diff options
Diffstat (limited to '')
250 files changed, 92048 insertions, 0 deletions
diff --git a/doc/Makefile.in b/doc/Makefile.in new file mode 100644 index 0000000..8578b01 --- /dev/null +++ b/doc/Makefile.in @@ -0,0 +1,16 @@ +## doc Makefile.in for OpenLDAP +# $OpenLDAP$ +## This work is part of OpenLDAP Software <http://www.openldap.org/>. +## +## Copyright 1998-2018 The OpenLDAP Foundation. +## All rights reserved. +## +## Redistribution and use in source and binary forms, with or without +## modification, are permitted only as authorized by the OpenLDAP +## Public License. +## +## A copy of this license is available in the file LICENSE in the +## top-level directory of the distribution or, alternatively, at +## <http://www.OpenLDAP.org/license.html>. + +SUBDIRS= man diff --git a/doc/devel/README b/doc/devel/README new file mode 100644 index 0000000..5622d78 --- /dev/null +++ b/doc/devel/README @@ -0,0 +1,8 @@ +The OpenLDAP Developer's FAQ is available at: + http://www.openldap.org/faq/index.cgi?file=4 + +Additional developer pages are at: + http://www.openldap.org/devel/ + +--- +$OpenLDAP$ diff --git a/doc/devel/args b/doc/devel/args new file mode 100644 index 0000000..7805eff --- /dev/null +++ b/doc/devel/args @@ -0,0 +1,63 @@ +Tools ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz +ldapcompare * DE**HI** MNOPQR UVWXYZ de *h*** *nop* vwxyz +ldapdelete *CDE**HI** MNOPQR UVWXYZ cdef*h*** *nop* vwxyz +ldapexop * D **HI** NO QR UVWXYZ de *h*** *nop vwxy +ldapmodify *CDE**HI** MNOPQRS UVWXYZabcde *h*** *nop*r t vwxy +ldapmodrdn *CDE**HI** MNOPQR UVWXYZ cdef*h*** *nop*rs vwxy +ldappasswd A*CDE**HI** NO QRS UVWXYZa def*h*** * o * s vwxy +ldapsearch A*CDE**HI**LMNOPQRSTUVWXYZab def*h***l*nop* stuvwxyz +ldapurl * E**H ** S ab f*h*** * p* s +ldapwhoami * DE**HI** NO QR UVWXYZ def*h*** *nop* vwxy + + +* reserved + BFGJgijmq01235789 + +* General flags: + -C Chase Referrals + -D Bind DN + -E Tool-specific Extensions (e.g., -E <[!]oid[=options]>*) + -e General Extensions (e.g., -e <[!]oid[=options]>*) + -f file + -H URI + -P protocol version + -V version information + -W prompt for bind password + -d debug + -h host + -n no-op + -N no (SASLprep) normalization of simple bind password + -o general options (currently nettimeout and ldif-wrap only) + -p port + -v verbose + -V version + -x simple bind + -y Bind password-file + -w Bind password + +Not used + -4 IPv4 only + -6 IPv6 only + + +* LDAPv3 Only + -M ManageDSAIT + -Z StartTLS + + -Y SASL Mechanism (defaults to "best") + -R SASL Realm (defaults to empty) + -O SASL Security Options (defaults to "noanonymous,noplain") + -U SASL Authentication Identity (defaults to USER) + -X SASL Authorization Identity (defaults to empty) + + -I SASL interactive mode (default: automatic) + -Q SASL quiet mode (default: automatic) + + +* LDAPv2+ Only (REMOVED) + -K LDAPv2 Kerberos Bind (Step 1 only) + -k LDAPv2 Kerberos Bind + + +--- +$OpenLDAP$ diff --git a/doc/devel/template.c b/doc/devel/template.c new file mode 100644 index 0000000..28e028d --- /dev/null +++ b/doc/devel/template.c @@ -0,0 +1,26 @@ +/* template.c -- example OpenLDAP source file */ +/* $OpenLDAP$ */ +/* This work is part of OpenLDAP Software <http://www.openldap.org/>. + * + * Copyright YEAR The OpenLDAP Foundation. + * Portions Copyright YEAR Secondary Rights Holder. + * Portions Copyright YEAR Another Rights Holder. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. + * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * <http://www.OpenLDAP.org/license.html>. + */ +/* Additional (custom) notices (where necessary). + * Please consult Kurt Zeilenga <kurt@openldap.org> before adding + * additional notices. + */ +/* ACKNOWLEDGEMENTS: + * This work was initially developed by Jane Doe for inclusion in + * OpenLDAP Software. Additional significant contributors include: + * John Doe + */ diff --git a/doc/devel/todo b/doc/devel/todo new file mode 100644 index 0000000..ca088e8 --- /dev/null +++ b/doc/devel/todo @@ -0,0 +1,73 @@ +OpenLDAP Software To Do List +---------------------------- + +This is a list of projects that need getting done. They are defined +by scale of the effort as opposed to priority. Contribute to +projects based upon your personal priorities. + +If you would like to work on any of these projects, please coordinate +by posting to OpenLDAP-devel mailing list: + http://www.OpenLDAP.org/lists + +If you have a project you'd like added to the list, talk it up on +Developer's list or just do it. + +Please read: + http://www.OpenLDAP.org/devel/programming.html + http://www.OpenLDAP.org/devel/contributing.html + + +OpenLDAP 2.x Projects +--------------------- + SLAPD + Complete Unicode Support (ACLs, etc.) + client C API update + Implement per referral/continuation callback + clients (e.g. ldapsearch(1)) + Implement referral chasing options w/ referral callback + Update manual pages + + +Large projects +-------------- +Implement character string localization +Implement X.500 administrative models (e.g. subentries (RFC 3672), etc.) +Implement LDAP sorted search results control (RFC 2891) + + +Medium projects +--------------- +Add syncrepl turn +Implement DIT Structure Rules and Name Forms +Implement LDAPprep +Implement native support for simple SASL mechanisms + (e.g. EXTERNAL and PLAIN) +Redesign slapd memory allocation fault handling +Localize tools + + +Small projects +-------------- +Add BSD kqueue(2) support to slapd(8) +Add DSML capabilities to command line tools +Add LDIFv2 (XML) support to command line tools +Implement authPassword (RFC 3112) +Implement SASLprep (RFC 4013) for LDAP (draft-ietf-ldapbis-*) +Implement additional matching rules (RFC 3698) +Add dumpasn1 logging support +Add tests to test suite +Recode linked-list structs to use <ldap_queue.h> macros +Convert utfconv.txt into man page(s). +Update manual pages as needed. + + +For additional TODO items, see: + http://www.openldap.org/its/index.cgi/Software%20Enhancements + http://www.openldap.org/its/index.cgi/Software%20Bugs + + +JLDAP TODO items, see: + http://www.openldap.org/devel/gitweb.cgi?p=openldap-jldap.git;a=blob_plain;f=design/todo.txt + +--- +$OpenLDAP$ diff --git a/doc/devel/toolargs b/doc/devel/toolargs new file mode 100644 index 0000000..eae05c9 --- /dev/null +++ b/doc/devel/toolargs @@ -0,0 +1,29 @@ +Tools ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz +slapacl D F U X b d f o uv +slapadd F S bcd fg j l no q s uvw +slapauth F M R U X d f o v +slapcat F H abcd fg l no s v +slapdn F N P d f o v +slapindex F bcd fg no q t v +slappasswd T c h s uv +slapschema F H abcd fg l no s v +slaptest F Q d f no uv + +* General flags: + -F config directory + -U authcID + -X authzID + -b suffix (slapacl: entryDN) + -c continue mode + -d debug level + -f config file + -l LDIF file + -n database number + -o options + -q "quick" mode + -s subtree + -u dryrun (slappasswd: RFC2307 userPassword) + -v verbose + +--- +$OpenLDAP$ diff --git a/doc/devel/utfconv.txt b/doc/devel/utfconv.txt new file mode 100644 index 0000000..88dfb1d --- /dev/null +++ b/doc/devel/utfconv.txt @@ -0,0 +1,291 @@ + Dec 5, 2000 + Dave Steck + Novell, Inc. + + UTF-8 Conversion Functions + + +1. Strings in the LDAP C SDK should be encoded in UTF-8 format. + However, most platforms do not provide APIs for converting to + this format. If they do, they are platform-specific. + + As a result, most applications (knowingly or not) use local strings + with LDAP functions. This works fine for 7-bit ASCII characters, + but will fail with 8-bit European characters, Asian characters, etc. + + We propose adding the following platform-independent conversion functions + to the OpenLDAP SDK. There are 4 functions for converting between UTF-8 + and wide characters, and 4 functions for converting between UTF-8 and + multibyte characters. + + For multibyte to UTF-8 conversions, charset translation is necessary. + While a full charset translator is not practical or appropriate for the + LDAP SDK, we can pass the translator function in as an argument. + A NULL for this argument will use the ANSI C functions mbtowc, mbstowcs, + wctomb, and wcstombs. + +2. UTF-8 <--> Wide Character conversions + +The following new conversion routines will be added, following the pattern of +the ANSI C conversion routines (mbtowc, mbstowcs, etc). These routines use +the wchar_t type. wchar_t is 2 bytes on some systems and 4 bytes on others. +However the advantage of using wchar_t is that all the standard wide character +string functions may be used on these strings: wcslen, wcscpy, etc. + + int ldap_x_utf8_to_wc - Convert a single UTF-8 encoded character to a wide character. + int ldap_x_utf8s_to_wcs - Convert a UTF-8 string to a wide character string. + int ldap_x_wc_to_utf8 - Convert a single wide character to a UTF-8 sequence. + int ldap_x_wcs_to_utf8s - Convert a wide character string to a UTF-8 string. + + +2.1 ldap_x_utf8_to_wc - Convert a single UTF-8 encoded character to a wide character. + +int ldap_x_utf8_to_wc ( wchar_t *wchar, const char *utf8char ) + + wchar (OUT) Points to a wide character code to receive the + converted character. + + utf8char (IN) Address of the UTF8 sequence of bytes. + +Return Value: + If successful, the function returns the length in + bytes of the UTF-8 input character. + + If utf8char is NULL or points to an empty string, the + function returns 1 and a NULL is written to wchar. + + If utf8char contains an invalid UTF-8 sequence -1 is returned. + + +2.2 ldap_x_utf8s_to_wcs - Convert a UTF-8 string to a wide character string. + +int ldap_x_utf8s_to_wcs (wchar_t *wcstr, const char *utf8str, size_t count) + + wcstr (OUT) Points to a wide char buffer to receive the + converted wide char string. The output string will be + null terminated if there is space for it in the + buffer. + + utf8str (IN) Address of the null-terminated UTF-8 string to convert. + + count (IN) The number of UTF-8 characters to convert, or + equivalently, the size of the output buffer in wide + characters. + +Return Value: + If successful, the function returns the number of wide + characters written to wcstr, excluding the null termination + character, if any. + + If wcstr is NULL, the function returns the number of wide + characters required to contain the converted string, + excluding the null termination character. + + If an invalid UTF-8 sequence is encountered, the + function returns -1. + + If the return value equals count, there was not enough space to fit the + string and the null terminator in the buffer. + + +2.3 ldap_x_wc_to_utf8 - Convert a single wide character to a UTF-8 sequence. + +int ldap_x_wc_to_utf8 ( char *utf8char, wchar_t wchar, count ) + + utf8char (OUT) Points to a byte array to receive the converted UTF-8 + string. + + wchar (IN) The wide character to convert. + + count (IN) The maximum number of bytes to write to the output + buffer. Normally set this to LDAP_MAX_UTF8_LEN, which + is defined as 3 or 6 depending on the size of wchar_t. + A partial character will not be written. + +Return Value: + If successful, the function returns the length in bytes of + the converted UTF-8 output character. + + If wchar is NULL, the function returns 1 and a NULL is + written to utf8char. + + If wchar cannot be converted to a UTF-8 character, the + function returns -1. + + +2.4 int ldap_x_wcs_to_utf8s - Convert a wide character string to a UTF-8 string. + +int ldap_x_wcs_to_utf8s (char *utf8str, const wchar_t *wcstr, size_t count) + + utf8str (OUT) Points to a byte array to receive the converted + UTF-8 string. The output string will be null + terminated if there is space for it in the + buffer. + + + wcstr (IN) Address of the null-terminated wide char string to convert. + + count (IN) The size of the output buffer in bytes. + +Return Value: + If successful, the function returns the number of bytes + written to utf8str, excluding the null termination + character, if any. + + If utf8str is NULL, the function returns the number of + bytes required to contain the converted string, excluding + the null termination character. The 'count' parameter is ignored. + + If the function encounters a wide character that cannot + be mapped to a UTF-8 sequence, the function returns -1. + + If the return value equals count, there was not enough space to fit + the string and the null terminator in the buffer. + + + +3. Multi-byte <--> UTF-8 Conversions + +These functions convert the string in a two-step process, from multibyte +to Wide, then from Wide to UTF8, or vice versa. This conversion requires a +charset translation routine, which is passed in as an argument. + + ldap_x_mb_to_utf8 - Convert a multi-byte character to a UTF-8 character. + ldap_x_mbs_to_utf8s - Convert a multi-byte string to a UTF-8 string. + ldap_x_utf8_to_mb - Convert a UTF-8 character to a multi-byte character. + ldap_x_utf8s_to_mbs - Convert a UTF-8 string to a multi-byte string. + +3.1 ldap_x_mb_to_utf8 - Convert a multi-byte character to a UTF-8 character. + +int ldap_x_mb_to_utf8 ( char *utf8char, const char *mbchar, size_t mbsize, int (*f_mbtowc)(wchar_t *wchar, const char *mbchar, size_t count) ) + + utf8char (OUT) Points to a byte buffer to receive the converted + UTF-8 character. May be NULL. The output is not + null-terminated. + + mbchar (IN) Address of a sequence of bytes forming a multibyte character. + + mbsize (IN) The maximum number of bytes of the mbchar argument to + check. This should normally be MB_CUR_MAX. + + f_mbtowc (IN) The function to use for converting a multibyte + character to a wide character. If NULL, the local + ANSI C routine mbtowc is used. + +Return Value: + If successful, the function returns the length in bytes of + the UTF-8 output character. + + If utf8char is NULL, count is ignored and the funtion + returns the number of bytes that would be written to the + output char. + + If count is zero, 0 is returned and nothing is written to + utf8char. + + If mbchar is NULL or points to an empty string, the + function returns 1 and a null byte is written to utf8char. + + If mbchar contains an invalid multi-byte character, -1 is returned. + + +3.2 ldap_x_mbs_to_utf8s - Convert a multi-byte string to a UTF-8 string. + +int ldap_x_mbs_to_utf8s (char *utf8str, const char *mbstr, size_t count, + size_t (*f_mbstowcs)(wchar_t *wcstr, const char *mbstr, size_t count)) + +utf8str (OUT) Points to a buffer to receive the converted UTF-8 string. + May be NULL. + + mbchar (IN) Address of the null-terminated multi-byte input string. + + count (IN) The size of the output buffer in bytes. + + f_mbstowcs (IN) The function to use for converting a multibyte string + to a wide character string. If NULL, the local ANSI + C routine mbstowcs is used. + +Return Value: + If successful, the function returns the length in + bytes of the UTF-8 output string, excluding the null + terminator, if present. + + If utf8str is NULL, count is ignored and the function + returns the number of bytes required for the output string, + excluding the NULL. + + If count is zero, 0 is returned and nothing is written to utf8str. + + If mbstr is NULL or points to an empty string, the + function returns 1 and a null byte is written to utf8str. + + If mbstr contains an invalid multi-byte character, -1 is returned. + + If the returned value is equal to count, the entire null-terminated + string would not fit in the output buffer. + + +3.3 ldap_x_utf8_to_mb - Convert a UTF-8 character to a multi-byte character. + +int ldap_x_utf8_to_mb ( char *mbchar, const char *utf8char, + int (*f_wctomb)(char *mbchar, wchar_t wchar) ) + +mbchar (OUT) Points to a byte buffer to receive the converted multi-byte + character. May be NULL. + + utf8char (IN) Address of the UTF-8 character sequence. + + f_wctomb (IN) The function to use for converting a wide character + to a multibyte character. If NULL, the local + ANSI C routine wctomb is used. + + +Return Value: + If successful, the function returns the length in + bytes of the multi-byte output character. + + If utf8char is NULL or points to an empty string, the + function returns 1 and a null byte is written to mbchar. + + If utf8char contains an invalid UTF-8 sequence, -1 is returned. + + +3.4 int ldap_x_utf8s_to_mbs - Convert a UTF-8 string to a multi-byte string. + + +int ldap_x_utf8s_to_mbs ( char *mbstr, const char *utf8str, size_t count, + size_t (*f_wcstombs)(char *mbstr, const wchar_t *wcstr, size_t count) ) + + mbstr (OUT) Points to a byte buffer to receive the converted + multi-byte string. May be NULL. + + utf8str (IN) Address of the null-terminated UTF-8 string to convert. + + count (IN) The size of the output buffer in bytes. + + f_wcstombs (IN) The function to use for converting a wide character + string to a multibyte string. If NULL, the local + ANSI C routine wcstombs is used. + +Return Value: + If successful, the function returns the number of bytes + written to mbstr, excluding the null termination + character, if any. + + If mbstr is NULL, count is ignored and the funtion + returns the number of bytes required for the output string, + excluding the NULL. + + If count is zero, 0 is returned and nothing is written to + mbstr. + + If utf8str is NULL or points to an empty string, the + function returns 1 and a null byte is written to mbstr. + + If an invalid UTF-8 character is encountered, the + function returns -1. + +The output string will be null terminated if there is space for it in +the output buffer. + + diff --git a/doc/guide/README b/doc/guide/README new file mode 100644 index 0000000..87b3bce --- /dev/null +++ b/doc/guide/README @@ -0,0 +1,16 @@ +This module contains OpenLDAP guides in Simple Document Format (SDF). + +SDF is a freely available documentation system. Based on a +simple, readable markup language, SDF generates high quality +output in multiple formats. + + cd admin # OpenLDAP Administrator's Guide + sdf -2topics index.sdf # generate HTML for WWW publishing + sdf -2html guide.sdf # generate HTML for release + sdf -2txt guide.sdf # generate TXT for release + +More information about STF can be obtained from the CPAN at: + http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html + +SDF itself can be obtained at: + http://search.cpan.org/~ianc/sdf-2.001/ diff --git a/doc/guide/admin/Makefile b/doc/guide/admin/Makefile new file mode 100644 index 0000000..de604fb --- /dev/null +++ b/doc/guide/admin/Makefile @@ -0,0 +1,96 @@ +## Makefile for OpenLDAP Administrator's Guide +# $OpenLDAP$ +## This work is part of OpenLDAP Software <http://www.openldap.org/>. +## +## Copyright 2005-2018 The OpenLDAP Foundation. +## All rights reserved. +## +## Redistribution and use in source and binary forms, with or without +## modification, are permitted only as authorized by the OpenLDAP +## Public License. +## +## A copy of this license is available in the file LICENSE in the +## top-level directory of the distribution or, alternatively, at +## <http://www.OpenLDAP.org/license.html>. +all: guide.html index.html + +# for website building (for webmaster use, don't change) +www: guide.html index.html OpenLDAP-Admin-Guide.pdf + +sdf-src: \ + ../plain.sdf \ + ../preamble.sdf \ + abstract.sdf \ + access-control.sdf \ + appendix-changes.sdf \ + appendix-common-errors.sdf \ + appendix-configs.sdf \ + appendix-contrib.sdf \ + appendix-deployments.sdf \ + appendix-ldap-result-codes.sdf \ + appendix-recommended-versions.sdf \ + appendix-upgrading.sdf \ + backends.sdf \ + config.sdf \ + dbtools.sdf \ + glossary.sdf \ + guide.sdf \ + install.sdf \ + intro.sdf \ + maintenance.sdf \ + master.sdf \ + monitoringslapd.sdf \ + overlays.sdf \ + preface.sdf \ + quickstart.sdf \ + referrals.sdf \ + replication.sdf \ + runningslapd.sdf \ + sasl.sdf \ + schema.sdf \ + security.sdf \ + slapdconfig.sdf \ + title.sdf \ + tls.sdf \ + troubleshooting.sdf \ + tuning.sdf + +sdf-img: \ + ../images/LDAPlogo.gif \ + allmail-en.png \ + allusersgroup-en.png \ + config_dit.png \ + config_local.png \ + config_ref.png \ + config_repl.png \ + delta-syncrepl.png \ + dual_dc.png \ + intro_dctree.png \ + intro_tree.png \ + ldap-sync-refreshandpersist.png \ + ldap-sync-refreshonly.png \ + n-way-multi-master.png \ + push-based-complete.png \ + push-based-standalone.png \ + refint.png \ + set-following-references.png \ + set-memberUid.png \ + set-recursivegroup.png + +guide.html: guide.sdf sdf-src sdf-img + sdf -2html guide.sdf + +index.html: index.sdf sdf-src sdf-img + sdf -2topics index.sdf + +admin.html: admin.sdf sdf-src sdf-img + sdf -DPDF -2html admin.sdf + +guide.pdf: admin.html guide.book + htmldoc --batch guide.book -f guide.pdf + +OpenLDAP-Admin-Guide.pdf: admin.html guide.book + htmldoc --batch guide.book -f OpenLDAP-Admin-Guide.pdf + +clean: + rm -f *.pdf *.html *~ *.bak diff --git a/doc/guide/admin/README.spellcheck b/doc/guide/admin/README.spellcheck new file mode 100644 index 0000000..0a123b7 --- /dev/null +++ b/doc/guide/admin/README.spellcheck @@ -0,0 +1,16 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +# +# README.spellcheck +# + +aspell.en.pws + We use aspell to spell check the Admin Guide and Man Pages. + + Please move aspell.en.pws to ~/.aspell.en.pws and run: + + aspell --lang=en_US -c <filename> + + If you add additional words and terms, please add + them or copy them to aspell.en.pws and commit. diff --git a/doc/guide/admin/abstract.sdf b/doc/guide/admin/abstract.sdf new file mode 100644 index 0000000..bd96f83 --- /dev/null +++ b/doc/guide/admin/abstract.sdf @@ -0,0 +1,7 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +# +# OpenLDAP Administrator's Guide: Abstract + + diff --git a/doc/guide/admin/access-control.sdf b/doc/guide/admin/access-control.sdf new file mode 100644 index 0000000..6977da3 --- /dev/null +++ b/doc/guide/admin/access-control.sdf @@ -0,0 +1,1341 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Access Control + +H2: Introduction + +As the directory gets populated with more and more data of varying sensitivity, +controlling the kinds of access granted to the directory becomes more and more +critical. For instance, the directory may contain data of a confidential nature +that you may need to protect by contract or by law. Or, if using the directory +to control access to other services, inappropriate access to the directory may +create avenues of attack to your sites security that result in devastating +damage to your assets. + +Access to your directory can be configured via two methods, the first using +{{SECT:The slapd Configuration File}} and the second using the {{slapd-config}}(5) +format ({{SECT:Configuring slapd}}). + +The default access control policy is allow read by all clients. Regardless of +what access control policy is defined, the {{rootdn}} is always allowed full +rights (i.e. auth, search, compare, read and write) on everything and anything. + +As a consequence, it's useless (and results in a performance penalty) to explicitly +list the {{rootdn}} among the {{<by>}} clauses. + +The following sections will describe Access Control Lists in greater depth and +follow with some examples and recommendations. See {{slapd.access}}(5) for +complete details. + +H2: Access Control via Static Configuration + +Access to entries and attributes is controlled by the +access configuration file directive. The general form of an +access line is: + +> <access directive> ::= access to <what> +> [by <who> [<access>] [<control>] ]+ +> <what> ::= * | +> [dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>] +> [filter=<ldapfilter>] [attrs=<attrlist>] +> <basic-style> ::= regex | exact +> <scope-style> ::= base | one | subtree | children +> <attrlist> ::= <attr> [val[.<basic-style>]=<regex>] | <attr> , <attrlist> +> <attr> ::= <attrname> | entry | children +> <who> ::= * | [anonymous | users | self +> | dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>] +> [dnattr=<attrname>] +> [group[/<objectclass>[/<attrname>][.<basic-style>]]=<regex>] +> [peername[.<basic-style>]=<regex>] +> [sockname[.<basic-style>]=<regex>] +> [domain[.<basic-style>]=<regex>] +> [sockurl[.<basic-style>]=<regex>] +> [set=<setspec>] +> [aci=<attrname>] +> <access> ::= [self]{<level>|<priv>} +> <level> ::= none | disclose | auth | compare | search | read | write | manage +> <priv> ::= {=|+|-}{m|w|r|s|c|x|d|0}+ +> <control> ::= [stop | continue | break] + +where the <what> part selects the entries and/or attributes to which +the access applies, the {{EX:<who>}} part specifies which entities +are granted access, and the {{EX:<access>}} part specifies the +access granted. Multiple {{EX:<who> <access> <control>}} triplets +are supported, allowing many entities to be granted different access +to the same set of entries and attributes. Not all of these access +control options are described here; for more details see the +{{slapd.access}}(5) man page. + + +H3: What to control access to + +The <what> part of an access specification determines the entries +and attributes to which the access control applies. Entries are +commonly selected in two ways: by DN and by filter. The following +qualifiers select entries by DN: + +> to * +> to dn[.<basic-style>]=<regex> +> to dn.<scope-style>=<DN> + +The first form is used to select all entries. The second form may +be used to select entries by matching a regular expression against +the target entry's {{normalized DN}}. (The second form is not +discussed further in this document.) The third form is used to +select entries which are within the requested scope of DN. The +<DN> is a string representation of the Distinguished Name, as +described in {{REF:RFC4514}}. + +The scope can be either {{EX:base}}, {{EX:one}}, {{EX:subtree}}, +or {{EX:children}}. Where {{EX:base}} matches only the entry with +provided DN, {{EX:one}} matches the entries whose parent is the +provided DN, {{EX:subtree}} matches all entries in the subtree whose +root is the provided DN, and {{EX:children}} matches all entries +under the DN (but not the entry named by the DN). + +For example, if the directory contained entries named: + +> 0: o=suffix +> 1: cn=Manager,o=suffix +> 2: ou=people,o=suffix +> 3: uid=kdz,ou=people,o=suffix +> 4: cn=addresses,uid=kdz,ou=people,o=suffix +> 5: uid=hyc,ou=people,o=suffix + +\Then: +. {{EX:dn.base="ou=people,o=suffix"}} match 2; +. {{EX:dn.one="ou=people,o=suffix"}} match 3, and 5; +. {{EX:dn.subtree="ou=people,o=suffix"}} match 2, 3, 4, and 5; and +. {{EX:dn.children="ou=people,o=suffix"}} match 3, 4, and 5. + + +Entries may also be selected using a filter: + +> to filter=<ldap filter> + +where <ldap filter> is a string representation of an LDAP +search filter, as described in {{REF:RFC4515}}. For example: + +> to filter=(objectClass=person) + +Note that entries may be selected by both DN and filter by +including both qualifiers in the <what> clause. + +> to dn.one="ou=people,o=suffix" filter=(objectClass=person) + +Attributes within an entry are selected by including a comma-separated +list of attribute names in the <what> selector: + +> attrs=<attribute list> + +A specific value of an attribute is selected by using a single +attribute name and also using a value selector: + +> attrs=<attribute> val[.<style>]=<regex> + +There are two special {{pseudo}} attributes {{EX:entry}} and +{{EX:children}}. To read (and hence return) a target entry, the +subject must have {{EX:read}} access to the target's {{entry}} +attribute. To perform a search, the subject must have +{{EX:search}} access to the search base's {{entry}} attribute. +To add or delete an entry, the subject must have +{{EX:write}} access to the entry's {{EX:entry}} attribute AND must +have {{EX:write}} access to the entry's parent's {{EX:children}} +attribute. To rename an entry, the subject must have {{EX:write}} +access to entry's {{EX:entry}} attribute AND have {{EX:write}} +access to both the old parent's and new parent's {{EX:children}} +attributes. The complete examples at the end of this section should +help clear things up. + +Lastly, there is a special entry selector {{EX:"*"}} that is used to +select any entry. It is used when no other {{EX:<what>}} +selector has been provided. It's equivalent to "{{EX:dn=.*}}" + + +H3: Who to grant access to + +The <who> part identifies the entity or entities being granted +access. Note that access is granted to "entities" not "entries." +The following table summarizes entity specifiers: + +!block table; align=Center; coltags="EX,N"; \ + title="Table 6.3: Access Entity Specifiers" +Specifier|Entities +*|All, including anonymous and authenticated users +anonymous|Anonymous (non-authenticated) users +users|Authenticated users +self|User associated with target entry +dn[.<basic-style>]=<regex>|Users matching a regular expression +dn.<scope-style>=<DN>|Users within scope of a DN +!endblock + +The DN specifier behaves much like <what> clause DN specifiers. + +Other control factors are also supported. For example, a {{EX:<who>}} +can be restricted by an entry listed in a DN-valued attribute in +the entry to which the access applies: + +> dnattr=<dn-valued attribute name> + +The dnattr specification is used to give access to an entry +whose DN is listed in an attribute of the entry (e.g., give +access to a group entry to whoever is listed as the owner of +the group entry). + +Some factors may not be appropriate in all environments (or any). +For example, the domain factor relies on IP to domain name lookups. +As these can easily be spoofed, the domain factor should be avoided. + + +H3: The access to grant + +The kind of <access> granted can be one of the following: + +!block table; colaligns="LRL"; coltags="EX,EX,N"; align=Center; \ + title="Table 6.4: Access Levels" +Level Privileges Description +none =0 no access +disclose =d needed for information disclosure on error +auth =dx needed to authenticate (bind) +compare =cdx needed to compare +search =scdx needed to apply search filters +read =rscdx needed to read search results +write =wrscdx needed to modify/rename +manage =mwrscdx needed to manage +!endblock + +Each level implies all lower levels of access. So, for example, +granting someone {{EX:write}} access to an entry also grants them +{{EX:read}}, {{EX:search}}, {{EX:compare}}, {{EX:auth}} and +{{EX:disclose}} access. However, one may use the privileges specifier +to grant specific permissions. + + +H3: Access Control Evaluation + +When evaluating whether some requester should be given access to +an entry and/or attribute, slapd compares the entry and/or attribute +to the {{EX:<what>}} selectors given in the configuration file. +For each entry, access controls provided in the database which holds +the entry (or the global access directives if not held in any database) apply +first, followed by the global access directives. However, when dealing with +an access list, because the global access list is effectively appended +to each per-database list, if the resulting list is non-empty then the +access list will end with an implicit {{EX:access to * by * none}} directive. +If there are no access directives applicable to a backend, then a default +read is used. + +Within this +priority, access directives are examined in the order in which they +appear in the config file. Slapd stops with the first {{EX:<what>}} +selector that matches the entry and/or attribute. The corresponding +access directive is the one slapd will use to evaluate access. + +Next, slapd compares the entity requesting access to the {{EX:<who>}} +selectors within the access directive selected above in the order +in which they appear. It stops with the first {{EX:<who>}} selector +that matches the requester. This determines the access the entity +requesting access has to the entry and/or attribute. + +Finally, slapd compares the access granted in the selected +{{EX:<access>}} clause to the access requested by the client. If +it allows greater or equal access, access is granted. Otherwise, +access is denied. + +The order of evaluation of access directives makes their placement +in the configuration file important. If one access directive is +more specific than another in terms of the entries it selects, it +should appear first in the config file. Similarly, if one {{EX:<who>}} +selector is more specific than another it should come first in the +access directive. The access control examples given below should +help make this clear. + + + +H3: Access Control Examples + +The access control facility described above is quite powerful. This +section shows some examples of its use for descriptive purposes. + +A simple example: + +> access to * by * read + +This access directive grants read access to everyone. + +> access to * +> by self write +> by anonymous auth +> by * read + +This directive allows the user to modify their entry, allows anonymous +to authenticate against these entries, and allows all others to +read these entries. Note that only the first {{EX:by <who>}} clause +which matches applies. Hence, the anonymous users are granted +{{EX:auth}}, not {{EX:read}}. The last clause could just as well +have been "{{EX:by users read}}". + +It is often desirable to restrict operations based upon the level +of protection in place. The following shows how security strength +factors (SSF) can be used. + +> access to * +> by ssf=128 self write +> by ssf=64 anonymous auth +> by ssf=64 users read + +This directive allows users to modify their own entries if security +protections have of strength 128 or better have been established, +allows authentication access to anonymous users, and read access +when 64 or better security protections have been established. If +client has not establish sufficient security protections, the +implicit {{EX:by * none}} clause would be applied. + +The following example shows the use of a style specifiers to select +the entries by DN in two access directives where ordering is +significant. + +> access to dn.children="dc=example,dc=com" +> by * search +> access to dn.children="dc=com" +> by * read + +Read access is granted to entries under the {{EX:dc=com}} subtree, +except for those entries under the {{EX:dc=example,dc=com}} subtree, +to which search access is granted. No access is granted to +{{EX:dc=com}} as neither access directive matches this DN. If the +order of these access directives was reversed, the trailing directive +would never be reached, since all entries under {{EX:dc=example,dc=com}} +are also under {{EX:dc=com}} entries. + +Also note that if no {{EX:access to}} directive matches or no {{EX:by +<who>}} clause, {{B:access is denied}}. That is, every {{EX:access +to}} directive ends with an implicit {{EX:by * none}} clause. When dealing +with an access list, because the global access list is effectively appended +to each per-database list, if the resulting list is non-empty then the access +list will end with an implicit {{EX:access to * by * none}} directive. If +there are no access directives applicable to a backend, then a default read is +used. + +The next example again shows the importance of ordering, both of +the access directives and the {{EX:by <who>}} clauses. It also +shows the use of an attribute selector to grant access to a specific +attribute and various {{EX:<who>}} selectors. + +> access to dn.subtree="dc=example,dc=com" attrs=homePhone +> by self write +> by dn.children="dc=example,dc=com" search +> by peername.regex=IP=10\..+ read +> access to dn.subtree="dc=example,dc=com" +> by self write +> by dn.children="dc=example,dc=com" search +> by anonymous auth + +This example applies to entries in the "{{EX:dc=example,dc=com}}" +subtree. To all attributes except {{EX:homePhone}}, an entry can +write to itself, entries under {{EX:example.com}} entries can search +by them, anybody else has no access (implicit {{EX:by * none}}) +excepting for authentication/authorization (which is always done +anonymously). The {{EX:homePhone}} attribute is writable by the +entry, searchable by entries under {{EX:example.com}}, readable by +clients connecting from network 10, and otherwise not readable +(implicit {{EX:by * none}}). All other access is denied by the +implicit {{EX:access to * by * none}}. + +Sometimes it is useful to permit a particular DN to add or +remove itself from an attribute. For example, if you would like to +create a group and allow people to add and remove only +their own DN from the member attribute, you could accomplish +it with an access directive like this: + +> access to attrs=member,entry +> by dnattr=member selfwrite + +The dnattr {{EX:<who>}} selector says that the access applies to +entries listed in the {{EX:member}} attribute. The {{EX:selfwrite}} access +selector says that such members can only add or delete their +own DN from the attribute, not other values. The addition of +the entry attribute is required because access to the entry is +required to access any of the entry's attributes. + +!if 0 +For more details on how to use the {{EX:access}} directive, +consult the {{Advanced Access Control}} chapter. +!endif + + +H2: Access Control via Dynamic Configuration + +Access to slapd entries and attributes is controlled by the +olcAccess attribute, whose values are a sequence of access directives. +The general form of the olcAccess configuration is: + +> olcAccess: <access directive> +> <access directive> ::= to <what> +> [by <who> [<access>] [<control>] ]+ +> <what> ::= * | +> [dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>] +> [filter=<ldapfilter>] [attrs=<attrlist>] +> <basic-style> ::= regex | exact +> <scope-style> ::= base | one | subtree | children +> <attrlist> ::= <attr> [val[.<basic-style>]=<regex>] | <attr> , <attrlist> +> <attr> ::= <attrname> | entry | children +> <who> ::= * | [anonymous | users | self +> | dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>] +> [dnattr=<attrname>] +> [group[/<objectclass>[/<attrname>][.<basic-style>]]=<regex>] +> [peername[.<basic-style>]=<regex>] +> [sockname[.<basic-style>]=<regex>] +> [domain[.<basic-style>]=<regex>] +> [sockurl[.<basic-style>]=<regex>] +> [set=<setspec>] +> [aci=<attrname>] +> <access> ::= [self]{<level>|<priv>} +> <level> ::= none | disclose | auth | compare | search | read | write | manage +> <priv> ::= {=|+|-}{m|w|r|s|c|x|d|0}+ +> <control> ::= [stop | continue | break] + +where the <what> part selects the entries and/or attributes to which +the access applies, the {{EX:<who>}} part specifies which entities +are granted access, and the {{EX:<access>}} part specifies the +access granted. Multiple {{EX:<who> <access> <control>}} triplets +are supported, allowing many entities to be granted different access +to the same set of entries and attributes. Not all of these access +control options are described here; for more details see the +{{slapd.access}}(5) man page. + + +H3: What to control access to + +The <what> part of an access specification determines the entries +and attributes to which the access control applies. Entries are +commonly selected in two ways: by DN and by filter. The following +qualifiers select entries by DN: + +> to * +> to dn[.<basic-style>]=<regex> +> to dn.<scope-style>=<DN> + +The first form is used to select all entries. The second form may +be used to select entries by matching a regular expression against +the target entry's {{normalized DN}}. (The second form is not +discussed further in this document.) The third form is used to +select entries which are within the requested scope of DN. The +<DN> is a string representation of the Distinguished Name, as +described in {{REF:RFC4514}}. + +The scope can be either {{EX:base}}, {{EX:one}}, {{EX:subtree}}, +or {{EX:children}}. Where {{EX:base}} matches only the entry with +provided DN, {{EX:one}} matches the entries whose parent is the +provided DN, {{EX:subtree}} matches all entries in the subtree whose +root is the provided DN, and {{EX:children}} matches all entries +under the DN (but not the entry named by the DN). + +For example, if the directory contained entries named: + +> 0: o=suffix +> 1: cn=Manager,o=suffix +> 2: ou=people,o=suffix +> 3: uid=kdz,ou=people,o=suffix +> 4: cn=addresses,uid=kdz,ou=people,o=suffix +> 5: uid=hyc,ou=people,o=suffix + +\Then: +. {{EX:dn.base="ou=people,o=suffix"}} match 2; +. {{EX:dn.one="ou=people,o=suffix"}} match 3, and 5; +. {{EX:dn.subtree="ou=people,o=suffix"}} match 2, 3, 4, and 5; and +. {{EX:dn.children="ou=people,o=suffix"}} match 3, 4, and 5. + + +Entries may also be selected using a filter: + +> to filter=<ldap filter> + +where <ldap filter> is a string representation of an LDAP +search filter, as described in {{REF:RFC4515}}. For example: + +> to filter=(objectClass=person) + +Note that entries may be selected by both DN and filter by +including both qualifiers in the <what> clause. + +> to dn.one="ou=people,o=suffix" filter=(objectClass=person) + +Attributes within an entry are selected by including a comma-separated +list of attribute names in the <what> selector: + +> attrs=<attribute list> + +A specific value of an attribute is selected by using a single +attribute name and also using a value selector: + +> attrs=<attribute> val[.<style>]=<regex> + +There are two special {{pseudo}} attributes {{EX:entry}} and +{{EX:children}}. To read (and hence return) a target entry, the +subject must have {{EX:read}} access to the target's {{entry}} +attribute. To perform a search, the subject must have +{{EX:search}} access to the search base's {{entry}} attribute. +To add or delete an entry, the subject must have +{{EX:write}} access to the entry's {{EX:entry}} attribute AND must +have {{EX:write}} access to the entry's parent's {{EX:children}} +attribute. To rename an entry, the subject must have {{EX:write}} +access to entry's {{EX:entry}} attribute AND have {{EX:write}} +access to both the old parent's and new parent's {{EX:children}} +attributes. The complete examples at the end of this section should +help clear things up. + +Lastly, there is a special entry selector {{EX:"*"}} that is used to +select any entry. It is used when no other {{EX:<what>}} +selector has been provided. It's equivalent to "{{EX:dn=.*}}" + + +H3: Who to grant access to + +The <who> part identifies the entity or entities being granted +access. Note that access is granted to "entities" not "entries." +The following table summarizes entity specifiers: + +!block table; align=Center; coltags="EX,N"; \ + title="Table 5.3: Access Entity Specifiers" +Specifier|Entities +*|All, including anonymous and authenticated users +anonymous|Anonymous (non-authenticated) users +users|Authenticated users +self|User associated with target entry +dn[.<basic-style>]=<regex>|Users matching a regular expression +dn.<scope-style>=<DN>|Users within scope of a DN +!endblock + +The DN specifier behaves much like <what> clause DN specifiers. + +Other control factors are also supported. For example, a {{EX:<who>}} +can be restricted by an entry listed in a DN-valued attribute in +the entry to which the access applies: + +> dnattr=<dn-valued attribute name> + +The dnattr specification is used to give access to an entry +whose DN is listed in an attribute of the entry (e.g., give +access to a group entry to whoever is listed as the owner of +the group entry). + +Some factors may not be appropriate in all environments (or any). +For example, the domain factor relies on IP to domain name lookups. +As these can easily be spoofed, the domain factor should be avoided. + + +H3: The access to grant + +The kind of <access> granted can be one of the following: + +!block table; colaligns="LRL"; coltags="EX,EX,N"; align=Center; \ + title="Table 5.4: Access Levels" +Level Privileges Description +none =0 no access +disclose =d needed for information disclosure on error +auth =dx needed to authenticate (bind) +compare =cdx needed to compare +search =scdx needed to apply search filters +read =rscdx needed to read search results +write =wrscdx needed to modify/rename +manage =mwrscdx needed to manage +!endblock + +Each level implies all lower levels of access. So, for example, +granting someone {{EX:write}} access to an entry also grants them +{{EX:read}}, {{EX:search}}, {{EX:compare}}, {{EX:auth}} and +{{EX:disclose}} access. However, one may use the privileges specifier +to grant specific permissions. + + +H3: Access Control Evaluation + +When evaluating whether some requester should be given access to +an entry and/or attribute, slapd compares the entry and/or attribute +to the {{EX:<what>}} selectors given in the configuration. For +each entry, access controls provided in the database which holds +the entry (or the global access directives if not held in any database) apply +first, followed by the global access directives (which are held in +the {{EX:frontend}} database definition). However, when dealing with +an access list, because the global access list is effectively appended +to each per-database list, if the resulting list is non-empty then the +access list will end with an implicit {{EX:access to * by * none}} directive. +If there are no access directives applicable to a backend, then a default +read is used. + +Within this priority, +access directives are examined in the order in which they appear +in the configuration attribute. Slapd stops with the first +{{EX:<what>}} selector that matches the entry and/or attribute. The +corresponding access directive is the one slapd will use to evaluate +access. + +Next, slapd compares the entity requesting access to the {{EX:<who>}} +selectors within the access directive selected above in the order +in which they appear. It stops with the first {{EX:<who>}} selector +that matches the requester. This determines the access the entity +requesting access has to the entry and/or attribute. + +Finally, slapd compares the access granted in the selected +{{EX:<access>}} clause to the access requested by the client. If +it allows greater or equal access, access is granted. Otherwise, +access is denied. + +The order of evaluation of access directives makes their placement +in the configuration file important. If one access directive is +more specific than another in terms of the entries it selects, it +should appear first in the configuration. Similarly, if one {{EX:<who>}} +selector is more specific than another it should come first in the +access directive. The access control examples given below should +help make this clear. + + + +H3: Access Control Examples + +The access control facility described above is quite powerful. This +section shows some examples of its use for descriptive purposes. + +A simple example: + +> olcAccess: to * by * read + +This access directive grants read access to everyone. + +> olcAccess: to * +> by self write +> by anonymous auth +> by * read + +This directive allows the user to modify their entry, allows anonymous +to authenticate against these entries, and allows all others to +read these entries. Note that only the first {{EX:by <who>}} clause +which matches applies. Hence, the anonymous users are granted +{{EX:auth}}, not {{EX:read}}. The last clause could just as well +have been "{{EX:by users read}}". + +It is often desirable to restrict operations based upon the level +of protection in place. The following shows how security strength +factors (SSF) can be used. + +> olcAccess: to * +> by ssf=128 self write +> by ssf=64 anonymous auth +> by ssf=64 users read + +This directive allows users to modify their own entries if security +protections of strength 128 or better have been established, +allows authentication access to anonymous users, and read access +when strength 64 or better security protections have been established. If +the client has not establish sufficient security protections, the +implicit {{EX:by * none}} clause would be applied. + +The following example shows the use of style specifiers to select +the entries by DN in two access directives where ordering is +significant. + +> olcAccess: to dn.children="dc=example,dc=com" +> by * search +> olcAccess: to dn.children="dc=com" +> by * read + +Read access is granted to entries under the {{EX:dc=com}} subtree, +except for those entries under the {{EX:dc=example,dc=com}} subtree, +to which search access is granted. No access is granted to +{{EX:dc=com}} as neither access directive matches this DN. If the +order of these access directives was reversed, the trailing directive +would never be reached, since all entries under {{EX:dc=example,dc=com}} +are also under {{EX:dc=com}} entries. + +Also note that if no {{EX:olcAccess: to}} directive matches or no {{EX:by +<who>}} clause, {{B:access is denied}}. When dealing with an access list, +because the global access list is effectively appended to each per-database +list, if the resulting list is non-empty then the access list will end with +an implicit {{EX:access to * by * none}} directive. If there are no access +directives applicable to a backend, then a default read is used. + +The next example again shows the importance of ordering, both of +the access directives and the {{EX:by <who>}} clauses. It also +shows the use of an attribute selector to grant access to a specific +attribute and various {{EX:<who>}} selectors. + +> olcAccess: to dn.subtree="dc=example,dc=com" attrs=homePhone +> by self write +> by dn.children=dc=example,dc=com" search +> by peername.regex=IP=10\..+ read +> olcAccess: to dn.subtree="dc=example,dc=com" +> by self write +> by dn.children="dc=example,dc=com" search +> by anonymous auth + +This example applies to entries in the "{{EX:dc=example,dc=com}}" +subtree. To all attributes except {{EX:homePhone}}, an entry can +write to itself, entries under {{EX:example.com}} entries can search +by them, anybody else has no access (implicit {{EX:by * none}}) +excepting for authentication/authorization (which is always done +anonymously). The {{EX:homePhone}} attribute is writable by the +entry, searchable by entries under {{EX:example.com}}, readable by +clients connecting from network 10, and otherwise not readable +(implicit {{EX:by * none}}). All other access is denied by the +implicit {{EX:access to * by * none}}. + +Sometimes it is useful to permit a particular DN to add or +remove itself from an attribute. For example, if you would like to +create a group and allow people to add and remove only +their own DN from the member attribute, you could accomplish +it with an access directive like this: + +> olcAccess: to attrs=member,entry +> by dnattr=member selfwrite + +The dnattr {{EX:<who>}} selector says that the access applies to +entries listed in the {{EX:member}} attribute. The {{EX:selfwrite}} access +selector says that such members can only add or delete their +own DN from the attribute, not other values. The addition of +the entry attribute is required because access to the entry is +required to access any of the entry's attributes. + + + +H3: Access Control Ordering + +Since the ordering of {{EX:olcAccess}} directives is essential to their +proper evaluation, but LDAP attributes normally do not preserve the +ordering of their values, OpenLDAP uses a custom schema extension to +maintain a fixed ordering of these values. This ordering is maintained +by prepending a {{EX:"{X}"}} numeric index to each value, similarly to +the approach used for ordering the configuration entries. These index +tags are maintained automatically by slapd and do not need to be specified +when originally defining the values. For example, when you create the +settings + +> olcAccess: to attrs=member,entry +> by dnattr=member selfwrite +> olcAccess: to dn.children="dc=example,dc=com" +> by * search +> olcAccess: to dn.children="dc=com" +> by * read + +when you read them back using slapcat or ldapsearch they will contain + +> olcAccess: {0}to attrs=member,entry +> by dnattr=member selfwrite +> olcAccess: {1}to dn.children="dc=example,dc=com" +> by * search +> olcAccess: {2}to dn.children="dc=com" +> by * read + +The numeric index may be used to specify a particular value to change +when using ldapmodify to edit the access rules. This index can be used +instead of (or in addition to) the actual access value. Using this +numeric index is very helpful when multiple access rules are being managed. + +For example, if we needed to change the second rule above to grant +write access instead of search, we could try this LDIF: + +> changetype: modify +> delete: olcAccess +> olcAccess: to dn.children="dc=example,dc=com" by * search +> - +> add: olcAccess +> olcAccess: to dn.children="dc=example,dc=com" by * write +> - + +But this example {{B:will not}} guarantee that the existing values remain in +their original order, so it will most likely yield a broken security +configuration. Instead, the numeric index should be used: + +> changetype: modify +> delete: olcAccess +> olcAccess: {1} +> - +> add: olcAccess +> olcAccess: {1}to dn.children="dc=example,dc=com" by * write +> - + +This example deletes whatever rule is in value #1 of the {{EX:olcAccess}} +attribute (regardless of its value) and adds a new value that is +explicitly inserted as value #1. The result will be + +> olcAccess: {0}to attrs=member,entry +> by dnattr=member selfwrite +> olcAccess: {1}to dn.children="dc=example,dc=com" +> by * write +> olcAccess: {2}to dn.children="dc=com" +> by * read + +which is exactly what was intended. + +!if 0 +For more details on how to use the {{EX:access}} directive, +consult the {{Advanced Access Control}} chapter. +!endif + + +H2: Access Control Common Examples + +H3: Basic ACLs + +Generally one should start with some basic ACLs such as: + +> access to attrs=userPassword +> by self =xw +> by anonymous auth +> by * none +> +> +> access to * +> by self write +> by users read +> by * none + +The first ACL allows users to update (but not read) their passwords, anonymous +users to authenticate against this attribute, and (implicitly) denying all +access to others. + +The second ACL allows users full access to their entry, authenticated users read +access to anything, and (implicitly) denying all access to others (in this case, +anonymous users). + + +H3: Matching Anonymous and Authenticated users + +An anonymous user has a empty DN. While the {{dn.exact=""}} or {{dn.regex="^$"}} + could be used, {{slapd}}(8)) offers an anonymous shorthand which should be +used instead. + +> access to * +> by anonymous none +> by * read + +denies all access to anonymous users while granting others read. + +Authenticated users have a subject DN. While {{dn.regex=".+"}} will match any +authenticated user, OpenLDAP provides the users short hand which should be used +instead. + +> access to * +> by users read +> by * none + +This ACL grants read permissions to authenticated users while denying others +(i.e.: anonymous users). + + +H3: Controlling rootdn access + +You could specify the {{rootdn}} in {{slapd.conf}}(5) or {{slapd.d}} without +specifying a {{rootpw}}. Then you have to add an actual directory entry with +the same dn, e.g.: + +> dn: cn=Manager,o=MyOrganization +> cn: Manager +> sn: Manager +> objectClass: person +> objectClass: top +> userPassword: {SSHA}someSSHAdata + +Then binding as the {{rootdn}} will require a regular bind to that DN, which +in turn requires auth access to that entry's DN and {{userPassword}}, and this +can be restricted via ACLs. E.g.: + +> access to dn.base="cn=Manager,o=MyOrganization" +> by peername.regex=127\.0\.0\.1 auth +> by peername.regex=192\.168\.0\..* auth +> by users none +> by * none + +The ACLs above will only allow binding using rootdn from localhost and +192.168.0.0/24. + + +H3: Managing access with Groups + +There are a few ways to do this. One approach is illustrated here. Consider the +following DIT layout: + +> +-dc=example,dc=com +> +---cn=administrators,dc=example,dc=com +> +---cn=fred blogs,dc=example,dc=com + +and the following group object (in LDIF format): + +> dn: cn=administrators,dc=example,dc=com +> cn: administrators of this region +> objectclass: groupOfNames (important for the group acl feature) +> member: cn=fred blogs,dc=example,dc=com +> member: cn=somebody else,dc=example,dc=com + +One can then grant access to the members of this this group by adding appropriate +{{by group}} clause to an access directive in {{slapd.conf}}(5). For instance, + +> access to dn.children="dc=example,dc=com" +> by self write +> by group.exact="cn=Administrators,dc=example,dc=com" write +> by * auth + +Like by {{dn}} clauses, one can also use {{expand}} to expand the group name +based upon the regular expression matching of the target, that is, the to {{dn.regex}}). +For instance, + +> access to dn.regex="(.+,)?ou=People,(dc=[^,]+,dc=[^,]+)$" +> attrs=children,entry,uid +> by group.expand="cn=Managers,$2" write +> by users read +> by * auth + + +The above illustration assumed that the group members are to be found in the +{{member}} attribute type of the {{groupOfNames}} object class. If you need to +use a different group object and/or a different attribute type then use the +following {{slapd.conf}}(5) (abbreviated) syntax: + +> access to <what> +> by group/<objectclass>/<attributename>=<DN> <access> + +For example: + +> access to * +> by group/organizationalRole/roleOccupant="cn=Administrator,dc=example,dc=com" write + +In this case, we have an ObjectClass {{organizationalRole}} which contains the +administrator DN's in the {{roleOccupant}} attribute. For instance: + +> dn: cn=Administrator,dc=example,dc=com +> cn: Administrator +> objectclass: organizationalRole +> roleOccupant: cn=Jane Doe,dc=example,dc=com + +Note: the specified member attribute type MUST be of DN or {{NameAndOptionalUID}} syntax, +and the specified object class SHOULD allow the attribute type. + +Dynamic Groups are also supported in Access Control. Please see {{slapo-dynlist}}(5) +and the {{SECT:Dynamic Lists}} overlay section. + + +H3: Granting access to a subset of attributes + +You can grant access to a set of attributes by specifying a list of attribute names +in the ACL {{to}} clause. To be useful, you also need to grant access to the +{{entry}} itself. Also note how {{children}} controls the ability to add, delete, +and rename entries. + +> # mail: self may write, authenticated users may read +> access to attrs=mail +> by self write +> by users read +> by * none +> +> # cn, sn: self my write, all may read +> access to attrs=cn,sn +> by self write +> by * read +> +> # immediate children: only self can add/delete entries under this entry +> access to attrs=children +> by self write +> +> # entry itself: self may write, all may read +> access to attrs=entry +> by self write +> by * read +> +> # other attributes: self may write, others have no access +> access to * +> by self write +> by * none + +ObjectClass names may also be specified in this list, which will affect +all the attributes that are required and/or allowed by that {{objectClass}}. +Actually, names in {{attrlist}} that are prefixed by {{@}} are directly treated +as objectClass names. A name prefixed by {{!}} is also treated as an objectClass, +but in this case the access rule affects the attributes that are not required +nor allowed by that {{objectClass}}. + + +H3: Allowing a user write to all entries below theirs + +For a setup where a user can write to its own record and to all of its children: + +> access to dn.regex="(.+,)?(uid=[^,]+,o=Company)$" +> by dn.exact,expand="$2" write +> by anonymous auth + +(Add more examples for above) + + +H3: Allowing entry creation + +Let's say, you have it like this: + +> o=<basedn> +> ou=domains +> associatedDomain=<somedomain> +> ou=users +> uid=<someuserid> +> uid=<someotheruserid> +> ou=addressbooks +> uid=<someuserid> +> cn=<someone> +> cn=<someoneelse> + +and, for another domain <someotherdomain>: + +> o=<basedn> +> ou=domains +> associatedDomain=<someotherdomain> +> ou=users +> uid=<someuserid> +> uid=<someotheruserid> +> ou=addressbooks +> uid=<someotheruserid> +> cn=<someone> +> cn=<someoneelse> + +then, if you wanted user {{uid=<someuserid>}} to {{B:ONLY}} create an entry +for its own thing, you could write an ACL like this: + +> # this rule lets users of "associatedDomain=<matcheddomain>" +> # write under "ou=addressbook,associatedDomain=<matcheddomain>,ou=domains,o=<basedn>", +> # i.e. a user can write ANY entry below its domain's address book; +> # this permission is necessary, but not sufficient, the next +> # will restrict this permission further +> +> +> access to dn.regex="^ou=addressbook,associatedDomain=([^,]+),ou=domains,o=<basedn>$" attrs=children +> by dn.regex="^uid=([^,]+),ou=users,associatedDomain=$1,ou=domains,o=<basedn>$$" write +> by * none +> +> +> # Note that above the "by" clause needs a "regex" style to make sure +> # it expands to a DN that starts with a "uid=<someuserid>" pattern +> # while substituting the associatedDomain submatch from the "what" clause. +> +> +> # This rule lets a user with "uid=<matcheduid>" of "<associatedDomain=matcheddomain>" +> # write (i.e. add, modify, delete) the entry whose DN is exactly +> # "uid=<matcheduid>,ou=addressbook,associatedDomain=<matcheddomain>,ou=domains,o=<basedn>" +> # and ANY entry as subtree of it +> +> +> access to dn.regex="^(.+,)?uid=([^,]+),ou=addressbook,associatedDomain=([^,]+),ou=domains,o=<basedn>$" +> by dn.exact,expand="uid=$2,ou=users,associatedDomain=$3,ou=domains,o=<basedn>" write +> by * none +> +> +> # Note that above the "by" clause uses the "exact" style with the "expand" +> # modifier because now the whole pattern can be rebuilt by means of the +> # submatches from the "what" clause, so a "regex" compilation and evaluation +> # is no longer required. + + +H3: Tips for using regular expressions in Access Control + +Always use {{dn.regex=<pattern>}} when you intend to use regular expression +matching. {{dn=<pattern>}} alone defaults to {{dn.exact<pattern>}}. + +Use {{(.+)}} instead of {{(.*)}} when you want at least one char to be matched. +{{(.*)}} matches the empty string as well. + +Don't use regular expressions for matches that can be done otherwise in a safer +and cheaper manner. Examples: + +> dn.regex=".*dc=example,dc=com" + +is unsafe and expensive: + + * unsafe because any string containing {{dc=example,dc=com }}will match, +not only those that end with the desired pattern; use {{.*dc=example,dc=com$}} instead. + * unsafe also because it would allow any {{attributeType}} ending with {{dc}} + as naming attribute for the first RDN in the string, e.g. a custom attributeType +{{mydc}} would match as well. If you really need a regular expression that allows +just {{dc=example,dc=com}} or any of its subtrees, use {{^(.+,)?dc=example,dc=com$}}, +which means: anything to the left of dc=..., if any (the question mark after the +pattern within brackets), must end with a comma; + * expensive because if you don't need submatches, you could use scoping styles, e.g. + +> dn.subtree="dc=example,dc=com" + +to include {{dc=example,dc=com}} in the matching patterns, + +> dn.children="dc=example,dc=com" + +to exclude {{dc=example,dc=com}} from the matching patterns, or + +> dn.onelevel="dc=example,dc=com" + +to allow exactly one sublevel matches only. + +Always use {{^}} and {{$}} in regexes, whenever appropriate, because +{{ou=(.+),ou=(.+),ou=addressbooks,o=basedn}} will match +{{something=bla,ou=xxx,ou=yyy,ou=addressbooks,o=basedn,ou=addressbooks,o=basedn,dc=some,dc=org}} + +Always use {{([^,]+)}} to indicate exactly one RDN, because {{(.+)}} can +include any number of RDNs; e.g. {{ou=(.+),dc=example,dc=com}} will match +{{ou=My,o=Org,dc=example,dc=com}}, which might not be what you want. + +Never add the rootdn to the by clauses. ACLs are not even processed for operations +performed with rootdn identity (otherwise there would be no reason to define a +rootdn at all). + +Use shorthands. The user directive matches authenticated users and the anonymous +directive matches anonymous users. + +Don't use the {{dn.regex}} form for <by> clauses if all you need is scoping +and/or substring replacement; use scoping styles (e.g. {{exact}}, {{onelevel}}, +{{children}} or {{subtree}}) and the style modifier expand to cause substring expansion. + +For instance, + +> access to dn.regex=".+,dc=([^,]+),dc=([^,]+)$" +> by dn.regex="^[^,],ou=Admin,dc=$1,dc=$2$$" write + +although correct, can be safely and efficiently replaced by + +> access to dn.regex=".+,(dc=[^,]+,dc=[^,]+)$" +> by dn.onelevel,expand="ou=Admin,$1" write + +where the regex in the {{<what>}} clause is more compact, and the one in the {{<by>}} +clause is replaced by a much more efficient scoping style of onelevel with substring expansion. + + +H3: Granting and Denying access based on security strength factors (ssf) + +You can restrict access based on the security strength factor (SSF) + +> access to dn="cn=example,cn=edu" +> by * ssf=256 read + +0 (zero) implies no protection, +1 implies integrity protection only, +56 DES or other weak ciphers, +112 triple DES and other strong ciphers, +128 RC4, Blowfish and other modern strong ciphers. + +Other possibilities: + +> transport_ssf=<n> +> tls_ssf=<n> +> sasl_ssf=<n> + +256 is recommended. + +See {{slapd.conf}}(5) for information on {{ssf}}. + + +H3: When things aren't working as expected + +Consider this example: + +> access to * +> by anonymous auth +> +> access to * +> by self write +> +> access to * +> by users read + +You may think this will allow any user to login, to read everything and change +his own data if he is logged in. But in this example only the login works and +an ldapsearch returns no data. The Problem is that SLAPD goes through its access +config line by line and stops as soon as it finds a match in the part of the +access rule.