailingListID"
    by anonymous    auth
    by self         read
    by dn.exact="PH_LDAP_BINDDN"   read
    by dn.exact="PH_LDAP_ADMIN_DN"  write
    by users        read

#
# Set ACL for vmail/vmailadmin.
#
access to dn="PH_LDAP_BINDDN"
    by anonymous                    auth
    by self                         write
    by users                        none

access to dn="PH_LDAP_ADMIN_DN"
    by anonymous                    auth
    by self                         write
    by users                        none

#
# Allow users to access their own domain subtree.
# Allow domain admin to modify accounts under same domain.
#
access to dn.regex="domainName=([^,]+),PH_LDAP_BASEDN$"
    by anonymous                    auth
    by self                         write
    by dn.exact="PH_LDAP_BINDDN"   read
    by dn.exact="PH_LDAP_ADMIN_DN"  write
    by dn.regex="mail=[^,]+@$1,PH_LDAP_ADMIN_BASEDN$" write
    by dn.regex="mail=[^,]+@$1,ou=Users,domainName=$1,PH_LDAP_BASEDN$" read
    by users                        none

#
# Grant correct privileges to vmail/vmailadmin.
#
access to dn.subtree="PH_LDAP_BASEDN"
    by anonymous                    auth
    by self                         write
    by dn.exact="PH_LDAP_BINDDN"    read
    by dn.exact="PH_LDAP_ADMIN_DN"  write
    by users                        read

access to dn.subtree="PH_LDAP_ADMIN_BASEDN"
    by anonymous                    auth
    by self                         write
    by dn.exact="PH_LDAP_BINDDN"    read
    by dn.exact="PH_LDAP_ADMIN_DN"  write
    by users                        none

#
# Set permission for "cn=*,PH_LDAP_SUFFIX".
#
access to dn.regex="cn=[^,]+,PH_LDAP_SUFFIX"
    by anonymous                    auth
    by self                         write
    by users                        none

#
# Set default permission.
#
access to *
    by anonymous                    auth
    by self                         write
    by users                        read

#######################################################################
# Databases
#######################################################################
database monitor
access to dn="cn=monitor"
    by dn.exact="PH_LDAP_ROOTDN" read
    by dn.exact="PH_LDAP_BINDDN" read
    by * none

# Database used to store mail accounts
database    PH_OPENLDAP_DEFAULT_DBTYPE
suffix      PH_LDAP_SUFFIX
directory   PH_LDAP_DATA_DIR

rootdn      PH_LDAP_ROOTDN
rootpw      PH_LDAP_ROOTPW_SSHA

# Specify the maximum number of entries to return from a search operation.
# Defaults to 500. Use `unlimited` to specify no limits.
sizelimit   unlimited

# Specify the maximum size of the database in bytes for mdb backend database.
# A memory map of this size is allocated at startup time and the database will
# not be allowed to grow beyond this size.
# The default is 10485760 bytes (10 MB).
# This setting may be changed upward if the configured limit needs to be increased.
#maxsize     2147483648

# Specify that on-disk database contents should not be
# immediately synchronized with in memory changes.  Enabling
# this option may improve performance at the expense of data
# security. In particular, if the operating system crashes
# before changes are flushed, some number of transactions may be
# lost.  By default, a full data flush/sync is performed when
# each transaction is committed.
#dbnosync

# Specify the frequency for flushing the database disk buffers.
# This directive specifies how often to checkpoint the BDB transaction log.
# This setting is only needed if the dbnosync option is used.
#
# The checkpoint will occur if either <kbyte> data has been
# written or <min> minutes have passed since the last
# checkpoint.  Both arguments default to zero, in which case
# they are ignored. When the <min> argument is non-zero, an
# internal task will run every <min> minutes to perform the
# checkpoint.
# Note: currently the <kbyte> setting (for mdb backend) is unimplemented.
checkpoint  128 3

# Set directory permission.
mode        0700

#
# Default indexes.
#
index objectclass,entryCSN,entryUUID                eq
index uidNumber,gidNumber,uid,memberUid,loginShell  eq,pres
index homeDirectory,mailMessageStore                eq,pres
index ou,cn,mail,surname,givenname,telephoneNumber,displayName  eq,pres,sub
index nisMapName,nisMapEntry                        eq,pres,sub
index shadowLastChange                              eq,pres
index member,uniqueMember eq,pres

#
# Index for mail attrs.
#
# Domain object
index domainName,mtaTransport,accountStatus,enabledService,disabledService  eq,pres,sub
index domainAliasName    eq,pres,sub
index domainMaxUserNumber eq,pres
index domainAdmin,domainGlobalAdmin,domainBackupMX    eq,pres,sub
index domainSenderBccAddress,domainRecipientBccAddress  eq,pres,sub

# Group object
index accessPolicy,hasMember,listAllowedUser,mailingListID   eq,pres,sub

# User object
index mailForwardingAddress,shadowAddress   eq,pres,sub
index backupMailAddress,memberOfGroup   eq,pres,sub
index userRecipientBccAddress,userSenderBccAddress  eq,pres,sub
index mobile,departmentNumber eq,pres,sub