(here: {{to *}}) + +To get what we wanted the file has to read: + +> access to * +> by anonymous auth +> by self write +> by users read + +The general rule is: "special access rules first, generic access rules last" + +See also {{slapd.access}}(5), loglevel 128 and {{slapacl}}(8) for debugging +information. + + +H2: Sets - Granting rights based on relationships + +Sets are best illustrated via examples. The following sections will present +a few set ACL examples in order to facilitate their understanding. + +(Sets in Access Controls FAQ Entry: {{URL:http://www.openldap.org/faq/data/cache/1133.html}}) + +Note: Sets are considered experimental. + + +H3: Groups of Groups + +The OpenLDAP ACL for groups doesn't expand groups within groups, which are +groups that have another group as a member. For example: + +> dn: cn=sudoadm,ou=group,dc=example,dc=com +> cn: sudoadm +> objectClass: groupOfNames +> member: uid=john,ou=people,dc=example,dc=com +> member: cn=accountadm,ou=group,dc=example,dc=com +> +> dn: cn=accountadm,ou=group,dc=example,dc=com +> cn: accountadm +> objectClass: groupOfNames +> member: uid=mary,ou=people,dc=example,dc=com + +If we use standard group ACLs with the above entries and allow members of the +{{F:sudoadm}} group to write somewhere, {{F:mary}} won't be included: + +> access to dn.subtree="ou=sudoers,dc=example,dc=com" +> by group.exact="cn=sudoadm,ou=group,dc=example,dc=com" write +> by * read + +With sets we can make the ACL be recursive and consider group within groups. So +for each member that is a group, it is further expanded: + +> access to dn.subtree="ou=sudoers,dc=example,dc=com" +> by set="[cn=sudoadm,ou=group,dc=example,dc=com]/member* & user" write +> by * read + +This set ACL means: take the {{F:cn=sudoadm}} DN, check its {{F:member}} +attribute(s) (where the "{{F:*}}" means recursively) and intersect the result +with the authenticated user's DN. If the result is non-empty, the ACL is +considered a match and write access is granted. + +The following drawing explains how this set is built: +!import "set-recursivegroup.png"; align="center"; title="Building a recursive group" +FT[align="Center"] Figure X.Y: Populating a recursive group set + +First we get the {{F:uid=john}} DN. This entry doesn't have a {{F:member}} +attribute, so the expansion stops here. Now we get to {{F:cn=accountadm}}. +This one does have a {{F:member}} attribute, which is {{F:uid=mary}}. The +{{F:uid=mary}} entry, however, doesn't have member, so we stop here again. The +end comparison is: + +> {"uid=john,ou=people,dc=example,dc=com","uid=mary,ou=people,dc=example,dc=com"} & user + +If the authenticated user's DN is any one of those two, write access is +granted. So this set will include {{F:mary}} in the {{F:sudoadm}} group and she +will be allowed the write access. + +H3: Group ACLs without DN syntax + +The traditional group ACLs, and even the previous example about recursive groups, require +that the members are specified as DNs instead of just usernames. + +With sets, however, it's also possible to use simple names in group ACLs, as this example will +show. + +Let's say we want to allow members of the {{F:sudoadm}} group to write to the +{{F:ou=suders}} branch of our tree. But our group definition now is using {{F:memberUid}} for +the group members: + +> dn: cn=sudoadm,ou=group,dc=example,dc=com +> cn: sudoadm +> objectClass: posixGroup +> gidNumber: 1000 +> memberUid: john + +With this type of group, we can't use group ACLs. But with a set ACL we can +grant the desired access: + +> access to dn.subtree="ou=sudoers,dc=example,dc=com" +> by set="[cn=sudoadm,ou=group,dc=example,dc=com]/memberUid & user/uid" write +> by * read + +We use a simple intersection where we compare the {{F:uid}} attribute +of the connecting (and authenticated) user with the {{F:memberUid}} attributes +of the group. If they match, the intersection is non-empty and the ACL will +grant write access. + +This drawing illustrates this set when the connecting user is authenticated as +{{F:uid=john,ou=people,dc=example,dc=com}}: +!import "set-memberUid.png"; align="center"; title="Sets with memberUid" +FT[align="Center"] Figure X.Y: Sets with {{F:memberUid}} + +In this case, it's a match. If it were {{F:mary}} authenticating, however, she +would be denied write access to {{F:ou=sudoers}} because her {{F:uid}} +attribute is not listed in the group's {{F:memberUid}}. + +H3: Following references + +We will now show a quite powerful example of what can be done with sets. This +example tends to make OpenLDAP administrators smile after they have understood +it and its implications. + +Let's start with an user entry: + +> dn: uid=john,ou=people,dc=example,dc=com +> uid: john +> objectClass: inetOrgPerson +> givenName: John +> sn: Smith +> cn: john +> manager: uid=mary,ou=people,dc=example,dc=com + +Writing an ACL to allow the manager to update some attributes is quite simple +using sets: + +> access to dn.exact="uid=john,ou=people,dc=example,dc=com" +> attrs=carLicense,homePhone,mobile,pager,telephoneNumber +> by self write +> by set="this/manager & user" write +> by * read + +In that set, {{F:this}} expands to the entry being accessed, so that +{{F:this/manager}} expands to {{F:uid=mary,ou=people,dc=example,dc=com}} when +john's entry is accessed. If the manager herself is accessing John's entry, +the ACL will match and write access to those attributes will be granted. + +So far, this same behavior can be obtained with the {{F:dnattr}} keyword. With +sets, however, we can further enhance this ACL. Let's say we want to allow the +secretary of the manager to also update these attributes. This is how we do it: + +> access to dn.exact="uid=john,ou=people,dc=example,dc=com" +> attrs=carLicense,homePhone,mobile,pager,telephoneNumber +> by self write +> by set="this/manager & user" write +> by set="this/manager/secretary & user" write +> by * read + +Now we need a picture to help explain what is happening here (entries shortened +for clarity): + +!import "set-following-references.png"; align="center"; title="Sets jumping through entries" +FT[align="Center"] Figure X.Y: Sets jumping through entries + +In this example, Jane is the secretary of Mary, which is the manager of John. +This whole relationship is defined with the {{F:manager}} and {{F:secretary}} +attributes, which are both of the distinguishedName syntax (i.e., full DNs). +So, when the {{F:uid=john}} entry is being accessed, the +{{F:this/manager/secretary}} set becomes +{{F:{"uid=jane,ou=people,dc=example,dc=com"}}} (follow the references in the +picture): + +> this = [uid=john,ou=people,dc=example,dc=com] +> this/manager = \ +> [uid=john,ou=people,dc=example,dc=com]/manager = uid=mary,ou=people,dc=example,dc=com +> this/manager/secretary = \ +> [uid=mary,ou=people,dc=example,dc=com]/secretary = uid=jane,ou=people,dc=example,dc=com + +The end result is that when Jane accesses John's entry, she will be granted +write access to the specified attributes. Better yet, this will happen to any +entry she accesses which has Mary as the manager. + +This is all cool and nice, but perhaps gives too much power to secretaries. Maybe we need to further +restrict it. For example, let's only allow executive secretaries to have this power: + +> access to dn.exact="uid=john,ou=people,dc=example,dc=com" +> attrs=carLicense,homePhone,mobile,pager,telephoneNumber +> by self write +> by set="this/manager & user" write +> by set="this/manager/secretary & +> [cn=executive,ou=group,dc=example,dc=com]/member* & +> user" write +> by * read + +It's almost the same ACL as before, but we now also require that the connecting user be a member +of the (possibly nested) {{F:cn=executive}} group. + + diff --git a/doc/guide/admin/admin.sdf b/doc/guide/admin/admin.sdf new file mode 100644 index 0000000..0ed35e3 --- /dev/null +++ b/doc/guide/admin/admin.sdf @@ -0,0 +1,11 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +# +# guide.sdf +# + +!macro build_html_cover +!endmacro + +!include "master.sdf" diff --git a/doc/guide/admin/allmail-en.png b/doc/guide/admin/allmail-en.png Binary files differnew file mode 100644 index 0000000..a50a0ff --- /dev/null +++ b/doc/guide/admin/allmail-en.png diff --git a/doc/guide/admin/allusersgroup-en.png b/doc/guide/admin/allusersgroup-en.png Binary files differnew file mode 100644 index 0000000..76f1569 --- /dev/null +++ b/doc/guide/admin/allusersgroup-en.png diff --git a/doc/guide/admin/appendix-changes.sdf b/doc/guide/admin/appendix-changes.sdf new file mode 100644 index 0000000..b3f8bdc --- /dev/null +++ b/doc/guide/admin/appendix-changes.sdf @@ -0,0 +1,219 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Changes Since Previous Release + +The following sections attempt to summarize the new features and changes in OpenLDAP +software since the 2.3.x release and the OpenLDAP Admin Guide. + +H2: New Guide Sections + +In order to make the Admin Guide more thorough and cover the majority of questions +asked on the OpenLDAP mailing lists and scenarios discussed there, we have added the following new sections: + +* {{SECT:When should I use LDAP?}} +* {{SECT:When should I not use LDAP?}} +* {{SECT:LDAP vs RDBMS}} +* {{SECT:Access Control}} +* {{SECT:Backends}} +* {{SECT:Overlays}} +* {{SECT:Replication}} +* {{SECT:Maintenance}} +* {{SECT:Monitoring}} +* {{SECT:Tuning}} +* {{SECT:Troubleshooting}} +* {{SECT:Changes Since Previous Release}} +* {{SECT:Upgrading from 2.3.x}} +* {{SECT:Common errors encountered when using OpenLDAP Software}} +* {{SECT:Recommended OpenLDAP Software Dependency Versions}} +* {{SECT:Real World OpenLDAP Deployments and Examples}} +* {{SECT:OpenLDAP Software Contributions}} +* {{SECT:Configuration File Examples}} +* {{SECT:LDAP Result Codes}} +* {{SECT:Glossary}} + +Also, the table of contents is now 3 levels deep to ease navigation. + + +H2: New Features and Enhancements in 2.4 + +H3: Better {{B:cn=config}} functionality + +There is a new slapd-config(5) manpage for the {{B:cn=config}} backend. The +original design called for auto-renaming of config entries when you insert or +delete entries with ordered names, but that was not implemented in 2.3. It is +now in 2.4. This means, e.g., if you have + +> olcDatabase={1}mdb,cn=config +> olcSuffix: dc=example,dc=com + +and you want to add a new subordinate, now you can ldapadd: + +> olcDatabase={1}mdb,cn=config +> olcSuffix: dc=foo,dc=example,dc=com + +This will insert a new back-mdb database in slot 1 and bump all following databases + down one, so the original back-mdb database will now be named: + +> olcDatabase={2}mdb,cn=config +> olcSuffix: dc=example,dc=com + +H3: Better {{B:cn=schema}} functionality + +In 2.3 you were only able to add new schema elements, not delete or modify +existing elements. In 2.4 you can modify schema at will. (Except for the +hardcoded system schema, of course.) + +H3: More sophisticated Syncrepl configurations + +The original implementation of Syncrepl in OpenLDAP 2.2 was intended to support +multiple consumers within the same database, but that feature never worked and +was removed from OpenLDAP 2.3; you could only configure a single consumer in +any database. + +In 2.4 you can configure multiple consumers in a single database. The configuration +possibilities here are quite complex and numerous. You can configure consumers +over arbitrary subtrees of a database (disjoint or overlapping). Any portion +of the database may in turn be provided to other consumers using the Syncprov +overlay. The Syncprov overlay works with any number of consumers over a single +database or over arbitrarily many glued databases. + +H3: N-Way Multimaster Replication + +As a consequence of the work to support multiple consumer contexts, the syncrepl +system now supports full N-Way multimaster replication with entry-level conflict +resolution. There are some important constraints, of course: In order to maintain +consistent results across all servers, you must maintain tightly synchronized +clocks across all participating servers (e.g., you must use NTP on all servers). + +The entryCSNs used for replication now record timestamps with microsecond resolution, +instead of just seconds. The delta-syncrepl code has not been updated to support +multimaster usage yet, that will come later in the 2.4 cycle. + +H3: Replicating {{slapd}} Configuration (syncrepl and {{B:cn=config}}) + +Syncrepl was explicitly disabled on cn=config in 2.3. It is now fully supported +in 2.4; you can use syncrepl to replicate an entire server configuration from +one server to arbitrarily many other servers. It's possible to clone an entire +running slapd using just a small (less than 10 lines) seed configuration, or +you can just replicate the schema subtrees, etc. Tests 049 and 050 in the test +suite provide working examples of these capabilities. + + +H3: Push-Mode Replication + +In 2.3 you could configure syncrepl as a full push-mode replicator by using it +in conjunction with a back-ldap pointed at the target server. But because the +back-ldap database needs to have a suffix corresponding to the target's suffix, +you could only configure one instance per slapd. + +In 2.4 you can define a database to be "hidden", which means that its suffix is +ignored when checking for name collisions, and the database will never be used +to answer requests received by the frontend. Using this "hidden" database feature +allows you to configure multiple databases with the same suffix, allowing you to +set up multiple back-ldap instances for pushing replication of a single database +to multiple targets. There may be other uses for hidden databases as well (e.g., +using a syncrepl consumer to maintain a *local* mirror of a database on a separate filesystem). + + +H3: More extensive TLS configuration control + +In 2.3, the TLS configuration in slapd was only used by the slapd listeners. For +outbound connections used by e.g. back-ldap or syncrepl their TLS parameters came +from the system's ldap.conf file. + +In 2.4 all of these sessions inherit their settings from the main slapd configuration, +but settings can be individually overridden on a per-config-item basis. This is +particularly helpful if you use certificate-based authentication and need to use a +different client certificate for different destinations. + + +H3: Performance enhancements + +Too many to list. Some notable changes - ldapadd used to be a couple of orders +of magnitude slower than "slapadd -q". It's now at worst only about half the +speed of slapadd -q. Some comparisons of all the 2.x OpenLDAP releases are available +at {{URL:http://www.openldap.org/pub/hyc/scale2007.pdf}} + +That compared 2.0.27, 2.1.30, 2.2.30, 2.3.33, and CVS HEAD). Toward the latter end +of the "Cached Search Performance" chart it gets hard to see the difference +because the run times are so small, but the new code is about 25% faster than 2.3, +which was about 20% faster than 2.2, which was about 100% faster than 2.1, which +was about 100% faster than 2.0, in that particular search scenario. That test +basically searched a 1.3GB DB of 380836 entries (all in the slapd entry cache) +in under 1 second. i.e., on a 2.4GHz CPU with DDR400 ECC/Registered RAM we can +search over 500 thousand entries per second. The search was on an unindexed +attribute using a filter that would not match any entry, forcing slapd to examine +every entry in the DB, testing the filter for a match. + +Essentially the slapd entry cache in back-bdb/back-hdb is so efficient the search +processing time is almost invisible; the runtime is limited only by the memory +bandwidth of the machine. (The search data rate corresponds to about 3.5GB/sec; +the memory bandwidth on the machine is only about 4GB/sec due to ECC and register latency.) + +H3: New overlays + +* slapo-constraint (Attribute value constraints) +* slapo-dds (Dynamic Directory Services, RFC 2589) +* slapo-memberof (reverse group membership maintenance) + +H3: New features in existing Overlays + +* slapo-pcache + - Inspection/Maintenance + -- the cache database can be directly accessed via + LDAP by adding a specific control to each LDAP request; a specific + extended operation allows to consistently remove cached entries and entire + cached queries + - Hot Restart + -- cached queries are saved on disk at shutdown, and reloaded if + not expired yet at subsequent restart + +* slapo-rwm can safely interoperate with other overlays +* Dyngroup/Dynlist merge, plus security enhancements + - added dgIdentity support (draft-haripriya-dynamicgroup) + +H3: New features in slapd + +* monitoring of back-{b,h}db: cache fill-in, non-indexed searches, +* session tracking control (draft-wahl-ldap-session) +* subtree delete in back-sql (draft-armijo-ldap-treedelete) +* sorted values in multivalued attributes for faster matching +* lightweight dispatcher for greater throughput under heavy load and on +multiprocessor machines. (33% faster than 2.3 on AMD quad-socket dual-core server.) + + +H3: New features in libldap + +* ldap_sync client API (LDAP Content Sync Operation, RFC 4533) + +H3: New clients, tools and tool enhancements + +* ldapexop for arbitrary extended operations +* Complete support of controls in request/response for all clients +* LDAP Client tools now honor SRV records + +H3: New build options + +* Support for building against GnuTLS + + +H2: Obsolete Features Removed From 2.4 + +These features were strongly deprecated in 2.3 and removed in 2.4. + +H3: Slurpd + +Please read the {{SECT:Replication}} section as to why this is no longer in +OpenLDAP + +H3: back-ldbm + +back-ldbm was both slow and unreliable. Its byzantine indexing code was +prone to spontaneous corruption, as were the underlying database libraries +that were commonly used (e.g. GDBM or NDBM). back-bdb and back-hdb are +superior in every aspect, with simplified indexing to avoid index corruption, +fine-grained locking for greater concurrency, hierarchical caching for +greater performance, streamlined on-disk format for greater efficiency +and portability, and full transaction support for greater reliability. diff --git a/doc/guide/admin/appendix-common-errors.sdf b/doc/guide/admin/appendix-common-errors.sdf new file mode 100644 index 0000000..2c21b71 --- /dev/null +++ b/doc/guide/admin/appendix-common-errors.sdf @@ -0,0 +1,662 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Common errors encountered when using OpenLDAP Software + +The following sections attempt to summarize the most common causes of LDAP errors +when using OpenLDAP + +H2: Common causes of LDAP errors + +H3: ldap_*: Can't contact LDAP server + +The {{B:Can't contact LDAP server}} error is usually returned when the LDAP +server cannot be contacted. This may occur for many reasons: + +* the LDAP server is not running; this can be checked by running, for example, + +> telnet <host> <port> + +replacing {{<host>}} and {{<port>}} with the hostname and the port the server +is supposed to listen on. +* the client has not been instructed to contact a running server; with OpenLDAP +command-line tools this is accomplished by providing the -H switch, whose +argument is a valid LDAP url corresponding to the interface the server is +supposed to be listening on. + +H3: ldap_*: No such object + +The {{B:no such object}} error is generally returned when the target DN of the +operation cannot be located. This section details reasons common to all +operations. You should also look for answers specific to the operation +(as indicated in the error message). + +The most common reason for this error is non-existence of the named object. First, +check for typos. + +Also note that, by default, a new directory server holds no objects +(except for a few system entries). So, if you are setting up a new directory +server and get this message, it may simply be that you have yet to add the +object you are trying to locate. + +The error commonly occurs because a DN was not specified and a default was not +properly configured. + +If you have a suffix specified in slapd.conf eg. + +> suffix "dc=example,dc=com" + +You should use + +> ldapsearch -b 'dc=example,dc=com' '(cn=jane*)' + +to tell it where to start the search. + +The {{F:-b}} should be specified for all LDAP commands unless you have an +{{ldap.conf}}(5) default configured. + +See {{ldapsearch}}(1), {{ldapmodify}}(1) + +Also, {{slapadd}}(8) and its ancillary programs are very strict about the +syntax of the LDIF file. + +Some liberties in the LDIF file may result in an apparently successful creation +of the database, but accessing some parts of it may be difficult. + +One known common error in database creation is putting a blank line before the +first entry in the LDIF file. {{B:There must be no leading blank lines in the +LDIF file.}} + +It is generally recommended that {{ldapadd}}(1) be used instead of {{slapadd}}(8) +when adding new entries your directory. {{slapadd}}(8) should be used to bulk +load entries known to be valid. + +Another cause of this message is a referral +({SECT:Constructing a Distributed Directory Service}}) entry to an unpopulated +directory. + +Either remove the referral, or add a single record with the referral base DN +to the empty directory. + +This error may also occur when slapd is unable to access the contents of its +database because of file permission problems. For instance, on a Red Hat Linux +system, slapd runs as user 'ldap'. When slapadd is run as root to create a +database from scratch, the contents of {{F:/var/lib/ldap}} are created with +user and group root and with permission 600, making the contents inaccessible +to the slapd server. + +H3: ldap_*: Can't chase referral + +This is caused by the line + +> referral ldap://root.openldap.org + +In {{F:slapd.conf}}, it was provided as an example for how to use referrals +in the original file. However if your machine is not permanently connected to +the Internet, it will fail to find the server, and hence produce an error message. + +To resolve, just place a # in front of line and restart slapd or point it to +an available ldap server. + +See also: {{ldapadd}}(1), {{ldapmodify}}(1) and {{slapd.conf}}(5) + +H3: ldap_*: server is unwilling to perform + +slapd will return an unwilling to perform error if the backend holding the +target entry does not support the given operation. + +The password backend is only willing to perform searches. It will return an +unwilling to perform error for all other operations. + +The shell backend is configurable and may support a limited subset of operations. +Check for other errors indicating a shortage of resources required by the +directory server. i.e. you may have a full disk etc + +H3: ldap_*: Insufficient access + +This error occurs when server denies the operation due to insufficient access. +This is usually caused by binding to a DN with insufficient privileges +(or binding anonymously) to perform the operation. + +You can bind as the rootdn/rootpw specified in {{slapd.conf}}(5) to gain full +access. Otherwise, you must bind to an entry which has been granted the +appropriate rights through access controls. + + +H3: ldap_*: Invalid DN syntax + +The target (or other) DN of the operation is invalid. This implies that either +the string representation of the DN is not in the required form, one of the +types in the attribute value assertions is not defined, or one of the values +in the attribute value assertions does not conform to the appropriate syntax. + +H3: ldap_*: Referral hop limit exceeded + +This error generally occurs when the client chases a referral which refers +itself back to a server it already contacted. The server responds as it did +before and the client loops. This loop is detected when the hop limit is exceeded. + +This is most often caused through misconfiguration of the server's default +referral. The default referral should not be itself: + +That is, on {{F:ldap://myldap/}} the default referral should not be {{F:ldap://myldap/}} + (or any hostname/ip which is equivalent to myldap). + +H3: ldap_*: operations error + +In some versions of {{slapd}}(8), {{operationsError}} was returned instead of other. + +H3: ldap_*: other error + +The other result code indicates an internal error has occurred. +While the additional information provided with the result code might provide +some hint as to the problem, often one will need to consult the server's log files. + +H3: ldap_add/modify: Invalid syntax + +This error is reported when a value of an attribute does not conform to syntax +restrictions. Additional information is commonly provided stating which value +of which attribute was found to be invalid. Double check this value and other +values (the server will only report the first error it finds). + +Common causes include: + +* extraneous whitespace (especially trailing whitespace) +* improperly encoded characters (LDAPv3 uses UTF-8 encoded Unicode) +* empty values (few syntaxes allow empty values) + + +For certain syntax, like OBJECT IDENTIFIER (OID), this error can indicate that +the OID descriptor (a "short name") provided is unrecognized. For instance, +this error is returned if the {{objectClass}} value provided is unrecognized. + +H3: ldap_add/modify: Object class violation + +This error is returned with the entry to be added or the entry as modified +violates the object class schema rules. Normally additional information is +returned the error detailing the violation. Some of these are detailed below. + +Violations related to the entry's attributes: + +> Attribute not allowed + +A provided attribute is not allowed by the entry's object class(es). + +> Missing required attribute + +An attribute required by the entry's object class(es) was not provided. + +Violations related to the entry's class(es): + +> Entry has no objectClass attribute + +The entry did not state which object classes it belonged to. + +> Unrecognized objectClass + +One (or more) of the listed objectClass values is not recognized. + +> No structural object class provided + +None of the listed objectClass values is structural. + +> Invalid structural object class chain + +Two or more structural objectClass values are not in same structural object +class chain. + +> Structural object class modification + +Modify operation attempts to change the structural class of the entry. + +> Instanstantiation of abstract objectClass. + +An abstract class is not subordinate to any listed structural or auxiliary class. + +> Invalid structural object class + +Other structural object class problem. + +> No structuralObjectClass operational attribute + +This is commonly returned when a shadow server is provided an entry which does +not contain the structuralObjectClass operational attribute. + + +Note that the above error messages as well as the above answer assumes basic +knowledge of LDAP/X.500 schema. + +H3: ldap_add: No such object + +The "ldap_add: No such object" error is commonly returned if parent of the +entry being added does not exist. Add the parent entry first... + +For example, if you are adding "cn=bob,dc=domain,dc=com" and you get: + +> ldap_add: No such object + +The entry "dc=domain,dc=com" likely doesn't exist. You can use ldapsearch to +see if does exist: + +> ldapsearch -b 'dc=domain,dc=com' -s base '(objectclass=*)' + +If it doesn't, add it. See {{SECT:A Quick-Start Guide}} for assistance. + +Note: if the entry being added is the same as database suffix, it's parent +isn't required. i.e.: if your suffix is "dc=domain,dc=com", "dc=com" doesn't +need to exist to add "dc=domain,dc=com". + +This error will also occur if you try to add any entry that the server is not +configured to hold. + +For example, if your database suffix is "dc=domain,dc=com" and you attempt to +add "dc=domain2,dc=com", "dc=com", "dc=domain,dc=org", "o=domain,c=us", or an +other DN in the "dc=domain,dc=com" subtree, the server will return a + "No such object" (or referral) error. + +{{slapd}}(8) will generally return "no global superior knowledge" as additional +information indicating its return noSuchObject instead of a referral as the +server is not configured with knowledge of a global superior server. + + +H3: ldap add: invalid structural object class chain + +This particular error refers to the rule about STRUCTURAL objectclasses, which +states that an object is of one STRUCTURAL class, the structural class of the +object. The object is said to belong to this class, zero or more auxiliaries + classes, and their super classes. + +While all of these classes are commonly listed in the objectClass attribute of +the entry, one of these classes is the structural object class of the entry. +Thus, it is OK for an objectClass attribute +to contain inetOrgPerson, organizationalPerson, and person because they inherit + one from another to form a single super class chain. That is, inetOrgPerson SUPs +organizationPerson SUPs person. On the other hand, it is invalid for both inetOrgPerson +and account to be listed in objectClass as inetOrgPerson and account are not +part of the same super class chain (unless some other class is also listed +with is a subclass of both). + +To resolve this problem, one must determine which class will better serve +structural object class for the entry, adding this class to the objectClass +attribute (if not already present), and remove any other structural class from +the entry's objectClass attribute which is not a super class of the structural +object class. + +Which object class is better depends on the particulars of the situation. +One generally should consult the documentation for the applications one is +using for help in making the determination. + +H3: ldap_add: no structuralObjectClass operational attribute + +ldapadd(1) may error: + +> adding new entry "uid=XXX,ou=People,o=campus,c=ru" +> ldap_add: Internal (implementation specific) error (80) +> additional info: no structuralObjectClass operational attribute + +when slapd(8) cannot determine, based upon the contents of the objectClass +attribute, what the structural class of the object should be. + + +H3: ldap_add/modify/rename: Naming violation + +OpenLDAP's slapd checks for naming attributes and distinguished values consistency, +according to RFC 4512. + +Naming attributes are those attributeTypes that appear in an entry's RDN; + distinguished values are the values of the naming attributes that appear in +an entry's RDN, e.g, in + +> cn=Someone+mail=someone@example.com,dc=example,dc=com + +the naming attributes are cn and mail, and the distinguished values are +Someone and someone@example.com. + +OpenLDAP's slapd checks for consistency when: + +* adding an entry +* modifying an entry, if the values of the naming attributes are changed +* renaming an entry, if the RDN of the entry changes + +Possible causes of error are: + +* the naming attributes are not present in the entry; for example: + +> dn: dc=example,dc=com +> objectClass: organization +> o: Example +> # note: "dc: example" is missing + +* the naming attributes are present in the entry, but in the attributeType +definition they are marked as: +- collective +- operational +- obsolete + +* the naming attributes are present in the entry, but the distinguished values +are not; for example: + +> dn: dc=example,dc=com +> objectClass: domain +> dc: foobar +> # note: "dc" is present, but the value is not "example" + +* the naming attributes are present in the entry, with the distinguished values, but the naming attributes: +- do not have an equality field, so equality cannot be asserted +- the matching rule is not supported (yet) +- the matching rule is not appropriate + +* the given distinguished values do not comply with their syntax + +* other errors occurred during the validation/normalization/match process; +this is a catchall: look at previous logs for details in case none of the above +apply to your case. + +In any case, make sure that the attributeType definition for the naming attributes +contains an appropriate EQUALITY field; or that of the superior, if they are +defined based on a superior attributeType (look at the SUP field). See RFC 4512 for details. + + +H3: ldap_add/delete/modify/rename: no global superior knowledge + +If the target entry name places is not within any of the databases the server +is configured to hold and the server has no knowledge of a global superior, +the server will indicate it is unwilling to perform the operation and provide +the text "no global superior knowledge" as additional text. + +Likely the entry name is incorrect, or the server is not properly configured +to hold the named entry, or, in distributed directory environments, a default +referral was not configured. + + +H3: ldap_bind: Insufficient access + +Current versions of slapd(8) requires that clients have authentication +permission to attribute types used for authentication purposes before accessing +them to perform the bind operation. As all bind operations are done anonymously +(regardless of previous bind success), the auth access must be granted to anonymous. + +In the example ACL below grants the following access: + +* to anonymous users: +- permission to authenticate using values of userPassword +* to authenticated users: +- permission to update (but not read) their userPassword +- permission to read any object excepting values of userPassword + +All other access is denied. + +> access to attr=userPassword +> by self =w +> by anonymous auth + +> access * +> by self write +> by users read + + +H3: ldap_bind: Invalid credentials + +The error usually occurs when the credentials (password) provided does not +match the userPassword held in entry you are binding to. + +The error can also occur when the bind DN specified is not known to the server. + +Check both! In addition to the cases mentioned above you should check if the +server denied access to userPassword on selected parts of the directory. In +fact, slapd always returns "Invalid credentials" in case of failed bind, +regardless of the failure reason, since other return codes could reveal the +validity of the user's name. + +To debug access rules defined in slapd.conf, add "ACL" to log level. + +H3: ldap_bind: Protocol error + +There error is generally occurs when the LDAP version requested by the +client is not supported by the server. + +The OpenLDAP Software 2.x server, by default, only accepts version 3 LDAP Bind +requests but can be configured to accept a version 2 LDAP Bind request. + +Note: The 2.x server expects LDAPv3 [RFC4510] to be used when the client +requests version 3 and expects a limited LDAPv3 variant (basically, LDAPv3 +syntax and semantics in an LDAPv2 PDUs) to be used when version 2 is expected. + +This variant is also sometimes referred to as LDAPv2+, but differs from the U-Mich +LDAP variant in a number of ways. + +H3: ldap_modify: cannot modify object class + +This message is commonly returned when attempting to modify the objectClass +attribute in a manner inconsistent with the LDAP/X.500 information model. In +particular, it commonly occurs when one tries to change the structure of the +object from one class to another, for instance, trying to change an 'apple' +into a 'pear' or a 'fruit' into a 'pear'. + +Such changes are disallowed by the slapd(8) in accordance with LDAP and X.500 restrictions. + + +H3: ldap_sasl_interactive_bind_s: ... + +If you intended to bind using a DN and password and get an error from +ldap_sasl_interactive_bind_s, you likely forgot to provide a '-x' option to +the command. By default, SASL authentication is used. '-x' is necessary to +select "simple" authentication. + + +H3: ldap_sasl_interactive_bind_s: No such Object + +This indicates that LDAP SASL authentication function could not read the +Root DSE. +The error will occur when the server doesn't provide a root DSE. This may be +due to access controls. + + +H3: ldap_sasl_interactive_bind_s: No such attribute + +This indicates that LDAP SASL authentication function could read the Root +DSE but it contained no supportedSASLMechanism attribute. + +The supportedSASLmechanism attribute lists mechanisms currently available. +The list may be empty because none of the supported mechanisms are currently +available. For example, EXTERNAL is listed only if the client has established +its identity by authenticating at a lower level (e.g. TLS). + +Note: the attribute may not be visible due to access controls + +Note: SASL bind is the default for all OpenLDAP tools, e.g. ldapsearch(1), ldapmodify(1). To force use of "simple" bind, use the "-x" option. Use of "simple" bind is not recommended unless one has adequate confidentiality protection in place (e.g. TLS/SSL, IPSEC). + +H3: ldap_sasl_interactive_bind_s: Unknown authentication method + +This indicates that none of the SASL authentication supported by the server +are supported by the client, or that they are too weak or otherwise inappropriate +for use by the client. Note that the default security options disallows the use +of certain mechanisms such as ANONYMOUS and PLAIN (without TLS). + +Note: SASL bind is the default for all OpenLDAP tools. To force use of "simple" bind, use the "-x" option. Use of "simple" bind is not recommended unless one has adequate confidentiality protection in place (e.g. TLS/SSL, IPSEC). + +H3: ldap_sasl_interactive_bind_s: Local error (82) + +Apparently not having forward and reverse DNS entries for the LDAP server can result in this error. + + +H3: ldap_search: Partial results and referral received + +This error is returned with the server responses to an LDAPv2 search query +with both results (zero or more matched entries) and references (referrals to other servers). +See also: ldapsearch(1). + +If the updatedn on the replica does not exist, a referral will be returned. +It may do this as well if the ACL needs tweaking. + +H3: ldap_start_tls: Operations error + +ldapsearch(1) and other tools will return + +> ldap_start_tls: Operations error (1) +> additional info: TLS already started + +When the user (though command line options and/or ldap.conf(5)) has requested +TLS (SSL) be started twice. For instance, when specifying both "-H ldaps://server.do.main" and "-ZZ". + +H2: Other Errors + +H3: ber_get_next on fd X failed errno=34 (Numerical result out of range) + +This slapd error generally indicates that the client sent a message that +exceeded an administrative limit. See sockbuf_max_incoming and sockbuf_max_incoming_auth +configuration directives in slapd.conf(5). + +H3: ber_get_next on fd X failed errno=11 (Resource temporarily unavailable) + +This message is not indicative of abnormal behavior or error. It simply means +that expected data is not yet available from the resource, in this context, a +network socket. slapd(8) will process the data once it does becomes available. + +H3: daemon: socket() failed errno=97 (Address family not supported) + +This message indicates that the operating system does not support one of the +(protocol) address families which slapd(8) was configured to support. Most +commonly, this occurs when slapd(8) was configured to support IPv6 yet the +operating system kernel wasn't. In such cases, the message can be ignored. + +H3: GSSAPI: gss_acquire_cred: Miscellaneous failure; Permission denied; + +This message means that slapd is not running as root and, thus, it cannot get +its Kerberos 5 key from the keytab, usually file /etc/krb5.keytab. + +A keytab file is used to store keys that are to be used by services or daemons +that are started at boot time. It is very important that these secrets are kept +beyond reach of intruders. + +That's why the default keytab file is owned by root and protected from being +read by others. Do not mess with these permissions, build a different keytab +file for slapd instead, and make sure it is owned by the user that slapd +runs as. + +To do this, start kadmin, and enter the following commands: + +> addprinc -randkey ldap/ldap.example.com@EXAMPLE.COM +> ktadd -k /etc/openldap/ldap.keytab ldap/ldap.example.com@EXAMPLE.COM + +Then, on the shell, do: + +> chown ldap:ldap /etc/openldap/ldap.keytab +> chmod 600 /etc/openldap/ldap.keytab + +Now you have to tell slapd (well, actually tell the gssapi library in Kerberos 5 +that is invoked by Cyrus SASL) where to find the new keytab. You do this by +setting the environment variable KRB5_KTNAME like this: + +> export KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab" + +Set that environment variable on the slapd start script (Red Hat users might +find /etc/sysconfig/ldap a perfect place). + +This only works if you are using MIT kerberos. It doesn't work with Heimdal, +for instance. + + +In Heimdal there is a function gsskrb5_register_acceptor_identity() that sets +the path of the keytab file you want to use. In Cyrus SASL 2 you can add + +> keytab: /path/to/file + +to your application's SASL config file to use this feature. This only works with Heimdal. + + +H3: access from unknown denied + +This related to TCP wrappers. See hosts_access(5) for more information. +in the log file: "access from unknown denied" This related to TCP wrappers. +See hosts_access(5) for more information. +for example: add the line "slapd: .hosts.you.want.to.allow" in /etc/hosts.allow +to get rid of the error. + +H3: ldap_read: want=# error=Resource temporarily unavailable + +This message occurs normally. It means that pending data is not yet available +from the resource, a network socket. slapd(8) will process the data once it +becomes available. + +H3: `make test' fails + +Some times, `make test' fails at the very first test with an obscure message like + +> make test +> make[1]: Entering directory `/ldap_files/openldap-2.4.6/tests' +> make[2]: Entering directory `/ldap_files/openldap-2.4.6/tests' +> Initiating LDAP tests for BDB... +> Cleaning up test run directory leftover from previous run. +> Running ./scripts/all... +> >>>>> Executing all LDAP tests for bdb +> >>>>> Starting test000-rootdse ... +> running defines.sh +> Starting slapd on TCP/IP port 9011... +> Using ldapsearch to retrieve the root DSE... +> Waiting 5 seconds for slapd to start... +> ./scripts/test000-rootdse: line 40: 10607 Segmentation fault $SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING >$LOG1 2>&1 +> Waiting 5 seconds for slapd to start... +> Waiting 5 seconds for slapd to start... +> Waiting 5 seconds for slapd to start... +> Waiting 5 seconds for slapd to start... +> Waiting 5 seconds for slapd to start... +> ./scripts/test000-rootdse: kill: (10607) - No such pid +> ldap_sasl_bind_s: Can't contact LDAP server (-1) +> >>>>> Test failed +> >>>>> ./scripts/test000-rootdse failed (exit 1) +> make[2]: *** [bdb-yes] Error 1 +> make[2]: Leaving directory `/ldap_files/openldap-2.4.6/tests' +> make[1]: *** [test] Error 2 +> make[1]: Leaving directory `/ldap_files/openldap-2.4.6/tests' +> make: *** [test] Error 2 + +or so. Usually, the five lines + + Waiting 5 seconds for slapd to start... + +indicate that slapd didn't start at all. + +In tests/testrun/slapd.1.log there is a full log of what slapd wrote while +trying to start. The log level can be increased by setting the environment +variable SLAPD_DEBUG to the corresponding value; see loglevel in slapd.conf(5) +for the meaning of log levels. + +A typical reason for this behavior is a runtime link problem, i.e. slapd cannot +find some dynamic libraries it was linked against. Try running ldd(1) on slapd +(for those architectures that support runtime linking). + +There might well be other reasons; the contents of the log file should help +clarifying them. + +Tests that fire up multiple instances of slapd typically log to tests/testrun/slapd.<n>.log, +with a distinct <n> for each instance of slapd; list tests/testrun/ for possible +values of <n>. + +H3: ldap_*: Internal (implementation specific) error (80) - additional info: entry index delete failed + +This seems to be related with wrong ownership of the BDB's dir (/var/lib/ldap) +and files. The files must be owned by the user that slapd runs as. + +> chown -R ldap:ldap /var/lib/ldap + +fixes it in Debian + + +H3: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) + +Using SASL, when a client contacts LDAP server, the slapd service dies +immediately and client gets an error : + +> SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) + +Then check the slapd service, it stopped. + +This may come from incompatible of using different versions of BerkeleyDB for +installing of SASL and installing of OpenLDAP. The problem arises in case of +using multiple version of BerkeleyDB. Solution: - Check which version of +BerkeleyDB when install Cyrus SASL. + +Reinstall OpenLDAP with the version of BerkeleyDB above. + diff --git a/doc/guide/admin/appendix-configs.sdf b/doc/guide/admin/appendix-configs.sdf new file mode 100644 index 0000000..61254d7 --- /dev/null +++ b/doc/guide/admin/appendix-configs.sdf @@ -0,0 +1,14 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Configuration File Examples + + +H2: slapd.conf + + +H2: ldap.conf + + +H2: a-n-other.conf diff --git a/doc/guide/admin/appendix-contrib.sdf b/doc/guide/admin/appendix-contrib.sdf new file mode 100644 index 0000000..a0496c6 --- /dev/null +++ b/doc/guide/admin/appendix-contrib.sdf @@ -0,0 +1,116 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: OpenLDAP Software Contributions + +The following sections attempt to summarize the various contributions in OpenLDAP +software, as found in {{F:openldap_src/contrib}} + +H2: Client APIs + +Intro and discuss + +H3: ldapc++ + +Intro and discuss + +H3: ldaptcl + +Intro and discuss + +H2: Overlays + +H3: acl + +Plugins that implement access rules. Currently only posixGroup, +which implements access control based on posixGroup membership. + + +H3: addpartial + +Treat Add requests as Modify requests if the entry exists. + + +H3: allop + +Return operational attributes for root DSE even when not +requested, since some clients expect this. + + +H3: autogroup + +Automated updates of group memberships. + + +H3: comp_match + +Component Matching rules (RFC 3687). + + +H3: denyop + +Deny selected operations, returning {{unwillingToPerform}}. + + +H3: dsaschema + +Permit loading DSA-specific schema, including operational attrs. + + +H3: lastmod + +Track the time of the last write operation to a database. + + +H3: nops + +Remove null operations, e.g. changing a value to same as before. + + +H3: nssov + +Handle NSS lookup requests through a local Unix Domain socket. + + +H3: passwd + +Support additional password mechanisms. + + +H3: proxyOld + +Proxy Authorization compatibility with obsolete internet-draft. + + +H3: smbk5pwd + +Make the PasswordModify Extended Operation update Kerberos +keys and Samba password hashes as well as {{userPassword}}. + + +H3: trace + +Trace overlay invocation. + + +H3: usn + +Maintain {{usnCreated}} and {{usnChanged}} attrs similar to Microsoft AD. + + +H2: Tools + +Intro and discuss + +H3: Statistic Logging + +statslog + +H2: SLAPI Plugins + +Intro and discuss + +H3: addrdnvalues + +More diff --git a/doc/guide/admin/appendix-deployments.sdf b/doc/guide/admin/appendix-deployments.sdf new file mode 100644 index 0000000..96f7897 --- /dev/null +++ b/doc/guide/admin/appendix-deployments.sdf @@ -0,0 +1,7 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Real World OpenLDAP Deployments and Examples + +Examples and discussions diff --git a/doc/guide/admin/appendix-ldap-result-codes.sdf b/doc/guide/admin/appendix-ldap-result-codes.sdf new file mode 100644 index 0000000..76c4f77 --- /dev/null +++ b/doc/guide/admin/appendix-ldap-result-codes.sdf @@ -0,0 +1,269 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: LDAP Result Codes + +For the purposes of this guide, we have incorporated the standard LDAP result +codes from {{Appendix A. LDAP Result Codes}} of {{REF:RFC4511}}, a copy of which can +be found in {{F:doc/rfc}} of the OpenLDAP source code. + +We have expanded the description of each error in relation to the OpenLDAP +toolsets. +LDAP extensions may introduce extension-specific result codes, which are not part +of RFC4511. +OpenLDAP returns the result codes related to extensions it implements. +Their meaning is documented in the extension they are related to. + +H2: Non-Error Result Codes + +These result codes (called "non-error" result codes) do not indicate +an error condition: + +> success (0), +> compareFalse (5), +> compareTrue (6), +> referral (10), and +> saslBindInProgress (14). + +The {{success}}, {{compareTrue}}, and {{compareFalse}} result codes indicate +successful completion (and, hence, are referred to as "successful" +result codes). + +The {{referral}} and {{saslBindInProgress}} result codes indicate the client +needs to take additional action to complete the operation. + +H2: Result Codes + +Existing LDAP result codes are described as follows: + +H2: success (0) + +Indicates the successful completion of an operation. + +Note: this code is not used with the Compare operation. See {{SECT:compareFalse (5)}} +and {{SECT:compareTrue (6)}}. + +H2: operationsError (1) + +Indicates that the operation is not properly sequenced with +relation to other operations (of same or different type). + +For example, this code is returned if the client attempts to +StartTLS ({{REF:RFC4511}} Section 4.14) while there are other uncompleted operations +or if a TLS layer was already installed. + +H2: protocolError (2) + +Indicates the server received data that is not well-formed. + +For Bind operation only, this code is also used to indicate +that the server does not support the requested protocol +version. + +For Extended operations only, this code is also used to +indicate that the server does not support (by design or +configuration) the Extended operation associated with the +{{requestName}}. + +For request operations specifying multiple controls, this may +be used to indicate that the server cannot ignore the order +of the controls as specified, or that the combination of the +specified controls is invalid or unspecified. + +H2: timeLimitExceeded (3) + +Indicates that the time limit specified by the client was +exceeded before the operation could be completed. + +H2: sizeLimitExceeded (4) + +Indicates that the size limit specified by the client was +exceeded before the operation could be completed. + +H2: compareFalse (5) + +Indicates that the Compare operation has successfully +completed and the assertion has evaluated to FALSE or +Undefined. + +H2: compareTrue (6) + +Indicates that the Compare operation has successfully +completed and the assertion has evaluated to TRUE. + +H2: authMethodNotSupported (7) + +Indicates that the authentication method or mechanism is not +supported. + +H2: strongerAuthRequired (8) + +Indicates the server requires strong(er) authentication in +order to complete the operation. + +When used with the Notice of Disconnection operation, this +code indicates that the server has detected that an +established security association between the client and +server has unexpectedly failed or been compromised. + +H2: referral (10) + +Indicates that a referral needs to be chased to complete the +operation (see {{REF:RFC4511}} Section 4.1.10). + +H2: adminLimitExceeded (11) + +Indicates that an administrative limit has been exceeded. + +H2: unavailableCriticalExtension (12) + +Indicates a critical control is unrecognized (see {{REF:RFC4511}} Section +4.1.11). + +H2: confidentialityRequired (13) + +Indicates that data confidentiality protections are required. + +H2: saslBindInProgress (14) + +Indicates the server requires the client to send a new bind +request, with the same SASL mechanism, to continue the +authentication process (see {{REF:RFC4511}} Section 4.2). + +H2: noSuchAttribute (16) + +Indicates that the named entry does not contain the specified +attribute or attribute value. + +H2: undefinedAttributeType (17) + +Indicates that a request field contains an unrecognized +attribute description. + +H2: inappropriateMatching (18) + +Indicates that an attempt was made (e.g., in an assertion) to +use a matching rule not defined for the attribute type +concerned. + +H2: constraintViolation (19) + +Indicates that the client supplied an attribute value that +does not conform to the constraints placed upon it by the +data model. + +For example, this code is returned when multiple values are +supplied to an attribute that has a SINGLE-VALUE constraint. + +H2: attributeOrValueExists (20) + +Indicates that the client supplied an attribute or value to +be added to an entry, but the attribute or value already +exists. + +H2: invalidAttributeSyntax (21) + +Indicates that a purported attribute value does not conform +to the syntax of the attribute. + +H2: noSuchObject (32) + +Indicates that the object does not exist in the DIT. + +H2: aliasProblem (33) + +Indicates that an alias problem has occurred. For example, +the code may used to indicate an alias has been dereferenced +that names no object. + +H2: invalidDNSyntax (34) + +Indicates that an LDAPDN or RelativeLDAPDN field (e.g., search +base, target entry, ModifyDN newrdn, etc.) of a request does +not conform to the required syntax or contains attribute +values that do not conform to the syntax of the attribute's +type. + +H2: aliasDereferencingProblem (36) + +Indicates that a problem occurred while dereferencing an +alias. Typically, an alias was encountered in a situation +where it was not allowed or where access was denied. + +H2: inappropriateAuthentication (48) + +Indicates the server requires the client that had attempted +to bind anonymously or without supplying credentials to +provide some form of credentials. + +H2: invalidCredentials (49) + +Indicates that the provided credentials (e.g., the user's name +and password) are invalid. + +H2: insufficientAccessRights (50) + +Indicates that the client does not have sufficient access +rights to perform the operation. + +H2: busy (51) + +Indicates that the server is too busy to service the +operation. + +H2: unavailable (52) + +Indicates that the server is shutting down or a subsystem +necessary to complete the operation is offline. + +H2: unwillingToPerform (53) + +Indicates that the server is unwilling to perform the +operation. + +H2: loopDetect (54) + +Indicates that the server has detected an internal loop (e.g., +while dereferencing aliases or chaining an operation). + +H2: namingViolation (64) + +Indicates that the entry's name violates naming restrictions. + +H2: objectClassViolation (65) + +Indicates that the entry violates object class restrictions. + +H2: notAllowedOnNonLeaf (66) + +Indicates that the operation is inappropriately acting upon a +non-leaf entry. + +H2: notAllowedOnRDN (67) + +Indicates that the operation is inappropriately attempting to +remove a value that forms the entry's relative distinguished +name. + +H2: entryAlreadyExists (68) + +Indicates that the request cannot be fulfilled (added, moved, +or renamed) as the target entry already exists. + +H2: objectClassModsProhibited (69) + +Indicates that an attempt to modify the object class(es) of +an entry's 'objectClass' attribute is prohibited. + +For example, this code is returned when a client attempts to +modify the structural object class of an entry. + +H2: affectsMultipleDSAs (71) + +Indicates that the operation cannot be performed as it would +affect multiple servers (DSAs). + +H2: other (80) + +Indicates the server has encountered an internal error. diff --git a/doc/guide/admin/appendix-recommended-versions.sdf b/doc/guide/admin/appendix-recommended-versions.sdf new file mode 100644 index 0000000..52d9bdb --- /dev/null +++ b/doc/guide/admin/appendix-recommended-versions.sdf @@ -0,0 +1,30 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Recommended OpenLDAP Software Dependency Versions + +This appendix details the recommended versions of the software +that OpenLDAP depends on. + +Please read the {{SECT:Prerequisite software}} section for more +information on the following software dependencies. + +H2: Dependency Versions + +!block table; align=Center; coltags="N,EX,EX"; title="Table 8.5: OpenLDAP Software Dependency Versions" +Feature|Software|Version +{{TERM[expand]TLS}}: +|{{PRD:OpenSSL}}|0.9.7+ +|{{PRD:GnuTLS}}|2.12.0 +|{{PRD:MozNSS}}|3.12.9 +{{TERM[expand]SASL}}|{{PRD:Cyrus SASL}}|2.1.21+ +{{TERM[expand]Kerberos}}: +|{{PRD:Heimdal}}|Version +|{{PRD:MIT Kerberos}}|Version +Threads: +|POSIX {{pthreads}}|Version +|Mach {{CThreads}}|Version +TCP Wrappers|Name|Version +!endblock + diff --git a/doc/guide/admin/appendix-upgrading.sdf b/doc/guide/admin/appendix-upgrading.sdf new file mode 100644 index 0000000..9548812 --- /dev/null +++ b/doc/guide/admin/appendix-upgrading.sdf @@ -0,0 +1,40 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Upgrading from 2.3.x + +The following sections attempt to document the steps you will need to take in order +to upgrade from the latest 2.3.x OpenLDAP version. + +The normal upgrade procedure, as discussed in the {{SECT:Maintenance}} section, should +of course still be followed prior to doing any of this. + +H2: {{B:cn=config}} olc* attributes + +Quite a few {{olc*}} attributes have now become obsolete, if you see in your logs +entries like below, just remove them from the relevant ldif file. + +> olcReplicationInterval: value #0: <olcReplicationInterval> keyword is obsolete (ignored) + +H2: ACLs: searches require privileges on the search base + +Search operations now require "search" privileges on the "entry" pseudo-attribute of the search +base. While upgrading from 2.3.x, make sure your ACLs grant such privileges to all desired search +bases. + +For example, assuming you have the following ACL: + +> access to dn.sub="ou=people,dc=example,dc=com" by * search + +Searches using a base of "dc=example,dc=com" will only be allowed if you add the following ACL: + +> access to dn.base="dc=example,dc=com" attrs=entry by * search + +Note: The {{slapd.access}}(5) man page states that this requirement was introduced +with OpenLDAP 2.3. However, it is the default behavior only since 2.4. + + + +ADD MORE HERE + diff --git a/doc/guide/admin/aspell.en.pws b/doc/guide/admin/aspell.en.pws new file mode 100644 index 0000000..f486703 --- /dev/null +++ b/doc/guide/admin/aspell.en.pws @@ -0,0 +1,1694 @@ +personal_ws-1.1 en 1687 +commonName +bla +Masarati +subjectAltName +api +usnCreated +BhY +olcSyncRepl +olcSyncrepl +adamsom +adamson +CER +intermediateResponse +bjensen +cdx +CGI +DCE +DAP +chainingRequired +arg +ddd +DAs +TLSCACertificateFile +BNF +TLSDHParamFile +ppolicy +gavin +ASN +ava +Chu +del +libexecdir +DDR +numericoid +dsaschema +ECC +cli +DIB +dev +reqNewSuperior +librewrite +memberof +memberOf +BSI +updateref +buf +changetype +dir +EGD +pwdMustChange +Debian +dit +AlmostASearchRequest +EXEEXT +edu +Heimdal +organizationalPerson +olcTimeLimit +CAPI +tokenization +INSTALLFLAGS +CRL +reqcert +CRP +postread +csn +laura +checkpass +xvfB +neverDerefaliases +dns +DN's +DNs +dn's +cdef +Helvetica +DOP +requestdata +gcc +gecos +reqData +CWD +ando +reqDeleteOldRDN +DSA +dontusecopy +msgfree +DSE +keycol +dlopen +eng +AttributeValue +attributevalue +DUA +EOF +inputfile +DSP +refreshDone +dst +NOSYNC +env +pagedResultsControl +dup +hdb +LDIFv +syslog +monitorTimestamp +subschemaSubentry +interoperate +gid +testdb +gif +memfree +struct +dirsync +IAB +fmt +SysNet +olcConstraintAttribute +GHz +Bint +memalloc +FSF +usernames +strtol +idl +IDN +DESTDIR +iff +contextCSN +auditModify +auditSearch +OpenLDAP +openldap +resultcode +resultCode +sysconfig +indices +blen +APIs +lresolv +uidObject +Contribware +directoryString +database's +iscritical +qbuaQ +gss +ZKKuqbEKJfKSXhUbHG +employeeType +invalidAttributeSyntax +subtree +Kartik +newparent +DkMTwBl +memcalloc +ing +filtertype +ini +XKqkdPOmY +regcomp +ldapmodify +includedir +IPC +resync +ldapsearch +reqAttr +dynlist +args +hardcoded +pgsql +argv +kdz +notAllowedOnRDN +hostport +StartTLS +starttls +ldb +servercredp +ldd +IPv +ipv +hyc +joe +bindmethods +armijo +ldp +ISP +len +carLicense +Choi +Clatworthy +scherr +virtualnamingcontext +ITU +XXXX +Stringprep +Apurva +labeledURI +DEFS +MDn +attrstyle +directoryOperation +creatorsName +mem +oldPasswdFile +oldpasswdfile +uniqueMember +krb +libpath +acknowledgements +jts +createTimestamp +MIB +LLL +OpenSSL +openssl +LOF +AVAs +associatedDomain +organizationalRole +initgroups +olcDbCachesize +olcDbCacheSize +ETCDIR +colaligns +olcReadOnly +olcReadonly +reqResult +LDAPMatchingRule +bool +LRL +CPPFLAGS +yWpR +schemadir +desc +lud +newrdn +LRU +memvfree +dbtools +nis +rewriteRule +postoperation +LVL +oid +msg +attr +TmkzUAb +caseExactOrderingMatch +Subbarao +aeeiib +oidlen +submatches +PEM +olc +OLF +PDU +LDAPSchemaExtensionItem +auth +Pierangelo +authzFrom +pid +subdirectories +OLP +pwdPolicyChecker +subst +mux +singleLevel +cleartext +numattrsets +requestDN +caseExactSubstringsMatch +NSS +PKI +olcSyncProvConfig +ple +jones +NTP +auditModRDN +checkpointing +NUL +num +objectIdentifierMatch +sharedstatedir +png +CPAN +OSI +extendedop +distinguishedName +distinguishedname +preinstalled +rfc +LDAPCONF +rdn +wZFQrDD +OTP +olcSizeLimit +PRD +sbi +pos +pre +sudoadm +stringal +retoidp +sdf +efgh +PSH +accesslog +sed +cond +qdescrs +modifyDN +conf +ldapmodrdn +sel +bvec +HtZhZS +TBC +stringbv +SHA +Sep +ptr +conn +pwd +DISP +newsup +rnd +TCL +shm +DITs +tcp +INCPATH +RPC +myOID +supportedSASLMechanism +supportedSASLmechanism +realnamingcontext +UCD +SMD +keytab +portnumber +uncached +slp +derefInSearching +UMich's +TGT +numbits +sasldb +UCS +searchDN +keytbl +UDP +tgz +freemods +prepend +nssov +errText +groupnaam +UFl +src +matchedDN +ufn +allusersgroup +FIXME +sql +uid +crit +objectClassViolation +ssf +ldapfilter +vec +TOC +rwm +pwdChangedTime +tls +peernamestyle +xpasswd +SRP +tmp +SSL +dupbv +CPUs +itsupport +SRV +entrymods +sss +rwx +reqNewRDN +nopresent +rebindproc +olcOverlayConfig +str +syncIdSet +cron +accesslevel +czBJdDqS +accessor's +keyval +alloc +saslpasswd +README +QWGWZpj +maxentries +ttl +undefinedAttributeType +peercred +sys +allop +memberUid +CSNs +wildcards +uri +tty +url +sambaGroupMapping +XED +sortKey +UTF +vlv +TXN +usn +auditExtended +usr +txt +UTR +XER +roomNumber +olcDbIDLcacheSize +namespace +LDAPControl +dbconfig +olcAttributeOptions +dsaparam +searchResult +ctrl +ldapwhoami +extensibleObject +clientctrls +monitorServer +MANCOMPRESSSUFFIX +memberAttr +multiclassing +memberURL +sudoers +pwdMaxFailure +pseudorootdn +MezRroT +GDBM +LIBRELEASE +DSA's +DSAs +realloc +booleanMatch +compareTrue +mySQL +passwd +printf +idassert +rwxrwxrwx +al +realself +cd +aQ +ar +olcDatabaseConfig +de +derated +auditDelete +cn +ee +versa +cp +bv +eg +fd +dn +fG +DS +fi +EO +allmail +du +eq +pwdAllowUserChange +dx +et +eu +syncUUIDs +hh +regexec +IG +msgidp +noEstimate +kb +organizationalUnit +Warper +logfilter +io +ip +referralsRequired +ld +Matic +regexes +subfinal +pseudorootpw +md +preread +pwdMinLength +iZ +ldapdelete +xyz +rdbms +RDBMs +extparam +mk +ng +oc +FIPS +NL +logfiles +mr +octetStringSubstringsMatch +ok +mv +LTVERSION +someotheruserid +rc +realdn +ou +yyy +sb +enum +auditContext +QN +contrib +RL +errMatchedDN +auditContainer +ro +rp +th +sn +ru +UG +ss +behera +TP +su +invalidCredentials +tt +wildcard +wi +syslogd +newPasswd +xf +deallocation +whitespaces +retdatap +attrlist +Vu +Za +PDkzODdASFxOQ +MyOrganization +ws +cacert +notAllowedOnNonLeaf +attrname +olcTLSCipherSuite +Xr +x's +xw +octetStringMatch +mechs +ZZ +LDVERSION +testAttr +backend +backends +backend's +BerValues +Solaris +structs +reqTimeLimit +judgmentday +reqAuthzID +errp +ostring +policyDN +testObject +pwdMaxAge +binddn +bindDN +bindDn +distributedOperation +schemachecking +strvals +dataflow +robert +fqdn +prtotal +admittable +Makefile +IANA +localhost +offsite +bindir +fred +olcUpdateref +bindwhen +UMLDAP +searchResultDone +MAXLEN +pwdInHistory +realtime +reqAttrsOnly +sysconfdir +searchResultReference +olcAttributeTypes +everytime +protocolError +errno +errOp +serverctrls +recursivegroup +BlpQmtczb +integerMatch +moduledir +dynstyle +bindpw +AUTHNAME +UniqueName +blahblah +saslmech +pthreads +IEEE +regex +SIGINT +slappasswd +errABsObject +errAbsObject +ldapexop +objectIdentifier +objectidentifier +deallocators +mirrormode +MirrorMode +loopDetect +SIGHUP +authMethodNotSupported +IDNA +bvecfree +pwdLockoutDuration +attrset +displayName +subentry +reqScope +oldPasswd +exop +filtercomp +expr +syntaxes +memrealloc +returncode +returnCode +OpenLDAP's +exts +bitstringa +caseIgnoreOrderingMatch +searchFilterAttrDN +func +jane +IESG +llber +attrval +ietf +olcSchemaConfig +bitstrings +bvalues +hmev +realdnattr +attrpair +affectsMultipleDSAs +Preprocessor +lastName +lldap +cachesize +slapauth +attributeType +attributetype +GSER +olcDbNosync +typedef +bjorn +datagram +strcasecmp +selfstyle +preoperation +FQDNs +exopPasswdDN +userid +subentries +monitoredObject +TLSVerifyClient +noidlen +LDAPNOINIT +henry +pwdGraceAuthnLimit +pwdGraceAuthNLimit +hnPk +userpassword +userPassword +noanonymous +LIBVERSION +anyuser +symas +dcedn +glibc +sublevel +chroot +posixGroup +nretries +testgroup +ldaphost +frontend +someotherdomain +proxying +IMAP +organisations +rewriteMap +monitoredInfo +modrDN +ModRDN +modrdn +HREF +DQTxCYEApdUtNXGgdUac +inline +ConnSettings +ShowSystemTables +multiproxy +reqSizeLimit +kerberos +loglevel +bvstrdup +reqReferral +rlookups +siiiib +LTSTATIC +timelimitExceeded +timeLimitExceeded +XKYnrjvGT +subtrees +unixODBC +hostnames +AutoConfig +libtool +submatch +reqDN +dnstyle +inet +schemas +pwdPolicySubentry +pwdPolicySubEntry +reqId +backsql +scanf +olcBackend +TLSCACertificatePath +Arial +init +runtime +onelevel +YtNFk +impl +Autoconf +stderr +ascii +MANCOMPRESS +authPassword +attrdescN +aspell +allusers +statslog +alwaysDerefAliases +RELEASEDATE +olcModuleList +pwdSafeModify +html +GCmfuqEvm +multimaster +testrun +olcUniqueURI +rewriteEngine +slapdindex +LTFINISH +olcOverlay +lber +serverID +blogs +numResponses +lang +POSIX +pathname +noSuchObject +proxyOld +BerElement +berelement +sbiod +plugin +http +olcModuleLoad +ldap +ldbm +numericStringSubstringsMatch +internet +storages +WhoAmI +whoami +criticality +addBlanks +logins +syncrepl +dbnum +operationsError +homePhone +octetStringOrderingMatch +testTwo +BmIwN +ldif +entryAlreadyExists +plaintext +someoneelse +errDisconnect +UserName +username +accessee +LDAPURLDesc +ISOC +IRTF +jpeg +ktadd +tuple +refint +makeinfo +chmod +auditWriteObject +Jong +addressbooks +setspec +syncprov +dctree +hallvard +cctrls +debuglevel +dSAOperation +datadir +slapadd +reqFilter +matcheddomain +CThreads +slapacl +requestName +randkey +Cryptosystem +groupOfNames +themself +jsmith +filesystems +lineno +SASL's +lockdetect +addrdnvalues +Hyuk +rewriteContext +soelim +slapdconfig +entrylimit +departmentNumber +immSupr +addressbook +pidfile +online +logold +proxyattrset +proxyAttrSet +proxyAttrset +mary +crlcheck +olcBdbConfig +kadmin +mech +slapcat +insufficientAccessRights +XDEFS +olcDbLinearIndex +MKDEPFLAG +rootdns +caseExactIA +notypes +numericStringMatch +octothorpe +lltdl +rootDSE +rootdse +logops +rewriter +chown +attributeUsage +slapdconf +olcDbUri +subany +Authorizaiton +bvalue +manpage +olcLimits +PRNGD +BerVarray +abcdefgh +matchingrule +matchingRule +modifiersName +inetOrgPerson +inetorgperson +secprops +logdb +postaladdress +postalAddress +quanah +ManageDsaIT +manageDSAit +subinitial +procs +varchar +RDBMSes +XLDFLAGS +caseExactMatch +urldesc +usnChanged +liblutil +olcObjectIdentifier +subdir +suffixmassage +auditAdd +pwdMinAge +olcModulePath +URLattr +reqSession +login +RetCodes +userApplications +NDBM +newSuperiorDN +browseable +auditBind +setstyle +newSuperior +newsuperior +concat +realanonymous +invalue +refreshOnly +pwcheck +filesystem +Naur +unwillingToPerform +PhotoURI +MyCompany +mkdep +idlcachesize +irresponsive +PasswordModify +readOnly +readonly +CLDAP +proto +mkdir +peername +pwdFailureTime +compareDN +reqVersion +negttl +logevels +AAQSkZJRgABAAAAAQABAAD +strcast +aUihad +failover +constraintViolation +cacheable +sambaPwdCanChange +errCode +queryid +olcReferral +dynacl +mkln +structuralObjectClass +proxyAuthz +config +IDSET +odbc +searchFilter +wholeSubtree +SASLprep +nisMailAlias +libodbcpsqlS +OxObjects +attributeDescription +groupnummer +lsei +kurt +OrgPerson +generalizedTime +filename +pwdCheckQuality +methodp +Verdana +deref +proxied +endmacro +backload +ECHOPROMPT +bvarray +ltdl +slapdconfigfile +modv +ObjectClassDescription +truelies +slurpd +basename +groupOfUniqueNames +DHAVE +oPdklp +ludp +entryUUID +ldapapiinfo +SampleLDAP +compareAttrDN +lssl +newentry +applicatio +addpartial +confdir +entryDN +pwdFailureCountInterval +XXXLIBS +Kumar +LTHREAD +distinguishedNameMatch +timestamp +UUIDs +olcDbCheckpoint +LTINSTALL +gssapi +continuated +localstatedir +devel +errcodep +Elfrink +olcPidFile +attribute's +pPasswd +metadirectory +Mitya +myObjectClass +OIDs +oids +sermersheim +chainingPreferred +CFLAGS +minssf +ModName +attrs +typeA +objclasses +typeB +nelems +subord +namingViolation +PCOq +inappropriateAuthentication +mixin +suders +syntaxOID +olcTLSCACertificateFile +IGJlZ +userPrincipalName +TLSCipherSuite +auditlog +runningslapd +myLDAP +myldap +configs +datasource +refreshAndPersist +authc +PENs +referralDN +MANAGERDN +noop +errObject +XXLIBS +reqAssertion +nops +PDUs +baseObject +bvecadd +perl +inplace +lossy +pers +authz +pwdReset +wrscdx +adminLimitExceeded +LDAPMessage +serverctrlsp +simplebinddn +nonleaf +compareFalse +lsasl +caseIgnoreSubstringsMatch +AUTOREMOVE +mydc +searchResultEntry +PIII +olcDbShmKey +substr +testsaslauthd +reqRespControls +XXXXXXXXXX +MANSECT +bindmethod +KTNAME +referralsp +pwdExpireWarning +suretecsystems +timeval +LTLINK +gsMatch +attributeTypes +pwdCheckModule +olcDatabase +PKCS +syncuser +oOjM +extern +dcObject +supportedControl +addprinc +logbase +oMxg +filterlist +generalizedTimeMatch +strongAuthRequired +Kovalev +Google +sessionlog +balancer +NSSR +PKIX +urandom +derefFindingBaseObj +Poitou +dereferencing +dereferenced +ORed +caseIgnoreSubstrin +superset +Locators +qdstring +olcAccess +dereferences +shoesize +monitorContext +RDBM +PostgreSQL +ppErrStr +olcFrontendConfig +aliasDereferencingProblem +gsskrb +unindexed +whitespace +seeAlso +monitorRuntimeConfig +olcAuditlogFile +namingContexts +referralAttrDN +idlecachesize +moddn +calloc +LDFLAGS +attributeOrValueExists +olcHdbConfig +bsize +auditObject +dnssrv +dynamicObject +objectclass +objectClass +sizeLimitExceeded +accountadm +reqControls +modme +shtool +aXRoIGEgc +RDNs +rdns +modifyTimestamp +objectIdentiferMatch +sleeptime +derefAliases +pagedResults +denyop +sctrls +ldapport +octetString +repl +FakeOidIndex +ERXRTc +LxsdLy +lastmod +integerOrderingMatch +sambaGroupType +RowVersioning +searchEntryDN +pwdLockout +sbin +olcSuffix +sbio +posp +TLSCertificateKeyFile +george +LDAPSyntax +apache's +scdx +someuserid +attrtype +msgtype +pathtest +ldapcompare +coltags +sasl +unixusers +bvfree +xeXBkeFxlZ +priv +proxyTemplates +FileUsage +bvals +givenName +givenname +jensen +auditReadObject +proc +unavailableCriticalExtension +slapdn +noSuchAttribute +retcode +slapds +slapd's +DLDAP +TABs +dyngroup +pathspec +domainstyle +requestoid +rpath +Blowfish +dryrun +Poobah +searchable +SDSE +olcDbDirectory +ludpp +spellcheck +logsuccess +lucyB +entryUUIDs +reqEntries +sockbuf +wrongpassword +olcSaslSecprops +olcSaslSecProps +dnSubtreeMatch +conns +pcache +ChangeLog +changelog +ursula +monitorConnectionLocalAddress +requestor's +requestors +TLSCertificateFile +pwdPolicy +infodir +suretec +tbls +const +bvdup +mkversion +olcDbSearchStack +numericStringOrderingMatch +checkpointed +strongerAuthRequired +treedelete +olcObjectClasses +berptr +errSleepTime +substrings +slapd +sambaNTPassword +slapi +lcrypto +slapo +mwrscdx +credlen +deleteDN +substring +prepending +sldb +credp +numEntries +searchBase +searchbase +berval +slen +metadata +lookup +databasetype +rewriteRules +smbk +userCertificate +entryCSN +errAuxObject +replogfile +reloadhint +reloadHint +moduleload +hasSubordinates +ShowOidColumn +contextp +LDAPModifying +nameAndOptionalUID +addDN +berval's +bervals +passwdfile +reqDerefAliases +authcDN +groupstyle +cancelled +stateful +proxytemplate +proxyTemplate +entryExpireTimestamp +referralsPreferred +authcID +authcid +AuthcId +MChAODQ +lookups +GnuTLS +gnutls +MozNSS +MOZNSS +moznss +LTONLY +SNMP +timelimit +UCASE +thru +saslauthd +logpurge +SMTP +srvtab +ldapadd +spasswd +sprintf +monitorCounterObject +Instanstantiation +olcDbConfig +olcLastMod +vals +param +matcheddnp +malloc +XLIBS +freeit +invalidDNSyntax +sambaSID +zeilenga +addAttrDN +syncdata +somedomain +attrsonly +attrsOnly +numericString +libexec +entryCSNs +noprompt +LTCOMPILE +ldapbis +SSHA +mandir +RXER +SSFs +auditCompare +pEntry +strongAuthNotSupported +endblock +LDAPAVA +startup +sharedemail +olcReplicationInterval +TLSv +libtool's +slapindex +rscdx +dhparam +subr +SSLv +SIGTERM +liblunicode +uint +stringa +reindex +stringb +lutil +inetd +SERATGCgaGBYWGDEjJR +wahl +olcDbQuarantine +reqEnd +modifyAttrDN +monitorContainer +searchstack +cachefree +errUnsolicitedOID +WebUpdate +RelativeLDAPDN +URLlist +monitorInfo +argsfile +attrvalue +deallocate +autogroup +msgid +ilOzQ +modulepath +logfile +Supr +inappropriateMatching +SUPs +myAttributeType +BerValue +basedn +baseDN +bvstr +replog +adressbooks +databasenumber +subschema +PhotoObject +INADDR +pthread +errlist +olcDbIndex +olcDbindex +ldapext +caseIgnoreMatch +suffixalias +sbindir +gidNumber +LDAPSync +bitstring +objclass +oplist +libodbcpsql +LDAPObjectClass +sockurl +somevalue +businessCategory +getpid +monitorIsShadow +confidentialityRequired +groupOfURLs +preallocated +hostname +TTLs +attrdesc +ghenry +odbcinst +reqType +slapover +BerkeleyDB's +attributename +lwrap +reqStart +errUnsolicitedData +objectclasses +objectClasses +countp +dereference +sizelimit +use'd +rootdn +RootDN +LTFLAGS +Bourne +URIs +pwdAttribute +uppercased +cacertdir +ciphersuite +URL's +urls +olcAuditLogConfig +reqMod +joebloggs +pwdHistory +entryTtl +olcIdleTimeout +TLSRandFile +unmassaged +LDAPMod +ldapmod +srcdir +someSSHAdata +whsp +exattrs +reqOld +kbyte +monitorCounter +quickstart +UUID +olcConstraintConfig +roleOccupant +rootpw +veryclean +syslogged +olcRootDN +idletimeout +sockname +telephoneNumber +telephonenumber +objectClassModsProhibited +nattrsets +saslargs +OBJEXT +LDAPAttributeType +newpasswdfile +newPasswdFile +boolean +liblber +ucdata +toolsets +builddir +builtin +matcheduid +Locator +ldapmaster +olcMirrorMode +libldap +refreshDeletes +aliasProblem +eMail +outvalue +LDAPRDN +olcBackendConfig +wBDABALD +libdir +deleteoldrdn +abcd +olcRootPW +dnattr +Servername +AttributeTypeDescription +strdup +domainScope +prepended +saslBindInProgress +olcDbMode +selfwrite +olcLdapConfig +pwdGraceUseTime +titleCatalog +woid +organizationPerson +ldaptcl +INCDIR +ACDF +realusers +ranlib +eatBlanks +reqMessage +paramName +ctrlp +freebuf +ctrls +firstName +ABNF +dnpattern +perror +MSSQL +VUld +SmVuc +ACIs +errmsgp +authzDN +gunzip +jpegPhoto +supportedSASLMechanisms +ACLs +reqMethod +authzId +authzid +authzID +hasSubordintes +proxyCache +proxycache +slaptest +olcLogLevel +LDAPDN +XINCPATH +monitoringslapd +babs +DSAIT +olcHidden +mySNMP +metainformation +BerkeleyDB +ldapuri +auditAbandon +RANDFILE +ldapurl +strlen +pwdAccountLockedTime +searchAttrDN +dbcache +sambaPwdLastSet +wBDARESEhgVG +multi +aaa +ldaprc +UpdateDN +updatedn +LDAPBASE +LDAPAPIFeatureInfo +authzTo +valsort +plugins +Diffie +ldappasswd +olcGlobal +ABI +aci +endif +unescaped +acl +ADH +olcPasswordHash +ldapc +loopback +ldapi +BDB's +GETREALM +functionalities +noplain +NOECHOPROMPT +AES +ldaps +notoc +bdb +LDAPv +IPsec +olcServerID +BCP +baz +params +generalizedTimeOrderingMatch +ber +slimit +ali +attributeoptions +BfQ +uidNumber +CA's +CAs +namingContext +mdb +lmdb +LMDB +LMDB's +MDB diff --git a/doc/guide/admin/backends.sdf b/doc/guide/admin/backends.sdf new file mode 100644 index 0000000..0e33627 --- /dev/null +++ b/doc/guide/admin/backends.sdf @@ -0,0 +1,589 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Backends + +Backends do the actual work of storing or retrieving data in response +to LDAP requests. Backends may be compiled statically into {{slapd}}, +or when module support is enabled, they may be dynamically loaded. + +If your installation uses dynamic modules, you may need to add the +relevant {{moduleload}} directives to the examples that follow. The +name of the module for a backend is usually of the form: + +> back_<backend name>.la + +So for example, if you need to load the {{hdb}} backend, you would configure + +> moduleload back_hdb.la + +H2: Berkeley DB Backends + + +H3: Overview + +The {{hdb}} backend to {{slapd}}(8) is a backend for a +normal {{slapd}} database. It uses the Oracle Berkeley DB ({{TERM:BDB}}) +package to store data. It makes extensive use of indexing and caching +(see the {{SECT:Tuning}} section) to speed data access. + +{{hdb}} is a variant of the original {{bdb}} backend which was first written for use with BDB. +{{hdb}} uses a hierarchical database layout which supports subtree renames. +It is otherwise identical to the {{bdb}} +behavior, and all the same configuration options apply. + +Note: An {{hdb}} database needs a large {{idlcachesize}} for good search performance, +typically three times the {{cachesize}} (entry cache size) or larger. + +Note: The {{hdb}} backend has superseded the {{bdb}} backend, and both will +soon be deprecated in favor of the new {{mdb}} backend. See below. + +H3: back-bdb/back-hdb Configuration + +MORE LATER + +H3: Further Information + +{{slapd-bdb}}(5) + +H2: LDAP + + +H3: Overview + +The LDAP backend to {{slapd}}(8) is not an actual database; instead it acts +as a proxy to forward incoming requests to another LDAP server. While +processing requests it will also chase referrals, so that referrals are fully +processed instead of being returned to the {{slapd}} client. + +Sessions that explicitly {{Bind}} to the {{back-ldap}} database always create +their own private connection to the remote LDAP server. Anonymous sessions +will share a single anonymous connection to the remote server. For sessions +bound through other mechanisms, all sessions with the same DN will share the +same connection. This connection pooling strategy can enhance the proxy's +efficiency by reducing the overhead of repeatedly making/breaking multiple +connections. + +The ldap database can also act as an information service, i.e. the identity +of locally authenticated clients is asserted to the remote server, possibly +in some modified form. For this purpose, the proxy binds to the remote server +with some administrative identity, and, if required, authorizes the asserted +identity. + +It is heavily used by a lot of other {{SECT: Backends}} and {{SECT: Overlays}}. + +H3: back-ldap Configuration + +As previously mentioned, {{slapd-ldap(5)}} is used behind the scenes by many +other {{SECT: Backends}} and {{SECT: Overlays}}. Some of them merely provide a +few configuration directive themselves, but have available to the administrator +the whole of the {{slapd-ldap(5)}} options. + +For example, the {{SECT: Translucent Proxy}}, which retrieves entries from a +remote LDAP server that can be partially overridden by the defined database, has +only four specific {{translucent-}} directives, but can be configured using any +of the normal {{slapd-ldap(5)}} options. See {[slapo-translucent(5)}} for details. + +Other {{SECT: Overlays}} allow you to tag directives in front of a normal +{{slapd-ldap(5)}} directive. For example, the {{slapo-chain(5)}} overlay does +this: + +{{"There are very few chain overlay specific directives; however, directives +related to the instances of the ldap backend that may be implicitly instantiated +by the overlay may assume a special meaning when used in conjunction with this +overlay. They are described in slapd-ldap(5), and they also need to be prefixed +by chain-."}} + +You may have also seen the {{slapd-ldap(5)}} backend used and described in the +{{SECT: Push Based}} {{SECT: Replication}} section of the guide. + +It should therefore be obvious that the {{slapd-ldap(5)}} backend is extremely +flexible and heavily used throughout the OpenLDAP Suite. + +The following is a very simple example, but already the power of the {{slapd-ldap(5)}} +backend is seen by use of a {{uri list}}: + +> database ldap +> suffix "dc=suretecsystems,dc=com" +> rootdn "cn=slapd-ldap" +> uri ldap://localhost/ ldap://remotehost ldap://remotehost2 + +The URI list is space or comma-separated. Whenever the server that responds +is not the first one in the list, the list is rearranged and the responsive +server is moved to the head, so that it will be first contacted the next time +a connection needs be created. + +This feature can be used to provide a form of load balancing when using +{{SECT: MirrorMode replication}}. + +H3: Further Information + +{{slapd-ldap}}(5) + +H2: LDIF + + +H3: Overview + +The LDIF backend to {{slapd}}(8) is a basic storage backend that stores +entries in text files in LDIF format, and exploits the filesystem to create +the tree structure of the database. It is intended as a cheap, low performance +easy to use backend. + +When using the {{cn=config}} dynamic configuration database with persistent +storage, the configuration data is stored using this backend. See {{slapd-config}}(5) +for more information + +H3: back-ldif Configuration + +Like many other backends, the LDIF backend can be instantiated with very few +configuration lines: + +> include ./schema/core.schema +> +> database ldif +> directory ./ldif +> suffix "dc=suretecsystems,dc=com" +> rootdn "cn=LDIF,dc=suretecsystems,dc=com" +> rootpw LDIF + +If we add the {{dcObject}} for {{dc=suretecsystems,dc=com}}, you can see how this +is added behind the scenes on the file system: + +> dn: dc=suretecsystems,dc=com +> objectClass: dcObject +> objectClass: organization +> dc: suretecsystems +> o: Suretec Systems Ltd + +Now we add it to the directory: + +> ldapadd -x -H ldap://localhost:9011 -f suretec.ldif -D "cn=LDIF,dc=suretecsystems,dc=com" -w LDIF +> adding new entry "dc=suretecsystems,dc=com" + +And inside {{F: ./ldif}} we have: + +> ls ./ldif +> dc=suretecsystems,dc=com.ldif + +which again contains: + +> cat ldif/dc\=suretecsystems\,dc\=com.ldif +> +> dn: dc=suretecsystems +> objectClass: dcObject +> objectClass: organization +> dc: suretecsystems +> o: Suretec Systems Ltd. +> structuralObjectClass: organization +> entryUUID: 2134b714-e3a1-102c-9a15-f96ee263886d +> creatorsName: cn=LDIF,dc=suretecsystems,dc=com +> createTimestamp: 20080711142643Z +> entryCSN: 20080711142643.661124Z#000000#000#000000 +> modifiersName: cn=LDIF,dc=suretecsystems,dc=com +> modifyTimestamp: 20080711142643Z + +This is the complete format you would get when exporting your directory using +{{F: slapcat}} etc. + +H3: Further Information + +{{slapd-ldif}}(5) + +H2: LMDB + + +H3: Overview + +The {{mdb}} backend to {{slapd}}(8) is the recommended primary backend for a +normal {{slapd}} database. It uses OpenLDAP's own +Lightning Memory-Mapped Database ({{TERM:LMDB}}) +library to store data and is intended to replace the Berkeley DB backends. + +It supports indexing like the BDB backends, but it uses no caching and requires +no tuning to deliver maximum search performance. Like {{hdb}}, it is also +fully hierarchical and supports subtree renames in constant time. + +H3: back-mdb Configuration + +Unlike the BDB backends, the {{mdb}} backend can be instantiated with very few +configuration lines: + +> include ./schema/core.schema +> +> database mdb +> directory ./mdb +> suffix "dc=suretecsystems,dc=com" +> rootdn "cn=mdb,dc=suretecsystems,dc=com" +> rootpw mdb +> maxsize 1073741824 + +In addition to the usual parameters that a minimal configuration requires, the {{mdb}} +backend requires a maximum size to be set. This should be the largest that +the database is ever anticipated to grow (in bytes). The filesystem must also +provide enough free space to accommodate this size. + +H3: Further Information + +{{slapd-mdb}}(5) + +H2: Metadirectory + + +H3: Overview + +The meta backend to {{slapd}}(8) performs basic LDAP proxying with respect +to a set of remote LDAP servers, called "targets". The information contained +in these servers can be presented as belonging to a single Directory Information +Tree ({{TERM:DIT}}). + +A basic knowledge of the functionality of the {{slapd-ldap}}(5) backend is +recommended. This backend has been designed as an enhancement of the ldap +backend. The two backends share many features (actually they also share portions + of code). While the ldap backend is intended to proxy operations directed + to a single server, the meta backend is mainly intended for proxying of + multiple servers and possibly naming context masquerading. + +These features, although useful in many scenarios, may result in excessive +overhead for some applications, so its use should be carefully considered. + + +H3: back-meta Configuration + +LATER + +H3: Further Information + +{{slapd-meta}}(5) + +H2: Monitor + + +H3: Overview + +The monitor backend to {{slapd}}(8) is not an actual database; if enabled, +it is automatically generated and dynamically maintained by slapd with +information about the running status of the daemon. + +To inspect all monitor information, issue a subtree search with base {{cn=Monitor}}, +requesting that attributes "+" and "*" are returned. The monitor backend produces +mostly operational attributes, and LDAP only returns operational attributes +that are explicitly requested. Requesting attribute "+" is an extension which +requests all operational attributes. + +See the {{SECT:Monitoring}} section. + +H3: back-monitor Configuration + +The monitor database can be instantiated only once, i.e. only one occurrence +of "database monitor" can occur in the {{slapd.conf(5)}} file. Also the suffix +is automatically set to {{"cn=Monitor"}}. + +You can however set a {{rootdn}} and {{rootpw}}. The following is all that is +needed to instantiate a monitor backend: + +> include ./schema/core.schema +> +> database monitor +> rootdn "cn=monitoring,cn=Monitor" +> rootpw monitoring + +You can also apply Access Control to this database like any other database, for +example: + +> access to dn.subtree="cn=Monitor" +> by dn.exact="uid=Admin,dc=my,dc=org" write +> by users read +> by * none + +Note: The {{F: core.schema}} must be loaded for the monitor database to work. + +A small example of the data returned via {{ldapsearch}} would be: + +> ldapsearch -x -H ldap://localhost:9011 -b 'cn=Monitor' +> # extended LDIF +> # +> # LDAPv3 +> # base <cn=Monitor> with scope subtree +> # filter: (objectclass=*) +> # requesting: ALL +> # +> +> # Monitor +> dn: cn=Monitor +> objectClass: monitorServer +> cn: Monitor +> description: This subtree contains monitoring/managing objects. +> description: This object contains information about this server. +> description: Most of the information is held in operational attributes, which +> must be explicitly requested. +> +> # Backends, Monitor +> dn: cn=Backends,cn=Monitor +> objectClass: monitorContainer +> cn: Backends +> description: This subsystem contains information about available backends. + +Please see the {{SECT: Monitoring}} section for complete examples of information +available via this backend. + +H3: Further Information + +{{slapd-monitor}}(5) + +H2: Null + + +H3: Overview + +The Null backend to {{slapd}}(8) is surely the most useful part of slapd: + +* Searches return success but no entries. +* Compares return compareFalse. +* Updates return success (unless readonly is on) but do nothing. +* Binds other than as the rootdn fail unless the database option "bind on" is given. +* The slapadd(8) and slapcat(8) tools are equally exciting. + +Inspired by the {{F:/dev/null}} device. + +H3: back-null Configuration + +This has to be one of the shortest configurations you'll ever do. In order to +test this, your {{F: slapd.conf}} file would look like: + +> database null +> suffix "cn=Nothing" +> bind on + +{{bind on}} means: + +{{"Allow binds as any DN in this backend's suffix, with any password. The default is "off"."}} + +To test this backend with {{ldapsearch}}: + +> ldapsearch -x -H ldap://localhost:9011 -D "uid=none,cn=Nothing" -w testing -b 'cn=Nothing' +> # extended LDIF +> # +> # LDAPv3 +> # base <cn=Nothing> with scope subtree +> # filter: (objectclass=*) +> # requesting: ALL +> # +> +> # search result +> search: 2 +> result: 0 Success +> +> # numResponses: 1 + + +H3: Further Information + +{{slapd-null}}(5) + +H2: Passwd + + +H3: Overview + +The PASSWD backend to {{slapd}}(8) serves up the user account information +listed in the system {{passwd}}(5) file (defaulting to {{F: /etc/passwd}}). + +This backend is provided for demonstration purposes only. The DN of each entry +is "uid=<username>,<suffix>". + +H3: back-passwd Configuration + +The configuration using {{F: slapd.conf}} a slightly longer, but not much. For +example: + +> include ./schema/core.schema +> +> database passwd +> suffix "cn=passwd" + +Again, testing this with {{ldapsearch}} would result in something like: + +> ldapsearch -x -H ldap://localhost:9011 -b 'cn=passwd' +> # extended LDIF +> # +> # LDAPv3 +> # base <cn=passwd> with scope subtree +> # filter: (objectclass=*) +> # requesting: ALL +> # +> +> # passwd +> dn: cn=passwd +> cn: passwd +> objectClass: organizationalUnit +> +> # root, passwd +> dn: uid=root,cn=passwd +> objectClass: person +> objectClass: uidObject +> uid: root +> cn: root +> sn: root +> description: root + + +H3: Further Information + +{{slapd-passwd}}(5) + +H2: Perl/Shell + +H3: Overview + +The Perl backend to {{slapd}}(8) works by embedding a {{perl}}(1) interpreter +into {{slapd}}(8). Any perl database section of the configuration file +{{slapd.conf}}(5) must then specify what Perl module to use. Slapd then creates +a new Perl object that handles all the requests for that particular instance of the backend. + +The Shell backend to {{slapd}}(8) executes external programs to implement +operations, and is designed to make it easy to tie an existing database to the +slapd front-end. This backend is primarily intended to be used in prototypes. + +H3: back-perl/back-shell Configuration + +LATER + +H3: Further Information + +{{slapd-shell}}(5) and {{slapd-perl}}(5) + +H2: Relay + + +H3: Overview + +The primary purpose of this {{slapd}}(8) backend is to map a naming context +defined in a database running in the same {{slapd}}(8) instance into a +virtual naming context, with attributeType and objectClass manipulation, if +required. It requires the rwm overlay. + +This backend and the above mentioned overlay are experimental. + +H3: back-relay Configuration + +LATER + +H3: Further Information + +{{slapd-relay}}(5) + +H2: SQL + + +H3: Overview + +The primary purpose of this {{slapd}}(8) backend is to PRESENT information +stored in some RDBMS as an LDAP subtree without any programming (some SQL and +maybe stored procedures can't be considered programming, anyway ;). + +That is, for example, when you (some ISP) have account information you use in +an RDBMS, and want to use modern solutions that expect such information in LDAP +(to authenticate users, make email lookups etc.). Or you want to synchronize or +distribute information between different sites/applications that use RDBMSes +and/or LDAP. Or whatever else... + +It is {{B:NOT}} designed as a general-purpose backend that uses RDBMS instead of +BerkeleyDB (as the standard BDB backend does), though it can be used as such with +several limitations. Please see {{SECT: LDAP vs RDBMS}} for discussion. + +The idea is to use some meta-information to translate LDAP queries to SQL queries, +leaving relational schema untouched, so that old applications can continue using +it without any modifications. This allows SQL and LDAP applications to interoperate +without replication, and exchange data as needed. + +The SQL backend is designed to be tunable to virtually any relational schema without +having to change source (through that meta-information mentioned). Also, it uses +ODBC to connect to RDBMSes, and is highly configurable for SQL dialects RDBMSes +may use, so it may be used for integration and distribution of data on different +RDBMSes, OSes, hosts etc., in other words, in highly heterogeneous environments. + +This backend is experimental. + +H3: back-sql Configuration + +This backend has to be one of the most abused and complex backends there is. +Therefore, we will go through a simple, small example that comes with the +OpenLDAP source and can be found in {{F: servers/slapd/back-sql/rdbms_depend/README}} + +For this example we will be using PostgreSQL. + +First, we add to {{F: /etc/odbc.ini}} a block of the form: + +> [example] <=== +> Description = Example for OpenLDAP's back-sql +> Driver = PostgreSQL +> Trace = No +> Database = example <=== +> Servername = localhost +> UserName = manager <=== +> Password = secret <=== +> Port = 5432 +> ;Protocol = 6.4 +> ReadOnly = No +> RowVersioning = No +> ShowSystemTables = No +> ShowOidColumn = No +> FakeOidIndex = No +> ConnSettings = + +The relevant information for our test setup is highlighted with '<===' on the +right above. + +Next, we add to {{F: /etc/odbcinst.ini}} a block of the form: + +> [PostgreSQL] +> Description = ODBC for PostgreSQL +> Driver = /usr/lib/libodbcpsql.so +> Setup = /usr/lib/libodbcpsqlS.so +> FileUsage = 1 + + +We will presume you know how to create a database and user in PostgreSQL and +how to set a password. Also, we'll presume you can populate the 'example' +database you've just created with the following files, as found in {{F: servers/slapd/back-sql/rdbms_depend/pgsql }} + +> backsql_create.sql, testdb_create.sql, testdb_data.sql, testdb_metadata.sql + +Lastly, run the test: + +> [root@localhost]# cd $SOURCES/tests +> [root@localhost]# SLAPD_USE_SQL=pgsql ./run sql-test000 + +Briefly, you should see something like (cut short for space): + +> Cleaning up test run directory leftover from previous run. +> Running ./scripts/sql-test000-read... +> running defines.sh +> Starting slapd on TCP/IP port 9011... +> Testing SQL backend read operations... +> Waiting 5 seconds for slapd to start... +> Testing correct bind... dn:cn=Mitya Kovalev,dc=example,dc=com +> Testing incorrect bind (should fail)... ldap_bind: Invalid credentials (49) +> +> ...... +> +> Filtering original ldif... +> Comparing filter output... +> >>>>> Test succeeded + +The test is basically readonly; this can be performed by all RDBMSes +(listed above). + +There is another test, sql-test900-write, which is currently enabled +only for PostgreSQL and IBM db2. + +Using {{F: sql-test000}}, files in {{F: servers/slapd/back-sql/rdbms_depend/pgsql/}} +and the man page, you should be set. + +Note: This backend is experimental. + +H3: Further Information + +{{slapd-sql}}(5) and {{F: servers/slapd/back-sql/rdbms_depend/README}} diff --git a/doc/guide/admin/config.sdf b/doc/guide/admin/config.sdf new file mode 100644 index 0000000..3fe62cf --- /dev/null +++ b/doc/guide/admin/config.sdf @@ -0,0 +1,70 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +H1: The Big Picture - Configuration Choices + +This section gives a brief overview of various {{TERM:LDAP}} directory +configurations, and how your Standalone LDAP Daemon {{slapd}}(8) +fits in with the rest of the world. + + +H2: Local Directory Service + +In this configuration, you run a {{slapd}}(8) instance which provides +directory service for your local domain only. It does not interact +with other directory servers in any way. This configuration is shown +in Figure 3.1. + +!import "config_local.png"; align="center"; title="Local service via slapd(8) configuration" +FT[align="Center"] Figure 3.1: Local service configuration. + +Use this configuration if you are just starting out (it's the one the +quick-start guide makes for you) or if you want to provide a local +service and are not interested in connecting to the rest of the world. +It's easy to upgrade to another configuration later if you want. + + +H2: Local Directory Service with Referrals + +In this configuration, you run a {{slapd}}(8) instance which provides +directory service for your local domain and configure it to return +referrals to other servers capable of handling requests. You may +run this service (or services) yourself or use one provided to you. +This configuration is shown in Figure 3.2. + +!import "config_ref.png"; align="center"; title="Local service with referrals" +FT[align="Center"] Figure 3.2: Local service with referrals + +Use this configuration if you want to provide local service and +participate in the Global Directory, or you want to delegate +responsibility for {{subordinate}} entries to another server. + + +H2: Replicated Directory Service + +slapd(8) includes support for {{LDAP Sync}}-based replication, called +{{syncrepl}}, which may be used to maintain shadow copies of directory +information on multiple directory servers. In its most basic +configuration, the {{master}} is a syncrepl provider and one or more +{{slave}} (or {{shadow}}) are syncrepl consumers. An example +master-slave configuration is shown in figure 3.3. Multi-Master +configurations are also supported. + +!import "config_repl.png"; align="center"; title="Replicated Directory Services" +FT[align="Center"] Figure 3.3: Replicated Directory Services + +This configuration can be used in conjunction with either of the +first two configurations in situations where a single {{slapd}}(8) +instance does not provide the required reliability or availability. + +H2: Distributed Local Directory Service + +In this configuration, the local service is partitioned into smaller +services, each of which may be replicated, and {{glued}} together with +{{superior}} and {{subordinate}} referrals. +!if 0 +An example of this configuration is shown in Figure 3.4. + +!import "config_dist.gif"; align="center"; title="Distributed Local Directory Services" +FT[align="Center"] Figure 3.4: Distributed Local Directory Services +!endif diff --git a/doc/guide/admin/config_dit.png b/doc/guide/admin/config_dit.png Binary files differnew file mode 100644 index 0000000..fd51f29 --- /dev/null +++ b/doc/guide/admin/config_dit.png diff --git a/doc/guide/admin/config_local.png b/doc/guide/admin/config_local.png Binary files differnew file mode 100644 index 0000000..5337c7f --- /dev/null +++ b/doc/guide/admin/config_local.png diff --git a/doc/guide/admin/config_ref.png b/doc/guide/admin/config_ref.png Binary files differnew file mode 100644 index 0000000..cca3dde --- /dev/null +++ b/doc/guide/admin/config_ref.png diff --git a/doc/guide/admin/config_repl.png b/doc/guide/admin/config_repl.png Binary files differnew file mode 100644 index 0000000..9525279 --- /dev/null +++ b/doc/guide/admin/config_repl.png diff --git a/doc/guide/admin/dbtools.sdf b/doc/guide/admin/dbtools.sdf new file mode 100644 index 0000000..a9453d1 --- /dev/null +++ b/doc/guide/admin/dbtools.sdf @@ -0,0 +1,373 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Database Creation and Maintenance Tools + +This section tells you how to create a slapd database from scratch, +and how to do trouble shooting if you run into problems. There are +two ways to create a database. First, you can create the database +on-line using {{TERM:LDAP}}. With this method, you simply start up slapd +and add entries using the LDAP client of your choice. This method +is fine for relatively small databases (a few hundred or thousand +entries, depending on your requirements). This method works for +database types which support updates. + +The second method of database creation is to do it off-line using +special utilities provided with {{slapd}}(8). This method is best if you +have many thousands of entries to create, which would take an +unacceptably long time using the LDAP method, or if you want to +ensure the database is not accessed while it is being created. Note +that not all database types support these utilities. + + +H2: Creating a database over LDAP + +With this method, you use the LDAP client of your choice (e.g., +the {{ldapadd}}(1)) to add entries, just like you would once the +database is created. You should be sure to set the following +options in the configuration file before starting {{slapd}}(8). + +> suffix <dn> + +As described in the {{SECT:General Database Directives}} section, +this option defines which entries are to be held by this database. +You should set this to the DN of the root of the subtree you are +trying to create. For example: + +> suffix "dc=example,dc=com" + +You should be sure to specify a directory where the index files +should be created: + +> directory <directory> + +For example: + +> directory /usr/local/var/openldap-data + +You need to create this directory with appropriate permissions such +that slapd can write to it. + +You need to configure slapd so that you can connect to it as a +directory user with permission to add entries. You can configure +the directory to support a special {{super-user}} or {{root}} user +just for this purpose. This is done through the following two +options in the database definition: + +> rootdn <dn> +> rootpw <passwd> + +For example: + +> rootdn "cn=Manager,dc=example,dc=com" +> rootpw secret + +These options specify a DN and password that can be used to +authenticate as the {{super-user}} entry of the database (i.e., +the entry allowed to do anything). The DN and password specified +here will always work, regardless of whether the entry named actually +exists or has the password given. This solves the chicken-and-egg +problem of how to authenticate and add entries before any entries +yet exist. + +Finally, you should make sure that the database definition contains +the index definitions you want: + +> index {<attrlist> | default} [pres,eq,approx,sub,none] + +For example, to index the {{EX:cn}}, {{EX:sn}}, {{EX:uid}} and +{{EX:objectclass}} attributes, the following {{EX:index}} directives +could be used: + +> index cn,sn,uid pres,eq,approx,sub +> index objectClass eq + +This would create presence, equality, approximate, and substring +indices for the {{EX:cn}}, {{EX:sn}}, and {{EX:uid}} attributes and +an equality index for the {{EX:objectClass}} attribute. Note that +not all index types are available with all attribute types. See +{{SECT:The slapd Configuration File}} section for more information +on this option. + +Once you have configured things to your liking, start up slapd, +connect with your LDAP client, and start adding entries. For +example, to add an organization entry and an organizational role +entry using the {{I:ldapadd}} tool, you could create an {{TERM:LDIF}} +file called {{EX:entries.ldif}} with the contents: + +> # Organization for Example Corporation +> dn: dc=example,dc=com +> objectClass: dcObject +> objectClass: organization +> dc: example +> o: Example Corporation +> description: The Example Corporation +> +> # Organizational Role for Directory Manager +> dn: cn=Manager,dc=example,dc=com +> objectClass: organizationalRole +> cn: Manager +> description: Directory Manager + +and then use a command like this to actually create the entry: + +> ldapadd -f entries.ldif -x -D "cn=Manager,dc=example,dc=com" -w secret + +The above command assumes settings provided in the above examples. + + +H2: Creating a database off-line + +The second method of database creation is to do it off-line, using +the slapd database tools described below. This method is best if +you have many thousands of entries to create, which would take an +unacceptably long time to add using the LDAP method described above. +These tools read the slapd configuration file and an input file +containing a text representation of the entries to add. For database +types which support the tools, they produce the database files +directly (otherwise you must use the on-line method above). There +are several important configuration options you will want to be +sure and set in the config file database definition first: + +> suffix <dn> + +As described in the {{SECT:General Database Directives}} section, +this option defines which entries are to be held by this database. +You should set this to the DN of the root of the subtree you are +trying to create. For example: + +> suffix "dc=example,dc=com" + +You should be sure to specify a directory where the index files +should be created: + +> directory <directory> + +For example: + +> directory /usr/local/var/openldap-data + +Finally, you need to specify which indices you want to build. This +is done by one or more index options. + +> index {<attrlist> | default} [pres,eq,approx,sub,none] + +For example: + +> index cn,sn,uid pres,eq,approx,sub +> index objectClass eq + +This would create presence, equality, approximate, and substring +indices for the {{EX:cn}}, {{EX:sn}}, and {{EX:uid}} attributes and +an equality index for the {{EX:objectClass}} attribute. Note that +not all index types are available with all attribute types. See +{{SECT:The slapd Configuration File}} section for more information +on this option. + +H3: The {{EX:slapadd}} program + +Once you've configured things to your liking, you create the primary +database and associated indices by running the {{slapadd}}(8) +program: + +> slapadd -l <inputfile> -f <slapdconfigfile> +> [-d <debuglevel>] [-n <integer>|-b <suffix>] + +The arguments have the following meanings: + +> -l <inputfile> + +Specifies the {{TERM:LDIF}} input file containing the entries to +add in text form (described below in the {{SECT:The LDIF text entry +format}} section). + +> -f <slapdconfigfile> + +Specifies the slapd configuration file that tells where to create +the indices, what indices to create, etc. + +> -F <slapdconfdirectory> + +Specifies a config directory. If both {{EX:-f}} and {{EX:-F}} are specified, +the config file will be read and converted to config directory format and +written to the specified directory. If neither option is specified, an attempt +to read the default config directory will be made before trying to use the +default config file. If a valid config directory exists then the default +config file is ignored. If dryrun mode is also specified, no conversion will occur. + +> -d <debuglevel> + +Turn on debugging, as specified by {{EX:<debuglevel>}}. The debug +levels are the same as for slapd. See the {{SECT:Command-Line +Options}} section in {{SECT:Running slapd}}. + +> -n <databasenumber> + +An optional argument that specifies which database to modify. The +first database listed in the configuration file is {{EX:1}}, the +second {{EX:2}}, etc. By default, the first database in the +configuration file is used. Should not be used in conjunction with +{{EX:-b}}. + +> -b <suffix> + +An optional argument that specifies which database to modify. The +provided suffix is matched against a database {{EX:suffix}} directive +to determine the database number. Should not be used in conjunction +with {{EX:-n}}. + + +H3: The {{EX:slapindex}} program + +Sometimes it may be necessary to regenerate indices (such as after +modifying {{slapd.conf}}(5)). This is possible using the {{slapindex}}(8) +program. {{slapindex}} is invoked like this + +> slapindex -f <slapdconfigfile> +> [-d <debuglevel>] [-n <databasenumber>|-b <suffix>] + +Where the {{EX:-f}}, {{EX:-d}}, {{EX:-n}} and {{EX:-b}} options +are the same as for the {{slapadd}}(1) program. {{slapindex}} +rebuilds all indices based upon the current database contents. + + +H3: The {{EX:slapcat}} program + +The {{EX:slapcat}} program is used to dump the database to an +{{TERM:LDIF}} file. This can be useful when you want to make a +human-readable backup of your database or when you want to edit +your database off-line. The program is invoked like this: + +> slapcat -l <filename> -f <slapdconfigfile> +> [-d <debuglevel>] [-n <databasenumber>|-b <suffix>] + +where {{EX:-n}} or {{EX:-b}} is used to select the database in the +{{slapd.conf}}(5) specified using {{EX:-f}}. The corresponding +{{TERM:LDIF}} output is written to standard output or to the file +specified using the {{EX:-l}} option. + + +!if 0 +H3: The {{EX:ldif}} program + +The {{ldif}}(1) program is used to convert arbitrary data values +to {{TERM:LDIF}} format. This can be useful when writing a program +or script to create the LDIF file you will feed into the {{slapadd}}(8) +or {{ldapadd}}(1) program, or when writing a SHELL backend. +{{ldif}}(1) takes an attribute description as an argument and reads +the attribute value(s) from standard input. It produces the LDIF +formatted attribute line(s) on standard output. The usage is: + +> ldif [-b] <attrdesc> + +where {{EX:<attrdesc>}} is an attribute description. Without the +{{EX-b}} option, the {{ldif}} program will consider each line of +standard input to be a separate value of the attribute. + +> ldif description << EOF +> leading space +> # leading hash mark +> EOF + +The {{EX:-b}} option can be used to force the {{ldif}} program to +interpret its input as a single raw binary value. This option is +useful when converting binary data such as a {{EX:jpegPhoto}} or +{{EX:audio}} attribute. For example: + +> ldif -b jpegPhoto < photo.jpeg +!endif + + +H2: The LDIF text entry format + +The {{TERM[expand]LDIF}} (LDIF) is used to represent LDAP entries +in a simple text format. This section provides a brief description +of the LDIF entry format which complements {{ldif}}(5) and the +technical specification {{REF:RFC2849}}. + +The basic form of an entry is: + +> # comment +> dn: <distinguished name> +> <attrdesc>: <attrvalue> +> <attrdesc>: <attrvalue> +> +> ... + +Lines starting with a '{{EX:#}}' character are comments. An +attribute description may be a simple attribute type like {{EX:cn}} +or {{EX:objectClass}} or {{EX:1.2.3}} (an {{TERM:OID}} associated +with an attribute type) or may include options such as {{EX:cn;lang_en_US}} +or {{EX:userCertificate;binary}}. + +A line may be continued by starting the next line with a {{single}} +space or tab character. For example: + +> dn: cn=Barbara J Jensen,dc=example,dc= +> com +> cn: Barbara J +> Jensen + +is equivalent to: + +> dn: cn=Barbara J Jensen,dc=example,dc=com +> cn: Barbara J Jensen + +Multiple attribute values are specified on separate lines. e.g., + +> cn: Barbara J Jensen +> cn: Babs Jensen + +If an {{EX:<attrvalue>}} contains non-printing characters or begins +with a space, a colon ('{{EX::}}'), or a less than ('{{EX:<}}'), +the {{EX:<attrdesc>}} is followed by a double colon and the base64 +encoding of the value. For example, the value "{{EX: begins with +a space}}" would be encoded like this: + +> cn:: IGJlZ2lucyB3aXRoIGEgc3BhY2U= + +You can also specify a {{TERM:URL}} containing the attribute value. +For example, the following specifies the {{EX:jpegPhoto}} value +should be obtained from the file {{F:/path/to/file.jpeg}}. + +> cn:< file:///path/to/file.jpeg + +Multiple entries within the same LDIF file are separated by blank +lines. Here's an example of an LDIF file containing three entries. + +> # Barbara's Entry +> dn: cn=Barbara J Jensen,dc=example,dc=com +> cn: Barbara J Jensen +> cn: Babs Jensen +> objectClass: person +> sn: Jensen +> +> # Bjorn's Entry +> dn: cn=Bjorn J Jensen,dc=example,dc=com +> cn: Bjorn J Jensen +> cn: Bjorn Jensen +> objectClass: person +> sn: Jensen +> # Base64 encoded JPEG photo +> jpegPhoto:: /9j/4AAQSkZJRgABAAAAAQABAAD/2wBDABALD +> A4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQ +> ERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVG +> +> # Jennifer's Entry +> dn: cn=Jennifer J Jensen,dc=example,dc=com +> cn: Jennifer J Jensen +> cn: Jennifer Jensen +> objectClass: person +> sn: Jensen +> # JPEG photo from file +> jpegPhoto:< file:///path/to/file.jpeg + +Notice that the {{EX:jpegPhoto}} in Bjorn's entry is base 64 encoded +and the {{EX:jpegPhoto}} in Jennifer's entry is obtained from the +location indicated by the URL. + +Note: Trailing spaces are not trimmed from values in an LDIF file. +Nor are multiple internal spaces compressed. If you don't want them +in your data, don't put them there. + diff --git a/doc/guide/admin/delta-syncrepl.png b/doc/guide/admin/delta-syncrepl.png Binary files differnew file mode 100644 index 0000000..ca1da14 --- /dev/null +++ b/doc/guide/admin/delta-syncrepl.png diff --git a/doc/guide/admin/dual_dc.png b/doc/guide/admin/dual_dc.png Binary files differnew file mode 100644 index 0000000..367310f --- /dev/null +++ b/doc/guide/admin/dual_dc.png diff --git a/doc/guide/admin/glossary.sdf b/doc/guide/admin/glossary.sdf new file mode 100644 index 0000000..05373c1 --- /dev/null +++ b/doc/guide/admin/glossary.sdf @@ -0,0 +1,16 @@ +# $OpenLDAP$ +# Copyright 2006-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +H1: Glossary + +H2: Terms +!catalog terms ''; headings; columns="Term,Definition" + +H2: Related Organizations +!catalog organisations ''; headings; columns="ORG:Name,Long,URL:Jump" + +H2: Related Products +!catalog products ''; headings; columns="PRD:Name,URL:Jump" + +H2: References +!catalog references ''; headings; columns="REF:Reference,Document,Status,URL:Jump" diff --git a/doc/guide/admin/guide.book b/doc/guide/admin/guide.book new file mode 100644 index 0000000..76eb69c --- /dev/null +++ b/doc/guide/admin/guide.book @@ -0,0 +1,3 @@ +#HTMLDOC 1.8.27 +-t pdf14 --book --toclevels 3 --no-numbered --toctitle "Table of Contents" --title --titleimage "../images/LDAPwww.gif" --linkstyle plain --size Universal --left 1.00in --right 0.50in --top 0.50in --bottom 0.50in --header .t. --header1 ... --footer ..1 --nup 1 --tocheader .t. --tocfooter ..i --duplex --portrait --color --no-pscommands --no-xrxcomments --compression=1 --jpeg=0 --fontsize 11.0 --fontspacing 1.2 --headingfont Helvetica --bodyfont Times --headfootsize 11.0 --headfootfont Helvetica --charset iso-8859-1 --links --embedfonts --pagemode outline --pagelayout single --firstpage p1 --pageeffect none --pageduration 10 --effectduration 1.0 --no-encryption --permissions all --owner-password "" --user-password "" --browserwidth 680 --no-strict --no-overflow +admin.html diff --git a/doc/guide/admin/guide.html b/doc/guide/admin/guide.html new file mode 100644 index 0000000..8a8a174 --- /dev/null +++ b/doc/guide/admin/guide.html @@ -0,0 +1,11390 @@ +<!doctype html public "-//W30//DTD W3 HTML 2.0//EN"> + +<HTML> + +<!-- This file was generated using SDF 2.001 by + Ian Clatworthy (ianc@mincom.com). SDF is freely + available from http://www.mincom.com/mtr/sdf. --> + +<HEAD> +<TITLE>OpenLDAP Software 2.4 Administrator's Guide</TITLE> +</HEAD> +<BODY> + +<DIV CLASS="header"> +<A HREF="http://www.OpenLDAP.org/"> +<P><IMG SRC="../images/LDAPlogo.gif" ALIGN="Left" BORDER=0></P> +</A> +<DIV CLASS="navigate"> +<P ALIGN="Center"><A HREF="http://www.openldap.org/">Home</A> | <A HREF="../index.html">Catalog</A></P> +</DIV> +<BR CLEAR="Left"> +</DIV> +<DIV CLASS="title"> +<H1 CLASS="doc-title">OpenLDAP Software 2.4 Administrator's Guide</H1> +<ADDRESS CLASS="doc-author">The OpenLDAP Project <<A HREF="http://www.openldap.org/">http://www.openldap.org/</A>></ADDRESS> +<ADDRESS CLASS="doc-modified">19 December 2018</ADDRESS> +<BR CLEAR="All"> +</DIV> +<DIV CLASS="contents"> +<HR> +<H2>Table of Contents</H2> +<UL> +<A HREF="#Preface">Preface</A> +<BR> +<A HREF="#Introduction to OpenLDAP Directory Services">1. Introduction to OpenLDAP Directory Services</A><UL> +<A HREF="#What is a directory service">1.1. What is a directory service?</A> +<BR> +<A HREF="#What is LDAP">1.2. What is LDAP?</A> +<BR> +<A HREF="#When should I use LDAP">1.3. When should I use LDAP?</A> +<BR> +<A HREF="#When should I not use LDAP">1.4. When should I not use LDAP?</A> +<BR> +<A HREF="#How does LDAP work">1.5. How does LDAP work?</A> +<BR> +<A HREF="#What about X.500">1.6. What about X.500?</A> +<BR> +<A HREF="#What is the difference between LDAPv2 and LDAPv3">1.7. What is the difference between LDAPv2 and LDAPv3?</A> +<BR> +<A HREF="#LDAP vs RDBMS">1.8. LDAP vs RDBMS</A> +<BR> +<A HREF="#What is slapd and what can it do">1.9. What is slapd and what can it do?</A></UL> +<BR> +<A HREF="#A Quick-Start Guide">2. A Quick-Start Guide</A> +<BR> +<A HREF="#The Big Picture - Configuration Choices">3. The Big Picture - Configuration Choices</A><UL> +<A HREF="#Local Directory Service">3.1. Local Directory Service</A> +<BR> +<A HREF="#Local Directory Service with Referrals">3.2. Local Directory Service with Referrals</A> +<BR> +<A HREF="#Replicated Directory Service">3.3. Replicated Directory Service</A> +<BR> +<A HREF="#Distributed Local Directory Service">3.4. Distributed Local Directory Service</A></UL> +<BR> +<A HREF="#Building and Installing OpenLDAP Software">4. Building and Installing OpenLDAP Software</A><UL> +<A HREF="#Obtaining and Extracting the Software">4.1. Obtaining and Extracting the Software</A> +<BR> +<A HREF="#Prerequisite software">4.2. Prerequisite software</A><UL> +<A HREF="#{{TERM[expand]TLS}}">4.2.1. <TERM>Transport Layer Security</TERM></A> +<BR> +<A HREF="#{{TERM[expand]SASL}}">4.2.2. <TERM>Simple Authentication and Security Layer</TERM></A> +<BR> +<A HREF="#{{TERM[expand]Kerberos}}">4.2.3. <TERM>Kerberos Authentication Service</TERM></A> +<BR> +<A HREF="#Database Software">4.2.4. Database Software</A> +<BR> +<A HREF="#Threads">4.2.5. Threads</A> +<BR> +<A HREF="#TCP Wrappers">4.2.6. TCP Wrappers</A></UL> +<BR> +<A HREF="#Running configure">4.3. Running configure</A> +<BR> +<A HREF="#Building the Software">4.4. Building the Software</A> +<BR> +<A HREF="#Testing the Software">4.5. Testing the Software</A> +<BR> +<A HREF="#Installing the Software">4.6. Installing the Software</A></UL> +<BR> +<A HREF="#Configuring slapd">5. Configuring slapd</A><UL> +<A HREF="#Configuration Layout">5.1. Configuration Layout</A> +<BR> +<A HREF="#Configuration Directives">5.2. Configuration Directives</A><UL> +<A HREF="#cn=config">5.2.1. cn=config</A> +<BR> +<A HREF="#cn=module">5.2.2. cn=module</A> +<BR> +<A HREF="#cn=schema">5.2.3. cn=schema</A> +<BR> +<A HREF="#Backend-specific Directives">5.2.4. Backend-specific Directives</A> +<BR> +<A HREF="#Database-specific Directives">5.2.5. Database-specific Directives</A> +<BR> +<A HREF="#BDB and HDB Database Directives">5.2.6. BDB and HDB Database Directives</A></UL> +<BR> +<A HREF="#Configuration Example">5.3. Configuration Example</A> +<BR> +<A HREF="#Converting old style {{slapd.conf}}(5) file to {{cn=config}} format">5.4. Converting old style <EM>slapd.conf</EM>(5) file to <EM>cn=config</EM> format</A></UL> +<BR> +<A HREF="#The slapd Configuration File">6. The slapd Configuration File</A><UL> +<A HREF="#Configuration File Format">6.1. Configuration File Format</A> +<BR> +<A HREF="#Configuration File Directives">6.2. Configuration File Directives</A><UL> +<A HREF="#Global Directives">6.2.1. Global Directives</A> +<BR> +<A HREF="#General Backend Directives">6.2.2. General Backend Directives</A> +<BR> +<A HREF="#General Database Directives">6.2.3. General Database Directives</A> +<BR> +<A HREF="#BDB and HDB Database Directives">6.2.4. BDB and HDB Database Directives</A></UL> +<BR> +<A HREF="#Configuration File Example">6.3. Configuration File Example</A></UL> +<BR> +<A HREF="#Running slapd">7. Running slapd</A><UL> +<A HREF="#Command-Line Options">7.1. Command-Line Options</A> +<BR> +<A HREF="#Starting slapd">7.2. Starting slapd</A> +<BR> +<A HREF="#Stopping slapd">7.3. Stopping slapd</A></UL> +<BR> +<A HREF="#Access Control">8. Access Control</A><UL> +<A HREF="#Introduction">8.1. Introduction</A> +<BR> +<A HREF="#Access Control via Static Configuration">8.2. Access Control via Static Configuration</A><UL> +<A HREF="#What to control access to">8.2.1. What to control access to</A> +<BR> +<A HREF="#Who to grant access to">8.2.2. Who to grant access to</A> +<BR> +<A HREF="#The access to grant">8.2.3. The access to grant</A> +<BR> +<A HREF="#Access Control Evaluation">8.2.4. Access Control Evaluation</A> +<BR> +<A HREF="#Access Control Examples">8.2.5. Access Control Examples</A></UL> +<BR> +<A HREF="#Access Control via Dynamic Configuration">8.3. Access Control via Dynamic Configuration</A><UL> +<A HREF="#What to control access to">8.3.1. What to control access to</A> +<BR> +<A HREF="#Who to grant access to">8.3.2. Who to grant access to</A> +<BR> +<A HREF="#The access to grant">8.3.3. The access to grant</A> +<BR> +<A HREF="#Access Control Evaluation">8.3.4. Access Control Evaluation</A> +<BR> +<A HREF="#Access Control Examples">8.3.5. Access Control Examples</A> +<BR> +<A HREF="#Access Control Ordering">8.3.6. Access Control Ordering</A></UL> +<BR> +<A HREF="#Access Control Common Examples">8.4. Access Control Common Examples</A><UL> +<A HREF="#Basic ACLs">8.4.1. Basic ACLs</A> +<BR> +<A HREF="#Matching Anonymous and Authenticated users">8.4.2. Matching Anonymous and Authenticated users</A> +<BR> +<A HREF="#Controlling rootdn access">8.4.3. Controlling rootdn access</A> +<BR> +<A HREF="#Managing access with Groups">8.4.4. Managing access with Groups</A> +<BR> +<A HREF="#Granting access to a subset of attributes">8.4.5. Granting access to a subset of attributes</A> +<BR> +<A HREF="#Allowing a user write to all entries below theirs">8.4.6. Allowing a user write to all entries below theirs</A> +<BR> +<A HREF="#Allowing entry creation">8.4.7. Allowing entry creation</A> +<BR> +<A HREF="#Tips for using regular expressions in Access Control">8.4.8. Tips for using regular expressions in Access Control</A> +<BR> +<A HREF="#Granting and Denying access based on security strength factors (ssf)">8.4.9. Granting and Denying access based on security strength factors (ssf)</A> +<BR> +<A HREF="#When things aren\'t working as expected">8.4.10. When things aren't working as expected</A></UL> +<BR> +<A HREF="#Sets - Granting rights based on relationships">8.5. Sets - Granting rights based on relationships</A><UL> +<A HREF="#Groups of Groups">8.5.1. Groups of Groups</A> +<BR> +<A HREF="#Group ACLs without DN syntax">8.5.2. Group ACLs without DN syntax</A> +<BR> +<A HREF="#Following references">8.5.3. Following references</A></UL></UL> +<BR> +<A HREF="#Limits">9. Limits</A><UL> +<A HREF="#Introduction">9.1. Introduction</A> +<BR> +<A HREF="#Soft and Hard limits">9.2. Soft and Hard limits</A> +<BR> +<A HREF="#Global Limits">9.3. Global Limits</A> +<BR> +<A HREF="#Per-Database Limits">9.4. Per-Database Limits</A><UL> +<A HREF="#Specify who the limits apply to">9.4.1. Specify who the limits apply to</A> +<BR> +<A HREF="#Specify time limits">9.4.2. Specify time limits</A> +<BR> +<A HREF="#Specifying size limits">9.4.3. Specifying size limits</A> +<BR> +<A HREF="#Size limits and Paged Results">9.4.4. Size limits and Paged Results</A></UL> +<BR> +<A HREF="#Example Limit Configurations">9.5. Example Limit Configurations</A><UL> +<A HREF="#Simple Global Limits">9.5.1. Simple Global Limits</A> +<BR> +<A HREF="#Global Hard and Soft Limits">9.5.2. Global Hard and Soft Limits</A> +<BR> +<A HREF="#Giving specific users larger limits">9.5.3. Giving specific users larger limits</A> +<BR> +<A HREF="#Limiting who can do paged searches">9.5.4. Limiting who can do paged searches</A></UL> +<BR> +<A HREF="#Further Information">9.6. Further Information</A></UL> +<BR> +<A HREF="#Database Creation and Maintenance Tools">10. Database Creation and Maintenance Tools</A><UL> +<A HREF="#Creating a database over LDAP">10.1. Creating a database over LDAP</A> +<BR> +<A HREF="#Creating a database off-line">10.2. Creating a database off-line</A><UL> +<A HREF="#The {{EX:slapadd}} program">10.2.1. The <TT>slapadd</TT> program</A> +<BR> +<A HREF="#The {{EX:slapindex}} program">10.2.2. The <TT>slapindex</TT> program</A> +<BR> +<A HREF="#The {{EX:slapcat}} program">10.2.3. The <TT>slapcat</TT> program</A></UL> +<BR> +<A HREF="#The LDIF text entry format">10.3. The LDIF text entry format</A></UL> +<BR> +<A HREF="#Backends">11. Backends</A><UL> +<A HREF="#Berkeley DB Backends">11.1. Berkeley DB Backends</A><UL> +<A HREF="#Overview">11.1.1. Overview</A> +<BR> +<A HREF="#back-bdb/back-hdb Configuration">11.1.2. back-bdb/back-hdb Configuration</A> +<BR> +<A HREF="#Further Information">11.1.3. Further Information</A></UL> +<BR> +<A HREF="#LDAP">11.2. LDAP</A><UL> +<A HREF="#Overview">11.2.1. Overview</A> +<BR> +<A HREF="#back-ldap Configuration">11.2.2. back-ldap Configuration</A> +<BR> +<A HREF="#Further Information">11.2.3. Further Information</A></UL> +<BR> +<A HREF="#LDIF">11.3. LDIF</A><UL> +<A HREF="#Overview">11.3.1. Overview</A> +<BR> +<A HREF="#back-ldif Configuration">11.3.2. back-ldif Configuration</A> +<BR> +<A HREF="#Further Information">11.3.3. Further Information</A></UL> +<BR> +<A HREF="#LMDB">11.4. LMDB</A><UL> +<A HREF="#Overview">11.4.1. Overview</A> +<BR> +<A HREF="#back-mdb Configuration">11.4.2. back-mdb Configuration</A> +<BR> +<A HREF="#Further Information">11.4.3. Further Information</A></UL> +<BR> +<A HREF="#Metadirectory">11.5. Metadirectory</A><UL> +<A HREF="#Overview">11.5.1. Overview</A> +<BR> +<A HREF="#back-meta Configuration">11.5.2. back-meta Configuration</A> +<BR> +<A HREF="#Further Information">11.5.3. Further Information</A></UL> +<BR> +<A HREF="#Monitor">11.6. Monitor</A><UL> +<A HREF="#Overview">11.6.1. Overview</A> +<BR> +<A HREF="#back-monitor Configuration">11.6.2. back-monitor Configuration</A> +<BR> +<A HREF="#Further Information">11.6.3. Further Information</A></UL> +<BR> +<A HREF="#Null">11.7. Null</A><UL> +<A HREF="#Overview">11.7.1. Overview</A> +<BR> +<A HREF="#back-null Configuration">11.7.2. back-null Configuration</A> +<BR> +<A HREF="#Further Information">11.7.3. Further Information</A></UL> +<BR> +<A HREF="#Passwd">11.8. Passwd</A><UL> +<A HREF="#Overview">11.8.1. Overview</A> +<BR> +<A HREF="#back-passwd Configuration">11.8.2. back-passwd Configuration</A> +<BR> +<A HREF="#Further Information">11.8.3. Further Information</A></UL> +<BR> +<A HREF="#Perl/Shell">11.9. Perl/Shell</A><UL> +<A HREF="#Overview">11.9.1. Overview</A> +<BR> +<A HREF="#back-perl/back-shell Configuration">11.9.2. back-perl/back-shell Configuration</A> +<BR> +<A HREF="#Further Information">11.9.3. Further Information</A></UL> +<BR> +<A HREF="#Relay">11.10. Relay</A><UL> +<A HREF="#Overview">11.10.1. Overview</A> +<BR> +<A HREF="#back-relay Configuration">11.10.2. back-relay Configuration</A> +<BR> +<A HREF="#Further Information">11.10.3. Further Information</A></UL> +<BR> +<A HREF="#SQL">11.11. SQL</A><UL> +<A HREF="#Overview">11.11.1. Overview</A> +<BR> +<A HREF="#back-sql Configuration">11.11.2. back-sql Configuration</A> +<BR> +<A HREF="#Further Information">11.11.3. Further Information</A></UL></UL> +<BR> +<A HREF="#Overlays">12. Overlays</A><UL> +<A HREF="#Access Logging">12.1. Access Logging</A><UL> +<A HREF="#Overview">12.1.1. Overview</A> +<BR> +<A HREF="#Access Logging Configuration">12.1.2. Access Logging Configuration</A> +<BR> +<A HREF="#Further Information">12.1.3. Further Information</A></UL> +<BR> +<A HREF="#Audit Logging">12.2. Audit Logging</A><UL> +<A HREF="#Overview">12.2.1. Overview</A> +<BR> +<A HREF="#Audit Logging Configuration">12.2.2. Audit Logging Configuration</A> +<BR> +<A HREF="#Further Information">12.2.3. Further Information</A></UL> +<BR> +<A HREF="#Chaining">12.3. Chaining</A><UL> +<A HREF="#Overview">12.3.1. Overview</A> +<BR> +<A HREF="#Chaining Configuration">12.3.2. Chaining Configuration</A> +<BR> +<A HREF="#Handling Chaining Errors">12.3.3. Handling Chaining Errors</A> +<BR> +<A HREF="#Read-Back of Chained Modifications">12.3.4. Read-Back of Chained Modifications</A> +<BR> +<A HREF="#Further Information">12.3.5. Further Information</A></UL> +<BR> +<A HREF="#Constraints">12.4. Constraints</A><UL> +<A HREF="#Overview">12.4.1. Overview</A> +<BR> +<A HREF="#Constraint Configuration">12.4.2. Constraint Configuration</A> +<BR> +<A HREF="#Further Information">12.4.3. Further Information</A></UL> +<BR> +<A HREF="#Dynamic Directory Services">12.5. Dynamic Directory Services</A><UL> +<A HREF="#Overview">12.5.1. Overview</A> +<BR> +<A HREF="#Dynamic Directory Service Configuration">12.5.2. Dynamic Directory Service Configuration</A> +<BR> +<A HREF="#Further Information">12.5.3. Further Information</A></UL> +<BR> +<A HREF="#Dynamic Groups">12.6. Dynamic Groups</A><UL> +<A HREF="#Overview">12.6.1. Overview</A> +<BR> +<A HREF="#Dynamic Group Configuration">12.6.2. Dynamic Group Configuration</A></UL> +<BR> +<A HREF="#Dynamic Lists">12.7. Dynamic Lists</A><UL> +<A HREF="#Overview">12.7.1. Overview</A> +<BR> +<A HREF="#Dynamic List Configuration">12.7.2. Dynamic List Configuration</A> +<BR> +<A HREF="#Further Information">12.7.3. Further Information</A></UL> +<BR> +<A HREF="#Reverse Group Membership Maintenance">12.8. Reverse Group Membership Maintenance</A><UL> +<A HREF="#Overview">12.8.1. Overview</A> +<BR> +<A HREF="#Member Of Configuration">12.8.2. Member Of Configuration</A> +<BR> +<A HREF="#Further Information">12.8.3. Further Information</A></UL> +<BR> +<A HREF="#The Proxy Cache Engine">12.9. The Proxy Cache Engine</A><UL> +<A HREF="#Overview">12.9.1. Overview</A> +<BR> +<A HREF="#Proxy Cache Configuration">12.9.2. Proxy Cache Configuration</A> +<BR> +<A HREF="#Further Information">12.9.3. Further Information</A></UL> +<BR> +<A HREF="#Password Policies">12.10. Password Policies</A><UL> +<A HREF="#Overview">12.10.1. Overview</A> +<BR> +<A HREF="#Password Policy Configuration">12.10.2. Password Policy Configuration</A> +<BR> +<A HREF="#Further Information">12.10.3. Further Information</A></UL> +<BR> +<A HREF="#Referential Integrity">12.11. Referential Integrity</A><UL> +<A HREF="#Overview">12.11.1. Overview</A> +<BR> +<A HREF="#Referential Integrity Configuration">12.11.2. Referential Integrity Configuration</A> +<BR> +<A HREF="#Further Information">12.11.3. Further Information</A></UL> +<BR> +<A HREF="#Return Code">12.12. Return Code</A><UL> +<A HREF="#Overview">12.12.1. Overview</A> +<BR> +<A HREF="#Return Code Configuration">12.12.2. Return Code Configuration</A> +<BR> +<A HREF="#Further Information">12.12.3. Further Information</A></UL> +<BR> +<A HREF="#Rewrite/Remap">12.13. Rewrite/Remap</A><UL> +<A HREF="#Overview">12.13.1. Overview</A> +<BR> +<A HREF="#Rewrite/Remap Configuration">12.13.2. Rewrite/Remap Configuration</A> +<BR> +<A HREF="#Further Information">12.13.3. Further Information</A></UL> +<BR> +<A HREF="#Sync Provider">12.14. Sync Provider</A><UL> +<A HREF="#Overview">12.14.1. Overview</A> +<BR> +<A HREF="#Sync Provider Configuration">12.14.2. Sync Provider Configuration</A> +<BR> +<A HREF="#Further Information">12.14.3. Further Information</A></UL> +<BR> +<A HREF="#Translucent Proxy">12.15. Translucent Proxy</A><UL> +<A HREF="#Overview">12.15.1. Overview</A> +<BR> +<A HREF="#Translucent Proxy Configuration">12.15.2. Translucent Proxy Configuration</A> +<BR> +<A HREF="#Further Information">12.15.3. Further Information</A></UL> +<BR> +<A HREF="#Attribute Uniqueness">12.16. Attribute Uniqueness</A><UL> +<A HREF="#Overview">12.16.1. Overview</A> +<BR> +<A HREF="#Attribute Uniqueness Configuration">12.16.2. Attribute Uniqueness Configuration</A> +<BR> +<A HREF="#Further Information">12.16.3. Further Information</A></UL> +<BR> +<A HREF="#Value Sorting">12.17. Value Sorting</A><UL> +<A HREF="#Overview">12.17.1. Overview</A> +<BR> +<A HREF="#Value Sorting Configuration">12.17.2. Value Sorting Configuration</A> +<BR> +<A HREF="#Further Information">12.17.3. Further Information</A></UL> +<BR> +<A HREF="#Overlay Stacking">12.18. Overlay Stacking</A><UL> +<A HREF="#Overview">12.18.1. Overview</A> +<BR> +<A HREF="#Example Scenarios">12.18.2. Example Scenarios</A></UL></UL> +<BR> +<A HREF="#Schema Specification">13. Schema Specification</A><UL> +<A HREF="#Distributed Schema Files">13.1. Distributed Schema Files</A> +<BR> +<A HREF="#Extending Schema">13.2. Extending Schema</A><UL> +<A HREF="#Object Identifiers">13.2.1. Object Identifiers</A> +<BR> +<A HREF="#Naming Elements">13.2.2. Naming Elements</A> +<BR> +<A HREF="#Local schema file">13.2.3. Local schema file</A> +<BR> +<A HREF="#Attribute Type Specification">13.2.4. Attribute Type Specification</A> +<BR> +<A HREF="#Object Class Specification">13.2.5. Object Class Specification</A> +<BR> +<A HREF="#OID Macros">13.2.6. OID Macros</A></UL></UL> +<BR> +<A HREF="#Security Considerations">14. Security Considerations</A><UL> +<A HREF="#Network Security">14.1. Network Security</A><UL> +<A HREF="#Selective Listening">14.1.1. Selective Listening</A> +<BR> +<A HREF="#IP Firewall">14.1.2. IP Firewall</A> +<BR> +<A HREF="#TCP Wrappers">14.1.3. TCP Wrappers</A></UL> +<BR> +<A HREF="#Data Integrity and Confidentiality Protection">14.2. Data Integrity and Confidentiality Protection</A><UL> +<A HREF="#Security Strength Factors">14.2.1. Security Strength Factors</A></UL> +<BR> +<A HREF="#Authentication Methods">14.3. Authentication Methods</A><UL> +<A HREF="#"simple" method">14.3.1. "simple" method</A> +<BR> +<A HREF="#SASL method">14.3.2. SASL method</A></UL> +<BR> +<A HREF="#Password Storage">14.4. Password Storage</A><UL> +<A HREF="#SSHA password storage scheme">14.4.1. SSHA password storage scheme</A> +<BR> +<A HREF="#CRYPT password storage scheme">14.4.2. CRYPT password storage scheme</A> +<BR> +<A HREF="#MD5 password storage scheme">14.4.3. MD5 password storage scheme</A> +<BR> +<A HREF="#SMD5 password storage scheme">14.4.4. SMD5 password storage scheme</A> +<BR> +<A HREF="#SHA password storage scheme">14.4.5. SHA password storage scheme</A> +<BR> +<A HREF="#SASL password storage scheme">14.4.6. SASL password storage scheme</A></UL> +<BR> +<A HREF="#Pass-Through authentication">14.5. Pass-Through authentication</A><UL> +<A HREF="#Configuring slapd to use an authentication provider">14.5.1. Configuring slapd to use an authentication provider</A> +<BR> +<A HREF="#Configuring saslauthd">14.5.2. Configuring saslauthd</A> +<BR> +<A HREF="#Testing pass-through authentication">14.5.3. Testing pass-through authentication</A></UL></UL> +<BR> +<A HREF="#Using SASL">15. Using SASL</A><UL> +<A HREF="#SASL Security Considerations">15.1. SASL Security Considerations</A> +<BR> +<A HREF="#SASL Authentication">15.2. SASL Authentication</A><UL> +<A HREF="#GSSAPI">15.2.1. GSSAPI</A> +<BR> +<A HREF="#KERBEROS_V4">15.2.2. KERBEROS_V4</A> +<BR> +<A HREF="#DIGEST-MD5">15.2.3. DIGEST-MD5</A> +<BR> +<A HREF="#EXTERNAL">15.2.4. EXTERNAL</A> +<BR> +<A HREF="#Mapping Authentication Identities">15.2.5. Mapping Authentication Identities</A> +<BR> +<A HREF="#Direct Mapping">15.2.6. Direct Mapping</A> +<BR> +<A HREF="#Search-based mappings">15.2.7. Search-based mappings</A></UL> +<BR> +<A HREF="#SASL Proxy Authorization">15.3. SASL Proxy Authorization</A><UL> +<A HREF="#Uses of Proxy Authorization">15.3.1. Uses of Proxy Authorization</A> +<BR> +<A HREF="#SASL Authorization Identities">15.3.2. SASL Authorization Identities</A> +<BR> +<A HREF="#Proxy Authorization Rules">15.3.3. Proxy Authorization Rules</A></UL></UL> +<BR> +<A HREF="#Using TLS">16. Using TLS</A><UL> +<A HREF="#TLS Certificates">16.1. TLS Certificates</A><UL> +<A HREF="#Server Certificates">16.1.1. Server Certificates</A> +<BR> +<A HREF="#Client Certificates">16.1.2. Client Certificates</A></UL> +<BR> +<A HREF="#TLS Configuration">16.2. TLS Configuration</A><UL> +<A HREF="#Server Configuration">16.2.1. Server Configuration</A> +<BR> +<A HREF="#Client Configuration">16.2.2. Client Configuration</A></UL></UL> +<BR> +<A HREF="#Constructing a Distributed Directory Service">17. Constructing a Distributed Directory Service</A><UL> +<A HREF="#Subordinate Knowledge Information">17.1. Subordinate Knowledge Information</A> +<BR> +<A HREF="#Superior Knowledge Information">17.2. Superior Knowledge Information</A> +<BR> +<A HREF="#The ManageDsaIT Control">17.3. The ManageDsaIT Control</A></UL> +<BR> +<A HREF="#Replication">18. Replication</A><UL> +<A HREF="#Replication Technology">18.1. Replication Technology</A><UL> +<A HREF="#LDAP Sync Replication">18.1.1. LDAP Sync Replication</A></UL> +<BR> +<A HREF="#Deployment Alternatives">18.2. Deployment Alternatives</A><UL> +<A HREF="#Delta-syncrepl replication">18.2.1. Delta-syncrepl replication</A> +<BR> +<A HREF="#N-Way Multi-Master replication">18.2.2. N-Way Multi-Master replication</A> +<BR> +<A HREF="#MirrorMode replication">18.2.3. MirrorMode replication</A> +<BR> +<A HREF="#Syncrepl Proxy Mode">18.2.4. Syncrepl Proxy Mode</A></UL> +<BR> +<A HREF="#Configuring the different replication types">18.3. Configuring the different replication types</A><UL> +<A HREF="#Syncrepl">18.3.1. Syncrepl</A> +<BR> +<A HREF="#Delta-syncrepl">18.3.2. Delta-syncrepl</A> +<BR> +<A HREF="#N-Way Multi-Master">18.3.3. N-Way Multi-Master</A> +<BR> +<A HREF="#MirrorMode">18.3.4. MirrorMode</A> +<BR> +<A HREF="#Syncrepl Proxy">18.3.5. Syncrepl Proxy</A></UL></UL> +<BR> +<A HREF="#Maintenance">19. Maintenance</A><UL> +<A HREF="#Directory Backups">19.1. Directory Backups</A> +<BR> +<A HREF="#Berkeley DB Logs">19.2. Berkeley DB Logs</A> +<BR> +<A HREF="#Checkpointing">19.3. Checkpointing</A> +<BR> +<A HREF="#Migration">19.4. Migration</A></UL> +<BR> +<A HREF="#Monitoring">20. Monitoring</A><UL> +<A HREF="#Monitor configuration via cn=config(5)">20.1. Monitor configuration via cn=config(5)</A> +<BR> +<A HREF="#Monitor configuration via slapd.conf(5)">20.2. Monitor configuration via slapd.conf(5)</A> +<BR> +<A HREF="#Accessing Monitoring Information">20.3. Accessing Monitoring Information</A> +<BR> +<A HREF="#Monitor Information">20.4. Monitor Information</A><UL> +<A HREF="#Backends">20.4.1. Backends</A> +<BR> +<A HREF="#Connections">20.4.2. Connections</A> +<BR> +<A HREF="#Databases">20.4.3. Databases</A> +<BR> +<A HREF="#Listener">20.4.4. Listener</A> +<BR> +<A HREF="#Log">20.4.5. Log</A> +<BR> +<A HREF="#Operations">20.4.6. Operations</A> +<BR> +<A HREF="#Overlays">20.4.7. Overlays</A> +<BR> +<A HREF="#SASL">20.4.8. SASL</A> +<BR> +<A HREF="#Statistics">20.4.9. Statistics</A> +<BR> +<A HREF="#Threads">20.4.10. Threads</A> +<BR> +<A HREF="#Time">20.4.11. Time</A> +<BR> +<A HREF="#TLS">20.4.12. TLS</A> +<BR> +<A HREF="#Waiters">20.4.13. Waiters</A></UL></UL> +<BR> +<A HREF="#Tuning">21. Tuning</A><UL> +<A HREF="#Performance Factors">21.1. Performance Factors</A><UL> +<A HREF="#Memory">21.1.1. Memory</A> +<BR> +<A HREF="#Disks">21.1.2. Disks</A> +<BR> +<A HREF="#Network Topology">21.1.3. Network Topology</A> +<BR> +<A HREF="#Directory Layout Design">21.1.4. Directory Layout Design</A> +<BR> +<A HREF="#Expected Usage">21.1.5. Expected Usage</A></UL> +<BR> +<A HREF="#Indexes">21.2. Indexes</A><UL> +<A HREF="#Understanding how a search works">21.2.1. Understanding how a search works</A> +<BR> +<A HREF="#What to index">21.2.2. What to index</A> +<BR> +<A HREF="#Presence indexing">21.2.3. Presence indexing</A></UL> +<BR> +<A HREF="#Logging">21.3. Logging</A><UL> +<A HREF="#What log level to use">21.3.1. What log level to use</A> +<BR> +<A HREF="#What to watch out for">21.3.2. What to watch out for</A> +<BR> +<A HREF="#Improving throughput">21.3.3. Improving throughput</A></UL> +<BR> +<A HREF="#Caching">21.4. Caching</A><UL> +<A HREF="#Berkeley DB Cache">21.4.1. Berkeley DB Cache</A> +<BR> +<A HREF="#{{slapd}}(8) Entry Cache (cachesize)">21.4.2. <EM>slapd</EM>(8) Entry Cache (cachesize)</A> +<BR> +<A HREF="#{{TERM:IDL}} Cache (idlcachesize)">21.4.3. <TERM>IDL</TERM> Cache (idlcachesize)</A></UL> +<BR> +<A HREF="#{{slapd}}(8) Threads">21.5. <EM>slapd</EM>(8) Threads</A></UL> +<BR> +<A HREF="#Troubleshooting">22. Troubleshooting</A><UL> +<A HREF="#User or Software errors">22.1. User or Software errors?</A> +<BR> +<A HREF="#Checklist">22.2. Checklist</A> +<BR> +<A HREF="#OpenLDAP Bugs">22.3. OpenLDAP Bugs</A> +<BR> +<A HREF="#3rd party software error">22.4. 3rd party software error</A> +<BR> +<A HREF="#How to contact the OpenLDAP Project">22.5. How to contact the OpenLDAP Project</A> +<BR> +<A HREF="#How to present your problem">22.6. How to present your problem</A> +<BR> +<A HREF="#Debugging {{slapd}}(8)">22.7. Debugging <EM>slapd</EM>(8)</A> +<BR> +<A HREF="#Commercial Support">22.8. Commercial Support</A></UL> +<BR> +<A HREF="#Changes Since Previous Release">A. Changes Since Previous Release</A><UL> +<A HREF="#New Guide Sections">A.1. New Guide Sections</A> +<BR> +<A HREF="#New Features and Enhancements in 2.4">A.2. New Features and Enhancements in 2.4</A><UL> +<A HREF="#Better {{B:cn=config}} functionality">A.2.1. Better <B>cn=config</B> functionality</A> +<BR> +<A HREF="#Better {{B:cn=schema}} functionality">A.2.2. Better <B>cn=schema</B> functionality</A> +<BR> +<A HREF="#More sophisticated Syncrepl configurations">A.2.3. More sophisticated Syncrepl configurations</A> +<BR> +<A HREF="#N-Way Multimaster Replication">A.2.4. N-Way Multimaster Replication</A> +<BR> +<A HREF="#Replicating {{slapd}} Configuration (syncrepl and {{B:cn=config}})">A.2.5. Replicating <EM>slapd</EM> Configuration (syncrepl and <B>cn=config</B>)</A> +<BR> +<A HREF="#Push-Mode Replication">A.2.6. Push-Mode Replication</A> +<BR> +<A HREF="#More extensive TLS configuration control">A.2.7. More extensive TLS configuration control</A> +<BR> +<A HREF="#Performance enhancements">A.2.8. Performance enhancements</A> +<BR> +<A HREF="#New overlays">A.2.9. New overlays</A> +<BR> +<A HREF="#New features in existing Overlays">A.2.10. New features in existing Overlays</A> +<BR> +<A HREF="#New features in slapd">A.2.11. New features in slapd</A> +<BR> +<A HREF="#New features in libldap">A.2.12. New features in libldap</A> +<BR> +<A HREF="#New clients, tools and tool enhancements">A.2.13. New clients, tools and tool enhancements</A> +<BR> +<A HREF="#New build options">A.2.14. New build options</A></UL> +<BR> +<A HREF="#Obsolete Features Removed From 2.4">A.3. Obsolete Features Removed From 2.4</A><UL> +<A HREF="#Slurpd">A.3.1. Slurpd</A> +<BR> +<A HREF="#back-ldbm">A.3.2. back-ldbm</A></UL></UL> +<BR> +<A HREF="#Upgrading from 2.3.x">B. Upgrading from 2.3.x</A><UL> +<A HREF="#{{B:cn=config}} olc* attributes">B.1. <B>cn=config</B> olc* attributes</A> +<BR> +<A HREF="#ACLs: searches require privileges on the search base">B.2. ACLs: searches require privileges on the search base</A></UL> +<BR> +<A HREF="#Common errors encountered when using OpenLDAP Software">C. Common errors encountered when using OpenLDAP Software</A><UL> +<A HREF="#Common causes of LDAP errors">C.1. Common causes of LDAP errors</A><UL> +<A HREF="#ldap_*: Can\'t contact LDAP server">C.1.1. ldap_*: Can't contact LDAP server</A> +<BR> +<A HREF="#ldap_*: No such object">C.1.2. ldap_*: No such object</A> +<BR> +<A HREF="#ldap_*: Can\'t chase referral">C.1.3. ldap_*: Can't chase referral</A> +<BR> +<A HREF="#ldap_*: server is unwilling to perform">C.1.4. ldap_*: server is unwilling to perform</A> +<BR> +<A HREF="#ldap_*: Insufficient access">C.1.5. ldap_*: Insufficient access</A> +<BR> +<A HREF="#ldap_*: Invalid DN syntax">C.1.6. ldap_*: Invalid DN syntax</A> +<BR> +<A HREF="#ldap_*: Referral hop limit exceeded">C.1.7. ldap_*: Referral hop limit exceeded</A> +<BR> +<A HREF="#ldap_*: operations error">C.1.8. ldap_*: operations error</A> +<BR> +<A HREF="#ldap_*: other error">C.1.9. ldap_*: other error</A> +<BR> +<A HREF="#ldap_add/modify: Invalid syntax">C.1.10. ldap_add/modify: Invalid syntax</A> +<BR> +<A HREF="#ldap_add/modify: Object class violation">C.1.11. ldap_add/modify: Object class violation</A> +<BR> +<A HREF="#ldap_add: No such object">C.1.12. ldap_add: No such object</A> +<BR> +<A HREF="#ldap add: invalid structural object class chain">C.1.13. ldap add: invalid structural object class chain</A> +<BR> +<A HREF="#ldap_add: no structuralObjectClass operational attribute">C.1.14. ldap_add: no structuralObjectClass operational attribute</A> +<BR> +<A HREF="#ldap_add/modify/rename: Naming violation">C.1.15. ldap_add/modify/rename: Naming violation</A> +<BR> +<A HREF="#ldap_add/delete/modify/rename: no global superior knowledge">C.1.16. ldap_add/delete/modify/rename: no global superior knowledge</A> +<BR> +<A HREF="#ldap_bind: Insufficient access">C.1.17. ldap_bind: Insufficient access</A> +<BR> +<A HREF="#ldap_bind: Invalid credentials">C.1.18. ldap_bind: Invalid credentials</A> +<BR> +<A HREF="#ldap_bind: Protocol error">C.1.19. ldap_bind: Protocol error</A> +<BR> +<A HREF="#ldap_modify: cannot modify object class">C.1.20. ldap_modify: cannot modify object class</A> +<BR> +<A HREF="#ldap_sasl_interactive_bind_s: ..">C.1.21. ldap_sasl_interactive_bind_s: ...</A> +<BR> +<A HREF="#ldap_sasl_interactive_bind_s: No such Object">C.1.22. ldap_sasl_interactive_bind_s: No such Object</A> +<BR> +<A HREF="#ldap_sasl_interactive_bind_s: No such attribute">C.1.23. ldap_sasl_interactive_bind_s: No such attribute</A> +<BR> +<A HREF="#ldap_sasl_interactive_bind_s: Unknown authentication method">C.1.24. ldap_sasl_interactive_bind_s: Unknown authentication method</A> +<BR> +<A HREF="#ldap_sasl_interactive_bind_s: Local error (82)">C.1.25. ldap_sasl_interactive_bind_s: Local error (82)</A> +<BR> +<A HREF="#ldap_search: Partial results and referral received">C.1.26. ldap_search: Partial results and referral received</A> +<BR> +<A HREF="#ldap_start_tls: Operations error">C.1.27. ldap_start_tls: Operations error</A></UL> +<BR> +<A HREF="#Other Errors">C.2. Other Errors</A><UL> +<A HREF="#ber_get_next on fd X failed errno=34 (Numerical result out of range)">C.2.1. ber_get_next on fd X failed errno=34 (Numerical result out of range)</A> +<BR> +<A HREF="#ber_get_next on fd X failed errno=11 (Resource temporarily unavailable)">C.2.2. ber_get_next on fd X failed errno=11 (Resource temporarily unavailable)</A> +<BR> +<A HREF="#daemon: socket() failed errno=97 (Address family not supported)">C.2.3. daemon: socket() failed errno=97 (Address family not supported)</A> +<BR> +<A HREF="#GSSAPI: gss_acquire_cred: Miscellaneous failure; Permission denied;">C.2.4. GSSAPI: gss_acquire_cred: Miscellaneous failure; Permission denied;</A> +<BR> +<A HREF="#access from unknown denied">C.2.5. access from unknown denied</A> +<BR> +<A HREF="#ldap_read: want=# error=Resource temporarily unavailable">C.2.6. ldap_read: want=# error=Resource temporarily unavailable</A> +<BR> +<A HREF="#`make test\' fails">C.2.7. `make test' fails</A> +<BR> +<A HREF="#ldap_*: Internal (implementation specific) error (80) - additional info: entry index delete failed">C.2.8. ldap_*: Internal (implementation specific) error (80) - additional info: entry index delete failed</A> +<BR> +<A HREF="#ldap_sasl_interactive_bind_s: Can\'t contact LDAP server (-1)">C.2.9. ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)</A></UL></UL> +<BR> +<A HREF="#Recommended OpenLDAP Software Dependency Versions">D. Recommended OpenLDAP Software Dependency Versions</A><UL> +<A HREF="#Dependency Versions">D.1. Dependency Versions</A></UL> +<BR> +<A HREF="#Real World OpenLDAP Deployments and Examples">E. Real World OpenLDAP Deployments and Examples</A> +<BR> +<A HREF="#OpenLDAP Software Contributions">F. OpenLDAP Software Contributions</A><UL> +<A HREF="#Client APIs">F.1. Client APIs</A><UL> +<A HREF="#ldapc++">F.1.1. ldapc++</A> +<BR> +<A HREF="#ldaptcl">F.1.2. ldaptcl</A></UL> +<BR> +<A HREF="#Overlays">F.2. Overlays</A><UL> +<A HREF="#acl">F.2.1. acl</A> +<BR> +<A HREF="#addpartial">F.2.2. addpartial</A> +<BR> +<A HREF="#allop">F.2.3. allop</A> +<BR> +<A HREF="#autogroup">F.2.4. autogroup</A> +<BR> +<A HREF="#comp_match">F.2.5. comp_match</A> +<BR> +<A HREF="#denyop">F.2.6. denyop</A> +<BR> +<A HREF="#dsaschema">F.2.7. dsaschema</A> +<BR> +<A HREF="#lastmod">F.2.8. lastmod</A> +<BR> +<A HREF="#nops">F.2.9. nops</A> +<BR> +<A HREF="#nssov">F.2.10. nssov</A> +<BR> +<A HREF="#passwd">F.2.11. passwd</A> +<BR> +<A HREF="#proxyOld">F.2.12. proxyOld</A> +<BR> +<A HREF="#smbk5pwd">F.2.13. smbk5pwd</A> +<BR> +<A HREF="#trace">F.2.14. trace</A> +<BR> +<A HREF="#usn">F.2.15. usn</A></UL> +<BR> +<A HREF="#Tools">F.3. Tools</A><UL> +<A HREF="#Statistic Logging">F.3.1. Statistic Logging</A></UL> +<BR> +<A HREF="#SLAPI Plugins">F.4. SLAPI Plugins</A><UL> +<A HREF="#addrdnvalues">F.4.1. addrdnvalues</A></UL></UL> +<BR> +<A HREF="#Configuration File Examples">G. Configuration File Examples</A><UL> +<A HREF="#slapd.conf">G.1. slapd.conf</A> +<BR> +<A HREF="#ldap.conf">G.2. ldap.conf</A> +<BR> +<A HREF="#a-n-other.conf">G.3. a-n-other.conf</A></UL> +<BR> +<A HREF="#LDAP Result Codes">H. LDAP Result Codes</A><UL> +<A HREF="#Non-Error Result Codes">H.1. Non-Error Result Codes</A> +<BR> +<A HREF="#Result Codes">H.2. Result Codes</A> +<BR> +<A HREF="#success (0)">H.3. success (0)</A> +<BR> +<A HREF="#operationsError (1)">H.4. operationsError (1)</A> +<BR> +<A HREF="#protocolError (2)">H.5. protocolError (2)</A> +<BR> +<A HREF="#timeLimitExceeded (3)">H.6. timeLimitExceeded (3)</A> +<BR> +<A HREF="#sizeLimitExceeded (4)">H.7. sizeLimitExceeded (4)</A> +<BR> +<A HREF="#compareFalse (5)">H.8. compareFalse (5)</A> +<BR> +<A HREF="#compareTrue (6)">H.9. compareTrue (6)</A> +<BR> +<A HREF="#authMethodNotSupported (7)">H.10. authMethodNotSupported (7)</A> +<BR> +<A HREF="#strongerAuthRequired (8)">H.11. strongerAuthRequired (8)</A> +<BR> +<A HREF="#referral (10)">H.12. referral (10)</A> +<BR> +<A HREF="#adminLimitExceeded (11)">H.13. adminLimitExceeded (11)</A> +<BR> +<A HREF="#unavailableCriticalExtension (12)">H.14. unavailableCriticalExtension (12)</A> +<BR> +<A HREF="#confidentialityRequired (13)">H.15. confidentialityRequired (13)</A> +<BR> +<A HREF="#saslBindInProgress (14)">H.16. saslBindInProgress (14)</A> +<BR> +<A HREF="#noSuchAttribute (16)">H.17. noSuchAttribute (16)</A> +<BR> +<A HREF="#undefinedAttributeType (17)">H.18. undefinedAttributeType (17)</A> +<BR> +<A HREF="#inappropriateMatching (18)">H.19. inappropriateMatching (18)</A> +<BR> +<A HREF="#constraintViolation (19)">H.20. constraintViolation (19)</A> +<BR> +<A HREF="#attributeOrValueExists (20)">H.21. attributeOrValueExists (20)</A> +<BR> +<A HREF="#invalidAttributeSyntax (21)">H.22. invalidAttributeSyntax (21)</A> +<BR> +<A HREF="#noSuchObject (32)">H.23. noSuchObject (32)</A> +<BR> +<A HREF="#aliasProblem (33)">H.24. aliasProblem (33)</A> +<BR> +<A HREF="#invalidDNSyntax (34)">H.25. invalidDNSyntax (34)</A> +<BR> +<A HREF="#aliasDereferencingProblem (36)">H.26. aliasDereferencingProblem (36)</A> +<BR> +<A HREF="#inappropriateAuthentication (48)">H.27. inappropriateAuthentication (48)</A> +<BR> +<A HREF="#invalidCredentials (49)">H.28. invalidCredentials (49)</A> +<BR> +<A HREF="#insufficientAccessRights (50)">H.29. insufficientAccessRights (50)</A> +<BR> +<A HREF="#busy (51)">H.30. busy (51)</A> +<BR> +<A HREF="#unavailable (52)">H.31. unavailable (52)</A> +<BR> +<A HREF="#unwillingToPerform (53)">H.32. unwillingToPerform (53)</A> +<BR> +<A HREF="#loopDetect (54)">H.33. loopDetect (54)</A> +<BR> +<A HREF="#namingViolation (64)">H.34. namingViolation (64)</A> +<BR> +<A HREF="#objectClassViolation (65)">H.35. objectClassViolation (65)</A> +<BR> +<A HREF="#notAllowedOnNonLeaf (66)">H.36. notAllowedOnNonLeaf (66)</A> +<BR> +<A HREF="#notAllowedOnRDN (67)">H.37. notAllowedOnRDN (67)</A> +<BR> +<A HREF="#entryAlreadyExists (68)">H.38. entryAlreadyExists (68)</A> +<BR> +<A HREF="#objectClassModsProhibited (69)">H.39. objectClassModsProhibited (69)</A> +<BR> +<A HREF="#affectsMultipleDSAs (71)">H.40. affectsMultipleDSAs (71)</A> +<BR> +<A HREF="#other (80)">H.41. other (80)</A></UL> +<BR> +<A HREF="#Glossary">I. Glossary</A><UL> +<A HREF="#Terms">I.1. Terms</A> +<BR> +<A HREF="#Related Organizations">I.2. Related Organizations</A> +<BR> +<A HREF="#Related Products">I.3. Related Products</A> +<BR> +<A HREF="#References">I.4. References</A></UL> +<BR> +<A HREF="#Generic configure Instructions">J. Generic configure Instructions</A> +<BR> +<A HREF="#OpenLDAP Software Copyright Notices">K. OpenLDAP Software Copyright Notices</A><UL> +<A HREF="#OpenLDAP Copyright Notice">K.1. OpenLDAP Copyright Notice</A> +<BR> +<A HREF="#Additional Copyright Notices">K.2. Additional Copyright Notices</A> +<BR> +<A HREF="#University of Michigan Copyright Notice">K.3. University of Michigan Copyright Notice</A></UL> +<BR> +<A HREF="#OpenLDAP Public License">L. OpenLDAP Public License</A></UL> +</DIV> +<DIV CLASS="main"> +<P></P> +<HR> +<H1><A NAME="Preface">Preface</A></H1> +<H2>Copyright</H2> +<P>Copyright 1998-2012, The <A HREF="http://www.openldap.org/foundation/">OpenLDAP Foundation</A>, <EM>All Rights Reserved</EM>.</P> +<P>Copyright 1992-1996, Regents of the <A HREF="http://www.umich.edu/">University of Michigan</A>, <EM>All Rights Reserved</EM>.</P> +<P>This document is considered a part of OpenLDAP Software. This document is subject to terms of conditions set forth in <A HREF="#OpenLDAP Software Copyright Notices">OpenLDAP Software Copyright Notices</A> and the <A HREF="#OpenLDAP Public License">OpenLDAP Public License</A>. Complete copies of the notices and associated license can be found in Appendix K and L, respectively.</P> +<P>Portions of OpenLDAP Software and this document may be copyright by other parties and/or subject to additional restrictions. Individual source files should be consulted for additional copyright notices.</P> +<H2>Scope of this Document</H2> +<P>This document provides a guide for installing OpenLDAP Software 2.4 (<A HREF="http://www.openldap.org/software/">http://www.openldap.org/software/</A>) on <TERM>UNIX</TERM> (and UNIX-like) systems. The document is aimed at experienced system administrators with basic understanding of <TERM>LDAP</TERM>-based directory services.</P> +<P>This document is meant to be used in conjunction with other OpenLDAP information resources provided with the software package and on the project's site (<A HREF="http://www.OpenLDAP.org/">http://www.OpenLDAP.org/</A>) on the <TERM>World Wide Web</TERM>. The site makes available a number of resources.</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>OpenLDAP Resources</CAPTION> +<TR CLASS="heading"> +<TD> +<STRONG>Resource</STRONG> +</TD> +<TD> +<STRONG>URL</STRONG> +</TD> +</TR> +<TR> +<TD> +Document Catalog +</TD> +<TD> +<A HREF="http://www.OpenLDAP.org/doc/">http://www.OpenLDAP.org/doc/</A> +</TD> +</TR> +<TR> +<TD> +Frequently Asked Questions +</TD> +<TD> +<A HREF="http://www.OpenLDAP.org/faq/">http://www.OpenLDAP.org/faq/</A> +</TD> +</TR> +<TR> +<TD> +Issue Tracking System +</TD> +<TD> +<A HREF="http://www.OpenLDAP.org/its/">http://www.OpenLDAP.org/its/</A> +</TD> +</TR> +<TR> +<TD> +Mailing Lists +</TD> +<TD> +<A HREF="http://www.OpenLDAP.org/lists/">http://www.OpenLDAP.org/lists/</A> +</TD> +</TR> +<TR> +<TD> +Manual Pages +</TD> +<TD> +<A HREF="http://www.OpenLDAP.org/software/man.cgi">http://www.OpenLDAP.org/software/man.cgi</A> +</TD> +</TR> +<TR> +<TD> +Software Pages +</TD> +<TD> +<A HREF="http://www.OpenLDAP.org/software/">http://www.OpenLDAP.org/software/</A> +</TD> +</TR> +<TR> +<TD> +Support Pages +</TD> +<TD> +<A HREF="http://www.OpenLDAP.org/support/">http://www.OpenLDAP.org/support/</A> +</TD> +</TR> +</TABLE> + +<P>This document is not a complete reference for OpenLDAP software; the manual pages are the definitive documentation. For best results, you should use the manual pages that were installed on your system with your version of OpenLDAP software so that you're looking at documentation that matches the code. While the OpenLDAP web site also provides the manual pages for convenience, you can not assume that they corresond to the particular version you're running.</P> +<H2>Acknowledgments</H2> +<P>The <A HREF="http://www.openldap.org/project/">OpenLDAP Project</A> is comprised of a team of volunteers. This document would not be possible without their contribution of time and energy.</P> +<P>The OpenLDAP Project would also like to thank the <A HREF="http://www.umich.edu/~dirsvcs/ldap/ldap.html">University of Michigan LDAP Team</A> for building the foundation of LDAP software and information to which OpenLDAP Software is built upon. This document is based upon University of Michigan document: <A HREF="http://www.umich.edu/~dirsvcs/ldap/doc/guides/slapd/guide.pdf">The SLAPD and SLURPD Administrators Guide</A>.</P> +<H2>Amendments</H2> +<P>Suggested enhancements and corrections to this document should be submitted using the <A HREF="http://www.openldap.org/">OpenLDAP</A> <TERM>Issue Tracking System</TERM> (<A HREF="http://www.openldap.org/its/">http://www.openldap.org/its/</A>).</P> +<H2>About this document</H2> +<P>This document was produced using the <TERM>Simple Document Format</TERM> (<TERM>SDF</TERM>) documentation system (<A HREF="http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html">http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html</A>) developed by <EM>Ian Clatworthy</EM>. Tools for SDF are available from <A HREF="http://cpan.org/">CPAN</A> (<A HREF="http://search.cpan.org/search?query=SDF&mode=dist">http://search.cpan.org/search?query=SDF&mode=dist</A>).</P> +<P></P> +<HR> +<H1><A NAME="Introduction to OpenLDAP Directory Services">1. Introduction to OpenLDAP Directory Services</A></H1> +<P>This document describes how to build, configure, and operate <A HREF="http://www.openldap.org/">OpenLDAP</A> Software to provide directory services. This includes details on how to configure and run the Standalone <TERM>LDAP</TERM> Daemon, <EM>slapd</EM>(8). It is intended for new and experienced administrators alike. This section provides a basic introduction to directory services and, in particular, the directory services provided by <EM>slapd</EM>(8). This introduction is only intended to provide enough information so one might get started learning about <TERM>LDAP</TERM>, <TERM>X.500</TERM>, and directory services.</P> +<H2><A NAME="What is a directory service">1.1. What is a directory service?</A></H2> +<P>A directory is a specialized database specifically designed for searching and browsing, in additional to supporting basic lookup and update functions.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>A directory is defined by some as merely a database optimized for read access. This definition, at best, is overly simplistic. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>Directories tend to contain descriptive, attribute-based information and support sophisticated filtering capabilities. Directories generally do not support complicated transaction or roll-back schemes found in database management systems designed for handling high-volume complex updates. Directory updates are typically simple all-or-nothing changes, if they are allowed at all. Directories are generally tuned to give quick response to high-volume lookup or search operations. They may have the ability to replicate information widely in order to increase availability and reliability, while reducing response time. When directory information is replicated, temporary inconsistencies between the replicas may be okay, as long as inconsistencies are resolved in a timely manner.</P> +<P>There are many different ways to provide a directory service. Different methods allow different kinds of information to be stored in the directory, place different requirements on how that information can be referenced, queried and updated, how it is protected from unauthorized access, etc. Some directory services are <EM>local</EM>, providing service to a restricted context (e.g., the finger service on a single machine). Other services are global, providing service to a much broader context (e.g., the entire Internet). Global services are usually <EM>distributed</EM>, meaning that the data they contain is spread across many machines, all of which cooperate to provide the directory service. Typically a global service defines a uniform <EM>namespace</EM> which gives the same view of the data no matter where you are in relation to the data itself.</P> +<P>A web directory, such as provided by the <EM>Open Directory Project</EM> <<A HREF="http://dmoz.org">http://dmoz.org</A>>, is a good example of a directory service. These services catalog web pages and are specifically designed to support browsing and searching.</P> +<P>While some consider the Internet <TERM>Domain Name System</TERM> (DNS) is an example of a globally distributed directory service, DNS is not browseable nor searchable. It is more properly described as a globally distributed <EM>lookup</EM> service.</P> +<H2><A NAME="What is LDAP">1.2. What is LDAP?</A></H2> +<P><TERM>LDAP</TERM> stands for <TERM>Lightweight Directory Access Protocol</TERM>. As the name suggests, it is a lightweight protocol for accessing directory services, specifically <TERM>X.500</TERM>-based directory services. LDAP runs over <TERM>TCP</TERM>/<TERM>IP</TERM> or other connection oriented transfer services. LDAP is an <A HREF="http://www.ietf.org/">IETF</A> Standard Track protocol and is specified in "Lightweight Directory Access Protocol (LDAP) Technical Specification Road Map" <A HREF="http://www.rfc-editor.org/rfc/rfc4510.txt">RFC4510</A>.</P> +<P>This section gives an overview of LDAP from a user's perspective.</P> +<P><EM>What kind of information can be stored in the directory?</EM> The LDAP information model is based on <EM>entries</EM>. An entry is a collection of attributes that has a globally-unique <TERM>Distinguished Name</TERM> (DN). The DN is used to refer to the entry unambiguously. Each of the entry's attributes has a <EM>type</EM> and one or more <EM>values</EM>. The types are typically mnemonic strings, like "<TT>cn</TT>" for common name, or "<TT>mail</TT>" for email address. The syntax of values depend on the attribute type. For example, a <TT>cn</TT> attribute might contain the value <TT>Babs Jensen</TT>. A <TT>mail</TT> attribute might contain the value "<TT>babs@example.com</TT>". A <TT>jpegPhoto</TT> attribute would contain a photograph in the <TERM>JPEG</TERM> (binary) format.</P> +<P><EM>How is the information arranged?</EM> In LDAP, directory entries are arranged in a hierarchical tree-like structure. Traditionally, this structure reflected the geographic and/or organizational boundaries. Entries representing countries appear at the top of the tree. Below them are entries representing states and national organizations. Below them might be entries representing organizational units, people, printers, documents, or just about anything else you can think of. Figure 1.1 shows an example LDAP directory tree using traditional naming.</P> +<P><CENTER><IMG SRC="intro_tree.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure 1.1: LDAP directory tree (traditional naming)</P> +<P>The tree may also be arranged based upon Internet domain names. This naming approach is becoming increasing popular as it allows for directory services to be located using the <EM>DNS</EM>. Figure 1.2 shows an example LDAP directory tree using domain-based naming.</P> +<P><CENTER><IMG SRC="intro_dctree.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure 1.2: LDAP directory tree (Internet naming)</P> +<P>In addition, LDAP allows you to control which attributes are required and allowed in an entry through the use of a special attribute called <TT>objectClass</TT>. The values of the <TT>objectClass</TT> attribute determine the <EM>schema</EM> rules the entry must obey.</P> +<P><EM>How is the information referenced?</EM> An entry is referenced by its distinguished name, which is constructed by taking the name of the entry itself (called the <TERM>Relative Distinguished Name</TERM> or RDN) and concatenating the names of its ancestor entries. For example, the entry for Barbara Jensen in the Internet naming example above has an RDN of <TT>uid=babs</TT> and a DN of <TT>uid=babs,ou=People,dc=example,dc=com</TT>. The full DN format is described in <A HREF="http://www.rfc-editor.org/rfc/rfc4514.txt">RFC4514</A>, "LDAP: String Representation of Distinguished Names."</P> +<P><EM>How is the information accessed?</EM> LDAP defines operations for interrogating and updating the directory. Operations are provided for adding and deleting an entry from the directory, changing an existing entry, and changing the name of an entry. Most of the time, though, LDAP is used to search for information in the directory. The LDAP search operation allows some portion of the directory to be searched for entries that match some criteria specified by a search filter. Information can be requested from each entry that matches the criteria.</P> +<P>For example, you might want to search the entire directory subtree at and below <TT>dc=example,dc=com</TT> for people with the name <TT>Barbara Jensen</TT>, retrieving the email address of each entry found. LDAP lets you do this easily. Or you might want to search the entries directly below the <TT>st=California,c=US</TT> entry for organizations with the string <TT>Acme</TT> in their name, and that have a fax number. LDAP lets you do this too. The next section describes in more detail what you can do with LDAP and how it might be useful to you.</P> +<P><EM>How is the information protected from unauthorized access?</EM> Some directory services provide no protection, allowing anyone to see the information. LDAP provides a mechanism for a client to authenticate, or prove its identity to a directory server, paving the way for rich access control to protect the information the server contains. LDAP also supports data security (integrity and confidentiality) services.</P> +<H2><A NAME="When should I use LDAP">1.3. When should I use LDAP?</A></H2> +<P>This is a very good question. In general, you should use a Directory server when you require data to be centrally managed, stored and accessible via standards based methods.</P> +<P>Some common examples found throughout the industry are, but not limited to:</P> +<UL> +<LI>Machine Authentication +<LI>User Authentication +<LI>User/System Groups +<LI>Address book +<LI>Organization Representation +<LI>Asset Tracking +<LI>Telephony Information Store +<LI>User resource management +<LI>E-mail address lookups +<LI>Application Configuration store +<LI>PBX Configuration store +<LI>etc.....</UL> +<P>There are various <A HREF="#Distributed Schema Files">Distributed Schema Files</A> that are standards based, but you can always create your own <A HREF="#Schema Specification">Schema Specification</A>.</P> +<P>There are always new ways to use a Directory and apply LDAP principles to address certain problems, therefore there is no simple answer to this question.</P> +<P>If in doubt, join the general LDAP forum for non-commercial discussions and information relating to LDAP at: <A HREF="http://www.umich.edu/~dirsvcs/ldap/mailinglist.html">http://www.umich.edu/~dirsvcs/ldap/mailinglist.html</A> and ask</P> +<H2><A NAME="When should I not use LDAP">1.4. When should I not use LDAP?</A></H2> +<P>When you start finding yourself bending the directory to do what you require, maybe a redesign is needed. Or if you only require one application to use and manipulate your data (for discussion of LDAP vs RDBMS, please read the <A HREF="#LDAP vs RDBMS">LDAP vs RDBMS</A> section).</P> +<P>It will become obvious when LDAP is the right tool for the job.</P> +<H2><A NAME="How does LDAP work">1.5. How does LDAP work?</A></H2> +<P>LDAP utilizes a <EM>client-server model</EM>. One or more LDAP servers contain the data making up the directory information tree (<TERM>DIT</TERM>). The client connects to servers and asks it a question. The server responds with an answer and/or with a pointer to where the client can get additional information (typically, another LDAP server). No matter which LDAP server a client connects to, it sees the same view of the directory; a name presented to one LDAP server references the same entry it would at another LDAP server. This is an important feature of a global directory service.</P> +<H2><A NAME="What about X.500">1.6. What about X.500?</A></H2> +<P>Technically, <TERM>LDAP</TERM> is a directory access protocol to an <TERM>X.500</TERM> directory service, the <TERM>OSI</TERM> directory service. Initially, LDAP clients accessed gateways to the X.500 directory service. This gateway ran LDAP between the client and gateway and X.500's <TERM>Directory Access Protocol</TERM> (<TERM>DAP</TERM>) between the gateway and the X.500 server. DAP is a heavyweight protocol that operates over a full OSI protocol stack and requires a significant amount of computing resources. LDAP is designed to operate over <TERM>TCP</TERM>/<TERM>IP</TERM> and provides most of the functionality of DAP at a much lower cost.</P> +<P>While LDAP is still used to access X.500 directory service via gateways, LDAP is now more commonly directly implemented in X.500 servers.</P> +<P>The Standalone LDAP Daemon, or <EM>slapd</EM>(8), can be viewed as a <EM>lightweight</EM> X.500 directory server. That is, it does not implement the X.500's DAP nor does it support the complete X.500 models.</P> +<P>If you are already running a X.500 DAP service and you want to continue to do so, you can probably stop reading this guide. This guide is all about running LDAP via <EM>slapd</EM>(8), without running X.500 DAP. If you are not running X.500 DAP, want to stop running X.500 DAP, or have no immediate plans to run X.500 DAP, read on.</P> +<P>It is possible to replicate data from an LDAP directory server to a X.500 DAP <TERM>DSA</TERM>. This requires an LDAP/DAP gateway. OpenLDAP Software does not include such a gateway.</P> +<H2><A NAME="What is the difference between LDAPv2 and LDAPv3">1.7. What is the difference between LDAPv2 and LDAPv3?</A></H2> +<P>LDAPv3 was developed in the late 1990's to replace LDAPv2. LDAPv3 adds the following features to LDAP:</P> +<UL> +<LI>Strong authentication and data security services via <TERM>SASL</TERM> +<LI>Certificate authentication and data security services via <TERM>TLS</TERM> (SSL) +<LI>Internationalization through the use of Unicode +<LI>Referrals and Continuations +<LI>Schema Discovery +<LI>Extensibility (controls, extended operations, and more)</UL> +<P>LDAPv2 is historic (<A HREF="http://www.rfc-editor.org/rfc/rfc3494.txt">RFC3494</A>). As most <EM>so-called</EM> LDAPv2 implementations (including <EM>slapd</EM>(8)) do not conform to the LDAPv2 technical specification, interoperability amongst implementations claiming LDAPv2 support is limited. As LDAPv2 differs significantly from LDAPv3, deploying both LDAPv2 and LDAPv3 simultaneously is quite problematic. LDAPv2 should be avoided. LDAPv2 is disabled by default.</P> +<H2><A NAME="LDAP vs RDBMS">1.8. LDAP vs RDBMS</A></H2> +<P>This question is raised many times, in different forms. The most common, however, is: <EM>Why doesn't OpenLDAP use a relational database management system (RDBMS) instead of an embedded key/value store like LMDB?</EM> In general, expecting that the sophisticated algorithms implemented by commercial-grade RDBMS would make <EM>OpenLDAP</EM> be faster or somehow better and, at the same time, permitting sharing of data with other applications.</P> +<P>The short answer is that use of an embedded database and custom indexing system allows OpenLDAP to provide greater performance and scalability without loss of reliability. OpenLDAP uses <TERM>LMDB</TERM> concurrent / transactional database software.</P> +<P>Now for the long answer. We are all confronted all the time with the choice RDBMSes vs. directories. It is a hard choice and no simple answer exists.</P> +<P>It is tempting to think that having a RDBMS backend to the directory solves all problems. However, it is a pig. This is because the data models are very different. Representing directory data with a relational database is going to require splitting data into multiple tables.</P> +<P>Think for a moment about the person objectclass. Its definition requires attribute types objectclass, sn and cn and allows attribute types userPassword, telephoneNumber, seeAlso and description. All of these attributes are multivalued, so a normalization requires putting each attribute type in a separate table.</P> +<P>Now you have to decide on appropriate keys for those tables. The primary key might be a combination of the DN, but this becomes rather inefficient on most database implementations.</P> +<P>The big problem now is that accessing data from one entry requires seeking on different disk areas. On some applications this may be OK but in many applications performance suffers.</P> +<P>The only attribute types that can be put in the main table entry are those that are mandatory and single-value. You may add also the optional single-valued attributes and set them to NULL or something if not present.</P> +<P>But wait, the entry can have multiple objectclasses and they are organized in an inheritance hierarchy. An entry of objectclass organizationalPerson now has the attributes from person plus a few others and some formerly optional attribute types are now mandatory.</P> +<P>What to do? Should we have different tables for the different objectclasses? This way the person would have an entry on the person table, another on organizationalPerson, etc. Or should we get rid of person and put everything on the second table?</P> +<P>But what do we do with a filter like (cn=*) where cn is an attribute type that appears in many, many objectclasses. Should we search all possible tables for matching entries? Not very attractive.</P> +<P>Once this point is reached, three approaches come to mind. One is to do full normalization so that each attribute type, no matter what, has its own separate table. The simplistic approach where the DN is part of the primary key is extremely wasteful, and calls for an approach where the entry has a unique numeric id that is used instead for the keys and a main table that maps DNs to ids. The approach, anyway, is very inefficient when several attribute types from one or more entries are requested. Such a database, though cumbersomely, can be managed from SQL applications.</P> +<P>The second approach is to put the whole entry as a blob in a table shared by all entries regardless of the objectclass and have additional tables that act as indices for the first table. Index tables are not database indices, but are fully managed by the LDAP server-side implementation. However, the database becomes unusable from SQL. And, thus, a fully fledged database system provides little or no advantage. The full generality of the database is unneeded. Much better to use something light and fast, like <TERM>LMDB</TERM>.</P> +<P>A completely different way to see this is to give up any hopes of implementing the directory data model. In this case, LDAP is used as an access protocol to data that provides only superficially the directory data model. For instance, it may be read only or, where updates are allowed, restrictions are applied, such as making single-value attribute types that would allow for multiple values. Or the impossibility to add new objectclasses to an existing entry or remove one of those present. The restrictions span the range from allowed restrictions (that might be elsewhere the result of access control) to outright violations of the data model. It can be, however, a method to provide LDAP access to preexisting data that is used by other applications. But in the understanding that we don't really have a "directory".</P> +<P>Existing commercial LDAP server implementations that use a relational database are either from the first kind or the third. I don't know of any implementation that uses a relational database to do inefficiently what BDB does efficiently. For those who are interested in "third way" (exposing EXISTING data from RDBMS as LDAP tree, having some limitations compared to classic LDAP model, but making it possible to interoperate between LDAP and SQL applications):</P> +<P>OpenLDAP includes back-sql - the backend that makes it possible. It uses ODBC + additional metainformation about translating LDAP queries to SQL queries in your RDBMS schema, providing different levels of access - from read-only to full access depending on RDBMS you use, and your schema.</P> +<P>For more information on concept and limitations, see <EM>slapd-sql</EM>(5) man page, or the <A HREF="#Backends">Backends</A> section. There are also several examples for several RDBMSes in <TT>back-sql/rdbms_depend/*</TT> subdirectories.</P> +<H2><A NAME="What is slapd and what can it do">1.9. What is slapd and what can it do?</A></H2> +<P><EM>slapd</EM>(8) is an LDAP directory server that runs on many different platforms. You can use it to provide a directory service of your very own. Your directory can contain pretty much anything you want to put in it. You can connect it to the global LDAP directory service, or run a service all by yourself. Some of slapd's more interesting features and capabilities include:</P> +<P><B>LDAPv3</B>: <EM>slapd</EM> implements version 3 of <TERM>Lightweight Directory Access Protocol</TERM>. <EM>slapd</EM> supports LDAP over both <TERM>IPv4</TERM> and <TERM>IPv6</TERM> and Unix <TERM>IPC</TERM>.</P> +<P><B><TERM>Simple Authentication and Security Layer</TERM></B>: <EM>slapd</EM> supports strong authentication and data security (integrity and confidentiality) services through the use of SASL. <EM>slapd</EM>'s SASL implementation utilizes <A HREF="http://asg.web.cmu.edu/sasl/sasl-library.html">Cyrus SASL</A> software which supports a number of mechanisms including <TERM>DIGEST-MD5</TERM>, <TERM>EXTERNAL</TERM>, and <TERM>GSSAPI</TERM>.</P> +<P><B><TERM>Transport Layer Security</TERM></B>: <EM>slapd</EM> supports certificate-based authentication and data security (integrity and confidentiality) services through the use of TLS (or SSL). <EM>slapd</EM>'s TLS implementation can utilize <A HREF="http://www.openssl.org/">OpenSSL</A>, <A HREF="http://www.gnu.org/software/gnutls/">GnuTLS</A>, or <A HREF="http://developer.mozilla.org/en/NSS">MozNSS</A> software.</P> +<P><B>Topology control</B>: <EM>slapd</EM> can be configured to restrict access at the socket layer based upon network topology information. This feature utilizes <EM>TCP wrappers</EM>.</P> +<P><B>Access control</B>: <EM>slapd</EM> provides a rich and powerful access control facility, allowing you to control access to the information in your database(s). You can control access to entries based on LDAP authorization information, <TERM>IP</TERM> address, domain name and other criteria. <EM>slapd</EM> supports both <EM>static</EM> and <EM>dynamic</EM> access control information.</P> +<P><B>Internationalization</B>: <EM>slapd</EM> supports Unicode and language tags.</P> +<P><B>Choice of database backends</B>: <EM>slapd</EM> comes with a variety of different database backends you can choose from. They include <TERM>MDB</TERM>, a hierarchical high-performance transactional database backend; <TERM>BDB</TERM>, a high-performance transactional database backend (deprecated); <TERM>HDB</TERM>, a hierarchical high-performance transactional backend (deprecated); <EM>SHELL</EM>, a backend interface to arbitrary shell scripts; and PASSWD, a simple backend interface to the <EM>passwd</EM>(5) file. The MDB backend utilizes <TERM>LMDB</TERM>, a high performance replacement for <A HREF="http://www.oracle.com/">Oracle Corporation</A>'s Berkeley DB. The BDB and HDB backends utilize <A HREF="http://www.oracle.com/">Oracle Corporation</A> Berkeley DB. These backends have been deprecated as LMDB provides significantly higher read and write throughput and data reliability.</P> +<P><B>Multiple database instances</B>: <EM>slapd</EM> can be configured to serve multiple databases at the same time. This means that a single <EM>slapd</EM> server can respond to requests for many logically different portions of the LDAP tree, using the same or different database backends.</P> +<P><B>Generic modules API</B>: If you require even more customization, <EM>slapd</EM> lets you write your own modules easily. <EM>slapd</EM> consists of two distinct parts: a front end that handles protocol communication with LDAP clients; and modules which handle specific tasks such as database operations. Because these two pieces communicate via a well-defined <TERM>C</TERM> <TERM>API</TERM>, you can write your own customized modules which extend <EM>slapd</EM> in numerous ways. Also, a number of <EM>programmable database</EM> modules are provided. These allow you to expose external data sources to <EM>slapd</EM> using popular programming languages (<A HREF="http://www.perl.org/">Perl</A>, <EM>shell</EM>, and <TERM>SQL</TERM>).</P> +<P><B>Threads</B>: <EM>slapd</EM> is threaded for high performance. A single multi-threaded <EM>slapd</EM> process handles all incoming requests using a pool of threads. This reduces the amount of system overhead required while providing high performance.</P> +<P><B>Replication</B>: <EM>slapd</EM> can be configured to maintain shadow copies of directory information. This <EM>single-master/multiple-slave</EM> replication scheme is vital in high-volume environments where a single <EM>slapd</EM> installation just doesn't provide the necessary availability or reliability. For extremely demanding environments where a single point of failure is not acceptable, <EM>multi-master</EM> replication is also available. <EM>slapd</EM> includes support for <EM>LDAP Sync</EM>-based replication.</P> +<P><B>Proxy Cache</B>: <EM>slapd</EM> can be configured as a caching LDAP proxy service.</P> +<P><B>Configuration</B>: <EM>slapd</EM> is highly configurable through a single configuration file which allows you to change just about everything you'd ever want to change. Configuration options have reasonable defaults, making your job much easier. Configuration can also be performed dynamically using LDAP itself, which greatly improves manageability.</P> +<P></P> +<HR> +<H1><A NAME="A Quick-Start Guide">2. A Quick-Start Guide</A></H1> +<P>The following is a quick start guide to OpenLDAP Software 2.4, including the Standalone <TERM>LDAP</TERM> Daemon, <EM>slapd</EM>(8).</P> +<P>It is meant to walk you through the basic steps needed to install and configure <A HREF="http://www.openldap.org/software/">OpenLDAP Software</A>. It should be used in conjunction with the other chapters of this document, manual pages, and other materials provided with the distribution (e.g. the <TT>INSTALL</TT> document) or on the <A HREF="http://www.openldap.org/">OpenLDAP</A> web site (<A HREF="http://www.OpenLDAP.org">http://www.OpenLDAP.org</A>), in particular the OpenLDAP Software <TERM>FAQ</TERM> (<A HREF="http://www.OpenLDAP.org/faq/?file=2">http://www.OpenLDAP.org/faq/?file=2</A>).</P> +<P>If you intend to run OpenLDAP Software seriously, you should review all of this document before attempting to install the software.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>This quick start guide does not use strong authentication nor any integrity or confidential protection services. These services are described in other chapters of the OpenLDAP Administrator's Guide. +<HR WIDTH="80%" ALIGN="Left"></P> +<UL> + </UL><OL> +<LI><B>Get the software</B> +<BR> +You can obtain a copy of the software by following the instructions on the OpenLDAP Software download page (<A HREF="http://www.openldap.org/software/download/">http://www.openldap.org/software/download/</A>). It is recommended that new users start with the latest <EM>release</EM>. +<BR> + +<LI><B>Unpack the distribution</B> +<BR> +Pick a directory for the source to live under, change directory to there, and unpack the distribution using the following commands:<UL> +<TT>gunzip -c openldap-VERSION.tgz | tar xvfB -</TT></UL> +<BR> +then relocate yourself into the distribution directory:<UL> +<TT>cd openldap-VERSION</TT></UL> +<BR> +You'll have to replace <TT>VERSION</TT> with the version name of the release. +<BR> + +<LI><B>Review documentation</B> +<BR> +You should now review the <TT>COPYRIGHT</TT>, <TT>LICENSE</TT>, <TT>README</TT> and <TT>INSTALL</TT> documents provided with the distribution. The <TT>COPYRIGHT</TT> and <TT>LICENSE</TT> provide information on acceptable use, copying, and limitation of warranty of OpenLDAP Software. +<BR> + +<BR> +You should also review other chapters of this document. In particular, the <A HREF="#Building and Installing OpenLDAP Software">Building and Installing OpenLDAP Software</A> chapter of this document provides detailed information on prerequisite software and installation procedures. +<BR> + +<LI><B>Run <TT>configure</TT></B> +<BR> +You will need to run the provided <TT>configure</TT> script to <EM>configure</EM> the distribution for building on your system. The <TT>configure</TT> script accepts many command line options that enable or disable optional software features. Usually the defaults are okay, but you may want to change them. To get a complete list of options that <TT>configure</TT> accepts, use the <TT>--help</TT> option:<UL> +<TT>./configure --help</TT></UL> +<BR> +However, given that you are using this guide, we'll assume you are brave enough to just let <TT>configure</TT> determine what's best:<UL> +<TT>./configure</TT></UL> +<BR> +Assuming <TT>configure</TT> doesn't dislike your system, you can proceed with building the software. If <TT>configure</TT> did complain, well, you'll likely need to go to the Software FAQ <EM>Installation</EM> section (<A HREF="http://www.openldap.org/faq/?file=8">http://www.openldap.org/faq/?file=8</A>) and/or actually read the <A HREF="#Building and Installing OpenLDAP Software">Building and Installing OpenLDAP Software</A> chapter of this document. +<BR> + +<LI><B>Build the software</B>. +<BR> +The next step is to build the software. This step has two parts, first we construct dependencies and then we compile the software:<UL> +<TT>make depend</TT> +<BR> +<TT>make</TT></UL> +<BR> +Both makes should complete without error. +<BR> + +<LI><B>Test the build</B>. +<BR> +To ensure a correct build, you should run the test suite (it only takes a few minutes):<UL> +<TT>make test</TT></UL> +<BR> +Tests which apply to your configuration will run and they should pass. Some tests, such as the replication test, may be skipped. +<BR> + +<LI><B>Install the software</B>. +<BR> +You are now ready to install the software; this usually requires <EM>super-user</EM> privileges:<UL> +<TT>su root -c 'make install'</TT></UL> +<BR> +Everything should now be installed under <TT>/usr/local</TT> (or whatever installation prefix was used by <TT>configure</TT>). +<BR> + +<LI><B>Edit the configuration file</B>. +<BR> +Use your favorite editor to edit the provided <EM>slapd.ldif</EM> example (usually installed as <TT>/usr/local/etc/openldap/slapd.ldif</TT>) to contain a MDB database definition of the form:<UL> +<TT>dn: olcDatabase=mdb,cn=config</TT> +<BR> +<TT>objectClass: olcDatabaseConfig</TT> +<BR> +<TT>objectClass: olcMdbConfig</TT> +<BR> +<TT>olcDatabase: mdb</TT> +<BR> +<TT>OlcDbMaxSize: 1073741824</TT> +<BR> +<TT>olcSuffix: dc=<MY-DOMAIN>,dc=<COM></TT> +<BR> +<TT>olcRootDN: cn=Manager,dc=<MY-DOMAIN>,dc=<COM></TT> +<BR> +<TT>olcRootPW: secret</TT> +<BR> +<TT>olcDbDirectory: /usr/local/var/openldap-data</TT> +<BR> +<TT>olcDbIndex: objectClass eq</TT></UL> +<BR> +Be sure to replace <TT><MY-DOMAIN></TT> and <TT><COM></TT> with the appropriate domain components of your domain name. For example, for <TT>example.com</TT>, use:<UL> +<TT>dn: olcDatabase=mdb,cn=config</TT> +<BR> +<TT>objectClass: olcDatabaseConfig</TT> +<BR> +<TT>objectClass: olcMdbConfig</TT> +<BR> +<TT>olcDatabase: mdb</TT> +<BR> +<TT>OlcDbMaxSize: 1073741824</TT> +<BR> +<TT>olcSuffix: dc=example,dc=com</TT> +<BR> +<TT>olcRootDN: cn=Manager,dc=example,dc=com</TT> +<BR> +<TT>olcRootPW: secret</TT> +<BR> +<TT>olcDbDirectory: /usr/local/var/openldap-data</TT> +<BR> +<TT>olcDbIndex: objectClass eq</TT></UL> +<BR> +If your domain contains additional components, such as <TT>eng.uni.edu.eu</TT>, use:<UL> +<TT>dn: olcDatabase=mdb,cn=config</TT> +<BR> +<TT>objectClass: olcDatabaseConfig</TT> +<BR> +<TT>objectClass: olcMdbConfig</TT> +<BR> +<TT>olcDatabase: mdb</TT> +<BR> +<TT>OlcDbMaxSize: 1073741824</TT> +<BR> +<TT>olcSuffix: dc=eng,dc=uni,dc=edu,dc=eu</TT> +<BR> +<TT>olcRootDN: cn=Manager,dc=eng,dc=uni,dc=edu,dc=eu</TT> +<BR> +<TT>olcRootPW: secret</TT> +<BR> +<TT>olcDbDirectory: /usr/local/var/openldap-data</TT> +<BR> +<TT>olcDbIndex: objectClass eq</TT></UL> +<BR> +Details regarding configuring <EM>slapd</EM>(8) can be found in the <EM>slapd-config</EM>(5) manual page and the <A HREF="#Configuring slapd">Configuring slapd</A> chapter of this document. Note that the specified olcDbDirectory must exist prior to starting <EM>slapd</EM>(8). +<BR> + +<LI><B>Import the configuration database</B> +<BR> +You are now ready to import your configration database for use by <EM>slapd</EM>(8), by running the command:<UL> +<TT> su root -c /usr/local/sbin/slapadd -n 0 -F /usr/local/etc/slapd.d -l /usr/local/etc/openldap/slapd.ldif</TT></UL> +<BR> + +<LI><B>Start SLAPD</B>. +<BR> +You are now ready to start the Standalone LDAP Daemon, <EM>slapd</EM>(8), by running the command:<UL> +<TT>su root -c /usr/local/libexec/slapd -F /usr/local/etc/slapd.d</TT></UL> +<BR> +To check to see if the server is running and configured correctly, you can run a search against it with <EM>ldapsearch</EM>(1). By default, <EM>ldapsearch</EM> is installed as <TT>/usr/local/bin/ldapsearch</TT>:<UL> +<TT>ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts</TT></UL> +<BR> +Note the use of single quotes around command parameters to prevent special characters from being interpreted by the shell. This should return:<UL> +<TT>dn:</TT> +<BR> +<TT>namingContexts: dc=example,dc=com</TT></UL> +<BR> +Details regarding running <EM>slapd</EM>(8) can be found in the <EM>slapd</EM>(8) manual page and the <A HREF="#Running slapd">Running slapd</A> chapter of this document. +<BR> + +<LI><B>Add initial entries to your directory</B>. +<BR> +You can use <EM>ldapadd</EM>(1) to add entries to your LDAP directory. <EM>ldapadd</EM> expects input in <TERM>LDIF</TERM> form. We'll do it in two steps:<OL> +<LI>create an LDIF file +<LI>run ldapadd</OL> +<BR> +Use your favorite editor and create an LDIF file that contains:<UL> +<TT>dn: dc=<MY-DOMAIN>,dc=<COM></TT> +<BR> +<TT>objectclass: dcObject</TT> +<BR> +<TT>objectclass: organization</TT> +<BR> +<TT>o: <MY ORGANIZATION></TT> +<BR> +<TT>dc: <MY-DOMAIN></TT> +<BR> +<TT></TT> +<BR> +<TT>dn: cn=Manager,dc=<MY-DOMAIN>,dc=<COM></TT> +<BR> +<TT>objectclass: organizationalRole</TT> +<BR> +<TT>cn: Manager</TT></UL> +<BR> +Be sure to replace <TT><MY-DOMAIN></TT> and <TT><COM></TT> with the appropriate domain components of your domain name. <TT><MY ORGANIZATION></TT> should be replaced with the name of your organization. When you cut and paste, be sure to trim any leading and trailing whitespace from the example.<UL> +<TT>dn: dc=example,dc=com</TT> +<BR> +<TT>objectclass: dcObject</TT> +<BR> +<TT>objectclass: organization</TT> +<BR> +<TT>o: Example Company</TT> +<BR> +<TT>dc: example</TT> +<BR> +<TT></TT> +<BR> +<TT>dn: cn=Manager,dc=example,dc=com</TT> +<BR> +<TT>objectclass: organizationalRole</TT> +<BR> +<TT>cn: Manager</TT></UL> +<BR> +Now, you may run <EM>ldapadd</EM>(1) to insert these entries into your directory.<UL> +<TT>ldapadd -x -D "cn=Manager,dc=<MY-DOMAIN>,dc=<COM>" -W -f example.ldif</TT></UL> +<BR> +Be sure to replace <TT><MY-DOMAIN></TT> and <TT><COM></TT> with the appropriate domain components of your domain name. You will be prompted for the "<TT>secret</TT>" specified in <TT>slapd.conf</TT>. For example, for <TT>example.com</TT>, use:<UL> +<TT>ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f example.ldif</TT></UL> +<BR> +where <TT>example.ldif</TT> is the file you created above.<UL> +<TT> </TT></UL> +<BR> +Additional information regarding directory creation can be found in the <A HREF="#Database Creation and Maintenance Tools">Database Creation and Maintenance Tools</A> chapter of this document. +<BR> + +<LI><B>See if it works</B>. +<BR> +Now we're ready to verify the added entries are in your directory. You can use any LDAP client to do this, but our example uses the <EM>ldapsearch</EM>(1) tool. Remember to replace <TT>dc=example,dc=com</TT> with the correct values for your site:<UL> +<TT>ldapsearch -x -b 'dc=example,dc=com' '(objectclass=*)'</TT></UL> +<BR> +This command will search for and retrieve every entry in the database.</OL> +<P>You are now ready to add more entries using <EM>ldapadd</EM>(1) or another LDAP client, experiment with various configuration options, backend arrangements, etc..</P> +<P>Note that by default, the <EM>slapd</EM>(8) database grants <EM>read access to everybody</EM> excepting the <EM>super-user</EM> (as specified by the <TT>rootdn</TT> configuration directive). It is highly recommended that you establish controls to restrict access to authorized users. Access controls are discussed in the <A HREF="#Access Control">Access Control</A> chapter. You are also encouraged to read the <A HREF="#Security Considerations">Security Considerations</A>, <A HREF="#Using SASL">Using SASL</A> and <A HREF="#Using TLS">Using TLS</A> sections.</P> +<P>The following chapters provide more detailed information on making, installing, and running <EM>slapd</EM>(8).</P> +<P></P> +<HR> +<H1><A NAME="The Big Picture - Configuration Choices">3. The Big Picture - Configuration Choices</A></H1> +<P>This section gives a brief overview of various <TERM>LDAP</TERM> directory configurations, and how your Standalone LDAP Daemon <EM>slapd</EM>(8) fits in with the rest of the world.</P> +<H2><A NAME="Local Directory Service">3.1. Local Directory Service</A></H2> +<P>In this configuration, you run a <EM>slapd</EM>(8) instance which provides directory service for your local domain only. It does not interact with other directory servers in any way. This configuration is shown in Figure 3.1.</P> +<P><CENTER><IMG SRC="config_local.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure 3.1: Local service configuration.</P> +<P>Use this configuration if you are just starting out (it's the one the quick-start guide makes for you) or if you want to provide a local service and are not interested in connecting to the rest of the world. It's easy to upgrade to another configuration later if you want.</P> +<H2><A NAME="Local Directory Service with Referrals">3.2. Local Directory Service with Referrals</A></H2> +<P>In this configuration, you run a <EM>slapd</EM>(8) instance which provides directory service for your local domain and configure it to return referrals to other servers capable of handling requests. You may run this service (or services) yourself or use one provided to you. This configuration is shown in Figure 3.2.</P> +<P><CENTER><IMG SRC="config_ref.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure 3.2: Local service with referrals</P> +<P>Use this configuration if you want to provide local service and participate in the Global Directory, or you want to delegate responsibility for <EM>subordinate</EM> entries to another server.</P> +<H2><A NAME="Replicated Directory Service">3.3. Replicated Directory Service</A></H2> +<P>slapd(8) includes support for <EM>LDAP Sync</EM>-based replication, called <EM>syncrepl</EM>, which may be used to maintain shadow copies of directory information on multiple directory servers. In its most basic configuration, the <EM>master</EM> is a syncrepl provider and one or more <EM>slave</EM> (or <EM>shadow</EM>) are syncrepl consumers. An example master-slave configuration is shown in figure 3.3. Multi-Master configurations are also supported.</P> +<P><CENTER><IMG SRC="config_repl.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure 3.3: Replicated Directory Services</P> +<P>This configuration can be used in conjunction with either of the first two configurations in situations where a single <EM>slapd</EM>(8) instance does not provide the required reliability or availability.</P> +<H2><A NAME="Distributed Local Directory Service">3.4. Distributed Local Directory Service</A></H2> +<P>In this configuration, the local service is partitioned into smaller services, each of which may be replicated, and <EM>glued</EM> together with <EM>superior</EM> and <EM>subordinate</EM> referrals.</P> +<P></P> +<HR> +<H1><A NAME="Building and Installing OpenLDAP Software">4. Building and Installing OpenLDAP Software</A></H1> +<P>This chapter details how to build and install the <A HREF="http://www.openldap.org/">OpenLDAP</A> Software package including <EM>slapd</EM>(8), the Standalone <TERM>LDAP</TERM> Daemon. Building and installing OpenLDAP Software requires several steps: installing prerequisite software, configuring OpenLDAP Software itself, making, and finally installing. The following sections describe this process in detail.</P> +<H2><A NAME="Obtaining and Extracting the Software">4.1. Obtaining and Extracting the Software</A></H2> +<P>You can obtain OpenLDAP Software from the project's download page at <A HREF="http://www.openldap.org/software/download/">http://www.openldap.org/software/download/</A> or directly from the project's <TERM>FTP</TERM> service at <A HREF="ftp://ftp.openldap.org/pub/OpenLDAP/">ftp://ftp.openldap.org/pub/OpenLDAP/</A>.</P> +<P>The project makes available two series of packages for <EM>general use</EM>. The project makes <EM>releases</EM> as new features and bug fixes come available. Though the project takes steps to improve stability of these releases, it is common for problems to arise only after <EM>release</EM>. The <EM>stable</EM> release is the latest <EM>release</EM> which has demonstrated stability through general use.</P> +<P>Users of OpenLDAP Software can choose, depending on their desire for the <EM>latest features</EM> versus <EM>demonstrated stability</EM>, the most appropriate series to install.</P> +<P>After downloading OpenLDAP Software, you need to extract the distribution from the compressed archive file and change your working directory to the top directory of the distribution:</P> +<UL> +<TT>gunzip -c openldap-VERSION.tgz | tar xf -</TT> +<BR> +<TT>cd openldap-VERSION</TT></UL> +<P>You'll have to replace <TT>VERSION</TT> with the version name of the release.</P> +<P>You should now review the <TT>COPYRIGHT</TT>, <TT>LICENSE</TT>, <TT>README</TT> and <TT>INSTALL</TT> documents provided with the distribution. The <TT>COPYRIGHT</TT> and <TT>LICENSE</TT> provide information on acceptable use, copying, and limitation of warranty of OpenLDAP Software. The <TT>README</TT> and <TT>INSTALL</TT> documents provide detailed information on prerequisite software and installation procedures.</P> +<H2><A NAME="Prerequisite software">4.2. Prerequisite software</A></H2> +<P>OpenLDAP Software relies upon a number of software packages distributed by third parties. Depending on the features you intend to use, you may have to download and install a number of additional software packages. This section details commonly needed third party software packages you might have to install. However, for an up-to-date prerequisite information, the <TT>README</TT> document should be consulted. Note that some of these third party packages may depend on additional software packages. Install each package per the installation instructions provided with it.</P> +<H3><A NAME="{{TERM[expand]TLS}}">4.2.1. <TERM>Transport Layer Security</TERM></A></H3> +<P>OpenLDAP clients and servers require installation of <A HREF="http://www.openssl.org/">OpenSSL</A>, <A HREF="http://www.gnu.org/software/gnutls/">GnuTLS</A>, or <A HREF="http://developer.mozilla.org/en/NSS">MozNSS</A> <TERM>TLS</TERM> libraries to provide <TERM>Transport Layer Security</TERM> services. Though some operating systems may provide these libraries as part of the base system or as an optional software component, OpenSSL, GnuTLS, and Mozilla NSS often require separate installation.</P> +<P>OpenSSL is available from <A HREF="http://www.openssl.org/">http://www.openssl.org/</A>. GnuTLS is available from <A HREF="http://www.gnu.org/software/gnutls/">http://www.gnu.org/software/gnutls/</A>. Mozilla NSS is available from <A HREF="http://developer.mozilla.org/en/NSS">http://developer.mozilla.org/en/NSS</A>.</P> +<P>OpenLDAP Software will not be fully LDAPv3 compliant unless OpenLDAP's <TT>configure</TT> detects a usable TLS library.</P> +<H3><A NAME="{{TERM[expand]SASL}}">4.2.2. <TERM>Simple Authentication and Security Layer</TERM></A></H3> +<P>OpenLDAP clients and servers require installation of <A HREF="http://asg.web.cmu.edu/sasl/sasl-library.html">Cyrus SASL</A> libraries to provide <TERM>Simple Authentication and Security Layer</TERM> services. Though some operating systems may provide this library as part of the base system or as an optional software component, Cyrus SASL often requires separate installation.</P> +<P>Cyrus SASL is available from <A HREF="http://asg.web.cmu.edu/sasl/sasl-library.html">http://asg.web.cmu.edu/sasl/sasl-library.html</A>. Cyrus SASL will make use of OpenSSL and Kerberos/GSSAPI libraries if preinstalled.</P> +<P>OpenLDAP Software will not be fully LDAPv3 compliant unless OpenLDAP's configure detects a usable Cyrus SASL installation.</P> +<H3><A NAME="{{TERM[expand]Kerberos}}">4.2.3. <TERM>Kerberos Authentication Service</TERM></A></H3> +<P>OpenLDAP clients and servers support <TERM>Kerberos</TERM> authentication services. In particular, OpenLDAP supports the Kerberos V <TERM>GSS-API</TERM> <TERM>SASL</TERM> authentication mechanism known as the <TERM>GSSAPI</TERM> mechanism. This feature requires, in addition to Cyrus SASL libraries, either <A HREF="http://www.pdc.kth.se/heimdal/">Heimdal</A> or <A HREF="http://web.mit.edu/kerberos/www/">MIT Kerberos</A> V libraries.</P> +<P>Heimdal Kerberos is available from <A HREF="http://www.pdc.kth.se/heimdal/">http://www.pdc.kth.se/heimdal/</A>. MIT Kerberos is available from <A HREF="http://web.mit.edu/kerberos/www/">http://web.mit.edu/kerberos/www/</A>.</P> +<P>Use of strong authentication services, such as those provided by Kerberos, is highly recommended.</P> +<H3><A NAME="Database Software">4.2.4. Database Software</A></H3> +<P>OpenLDAP's <EM>slapd</EM>(8) <TERM>MDB</TERM> primary database backend uses the <TERM>LMDB</TERM> software included with the OpenLDAP source. There is no need to download any additional software to have <EM>MDB</EM> support.</P> +<P>OpenLDAP's <EM>slapd</EM>(8) <TERM>BDB</TERM> and <TERM>HDB</TERM> deprecated database backends require <A HREF="http://www.oracle.com/">Oracle Corporation</A>'s Berkeley DB. If not available at configure time, you will not be able to build <EM>slapd</EM>(8) with these deprecated database backends.</P> +<P>Your operating system may provide a supported version of Berkeley DB in the base system or as an optional software component. If not, you'll have to obtain and install it yourself. Berkeley DB is available from <A HREF="http://www.oracle.com/">Oracle Corporation</A>'s Berkeley DB download page if required.</P> +<P>There are several versions available from <A HREF="http://www.oracle.com/">Oracle Corporation</A>. Berkeley DB version 6.0.20 and later uses a software license that is incompatible with LDAP technology and should not be used with OpenLDAP.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Please see <A HREF="#Recommended OpenLDAP Software Dependency Versions">Recommended OpenLDAP Software Dependency Versions</A> for more information. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="Threads">4.2.5. Threads</A></H3> +<P>OpenLDAP is designed to take advantage of threads. OpenLDAP supports POSIX <EM>pthreads</EM>, Mach <EM>CThreads</EM>, and a number of other varieties. <TT>configure</TT> will complain if it cannot find a suitable thread subsystem. If this occurs, please consult the <TT>Software|Installation|Platform Hints</TT> section of the OpenLDAP FAQ <A HREF="http://www.openldap.org/faq/">http://www.openldap.org/faq/</A>.</P> +<H3><A NAME="TCP Wrappers">4.2.6. TCP Wrappers</A></H3> +<P><EM>slapd</EM>(8) supports TCP Wrappers (IP level access control filters) if preinstalled. Use of TCP Wrappers or other IP-level access filters (such as those provided by an IP-level firewall) is recommended for servers containing non-public information.</P> +<H2><A NAME="Running configure">4.3. Running configure</A></H2> +<P>Now you should probably run the <TT>configure</TT> script with the <TT>--help</TT> option. This will give you a list of options that you can change when building OpenLDAP. Many of the features of OpenLDAP can be enabled or disabled using this method.</P> +<PRE> + ./configure --help +</PRE> +<P>The <TT>configure</TT> script also looks for certain variables on the command line and in the environment. These include:</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 4.1: Variables</CAPTION> +<TR CLASS="heading"> +<TD> +<STRONG>Variable</STRONG> +</TD> +<TD> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD> +<TT>CC</TT> +</TD> +<TD> +Specify alternative C Compiler +</TD> +</TR> +<TR> +<TD> +<TT>CFLAGS</TT> +</TD> +<TD> +Specify additional compiler flags +</TD> +</TR> +<TR> +<TD> +<TT>CPPFLAGS</TT> +</TD> +<TD> +Specify C Preprocessor flags +</TD> +</TR> +<TR> +<TD> +<TT>LDFLAGS</TT> +</TD> +<TD> +Specify linker flags +</TD> +</TR> +<TR> +<TD> +<TT>LIBS</TT> +</TD> +<TD> +Specify additional libraries +</TD> +</TR> +</TABLE> + +<P>Now run the configure script with any desired configuration options or variables.</P> +<PRE> + ./configure [options] [variable=value ...] +</PRE> +<P>As an example, let's assume that we want to install OpenLDAP with BDB backend and TCP Wrappers support. By default, BDB is enabled and TCP Wrappers is not. So, we just need to specify <TT>--enable-wrappers</TT> to include TCP Wrappers support:</P> +<PRE> + ./configure --enable-wrappers +</PRE> +<P>However, this will fail to locate dependent software not installed in system directories. For example, if TCP Wrappers headers and libraries are installed in <TT>/usr/local/include</TT> and <TT>/usr/local/lib</TT> respectively, the <TT>configure</TT> script should typically be called as follows:</P> +<PRE> + ./configure --enable-wrappers \ + CPPFLAGS="-I/usr/local/include" \ + LDFLAGS="-L/usr/local/lib -Wl,-rpath,/usr/local/lib" +</PRE> +<P>The <TT>configure</TT> script will normally auto-detect appropriate settings. If you have problems at this stage, consult any platform specific hints and check your <TT>configure</TT> options, if any.</P> +<H2><A NAME="Building the Software">4.4. Building the Software</A></H2> +<P>Once you have run the <TT>configure</TT> script the last line of output should be:</P> +<PRE> + Please "make depend" to build dependencies +</PRE> +<P>If the last line of output does not match, <TT>configure</TT> has failed, and you will need to review its output to determine what went wrong. You should not proceed until <TT>configure</TT> completes successfully.</P> +<P>To build dependencies, run:</P> +<PRE> + make depend +</PRE> +<P>Now build the software, this step will actually compile OpenLDAP.</P> +<PRE> + make +</PRE> +<P>You should examine the output of this command carefully to make sure everything is built correctly. Note that this command builds the LDAP libraries and associated clients as well as <EM>slapd</EM>(8).</P> +<H2><A NAME="Testing the Software">4.5. Testing the Software</A></H2> +<P>Once the software has been properly configured and successfully made, you should run the test suite to verify the build.</P> +<PRE> + make test +</PRE> +<P>Tests which apply to your configuration will run and they should pass. Some tests, such as the replication test, may be skipped if not supported by your configuration.</P> +<H2><A NAME="Installing the Software">4.6. Installing the Software</A></H2> +<P>Once you have successfully tested the software, you are ready to install it. You will need to have write permission to the installation directories you specified when you ran configure. By default OpenLDAP Software is installed in <TT>/usr/local</TT>. If you changed this setting with the <TT>--prefix</TT> configure option, it will be installed in the location you provided.</P> +<P>Typically, the installation requires <EM>super-user</EM> privileges. From the top level OpenLDAP source directory, type:</P> +<PRE> + su root -c 'make install' +</PRE> +<P>and enter the appropriate password when requested.</P> +<P>You should examine the output of this command carefully to make sure everything is installed correctly. You will find the configuration files for <EM>slapd</EM>(8) in <TT>/usr/local/etc/openldap</TT> by default. See the chapter <A HREF="#Configuring slapd">Configuring slapd</A> for additional information.</P> +<P></P> +<HR> +<H1><A NAME="Configuring slapd">5. Configuring slapd</A></H1> +<P>Once the software has been built and installed, you are ready to configure <EM>slapd</EM>(8) for use at your site.</P> +<P>OpenLDAP 2.3 and later have transitioned to using a dynamic runtime configuration engine, <EM>slapd-config</EM>(5). <EM>slapd-config</EM>(5)</P> +<UL> +<LI>is fully LDAP-enabled +<LI>is managed using the standard LDAP operations +<LI>stores its configuration data in an <TERM>LDIF</TERM> database, generally in the <TT>/usr/local/etc/openldap/slapd.d</TT> directory. +<LI>allows all of slapd's configuration options to be changed on the fly, generally without requiring a server restart for the changes to take effect.</UL> +<P>This chapter describes the general format of the <EM>slapd-config</EM>(5) configuration system, followed by a detailed description of commonly used settings.</P> +<P>The older style <EM>slapd.conf</EM>(5) file is still supported, but its use is deprecated and support for it will be withdrawn in a future OpenLDAP release. Configuring <EM>slapd</EM>(8) via <EM>slapd.conf</EM>(5) is described in the next chapter.</P> +<P>Refer to <EM>slapd</EM>(8) for information on how to have slapd automatically convert from <EM>slapd.conf</EM>(5) to <EM>slapd-config</EM>(5).</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Although the <EM>slapd-config</EM>(5) system stores its configuration as (text-based) LDIF files, you should <EM>never</EM> edit any of the LDIF files directly. Configuration changes should be performed via LDAP operations, e.g. <EM>ldapadd</EM>(1), <EM>ldapdelete</EM>(1), or <EM>ldapmodify</EM>(1). +<HR WIDTH="80%" ALIGN="Left"></P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>You will need to continue to use the older <EM>slapd.conf</EM>(5) configuration system if your OpenLDAP installation requires the use of one or more backends or overlays that have not been updated to use the <EM>slapd-config</EM>(5) system. As of OpenLDAP 2.4.33, all of the official backends have been updated. There may be additional contributed or experimental overlays that also have not been updated. +<HR WIDTH="80%" ALIGN="Left"></P> +<H2><A NAME="Configuration Layout">5.1. Configuration Layout</A></H2> +<P>The slapd configuration is stored as a special LDAP directory with a predefined schema and DIT. There are specific objectClasses used to carry global configuration options, schema definitions, backend and database definitions, and assorted other items. A sample config tree is shown in Figure 5.1.</P> +<P><CENTER><IMG SRC="config_dit.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure 5.1: Sample configuration tree.</P> +<P>Other objects may be part of the configuration but were omitted from the illustration for clarity.</P> +<P>The <EM>slapd-config</EM> configuration tree has a very specific structure. The root of the tree is named <TT>cn=config</TT> and contains global configuration settings. Additional settings are contained in separate child entries:</P> +<UL> +<LI>Dynamically loaded modules<UL> +These may only be used if the <TT>--enable-modules</TT> option was used to configure the software.</UL> +<LI>Schema definitions<UL> +The <TT>cn=schema,cn=config</TT> entry contains the system schema (all the schema that is hard-coded in slapd). +<BR> +Child entries of <TT>cn=schema,cn=config</TT> contain user schema as loaded from config files or added at runtime.</UL> +<LI>Backend-specific configuration +<LI>Database-specific configuration<UL> +Overlays are defined in children of the Database entry. +<BR> +Databases and Overlays may also have other miscellaneous children.</UL></UL> +<P>The usual rules for LDIF files apply to the configuration information: Comment lines beginning with a '<TT>#</TT>' character are ignored. If a line begins with a single space, it is considered a continuation of the previous line (even if the previous line is a comment) and the single leading space is removed. Entries are separated by blank lines.</P> +<P>The general layout of the config LDIF is as follows:</P> +<PRE> + # global configuration settings + dn: cn=config + objectClass: olcGlobal + cn: config + <global config settings> + + # schema definitions + dn: cn=schema,cn=config + objectClass: olcSchemaConfig + cn: schema + <system schema> + + dn: cn={X}core,cn=schema,cn=config + objectClass: olcSchemaConfig + cn: {X}core + <core schema> + + # additional user-specified schema + ... + + # backend definitions + dn: olcBackend=<typeA>,cn=config + objectClass: olcBackendConfig + olcBackend: <typeA> + <backend-specific settings> + + # database definitions + dn: olcDatabase={X}<typeA>,cn=config + objectClass: olcDatabaseConfig + olcDatabase: {X}<typeA> + <database-specific settings> + + # subsequent definitions and settings + ... +</PRE> +<P>Some of the entries listed above have a numeric index <TT>"{X}"</TT> in their names. While most configuration settings have an inherent ordering dependency (i.e., one setting must take effect before a subsequent one may be set), LDAP databases are inherently unordered. The numeric index is used to enforce a consistent ordering in the configuration database, so that all ordering dependencies are preserved. In most cases the index does not have to be provided; it will be automatically generated based on the order in which entries are created.</P> +<P>Configuration directives are specified as values of individual attributes. Most of the attributes and objectClasses used in the slapd configuration have a prefix of <TT>"olc"</TT> (OpenLDAP Configuration) in their names. Generally there is a one-to-one correspondence between the attributes and the old-style <TT>slapd.conf</TT> configuration keywords, using the keyword as the attribute name, with the "olc" prefix attached.</P> +<P>A configuration directive may take arguments. If so, the arguments are separated by whitespace. If an argument contains whitespace, the argument should be enclosed in double quotes <TT>"like this"</TT>. In the descriptions that follow, arguments that should be replaced by actual text are shown in brackets <TT><></TT>.</P> +<P>The distribution contains an example configuration file that will be installed in the <TT>/usr/local/etc/openldap</TT> directory. A number of files containing schema definitions (attribute types and object classes) are also provided in the <TT>/usr/local/etc/openldap/schema</TT> directory.</P> +<H2><A NAME="Configuration Directives">5.2. Configuration Directives</A></H2> +<P>This section details commonly used configuration directives. For a complete list, see the <EM>slapd-config</EM>(5) manual page. This section will treat the configuration directives in a top-down order, starting with the global directives in the <TT>cn=config</TT> entry. Each directive will be described along with its default value (if any) and an example of its use.</P> +<H3><A NAME="cn=config">5.2.1. cn=config</A></H3> +<P>Directives contained in this entry generally apply to the server as a whole. Most of them are system or connection oriented, not database related. This entry must have the <TT>olcGlobal</TT> objectClass.</P> +<H4><A NAME="olcIdleTimeout: <integer>">5.2.1.1. olcIdleTimeout: <integer></A></H4> +<P>Specify the number of seconds to wait before forcibly closing an idle client connection. A value of 0, the default, disables this feature.</P> +<H4><A NAME="olcLogLevel: <level>">5.2.1.2. olcLogLevel: <level></A></H4> +<P>This directive specifies the level at which debugging statements and operation statistics should be syslogged (currently logged to the <EM>syslogd</EM>(8) <TT>LOG_LOCAL4</TT> facility). You must have configured OpenLDAP <TT>--enable-debug</TT> (the default) for this to work (except for the two statistics levels, which are always enabled). Log levels may be specified as integers or by keyword. Multiple log levels may be used and the levels are additive. To display what levels correspond to what kind of debugging, invoke slapd with <TT>-d?</TT> or consult the table below. The possible values for <level> are:</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 5.1: Debugging Levels</CAPTION> +<TR CLASS="heading"> +<TD ALIGN='Right'> +<STRONG>Level</STRONG> +</TD> +<TD ALIGN='Left'> +<STRONG>Keyword</STRONG> +</TD> +<TD> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +-1 +</TD> +<TD ALIGN='Left'> +any +</TD> +<TD> +enable all debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +0 +</TD> +<TD ALIGN='Left'> + +</TD> +<TD> +no debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +1 +</TD> +<TD ALIGN='Left'> +(0x1 trace) +</TD> +<TD> +trace function calls +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +2 +</TD> +<TD ALIGN='Left'> +(0x2 packets) +</TD> +<TD> +debug packet handling +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +4 +</TD> +<TD ALIGN='Left'> +(0x4 args) +</TD> +<TD> +heavy trace debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +8 +</TD> +<TD ALIGN='Left'> +(0x8 conns) +</TD> +<TD> +connection management +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +16 +</TD> +<TD ALIGN='Left'> +(0x10 BER) +</TD> +<TD> +print out packets sent and received +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +32 +</TD> +<TD ALIGN='Left'> +(0x20 filter) +</TD> +<TD> +search filter processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +64 +</TD> +<TD ALIGN='Left'> +(0x40 config) +</TD> +<TD> +configuration processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +128 +</TD> +<TD ALIGN='Left'> +(0x80 ACL) +</TD> +<TD> +access control list processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +256 +</TD> +<TD ALIGN='Left'> +(0x100 stats) +</TD> +<TD> +stats log connections/operations/results +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +512 +</TD> +<TD ALIGN='Left'> +(0x200 stats2) +</TD> +<TD> +stats log entries sent +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +1024 +</TD> +<TD ALIGN='Left'> +(0x400 shell) +</TD> +<TD> +print communication with shell backends +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +2048 +</TD> +<TD ALIGN='Left'> +(0x800 parse) +</TD> +<TD> +print entry parsing debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +16384 +</TD> +<TD ALIGN='Left'> +(0x4000 sync) +</TD> +<TD> +syncrepl consumer processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +32768 +</TD> +<TD ALIGN='Left'> +(0x8000 none) +</TD> +<TD> +only messages that get logged whatever log level is set +</TD> +</TR> +</TABLE> + +<P>The desired log level can be input as a single integer that combines the (ORed) desired levels, both in decimal or in hexadecimal notation, as a list of integers (that are ORed internally), or as a list of the names that are shown between brackets, such that</P> +<PRE> + olcLogLevel 129 + olcLogLevel 0x81 + olcLogLevel 128 1 + olcLogLevel 0x80 0x1 + olcLogLevel acl trace +</PRE> +<P>are equivalent.</P> +<P>Examples:</P> +<PRE> + olcLogLevel -1 +</PRE> +<P>This will cause lots and lots of debugging information to be logged.</P> +<PRE> + olcLogLevel conns filter +</PRE> +<P>Just log the connection and search filter processing.</P> +<PRE> + olcLogLevel none +</PRE> +<P>Log those messages that are logged regardless of the configured loglevel. This differs from setting the log level to 0, when no logging occurs. At least the <TT>None</TT> level is required to have high priority messages logged.</P> +<P>Default:</P> +<PRE> + olcLogLevel stats +</PRE> +<P>Basic stats logging is configured by default. However, if no olcLogLevel is defined, no logging occurs (equivalent to a 0 level).</P> +<H4><A NAME="olcReferral <URI>">5.2.1.3. olcReferral <URI></A></H4> +<P>This directive specifies the referral to pass back when slapd cannot find a local database to handle a request.</P> +<P>Example:</P> +<PRE> + olcReferral: ldap://root.openldap.org +</PRE> +<P>This will refer non-local queries to the global root LDAP server at the OpenLDAP Project. Smart LDAP clients can re-ask their query at that server, but note that most of these clients are only going to know how to handle simple LDAP URLs that contain a host part and optionally a distinguished name part.</P> +<H4><A NAME="Sample Entry">5.2.1.4. Sample Entry</A></H4> +<PRE> +dn: cn=config +objectClass: olcGlobal +cn: config +olcIdleTimeout: 30 +olcLogLevel: Stats +olcReferral: ldap://root.openldap.org +</PRE> +<H3><A NAME="cn=module">5.2.2. cn=module</A></H3> +<P>If support for dynamically loaded modules was enabled when configuring slapd, <TT>cn=module</TT> entries may be used to specify sets of modules to load. Module entries must have the <TT>olcModuleList</TT> objectClass.</P> +<H4><A NAME="olcModuleLoad: <filename>">5.2.2.1. olcModuleLoad: <filename></A></H4> +<P>Specify the name of a dynamically loadable module to load. The filename may be an absolute path name or a simple filename. Non-absolute names are searched for in the directories specified by the <TT>olcModulePath</TT> directive.</P> +<H4><A NAME="olcModulePath: <pathspec>">5.2.2.2. olcModulePath: <pathspec></A></H4> +<P>Specify a list of directories to search for loadable modules. Typically the path is colon-separated but this depends on the operating system.</P> +<H4><A NAME="Sample Entries">5.2.2.3. Sample Entries</A></H4> +<PRE> +dn: cn=module{0},cn=config +objectClass: olcModuleList +cn: module{0} +olcModuleLoad: /usr/local/lib/smbk5pwd.la + +dn: cn=module{1},cn=config +objectClass: olcModuleList +cn: module{1} +olcModulePath: /usr/local/lib:/usr/local/lib/slapd +olcModuleLoad: accesslog.la +olcModuleLoad: pcache.la +</PRE> +<H3><A NAME="cn=schema">5.2.3. cn=schema</A></H3> +<P>The cn=schema entry holds all of the schema definitions that are hard-coded in slapd. As such, the values in this entry are generated by slapd so no schema values need to be provided in the config file. The entry must still be defined though, to serve as a base for the user-defined schema to add in underneath. Schema entries must have the <TT>olcSchemaConfig</TT> objectClass.</P> +<H4><A NAME="olcAttributeTypes: <{{REF:RFC4512}} Attribute Type Description>"> </A>5.2.3.1. olcAttributeTypes: <<A HREF="http://www.rfc-editor.org/rfc/rfc4512.txt">RFC4512</A> Attribute Type Description></H4> +<P>This directive defines an attribute type. Please see the <A HREF="#Schema Specification">Schema Specification</A> chapter for information regarding how to use this directive.</P> +<H4><A NAME="olcObjectClasses: <{{REF:RFC4512}} Object Class Description>"> </A>5.2.3.2. olcObjectClasses: <<A HREF="http://www.rfc-editor.org/rfc/rfc4512.txt">RFC4512</A> Object Class Description></H4> +<P>This directive defines an object class. Please see the <A HREF="#Schema Specification">Schema Specification</A> chapter for information regarding how to use this directive.</P> +<H4><A NAME="Sample Entries">5.2.3.3. Sample Entries</A></H4> +<PRE> +dn: cn=schema,cn=config +objectClass: olcSchemaConfig +cn: schema + +dn: cn=test,cn=schema,cn=config +objectClass: olcSchemaConfig +cn: test +olcAttributeTypes: ( 1.1.1 + NAME 'testAttr' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) +olcAttributeTypes: ( 1.1.2 NAME 'testTwo' EQUALITY caseIgnoreMatch + SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 ) +olcObjectClasses: ( 1.1.3 NAME 'testObject' + MAY ( testAttr $ testTwo ) AUXILIARY ) +</PRE> +<H3><A NAME="Backend-specific Directives">5.2.4. Backend-specific Directives</A></H3> +<P>Backend directives apply to all database instances of the same type and, depending on the directive, may be overridden by database directives. Backend entries must have the <TT>olcBackendConfig</TT> objectClass.</P> +<H4><A NAME="olcBackend: <type>">5.2.4.1. olcBackend: <type></A></H4> +<P>This directive names a backend-specific configuration entry. <TT><type></TT> should be one of the supported backend types listed in Table 5.2.</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 5.2: Database Backends</CAPTION> +<TR CLASS="heading"> +<TD> +<STRONG>Types</STRONG> +</TD> +<TD> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD> +<TT>bdb</TT> +</TD> +<TD> +Berkeley DB transactional backend (deprecated) +</TD> +</TR> +<TR> +<TD> +<TT>config</TT> +</TD> +<TD> +Slapd configuration backend +</TD> +</TR> +<TR> +<TD> +<TT>dnssrv</TT> +</TD> +<TD> +DNS SRV backend +</TD> +</TR> +<TR> +<TD> +<TT>hdb</TT> +</TD> +<TD> +Hierarchical variant of bdb backend (deprecated) +</TD> +</TR> +<TR> +<TD> +<TT>ldap</TT> +</TD> +<TD> +Lightweight Directory Access Protocol (Proxy) backend +</TD> +</TR> +<TR> +<TD> +<TT>ldif</TT> +</TD> +<TD> +Lightweight Data Interchange Format backend +</TD> +</TR> +<TR> +<TD> +<TT>mdb</TT> +</TD> +<TD> +Memory-Mapped DB backend +</TD> +</TR> +<TR> +<TD> +<TT>meta</TT> +</TD> +<TD> +Meta Directory backend +</TD> +</TR> +<TR> +<TD> +<TT>monitor</TT> +</TD> +<TD> +Monitor backend +</TD> +</TR> +<TR> +<TD> +<TT>passwd</TT> +</TD> +<TD> +Provides read-only access to <EM>passwd</EM>(5) +</TD> +</TR> +<TR> +<TD> +<TT>perl</TT> +</TD> +<TD> +Perl Programmable backend +</TD> +</TR> +<TR> +<TD> +<TT>shell</TT> +</TD> +<TD> +Shell (extern program) backend +</TD> +</TR> +<TR> +<TD> +<TT>sql</TT> +</TD> +<TD> +SQL Programmable backend +</TD> +</TR> +</TABLE> + +<P>Example:</P> +<PRE> + olcBackend: bdb +</PRE> +<P>There are no other directives defined for this entry. Specific backend types may define additional attributes for their particular use but so far none have ever been defined. As such, these directives usually do not appear in any actual configurations.</P> +<H4><A NAME="Sample Entry">5.2.4.2. Sample Entry</A></H4> +<PRE> + dn: olcBackend=bdb,cn=config + objectClass: olcBackendConfig + olcBackend: bdb +</PRE> +<H3><A NAME="Database-specific Directives">5.2.5. Database-specific Directives</A></H3> +<P>Directives in this section are supported by every type of database. Database entries must have the <TT>olcDatabaseConfig</TT> objectClass.</P> +<H4><A NAME="olcDatabase: [{<index>}]<type>">5.2.5.1. olcDatabase: [{<index>}]<type></A></H4> +<P>This directive names a specific database instance. The numeric {<index>} may be provided to distinguish multiple databases of the same type. Usually the index can be omitted, and slapd will generate it automatically. <TT><type></TT> should be one of the supported backend types listed in Table 5.2 or the <TT>frontend</TT> type.</P> +<P>The <TT>frontend</TT> is a special database that is used to hold database-level options that should be applied to all the other databases. Subsequent database definitions may also override some frontend settings.</P> +<P>The <TT>config</TT> database is also special; both the <TT>config</TT> and the <TT>frontend</TT> databases are always created implicitly even if they are not explicitly configured, and they are created before any other databases.</P> +<P>Example:</P> +<PRE> + olcDatabase: bdb +</PRE> +<P>This marks the beginning of a new <TERM>BDB</TERM> database instance.</P> +<H4><A NAME="olcAccess: to <what> [ by <who> [<accesslevel>] [<control>] ]+">5.2.5.2. olcAccess: to <what> [ by <who> [<accesslevel>] [<control>] ]+</A></H4> +<P>This directive grants access (specified by <accesslevel>) to a set of entries and/or attributes (specified by <what>) by one or more requestors (specified by <who>). See the <A HREF="#Access Control">Access Control</A> section of this guide for basic usage.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>If no <TT>olcAccess</TT> directives are specified, the default access control policy, <TT>to * by * read</TT>, allows all users (both authenticated and anonymous) read access. +<HR WIDTH="80%" ALIGN="Left"></P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Access controls defined in the frontend are appended to all other databases' controls. +<HR WIDTH="80%" ALIGN="Left"></P> +<H4><A NAME="olcReadonly { TRUE | FALSE }">5.2.5.3. olcReadonly { TRUE | FALSE }</A></H4> +<P>This directive puts the database into "read-only" mode. Any attempts to modify the database will return an "unwilling to perform" error. If set on a consumer, modifications sent by syncrepl will still occur.</P> +<P>Default:</P> +<PRE> + olcReadonly: FALSE +</PRE> +<H4><A NAME="olcRootDN: <DN>">5.2.5.4. olcRootDN: <DN></A></H4> +<P>This directive specifies the DN that is not subject to access control or administrative limit restrictions for operations on this database. The DN need not refer to an entry in this database or even in the directory. The DN may refer to a SASL identity.</P> +<P>Entry-based Example:</P> +<PRE> + olcRootDN: "cn=Manager,dc=example,dc=com" +</PRE> +<P>SASL-based Example:</P> +<PRE> + olcRootDN: "uid=root,cn=example.com,cn=digest-md5,cn=auth" +</PRE> +<P>See the <A HREF="#SASL Authentication">SASL Authentication</A> section for information on SASL authentication identities.</P> +<H4><A NAME="olcRootPW: <password>">5.2.5.5. olcRootPW: <password></A></H4> +<P>This directive can be used to specify a password for the DN for the rootdn (when the rootdn is set to a DN within the database).</P> +<P>Example:</P> +<PRE> + olcRootPW: secret +</PRE> +<P>It is also permissible to provide a hash of the password in <A HREF="http://www.rfc-editor.org/rfc/rfc2307.txt">RFC2307</A> form. <EM>slappasswd</EM>(8) may be used to generate the password hash.</P> +<P>Example:</P> +<PRE> + olcRootPW: {SSHA}ZKKuqbEKJfKSXhUbHG3fG8MDn9j1v4QN +</PRE> +<P>The hash was generated using the command <TT>slappasswd -s secret</TT>.</P> +<H4><A NAME="olcSizeLimit: <integer>">5.2.5.6. olcSizeLimit: <integer></A></H4> +<P>This directive specifies the maximum number of entries to return from a search operation.</P> +<P>Default:</P> +<PRE> + olcSizeLimit: 500 +</PRE> +<P>See the <A HREF="#Limits">Limits</A> section of this guide and slapd-config(5) for more details.</P> +<H4><A NAME="olcSuffix: <dn suffix>">5.2.5.7. olcSuffix: <dn suffix></A></H4> +<P>This directive specifies the DN suffix of queries that will be passed to this backend database. Multiple suffix lines can be given, and usually at least one is required for each database definition. (Some backend types, such as <TT>frontend</TT> and <TT>monitor</TT> use a hard-coded suffix which may not be overridden in the configuration.)</P> +<P>Example:</P> +<PRE> + olcSuffix: "dc=example,dc=com" +</PRE> +<P>Queries with a DN ending in "dc=example,dc=com" will be passed to this backend.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>When the backend to pass a query to is selected, slapd looks at the suffix value(s) in each database definition in the order in which they were configured. Thus, if one database suffix is a prefix of another, it must appear after it in the configuration. +<HR WIDTH="80%" ALIGN="Left"></P> +<H4><A NAME="olcSyncrepl">5.2.5.8. olcSyncrepl</A></H4> +<PRE> + olcSyncrepl: rid=<replica ID> + provider=ldap[s]://<hostname>[:port] + [type=refreshOnly|refreshAndPersist] + [interval=dd:hh:mm:ss] + [retry=[<retry interval> <# of retries>]+] + searchbase=<base DN> + [filter=<filter str>] + [scope=sub|one|base] + [attrs=<attr list>] + [attrsonly] + [sizelimit=<limit>] + [timelimit=<limit>] + [schemachecking=on|off] + [bindmethod=simple|sasl] + [binddn=<DN>] + [saslmech=<mech>] + [authcid=<identity>] + [authzid=<identity>] + [credentials=<passwd>] + [realm=<realm>] + [secprops=<properties>] + [starttls=yes|critical] + [tls_cert=<file>] + [tls_key=<file>] + [tls_cacert=<file>] + [tls_cacertdir=<path>] + [tls_reqcert=never|allow|try|demand] + [tls_cipher_suite=<ciphers>] + [tls_crlcheck=none|peer|all] + [logbase=<base DN>] + [logfilter=<filter str>] + [syncdata=default|accesslog|changelog] +</PRE> +<P>This directive specifies the current database as a replica of the master content by establishing the current <EM>slapd</EM>(8) as a replication consumer site running a syncrepl replication engine. The master database is located at the replication provider site specified by the <TT>provider</TT> parameter. The replica database is kept up-to-date with the master content using the LDAP Content Synchronization protocol. See <A HREF="http://www.rfc-editor.org/rfc/rfc4533.txt">RFC4533</A> for more information on the protocol.</P> +<P>The <TT>rid</TT> parameter is used for identification of the current <TT>syncrepl</TT> directive within the replication consumer server, where <TT><replica ID></TT> uniquely identifies the syncrepl specification described by the current <TT>syncrepl</TT> directive. <TT><replica ID></TT> is non-negative and is no more than three decimal digits in length.</P> +<P>The <TT>provider</TT> parameter specifies the replication provider site containing the master content as an LDAP URI. The <TT>provider</TT> parameter specifies a scheme, a host and optionally a port where the provider slapd instance can be found. Either a domain name or IP address may be used for <hostname>. Examples are <TT>ldap://provider.example.com:389</TT> or <TT>ldaps://192.168.1.1:636</TT>. If <port> is not given, the standard LDAP port number (389 or 636) is used. Note that the syncrepl uses a consumer-initiated protocol, and hence its specification is located at the consumer site, whereas the <TT>replica</TT> specification is located at the provider site. <TT>syncrepl</TT> and <TT>replica</TT> directives define two independent replication mechanisms. They do not represent the replication peers of each other.</P> +<P>The content of the syncrepl replica is defined using a search specification as its result set. The consumer slapd will send search requests to the provider slapd according to the search specification. The search specification includes <TT>searchbase</TT>, <TT>scope</TT>, <TT>filter</TT>, <TT>attrs</TT>, <TT>attrsonly</TT>, <TT>sizelimit</TT>, and <TT>timelimit</TT> parameters as in the normal search specification. The <TT>searchbase</TT> parameter has no default value and must always be specified. The <TT>scope</TT> defaults to <TT>sub</TT>, the <TT>filter</TT> defaults to <TT>(objectclass=*)</TT>, <TT>attrs</TT> defaults to <TT>"*,+"</TT> to replicate all user and operational attributes, and <TT>attrsonly</TT> is unset by default. Both <TT>sizelimit</TT> and <TT>timelimit</TT> default to "unlimited", and only positive integers or "unlimited" may be specified.</P> +<P>The <TERM>LDAP Content Synchronization</TERM> protocol has two operation types: <TT>refreshOnly</TT> and <TT>refreshAndPersist</TT>. The operation type is specified by the <TT>type</TT> parameter. In the <TT>refreshOnly</TT> operation, the next synchronization search operation is periodically rescheduled at an interval time after each synchronization operation finishes. The interval is specified by the <TT>interval</TT> parameter. It is set to one day by default. In the <TT>refreshAndPersist</TT> operation, a synchronization search remains persistent in the provider <EM>slapd</EM> instance. Further updates to the master replica will generate <TT>searchResultEntry</TT> to the consumer slapd as the search responses to the persistent synchronization search.</P> +<P>If an error occurs during replication, the consumer will attempt to reconnect according to the retry parameter which is a list of the <retry interval> and <# of retries> pairs. For example, retry="60 10 300 3" lets the consumer retry every 60 seconds for the first 10 times and then retry every 300 seconds for the next three times before stop retrying. + in <# of retries> means indefinite number of retries until success.</P> +<P>The schema checking can be enforced at the LDAP Sync consumer site by turning on the <TT>schemachecking</TT> parameter. If it is turned on, every replicated entry will be checked for its schema as the entry is stored into the replica content. Every entry in the replica should contain those attributes required by the schema definition. If it is turned off, entries will be stored without checking schema conformance. The default is off.</P> +<P>The <TT>binddn</TT> parameter gives the DN to bind as for the syncrepl searches to the provider slapd. It should be a DN which has read access to the replication content in the master database.</P> +<P>The <TT>bindmethod</TT> is <TT>simple</TT> or <TT>sasl</TT>, depending on whether simple password-based authentication or <TERM>SASL</TERM> authentication is to be used when connecting to the provider <EM>slapd</EM> instance.</P> +<P>Simple authentication should not be used unless adequate data integrity and confidentiality protections are in place (e.g. TLS or IPsec). Simple authentication requires specification of <TT>binddn</TT> and <TT>credentials</TT> parameters.</P> +<P>SASL authentication is generally recommended. SASL authentication requires specification of a mechanism using the <TT>saslmech</TT> parameter. Depending on the mechanism, an authentication identity and/or credentials can be specified using <TT>authcid</TT> and <TT>credentials</TT>, respectively. The <TT>authzid</TT> parameter may be used to specify an authorization identity.</P> +<P>The <TT>realm</TT> parameter specifies a realm which a certain mechanisms authenticate the identity within. The <TT>secprops</TT> parameter specifies Cyrus SASL security properties.</P> +<P>The <TT>starttls</TT> parameter specifies use of the StartTLS extended operation to establish a TLS session before authenticating to the provider. If the <TT>critical</TT> argument is supplied, the session will be aborted if the StartTLS request fails. Otherwise the syncrepl session continues without TLS. The tls_reqcert setting defaults to <TT>"demand"</TT> and the other TLS settings default to the same as the main slapd TLS settings.</P> +<P>Rather than replicating whole entries, the consumer can query logs of data modifications. This mode of operation is referred to as <EM>delta syncrepl</EM>. In addition to the above parameters, the <TT>logbase</TT> and <TT>logfilter</TT> parameters must be set appropriately for the log that will be used. The <TT>syncdata</TT> parameter must be set to either <TT>"accesslog"</TT> if the log conforms to the <EM>slapo-accesslog</EM>(5) log format, or <TT>"changelog"</TT> if the log conforms to the obsolete <EM>changelog</EM> format. If the <TT>syncdata</TT> parameter is omitted or set to <TT>"default"</TT> then the log parameters are ignored.</P> +<P>The <EM>syncrepl</EM> replication mechanism is supported by the <EM>bdb</EM>, <EM>hdb</EM>, and <EM>mdb</EM> backends.</P> +<P>See the <A HREF="#LDAP Sync Replication">LDAP Sync Replication</A> chapter of this guide for more information on how to use this directive.</P> +<H4><A NAME="olcTimeLimit: <integer>">5.2.5.9. olcTimeLimit: <integer></A></H4> +<P>This directive specifies the maximum number of seconds (in real time) slapd will spend answering a search request. If a request is not finished in this time, a result indicating an exceeded timelimit will be returned.</P> +<P>Default:</P> +<PRE> + olcTimeLimit: 3600 +</PRE> +<P>See the <A HREF="#Limits">Limits</A> section of this guide and slapd-config(5) for more details.</P> +<H4><A NAME="olcUpdateref: <URL>">5.2.5.10. olcUpdateref: <URL></A></H4> +<P>This directive is only applicable in a slave slapd. It specifies the URL to return to clients which submit update requests upon the replica. If specified multiple times, each <TERM>URL</TERM> is provided.</P> +<P>Example:</P> +<PRE> + olcUpdateref: ldap://master.example.net +</PRE> +<H4><A NAME="Sample Entries">5.2.5.11. Sample Entries</A></H4> +<PRE> +dn: olcDatabase=frontend,cn=config +objectClass: olcDatabaseConfig +objectClass: olcFrontendConfig +olcDatabase: frontend +olcReadOnly: FALSE + +dn: olcDatabase=config,cn=config +objectClass: olcDatabaseConfig +olcDatabase: config +olcRootDN: cn=Manager,dc=example,dc=com +</PRE> +<H3><A NAME="BDB and HDB Database Directives">5.2.6. BDB and HDB Database Directives</A></H3> +<P>Directives in this category apply to both the <TERM>BDB</TERM> and the <TERM>HDB</TERM> database. They are used in an olcDatabase entry in addition to the generic database directives defined above. For a complete reference of BDB/HDB configuration directives, see <EM>slapd-bdb</EM>(5). In addition to the <TT>olcDatabaseConfig</TT> objectClass, BDB and HDB database entries must have the <TT>olcBdbConfig</TT> and <TT>olcHdbConfig</TT> objectClass, respectively.</P> +<H4><A NAME="olcDbDirectory: <directory>">5.2.6.1. olcDbDirectory: <directory></A></H4> +<P>This directive specifies the directory where the BDB files containing the database and associated indices live.</P> +<P>Default:</P> +<PRE> + olcDbDirectory: /usr/local/var/openldap-data +</PRE> +<H4><A NAME="olcDbCachesize: <integer>">5.2.6.2. olcDbCachesize: <integer></A></H4> +<P>This directive specifies the size in entries of the in-memory cache maintained by the BDB backend database instance.</P> +<P>Default:</P> +<PRE> + olcDbCachesize: 1000 +</PRE> +<H4><A NAME="olcDbCheckpoint: <kbyte> <min>">5.2.6.3. olcDbCheckpoint: <kbyte> <min></A></H4> +<P>This directive specifies how often to checkpoint the BDB transaction log. A checkpoint operation flushes the database buffers to disk and writes a checkpoint record in the log. The checkpoint will occur if either <kbyte> data has been written or <min> minutes have passed since the last checkpoint. Both arguments default to zero, in which case they are ignored. When the <min> argument is non-zero, an internal task will run every <min> minutes to perform the checkpoint. See the Berkeley DB reference guide for more details.</P> +<P>Example:</P> +<PRE> + olcDbCheckpoint: 1024 10 +</PRE> +<H4><A NAME="olcDbConfig: <DB_CONFIG setting>">5.2.6.4. olcDbConfig: <DB_CONFIG setting></A></H4> +<P>This attribute specifies a configuration directive to be placed in the <TT>DB_CONFIG</TT> file of the database directory. At server startup time, if no such file exists yet, the <TT>DB_CONFIG</TT> file will be created and the settings in this attribute will be written to it. If the file exists, its contents will be read and displayed in this attribute. The attribute is multi-valued, to accommodate multiple configuration directives. No default is provided, but it is essential to use proper settings here to get the best server performance.</P> +<P>Any changes made to this attribute will be written to the <TT>DB_CONFIG</TT> file and will cause the database environment to be reset so the changes can take immediate effect. If the environment cache is large and has not been recently checkpointed, this reset operation may take a long time. It may be advisable to manually perform a single checkpoint using the Berkeley DB <EM>db_checkpoint</EM> utility before using LDAP Modify to change this attribute.</P> +<P>Example:</P> +<PRE> + olcDbConfig: set_cachesize 0 10485760 0 + olcDbConfig: set_lg_bsize 2097512 + olcDbConfig: set_lg_dir /var/tmp/bdb-log + olcDbConfig: set_flags DB_LOG_AUTOREMOVE +</PRE> +<P>In this example, the BDB cache is set to 10MB, the BDB transaction log buffer size is set to 2MB, and the transaction log files are to be stored in the /var/tmp/bdb-log directory. Also a flag is set to tell BDB to delete transaction log files as soon as their contents have been checkpointed and they are no longer needed. Without this setting the transaction log files will continue to accumulate until some other cleanup procedure removes them. See the Berkeley DB documentation for the <TT>db_archive</TT> command for details. For a complete list of Berkeley DB flags please see - <A HREF="http://www.oracle.com/technology/documentation/berkeley-db/db/api_c/env_set_flags.html">http://www.oracle.com/technology/documentation/berkeley-db/db/api_c/env_set_flags.html</A></P> +<P>Ideally the BDB cache must be at least as large as the working set of the database, the log buffer size should be large enough to accommodate most transactions without overflowing, and the log directory must be on a separate physical disk from the main database files. And both the database directory and the log directory should be separate from disks used for regular system activities such as the root, boot, or swap filesystems. See the FAQ-o-Matic and the Berkeley DB documentation for more details.</P> +<H4><A NAME="olcDbNosync: { TRUE | FALSE }">5.2.6.5. olcDbNosync: { TRUE | FALSE }</A></H4> +<P>This option causes on-disk database contents to not be immediately synchronized with in memory changes upon change. Setting this option to <TT>TRUE</TT> may improve performance at the expense of data integrity. This directive has the same effect as using</P> +<PRE> + olcDbConfig: set_flags DB_TXN_NOSYNC +</PRE> +<H4><A NAME="olcDbIDLcacheSize: <integer>">5.2.6.6. olcDbIDLcacheSize: <integer></A></H4> +<P>Specify the size of the in-memory index cache, in index slots. The default is zero. A larger value will speed up frequent searches of indexed entries. The optimal size will depend on the data and search characteristics of the database, but using a number three times the entry cache size is a good starting point.</P> +<P>Example:</P> +<PRE> + olcDbIDLcacheSize: 3000 +</PRE> +<H4><A NAME="olcDbIndex: {<attrlist> | default} [pres,eq,approx,sub,none]">5.2.6.7. olcDbIndex: {<attrlist> | default} [pres,eq,approx,sub,none]</A></H4> +<P>This directive specifies the indices to maintain for the given attribute. If only an <TT><attrlist></TT> is given, the default indices are maintained. The index keywords correspond to the common types of matches that may be used in an LDAP search filter.</P> +<P>Example:</P> +<PRE> + olcDbIndex: default pres,eq + olcDbIndex: uid + olcDbIndex: cn,sn pres,eq,sub + olcDbIndex: objectClass eq +</PRE> +<P>The first line sets the default set of indices to maintain to present and equality. The second line causes the default (pres,eq) set of indices to be maintained for the <TT>uid</TT> attribute type. The third line causes present, equality, and substring indices to be maintained for <TT>cn</TT> and <TT>sn</TT> attribute types. The fourth line causes an equality index for the <TT>objectClass</TT> attribute type.</P> +<P>There is no index keyword for inequality matches. Generally these matches do not use an index. However, some attributes do support indexing for inequality matches, based on the equality index.</P> +<P>A substring index can be more explicitly specified as <TT>subinitial</TT>, <TT>subany</TT>, or <TT>subfinal</TT>, corresponding to the three possible components of a substring match filter. A subinitial index only indexes substrings that appear at the beginning of an attribute value. A subfinal index only indexes substrings that appear at the end of an attribute value, while subany indexes substrings that occur anywhere in a value.</P> +<P>Note that by default, setting an index for an attribute also affects every subtype of that attribute. E.g., setting an equality index on the <TT>name</TT> attribute causes <TT>cn</TT>, <TT>sn</TT>, and every other attribute that inherits from <TT>name</TT> to be indexed.</P> +<P>By default, no indices are maintained. It is generally advised that minimally an equality index upon objectClass be maintained.</P> +<PRE> + olcDbindex: objectClass eq +</PRE> +<P>Additional indices should be configured corresponding to the most common searches that are used on the database. Presence indexing should not be configured for an attribute unless the attribute occurs very rarely in the database, and presence searches on the attribute occur very frequently during normal use of the directory. Most applications don't use presence searches, so usually presence indexing is not very useful.</P> +<P>If this setting is changed while slapd is running, an internal task will be run to generate the changed index data. All server operations can continue as normal while the indexer does its work. If slapd is stopped before the index task completes, indexing will have to be manually completed using the slapindex tool.</P> +<H4><A NAME="olcDbLinearIndex: { TRUE | FALSE }">5.2.6.8. olcDbLinearIndex: { TRUE | FALSE }</A></H4> +<P>If this setting is <TT>TRUE</TT> slapindex will index one attribute at a time. The default settings is <TT>FALSE</TT> in which case all indexed attributes of an entry are processed at the same time. When enabled, each indexed attribute is processed individually, using multiple passes through the entire database. This option improves slapindex performance when the database size exceeds the BDB cache size. When the BDB cache is large enough, this option is not needed and will decrease performance. Also by default, slapadd performs full indexing and so a separate slapindex run is not needed. With this option, slapadd does no indexing and slapindex must be used.</P> +<H4><A NAME="olcDbMode: { <octal> | <symbolic> }">5.2.6.9. olcDbMode: { <octal> | <symbolic> }</A></H4> +<P>This directive specifies the file protection mode that newly created database index files should have. This can be in the form <TT>0600</TT> or <TT>-rw-------</TT></P> +<P>Default:</P> +<PRE> + olcDbMode: 0600 +</PRE> +<H4><A NAME="olcDbSearchStack: <integer>">5.2.6.10. olcDbSearchStack: <integer></A></H4> +<P>Specify the depth of the stack used for search filter evaluation. Search filters are evaluated on a stack to accommodate nested <TT>AND</TT> / <TT>OR</TT> clauses. An individual stack is allocated for each server thread. The depth of the stack determines how complex a filter can be evaluated without requiring any additional memory allocation. Filters that are nested deeper than the search stack depth will cause a separate stack to be allocated for that particular search operation. These separate allocations can have a major negative impact on server performance, but specifying too much stack will also consume a great deal of memory. Each search uses 512K bytes per level on a 32-bit machine, or 1024K bytes per level on a 64-bit machine. The default stack depth is 16, thus 8MB or 16MB per thread is used on 32 and 64 bit machines, respectively. Also the 512KB size of a single stack slot is set by a compile-time constant which may be changed if needed; the code must be recompiled for the change to take effect.</P> +<P>Default:</P> +<PRE> + olcDbSearchStack: 16 +</PRE> +<H4><A NAME="olcDbShmKey: <integer>">5.2.6.11. olcDbShmKey: <integer></A></H4> +<P>Specify a key for a shared memory BDB environment. By default the BDB environment uses memory mapped files. If a non-zero value is specified, it will be used as the key to identify a shared memory region that will house the environment.</P> +<P>Example:</P> +<PRE> + olcDbShmKey: 42 +</PRE> +<H4><A NAME="Sample Entry">5.2.6.12. Sample Entry</A></H4> +<PRE> +dn: olcDatabase=hdb,cn=config +objectClass: olcDatabaseConfig +objectClass: olcHdbConfig +olcDatabase: hdb +olcSuffix: "dc=example,dc=com" +olcDbDirectory: /usr/local/var/openldap-data +olcDbCacheSize: 1000 +olcDbCheckpoint: 1024 10 +olcDbConfig: set_cachesize 0 10485760 0 +olcDbConfig: set_lg_bsize 2097152 +olcDbConfig: set_lg_dir /var/tmp/bdb-log +olcDbConfig: set_flags DB_LOG_AUTOREMOVE +olcDbIDLcacheSize: 3000 +olcDbIndex: objectClass eq +</PRE> +<H2><A NAME="Configuration Example">5.3. Configuration Example</A></H2> +<P>The following is an example configuration, interspersed with explanatory text. It defines two databases to handle different parts of the <TERM>X.500</TERM> tree; both are <TERM>BDB</TERM> database instances. The line numbers shown are provided for reference only and are not included in the actual file. First, the global configuration section:</P> +<PRE> + 1. # example config file - global configuration entry + 2. dn: cn=config + 3. objectClass: olcGlobal + 4. cn: config + 5. olcReferral: ldap://root.openldap.org + 6. +</PRE> +<P>Line 1 is a comment. Lines 2-4 identify this as the global configuration entry. The <TT>olcReferral:</TT> directive on line 5 means that queries not local to one of the databases defined below will be referred to the LDAP server running on the standard port (389) at the host <TT>root.openldap.org</TT>. Line 6 is a blank line, indicating the end of this entry.</P> +<PRE> + 7. # internal schema + 8. dn: cn=schema,cn=config + 9. objectClass: olcSchemaConfig + 10. cn: schema + 11. +</PRE> +<P>Line 7 is a comment. Lines 8-10 identify this as the root of the schema subtree. The actual schema definitions in this entry are hardcoded into slapd so no additional attributes are specified here. Line 11 is a blank line, indicating the end of this entry.</P> +<PRE> + 12. # include the core schema + 13. include: file:///usr/local/etc/openldap/schema/core.ldif + 14. +</PRE> +<P>Line 12 is a comment. Line 13 is an LDIF include directive which accesses the <EM>core</EM> schema definitions in LDIF format. Line 14 is a blank line.</P> +<P>Next comes the database definitions. The first database is the special <TT>frontend</TT> database whose settings are applied globally to all the other databases.</P> +<PRE> + 15. # global database parameters + 16. dn: olcDatabase=frontend,cn=config + 17. objectClass: olcDatabaseConfig + 18. olcDatabase: frontend + 19. olcAccess: to * by * read + 20. +</PRE> +<P>Line 15 is a comment. Lines 16-18 identify this entry as the global database entry. Line 19 is a global access control. It applies to all entries (after any applicable database-specific access controls). Line 20 is a blank line.</P> +<P>The next entry defines the config backend.</P> +<PRE> + 21. # set a rootpw for the config database so we can bind. + 22. # deny access to everyone else. + 23. dn: olcDatabase=config,cn=config + 24. objectClass: olcDatabaseConfig + 25. olcDatabase: config + 26. olcRootPW: {SSHA}XKYnrjvGT3wZFQrDD5040US592LxsdLy + 27. olcAccess: to * by * none + 28. +</PRE> +<P>Lines 21-22 are comments. Lines 23-25 identify this entry as the config database entry. Line 26 defines the <EM>super-user</EM> password for this database. (The DN defaults to <EM>"cn=config"</EM>.) Line 27 denies all access to this database, so only the super-user will be able to access it. (This is already the default access on the config database. It is just listed here for illustration, and to reiterate that unless a means to authenticate as the super-user is explicitly configured, the config database will be inaccessible.)</P> +<P>Line 28 is a blank line.</P> +<P>The next entry defines a BDB backend that will handle queries for things in the "dc=example,dc=com" portion of the tree. Indices are to be maintained for several attributes, and the <TT>userPassword</TT> attribute is to be protected from unauthorized access.</P> +<PRE> + 29. # BDB definition for example.com + 30. dn: olcDatabase=bdb,cn=config + 31. objectClass: olcDatabaseConfig + 32. objectClass: olcBdbConfig + 33. olcDatabase: bdb + 34. olcSuffix: dc=example,dc=com + 35. olcDbDirectory: /usr/local/var/openldap-data + 36. olcRootDN: cn=Manager,dc=example,dc=com + 37. olcRootPW: secret + 38. olcDbIndex: uid pres,eq + 39. olcDbIndex: cn,sn pres,eq,approx,sub + 40. olcDbIndex: objectClass eq + 41. olcAccess: to attrs=userPassword + 42. by self write + 43. by anonymous auth + 44. by dn.base="cn=Admin,dc=example,dc=com" write + 45. by * none + 46. olcAccess: to * + 47. by self write + 48. by dn.base="cn=Admin,dc=example,dc=com" write + 49. by * read + 50. +</PRE> +<P>Line 29 is a comment. Lines 30-33 identify this entry as a BDB database configuration entry. Line 34 specifies the DN suffix for queries to pass to this database. Line 35 specifies the directory in which the database files will live.</P> +<P>Lines 36 and 37 identify the database <EM>super-user</EM> entry and associated password. This entry is not subject to access control or size or time limit restrictions.</P> +<P>Lines 38 through 40 indicate the indices to maintain for various attributes.</P> +<P>Lines 41 through 49 specify access control for entries in this database. For all applicable entries, the <TT>userPassword</TT> attribute is writable by the entry itself and by the "admin" entry. It may be used for authentication/authorization purposes, but is otherwise not readable. All other attributes are writable by the entry and the "admin" entry, but may be read by all users (authenticated or not).</P> +<P>Line 50 is a blank line, indicating the end of this entry.</P> +<P>The next entry defines another BDB database. This one handles queries involving the <TT>dc=example,dc=net</TT> subtree but is managed by the same entity as the first database. Note that without line 60, the read access would be allowed due to the global access rule at line 19.</P> +<PRE> + 51. # BDB definition for example.net + 52. dn: olcDatabase=bdb,cn=config + 53. objectClass: olcDatabaseConfig + 54. objectClass: olcBdbConfig + 55. olcDatabase: bdb + 56. olcSuffix: "dc=example,dc=net" + 57. olcDbDirectory: /usr/local/var/openldap-data-net + 58. olcRootDN: "cn=Manager,dc=example,dc=com" + 59. olcDbIndex: objectClass eq + 60. olcAccess: to * by users read +</PRE> +<H2><A NAME="Converting old style {{slapd.conf}}(5) file to {{cn=config}} format">5.4. Converting old style <EM>slapd.conf</EM>(5) file to <EM>cn=config</EM> format</A></H2> +<P>Before converting to the <EM>cn=config</EM> format you should make sure that the config backend is properly configured in your existing config file. While the config backend is always present inside slapd, by default it is only accessible by its rootDN, and there are no default credentials assigned so unless you explicitly configure a means to authenticate to it, it will be unusable.</P> +<P>If you do not already have a <TT>database config</TT> section, add something like this to the end of <TT>slapd.conf</TT></P> +<PRE> + database config + rootpw VerySecret +</PRE> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Since the config backend can be used to load arbitrary code into the slapd process, it is extremely important to carefully guard whatever credentials are used to access it. Since simple passwords are vulnerable to password guessing attacks, it is usually better to omit the rootpw and only use SASL authentication for the config rootDN. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>An existing <EM>slapd.conf</EM>(5) file can be converted to the new format using <EM>slaptest</EM>(8) or any of the slap tools:</P> +<PRE> + slaptest -f /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d +</PRE> +<P>Test that you can access entries under <TT>cn=config</TT> using the default <EM>rootdn</EM> and the <EM>rootpw</EM> configured above:</P> +<PRE> + ldapsearch -x -D cn=config -w VerySecret -b cn=config +</PRE> +<P>You can then discard the old <EM>slapd.conf</EM>(5) file. Make sure to launch <EM>slapd</EM>(8) with the <EM>-F</EM> option to specify the configuration directory if you are not using the default directory path.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>When converting from the slapd.conf format to slapd.d format, any included files will also be integrated into the resulting configuration database. +<HR WIDTH="80%" ALIGN="Left"></P> +<P></P> +<HR> +<H1><A NAME="The slapd Configuration File">6. The slapd Configuration File</A></H1> +<P>This chapter describes configuring <EM>slapd</EM>(8) via the <EM>slapd.conf</EM>(5) configuration file. <EM>slapd.conf</EM>(5) has been deprecated and should only be used if your site requires one of the backends that hasn't yet been updated to work with the newer <EM>slapd-config</EM>(5) system. Configuring <EM>slapd</EM>(8) via <EM>slapd-config</EM>(5) is described in the previous chapter.</P> +<P>The <EM>slapd.conf</EM>(5) file is normally installed in the <TT>/usr/local/etc/openldap</TT> directory. An alternate configuration file location can be specified via a command-line option to <EM>slapd</EM>(8).</P> +<H2><A NAME="Configuration File Format">6.1. Configuration File Format</A></H2> +<P>The <EM>slapd.conf</EM>(5) file consists of three types of configuration information: global, backend specific, and database specific. Global information is specified first, followed by information associated with a particular backend type, which is then followed by information associated with a particular database instance. Global directives can be overridden in backend and/or database directives, and backend directives can be overridden by database directives.</P> +<P>Blank lines and comment lines beginning with a '<TT>#</TT>' character are ignored. If a line begins with whitespace, it is considered a continuation of the previous line (even if the previous line is a comment).</P> +<P>The general format of slapd.conf is as follows:</P> +<PRE> + # global configuration directives + <global config directives> + + # backend definition + backend <typeA> + <backend-specific directives> + + # first database definition & config directives + database <typeA> + <database-specific directives> + + # second database definition & config directives + database <typeB> + <database-specific directives> + + # second database definition & config directives + database <typeA> + <database-specific directives> + + # subsequent backend & database definitions & config directives + ... +</PRE> +<P>A configuration directive may take arguments. If so, they are separated by whitespace. If an argument contains whitespace, the argument should be enclosed in double quotes <TT>"like this"</TT>. If an argument contains a double quote or a backslash character `<TT>\</TT>', the character should be preceded by a backslash character `<TT>\</TT>'.</P> +<P>The distribution contains an example configuration file that will be installed in the <TT>/usr/local/etc/openldap</TT> directory. A number of files containing schema definitions (attribute types and object classes) are also provided in the <TT>/usr/local/etc/openldap/schema</TT> directory.</P> +<H2><A NAME="Configuration File Directives">6.2. Configuration File Directives</A></H2> +<P>This section details commonly used configuration directives. For a complete list, see the <EM>slapd.conf</EM>(5) manual page. This section separates the configuration file directives into global, backend-specific and data-specific categories, describing each directive and its default value (if any), and giving an example of its use.</P> +<H3><A NAME="Global Directives">6.2.1. Global Directives</A></H3> +<P>Directives described in this section apply to all backends and databases unless specifically overridden in a backend or database definition. Arguments that should be replaced by actual text are shown in brackets <TT><></TT>.</P> +<H4><A NAME="access to <what> [ by <who> [<accesslevel>] [<control>] ]+">6.2.1.1. access to <what> [ by <who> [<accesslevel>] [<control>] ]+</A></H4> +<P>This directive grants access (specified by <accesslevel>) to a set of entries and/or attributes (specified by <what>) by one or more requestors (specified by <who>). See the <A HREF="#Access Control">Access Control</A> section of this guide for basic usage.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>If no <TT>access</TT> directives are specified, the default access control policy, <TT>access to * by * read</TT>, allows all both authenticated and anonymous users read access. +<HR WIDTH="80%" ALIGN="Left"></P> +<H4><A NAME="attributetype <{{REF:RFC4512}} Attribute Type Description>"> </A>6.2.1.2. attributetype <<A HREF="http://www.rfc-editor.org/rfc/rfc4512.txt">RFC4512</A> Attribute Type Description></H4> +<P>This directive defines an attribute type. Please see the <A HREF="#Schema Specification">Schema Specification</A> chapter for information regarding how to use this directive.</P> +<H4><A NAME="idletimeout <integer>">6.2.1.3. idletimeout <integer></A></H4> +<P>Specify the number of seconds to wait before forcibly closing an idle client connection. An idletimeout of 0, the default, disables this feature.</P> +<H4><A NAME="include <filename>">6.2.1.4. include <filename></A></H4> +<P>This directive specifies that slapd should read additional configuration information from the given file before continuing with the next line of the current file. The included file should follow the normal slapd config file format. The file is commonly used to include files containing schema specifications.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>You should be careful when using this directive - there is no small limit on the number of nested include directives, and no loop detection is done. +<HR WIDTH="80%" ALIGN="Left"></P> +<H4><A NAME="loglevel <level>">6.2.1.5. loglevel <level></A></H4> +<P>This directive specifies the level at which debugging statements and operation statistics should be syslogged (currently logged to the <EM>syslogd</EM>(8) <TT>LOG_LOCAL4</TT> facility). You must have configured OpenLDAP <TT>--enable-debug</TT> (the default) for this to work (except for the two statistics levels, which are always enabled). Log levels may be specified as integers or by keyword. Multiple log levels may be used and the levels are additive. To display what numbers correspond to what kind of debugging, invoke slapd with <TT>-d?</TT> or consult the table below. The possible values for <integer> are:</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 6.1: Debugging Levels</CAPTION> +<TR CLASS="heading"> +<TD ALIGN='Right'> +<STRONG>Level</STRONG> +</TD> +<TD ALIGN='Left'> +<STRONG>Keyword</STRONG> +</TD> +<TD> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +-1 +</TD> +<TD ALIGN='Left'> +any +</TD> +<TD> +enable all debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +0 +</TD> +<TD ALIGN='Left'> + +</TD> +<TD> +no debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +1 +</TD> +<TD ALIGN='Left'> +(0x1 trace) +</TD> +<TD> +trace function calls +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +2 +</TD> +<TD ALIGN='Left'> +(0x2 packets) +</TD> +<TD> +debug packet handling +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +4 +</TD> +<TD ALIGN='Left'> +(0x4 args) +</TD> +<TD> +heavy trace debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +8 +</TD> +<TD ALIGN='Left'> +(0x8 conns) +</TD> +<TD> +connection management +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +16 +</TD> +<TD ALIGN='Left'> +(0x10 BER) +</TD> +<TD> +print out packets sent and received +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +32 +</TD> +<TD ALIGN='Left'> +(0x20 filter) +</TD> +<TD> +search filter processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +64 +</TD> +<TD ALIGN='Left'> +(0x40 config) +</TD> +<TD> +configuration processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +128 +</TD> +<TD ALIGN='Left'> +(0x80 ACL) +</TD> +<TD> +access control list processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +256 +</TD> +<TD ALIGN='Left'> +(0x100 stats) +</TD> +<TD> +stats log connections/operations/results +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +512 +</TD> +<TD ALIGN='Left'> +(0x200 stats2) +</TD> +<TD> +stats log entries sent +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +1024 +</TD> +<TD ALIGN='Left'> +(0x400 shell) +</TD> +<TD> +print communication with shell backends +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +2048 +</TD> +<TD ALIGN='Left'> +(0x800 parse) +</TD> +<TD> +print entry parsing debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +16384 +</TD> +<TD ALIGN='Left'> +(0x4000 sync) +</TD> +<TD> +syncrepl consumer processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +32768 +</TD> +<TD ALIGN='Left'> +(0x8000 none) +</TD> +<TD> +only messages that get logged whatever log level is set +</TD> +</TR> +</TABLE> + +<P>The desired log level can be input as a single integer that combines the (ORed) desired levels, both in decimal or in hexadecimal notation, as a list of integers (that are ORed internally), or as a list of the names that are shown between brackets, such that</P> +<PRE> + loglevel 129 + loglevel 0x81 + loglevel 128 1 + loglevel 0x80 0x1 + loglevel acl trace +</PRE> +<P>are equivalent.</P> +<P>Examples:</P> +<PRE> + loglevel -1 +</PRE> +<P>This will cause lots and lots of debugging information to be logged.</P> +<PRE> + loglevel conns filter +</PRE> +<P>Just log the connection and search filter processing.</P> +<PRE> + loglevel none +</PRE> +<P>Log those messages that are logged regardless of the configured loglevel. This differs from setting the log level to 0, when no logging occurs. At least the <TT>None</TT> level is required to have high priority messages logged.</P> +<P>Default:</P> +<PRE> + loglevel stats +</PRE> +<P>Basic stats logging is configured by default. However, if no loglevel is defined, no logging occurs (equivalent to a 0 level).</P> +<H4><A NAME="objectclass <{{REF:RFC4512}} Object Class Description>"> </A>6.2.1.6. objectclass <<A HREF="http://www.rfc-editor.org/rfc/rfc4512.txt">RFC4512</A> Object Class Description></H4> +<P>This directive defines an object class. Please see the <A HREF="#Schema Specification">Schema Specification</A> chapter for information regarding how to use this directive.</P> +<H4><A NAME="referral <URI>">6.2.1.7. referral <URI></A></H4> +<P>This directive specifies the referral to pass back when slapd cannot find a local database to handle a request.</P> +<P>Example:</P> +<PRE> + referral ldap://root.openldap.org +</PRE> +<P>This will refer non-local queries to the global root LDAP server at the OpenLDAP Project. Smart LDAP clients can re-ask their query at that server, but note that most of these clients are only going to know how to handle simple LDAP URLs that contain a host part and optionally a distinguished name part.</P> +<H4><A NAME="sizelimit <integer>">6.2.1.8. sizelimit <integer></A></H4> +<P>This directive specifies the maximum number of entries to return from a search operation.</P> +<P>Default:</P> +<PRE> + sizelimit 500 +</PRE> +<P>See the <A HREF="#Limits">Limits</A> section of this guide and <EM>slapd.conf</EM>(5) for more details.</P> +<H4><A NAME="timelimit <integer>">6.2.1.9. timelimit <integer></A></H4> +<P>This directive specifies the maximum number of seconds (in real time) slapd will spend answering a search request. If a request is not finished in this time, a result indicating an exceeded timelimit will be returned.</P> +<P>Default:</P> +<PRE> + timelimit 3600 +</PRE> +<P>See the <A HREF="#Limits">Limits</A> section of this guide and <EM>slapd.conf</EM>(5) for more details.</P> +<H3><A NAME="General Backend Directives">6.2.2. General Backend Directives</A></H3> +<P>Directives in this section apply only to the backend in which they are defined. They are supported by every type of backend. Backend directives apply to all databases instances of the same type and, depending on the directive, may be overridden by database directives.</P> +<H4><A NAME="backend <type>">6.2.2.1. backend <type></A></H4> +<P>This directive marks the beginning of a backend declaration. <TT><type></TT> should be one of the supported backend types listed in Table 6.2.</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 6.2: Database Backends</CAPTION> +<TR CLASS="heading"> +<TD> +<STRONG>Types</STRONG> +</TD> +<TD> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD> +<TT>bdb</TT> +</TD> +<TD> +Berkeley DB transactional backend (deprecated) +</TD> +</TR> +<TR> +<TD> +<TT>dnssrv</TT> +</TD> +<TD> +DNS SRV backend +</TD> +</TR> +<TR> +<TD> +<TT>hdb</TT> +</TD> +<TD> +Hierarchical variant of bdb backend (deprecated) +</TD> +</TR> +<TR> +<TD> +<TT>ldap</TT> +</TD> +<TD> +Lightweight Directory Access Protocol (Proxy) backend +</TD> +</TR> +<TR> +<TD> +<TT>mdb</TT> +</TD> +<TD> +Memory-Mapped DB backend +</TD> +</TR> +<TR> +<TD> +<TT>meta</TT> +</TD> +<TD> +Meta Directory backend +</TD> +</TR> +<TR> +<TD> +<TT>monitor</TT> +</TD> +<TD> +Monitor backend +</TD> +</TR> +<TR> +<TD> +<TT>passwd</TT> +</TD> +<TD> +Provides read-only access to <EM>passwd</EM>(5) +</TD> +</TR> +<TR> +<TD> +<TT>perl</TT> +</TD> +<TD> +Perl Programmable backend +</TD> +</TR> +<TR> +<TD> +<TT>shell</TT> +</TD> +<TD> +Shell (extern program) backend +</TD> +</TR> +<TR> +<TD> +<TT>sql</TT> +</TD> +<TD> +SQL Programmable backend +</TD> +</TR> +</TABLE> + +<P>Example:</P> +<PRE> + backend bdb +</PRE> +<P>This marks the beginning of a new <TERM>BDB</TERM> backend definition.</P> +<H3><A NAME="General Database Directives">6.2.3. General Database Directives</A></H3> +<P>Directives in this section apply only to the database in which they are defined. They are supported by every type of database.</P> +<H4><A NAME="database <type>">6.2.3.1. database <type></A></H4> +<P>This directive marks the beginning of a database instance declaration. <TT><type></TT> should be one of the supported backend types listed in Table 6.2.</P> +<P>Example:</P> +<PRE> + database bdb +</PRE> +<P>This marks the beginning of a new <TERM>BDB</TERM> database instance declaration.</P> +<H4><A NAME="limits <selector> <limit> [<limit> [...]]">6.2.3.2. limits <selector> <limit> [<limit> [...]]</A></H4> +<P>Specify time and size limits based on the operation's initiator or base DN.</P> +<P>See the <A HREF="#Limits">Limits</A> section of this guide and <EM>slapd.conf</EM>(5) for more details.</P> +<H4><A NAME="readonly { on | off }">6.2.3.3. readonly { on | off }</A></H4> +<P>This directive puts the database into "read-only" mode. Any attempts to modify the database will return an "unwilling to perform" error. If set on a consumer, modifications sent by syncrepl will still occur.</P> +<P>Default:</P> +<PRE> + readonly off +</PRE> +<H4><A NAME="rootdn <DN>">6.2.3.4. rootdn <DN></A></H4> +<P>This directive specifies the DN that is not subject to access control or administrative limit restrictions for operations on this database. The DN need not refer to an entry in this database or even in the directory. The DN may refer to a SASL identity.</P> +<P>Entry-based Example:</P> +<PRE> + rootdn "cn=Manager,dc=example,dc=com" +</PRE> +<P>SASL-based Example:</P> +<PRE> + rootdn "uid=root,cn=example.com,cn=digest-md5,cn=auth" +</PRE> +<P>See the <A HREF="#SASL Authentication">SASL Authentication</A> section for information on SASL authentication identities.</P> +<H4><A NAME="rootpw <password>">6.2.3.5. rootpw <password></A></H4> +<P>This directive can be used to specifies a password for the DN for the rootdn (when the rootdn is set to a DN within the database).</P> +<P>Example:</P> +<PRE> + rootpw secret +</PRE> +<P>It is also permissible to provide hash of the password in <A HREF="http://www.rfc-editor.org/rfc/rfc2307.txt">RFC2307</A> form. <EM>slappasswd</EM>(8) may be used to generate the password hash.</P> +<P>Example:</P> +<PRE> + rootpw {SSHA}ZKKuqbEKJfKSXhUbHG3fG8MDn9j1v4QN +</PRE> +<P>The hash was generated using the command <TT>slappasswd -s secret</TT>.</P> +<H4><A NAME="suffix <dn suffix>">6.2.3.6. suffix <dn suffix></A></H4> +<P>This directive specifies the DN suffix of queries that will be passed to this backend database. Multiple suffix lines can be given, and at least one is required for each database definition.</P> +<P>Example:</P> +<PRE> + suffix "dc=example,dc=com" +</PRE> +<P>Queries with a DN ending in "dc=example,dc=com" will be passed to this backend.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>When the backend to pass a query to is selected, slapd looks at the suffix line(s) in each database definition in the order they appear in the file. Thus, if one database suffix is a prefix of another, it must appear after it in the config file. +<HR WIDTH="80%" ALIGN="Left"></P> +<H4><A NAME="syncrepl">6.2.3.7. syncrepl</A></H4> +<PRE> + syncrepl rid=<replica ID> + provider=ldap[s]://<hostname>[:port] + searchbase=<base DN> + [type=refreshOnly|refreshAndPersist] + [interval=dd:hh:mm:ss] + [retry=[<retry interval> <# of retries>]+] + [filter=<filter str>] + [scope=sub|one|base] + [attrs=<attr list>] + [exattrs=<attr list>] + [attrsonly] + [sizelimit=<limit>] + [timelimit=<limit>] + [schemachecking=on|off] + [network-timeout=<seconds>] + [timeout=<seconds>] + [bindmethod=simple|sasl] + [binddn=<DN>] + [saslmech=<mech>] + [authcid=<identity>] + [authzid=<identity>] + [credentials=<passwd>] + [realm=<realm>] + [secprops=<properties>] + [keepalive=<idle>:<probes>:<interval>] + [starttls=yes|critical] + [tls_cert=<file>] + [tls_key=<file>] + [tls_cacert=<file>] + [tls_cacertdir=<path>] + [tls_reqcert=never|allow|try|demand] + [tls_cipher_suite=<ciphers>] + [tls_crlcheck=none|peer|all] + [tls_protocol_min=<major>[.<minor>]] + [suffixmassage=<real DN>] + [logbase=<base DN>] + [logfilter=<filter str>] + [syncdata=default|accesslog|changelog] +</PRE> +<P>This directive specifies the current database as a replica of the master content by establishing the current <EM>slapd</EM>(8) as a replication consumer site running a syncrepl replication engine. The master database is located at the replication provider site specified by the <TT>provider</TT> parameter. The replica database is kept up-to-date with the master content using the LDAP Content Synchronization protocol. See <A HREF="http://www.rfc-editor.org/rfc/rfc4533.txt">RFC4533</A> for more information on the protocol.</P> +<P>The <TT>rid</TT> parameter is used for identification of the current <TT>syncrepl</TT> directive within the replication consumer server, where <TT><replica ID></TT> uniquely identifies the syncrepl specification described by the current <TT>syncrepl</TT> directive. <TT><replica ID></TT> is non-negative and is no more than three decimal digits in length.</P> +<P>The <TT>provider</TT> parameter specifies the replication provider site containing the master content as an LDAP URI. The <TT>provider</TT> parameter specifies a scheme, a host and optionally a port where the provider slapd instance can be found. Either a domain name or IP address may be used for <hostname>. Examples are <TT>ldap://provider.example.com:389</TT> or <TT>ldaps://192.168.1.1:636</TT>. If <port> is not given, the standard LDAP port number (389 or 636) is used. Note that the syncrepl uses a consumer-initiated protocol, and hence its specification is located at the consumer site, whereas the <TT>replica</TT> specification is located at the provider site. <TT>syncrepl</TT> and <TT>replica</TT> directives define two independent replication mechanisms. They do not represent the replication peers of each other.</P> +<P>The content of the syncrepl replica is defined using a search specification as its result set. The consumer slapd will send search requests to the provider slapd according to the search specification. The search specification includes <TT>searchbase</TT>, <TT>scope</TT>, <TT>filter</TT>, <TT>attrs</TT>, <TT>exattrs</TT>, <TT>attrsonly</TT>, <TT>sizelimit</TT>, and <TT>timelimit</TT> parameters as in the normal search specification. The <TT>searchbase</TT> parameter has no default value and must always be specified. The <TT>scope</TT> defaults to <TT>sub</TT>, the <TT>filter</TT> defaults to <TT>(objectclass=*)</TT>, <TT>attrs</TT> defaults to <TT>"*,+"</TT> to replicate all user and operational attributes, and <TT>attrsonly</TT> is unset by default. Both <TT>sizelimit</TT> and <TT>timelimit</TT> default to "unlimited", and only positive integers or "unlimited" may be specified. The <TT>exattrs</TT> option may also be used to specify attributes that should be omitted from incoming entries.</P> +<P>The <TERM>LDAP Content Synchronization</TERM> protocol has two operation types: <TT>refreshOnly</TT> and <TT>refreshAndPersist</TT>. The operation type is specified by the <TT>type</TT> parameter. In the <TT>refreshOnly</TT> operation, the next synchronization search operation is periodically rescheduled at an interval time after each synchronization operation finishes. The interval is specified by the <TT>interval</TT> parameter. It is set to one day by default. In the <TT>refreshAndPersist</TT> operation, a synchronization search remains persistent in the provider <EM>slapd</EM> instance. Further updates to the master replica will generate <TT>searchResultEntry</TT> to the consumer slapd as the search responses to the persistent synchronization search.</P> +<P>If an error occurs during replication, the consumer will attempt to reconnect according to the retry parameter which is a list of the <retry interval> and <# of retries> pairs. For example, retry="60 10 300 3" lets the consumer retry every 60 seconds for the first 10 times and then retry every 300 seconds for the next three times before stop retrying. + in <# of retries> means indefinite number of retries until success.</P> +<P>The schema checking can be enforced at the LDAP Sync consumer site by turning on the <TT>schemachecking</TT> parameter. If it is turned on, every replicated entry will be checked for its schema as the entry is stored into the replica content. Every entry in the replica should contain those attributes required by the schema definition. If it is turned off, entries will be stored without checking schema conformance. The default is off.</P> +<P>The <TT>network-timeout</TT> parameter sets how long the consumer will wait to establish a network connection to the provider. Once a connection is established, the <TT>timeout</TT> parameter determines how long the consumer will wait for the initial Bind request to complete. The defaults for these parameters come from <EM>ldap.conf</EM>(5).</P> +<P>The <TT>binddn</TT> parameter gives the DN to bind as for the syncrepl searches to the provider slapd. It should be a DN which has read access to the replication content in the master database.</P> +<P>The <TT>bindmethod</TT> is <TT>simple</TT> or <TT>sasl</TT>, depending on whether simple password-based authentication or <TERM>SASL</TERM> authentication is to be used when connecting to the provider <EM>slapd</EM> instance.</P> +<P>Simple authentication should not be used unless adequate data integrity and confidentiality protections are in place (e.g. TLS or IPsec). Simple authentication requires specification of <TT>binddn</TT> and <TT>credentials</TT> parameters.</P> +<P>SASL authentication is generally recommended. SASL authentication requires specification of a mechanism using the <TT>saslmech</TT> parameter. Depending on the mechanism, an authentication identity and/or credentials can be specified using <TT>authcid</TT> and <TT>credentials</TT>, respectively. The <TT>authzid</TT> parameter may be used to specify an authorization identity.</P> +<P>The <TT>realm</TT> parameter specifies a realm which a certain mechanisms authenticate the identity within. The <TT>secprops</TT> parameter specifies Cyrus SASL security properties.</P> +<P>The <TT>keepalive</TT> parameter sets the values of idle, probes, and interval used to check whether a socket is alive; idle is the number of seconds a connection needs to remain idle before TCP starts sending keepalive probes; probes is the maximum number of keepalive probes TCP should send before dropping the connection; interval is interval in seconds between individual keepalive probes. Only some systems support the customization of these values; the keepalive parameter is ignored otherwise, and system-wide settings are used. For example, keepalive="240:10:30" will send a keepalive probe 10 times, every 30 seconds, after 240 seconds of idle activity. If no response to the probes is received, the connection will be dropped.</P> +<P>The <TT>starttls</TT> parameter specifies use of the StartTLS extended operation to establish a TLS session before authenticating to the provider. If the <TT>critical</TT> argument is supplied, the session will be aborted if the StartTLS request fails. Otherwise the syncrepl session continues without TLS. The tls_reqcert setting defaults to <TT>"demand"</TT> and the other TLS settings default to the same as the main slapd TLS settings.</P> +<P>The <TT>suffixmassage</TT> parameter allows the consumer to pull entries from a remote directory whose DN suffix differs from the local directory. The portion of the remote entries' DNs that matches the searchbase will be replaced with the suffixmassage DN.</P> +<P>Rather than replicating whole entries, the consumer can query logs of data modifications. This mode of operation is referred to as <EM>delta syncrepl</EM>. In addition to the above parameters, the <TT>logbase</TT> and <TT>logfilter</TT> parameters must be set appropriately for the log that will be used. The <TT>syncdata</TT> parameter must be set to either <TT>"accesslog"</TT> if the log conforms to the <EM>slapo-accesslog</EM>(5) log format, or <TT>"changelog"</TT> if the log conforms to the obsolete <EM>changelog</EM> format. If the <TT>syncdata</TT> parameter is omitted or set to <TT>"default"</TT> then the log parameters are ignored.</P> +<P>The <EM>syncrepl</EM> replication mechanism is supported by the <EM>bdb</EM>, <EM>hdb</EM>, and <EM>mdb</EM> backends.</P> +<P>See the <A HREF="#LDAP Sync Replication">LDAP Sync Replication</A> chapter of this guide for more information on how to use this directive.</P> +<H4><A NAME="updateref <URL>">6.2.3.8. updateref <URL></A></H4> +<P>This directive is only applicable in a <EM>slave</EM> (or <EM>shadow</EM>) <EM>slapd</EM>(8) instance. It specifies the URL to return to clients which submit update requests upon the replica. If specified multiple times, each <TERM>URL</TERM> is provided.</P> +<P>Example:</P> +<PRE> + updateref ldap://master.example.net +</PRE> +<H3><A NAME="BDB and HDB Database Directives">6.2.4. BDB and HDB Database Directives</A></H3> +<P>Directives in this category only apply to both the <TERM>BDB</TERM> and the <TERM>HDB</TERM> database. That is, they must follow a "database bdb" or "database hdb" line and come before any subsequent "backend" or "database" line. For a complete reference of BDB/HDB configuration directives, see <EM>slapd-bdb</EM>(5).</P> +<H4><A NAME="directory <directory>">6.2.4.1. directory <directory></A></H4> +<P>This directive specifies the directory where the BDB files containing the database and associated indices live.</P> +<P>Default:</P> +<PRE> + directory /usr/local/var/openldap-data +</PRE> +<H2><A NAME="Configuration File Example">6.3. Configuration File Example</A></H2> +<P>The following is an example configuration file, interspersed with explanatory text. It defines two databases to handle different parts of the <TERM>X.500</TERM> tree; both are <TERM>BDB</TERM> database instances. The line numbers shown are provided for reference only and are not included in the actual file. First, the global configuration section:</P> +<PRE> + 1. # example config file - global configuration section + 2. include /usr/local/etc/schema/core.schema + 3. referral ldap://root.openldap.org + 4. access to * by * read +</PRE> +<P>Line 1 is a comment. Line 2 includes another config file which contains <EM>core</EM> schema definitions. The <TT>referral</TT> directive on line 3 means that queries not local to one of the databases defined below will be referred to the LDAP server running on the standard port (389) at the host <TT>root.openldap.org</TT>.</P> +<P>Line 4 is a global access control. It applies to all entries (after any applicable database-specific access controls).</P> +<P>The next section of the configuration file defines a BDB backend that will handle queries for things in the "dc=example,dc=com" portion of the tree. The database is to be replicated to two slave slapds, one on truelies, the other on judgmentday. Indices are to be maintained for several attributes, and the <TT>userPassword</TT> attribute is to be protected from unauthorized access.</P> +<PRE> + 5. # BDB definition for the example.com + 6. database bdb + 7. suffix "dc=example,dc=com" + 8. directory /usr/local/var/openldap-data + 9. rootdn "cn=Manager,dc=example,dc=com" + 10. rootpw secret + 11. # indexed attribute definitions + 12. index uid pres,eq + 13. index cn,sn pres,eq,approx,sub + 14. index objectClass eq + 15. # database access control definitions + 16. access to attrs=userPassword + 17. by self write + 18. by anonymous auth + 19. by dn.base="cn=Admin,dc=example,dc=com" write + 20. by * none + 21. access to * + 22. by self write + 23. by dn.base="cn=Admin,dc=example,dc=com" write + 24. by * read +</PRE> +<P>Line 5 is a comment. The start of the database definition is marked by the database keyword on line 6. Line 7 specifies the DN suffix for queries to pass to this database. Line 8 specifies the directory in which the database files will live.</P> +<P>Lines 9 and 10 identify the database <EM>super-user</EM> entry and associated password. This entry is not subject to access control or size or time limit restrictions.</P> +<P>Lines 12 through 14 indicate the indices to maintain for various attributes.</P> +<P>Lines 16 through 24 specify access control for entries in this database. For all applicable entries, the <TT>userPassword</TT> attribute is writable by the entry itself and by the "admin" entry. It may be used for authentication/authorization purposes, but is otherwise not readable. All other attributes are writable by the entry and the "admin" entry, but may be read by all users (authenticated or not).</P> +<P>The next section of the example configuration file defines another BDB database. This one handles queries involving the <TT>dc=example,dc=net</TT> subtree but is managed by the same entity as the first database. Note that without line 39, the read access would be allowed due to the global access rule at line 4.</P> +<PRE> + 33. # BDB definition for example.net + 34. database bdb + 35. suffix "dc=example,dc=net" + 36. directory /usr/local/var/openldap-data-net + 37. rootdn "cn=Manager,dc=example,dc=com" + 38. index objectClass eq + 39. access to * by users read +</PRE> +<P></P> +<HR> +<H1><A NAME="Running slapd">7. Running slapd</A></H1> +<P><EM>slapd</EM>(8) is designed to be run as a standalone service. This allows the server to take advantage of caching, manage concurrency issues with underlying databases, and conserve system resources. Running from <EM>inetd</EM>(8) is <EM>NOT</EM> an option.</P> +<H2><A NAME="Command-Line Options">7.1. Command-Line Options</A></H2> +<P><EM>slapd</EM>(8) supports a number of command-line options as detailed in the manual page. This section details a few commonly used options.</P> +<PRE> + -f <filename> +</PRE> +<P>This option specifies an alternate configuration file for slapd. The default is normally <TT>/usr/local/etc/openldap/slapd.conf</TT>.</P> +<PRE> + -F <slapd-config-directory> +</PRE> +<P>Specifies the slapd configuration directory. The default is <TT>/usr/local/etc/openldap/slapd.d</TT>.</P> +<P>If both <TT>-f</TT> and <TT>-F</TT> are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, slapd will attempt to read the default config directory before trying to use the default config file. If a valid config directory exists then the default config file is ignored. All of the slap tools that use the config options observe this same behavior.</P> +<PRE> + -h <URLs> +</PRE> +<P>This option specifies alternative listener configurations. The default is <TT>ldap:///</TT> which implies <TERM>LDAP</TERM> over <TERM>TCP</TERM> on all interfaces on the default LDAP port 389. You can specify specific host-port pairs or other protocol schemes (such as <TT>ldaps://</TT> or <TT>ldapi://</TT>).</P> +<TABLE CLASS="columns" BORDER> +<TR CLASS="heading"> +<TD> +<STRONG>URL</STRONG> +</TD> +<TD> +<STRONG>Protocol</STRONG> +</TD> +<TD> +<STRONG>Transport</STRONG> +</TD> +</TR> +<TR> +<TD> +ldap:/// +</TD> +<TD> +LDAP +</TD> +<TD> +TCP port 389 +</TD> +</TR> +<TR> +<TD> +ldaps:/// +</TD> +<TD> +LDAP over SSL +</TD> +<TD> +TCP port 636 +</TD> +</TR> +<TR> +<TD> +ldapi:/// +</TD> +<TD> +LDAP +</TD> +<TD> +IPC (Unix-domain socket) +</TD> +</TR> +</TABLE> + +<P>For example, <TT>-h "ldaps:// ldap://127.0.0.1:666"</TT> will create two listeners: one for the (non-standard) <TT>ldaps://</TT> scheme on all interfaces on the default <TT>ldaps://</TT> port 636, and one for the standard <TT>ldap://</TT> scheme on the <TT>localhost</TT> (<EM>loopback</EM>) interface on port 666. Hosts may be specified using using hostnames or <TERM>IPv4</TERM> or <TERM>IPv6</TERM> addresses. Port values must be numeric.</P> +<P>For LDAP over IPC, the pathname of the Unix-domain socket can be encoded in the URL. Note that directory separators must be URL-encoded, like any other characters that are special to URLs. Thus the socket <TT>/usr/local/var/ldapi</TT> must be encoded as</P> +<PRE> + ldapi://%2Fusr%2Flocal%2Fvar%2Fldapi +</PRE> +<P>ldapi: is described in detail in <EM>Using LDAP Over IPC Mechanisms</EM> [<A HREF="http://tools.ietf.org/html/draft-chu-ldap-ldapi-00">Chu-LDAPI</A>]</P> +<P>Note that the ldapi:/// transport is not widely implemented: non-OpenLDAP clients may not be able to use it.</P> +<PRE> + -n <service-name> +</PRE> +<P>This option specifies the service name used for logging and other purposes. The default service name is <TT>slapd</TT>.</P> +<PRE> + -l <syslog-local-user> +</PRE> +<P>This option specifies the local user for the <EM>syslog</EM>(8) facility. Values can be <TT>LOCAL0</TT>, <TT>LOCAL1</TT>, <TT>LOCAL2</TT>, ..., and <TT>LOCAL7</TT>. The default is <TT>LOCAL4</TT>. This option may not be supported on all systems.</P> +<PRE> + -u user -g group +</PRE> +<P>These options specify the user and group, respectively, to run as. <TT>user</TT> can be either a user name or uid. <TT>group</TT> can be either a group name or gid.</P> +<PRE> + -r directory +</PRE> +<P>This option specifies a run-time directory. slapd will <EM>chroot</EM>(2) to this directory after opening listeners but before reading any configuration files or initializing any backends.</P> +<UL> +</UL> +<PRE> + -d <level> | ? +</PRE> +<P>This option sets the slapd debug level to <level>. When level is a `?' character, the various debugging levels are printed and slapd exits, regardless of any other options you give it. Current debugging levels are</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 7.1: Debugging Levels</CAPTION> +<TR CLASS="heading"> +<TD ALIGN='Right'> +<STRONG>Level</STRONG> +</TD> +<TD ALIGN='Left'> +<STRONG>Keyword</STRONG> +</TD> +<TD> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +-1 +</TD> +<TD ALIGN='Left'> +any +</TD> +<TD> +enable all debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +0 +</TD> +<TD ALIGN='Left'> + +</TD> +<TD> +no debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +1 +</TD> +<TD ALIGN='Left'> +(0x1 trace) +</TD> +<TD> +trace function calls +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +2 +</TD> +<TD ALIGN='Left'> +(0x2 packets) +</TD> +<TD> +debug packet handling +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +4 +</TD> +<TD ALIGN='Left'> +(0x4 args) +</TD> +<TD> +heavy trace debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +8 +</TD> +<TD ALIGN='Left'> +(0x8 conns) +</TD> +<TD> +connection management +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +16 +</TD> +<TD ALIGN='Left'> +(0x10 BER) +</TD> +<TD> +print out packets sent and received +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +32 +</TD> +<TD ALIGN='Left'> +(0x20 filter) +</TD> +<TD> +search filter processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +64 +</TD> +<TD ALIGN='Left'> +(0x40 config) +</TD> +<TD> +configuration processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +128 +</TD> +<TD ALIGN='Left'> +(0x80 ACL) +</TD> +<TD> +access control list processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +256 +</TD> +<TD ALIGN='Left'> +(0x100 stats) +</TD> +<TD> +stats log connections/operations/results +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +512 +</TD> +<TD ALIGN='Left'> +(0x200 stats2) +</TD> +<TD> +stats log entries sent +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +1024 +</TD> +<TD ALIGN='Left'> +(0x400 shell) +</TD> +<TD> +print communication with shell backends +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +2048 +</TD> +<TD ALIGN='Left'> +(0x800 parse) +</TD> +<TD> +print entry parsing debugging +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +16384 +</TD> +<TD ALIGN='Left'> +(0x4000 sync) +</TD> +<TD> +syncrepl consumer processing +</TD> +</TR> +<TR> +<TD ALIGN='Right'> +32768 +</TD> +<TD ALIGN='Left'> +(0x8000 none) +</TD> +<TD> +only messages that get logged whatever log level is set +</TD> +</TR> +</TABLE> + +<P>You may enable multiple levels by specifying the debug option once for each desired level. Or, since debugging levels are additive, you can do the math yourself. That is, if you want to trace function calls and watch the config file being processed, you could set level to the sum of those two levels (in this case, <TT> -d 65</TT>). Or, you can let slapd do the math, (e.g. <TT> -d 1 -d 64</TT>). Consult <TT><ldap_log.h></TT> for more details.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>slapd must have been compiled with <TT>--enable-debug</TT> defined for any debugging information beyond the two stats levels to be available (the default). +<HR WIDTH="80%" ALIGN="Left"></P> +<H2><A NAME="Starting slapd">7.2. Starting slapd</A></H2> +<P>In general, slapd is run like this:</P> +<PRE> + /usr/local/libexec/slapd [<option>]* +</PRE> +<P>where <TT>/usr/local/libexec</TT> is determined by <TT>configure</TT> and <option> is one of the options described above (or in <EM>slapd</EM>(8)). Unless you have specified a debugging level (including level <TT>0</TT>), slapd will automatically fork and detach itself from its controlling terminal and run in the background.</P> +<H2><A NAME="Stopping slapd">7.3. Stopping slapd</A></H2> +<P>To kill off <EM>slapd</EM>(8) safely, you should give a command like this</P> +<PRE> + kill -INT `cat /usr/local/var/slapd.pid` +</PRE> +<P>where <TT>/usr/local/var</TT> is determined by <TT>configure</TT>.</P> +<P>Killing slapd by a more drastic method may cause information loss or database corruption.</P> +<P></P> +<HR> +<H1><A NAME="Access Control">8. Access Control</A></H1> +<H2><A NAME="Introduction">8.1. Introduction</A></H2> +<P>As the directory gets populated with more and more data of varying sensitivity, controlling the kinds of access granted to the directory becomes more and more critical. For instance, the directory may contain data of a confidential nature that you may need to protect by contract or by law. Or, if using the directory to control access to other services, inappropriate access to the directory may create avenues of attack to your sites security that result in devastating damage to your assets.</P> +<P>Access to your directory can be configured via two methods, the first using <A HREF="#The slapd Configuration File">The slapd Configuration File</A> and the second using the <EM>slapd-config</EM>(5) format (<A HREF="#Configuring slapd">Configuring slapd</A>).</P> +<P>The default access control policy is allow read by all clients. Regardless of what access control policy is defined, the <EM>rootdn</EM> is always allowed full rights (i.e. auth, search, compare, read and write) on everything and anything.</P> +<P>As a consequence, it's useless (and results in a performance penalty) to explicitly list the <EM>rootdn</EM> among the <EM><by></EM> clauses.</P> +<P>The following sections will describe Access Control Lists in greater depth and follow with some examples and recommendations. See <EM>slapd.access</EM>(5) for complete details.</P> +<H2><A NAME="Access Control via Static Configuration">8.2. Access Control via Static Configuration</A></H2> +<P>Access to entries and attributes is controlled by the access configuration file directive. The general form of an access line is:</P> +<PRE> + <access directive> ::= access to <what> + [by <who> [<access>] [<control>] ]+ + <what> ::= * | + [dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>] + [filter=<ldapfilter>] [attrs=<attrlist>] + <basic-style> ::= regex | exact + <scope-style> ::= base | one | subtree | children + <attrlist> ::= <attr> [val[.<basic-style>]=<regex>] | <attr> , <attrlist> + <attr> ::= <attrname> | entry | children + <who> ::= * | [anonymous | users | self + | dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>] + [dnattr=<attrname>] + [group[/<objectclass>[/<attrname>][.<basic-style>]]=<regex>] + [peername[.<basic-style>]=<regex>] + [sockname[.<basic-style>]=<regex>] + [domain[.<basic-style>]=<regex>] + [sockurl[.<basic-style>]=<regex>] + [set=<setspec>] + [aci=<attrname>] + <access> ::= [self]{<level>|<priv>} + <level> ::= none | disclose | auth | compare | search | read | write | manage + <priv> ::= {=|+|-}{m|w|r|s|c|x|d|0}+ + <control> ::= [stop | continue | break] +</PRE> +<P>where the <what> part selects the entries and/or attributes to which the access applies, the <TT><who></TT> part specifies which entities are granted access, and the <TT><access></TT> part specifies the access granted. Multiple <TT><who> <access> <control></TT> triplets are supported, allowing many entities to be granted different access to the same set of entries and attributes. Not all of these access control options are described here; for more details see the <EM>slapd.access</EM>(5) man page.</P> +<H3><A NAME="What to control access to">8.2.1. What to control access to</A></H3> +<P>The <what> part of an access specification determines the entries and attributes to which the access control applies. Entries are commonly selected in two ways: by DN and by filter. The following qualifiers select entries by DN:</P> +<PRE> + to * + to dn[.<basic-style>]=<regex> + to dn.<scope-style>=<DN> +</PRE> +<P>The first form is used to select all entries. The second form may be used to select entries by matching a regular expression against the target entry's <EM>normalized DN</EM>. (The second form is not discussed further in this document.) The third form is used to select entries which are within the requested scope of DN. The <DN> is a string representation of the Distinguished Name, as described in <A HREF="http://www.rfc-editor.org/rfc/rfc4514.txt">RFC4514</A>.</P> +<P>The scope can be either <TT>base</TT>, <TT>one</TT>, <TT>subtree</TT>, or <TT>children</TT>. Where <TT>base</TT> matches only the entry with provided DN, <TT>one</TT> matches the entries whose parent is the provided DN, <TT>subtree</TT> matches all entries in the subtree whose root is the provided DN, and <TT>children</TT> matches all entries under the DN (but not the entry named by the DN).</P> +<P>For example, if the directory contained entries named:</P> +<PRE> + 0: o=suffix + 1: cn=Manager,o=suffix + 2: ou=people,o=suffix + 3: uid=kdz,ou=people,o=suffix + 4: cn=addresses,uid=kdz,ou=people,o=suffix + 5: uid=hyc,ou=people,o=suffix +</PRE> +<P>Then:</P> +<UL> +<TT>dn.base="ou=people,o=suffix"</TT> match 2; +<BR> +<TT>dn.one="ou=people,o=suffix"</TT> match 3, and 5; +<BR> +<TT>dn.subtree="ou=people,o=suffix"</TT> match 2, 3, 4, and 5; and +<BR> +<TT>dn.children="ou=people,o=suffix"</TT> match 3, 4, and 5.</UL> +<P>Entries may also be selected using a filter:</P> +<PRE> + to filter=<ldap filter> +</PRE> +<P>where <ldap filter> is a string representation of an LDAP search filter, as described in <A HREF="http://www.rfc-editor.org/rfc/rfc4515.txt">RFC4515</A>. For example:</P> +<PRE> + to filter=(objectClass=person) +</PRE> +<P>Note that entries may be selected by both DN and filter by including both qualifiers in the <what> clause.</P> +<PRE> + to dn.one="ou=people,o=suffix" filter=(objectClass=person) +</PRE> +<P>Attributes within an entry are selected by including a comma-separated list of attribute names in the <what> selector:</P> +<PRE> + attrs=<attribute list> +</PRE> +<P>A specific value of an attribute is selected by using a single attribute name and also using a value selector:</P> +<PRE> + attrs=<attribute> val[.<style>]=<regex> +</PRE> +<P>There are two special <EM>pseudo</EM> attributes <TT>entry</TT> and <TT>children</TT>. To read (and hence return) a target entry, the subject must have <TT>read</TT> access to the target's <EM>entry</EM> attribute. To perform a search, the subject must have <TT>search</TT> access to the search base's <EM>entry</EM> attribute. To add or delete an entry, the subject must have <TT>write</TT> access to the entry's <TT>entry</TT> attribute AND must have <TT>write</TT> access to the entry's parent's <TT>children</TT> attribute. To rename an entry, the subject must have <TT>write</TT> access to entry's <TT>entry</TT> attribute AND have <TT>write</TT> access to both the old parent's and new parent's <TT>children</TT> attributes. The complete examples at the end of this section should help clear things up.</P> +<P>Lastly, there is a special entry selector <TT>"*"</TT> that is used to select any entry. It is used when no other <TT><what></TT> selector has been provided. It's equivalent to "<TT>dn=.*</TT>"</P> +<H3><A NAME="Who to grant access to">8.2.2. Who to grant access to</A></H3> +<P>The <who> part identifies the entity or entities being granted access. Note that access is granted to "entities" not "entries." The following table summarizes entity specifiers:</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 6.3: Access Entity Specifiers</CAPTION> +<TR CLASS="heading"> +<TD> +<STRONG>Specifier</STRONG> +</TD> +<TD> +<STRONG>Entities</STRONG> +</TD> +</TR> +<TR> +<TD> +<TT>*</TT> +</TD> +<TD> +All, including anonymous and authenticated users +</TD> +</TR> +<TR> +<TD> +<TT>anonymous</TT> +</TD> +<TD> +Anonymous (non-authenticated) users +</TD> +</TR> +<TR> +<TD> +<TT>users</TT> +</TD> +<TD> +Authenticated users +</TD> +</TR> +<TR> +<TD> +<TT>self</TT> +</TD> +<TD> +User associated with target entry +</TD> +</TR> +<TR> +<TD> +<TT>dn[.<basic-style>]=<regex></TT> +</TD> +<TD> +Users matching a regular expression +</TD> +</TR> +<TR> +<TD> +<TT>dn.<scope-style>=<DN></TT> +</TD> +<TD> +Users within scope of a DN +</TD> +</TR> +</TABLE> + +<P>The DN specifier behaves much like <what> clause DN specifiers.</P> +<P>Other control factors are also supported. For example, a <TT><who></TT> can be restricted by an entry listed in a DN-valued attribute in the entry to which the access applies:</P> +<PRE> + dnattr=<dn-valued attribute name> +</PRE> +<P>The dnattr specification is used to give access to an entry whose DN is listed in an attribute of the entry (e.g., give access to a group entry to whoever is listed as the owner of the group entry).</P> +<P>Some factors may not be appropriate in all environments (or any). For example, the domain factor relies on IP to domain name lookups. As these can easily be spoofed, the domain factor should be avoided.</P> +<H3><A NAME="The access to grant">8.2.3. The access to grant</A></H3> +<P>The kind of <access> granted can be one of the following:</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 6.4: Access Levels</CAPTION> +<TR CLASS="heading"> +<TD ALIGN='Left'> +<STRONG>Level</STRONG> +</TD> +<TD ALIGN='Right'> +<STRONG>Privileges</STRONG> +</TD> +<TD ALIGN='Left'> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>none =</TT> +</TD> +<TD ALIGN='Right'> +<TT>0</TT> +</TD> +<TD ALIGN='Left'> +no access +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>disclose =</TT> +</TD> +<TD ALIGN='Right'> +<TT>d</TT> +</TD> +<TD ALIGN='Left'> +needed for information disclosure on error +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>auth =</TT> +</TD> +<TD ALIGN='Right'> +<TT>dx</TT> +</TD> +<TD ALIGN='Left'> +needed to authenticate (bind) +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>compare =</TT> +</TD> +<TD ALIGN='Right'> +<TT>cdx</TT> +</TD> +<TD ALIGN='Left'> +needed to compare +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>search =</TT> +</TD> +<TD ALIGN='Right'> +<TT>scdx</TT> +</TD> +<TD ALIGN='Left'> +needed to apply search filters +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>read =</TT> +</TD> +<TD ALIGN='Right'> +<TT>rscdx</TT> +</TD> +<TD ALIGN='Left'> +needed to read search results +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>write =</TT> +</TD> +<TD ALIGN='Right'> +<TT>wrscdx</TT> +</TD> +<TD ALIGN='Left'> +needed to modify/rename +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>manage =</TT> +</TD> +<TD ALIGN='Right'> +<TT>mwrscdx</TT> +</TD> +<TD ALIGN='Left'> +needed to manage +</TD> +</TR> +</TABLE> + +<P>Each level implies all lower levels of access. So, for example, granting someone <TT>write</TT> access to an entry also grants them <TT>read</TT>, <TT>search</TT>, <TT>compare</TT>, <TT>auth</TT> and <TT>disclose</TT> access. However, one may use the privileges specifier to grant specific permissions.</P> +<H3><A NAME="Access Control Evaluation">8.2.4. Access Control Evaluation</A></H3> +<P>When evaluating whether some requester should be given access to an entry and/or attribute, slapd compares the entry and/or attribute to the <TT><what></TT> selectors given in the configuration file. For each entry, access controls provided in the database which holds the entry (or the global access directives if not held in any database) apply first, followed by the global access directives. However, when dealing with an access list, because the global access list is effectively appended to each per-database list, if the resulting list is non-empty then the access list will end with an implicit <TT>access to * by * none</TT> directive. If there are no access directives applicable to a backend, then a default read is used.</P> +<P>Within this priority, access directives are examined in the order in which they appear in the config file. Slapd stops with the first <TT><what></TT> selector that matches the entry and/or attribute. The corresponding access directive is the one slapd will use to evaluate access.</P> +<P>Next, slapd compares the entity requesting access to the <TT><who></TT> selectors within the access directive selected above in the order in which they appear. It stops with the first <TT><who></TT> selector that matches the requester. This determines the access the entity requesting access has to the entry and/or attribute.</P> +<P>Finally, slapd compares the access granted in the selected <TT><access></TT> clause to the access requested by the client. If it allows greater or equal access, access is granted. Otherwise, access is denied.</P> +<P>The order of evaluation of access directives makes their placement in the configuration file important. If one access directive is more specific than another in terms of the entries it selects, it should appear first in the config file. Similarly, if one <TT><who></TT> selector is more specific than another it should come first in the access directive. The access control examples given below should help make this clear.</P> +<H3><A NAME="Access Control Examples">8.2.5. Access Control Examples</A></H3> +<P>The access control facility described above is quite powerful. This section shows some examples of its use for descriptive purposes.</P> +<P>A simple example:</P> +<PRE> + access to * by * read +</PRE> +<P>This access directive grants read access to everyone.</P> +<PRE> + access to * + by self write + by anonymous auth + by * read +</PRE> +<P>This directive allows the user to modify their entry, allows anonymous to authenticate against these entries, and allows all others to read these entries. Note that only the first <TT>by <who></TT> clause which matches applies. Hence, the anonymous users are granted <TT>auth</TT>, not <TT>read</TT>. The last clause could just as well have been "<TT>by users read</TT>".</P> +<P>It is often desirable to restrict operations based upon the level of protection in place. The following shows how security strength factors (SSF) can be used.</P> +<PRE> + access to * + by ssf=128 self write + by ssf=64 anonymous auth + by ssf=64 users read +</PRE> +<P>This directive allows users to modify their own entries if security protections have of strength 128 or better have been established, allows authentication access to anonymous users, and read access when 64 or better security protections have been established. If client has not establish sufficient security protections, the implicit <TT>by * none</TT> clause would be applied.</P> +<P>The following example shows the use of a style specifiers to select the entries by DN in two access directives where ordering is significant.</P> +<PRE> + access to dn.children="dc=example,dc=com" + by * search + access to dn.children="dc=com" + by * read +</PRE> +<P>Read access is granted to entries under the <TT>dc=com</TT> subtree, except for those entries under the <TT>dc=example,dc=com</TT> subtree, to which search access is granted. No access is granted to <TT>dc=com</TT> as neither access directive matches this DN. If the order of these access directives was reversed, the trailing directive would never be reached, since all entries under <TT>dc=example,dc=com</TT> are also under <TT>dc=com</TT> entries.</P> +<P>Also note that if no <TT>access to</TT> directive matches or no <TT>by <who></TT> clause, <B>access is denied</B>. That is, every <TT>access to</TT> directive ends with an implicit <TT>by * none</TT> clause. When dealing with an access list, because the global access list is effectively appended to each per-database list, if the resulting list is non-empty then the access list will end with an implicit <TT>access to * by * none</TT> directive. If there are no access directives applicable to a backend, then a default read is used.</P> +<P>The next example again shows the importance of ordering, both of the access directives and the <TT>by <who></TT> clauses. It also shows the use of an attribute selector to grant access to a specific attribute and various <TT><who></TT> selectors.</P> +<PRE> + access to dn.subtree="dc=example,dc=com" attrs=homePhone + by self write + by dn.children="dc=example,dc=com" search + by peername.regex=IP=10\..+ read + access to dn.subtree="dc=example,dc=com" + by self write + by dn.children="dc=example,dc=com" search + by anonymous auth +</PRE> +<P>This example applies to entries in the "<TT>dc=example,dc=com</TT>" subtree. To all attributes except <TT>homePhone</TT>, an entry can write to itself, entries under <TT>example.com</TT> entries can search by them, anybody else has no access (implicit <TT>by * none</TT>) excepting for authentication/authorization (which is always done anonymously). The <TT>homePhone</TT> attribute is writable by the entry, searchable by entries under <TT>example.com</TT>, readable by clients connecting from network 10, and otherwise not readable (implicit <TT>by * none</TT>). All other access is denied by the implicit <TT>access to * by * none</TT>.</P> +<P>Sometimes it is useful to permit a particular DN to add or remove itself from an attribute. For example, if you would like to create a group and allow people to add and remove only their own DN from the member attribute, you could accomplish it with an access directive like this:</P> +<PRE> + access to attrs=member,entry + by dnattr=member selfwrite +</PRE> +<P>The dnattr <TT><who></TT> selector says that the access applies to entries listed in the <TT>member</TT> attribute. The <TT>selfwrite</TT> access selector says that such members can only add or delete their own DN from the attribute, not other values. The addition of the entry attribute is required because access to the entry is required to access any of the entry's attributes.</P> +<H2><A NAME="Access Control via Dynamic Configuration">8.3. Access Control via Dynamic Configuration</A></H2> +<P>Access to slapd entries and attributes is controlled by the olcAccess attribute, whose values are a sequence of access directives. The general form of the olcAccess configuration is:</P> +<PRE> + olcAccess: <access directive> + <access directive> ::= to <what> + [by <who> [<access>] [<control>] ]+ + <what> ::= * | + [dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>] + [filter=<ldapfilter>] [attrs=<attrlist>] + <basic-style> ::= regex | exact + <scope-style> ::= base | one | subtree | children + <attrlist> ::= <attr> [val[.<basic-style>]=<regex>] | <attr> , <attrlist> + <attr> ::= <attrname> | entry | children + <who> ::= * | [anonymous | users | self + | dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>] + [dnattr=<attrname>] + [group[/<objectclass>[/<attrname>][.<basic-style>]]=<regex>] + [peername[.<basic-style>]=<regex>] + [sockname[.<basic-style>]=<regex>] + [domain[.<basic-style>]=<regex>] + [sockurl[.<basic-style>]=<regex>] + [set=<setspec>] + [aci=<attrname>] + <access> ::= [self]{<level>|<priv>} + <level> ::= none | disclose | auth | compare | search | read | write | manage + <priv> ::= {=|+|-}{m|w|r|s|c|x|d|0}+ + <control> ::= [stop | continue | break] +</PRE> +<P>where the <what> part selects the entries and/or attributes to which the access applies, the <TT><who></TT> part specifies which entities are granted access, and the <TT><access></TT> part specifies the access granted. Multiple <TT><who> <access> <control></TT> triplets are supported, allowing many entities to be granted different access to the same set of entries and attributes. Not all of these access control options are described here; for more details see the <EM>slapd.access</EM>(5) man page.</P> +<H3><A NAME="What to control access to">8.3.1. What to control access to</A></H3> +<P>The <what> part of an access specification determines the entries and attributes to which the access control applies. Entries are commonly selected in two ways: by DN and by filter. The following qualifiers select entries by DN:</P> +<PRE> + to * + to dn[.<basic-style>]=<regex> + to dn.<scope-style>=<DN> +</PRE> +<P>The first form is used to select all entries. The second form may be used to select entries by matching a regular expression against the target entry's <EM>normalized DN</EM>. (The second form is not discussed further in this document.) The third form is used to select entries which are within the requested scope of DN. The <DN> is a string representation of the Distinguished Name, as described in <A HREF="http://www.rfc-editor.org/rfc/rfc4514.txt">RFC4514</A>.</P> +<P>The scope can be either <TT>base</TT>, <TT>one</TT>, <TT>subtree</TT>, or <TT>children</TT>. Where <TT>base</TT> matches only the entry with provided DN, <TT>one</TT> matches the entries whose parent is the provided DN, <TT>subtree</TT> matches all entries in the subtree whose root is the provided DN, and <TT>children</TT> matches all entries under the DN (but not the entry named by the DN).</P> +<P>For example, if the directory contained entries named:</P> +<PRE> + 0: o=suffix + 1: cn=Manager,o=suffix + 2: ou=people,o=suffix + 3: uid=kdz,ou=people,o=suffix + 4: cn=addresses,uid=kdz,ou=people,o=suffix + 5: uid=hyc,ou=people,o=suffix +</PRE> +<P>Then:</P> +<UL> +<TT>dn.base="ou=people,o=suffix"</TT> match 2; +<BR> +<TT>dn.one="ou=people,o=suffix"</TT> match 3, and 5; +<BR> +<TT>dn.subtree="ou=people,o=suffix"</TT> match 2, 3, 4, and 5; and +<BR> +<TT>dn.children="ou=people,o=suffix"</TT> match 3, 4, and 5.</UL> +<P>Entries may also be selected using a filter:</P> +<PRE> + to filter=<ldap filter> +</PRE> +<P>where <ldap filter> is a string representation of an LDAP search filter, as described in <A HREF="http://www.rfc-editor.org/rfc/rfc4515.txt">RFC4515</A>. For example:</P> +<PRE> + to filter=(objectClass=person) +</PRE> +<P>Note that entries may be selected by both DN and filter by including both qualifiers in the <what> clause.</P> +<PRE> + to dn.one="ou=people,o=suffix" filter=(objectClass=person) +</PRE> +<P>Attributes within an entry are selected by including a comma-separated list of attribute names in the <what> selector:</P> +<PRE> + attrs=<attribute list> +</PRE> +<P>A specific value of an attribute is selected by using a single attribute name and also using a value selector:</P> +<PRE> + attrs=<attribute> val[.<style>]=<regex> +</PRE> +<P>There are two special <EM>pseudo</EM> attributes <TT>entry</TT> and <TT>children</TT>. To read (and hence return) a target entry, the subject must have <TT>read</TT> access to the target's <EM>entry</EM> attribute. To perform a search, the subject must have <TT>search</TT> access to the search base's <EM>entry</EM> attribute. To add or delete an entry, the subject must have <TT>write</TT> access to the entry's <TT>entry</TT> attribute AND must have <TT>write</TT> access to the entry's parent's <TT>children</TT> attribute. To rename an entry, the subject must have <TT>write</TT> access to entry's <TT>entry</TT> attribute AND have <TT>write</TT> access to both the old parent's and new parent's <TT>children</TT> attributes. The complete examples at the end of this section should help clear things up.</P> +<P>Lastly, there is a special entry selector <TT>"*"</TT> that is used to select any entry. It is used when no other <TT><what></TT> selector has been provided. It's equivalent to "<TT>dn=.*</TT>"</P> +<H3><A NAME="Who to grant access to">8.3.2. Who to grant access to</A></H3> +<P>The <who> part identifies the entity or entities being granted access. Note that access is granted to "entities" not "entries." The following table summarizes entity specifiers:</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 5.3: Access Entity Specifiers</CAPTION> +<TR CLASS="heading"> +<TD> +<STRONG>Specifier</STRONG> +</TD> +<TD> +<STRONG>Entities</STRONG> +</TD> +</TR> +<TR> +<TD> +<TT>*</TT> +</TD> +<TD> +All, including anonymous and authenticated users +</TD> +</TR> +<TR> +<TD> +<TT>anonymous</TT> +</TD> +<TD> +Anonymous (non-authenticated) users +</TD> +</TR> +<TR> +<TD> +<TT>users</TT> +</TD> +<TD> +Authenticated users +</TD> +</TR> +<TR> +<TD> +<TT>self</TT> +</TD> +<TD> +User associated with target entry +</TD> +</TR> +<TR> +<TD> +<TT>dn[.<basic-style>]=<regex></TT> +</TD> +<TD> +Users matching a regular expression +</TD> +</TR> +<TR> +<TD> +<TT>dn.<scope-style>=<DN></TT> +</TD> +<TD> +Users within scope of a DN +</TD> +</TR> +</TABLE> + +<P>The DN specifier behaves much like <what> clause DN specifiers.</P> +<P>Other control factors are also supported. For example, a <TT><who></TT> can be restricted by an entry listed in a DN-valued attribute in the entry to which the access applies:</P> +<PRE> + dnattr=<dn-valued attribute name> +</PRE> +<P>The dnattr specification is used to give access to an entry whose DN is listed in an attribute of the entry (e.g., give access to a group entry to whoever is listed as the owner of the group entry).</P> +<P>Some factors may not be appropriate in all environments (or any). For example, the domain factor relies on IP to domain name lookups. As these can easily be spoofed, the domain factor should be avoided.</P> +<H3><A NAME="The access to grant">8.3.3. The access to grant</A></H3> +<P>The kind of <access> granted can be one of the following:</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 5.4: Access Levels</CAPTION> +<TR CLASS="heading"> +<TD ALIGN='Left'> +<STRONG>Level</STRONG> +</TD> +<TD ALIGN='Right'> +<STRONG>Privileges</STRONG> +</TD> +<TD ALIGN='Left'> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>none</TT> +</TD> +<TD ALIGN='Right'> +<TT>=0</TT> +</TD> +<TD ALIGN='Left'> +no access +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>disclose</TT> +</TD> +<TD ALIGN='Right'> +<TT>=d</TT> +</TD> +<TD ALIGN='Left'> +needed for information disclosure on error +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>auth</TT> +</TD> +<TD ALIGN='Right'> +<TT>=dx</TT> +</TD> +<TD ALIGN='Left'> +needed to authenticate (bind) +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>compare</TT> +</TD> +<TD ALIGN='Right'> +<TT>=cdx</TT> +</TD> +<TD ALIGN='Left'> +needed to compare +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>search</TT> +</TD> +<TD ALIGN='Right'> +<TT>=scdx</TT> +</TD> +<TD ALIGN='Left'> +needed to apply search filters +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>read</TT> +</TD> +<TD ALIGN='Right'> +<TT>=rscdx</TT> +</TD> +<TD ALIGN='Left'> +needed to read search results +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>write</TT> +</TD> +<TD ALIGN='Right'> +<TT>=wrscdx</TT> +</TD> +<TD ALIGN='Left'> +needed to modify/rename +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>manage</TT> +</TD> +<TD ALIGN='Right'> +<TT>=mwrscdx</TT> +</TD> +<TD ALIGN='Left'> +needed to manage +</TD> +</TR> +</TABLE> + +<P>Each level implies all lower levels of access. So, for example, granting someone <TT>write</TT> access to an entry also grants them <TT>read</TT>, <TT>search</TT>, <TT>compare</TT>, <TT>auth</TT> and <TT>disclose</TT> access. However, one may use the privileges specifier to grant specific permissions.</P> +<H3><A NAME="Access Control Evaluation">8.3.4. Access Control Evaluation</A></H3> +<P>When evaluating whether some requester should be given access to an entry and/or attribute, slapd compares the entry and/or attribute to the <TT><what></TT> selectors given in the configuration. For each entry, access controls provided in the database which holds the entry (or the global access directives if not held in any database) apply first, followed by the global access directives (which are held in the <TT>frontend</TT> database definition). However, when dealing with an access list, because the global access list is effectively appended to each per-database list, if the resulting list is non-empty then the access list will end with an implicit <TT>access to * by * none</TT> directive. If there are no access directives applicable to a backend, then a default read is used.</P> +<P>Within this priority, access directives are examined in the order in which they appear in the configuration attribute. Slapd stops with the first <TT><what></TT> selector that matches the entry and/or attribute. The corresponding access directive is the one slapd will use to evaluate access.</P> +<P>Next, slapd compares the entity requesting access to the <TT><who></TT> selectors within the access directive selected above in the order in which they appear. It stops with the first <TT><who></TT> selector that matches the requester. This determines the access the entity requesting access has to the entry and/or attribute.</P> +<P>Finally, slapd compares the access granted in the selected <TT><access></TT> clause to the access requested by the client. If it allows greater or equal access, access is granted. Otherwise, access is denied.</P> +<P>The order of evaluation of access directives makes their placement in the configuration file important. If one access directive is more specific than another in terms of the entries it selects, it should appear first in the configuration. Similarly, if one <TT><who></TT> selector is more specific than another it should come first in the access directive. The access control examples given below should help make this clear.</P> +<H3><A NAME="Access Control Examples">8.3.5. Access Control Examples</A></H3> +<P>The access control facility described above is quite powerful. This section shows some examples of its use for descriptive purposes.</P> +<P>A simple example:</P> +<PRE> + olcAccess: to * by * read +</PRE> +<P>This access directive grants read access to everyone.</P> +<PRE> + olcAccess: to * + by self write + by anonymous auth + by * read +</PRE> +<P>This directive allows the user to modify their entry, allows anonymous to authenticate against these entries, and allows all others to read these entries. Note that only the first <TT>by <who></TT> clause which matches applies. Hence, the anonymous users are granted <TT>auth</TT>, not <TT>read</TT>. The last clause could just as well have been "<TT>by users read</TT>".</P> +<P>It is often desirable to restrict operations based upon the level of protection in place. The following shows how security strength factors (SSF) can be used.</P> +<PRE> + olcAccess: to * + by ssf=128 self write + by ssf=64 anonymous auth + by ssf=64 users read +</PRE> +<P>This directive allows users to modify their own entries if security protections of strength 128 or better have been established, allows authentication access to anonymous users, and read access when strength 64 or better security protections have been established. If the client has not establish sufficient security protections, the implicit <TT>by * none</TT> clause would be applied.</P> +<P>The following example shows the use of style specifiers to select the entries by DN in two access directives where ordering is significant.</P> +<PRE> + olcAccess: to dn.children="dc=example,dc=com" + by * search + olcAccess: to dn.children="dc=com" + by * read +</PRE> +<P>Read access is granted to entries under the <TT>dc=com</TT> subtree, except for those entries under the <TT>dc=example,dc=com</TT> subtree, to which search access is granted. No access is granted to <TT>dc=com</TT> as neither access directive matches this DN. If the order of these access directives was reversed, the trailing directive would never be reached, since all entries under <TT>dc=example,dc=com</TT> are also under <TT>dc=com</TT> entries.</P> +<P>Also note that if no <TT>olcAccess: to</TT> directive matches or no <TT>by <who></TT> clause, <B>access is denied</B>. When dealing with an access list, because the global access list is effectively appended to each per-database list, if the resulting list is non-empty then the access list will end with an implicit <TT>access to * by * none</TT> directive. If there are no access directives applicable to a backend, then a default read is used.</P> +<P>The next example again shows the importance of ordering, both of the access directives and the <TT>by <who></TT> clauses. It also shows the use of an attribute selector to grant access to a specific attribute and various <TT><who></TT> selectors.</P> +<PRE> + olcAccess: to dn.subtree="dc=example,dc=com" attrs=homePhone + by self write + by dn.children=dc=example,dc=com" search + by peername.regex=IP=10\..+ read + olcAccess: to dn.subtree="dc=example,dc=com" + by self write + by dn.children="dc=example,dc=com" search + by anonymous auth +</PRE> +<P>This example applies to entries in the "<TT>dc=example,dc=com</TT>" subtree. To all attributes except <TT>homePhone</TT>, an entry can write to itself, entries under <TT>example.com</TT> entries can search by them, anybody else has no access (implicit <TT>by * none</TT>) excepting for authentication/authorization (which is always done anonymously). The <TT>homePhone</TT> attribute is writable by the entry, searchable by entries under <TT>example.com</TT>, readable by clients connecting from network 10, and otherwise not readable (implicit <TT>by * none</TT>). All other access is denied by the implicit <TT>access to * by * none</TT>.</P> +<P>Sometimes it is useful to permit a particular DN to add or remove itself from an attribute. For example, if you would like to create a group and allow people to add and remove only their own DN from the member attribute, you could accomplish it with an access directive like this:</P> +<PRE> + olcAccess: to attrs=member,entry + by dnattr=member selfwrite +</PRE> +<P>The dnattr <TT><who></TT> selector says that the access applies to entries listed in the <TT>member</TT> attribute. The <TT>selfwrite</TT> access selector says that such members can only add or delete their own DN from the attribute, not other values. The addition of the entry attribute is required because access to the entry is required to access any of the entry's attributes.</P> +<H3><A NAME="Access Control Ordering">8.3.6. Access Control Ordering</A></H3> +<P>Since the ordering of <TT>olcAccess</TT> directives is essential to their proper evaluation, but LDAP attributes normally do not preserve the ordering of their values, OpenLDAP uses a custom schema extension to maintain a fixed ordering of these values. This ordering is maintained by prepending a <TT>"{X}"</TT> numeric index to each value, similarly to the approach used for ordering the configuration entries. These index tags are maintained automatically by slapd and do not need to be specified when originally defining the values. For example, when you create the settings</P> +<PRE> + olcAccess: to attrs=member,entry + by dnattr=member selfwrite + olcAccess: to dn.children="dc=example,dc=com" + by * search + olcAccess: to dn.children="dc=com" + by * read +</PRE> +<P>when you read them back using slapcat or ldapsearch they will contain</P> +<PRE> + olcAccess: {0}to attrs=member,entry + by dnattr=member selfwrite + olcAccess: {1}to dn.children="dc=example,dc=com" + by * search + olcAccess: {2}to dn.children="dc=com" + by * read +</PRE> +<P>The numeric index may be used to specify a particular value to change when using ldapmodify to edit the access rules. This index can be used instead of (or in addition to) the actual access value. Using this numeric index is very helpful when multiple access rules are being managed.</P> +<P>For example, if we needed to change the second rule above to grant write access instead of search, we could try this LDIF:</P> +<PRE> + changetype: modify + delete: olcAccess + olcAccess: to dn.children="dc=example,dc=com" by * search + - + add: olcAccess + olcAccess: to dn.children="dc=example,dc=com" by * write + - +</PRE> +<P>But this example <B>will not</B> guarantee that the existing values remain in their original order, so it will most likely yield a broken security configuration. Instead, the numeric index should be used:</P> +<PRE> + changetype: modify + delete: olcAccess + olcAccess: {1} + - + add: olcAccess + olcAccess: {1}to dn.children="dc=example,dc=com" by * write + - +</PRE> +<P>This example deletes whatever rule is in value #1 of the <TT>olcAccess</TT> attribute (regardless of its value) and adds a new value that is explicitly inserted as value #1. The result will be</P> +<PRE> + olcAccess: {0}to attrs=member,entry + by dnattr=member selfwrite + olcAccess: {1}to dn.children="dc=example,dc=com" + by * write + olcAccess: {2}to dn.children="dc=com" + by * read +</PRE> +<P>which is exactly what was intended.</P> +<H2><A NAME="Access Control Common Examples">8.4. Access Control Common Examples</A></H2> +<H3><A NAME="Basic ACLs">8.4.1. Basic ACLs</A></H3> +<P>Generally one should start with some basic ACLs such as:</P> +<PRE> + access to attrs=userPassword + by self =xw + by anonymous auth + by * none + + + access to * + by self write + by users read + by * none +</PRE> +<P>The first ACL allows users to update (but not read) their passwords, anonymous users to authenticate against this attribute, and (implicitly) denying all access to others.</P> +<P>The second ACL allows users full access to their entry, authenticated users read access to anything, and (implicitly) denying all access to others (in this case, anonymous users).</P> +<H3><A NAME="Matching Anonymous and Authenticated users">8.4.2. Matching Anonymous and Authenticated users</A></H3> +<P>An anonymous user has a empty DN. While the <EM>dn.exact=""</EM> or <EM>dn.regex="^$"</EM> could be used, <EM>slapd</EM>(8)) offers an anonymous shorthand which should be used instead.</P> +<PRE> + access to * + by anonymous none + by * read +</PRE> +<P>denies all access to anonymous users while granting others read.</P> +<P>Authenticated users have a subject DN. While <EM>dn.regex=".+"</EM> will match any authenticated user, OpenLDAP provides the users short hand which should be used instead.</P> +<PRE> + access to * + by users read + by * none +</PRE> +<P>This ACL grants read permissions to authenticated users while denying others (i.e.: anonymous users).</P> +<H3><A NAME="Controlling rootdn access">8.4.3. Controlling rootdn access</A></H3> +<P>You could specify the <EM>rootdn</EM> in <EM>slapd.conf</EM>(5) or <EM>slapd.d</EM> without specifying a <EM>rootpw</EM>. Then you have to add an actual directory entry with the same dn, e.g.:</P> +<PRE> + dn: cn=Manager,o=MyOrganization + cn: Manager + sn: Manager + objectClass: person + objectClass: top + userPassword: {SSHA}someSSHAdata +</PRE> +<P>Then binding as the <EM>rootdn</EM> will require a regular bind to that DN, which in turn requires auth access to that entry's DN and <EM>userPassword</EM>, and this can be restricted via ACLs. E.g.:</P> +<PRE> + access to dn.base="cn=Manager,o=MyOrganization" + by peername.regex=127\.0\.0\.1 auth + by peername.regex=192\.168\.0\..* auth + by users none + by * none +</PRE> +<P>The ACLs above will only allow binding using rootdn from localhost and 192.168.0.0/24.</P> +<H3><A NAME="Managing access with Groups">8.4.4. Managing access with Groups</A></H3> +<P>There are a few ways to do this. One approach is illustrated here. Consider the following DIT layout:</P> +<PRE> + +-dc=example,dc=com + +---cn=administrators,dc=example,dc=com + +---cn=fred blogs,dc=example,dc=com +</PRE> +<P>and the following group object (in LDIF format):</P> +<PRE> + dn: cn=administrators,dc=example,dc=com + cn: administrators of this region + objectclass: groupOfNames (important for the group acl feature) + member: cn=fred blogs,dc=example,dc=com + member: cn=somebody else,dc=example,dc=com +</PRE> +<P>One can then grant access to the members of this this group by adding appropriate <EM>by group</EM> clause to an access directive in <EM>slapd.conf</EM>(5). For instance,</P> +<PRE> + access to dn.children="dc=example,dc=com" + by self write + by group.exact="cn=Administrators,dc=example,dc=com" write + by * auth +</PRE> +<P>Like by <EM>dn</EM> clauses, one can also use <EM>expand</EM> to expand the group name based upon the regular expression matching of the target, that is, the to <EM>dn.regex</EM>). For instance,</P> +<PRE> + access to dn.regex="(.+,)?ou=People,(dc=[^,]+,dc=[^,]+)$" + attrs=children,entry,uid + by group.expand="cn=Managers,$2" write + by users read + by * auth +</PRE> +<P>The above illustration assumed that the group members are to be found in the <EM>member</EM> attribute type of the <EM>groupOfNames</EM> object class. If you need to use a different group object and/or a different attribute type then use the following <EM>slapd.conf</EM>(5) (abbreviated) syntax:</P> +<PRE> + access to <what> + by group/<objectclass>/<attributename>=<DN> <access> +</PRE> +<P>For example:</P> +<PRE> + access to * + by group/organizationalRole/roleOccupant="cn=Administrator,dc=example,dc=com" write +</PRE> +<P>In this case, we have an ObjectClass <EM>organizationalRole</EM> which contains the administrator DN's in the <EM>roleOccupant</EM> attribute. For instance:</P> +<PRE> + dn: cn=Administrator,dc=example,dc=com + cn: Administrator + objectclass: organizationalRole + roleOccupant: cn=Jane Doe,dc=example,dc=com +</PRE> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>the specified member attribute type MUST be of DN or <EM>NameAndOptionalUID</EM> syntax, and the specified object class SHOULD allow the attribute type. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>Dynamic Groups are also supported in Access Control. Please see <EM>slapo-dynlist</EM>(5) and the <A HREF="#Dynamic Lists">Dynamic Lists</A> overlay section.</P> +<H3><A NAME="Granting access to a subset of attributes">8.4.5. Granting access to a subset of attributes</A></H3> +<P>You can grant access to a set of attributes by specifying a list of attribute names in the ACL <EM>to</EM> clause. To be useful, you also need to grant access to the <EM>entry</EM> itself. Also note how <EM>children</EM> controls the ability to add, delete, and rename entries.</P> +<PRE> + # mail: self may write, authenticated users may read + access to attrs=mail + by self write + by users read + by * none + + # cn, sn: self my write, all may read + access to attrs=cn,sn + by self write + by * read + + # immediate children: only self can add/delete entries under this entry + access to attrs=children + by self write + + # entry itself: self may write, all may read + access to attrs=entry + by self write + by * read + + # other attributes: self may write, others have no access + access to * + by self write + by * none +</PRE> +<P>ObjectClass names may also be specified in this list, which will affect all the attributes that are required and/or allowed by that <EM>objectClass</EM>. Actually, names in <EM>attrlist</EM> that are prefixed by <EM>@</EM> are directly treated as objectClass names. A name prefixed by <EM>!</EM> is also treated as an objectClass, but in this case the access rule affects the attributes that are not required nor allowed by that <EM>objectClass</EM>.</P> +<H3><A NAME="Allowing a user write to all entries below theirs">8.4.6. Allowing a user write to all entries below theirs</A></H3> +<P>For a setup where a user can write to its own record and to all of its children:</P> +<PRE> + access to dn.regex="(.+,)?(uid=[^,]+,o=Company)$" + by dn.exact,expand="$2" write + by anonymous auth +</PRE> +<P>(Add more examples for above)</P> +<H3><A NAME="Allowing entry creation">8.4.7. Allowing entry creation</A></H3> +<P>Let's say, you have it like this:</P> +<PRE> + o=<basedn> + ou=domains + associatedDomain=<somedomain> + ou=users + uid=<someuserid> + uid=<someotheruserid> + ou=addressbooks + uid=<someuserid> + cn=<someone> + cn=<someoneelse> +</PRE> +<P>and, for another domain <someotherdomain>:</P> +<PRE> + o=<basedn> + ou=domains + associatedDomain=<someotherdomain> + ou=users + uid=<someuserid> + uid=<someotheruserid> + ou=addressbooks + uid=<someotheruserid> + cn=<someone> + cn=<someoneelse> +</PRE> +<P>then, if you wanted user <EM>uid=<someuserid></EM> to <B>ONLY</B> create an entry for its own thing, you could write an ACL like this:</P> +<PRE> + # this rule lets users of "associatedDomain=<matcheddomain>" + # write under "ou=addressbook,associatedDomain=<matcheddomain>,ou=domains,o=<basedn>", + # i.e. a user can write ANY entry below its domain's address book; + # this permission is necessary, but not sufficient, the next + # will restrict this permission further + + + access to dn.regex="^ou=addressbook,associatedDomain=([^,]+),ou=domains,o=<basedn>$" attrs=children + by dn.regex="^uid=([^,]+),ou=users,associatedDomain=$1,ou=domains,o=<basedn>$$" write + by * none + + + # Note that above the "by" clause needs a "regex" style to make sure + # it expands to a DN that starts with a "uid=<someuserid>" pattern + # while substituting the associatedDomain submatch from the "what" clause. + + + # This rule lets a user with "uid=<matcheduid>" of "<associatedDomain=matcheddomain>" + # write (i.e. add, modify, delete) the entry whose DN is exactly + # "uid=<matcheduid>,ou=addressbook,associatedDomain=<matcheddomain>,ou=domains,o=<basedn>" + # and ANY entry as subtree of it + + + access to dn.regex="^(.+,)?uid=([^,]+),ou=addressbook,associatedDomain=([^,]+),ou=domains,o=<basedn>$" + by dn.exact,expand="uid=$2,ou=users,associatedDomain=$3,ou=domains,o=<basedn>" write + by * none + + + # Note that above the "by" clause uses the "exact" style with the "expand" + # modifier because now the whole pattern can be rebuilt by means of the + # submatches from the "what" clause, so a "regex" compilation and evaluation + # is no longer required. +</PRE> +<H3><A NAME="Tips for using regular expressions in Access Control">8.4.8. Tips for using regular expressions in Access Control</A></H3> +<P>Always use <EM>dn.regex=<pattern></EM> when you intend to use regular expression matching. <EM>dn=<pattern></EM> alone defaults to <EM>dn.exact<pattern></EM>.</P> +<P>Use <EM>(.+)</EM> instead of <EM>(.*)</EM> when you want at least one char to be matched. <EM>(.*)</EM> matches the empty string as well.</P> +<P>Don't use regular expressions for matches that can be done otherwise in a safer and cheaper manner. Examples:</P> +<PRE> + dn.regex=".*dc=example,dc=com" +</PRE> +<P>is unsafe and expensive:</P> +<UL> +<LI>unsafe because any string containing <EM>dc=example,dc=com </EM>will match, not only those that end with the desired pattern; use <EM>.*dc=example,dc=com$</EM> instead. +<LI>unsafe also because it would allow any <EM>attributeType</EM> ending with <EM>dc</EM> as naming attribute for the first RDN in the string, e.g. a custom attributeType <EM>mydc</EM> would match as well. If you really need a regular expression that allows just <EM>dc=example,dc=com</EM> or any of its subtrees, use <EM>^(.+,)?dc=example,dc=com$</EM>, which means: anything to the left of dc=..., if any (the question mark after the pattern within brackets), must end with a comma; +<LI>expensive because if you don't need submatches, you could use scoping styles, e.g.</UL> +<PRE> + dn.subtree="dc=example,dc=com" +</PRE> +<P>to include <EM>dc=example,dc=com</EM> in the matching patterns,</P> +<PRE> + dn.children="dc=example,dc=com" +</PRE> +<P>to exclude <EM>dc=example,dc=com</EM> from the matching patterns, or</P> +<PRE> + dn.onelevel="dc=example,dc=com" +</PRE> +<P>to allow exactly one sublevel matches only.</P> +<P>Always use <EM>^</EM> and <EM>$</EM> in regexes, whenever appropriate, because <EM>ou=(.+),ou=(.+),ou=addressbooks,o=basedn</EM> will match <EM>something=bla,ou=xxx,ou=yyy,ou=addressbooks,o=basedn,ou=addressbooks,o=basedn,dc=some,dc=org</EM></P> +<P>Always use <EM>([^,]+)</EM> to indicate exactly one RDN, because <EM>(.+)</EM> can include any number of RDNs; e.g. <EM>ou=(.+),dc=example,dc=com</EM> will match <EM>ou=My,o=Org,dc=example,dc=com</EM>, which might not be what you want.</P> +<P>Never add the rootdn to the by clauses. ACLs are not even processed for operations performed with rootdn identity (otherwise there would be no reason to define a rootdn at all).</P> +<P>Use shorthands. The user directive matches authenticated users and the anonymous directive matches anonymous users.</P> +<P>Don't use the <EM>dn.regex</EM> form for <by> clauses if all you need is scoping and/or substring replacement; use scoping styles (e.g. <EM>exact</EM>, <EM>onelevel</EM>, <EM>children</EM> or <EM>subtree</EM>) and the style modifier expand to cause substring expansion.</P> +<P>For instance,</P> +<PRE> + access to dn.regex=".+,dc=([^,]+),dc=([^,]+)$" + by dn.regex="^[^,],ou=Admin,dc=$1,dc=$2$$" write +</PRE> +<P>although correct, can be safely and efficiently replaced by</P> +<PRE> + access to dn.regex=".+,(dc=[^,]+,dc=[^,]+)$" + by dn.onelevel,expand="ou=Admin,$1" write +</PRE> +<P>where the regex in the <EM><what></EM> clause is more compact, and the one in the <EM><by></EM> clause is replaced by a much more efficient scoping style of onelevel with substring expansion.</P> +<H3><A NAME="Granting and Denying access based on security strength factors (ssf)">8.4.9. Granting and Denying access based on security strength factors (ssf)</A></H3> +<P>You can restrict access based on the security strength factor (SSF)</P> +<PRE> + access to dn="cn=example,cn=edu" + by * ssf=256 read +</PRE> +<P>0 (zero) implies no protection, 1 implies integrity protection only, 56 DES or other weak ciphers, 112 triple DES and other strong ciphers, 128 RC4, Blowfish and other modern strong ciphers.</P> +<P>Other possibilities:</P> +<PRE> + transport_ssf=<n> + tls_ssf=<n> + sasl_ssf=<n> +</PRE> +<P>256 is recommended.</P> +<P>See <EM>slapd.conf</EM>(5) for information on <EM>ssf</EM>.</P> +<H3><A NAME="When things aren\'t working as expected">8.4.10. When things aren't working as expected</A></H3> +<P>Consider this example:</P> +<PRE> + access to * + by anonymous auth + + access to * + by self write + + access to * + by users read +</PRE> +<P>You may think this will allow any user to login, to read everything and change his own data if he is logged in. But in this example only the login works and an ldapsearch returns no data. The Problem is that SLAPD goes through its access config line by line and stops as soon as it finds a match in the part of the access rule.(here: <EM>to *</EM>)</P> +<P>To get what we wanted the file has to read:</P> +<PRE> + access to * + by anonymous auth + by self write + by users read +</PRE> +<P>The general rule is: "special access rules first, generic access rules last"</P> +<P>See also <EM>slapd.access</EM>(5), loglevel 128 and <EM>slapacl</EM>(8) for debugging information.</P> +<H2><A NAME="Sets - Granting rights based on relationships">8.5. Sets - Granting rights based on relationships</A></H2> +<P>Sets are best illustrated via examples. The following sections will present a few set ACL examples in order to facilitate their understanding.</P> +<P>(Sets in Access Controls FAQ Entry: <A HREF="http://www.openldap.org/faq/data/cache/1133.html">http://www.openldap.org/faq/data/cache/1133.html</A>)</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Sets are considered experimental. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="Groups of Groups">8.5.1. Groups of Groups</A></H3> +<P>The OpenLDAP ACL for groups doesn't expand groups within groups, which are groups that have another group as a member. For example:</P> +<PRE> + dn: cn=sudoadm,ou=group,dc=example,dc=com + cn: sudoadm + objectClass: groupOfNames + member: uid=john,ou=people,dc=example,dc=com + member: cn=accountadm,ou=group,dc=example,dc=com + + dn: cn=accountadm,ou=group,dc=example,dc=com + cn: accountadm + objectClass: groupOfNames + member: uid=mary,ou=people,dc=example,dc=com +</PRE> +<P>If we use standard group ACLs with the above entries and allow members of the <TT>sudoadm</TT> group to write somewhere, <TT>mary</TT> won't be included:</P> +<PRE> + access to dn.subtree="ou=sudoers,dc=example,dc=com" + by group.exact="cn=sudoadm,ou=group,dc=example,dc=com" write + by * read +</PRE> +<P>With sets we can make the ACL be recursive and consider group within groups. So for each member that is a group, it is further expanded:</P> +<PRE> + access to dn.subtree="ou=sudoers,dc=example,dc=com" + by set="[cn=sudoadm,ou=group,dc=example,dc=com]/member* & user" write + by * read +</PRE> +<P>This set ACL means: take the <TT>cn=sudoadm</TT> DN, check its <TT>member</TT> attribute(s) (where the "<TT>*</TT>" means recursively) and intersect the result with the authenticated user's DN. If the result is non-empty, the ACL is considered a match and write access is granted.</P> +<P>The following drawing explains how this set is built:</P> +<P><CENTER><IMG SRC="set-recursivegroup.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure X.Y: Populating a recursive group set</P> +<P>First we get the <TT>uid=john</TT> DN. This entry doesn't have a <TT>member</TT> attribute, so the expansion stops here. Now we get to <TT>cn=accountadm</TT>. This one does have a <TT>member</TT> attribute, which is <TT>uid=mary</TT>. The <TT>uid=mary</TT> entry, however, doesn't have member, so we stop here again. The end comparison is:</P> +<PRE> + {"uid=john,ou=people,dc=example,dc=com","uid=mary,ou=people,dc=example,dc=com"} & user +</PRE> +<P>If the authenticated user's DN is any one of those two, write access is granted. So this set will include <TT>mary</TT> in the <TT>sudoadm</TT> group and she will be allowed the write access.</P> +<H3><A NAME="Group ACLs without DN syntax">8.5.2. Group ACLs without DN syntax</A></H3> +<P>The traditional group ACLs, and even the previous example about recursive groups, require that the members are specified as DNs instead of just usernames.</P> +<P>With sets, however, it's also possible to use simple names in group ACLs, as this example will show.</P> +<P>Let's say we want to allow members of the <TT>sudoadm</TT> group to write to the <TT>ou=suders</TT> branch of our tree. But our group definition now is using <TT>memberUid</TT> for the group members:</P> +<PRE> + dn: cn=sudoadm,ou=group,dc=example,dc=com + cn: sudoadm + objectClass: posixGroup + gidNumber: 1000 + memberUid: john +</PRE> +<P>With this type of group, we can't use group ACLs. But with a set ACL we can grant the desired access:</P> +<PRE> + access to dn.subtree="ou=sudoers,dc=example,dc=com" + by set="[cn=sudoadm,ou=group,dc=example,dc=com]/memberUid & user/uid" write + by * read +</PRE> +<P>We use a simple intersection where we compare the <TT>uid</TT> attribute of the connecting (and authenticated) user with the <TT>memberUid</TT> attributes of the group. If they match, the intersection is non-empty and the ACL will grant write access.</P> +<P>This drawing illustrates this set when the connecting user is authenticated as <TT>uid=john,ou=people,dc=example,dc=com</TT>:</P> +<P><CENTER><IMG SRC="set-memberUid.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure X.Y: Sets with <TT>memberUid</TT></P> +<P>In this case, it's a match. If it were <TT>mary</TT> authenticating, however, she would be denied write access to <TT>ou=sudoers</TT> because her <TT>uid</TT> attribute is not listed in the group's <TT>memberUid</TT>.</P> +<H3><A NAME="Following references">8.5.3. Following references</A></H3> +<P>We will now show a quite powerful example of what can be done with sets. This example tends to make OpenLDAP administrators smile after they have understood it and its implications.</P> +<P>Let's start with an user entry:</P> +<PRE> + dn: uid=john,ou=people,dc=example,dc=com + uid: john + objectClass: inetOrgPerson + givenName: John + sn: Smith + cn: john + manager: uid=mary,ou=people,dc=example,dc=com +</PRE> +<P>Writing an ACL to allow the manager to update some attributes is quite simple using sets:</P> +<PRE> + access to dn.exact="uid=john,ou=people,dc=example,dc=com" + attrs=carLicense,homePhone,mobile,pager,telephoneNumber + by self write + by set="this/manager & user" write + by * read +</PRE> +<P>In that set, <TT>this</TT> expands to the entry being accessed, so that <TT>this/manager</TT> expands to <TT>uid=mary,ou=people,dc=example,dc=com</TT> when john's entry is accessed. If the manager herself is accessing John's entry, the ACL will match and write access to those attributes will be granted.</P> +<P>So far, this same behavior can be obtained with the <TT>dnattr</TT> keyword. With sets, however, we can further enhance this ACL. Let's say we want to allow the secretary of the manager to also update these attributes. This is how we do it:</P> +<PRE> + access to dn.exact="uid=john,ou=people,dc=example,dc=com" + attrs=carLicense,homePhone,mobile,pager,telephoneNumber + by self write + by set="this/manager & user" write + by set="this/manager/secretary & user" write + by * read +</PRE> +<P>Now we need a picture to help explain what is happening here (entries shortened for clarity):</P> +<P><CENTER><IMG SRC="set-following-references.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure X.Y: Sets jumping through entries</P> +<P>In this example, Jane is the secretary of Mary, which is the manager of John. This whole relationship is defined with the <TT>manager</TT> and <TT>secretary</TT> attributes, which are both of the distinguishedName syntax (i.e., full DNs). So, when the <TT>uid=john</TT> entry is being accessed, the <TT>this/manager/secretary</TT> set becomes <TT>{"uid=jane,ou=people,dc=example,dc=com"</TT>} (follow the references in the picture):</P> +<PRE> + this = [uid=john,ou=people,dc=example,dc=com] + this/manager = \ + [uid=john,ou=people,dc=example,dc=com]/manager = uid=mary,ou=people,dc=example,dc=com + this/manager/secretary = \ + [uid=mary,ou=people,dc=example,dc=com]/secretary = uid=jane,ou=people,dc=example,dc=com +</PRE> +<P>The end result is that when Jane accesses John's entry, she will be granted write access to the specified attributes. Better yet, this will happen to any entry she accesses which has Mary as the manager.</P> +<P>This is all cool and nice, but perhaps gives too much power to secretaries. Maybe we need to further restrict it. For example, let's only allow executive secretaries to have this power:</P> +<PRE> + access to dn.exact="uid=john,ou=people,dc=example,dc=com" + attrs=carLicense,homePhone,mobile,pager,telephoneNumber + by self write + by set="this/manager & user" write + by set="this/manager/secretary & + [cn=executive,ou=group,dc=example,dc=com]/member* & + user" write + by * read +</PRE> +<P>It's almost the same ACL as before, but we now also require that the connecting user be a member of the (possibly nested) <TT>cn=executive</TT> group.</P> +<P></P> +<HR> +<H1><A NAME="Limits">9. Limits</A></H1> +<H2><A NAME="Introduction">9.1. Introduction</A></H2> +<P>It is usually desirable to limit the server resources that can be consumed by each LDAP client. OpenLDAP provides two sets of limits: a size limit, which can restrict the <EM>number</EM> of entries that a client can retrieve in a single operation, and a time limit which restricts the length of time that an operation may continue. Both types of limit can be given different values depending on who initiated the operation.</P> +<H2><A NAME="Soft and Hard limits">9.2. Soft and Hard limits</A></H2> +<P>The server administrator can specify both <EM>soft limits</EM> and <EM>hard limits</EM>. Soft limits can be thought of as being the default limit value. Hard limits cannot be exceeded by ordinary LDAP users.</P> +<P>LDAP clients can specify their own size and time limits when issuing search operations. This feature has been present since the earliest version of X.500.</P> +<P>If the client specifies a limit then the lower of the requested value and the <EM>hard limit</EM> will become the limit for the operation.</P> +<P>If the client does not specify a limit then the server applies the <EM>soft limit</EM>.</P> +<P>Soft and Hard limits are often referred to together as <EM>administrative limits</EM>. Thus, if an LDAP client requests a search that would return more results than the limits allow it will get an <EM>adminLimitExceeded</EM> error. Note that the server will usually return some results even if the limit has been exceeded: this feature is useful to clients that just want to check for the existence of some entries without needing to see them all.</P> +<P>The <EM>rootdn</EM> is not subject to any limits.</P> +<H2><A NAME="Global Limits">9.3. Global Limits</A></H2> +<P>Limits specified in the global part of the server configuration act as defaults which are used if no database has more specific limits set.</P> +<P>In a <EM>slapd.conf</EM>(5) configuration the keywords are <TT>sizelimit</TT> and <TT>timelimit</TT>. When using the <EM>slapd config</EM> backend, the corresponding attributes are <TT>olcSizeLimit</TT> and <TT>olcTimeLimit</TT>. The syntax of these values are the same in both cases.</P> +<P>The simple form sets both soft and hard limits to the same value:</P> +<PRE> + sizelimit {<integer>|unlimited} + timelimit {<integer>|unlimited} +</PRE> +<P>The default sizelimit is 500 entries and the default timelimit is 3600 seconds.</P> +<P>An extended form allows soft and hard limits to be set separately:</P> +<PRE> + sizelimit size[.{soft|hard|unchecked}]=<integer> [...] + timelimit time[.{soft|hard}]=<integer> [...] +</PRE> +<P>Thus, to set a soft sizelimit of 10 entries and a hard limit of 75 entries:</P> +<PRE> + sizelimit size.soft=10 size.hard=75 +</PRE> +<P>The <EM>unchecked</EM> keyword sets a limit on how many entries the server will examine once it has created an initial set of candidate results by using indices. This can be very important in a large directory, as a search that cannot be satisfied from an index might cause the server to examine millions of entries, therefore always make sure the correct indexes are configured.</P> +<H2><A NAME="Per-Database Limits">9.4. Per-Database Limits</A></H2> +<P>Each database can have its own set of limits that override the global ones. The syntax is more flexible, and it allows different limits to be applied to different entities. Note that an <EM>entity</EM> is different from an <EM>entry</EM>: the term <EM>entity</EM> is used here to indicate the ID of the person or process that has initiated the LDAP operation.</P> +<P>In a <EM>slapd.conf</EM>(5) configuration the keyword is <TT>limits</TT>. When using the <EM>slapd config</EM> backend, the corresponding attribute is <TT>olcLimits</TT>. The syntax of the values is the same in both cases.</P> +<PRE> + limits <selector> <limit> [<limit> [...]] +</PRE> +<P>The <EM>limits</EM> clause can be specified multiple times to apply different limits to different initiators. The server examines each clause in turn until it finds one that matches the operation's initiator or base DN. If no match is found, the global limits will be used.</P> +<H3><A NAME="Specify who the limits apply to">9.4.1. Specify who the limits apply to</A></H3> +<P>The <TT><selector></TT> part of the <EM>limits</EM> clause can take any of these values:</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 9.1: Limits Entity Specifiers</CAPTION> +<TR CLASS="heading"> +<TD> +<STRONG>Specifier</STRONG> +</TD> +<TD> +<STRONG>Entities</STRONG> +</TD> +</TR> +<TR> +<TD> +<TT>*</TT> +</TD> +<TD> +All, including anonymous and authenticated users +</TD> +</TR> +<TR> +<TD> +<TT>anonymous</TT> +</TD> +<TD> +Anonymous (non-authenticated) users +</TD> +</TR> +<TR> +<TD> +<TT>users</TT> +</TD> +<TD> +Authenticated users +</TD> +</TR> +<TR> +<TD> +<TT>dn[.<type>][.<style>]=<pattern>]</TT> +</TD> +<TD> +Entry or entries within a scope that match <pattern> +</TD> +</TR> +<TR> +<TD> +<TT>group[/oc[/at]]=<pattern></TT> +</TD> +<TD> +Members of a group +</TD> +</TR> +</TABLE> + +<P>Where</P> +<P><EM>type</EM> can be one of self or this and</P> +<P><EM>style</EM> can be one of exact, base, onelevel, subtree, children, regex, or anonymous</P> +<P>More information can be found in the <EM>slapd.conf</EM>(5) or <EM>slapd-config</EM>(5) manual pages.</P> +<H3><A NAME="Specify time limits">9.4.2. Specify time limits</A></H3> +<P>The syntax for time limits is</P> +<PRE> + time[.{soft|hard}]=<integer> +</PRE> +<P>where integer is the number of seconds slapd will spend answering a search request.</P> +<P>If neither <EM>soft</EM> nor <EM>hard</EM> is specified, the value is used for both, e.g.:</P> +<PRE> + limits anonymous time=27 +</PRE> +<P>The value <EM>unlimited</EM> may be used to remove the hard time limit entirely, e.g.:</P> +<PRE> + limits dn.exact="cn=anyuser,dc=example,dc=org" time.hard=unlimited +</PRE> +<H3><A NAME="Specifying size limits">9.4.3. Specifying size limits</A></H3> +<P>The syntax for size limit is</P> +<PRE> + size[.{soft|hard|unchecked}]=<integer> +</PRE> +<P>where <TT><integer></TT> is the maximum number of entries slapd will return when answering a search request.</P> +<P>Soft, hard, and "unchecked" limits are available, with the same meanings described for the global limits configuration above.</P> +<H3><A NAME="Size limits and Paged Results">9.4.4. Size limits and Paged Results</A></H3> +<P>If the LDAP client adds the <EM>pagedResultsControl</EM> to the search operation, the hard size limit is used by default, because the request for a specific page size is considered an explicit request for a limitation on the number of entries to be returned. However, the size limit applies to the total count of entries returned within the search, and not to a single page.</P> +<P>Additional size limits may be enforced for paged searches.</P> +<P>The <TT>size.pr</TT> limit controls the maximum page size:</P> +<PRE> + size.pr={<integer>|noEstimate|unlimited} +</PRE> +<P><TT><integer></TT> is the maximum page size if no explicit size is set. <TT>noEstimate</TT> has no effect in the current implementation as the server does not return an estimate of the result size anyway. <TT>unlimited</TT> indicates that no limit is applied to the maximum page size.</P> +<P>The <TT>size.prtotal</TT> limit controls the total number of entries that can be returned by a paged search. By default the limit is the same as the normal <TT>size.hard</TT> limit.</P> +<PRE> + size.prtotal={<integer>|unlimited|disabled} +</PRE> +<P><TT>unlimited</TT> removes the limit on the number of entries that can be returned by a paged search. <TT>disabled</TT> can be used to selectively disable paged result searches.</P> +<H2><A NAME="Example Limit Configurations">9.5. Example Limit Configurations</A></H2> +<H3><A NAME="Simple Global Limits">9.5.1. Simple Global Limits</A></H3> +<P>This simple global configuration fragment applies size and time limits to all searches by all users except <EM>rootdn</EM>. It limits searches to 50 results and sets an overall time limit of 10 seconds.</P> +<PRE> + sizelimit 50 + timelimit 10 +</PRE> +<H3><A NAME="Global Hard and Soft Limits">9.5.2. Global Hard and Soft Limits</A></H3> +<P>It is sometimes useful to limit the size of result sets but to allow clients to request a higher limit where needed. This can be achieved by setting separate hard and soft limits.</P> +<PRE> + sizelimit size.soft=5 size.hard=100 +</PRE> +<P>To prevent clients from doing very inefficient non-indexed searches, add the <EM>unchecked</EM> limit:</P> +<PRE> + sizelimit size.soft=5 size.hard=100 size.unchecked=100 +</PRE> +<H3><A NAME="Giving specific users larger limits">9.5.3. Giving specific users larger limits</A></H3> +<P>Having set appropriate default limits in the global configuration, you may want to give certain users the ability to retrieve larger result sets. Here is a way to do that in the per-database configuration:</P> +<PRE> + limits dn.exact="cn=anyuser,dc=example,dc=org" size=100000 + limits dn.exact="cn=personnel,dc=example,dc=org" size=100000 + limits dn.exact="cn=dirsync,dc=example,dc=org" size=100000 +</PRE> +<P>It is generally best to avoid mentioning specific users in the server configuration. A better way is to give the higher limits to a group:</P> +<PRE> + limits group/groupOfNames/member="cn=bigwigs,dc=example,dc=org" size=100000 +</PRE> +<H3><A NAME="Limiting who can do paged searches">9.5.4. Limiting who can do paged searches</A></H3> +<P>It may be required that certain applications need very large result sets that they retrieve using paged searches, but that you do not want ordinary LDAP users to use the pagedResults control. The <EM>pr</EM> and <EM>prtotal</EM> limits can help:</P> +<PRE> + limits group/groupOfNames/member="cn=dirsync,dc=example,dc=org" size.prtotal=unlimited + limits users size.soft=5 size.hard=100 size.prtotal=disabled + limits anonymous size.soft=2 size.hard=5 size.prtotal=disabled +</PRE> +<H2><A NAME="Further Information">9.6. Further Information</A></H2> +<P>For further information please see <EM>slapd.conf</EM>(5), <EM>ldapsearch</EM>(1) and <EM>slapd.access</EM>(5)</P> +<P></P> +<HR> +<H1><A NAME="Database Creation and Maintenance Tools">10. Database Creation and Maintenance Tools</A></H1> +<P>This section tells you how to create a slapd database from scratch, and how to do trouble shooting if you run into problems. There are two ways to create a database. First, you can create the database on-line using <TERM>LDAP</TERM>. With this method, you simply start up slapd and add entries using the LDAP client of your choice. This method is fine for relatively small databases (a few hundred or thousand entries, depending on your requirements). This method works for database types which support updates.</P> +<P>The second method of database creation is to do it off-line using special utilities provided with <EM>slapd</EM>(8). This method is best if you have many thousands of entries to create, which would take an unacceptably long time using the LDAP method, or if you want to ensure the database is not accessed while it is being created. Note that not all database types support these utilities.</P> +<H2><A NAME="Creating a database over LDAP">10.1. Creating a database over LDAP</A></H2> +<P>With this method, you use the LDAP client of your choice (e.g., the <EM>ldapadd</EM>(1)) to add entries, just like you would once the database is created. You should be sure to set the following options in the configuration file before starting <EM>slapd</EM>(8).</P> +<PRE> + suffix <dn> +</PRE> +<P>As described in the <A HREF="#General Database Directives">General Database Directives</A> section, this option defines which entries are to be held by this database. You should set this to the DN of the root of the subtree you are trying to create. For example:</P> +<PRE> + suffix "dc=example,dc=com" +</PRE> +<P>You should be sure to specify a directory where the index files should be created:</P> +<PRE> + directory <directory> +</PRE> +<P>For example:</P> +<PRE> + directory /usr/local/var/openldap-data +</PRE> +<P>You need to create this directory with appropriate permissions such that slapd can write to it.</P> +<P>You need to configure slapd so that you can connect to it as a directory user with permission to add entries. You can configure the directory to support a special <EM>super-user</EM> or <EM>root</EM> user just for this purpose. This is done through the following two options in the database definition:</P> +<PRE> + rootdn <dn> + rootpw <passwd> +</PRE> +<P>For example:</P> +<PRE> + rootdn "cn=Manager,dc=example,dc=com" + rootpw secret +</PRE> +<P>These options specify a DN and password that can be used to authenticate as the <EM>super-user</EM> entry of the database (i.e., the entry allowed to do anything). The DN and password specified here will always work, regardless of whether the entry named actually exists or has the password given. This solves the chicken-and-egg problem of how to authenticate and add entries before any entries yet exist.</P> +<P>Finally, you should make sure that the database definition contains the index definitions you want:</P> +<PRE> + index {<attrlist> | default} [pres,eq,approx,sub,none] +</PRE> +<P>For example, to index the <TT>cn</TT>, <TT>sn</TT>, <TT>uid</TT> and <TT>objectclass</TT> attributes, the following <TT>index</TT> directives could be used:</P> +<PRE> + index cn,sn,uid pres,eq,approx,sub + index objectClass eq +</PRE> +<P>This would create presence, equality, approximate, and substring indices for the <TT>cn</TT>, <TT>sn</TT>, and <TT>uid</TT> attributes and an equality index for the <TT>objectClass</TT> attribute. Note that not all index types are available with all attribute types. See <A HREF="#The slapd Configuration File">The slapd Configuration File</A> section for more information on this option.</P> +<P>Once you have configured things to your liking, start up slapd, connect with your LDAP client, and start adding entries. For example, to add an organization entry and an organizational role entry using the <I>ldapadd</I> tool, you could create an <TERM>LDIF</TERM> file called <TT>entries.ldif</TT> with the contents:</P> +<PRE> + # Organization for Example Corporation + dn: dc=example,dc=com + objectClass: dcObject + objectClass: organization + dc: example + o: Example Corporation + description: The Example Corporation + + # Organizational Role for Directory Manager + dn: cn=Manager,dc=example,dc=com + objectClass: organizationalRole + cn: Manager + description: Directory Manager +</PRE> +<P>and then use a command like this to actually create the entry:</P> +<PRE> + ldapadd -f entries.ldif -x -D "cn=Manager,dc=example,dc=com" -w secret +</PRE> +<P>The above command assumes settings provided in the above examples.</P> +<H2><A NAME="Creating a database off-line">10.2. Creating a database off-line</A></H2> +<P>The second method of database creation is to do it off-line, using the slapd database tools described below. This method is best if you have many thousands of entries to create, which would take an unacceptably long time to add using the LDAP method described above. These tools read the slapd configuration file and an input file containing a text representation of the entries to add. For database types which support the tools, they produce the database files directly (otherwise you must use the on-line method above). There are several important configuration options you will want to be sure and set in the config file database definition first:</P> +<PRE> + suffix <dn> +</PRE> +<P>As described in the <A HREF="#General Database Directives">General Database Directives</A> section, this option defines which entries are to be held by this database. You should set this to the DN of the root of the subtree you are trying to create. For example:</P> +<PRE> + suffix "dc=example,dc=com" +</PRE> +<P>You should be sure to specify a directory where the index files should be created:</P> +<PRE> + directory <directory> +</PRE> +<P>For example:</P> +<PRE> + directory /usr/local/var/openldap-data +</PRE> +<P>Finally, you need to specify which indices you want to build. This is done by one or more index options.</P> +<PRE> + index {<attrlist> | default} [pres,eq,approx,sub,none] +</PRE> +<P>For example:</P> +<PRE> + index cn,sn,uid pres,eq,approx,sub + index objectClass eq +</PRE> +<P>This would create presence, equality, approximate, and substring indices for the <TT>cn</TT>, <TT>sn</TT>, and <TT>uid</TT> attributes and an equality index for the <TT>objectClass</TT> attribute. Note that not all index types are available with all attribute types. See <A HREF="#The slapd Configuration File">The slapd Configuration File</A> section for more information on this option.</P> +<H3><A NAME="The {{EX:slapadd}} program">10.2.1. The <TT>slapadd</TT> program</A></H3> +<P>Once you've configured things to your liking, you create the primary database and associated indices by running the <EM>slapadd</EM>(8) program:</P> +<PRE> + slapadd -l <inputfile> -f <slapdconfigfile> + [-d <debuglevel>] [-n <integer>|-b <suffix>] +</PRE> +<P>The arguments have the following meanings:</P> +<PRE> + -l <inputfile> +</PRE> +<P>Specifies the <TERM>LDIF</TERM> input file containing the entries to add in text form (described below in the <A HREF="#The LDIF text entry format">The LDIF text entry format</A> section).</P> +<PRE> + -f <slapdconfigfile> +</PRE> +<P>Specifies the slapd configuration file that tells where to create the indices, what indices to create, etc.</P> +<PRE> + -F <slapdconfdirectory> +</PRE> +<P>Specifies a config directory. If both <TT>-f</TT> and <TT>-F</TT> are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, an attempt to read the default config directory will be made before trying to use the default config file. If a valid config directory exists then the default config file is ignored. If dryrun mode is also specified, no conversion will occur.</P> +<PRE> + -d <debuglevel> +</PRE> +<P>Turn on debugging, as specified by <TT><debuglevel></TT>. The debug levels are the same as for slapd. See the <A HREF="#Command-Line Options">Command-Line Options</A> section in <A HREF="#Running slapd">Running slapd</A>.</P> +<PRE> + -n <databasenumber> +</PRE> +<P>An optional argument that specifies which database to modify. The first database listed in the configuration file is <TT>1</TT>, the second <TT>2</TT>, etc. By default, the first database in the configuration file is used. Should not be used in conjunction with <TT>-b</TT>.</P> +<PRE> + -b <suffix> +</PRE> +<P>An optional argument that specifies which database to modify. The provided suffix is matched against a database <TT>suffix</TT> directive to determine the database number. Should not be used in conjunction with <TT>-n</TT>.</P> +<H3><A NAME="The {{EX:slapindex}} program">10.2.2. The <TT>slapindex</TT> program</A></H3> +<P>Sometimes it may be necessary to regenerate indices (such as after modifying <EM>slapd.conf</EM>(5)). This is possible using the <EM>slapindex</EM>(8) program. <EM>slapindex</EM> is invoked like this</P> +<PRE> + slapindex -f <slapdconfigfile> + [-d <debuglevel>] [-n <databasenumber>|-b <suffix>] +</PRE> +<P>Where the <TT>-f</TT>, <TT>-d</TT>, <TT>-n</TT> and <TT>-b</TT> options are the same as for the <EM>slapadd</EM>(1) program. <EM>slapindex</EM> rebuilds all indices based upon the current database contents.</P> +<H3><A NAME="The {{EX:slapcat}} program">10.2.3. The <TT>slapcat</TT> program</A></H3> +<P>The <TT>slapcat</TT> program is used to dump the database to an <TERM>LDIF</TERM> file. This can be useful when you want to make a human-readable backup of your database or when you want to edit your database off-line. The program is invoked like this:</P> +<PRE> + slapcat -l <filename> -f <slapdconfigfile> + [-d <debuglevel>] [-n <databasenumber>|-b <suffix>] +</PRE> +<P>where <TT>-n</TT> or <TT>-b</TT> is used to select the database in the <EM>slapd.conf</EM>(5) specified using <TT>-f</TT>. The corresponding <TERM>LDIF</TERM> output is written to standard output or to the file specified using the <TT>-l</TT> option.</P> +<H2><A NAME="The LDIF text entry format">10.3. The LDIF text entry format</A></H2> +<P>The <TERM>LDAP Data Interchange Format</TERM> (LDIF) is used to represent LDAP entries in a simple text format. This section provides a brief description of the LDIF entry format which complements <EM>ldif</EM>(5) and the technical specification <A HREF="http://www.rfc-editor.org/rfc/rfc2849.txt">RFC2849</A>.</P> +<P>The basic form of an entry is:</P> +<PRE> + # comment + dn: <distinguished name> + <attrdesc>: <attrvalue> + <attrdesc>: <attrvalue> + + ... +</PRE> +<P>Lines starting with a '<TT>#</TT>' character are comments. An attribute description may be a simple attribute type like <TT>cn</TT> or <TT>objectClass</TT> or <TT>1.2.3</TT> (an <TERM>OID</TERM> associated with an attribute type) or may include options such as <TT>cn;lang_en_US</TT> or <TT>userCertificate;binary</TT>.</P> +<P>A line may be continued by starting the next line with a <EM>single</EM> space or tab character. For example:</P> +<PRE> + dn: cn=Barbara J Jensen,dc=example,dc= + com + cn: Barbara J + Jensen +</PRE> +<P>is equivalent to:</P> +<PRE> + dn: cn=Barbara J Jensen,dc=example,dc=com + cn: Barbara J Jensen +</PRE> +<P>Multiple attribute values are specified on separate lines. e.g.,</P> +<PRE> + cn: Barbara J Jensen + cn: Babs Jensen +</PRE> +<P>If an <TT><attrvalue></TT> contains non-printing characters or begins with a space, a colon ('<TT>:</TT>'), or a less than ('<TT><</TT>'), the <TT><attrdesc></TT> is followed by a double colon and the base64 encoding of the value. For example, the value "<TT> begins with a space</TT>" would be encoded like this:</P> +<PRE> + cn:: IGJlZ2lucyB3aXRoIGEgc3BhY2U= +</PRE> +<P>You can also specify a <TERM>URL</TERM> containing the attribute value. For example, the following specifies the <TT>jpegPhoto</TT> value should be obtained from the file <TT>/path/to/file.jpeg</TT>.</P> +<PRE> + cn:< file:///path/to/file.jpeg +</PRE> +<P>Multiple entries within the same LDIF file are separated by blank lines. Here's an example of an LDIF file containing three entries.</P> +<PRE> + # Barbara's Entry + dn: cn=Barbara J Jensen,dc=example,dc=com + cn: Barbara J Jensen + cn: Babs Jensen + objectClass: person + sn: Jensen + + # Bjorn's Entry + dn: cn=Bjorn J Jensen,dc=example,dc=com + cn: Bjorn J Jensen + cn: Bjorn Jensen + objectClass: person + sn: Jensen + # Base64 encoded JPEG photo + jpegPhoto:: /9j/4AAQSkZJRgABAAAAAQABAAD/2wBDABALD + A4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQ + ERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVG + + # Jennifer's Entry + dn: cn=Jennifer J Jensen,dc=example,dc=com + cn: Jennifer J Jensen + cn: Jennifer Jensen + objectClass: person + sn: Jensen + # JPEG photo from file + jpegPhoto:< file:///path/to/file.jpeg +</PRE> +<P>Notice that the <TT>jpegPhoto</TT> in Bjorn's entry is base 64 encoded and the <TT>jpegPhoto</TT> in Jennifer's entry is obtained from the location indicated by the URL.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Trailing spaces are not trimmed from values in an LDIF file. Nor are multiple internal spaces compressed. If you don't want them in your data, don't put them there. +<HR WIDTH="80%" ALIGN="Left"></P> +<P></P> +<HR> +<H1><A NAME="Backends">11. Backends</A></H1> +<P>Backends do the actual work of storing or retrieving data in response to LDAP requests. Backends may be compiled statically into <EM>slapd</EM>, or when module support is enabled, they may be dynamically loaded.</P> +<P>If your installation uses dynamic modules, you may need to add the relevant <EM>moduleload</EM> directives to the examples that follow. The name of the module for a backend is usually of the form:</P> +<PRE> + back_<backend name>.la +</PRE> +<P>So for example, if you need to load the <EM>hdb</EM> backend, you would configure</P> +<PRE> + moduleload back_hdb.la +</PRE> +<H2><A NAME="Berkeley DB Backends">11.1. Berkeley DB Backends</A></H2> +<H3><A NAME="Overview">11.1.1. Overview</A></H3> +<P>The <EM>hdb</EM> backend to <EM>slapd</EM>(8) is a backend for a normal <EM>slapd</EM> database. It uses the Oracle Berkeley DB (<TERM>BDB</TERM>) package to store data. It makes extensive use of indexing and caching (see the <A HREF="#Tuning">Tuning</A> section) to speed data access.</P> +<P><EM>hdb</EM> is a variant of the original <EM>bdb</EM> backend which was first written for use with BDB. <EM>hdb</EM> uses a hierarchical database layout which supports subtree renames. It is otherwise identical to the <EM>bdb</EM> behavior, and all the same configuration options apply.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>An <EM>hdb</EM> database needs a large <EM>idlcachesize</EM> for good search performance, typically three times the <EM>cachesize</EM> (entry cache size) or larger. +<HR WIDTH="80%" ALIGN="Left"></P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>The <EM>hdb</EM> backend has superseded the <EM>bdb</EM> backend, and both will soon be deprecated in favor of the new <EM>mdb</EM> backend. See below. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="back-bdb/back-hdb Configuration">11.1.2. back-bdb/back-hdb Configuration</A></H3> +<P>MORE LATER</P> +<H3><A NAME="Further Information">11.1.3. Further Information</A></H3> +<P><EM>slapd-bdb</EM>(5)</P> +<H2><A NAME="LDAP">11.2. LDAP</A></H2> +<H3><A NAME="Overview">11.2.1. Overview</A></H3> +<P>The LDAP backend to <EM>slapd</EM>(8) is not an actual database; instead it acts as a proxy to forward incoming requests to another LDAP server. While processing requests it will also chase referrals, so that referrals are fully processed instead of being returned to the <EM>slapd</EM> client.</P> +<P>Sessions that explicitly <EM>Bind</EM> to the <EM>back-ldap</EM> database always create their own private connection to the remote LDAP server. Anonymous sessions will share a single anonymous connection to the remote server. For sessions bound through other mechanisms, all sessions with the same DN will share the same connection. This connection pooling strategy can enhance the proxy's efficiency by reducing the overhead of repeatedly making/breaking multiple connections.</P> +<P>The ldap database can also act as an information service, i.e. the identity of locally authenticated clients is asserted to the remote server, possibly in some modified form. For this purpose, the proxy binds to the remote server with some administrative identity, and, if required, authorizes the asserted identity.</P> +<P>It is heavily used by a lot of other <A HREF="#Backends">Backends</A> and <A HREF="#Overlays">Overlays</A>.</P> +<H3><A NAME="back-ldap Configuration">11.2.2. back-ldap Configuration</A></H3> +<P>As previously mentioned, <EM>slapd-ldap(5)</EM> is used behind the scenes by many other <A HREF="#Backends">Backends</A> and <A HREF="#Overlays">Overlays</A>. Some of them merely provide a few configuration directive themselves, but have available to the administrator the whole of the <EM>slapd-ldap(5)</EM> options.</P> +<P>For example, the <A HREF="#Translucent Proxy">Translucent Proxy</A>, which retrieves entries from a remote LDAP server that can be partially overridden by the defined database, has only four specific <EM>translucent-</EM> directives, but can be configured using any of the normal <EM>slapd-ldap(5)</EM> options. See {[slapo-translucent(5)}} for details.</P> +<P>Other <A HREF="#Overlays">Overlays</A> allow you to tag directives in front of a normal <EM>slapd-ldap(5)</EM> directive. For example, the <EM>slapo-chain(5)</EM> overlay does this:</P> +<P><EM>"There are very few chain overlay specific directives; however, directives related to the instances of the ldap backend that may be implicitly instantiated by the overlay may assume a special meaning when used in conjunction with this overlay. They are described in slapd-ldap(5), and they also need to be prefixed by chain-."</EM></P> +<P>You may have also seen the <EM>slapd-ldap(5)</EM> backend used and described in the <A HREF="#Push Based">Push Based</A> <A HREF="#Replication">Replication</A> section of the guide.</P> +<P>It should therefore be obvious that the <EM>slapd-ldap(5)</EM> backend is extremely flexible and heavily used throughout the OpenLDAP Suite.</P> +<P>The following is a very simple example, but already the power of the <EM>slapd-ldap(5)</EM> backend is seen by use of a <EM>uri list</EM>:</P> +<PRE> + database ldap + suffix "dc=suretecsystems,dc=com" + rootdn "cn=slapd-ldap" + uri ldap://localhost/ ldap://remotehost ldap://remotehost2 +</PRE> +<P>The URI list is space or comma-separated. Whenever the server that responds is not the first one in the list, the list is rearranged and the responsive server is moved to the head, so that it will be first contacted the next time a connection needs be created.</P> +<P>This feature can be used to provide a form of load balancing when using <A HREF="#MirrorMode replication">MirrorMode replication</A>.</P> +<H3><A NAME="Further Information">11.2.3. Further Information</A></H3> +<P><EM>slapd-ldap</EM>(5)</P> +<H2><A NAME="LDIF">11.3. LDIF</A></H2> +<H3><A NAME="Overview">11.3.1. Overview</A></H3> +<P>The LDIF backend to <EM>slapd</EM>(8) is a basic storage backend that stores entries in text files in LDIF format, and exploits the filesystem to create the tree structure of the database. It is intended as a cheap, low performance easy to use backend.</P> +<P>When using the <EM>cn=config</EM> dynamic configuration database with persistent storage, the configuration data is stored using this backend. See <EM>slapd-config</EM>(5) for more information</P> +<H3><A NAME="back-ldif Configuration">11.3.2. back-ldif Configuration</A></H3> +<P>Like many other backends, the LDIF backend can be instantiated with very few configuration lines:</P> +<PRE> + include ./schema/core.schema + + database ldif + directory ./ldif + suffix "dc=suretecsystems,dc=com" + rootdn "cn=LDIF,dc=suretecsystems,dc=com" + rootpw LDIF +</PRE> +<P>If we add the <EM>dcObject</EM> for <EM>dc=suretecsystems,dc=com</EM>, you can see how this is added behind the scenes on the file system:</P> +<PRE> + dn: dc=suretecsystems,dc=com + objectClass: dcObject + objectClass: organization + dc: suretecsystems + o: Suretec Systems Ltd +</PRE> +<P>Now we add it to the directory:</P> +<PRE> + ldapadd -x -H ldap://localhost:9011 -f suretec.ldif -D "cn=LDIF,dc=suretecsystems,dc=com" -w LDIF + adding new entry "dc=suretecsystems,dc=com" +</PRE> +<P>And inside <TT>./ldif</TT> we have:</P> +<PRE> + ls ./ldif + dc=suretecsystems,dc=com.ldif +</PRE> +<P>which again contains:</P> +<PRE> + cat ldif/dc\=suretecsystems\,dc\=com.ldif + + dn: dc=suretecsystems + objectClass: dcObject + objectClass: organization + dc: suretecsystems + o: Suretec Systems Ltd. + structuralObjectClass: organization + entryUUID: 2134b714-e3a1-102c-9a15-f96ee263886d + creatorsName: cn=LDIF,dc=suretecsystems,dc=com + createTimestamp: 20080711142643Z + entryCSN: 20080711142643.661124Z#000000#000#000000 + modifiersName: cn=LDIF,dc=suretecsystems,dc=com + modifyTimestamp: 20080711142643Z +</PRE> +<P>This is the complete format you would get when exporting your directory using <TT>slapcat</TT> etc.</P> +<H3><A NAME="Further Information">11.3.3. Further Information</A></H3> +<P><EM>slapd-ldif</EM>(5)</P> +<H2><A NAME="LMDB">11.4. LMDB</A></H2> +<H3><A NAME="Overview">11.4.1. Overview</A></H3> +<P>The <EM>mdb</EM> backend to <EM>slapd</EM>(8) is the recommended primary backend for a normal <EM>slapd</EM> database. It uses OpenLDAP's own Lightning Memory-Mapped Database (<TERM>LMDB</TERM>) library to store data and is intended to replace the Berkeley DB backends.</P> +<P>It supports indexing like the BDB backends, but it uses no caching and requires no tuning to deliver maximum search performance. Like <EM>hdb</EM>, it is also fully hierarchical and supports subtree renames in constant time.</P> +<H3><A NAME="back-mdb Configuration">11.4.2. back-mdb Configuration</A></H3> +<P>Unlike the BDB backends, the <EM>mdb</EM> backend can be instantiated with very few configuration lines:</P> +<PRE> + include ./schema/core.schema + + database mdb + directory ./mdb + suffix "dc=suretecsystems,dc=com" + rootdn "cn=mdb,dc=suretecsystems,dc=com" + rootpw mdb + maxsize 1073741824 +</PRE> +<P>In addition to the usual parameters that a minimal configuration requires, the <EM>mdb</EM> backend requires a maximum size to be set. This should be the largest that the database is ever anticipated to grow (in bytes). The filesystem must also provide enough free space to accommodate this size.</P> +<H3><A NAME="Further Information">11.4.3. Further Information</A></H3> +<P><EM>slapd-mdb</EM>(5)</P> +<H2><A NAME="Metadirectory">11.5. Metadirectory</A></H2> +<H3><A NAME="Overview">11.5.1. Overview</A></H3> +<P>The meta backend to <EM>slapd</EM>(8) performs basic LDAP proxying with respect to a set of remote LDAP servers, called "targets". The information contained in these servers can be presented as belonging to a single Directory Information Tree (<TERM>DIT</TERM>).</P> +<P>A basic knowledge of the functionality of the <EM>slapd-ldap</EM>(5) backend is recommended. This backend has been designed as an enhancement of the ldap backend. The two backends share many features (actually they also share portions of code). While the ldap backend is intended to proxy operations directed to a single server, the meta backend is mainly intended for proxying of multiple servers and possibly naming context masquerading.</P> +<P>These features, although useful in many scenarios, may result in excessive overhead for some applications, so its use should be carefully considered.</P> +<H3><A NAME="back-meta Configuration">11.5.2. back-meta Configuration</A></H3> +<P>LATER</P> +<H3><A NAME="Further Information">11.5.3. Further Information</A></H3> +<P><EM>slapd-meta</EM>(5)</P> +<H2><A NAME="Monitor">11.6. Monitor</A></H2> +<H3><A NAME="Overview">11.6.1. Overview</A></H3> +<P>The monitor backend to <EM>slapd</EM>(8) is not an actual database; if enabled, it is automatically generated and dynamically maintained by slapd with information about the running status of the daemon.</P> +<P>To inspect all monitor information, issue a subtree search with base <EM>cn=Monitor</EM>, requesting that attributes "+" and "*" are returned. The monitor backend produces mostly operational attributes, and LDAP only returns operational attributes that are explicitly requested. Requesting attribute "+" is an extension which requests all operational attributes.</P> +<P>See the <A HREF="#Monitoring">Monitoring</A> section.</P> +<H3><A NAME="back-monitor Configuration">11.6.2. back-monitor Configuration</A></H3> +<P>The monitor database can be instantiated only once, i.e. only one occurrence of "database monitor" can occur in the <EM>slapd.conf(5)</EM> file. Also the suffix is automatically set to <EM>"cn=Monitor"</EM>.</P> +<P>You can however set a <EM>rootdn</EM> and <EM>rootpw</EM>. The following is all that is needed to instantiate a monitor backend:</P> +<PRE> + include ./schema/core.schema + + database monitor + rootdn "cn=monitoring,cn=Monitor" + rootpw monitoring +</PRE> +<P>You can also apply Access Control to this database like any other database, for example:</P> +<PRE> + access to dn.subtree="cn=Monitor" + by dn.exact="uid=Admin,dc=my,dc=org" write + by users read + by * none +</PRE> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>The <TT>core.schema</TT> must be loaded for the monitor database to work. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>A small example of the data returned via <EM>ldapsearch</EM> would be:</P> +<PRE> + ldapsearch -x -H ldap://localhost:9011 -b 'cn=Monitor' + # extended LDIF + # + # LDAPv3 + # base <cn=Monitor> with scope subtree + # filter: (objectclass=*) + # requesting: ALL + # + + # Monitor + dn: cn=Monitor + objectClass: monitorServer + cn: Monitor + description: This subtree contains monitoring/managing objects. + description: This object contains information about this server. + description: Most of the information is held in operational attributes, which + must be explicitly requested. + + # Backends, Monitor + dn: cn=Backends,cn=Monitor + objectClass: monitorContainer + cn: Backends + description: This subsystem contains information about available backends. +</PRE> +<P>Please see the <A HREF="#Monitoring">Monitoring</A> section for complete examples of information available via this backend.</P> +<H3><A NAME="Further Information">11.6.3. Further Information</A></H3> +<P><EM>slapd-monitor</EM>(5)</P> +<H2><A NAME="Null">11.7. Null</A></H2> +<H3><A NAME="Overview">11.7.1. Overview</A></H3> +<P>The Null backend to <EM>slapd</EM>(8) is surely the most useful part of slapd:</P> +<UL> +<LI>Searches return success but no entries. +<LI>Compares return compareFalse. +<LI>Updates return success (unless readonly is on) but do nothing. +<LI>Binds other than as the rootdn fail unless the database option "bind on" is given. +<LI>The slapadd(8) and slapcat(8) tools are equally exciting.</UL> +<P>Inspired by the <TT>/dev/null</TT> device.</P> +<H3><A NAME="back-null Configuration">11.7.2. back-null Configuration</A></H3> +<P>This has to be one of the shortest configurations you'll ever do. In order to test this, your <TT>slapd.conf</TT> file would look like:</P> +<PRE> + database null + suffix "cn=Nothing" + bind on +</PRE> +<P><EM>bind on</EM> means:</P> +<P><EM>"Allow binds as any DN in this backend's suffix, with any password. The default is "off"."</EM></P> +<P>To test this backend with <EM>ldapsearch</EM>:</P> +<PRE> + ldapsearch -x -H ldap://localhost:9011 -D "uid=none,cn=Nothing" -w testing -b 'cn=Nothing' + # extended LDIF + # + # LDAPv3 + # base <cn=Nothing> with scope subtree + # filter: (objectclass=*) + # requesting: ALL + # + + # search result + search: 2 + result: 0 Success + + # numResponses: 1 +</PRE> +<H3><A NAME="Further Information">11.7.3. Further Information</A></H3> +<P><EM>slapd-null</EM>(5)</P> +<H2><A NAME="Passwd">11.8. Passwd</A></H2> +<H3><A NAME="Overview">11.8.1. Overview</A></H3> +<P>The PASSWD backend to <EM>slapd</EM>(8) serves up the user account information listed in the system <EM>passwd</EM>(5) file (defaulting to <TT>/etc/passwd</TT>).</P> +<P>This backend is provided for demonstration purposes only. The DN of each entry is "uid=<username>,<suffix>".</P> +<H3><A NAME="back-passwd Configuration">11.8.2. back-passwd Configuration</A></H3> +<P>The configuration using <TT>slapd.conf</TT> a slightly longer, but not much. For example:</P> +<PRE> + include ./schema/core.schema + + database passwd + suffix "cn=passwd" +</PRE> +<P>Again, testing this with <EM>ldapsearch</EM> would result in something like:</P> +<PRE> + ldapsearch -x -H ldap://localhost:9011 -b 'cn=passwd' + # extended LDIF + # + # LDAPv3 + # base <cn=passwd> with scope subtree + # filter: (objectclass=*) + # requesting: ALL + # + + # passwd + dn: cn=passwd + cn: passwd + objectClass: organizationalUnit + + # root, passwd + dn: uid=root,cn=passwd + objectClass: person + objectClass: uidObject + uid: root + cn: root + sn: root + description: root +</PRE> +<H3><A NAME="Further Information">11.8.3. Further Information</A></H3> +<P><EM>slapd-passwd</EM>(5)</P> +<H2><A NAME="Perl/Shell">11.9. Perl/Shell</A></H2> +<H3><A NAME="Overview">11.9.1. Overview</A></H3> +<P>The Perl backend to <EM>slapd</EM>(8) works by embedding a <EM>perl</EM>(1) interpreter into <EM>slapd</EM>(8). Any perl database section of the configuration file <EM>slapd.conf</EM>(5) must then specify what Perl module to use. Slapd then creates a new Perl object that handles all the requests for that particular instance of the backend.</P> +<P>The Shell backend to <EM>slapd</EM>(8) executes external programs to implement operations, and is designed to make it easy to tie an existing database to the slapd front-end. This backend is primarily intended to be used in prototypes.</P> +<H3><A NAME="back-perl/back-shell Configuration">11.9.2. back-perl/back-shell Configuration</A></H3> +<P>LATER</P> +<H3><A NAME="Further Information">11.9.3. Further Information</A></H3> +<P><EM>slapd-shell</EM>(5) and <EM>slapd-perl</EM>(5)</P> +<H2><A NAME="Relay">11.10. Relay</A></H2> +<H3><A NAME="Overview">11.10.1. Overview</A></H3> +<P>The primary purpose of this <EM>slapd</EM>(8) backend is to map a naming context defined in a database running in the same <EM>slapd</EM>(8) instance into a virtual naming context, with attributeType and objectClass manipulation, if required. It requires the rwm overlay.</P> +<P>This backend and the above mentioned overlay are experimental.</P> +<H3><A NAME="back-relay Configuration">11.10.2. back-relay Configuration</A></H3> +<P>LATER</P> +<H3><A NAME="Further Information">11.10.3. Further Information</A></H3> +<P><EM>slapd-relay</EM>(5)</P> +<H2><A NAME="SQL">11.11. SQL</A></H2> +<H3><A NAME="Overview">11.11.1. Overview</A></H3> +<P>The primary purpose of this <EM>slapd</EM>(8) backend is to PRESENT information stored in some RDBMS as an LDAP subtree without any programming (some SQL and maybe stored procedures can't be considered programming, anyway ;).</P> +<P>That is, for example, when you (some ISP) have account information you use in an RDBMS, and want to use modern solutions that expect such information in LDAP (to authenticate users, make email lookups etc.). Or you want to synchronize or distribute information between different sites/applications that use RDBMSes and/or LDAP. Or whatever else...</P> +<P>It is <B>NOT</B> designed as a general-purpose backend that uses RDBMS instead of BerkeleyDB (as the standard BDB backend does), though it can be used as such with several limitations. Please see <A HREF="#LDAP vs RDBMS">LDAP vs RDBMS</A> for discussion.</P> +<P>The idea is to use some meta-information to translate LDAP queries to SQL queries, leaving relational schema untouched, so that old applications can continue using it without any modifications. This allows SQL and LDAP applications to interoperate without replication, and exchange data as needed.</P> +<P>The SQL backend is designed to be tunable to virtually any relational schema without having to change source (through that meta-information mentioned). Also, it uses ODBC to connect to RDBMSes, and is highly configurable for SQL dialects RDBMSes may use, so it may be used for integration and distribution of data on different RDBMSes, OSes, hosts etc., in other words, in highly heterogeneous environments.</P> +<P>This backend is experimental.</P> +<H3><A NAME="back-sql Configuration">11.11.2. back-sql Configuration</A></H3> +<P>This backend has to be one of the most abused and complex backends there is. Therefore, we will go through a simple, small example that comes with the OpenLDAP source and can be found in <TT>servers/slapd/back-sql/rdbms_depend/README</TT></P> +<P>For this example we will be using PostgreSQL.</P> +<P>First, we add to <TT>/etc/odbc.ini</TT> a block of the form:</P> +<PRE> + [example] <=== + Description = Example for OpenLDAP's back-sql + Driver = PostgreSQL + Trace = No + Database = example <=== + Servername = localhost + UserName = manager <=== + Password = secret <=== + Port = 5432 + ;Protocol = 6.4 + ReadOnly = No + RowVersioning = No + ShowSystemTables = No + ShowOidColumn = No + FakeOidIndex = No + ConnSettings = +</PRE> +<P>The relevant information for our test setup is highlighted with '<===' on the right above.</P> +<P>Next, we add to <TT>/etc/odbcinst.ini</TT> a block of the form:</P> +<PRE> + [PostgreSQL] + Description = ODBC for PostgreSQL + Driver = /usr/lib/libodbcpsql.so + Setup = /usr/lib/libodbcpsqlS.so + FileUsage = 1 +</PRE> +<P>We will presume you know how to create a database and user in PostgreSQL and how to set a password. Also, we'll presume you can populate the 'example' database you've just created with the following files, as found in <TT>servers/slapd/back-sql/rdbms_depend/pgsql </TT></P> +<PRE> + backsql_create.sql, testdb_create.sql, testdb_data.sql, testdb_metadata.sql +</PRE> +<P>Lastly, run the test:</P> +<PRE> + [root@localhost]# cd $SOURCES/tests + [root@localhost]# SLAPD_USE_SQL=pgsql ./run sql-test000 +</PRE> +<P>Briefly, you should see something like (cut short for space):</P> +<PRE> + Cleaning up test run directory leftover from previous run. + Running ./scripts/sql-test000-read... + running defines.sh + Starting slapd on TCP/IP port 9011... + Testing SQL backend read operations... + Waiting 5 seconds for slapd to start... + Testing correct bind... dn:cn=Mitya Kovalev,dc=example,dc=com + Testing incorrect bind (should fail)... ldap_bind: Invalid credentials (49) + + ...... + + Filtering original ldif... + Comparing filter output... + >>>>> Test succeeded +</PRE> +<P>The test is basically readonly; this can be performed by all RDBMSes (listed above).</P> +<P>There is another test, sql-test900-write, which is currently enabled only for PostgreSQL and IBM db2.</P> +<P>Using <TT>sql-test000</TT>, files in <TT>servers/slapd/back-sql/rdbms_depend/pgsql/</TT> and the man page, you should be set.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>This backend is experimental. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="Further Information">11.11.3. Further Information</A></H3> +<P><EM>slapd-sql</EM>(5) and <TT>servers/slapd/back-sql/rdbms_depend/README</TT></P> +<P></P> +<HR> +<H1><A NAME="Overlays">12. Overlays</A></H1> +<P>Overlays are software components that provide hooks to functions analogous to those provided by backends, which can be stacked on top of the backend calls and as callbacks on top of backend responses to alter their behavior.</P> +<P>Overlays may be compiled statically into <EM>slapd</EM>, or when module support is enabled, they may be dynamically loaded. Most of the overlays are only allowed to be configured on individual databases.</P> +<P>Some can be stacked on the <TT>frontend</TT> as well, for global use. This means that they can be executed after a request is parsed and validated, but right before the appropriate database is selected. The main purpose is to affect operations regardless of the database they will be handled by, and, in some cases, to influence the selection of the database by massaging the request DN.</P> +<P>Essentially, overlays represent a means to:</P> +<UL> +<LI>customize the behavior of existing backends without changing the backend code and without requiring one to write a new custom backend with complete functionality +<LI>write functionality of general usefulness that can be applied to different backend types</UL> +<P>When using <EM>slapd.conf</EM>(5), overlays that are configured before any other databases are considered global, as mentioned above. In fact they are implicitly stacked on top of the <TT>frontend</TT> database. They can also be explicitly configured as such:</P> +<PRE> + database frontend + overlay <overlay name> +</PRE> +<P>Overlays are usually documented by separate specific man pages in section 5; the naming convention is</P> +<PRE> + slapo-<overlay name> +</PRE> +<P>All distributed core overlays have a man page. Feel free to contribute to any, if you think there is anything missing in describing the behavior of the component and the implications of all the related configuration directives.</P> +<P>Official overlays are located in</P> +<PRE> + servers/slapd/overlays/ +</PRE> +<P>That directory also contains the file slapover.txt, which describes the rationale of the overlay implementation, and may serve as a guideline for the development of custom overlays.</P> +<P>Contribware overlays are located in</P> +<PRE> + contrib/slapd-modules/<overlay name>/ +</PRE> +<P>along with other types of run-time loadable components; they are officially distributed, but not maintained by the project.</P> +<P>All the current overlays in OpenLDAP are listed and described in detail in the following sections.</P> +<H2><A NAME="Access Logging">12.1. Access Logging</A></H2> +<H3><A NAME="Overview">12.1.1. Overview</A></H3> +<P>This overlay can record accesses to a given backend database on another database.</P> +<P>This allows all of the activity on a given database to be reviewed using arbitrary LDAP queries, instead of just logging to local flat text files. Configuration options are available for selecting a subset of operation types to log, and to automatically prune older log records from the logging database. Log records are stored with audit schema to assure their readability whether viewed as LDIF or in raw form.</P> +<P>It is also used for <A HREF="#delta-syncrepl replication">delta-syncrepl replication</A></P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>An accesslog database is unique to a given master. It should never be replicated. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="Access Logging Configuration">12.1.2. Access Logging Configuration</A></H3> +<P>The following is a basic example that implements Access Logging:</P> +<PRE> + database bdb + suffix dc=example,dc=com + ... + overlay accesslog + logdb cn=log + logops writes reads + logold (objectclass=person) + + database bdb + suffix cn=log + ... + index reqStart eq + access to * + by dn.base="cn=admin,dc=example,dc=com" read +</PRE> +<P>The following is an example used for <A HREF="#delta-syncrepl replication">delta-syncrepl replication</A>:</P> +<PRE> + database hdb + suffix cn=accesslog + directory /usr/local/var/openldap-accesslog + rootdn cn=accesslog + index default eq + index entryCSN,objectClass,reqEnd,reqResult,reqStart +</PRE> +<P>Accesslog overlay definitions for the primary db</P> +<PRE> + database bdb + suffix dc=example,dc=com + ... + overlay accesslog + logdb cn=accesslog + logops writes + logsuccess TRUE + # scan the accesslog DB every day, and purge entries older than 7 days + logpurge 07+00:00 01+00:00 +</PRE> +<P>An example search result against <B>cn=accesslog</B> might look like:</P> +<PRE> + [ghenry@suretec ghenry]# ldapsearch -x -b cn=accesslog + # extended LDIF + # + # LDAPv3 + # base <cn=accesslog> with scope subtree + # filter: (objectclass=*) + # requesting: ALL + # + + # accesslog + dn: cn=accesslog + objectClass: auditContainer + cn: accesslog + + # 20080110163829.000004Z, accesslog + dn: reqStart=20080110163829.000004Z,cn=accesslog + objectClass: auditModify + reqStart: 20080110163829.000004Z + reqEnd: 20080110163829.000005Z + reqType: modify + reqSession: 196696 + reqAuthzID: cn=admin,dc=suretecsystems,dc=com + reqDN: uid=suretec-46022f8$,ou=Users,dc=suretecsystems,dc=com + reqResult: 0 + reqMod: sambaPwdCanChange:- ###CENSORED### + reqMod: sambaPwdCanChange:+ ###CENSORED### + reqMod: sambaNTPassword:- ###CENSORED### + reqMod: sambaNTPassword:+ ###CENSORED### + reqMod: sambaPwdLastSet:- ###CENSORED### + reqMod: sambaPwdLastSet:+ ###CENSORED### + reqMod: entryCSN:= 20080110163829.095157Z#000000#000#000000 + reqMod: modifiersName:= cn=admin,dc=suretecsystems,dc=com + reqMod: modifyTimestamp:= 20080110163829Z + + # search result + search: 2 + result: 0 Success + + # numResponses: 3 + # numEntries: 2 +</PRE> +<H3><A NAME="Further Information">12.1.3. Further Information</A></H3> +<P><EM>slapo-accesslog(5)</EM> and the <A HREF="#delta-syncrepl replication">delta-syncrepl replication</A> section.</P> +<H2><A NAME="Audit Logging">12.2. Audit Logging</A></H2> +<P>The Audit Logging overlay can be used to record all changes on a given backend database to a specified log file.</P> +<H3><A NAME="Overview">12.2.1. Overview</A></H3> +<P>If the need arises whereby changes need to be logged as standard LDIF, then the auditlog overlay <B>slapo-auditlog (5)</B> can be used. Full examples are available in the man page <B>slapo-auditlog (5)</B></P> +<H3><A NAME="Audit Logging Configuration">12.2.2. Audit Logging Configuration</A></H3> +<P>If the directory is running vi <TT>slapd.d</TT>, then the following LDIF could be used to add the overlay to the overlay list in <B>cn=config</B> and set what file the <TERM>LDIF</TERM> gets logged to (adjust to suit)</P> +<PRE> + dn: olcOverlay=auditlog,olcDatabase={1}mdb,cn=config + changetype: add + objectClass: olcOverlayConfig + objectClass: olcAuditLogConfig + olcOverlay: auditlog + olcAuditlogFile: /tmp/auditlog.ldif +</PRE> +<P>In this example for testing, we are logging changes to <TT>/tmp/auditlog.ldif</TT></P> +<P>A typical <TERM>LDIF</TERM> file created by <B>slapo-auditlog(5)</B> would look like:</P> +<PRE> + # add 1196797576 dc=suretecsystems,dc=com cn=admin,dc=suretecsystems,dc=com + dn: dc=suretecsystems,dc=com + changetype: add + objectClass: dcObject + objectClass: organization + dc: suretecsystems + o: Suretec Systems Ltd. + structuralObjectClass: organization + entryUUID: 1606f8f8-f06e-1029-8289-f0cc9d81e81a + creatorsName: cn=admin,dc=suretecsystems,dc=com + modifiersName: cn=admin,dc=suretecsystems,dc=com + createTimestamp: 20051123130912Z + modifyTimestamp: 20051123130912Z + entryCSN: 20051123130912.000000Z#000001#000#000000 + auditContext: cn=accesslog + # end add 1196797576 + + # add 1196797577 dc=suretecsystems,dc=com cn=admin,dc=suretecsystems,dc=com + dn: ou=Groups,dc=suretecsystems,dc=com + changetype: add + objectClass: top + objectClass: organizationalUnit + ou: Groups + structuralObjectClass: organizationalUnit + entryUUID: 160aaa2a-f06e-1029-828a-f0cc9d81e81a + creatorsName: cn=admin,dc=suretecsystems,dc=com + modifiersName: cn=admin,dc=suretecsystems,dc=com + createTimestamp: 20051123130912Z + modifyTimestamp: 20051123130912Z + entryCSN: 20051123130912.000000Z#000002#000#000000 + # end add 1196797577 +</PRE> +<H3><A NAME="Further Information">12.2.3. Further Information</A></H3> +<P><EM>slapo-auditlog(5)</EM></P> +<H2><A NAME="Chaining">12.3. Chaining</A></H2> +<H3><A NAME="Overview">12.3.1. Overview</A></H3> +<P>The chain overlay provides basic chaining capability to the underlying database.</P> +<P>What is chaining? It indicates the capability of a DSA to follow referrals on behalf of the client, so that distributed systems are viewed as a single virtual DSA by clients that are otherwise unable to "chase" (i.e. follow) referrals by themselves.</P> +<P>The chain overlay is built on top of the ldap backend; it is compiled by default when <B>--enable-ldap</B>.</P> +<H3><A NAME="Chaining Configuration">12.3.2. Chaining Configuration</A></H3> +<P>In order to demonstrate how this overlay works, we shall discuss a typical scenario which might be one master server and three Syncrepl slaves.</P> +<P>On each replica, add this near the top of the <EM>slapd.conf</EM>(5) file (global), before any database definitions:</P> +<PRE> + overlay chain + chain-uri "ldap://ldapmaster.example.com" + chain-idassert-bind bindmethod="simple" + binddn="cn=Manager,dc=example,dc=com" + credentials="<secret>" + mode="self" + chain-tls start + chain-return-error TRUE +</PRE> +<P>Add this below your <EM>syncrepl</EM> statement:</P> +<PRE> + updateref "ldap://ldapmaster.example.com/" +</PRE> +<P>The <B>chain-tls</B> statement enables TLS from the slave to the ldap master. The DITs are exactly the same between these machines, therefore whatever user bound to the slave will also exist on the master. If that DN does not have update privileges on the master, nothing will happen.</P> +<P>You will need to restart the slave after these <EM>slapd.conf</EM> changes. Then, if you are using <EM>loglevel stats</EM> (256), you can monitor an <EM>ldapmodify</EM> on the slave and the master. (If you're using <EM>cn=config</EM> no restart is required.)</P> +<P>Now start an <EM>ldapmodify</EM> on the slave and watch the logs. You should expect something like:</P> +<PRE> + Sep 6 09:27:25 slave1 slapd[29274]: conn=11 fd=31 ACCEPT from IP=143.199.102.216:45181 (IP=143.199.102.216:389) + Sep 6 09:27:25 slave1 slapd[29274]: conn=11 op=0 STARTTLS + Sep 6 09:27:25 slave1 slapd[29274]: conn=11 op=0 RESULT oid= err=0 text= + Sep 6 09:27:25 slave1 slapd[29274]: conn=11 fd=31 TLS established tls_ssf=256 ssf=256 + Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=1 BIND dn="uid=user1,ou=people,dc=example,dc=com" method=128 + Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=1 BIND dn="uid=user1,ou=People,dc=example,dc=com" mech=SIMPLE ssf=0 + Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=1 RESULT tag=97 err=0 text= + Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=2 MOD dn="uid=user1,ou=People,dc=example,dc=com" + Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=2 MOD attr=mail + Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=2 RESULT tag=103 err=0 text= + Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=3 UNBIND + Sep 6 09:27:28 slave1 slapd[29274]: conn=11 fd=31 closed + Sep 6 09:27:28 slave1 slapd[29274]: syncrepl_entry: LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) + Sep 6 09:27:28 slave1 slapd[29274]: syncrepl_entry: be_search (0) + Sep 6 09:27:28 slave1 slapd[29274]: syncrepl_entry: uid=user1,ou=People,dc=example,dc=com + Sep 6 09:27:28 slave1 slapd[29274]: syncrepl_entry: be_modify (0) +</PRE> +<P>And on the master you will see this:</P> +<PRE> + Sep 6 09:23:57 ldapmaster slapd[2961]: conn=55902 op=3 PROXYAUTHZ dn="uid=user1,ou=people,dc=example,dc=com" + Sep 6 09:23:57 ldapmaster slapd[2961]: conn=55902 op=3 MOD dn="uid=user1,ou=People,dc=example,dc=com" + Sep 6 09:23:57 ldapmaster slapd[2961]: conn=55902 op=3 MOD attr=mail + Sep 6 09:23:57 ldapmaster slapd[2961]: conn=55902 op=3 RESULT tag=103 err=0 text= +</PRE> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>You can clearly see the PROXYAUTHZ line on the master, indicating the proper identity assertion for the update on the master. Also note the slave immediately receiving the Syncrepl update from the master. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="Handling Chaining Errors">12.3.3. Handling Chaining Errors</A></H3> +<P>By default, if chaining fails, the original referral is returned to the client under the assumption that the client might want to try and follow the referral.</P> +<P>With the following directive however, if the chaining fails at the provider side, the actual error is returned to the client.</P> +<PRE> + chain-return-error TRUE +</PRE> +<H3><A NAME="Read-Back of Chained Modifications">12.3.4. Read-Back of Chained Modifications</A></H3> +<P>Occasionally, applications want to read back the data that they just wrote. If a modification requested to a shadow server was silently chained to its provider, an immediate read could result in receiving data not yet synchronized. In those cases, clients should use the <B>dontusecopy</B> control to ensure they are directed to the authoritative source for that piece of data.</P> +<P>This control usually causes a referral to the actual source of the data to be returned. However, when the <EM>slapo-chain(5)</EM> overlay is used, it intercepts the referral being returned in response to the <B>dontusecopy</B> control, and tries to fetch the requested data.</P> +<H3><A NAME="Further Information">12.3.5. Further Information</A></H3> +<P><EM>slapo-chain(5)</EM></P> +<H2><A NAME="Constraints">12.4. Constraints</A></H2> +<H3><A NAME="Overview">12.4.1. Overview</A></H3> +<P>This overlay enforces a regular expression constraint on all values of specified attributes during an LDAP modify request that contains add or modify commands. It is used to enforce a more rigorous syntax when the underlying attribute syntax is too general.</P> +<H3><A NAME="Constraint Configuration">12.4.2. Constraint Configuration</A></H3> +<P>Configuration via <EM>slapd.conf</EM>(5) would look like:</P> +<PRE> + overlay constraint + constraint_attribute mail regex ^[[:alnum:]]+@mydomain.com$ + constraint_attribute title uri + ldap:///dc=catalog,dc=example,dc=com?title?sub?(objectClass=titleCatalog) +</PRE> +<P>A specification like the above would reject any <EM>mail</EM> attribute which did not look like <EM><alpha-numeric string>@mydomain.com</EM>.</P> +<P>It would also reject any title attribute whose values were not listed in the title attribute of any <EM>titleCatalog</EM> entries in the given scope.</P> +<P>An example for use with <EM>cn=config</EM>:</P> +<PRE> + dn: olcOverlay=constraint,olcDatabase={1}mdb,cn=config + changetype: add + objectClass: olcOverlayConfig + objectClass: olcConstraintConfig + olcOverlay: constraint + olcConstraintAttribute: mail regex ^[[:alnum:]]+@mydomain.com$ + olcConstraintAttribute: title uri ldap:///dc=catalog,dc=example,dc=com?title?sub?(objectClass=titleCatalog) +</PRE> +<H3><A NAME="Further Information">12.4.3. Further Information</A></H3> +<P><EM>slapo-constraint(5)</EM></P> +<H2><A NAME="Dynamic Directory Services">12.5. Dynamic Directory Services</A></H2> +<H3><A NAME="Overview">12.5.1. Overview</A></H3> +<P>The <EM>dds</EM> overlay to <EM>slapd</EM>(8) implements dynamic objects as per <A HREF="http://www.rfc-editor.org/rfc/rfc2589.txt">RFC2589</A>. The name <EM>dds</EM> stands for Dynamic Directory Services. It allows to define dynamic objects, characterized by the <EM>dynamicObject</EM> objectClass.</P> +<P>Dynamic objects have a limited lifetime, determined by a time-to-live (TTL) that can be refreshed by means of a specific refresh extended operation. This operation allows to set the Client Refresh Period (CRP), namely the period between refreshes that is required to preserve the dynamic object from expiration. The expiration time is computed by adding the requested TTL to the current time. When dynamic objects reach the end of their lifetime without being further refreshed, they are automatically <EM>deleted</EM>. There is no guarantee of immediate deletion, so clients should not count on it.</P> +<H3><A NAME="Dynamic Directory Service Configuration">12.5.2. Dynamic Directory Service Configuration</A></H3> +<P>A usage of dynamic objects might be to implement dynamic meetings; in this case, all the participants to the meeting are allowed to refresh the meeting object, but only the creator can delete it (otherwise it will be deleted when the TTL expires).</P> +<P>If we add the overlay to an example database, specifying a Max TTL of 1 day, a min of 10 seconds, with a default TTL of 1 hour. We'll also specify an interval of 120 (less than 60s might be too small) seconds between expiration checks and a tolerance of 5 second (lifetime of a dynamic object will be <EM>entryTtl + tolerance</EM>).</P> +<PRE> + overlay dds + dds-max-ttl 1d + dds-min-ttl 10s + dds-default-ttl 1h + dds-interval 120s + dds-tolerance 5s +</PRE> +<P>and add an index:</P> +<PRE> + entryExpireTimestamp +</PRE> +<P>Creating a meeting is as simple as adding the following:</P> +<PRE> + dn: cn=OpenLDAP Documentation Meeting,ou=Meetings,dc=example,dc=com + objectClass: groupOfNames + objectClass: dynamicObject + cn: OpenLDAP Documentation Meeting + member: uid=ghenry,ou=People,dc=example,dc=com + member: uid=hyc,ou=People,dc=example,dc=com +</PRE> +<H4><A NAME="Dynamic Directory Service ACLs">12.5.2.1. Dynamic Directory Service ACLs</A></H4> +<P>Allow users to start a meeting and to join it; restrict refresh to the <EM>member</EM>; restrict delete to the creator:</P> +<PRE> + access to attrs=userPassword + by self write + by * read + + access to dn.base="ou=Meetings,dc=example,dc=com" + attrs=children + by users write + + access to dn.onelevel="ou=Meetings,dc=example,dc=com" + attrs=entry + by dnattr=creatorsName write + by * read + + access to dn.onelevel="ou=Meetings,dc=example,dc=com" + attrs=participant + by dnattr=creatorsName write + by users selfwrite + by * read + + access to dn.onelevel="ou=Meetings,dc=example,dc=com" + attrs=entryTtl + by dnattr=member manage + by * read +</PRE> +<P>In simple terms, the user who created the <EM>OpenLDAP Documentation Meeting</EM> can add new attendees, refresh the meeting using (basically complete control):</P> +<PRE> + ldapexop -x -H ldap://ldaphost "refresh" "cn=OpenLDAP Documentation Meeting,ou=Meetings,dc=example,dc=com" "120" -D "uid=ghenry,ou=People,dc=example,dc=com" -W +</PRE> +<P>Any user can join the meeting, but not add another attendee, but they can refresh the meeting. The ACLs above are quite straight forward to understand.</P> +<H3><A NAME="Further Information">12.5.3. Further Information</A></H3> +<P><EM>slapo-dds(5)</EM></P> +<H2><A NAME="Dynamic Groups">12.6. Dynamic Groups</A></H2> +<H3><A NAME="Overview">12.6.1. Overview</A></H3> +<P>This overlay extends the Compare operation to detect members of a dynamic group. This overlay is now deprecated as all of its functions are available using the <A HREF="#Dynamic Lists">Dynamic Lists</A> overlay.</P> +<H3><A NAME="Dynamic Group Configuration">12.6.2. Dynamic Group Configuration</A></H3> +<H2><A NAME="Dynamic Lists">12.7. Dynamic Lists</A></H2> +<H3><A NAME="Overview">12.7.1. Overview</A></H3> +<P>This overlay allows expansion of dynamic groups and lists. Instead of having the group members or list attributes hard coded, this overlay allows us to define an LDAP search whose results will make up the group or list.</P> +<H3><A NAME="Dynamic List Configuration">12.7.2. Dynamic List Configuration</A></H3> +<P>This module can behave both as a dynamic list and dynamic group, depending on the configuration. The syntax is as follows:</P> +<PRE> + overlay dynlist + dynlist-attrset <group-oc> <URL-ad> [member-ad] +</PRE> +<P>The parameters to the <TT>dynlist-attrset</TT> directive have the following meaning:</P> +<UL> +<LI><TT><group-oc></TT>: specifies which object class triggers the subsequent LDAP search. Whenever an entry with this object class is retrieved, the search is performed. +<LI><TT><URL-ad></TT>: is the name of the attribute which holds the search URI. It has to be a subtype of <TT>labeledURI</TT>. The attributes and values present in the search result are added to the entry unless <TT>member-ad</TT> is used (see below). +<LI><TT>member-ad</TT>: if present, changes the overlay behavior into a dynamic group. Instead of inserting the results of the search in the entry, the distinguished name of the results are added as values of this attribute.</UL> +<P>Here is an example which will allow us to have an email alias which automatically expands to all user's emails according to our LDAP filter:</P> +<P>In <EM>slapd.conf</EM>(5):</P> +<PRE> + overlay dynlist + dynlist-attrset nisMailAlias labeledURI +</PRE> +<P>This means that whenever an entry which has the <TT>nisMailAlias</TT> object class is retrieved, the search specified in the <TT>labeledURI</TT> attribute is performed.</P> +<P>Let's say we have this entry in our directory:</P> +<PRE> + cn=all,ou=aliases,dc=example,dc=com + cn: all + objectClass: nisMailAlias + labeledURI: ldap:///ou=People,dc=example,dc=com?mail?one?(objectClass=inetOrgPerson) +</PRE> +<P>If this entry is retrieved, the search specified in <TT>labeledURI</TT> will be performed and the results will be added to the entry just as if they have always been there. In this case, the search filter selects all entries directly under <TT>ou=People</TT> that have the <TT>inetOrgPerson</TT> object class and retrieves the <TT>mail</TT> attribute, if it exists.</P> +<P>This is what gets added to the entry when we have two users under <TT>ou=People</TT> that match the filter:</P> +<P><CENTER><IMG SRC="allmail-en.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure X.Y: Dynamic List for all emails</P> +<P>The configuration for a dynamic group is similar. Let's see an example which would automatically populate an <TT>allusers</TT> group with all the user accounts in the directory.</P> +<P>In <TT>slapd.conf</TT>(5):</P> +<PRE> + include /path/to/dyngroup.schema + ... + overlay dynlist + dynlist-attrset groupOfURLs labeledURI member +</PRE> +<OL> +<LI> +<LI>Note: We must include the <TT>dyngroup.schema</TT> file that defines the +<LI><TT>groupOfURLs</TT> objectClass used in this example.</OL> +<P>Let's apply it to the following entry:</P> +<PRE> + cn=allusers,ou=group,dc=example,dc=com + cn: all + objectClass: groupOfURLs + labeledURI: ldap:///ou=people,dc=example,dc=com??one?(objectClass=inetOrgPerson) +</PRE> +<P>The behavior is similar to the dynamic list configuration we had before: whenever an entry with the <TT>groupOfURLs</TT> object class is retrieved, the search specified in the <TT>labeledURI</TT> attribute is performed. But this time, only the distinguished names of the results are added, and as values of the <TT>member</TT> attribute.</P> +<P>This is what we get:</P> +<P><CENTER><IMG SRC="allusersgroup-en.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure X.Y: Dynamic Group for all users</P> +<P>Note that a side effect of this scheme of dynamic groups is that the members need to be specified as full DNs. So, if you are planning in using this for <TT>posixGroup</TT>s, be sure to use RFC2307bis and some attribute which can hold distinguished names. The <TT>memberUid</TT> attribute used in the <TT>posixGroup</TT> object class can hold only names, not DNs, and is therefore not suitable for dynamic groups.</P> +<H3><A NAME="Further Information">12.7.3. Further Information</A></H3> +<P><EM>slapo-dynlist(5)</EM></P> +<H2><A NAME="Reverse Group Membership Maintenance">12.8. Reverse Group Membership Maintenance</A></H2> +<H3><A NAME="Overview">12.8.1. Overview</A></H3> +<P>In some scenarios, it may be desirable for a client to be able to determine which groups an entry is a member of, without performing an additional search. Examples of this are applications using the <TERM>DIT</TERM> for access control based on group authorization.</P> +<P>The <B>memberof</B> overlay updates an attribute (by default <B>memberOf</B>) whenever changes occur to the membership attribute (by default <B>member</B>) of entries of the objectclass (by default <B>groupOfNames</B>) configured to trigger updates.</P> +<P>Thus, it provides maintenance of the list of groups an entry is a member of, when usual maintenance of groups is done by modifying the members on the group entry.</P> +<H3><A NAME="Member Of Configuration">12.8.2. Member Of Configuration</A></H3> +<P>The typical use of this overlay requires just enabling the overlay for a specific database. For example, with the following minimal slapd.conf:</P> +<PRE> + include /usr/share/openldap/schema/core.schema + include /usr/share/openldap/schema/cosine.schema + + authz-regexp "gidNumber=0\\\+uidNumber=0,cn=peercred,cn=external,cn=auth" + "cn=Manager,dc=example,dc=com" + database bdb + suffix "dc=example,dc=com" + rootdn "cn=Manager,dc=example,dc=com" + rootpw secret + directory /var/lib/ldap2.4 + checkpoint 256 5 + index objectClass eq + index uid eq,sub + + overlay memberof +</PRE> +<P>adding the following ldif:</P> +<PRE> + cat memberof.ldif + dn: dc=example,dc=com + objectclass: domain + dc: example + + dn: ou=Group,dc=example,dc=com + objectclass: organizationalUnit + ou: Group + + dn: ou=People,dc=example,dc=com + objectclass: organizationalUnit + ou: People + + dn: uid=test1,ou=People,dc=example,dc=com + objectclass: account + uid: test1 + + dn: cn=testgroup,ou=Group,dc=example,dc=com + objectclass: groupOfNames + cn: testgroup + member: uid=test1,ou=People,dc=example,dc=com +</PRE> +<P>Results in the following output from a search on the test1 user:</P> +<PRE> + # ldapsearch -LL -Y EXTERNAL -H ldapi:/// "(uid=test1)" -b dc=example,dc=com memberOf + SASL/EXTERNAL authentication started + SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth + SASL SSF: 0 + version: 1 + + dn: uid=test1,ou=People,dc=example,dc=com + memberOf: cn=testgroup,ou=Group,dc=example,dc=com +</PRE> +<P>Note that the <B>memberOf</B> attribute is an operational attribute, so it must be requested explicitly.</P> +<H3><A NAME="Further Information">12.8.3. Further Information</A></H3> +<P><EM>slapo-memberof(5)</EM></P> +<H2><A NAME="The Proxy Cache Engine">12.9. The Proxy Cache Engine</A></H2> +<P><TERM>LDAP</TERM> servers typically hold one or more subtrees of a <TERM>DIT</TERM>. Replica (or shadow) servers hold shadow copies of entries held by one or more master servers. Changes are propagated from the master server to replica (slave) servers using LDAP Sync replication. An LDAP cache is a special type of replica which holds entries corresponding to search filters instead of subtrees.</P> +<H3><A NAME="Overview">12.9.1. Overview</A></H3> +<P>The proxy cache extension of slapd is designed to improve the responsiveness of the ldap and meta backends. It handles a search request (query) by first determining whether it is contained in any cached search filter. Contained requests are answered from the proxy cache's local database. Other requests are passed on to the underlying ldap or meta backend and processed as usual.</P> +<P>E.g. <TT>(shoesize>=9)</TT> is contained in <TT>(shoesize>=8)</TT> and <TT>(sn=Richardson)</TT> is contained in <TT>(sn=Richards*)</TT></P> +<P>Correct matching rules and syntaxes are used while comparing assertions for query containment. To simplify the query containment problem, a list of cacheable "templates" (defined below) is specified at configuration time. A query is cached or answered only if it belongs to one of these templates. The entries corresponding to cached queries are stored in the proxy cache local database while its associated meta information (filter, scope, base, attributes) is stored in main memory.</P> +<P>A template is a prototype for generating LDAP search requests. Templates are described by a prototype search filter and a list of attributes which are required in queries generated from the template. The representation for prototype filter is similar to <A HREF="http://www.rfc-editor.org/rfc/rfc4515.txt">RFC4515</A>, except that the assertion values are missing. Examples of prototype filters are: (sn=),(&(sn=)(givenname=)) which are instantiated by search filters (sn=Doe) and (&(sn=Doe)(givenname=John)) respectively.</P> +<P>The cache replacement policy removes the least recently used (LRU) query and entries belonging to only that query. Queries are allowed a maximum time to live (TTL) in the cache thus providing weak consistency. A background task periodically checks the cache for expired queries and removes them.</P> +<P>The Proxy Cache paper (<A HREF="http://www.openldap.org/pub/kapurva/proxycaching.pdf">http://www.openldap.org/pub/kapurva/proxycaching.pdf</A>) provides design and implementation details.</P> +<H3><A NAME="Proxy Cache Configuration">12.9.2. Proxy Cache Configuration</A></H3> +<P>The cache configuration specific directives described below must appear after a <TT>overlay pcache</TT> directive within a <TT>"database meta"</TT> or <TT>"database ldap"</TT> section of the server's <EM>slapd.conf</EM>(5) file.</P> +<H4><A NAME="Setting cache parameters">12.9.2.1. Setting cache parameters</A></H4> +<PRE> + pcache <DB> <maxentries> <nattrsets> <entrylimit> <period> +</PRE> +<P>This directive enables proxy caching and sets general cache parameters. The <DB> parameter specifies which underlying database is to be used to hold cached entries. It should be set to <TT>bdb</TT> or <TT>hdb</TT>. The <maxentries> parameter specifies the total number of entries which may be held in the cache. The <nattrsets> parameter specifies the total number of attribute sets (as specified by the <TT>pcacheAttrset</TT> directive) that may be defined. The <entrylimit> parameter specifies the maximum number of entries in a cacheable query. The <period> specifies the consistency check period (in seconds). In each period, queries with expired TTLs are removed.</P> +<H4><A NAME="Defining attribute sets">12.9.2.2. Defining attribute sets</A></H4> +<PRE> + pcacheAttrset <index> <attrs...> +</PRE> +<P>Used to associate a set of attributes to an index. Each attribute set is associated with an index number from 0 to <numattrsets>-1. These indices are used by the pcacheTemplate directive to define cacheable templates.</P> +<H4><A NAME="Specifying cacheable templates">12.9.2.3. Specifying cacheable templates</A></H4> +<PRE> + pcacheTemplate <prototype_string> <attrset_index> <TTL> +</PRE> +<P>Specifies a cacheable template and the "time to live" (in sec) <TTL> for queries belonging to the template. A template is described by its prototype filter string and set of required attributes identified by <attrset_index>.</P> +<H4><A NAME="Example for slapd.conf">12.9.2.4. Example for slapd.conf</A></H4> +<P>An example <EM>slapd.conf</EM>(5) database section for a caching server which proxies for the <TT>"dc=example,dc=com"</TT> subtree held at server <TT>ldap.example.com</TT>.</P> +<PRE> + database ldap + suffix "dc=example,dc=com" + rootdn "dc=example,dc=com" + uri ldap://ldap.example.com/ + overlay pcache + pcache hdb 100000 1 1000 100 + pcacheAttrset 0 mail postaladdress telephonenumber + pcacheTemplate (sn=) 0 3600 + pcacheTemplate (&(sn=)(givenName=)) 0 3600 + pcacheTemplate (&(departmentNumber=)(secretary=*)) 0 3600 + + cachesize 20 + directory ./testrun/db.2.a + index objectClass eq + index cn,sn,uid,mail pres,eq,sub +</PRE> +<H4><A NAME="Example for slapd-config">12.9.2.5. Example for slapd-config</A></H4> +<P>The same example as a LDIF file for back-config for a caching server which proxies for the <TT>"dc=example,dc=com"</TT> subtree held at server <TT>ldap.example.com</TT>.</P> +<PRE> + dn: olcDatabase={2}ldap,cn=config + objectClass: olcDatabaseConfig + objectClass: olcLDAPConfig + olcDatabase: {2}ldap + olcSuffix: dc=example,dc=com + olcRootDN: dc=example,dc=com + olcDbURI: "ldap://ldap.example.com" + + dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config + objectClass: olcOverlayConfig + objectClass: olcPcacheConfig + olcOverlay: {0}pcache + olcPcache: hdb 100000 1 1000 100 + olcPcacheAttrset: 0 mail postalAddress telephoneNumber + olcPcacheTemplate: "(sn=)" 0 3600 0 0 0 + olcPcacheTemplate: "(&(sn=)(givenName=))" 0 3600 0 0 0 + olcPcacheTemplate: "(&(departmentNumber=)(secretary=))" 0 3600 + + dn: olcDatabase={0}mdb,olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config + objectClass: olcMdbConfig + objectClass: olcPcacheDatabase + olcDatabase: {0}mdb + olcDbDirectory: ./testrun/db.2.a + olcDbCacheSize: 20 + olcDbIndex: objectClass eq + olcDbIndex: cn,sn,uid,mail pres,eq,sub +</PRE> +<H5><A NAME="Cacheable Queries">12.9.2.5.1. Cacheable Queries</A></H5> +<P>A LDAP search query is cacheable when its filter matches one of the templates as defined in the "pcacheTemplate" statements and when it references only the attributes specified in the corresponding attribute set. In the example above the attribute set number 0 defines that only the attributes: <TT>mail postaladdress telephonenumber</TT> are cached for the following pcacheTemplates.</P> +<H5><A NAME="Examples:">12.9.2.5.2. Examples:</A></H5> +<PRE> + Filter: (&(sn=Richard*)(givenName=jack)) + Attrs: mail telephoneNumber +</PRE> +<P>is cacheable, because it matches the template <TT>(&(sn=)(givenName=))</TT> and its attributes are contained in pcacheAttrset 0.</P> +<PRE> + Filter: (&(sn=Richard*)(telephoneNumber)) + Attrs: givenName +</PRE> +<P>is not cacheable, because the filter does not match the template, nor is the attribute givenName stored in the cache</P> +<PRE> + Filter: (|(sn=Richard*)(givenName=jack)) + Attrs: mail telephoneNumber +</PRE> +<P>is not cacheable, because the filter does not match the template ( logical OR "|" condition instead of logical AND "&" )</P> +<H3><A NAME="Further Information">12.9.3. Further Information</A></H3> +<P><EM>slapo-pcache(5)</EM></P> +<H2><A NAME="Password Policies">12.10. Password Policies</A></H2> +<H3><A NAME="Overview">12.10.1. Overview</A></H3> +<P>This overlay follows the specifications contained in the draft RFC titled draft-behera-ldap-password-policy-09. While the draft itself is expired, it has been implemented in several directory servers, including slapd. Nonetheless, it is important to note that it is a draft, meaning that it is subject to change and is a work-in-progress.</P> +<P>The key abilities of the password policy overlay are as follows:</P> +<UL> +<LI>Enforce a minimum length for new passwords +<LI>Make sure passwords are not changed too frequently +<LI>Cause passwords to expire, provide warnings before they need to be changed, and allow a fixed number of 'grace' logins to allow them to be changed after they have expired +<LI>Maintain a history of passwords to prevent password re-use +<LI>Prevent password guessing by locking a password for a specified period of time after repeated authentication failures +<LI>Force a password to be changed at the next authentication +<LI>Set an administrative lock on an account +<LI>Support multiple password policies on a default or a per-object basis. +<LI>Perform arbitrary quality checks using an external loadable module. This is a non-standard extension of the draft RFC.</UL> +<H3><A NAME="Password Policy Configuration">12.10.2. Password Policy Configuration</A></H3> +<P>Instantiate the module in the database where it will be used, after adding the new ppolicy schema and loading the ppolicy module. The following example shows the ppolicy module being added to the database that handles the naming context "dc=example,dc=com". In this example we are also specifying the DN of a policy object to use if none other is specified in a user's object.</P> +<PRE> + database bdb + suffix "dc=example,dc=com" + [...additional database configuration directives go here...] + + overlay ppolicy + ppolicy_default "cn=default,ou=policies,dc=example,dc=com" +</PRE> +<P>Now we need a container for the policy objects. In our example the password policy objects are going to be placed in a section of the tree called "ou=policies,dc=example,dc=com":</P> +<PRE> + dn: ou=policies,dc=example,dc=com + objectClass: organizationalUnit + objectClass: top + ou: policies +</PRE> +<P>The default policy object that we are creating defines the following policies:</P> +<UL> +<LI>The user is allowed to change his own password. Note that the directory ACLs for this attribute can also affect this ability (pwdAllowUserChange: TRUE). +<LI>The name of the password attribute is "userPassword" (pwdAttribute: userPassword). Note that this is the only value that is accepted by OpenLDAP for this attribute. +<LI>The server will check the syntax of the password. If the server is unable to check the syntax (i.e., it was hashed or otherwise encoded by the client) it will return an error refusing the password (pwdCheckQuality: 2). +<LI>When a client includes the Password Policy Request control with a bind request, the server will respond with a password expiration warning if it is going to expire in ten minutes or less (pwdExpireWarning: 600). The warnings themselves are returned in a Password Policy Response control. +<LI>When the password for a DN has expired, the server will allow five additional "grace" logins (pwdGraceAuthNLimit: 5). +<LI>The server will maintain a history of the last five passwords that were used for a DN (pwdInHistory: 5). +<LI>The server will lock the account after the maximum number of failed bind attempts has been exceeded (pwdLockout: TRUE). +<LI>When the server has locked an account, the server will keep it locked until an administrator unlocks it (pwdLockoutDuration: 0) +<LI>The server will reset its failed bind count after a period of 30 seconds. +<LI>Passwords will not expire (pwdMaxAge: 0). +<LI>Passwords can be changed as often as desired (pwdMinAge: 0). +<LI>Passwords must be at least 5 characters in length (pwdMinLength: 5). +<LI>The password does not need to be changed at the first bind or when the administrator has reset the password (pwdMustChange: FALSE) +<LI>The current password does not need to be included with password change requests (pwdSafeModify: FALSE) +<LI>The server will only allow five failed binds in a row for a particular DN (pwdMaxFailure: 5).</UL> +<P>The actual policy would be:</P> +<PRE> + dn: cn=default,ou=policies,dc=example,dc=com + cn: default + objectClass: pwdPolicy + objectClass: person + objectClass: top + pwdAllowUserChange: TRUE + pwdAttribute: userPassword + pwdCheckQuality: 2 + pwdExpireWarning: 600 + pwdFailureCountInterval: 30 + pwdGraceAuthNLimit: 5 + pwdInHistory: 5 + pwdLockout: TRUE + pwdLockoutDuration: 0 + pwdMaxAge: 0 + pwdMaxFailure: 5 + pwdMinAge: 0 + pwdMinLength: 5 + pwdMustChange: FALSE + pwdSafeModify: FALSE + sn: dummy value +</PRE> +<P>You can create additional policy objects as needed.</P> +<P>There are two ways password policy can be applied to individual objects:</P> +<P>1. The pwdPolicySubentry in a user's object - If a user's object has a pwdPolicySubEntry attribute specifying the DN of a policy object, then the policy defined by that object is applied.</P> +<P>2. Default password policy - If there is no specific pwdPolicySubentry set for an object, and the password policy module was configured with the DN of a default policy object and if that object exists, then the policy defined in that object is applied.</P> +<P>Please see <EM>slapo-ppolicy(5)</EM> for complete explanations of features and discussion of "Password Management Issues" at <A HREF="http://www.symas.com/blog/?page_id=66">http://www.symas.com/blog/?page_id=66</A></P> +<H3><A NAME="Further Information">12.10.3. Further Information</A></H3> +<P><EM>slapo-ppolicy(5)</EM></P> +<H2><A NAME="Referential Integrity">12.11. Referential Integrity</A></H2> +<H3><A NAME="Overview">12.11.1. Overview</A></H3> +<P>This overlay can be used with a backend database such as slapd-bdb(5) to maintain the cohesiveness of a schema which utilizes reference attributes.</P> +<P>Whenever a <EM>modrdn</EM> or <EM>delete</EM> is performed, that is, when an entry's DN is renamed or an entry is removed, the server will search the directory for references to this DN (in selected attributes: see below) and update them accordingly. If it was a <EM>delete</EM> operation, the reference is deleted. If it was a <EM>modrdn</EM> operation, then the reference is updated with the new DN.</P> +<P>For example, a very common administration task is to maintain group membership lists, specially when users are removed from the directory. When an user account is deleted or renamed, all groups this user is a member of have to be updated. LDAP administrators usually have scripts for that. But we can use the <TT>refint</TT> overlay to automate this task. In this example, if the user is removed from the directory, the overlay will take care to remove the user from all the groups he/she was a member of. No more scripting for this.</P> +<H3><A NAME="Referential Integrity Configuration">12.11.2. Referential Integrity Configuration</A></H3> +<P>The configuration for this overlay is as follows:</P> +<PRE> + overlay refint + refint_attributes <attribute [attribute ...]> + refint_nothing <string> +</PRE> +<UL> +<LI><TT>refint_attributes</TT>: this parameter specifies a space separated list of attributes which will have the referential integrity maintained. When an entry is removed or has its DN renamed, the server will do an internal search for any of the <TT>refint_attributes</TT> that point to the affected DN and update them accordingly. IMPORTANT: the attributes listed here must have the <TT>distinguishedName</TT> syntax, that is, hold DNs as values. +<LI><TT>refint_nothing</TT>: some times, while trying to maintain the referential integrity, the server has to remove the last attribute of its kind from an entry. This may be prohibited by the schema: for example, the <TT>groupOfNames</TT> object class requires at least one member. In these cases, the server will add the attribute value specified in <TT>refint_nothing</TT> to the entry.</UL> +<P>To illustrate this overlay, we will use the group membership scenario.</P> +<P>In <TT>slapd.conf</TT>:</P> +<PRE> + overlay refint + refint_attributes member + refint_nothing "cn=admin,dc=example,dc=com" +</PRE> +<P>This configuration tells the overlay to maintain the referential integrity of the <TT>member</TT> attribute. This attribute is used in the <TT>groupOfNames</TT> object class which always needs a member, so we add the <TT>refint_nothing</TT> directive to fill in the group with a standard member should all the members vanish.</P> +<P>If we have the following group membership, the refint overlay will automatically remove <TT>john</TT> from the group if his entry is removed from the directory:</P> +<P><CENTER><IMG SRC="refint.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure X.Y: Maintaining referential integrity in groups</P> +<P>Notice that if we rename (<TT>modrdn</TT>) the <TT>john</TT> entry to, say, <TT>jsmith</TT>, the refint overlay will also rename the reference in the <TT>member</TT> attribute, so the group membership stays correct.</P> +<P>If we removed all users from the directory who are a member of this group, then the end result would be a single member in the group: <TT>cn=admin,dc=example,dc=com</TT>. This is the <TT>refint_nothing</TT> parameter kicking into action so that the schema is not violated.</P> +<P>The <EM>rootdn</EM> must be set for the database as refint runs as the <EM>rootdn</EM> to gain access to make its updates. The <EM>rootpw</EM> does not need to be set.</P> +<H3><A NAME="Further Information">12.11.3. Further Information</A></H3> +<P><EM>slapo-refint(5)</EM></P> +<H2><A NAME="Return Code">12.12. Return Code</A></H2> +<H3><A NAME="Overview">12.12.1. Overview</A></H3> +<P>This overlay is useful to test the behavior of clients when server-generated erroneous and/or unusual responses occur, for example; error codes, referrals, excessive response times and so on.</P> +<P>This would be classed as a debugging tool whilst developing client software or additional Overlays.</P> +<P>For detailed information, please see the <EM>slapo-retcode(5)</EM> man page.</P> +<H3><A NAME="Return Code Configuration">12.12.2. Return Code Configuration</A></H3> +<P>The retcode overlay utilizes the "return code" schema described in the man page. This schema is specifically designed for use with this overlay and is not intended to be used otherwise.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>The necessary schema is loaded automatically by the overlay. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>An example configuration might be:</P> +<PRE> + overlay retcode + retcode-parent "ou=RetCodes,dc=example,dc=com" + include ./retcode.conf + + retcode-item "cn=Unsolicited" 0x00 unsolicited="0" + retcode-item "cn=Notice of Disconnect" 0x00 unsolicited="1.3.6.1.4.1.1466.20036" + retcode-item "cn=Pre-disconnect" 0x34 flags="pre-disconnect" + retcode-item "cn=Post-disconnect" 0x34 flags="post-disconnect" +</PRE> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG><EM>retcode.conf</EM> can be found in the openldap source at: <TT>tests/data/retcode.conf</TT> +<HR WIDTH="80%" ALIGN="Left"></P> +<P>An excerpt of a <TT>retcode.conf</TT> would be something like:</P> +<PRE> + retcode-item "cn=success" 0x00 + + retcode-item "cn=success w/ delay" 0x00 sleeptime=2 + + retcode-item "cn=operationsError" 0x01 + retcode-item "cn=protocolError" 0x02 + retcode-item "cn=timeLimitExceeded" 0x03 op=search + retcode-item "cn=sizeLimitExceeded" 0x04 op=search + retcode-item "cn=compareFalse" 0x05 op=compare + retcode-item "cn=compareTrue" 0x06 op=compare + retcode-item "cn=authMethodNotSupported" 0x07 + retcode-item "cn=strongAuthNotSupported" 0x07 text="same as authMethodNotSupported" + retcode-item "cn=strongAuthRequired" 0x08 + retcode-item "cn=strongerAuthRequired" 0x08 text="same as strongAuthRequired" +</PRE> +<P>Please see <TT>tests/data/retcode.conf</TT> for a complete <TT>retcode.conf</TT></P> +<H3><A NAME="Further Information">12.12.3. Further Information</A></H3> +<P><EM>slapo-retcode(5)</EM></P> +<H2><A NAME="Rewrite/Remap">12.13. Rewrite/Remap</A></H2> +<H3><A NAME="Overview">12.13.1. Overview</A></H3> +<P>It performs basic DN/data rewrite and objectClass/attributeType mapping. Its usage is mostly intended to provide virtual views of existing data either remotely, in conjunction with the proxy backend described in <EM>slapd-ldap(5)</EM>, or locally, in conjunction with the relay backend described in <EM>slapd-relay(5)</EM>.</P> +<P>This overlay is extremely configurable and advanced, therefore recommended reading is the <EM>slapo-rwm(5)</EM> man page.</P> +<H3><A NAME="Rewrite/Remap Configuration">12.13.2. Rewrite/Remap Configuration</A></H3> +<H3><A NAME="Further Information">12.13.3. Further Information</A></H3> +<P><EM>slapo-rwm(5)</EM></P> +<H2><A NAME="Sync Provider">12.14. Sync Provider</A></H2> +<H3><A NAME="Overview">12.14.1. Overview</A></H3> +<P>This overlay implements the provider-side support for the LDAP Content Synchronization (<A HREF="http://www.rfc-editor.org/rfc/rfc4533.txt">RFC4533</A>) as well as syncrepl replication support, including persistent search functionality.</P> +<H3><A NAME="Sync Provider Configuration">12.14.2. Sync Provider Configuration</A></H3> +<P>There is very little configuration needed for this overlay, in fact for many situations merely loading the overlay will suffice.</P> +<P>However, because the overlay creates a contextCSN attribute in the root entry of the database which is updated for every write operation performed against the database and only updated in memory, it is recommended to configure a checkpoint so that the contextCSN is written into the underlying database to minimize recovery time after an unclean shutdown:</P> +<PRE> + overlay syncprov + syncprov-checkpoint 100 10 +</PRE> +<P>For every 100 operations or 10 minutes, which ever is sooner, the contextCSN will be checkpointed.</P> +<P>The four configuration directives available are <B>syncprov-checkpoint</B>, <B>syncprov-sessionlog</B>, <B>syncprov-nopresent</B> and <B>syncprov-reloadhint</B> which are covered in the man page discussing various other scenarios where this overlay can be used.</P> +<H3><A NAME="Further Information">12.14.3. Further Information</A></H3> +<P>The <EM>slapo-syncprov(5)</EM> man page and the <A HREF="#Configuring the different replication types">Configuring the different replication types</A> section</P> +<H2><A NAME="Translucent Proxy">12.15. Translucent Proxy</A></H2> +<H3><A NAME="Overview">12.15.1. Overview</A></H3> +<P>This overlay can be used with a backend database such as <EM>slapd-bdb</EM>(5) to create a "translucent proxy".</P> +<P>Entries retrieved from a remote LDAP server may have some or all attributes overridden, or new attributes added, by entries in the local database before being presented to the client.</P> +<P>A search operation is first populated with entries from the remote LDAP server, the attributes of which are then overridden with any attributes defined in the local database. Local overrides may be populated with the add, modify, and modrdn operations, the use of which is restricted to the root user of the translucent local database.</P> +<P>A compare operation will perform a comparison with attributes defined in the local database record (if any) before any comparison is made with data in the remote database.</P> +<H3><A NAME="Translucent Proxy Configuration">12.15.2. Translucent Proxy Configuration</A></H3> +<P>There are various options available with this overlay, but for this example we will demonstrate adding new attributes to a remote entry and also searching against these newly added local attributes. For more information about overriding remote entries and search configuration, please see <EM>slapo-translucent(5)</EM></P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>The Translucent Proxy overlay will disable schema checking in the local database, so that an entry consisting of overlay attributes need not adhere to the complete schema. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>First we configure the overlay in the normal manner:</P> +<PRE> + include /usr/local/etc/openldap/schema/core.schema + include /usr/local/etc/openldap/schema/cosine.schema + include /usr/local/etc/openldap/schema/nis.schema + include /usr/local/etc/openldap/schema/inetorgperson.schema + + pidfile ./slapd.pid + argsfile ./slapd.args + + database bdb + suffix "dc=suretecsystems,dc=com" + rootdn "cn=trans,dc=suretecsystems,dc=com" + rootpw secret + directory ./openldap-data + + index objectClass eq + + overlay translucent + translucent_local carLicense + + uri ldap://192.168.X.X:389 + lastmod off + acl-bind binddn="cn=admin,dc=suretecsystems,dc=com" credentials="blahblah" +</PRE> +<P>You will notice the overlay directive and a directive to say what attribute we want to be able to search against in the local database. We must also load the ldap backend which will connect to the remote directory server.</P> +<P>Now we take an example LDAP group:</P> +<PRE> + # itsupport, Groups, suretecsystems.com + dn: cn=itsupport,ou=Groups,dc=suretecsystems,dc=com + objectClass: posixGroup + objectClass: sambaGroupMapping + cn: itsupport + gidNumber: 1000 + sambaSID: S-1-5-21-XXX + sambaGroupType: 2 + displayName: itsupport + memberUid: ghenry + memberUid: joebloggs +</PRE> +<P>and create an LDIF file we can use to add our data to the local database, using some pretty strange choices of new attributes for demonstration purposes:</P> +<PRE> + [ghenry@suretec test_configs]$ cat test-translucent-add.ldif + dn: cn=itsupport,ou=Groups,dc=suretecsystems,dc=com + businessCategory: frontend-override + carLicense: LIVID + employeeType: special + departmentNumber: 9999999 + roomNumber: 41L-535 +</PRE> +<P>Searching against the proxy gives:</P> +<PRE> + [ghenry@suretec test_configs]$ ldapsearch -x -H ldap://127.0.0.1:9001 "(cn=itsupport)" + # itsupport, Groups, OxObjects, suretecsystems.com + dn: cn=itsupport,ou=Groups,ou=OxObjects,dc=suretecsystems,dc=com + objectClass: posixGroup + objectClass: sambaGroupMapping + cn: itsupport + gidNumber: 1003 + SAMBASID: S-1-5-21-XXX + SAMBAGROUPTYPE: 2 + displayName: itsupport + memberUid: ghenry + memberUid: joebloggs + roomNumber: 41L-535 + departmentNumber: 9999999 + employeeType: special + carLicense: LIVID + businessCategory: frontend-override +</PRE> +<P>Here we can see that the 5 new attributes are added to the remote entry before being returned to the our client.</P> +<P>Because we have configured a local attribute to search against:</P> +<PRE> + overlay translucent + translucent_local carLicense +</PRE> +<P>we can also search for that to return the completely fabricated entry:</P> +<PRE> + ldapsearch -x -H ldap://127.0.0.1:9001 (carLicense=LIVID) +</PRE> +<P>This is an extremely feature because you can then extend a remote directory server locally and also search against the local entries.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Because the translucent overlay does not perform any DN rewrites, the local and remote database instances must have the same suffix. Other configurations will probably fail with No Such Object and other errors +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="Further Information">12.15.3. Further Information</A></H3> +<P><EM>slapo-translucent(5)</EM></P> +<H2><A NAME="Attribute Uniqueness">12.16. Attribute Uniqueness</A></H2> +<H3><A NAME="Overview">12.16.1. Overview</A></H3> +<P>This overlay can be used with a backend database such as <EM>slapd-bdb(5)</EM> to enforce the uniqueness of some or all attributes within a subtree.</P> +<H3><A NAME="Attribute Uniqueness Configuration">12.16.2. Attribute Uniqueness Configuration</A></H3> +<P>This overlay is only effective on new data from the point the overlay is enabled. To check uniqueness for existing data, you can export and import your data again via the LDAP Add operation, which will not be suitable for large amounts of data, unlike <B>slapcat</B>.</P> +<P>For the following example, if uniqueness were enforced for the <B>mail</B> attribute, the subtree would be searched for any other records which also have a <B>mail</B> attribute containing the same value presented with an <B>add</B>, <B>modify</B> or <B>modrdn</B> operation which are unique within the configured scope. If any are found, the request is rejected.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>If no attributes are specified, for example <B>ldap:///??sub?</B>, then the URI applies to all non-operational attributes. However, the keyword <B>ignore</B> can be specified to exclude certain non-operational attributes. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>To search at the base dn of the current backend database ensuring uniqueness of the <B>mail</B> attribute, we simply add the following configuration:</P> +<PRE> + overlay unique + unique_uri ldap:///?mail?sub? +</PRE> +<P>For an existing entry of:</P> +<PRE> + dn: cn=gavin,dc=suretecsystems,dc=com + objectClass: top + objectClass: inetorgperson + cn: gavin + sn: henry + mail: ghenry@suretecsystems.com +</PRE> +<P>and we then try to add a new entry of:</P> +<PRE> + dn: cn=robert,dc=suretecsystems,dc=com + objectClass: top + objectClass: inetorgperson + cn: robert + sn: jones + mail: ghenry@suretecsystems.com +</PRE> +<P>would result in an error like so:</P> +<PRE> + adding new entry "cn=robert,dc=example,dc=com" + ldap_add: Constraint violation (19) + additional info: some attributes not unique +</PRE> +<P>The overlay can have multiple URIs specified within a domain, allowing complex selections of objects and also have multiple <B>unique_uri</B> statements or <B>olcUniqueURI</B> attributes which will create independent domains.</P> +<P>For more information and details about the <B>strict</B> and <B>ignore</B> keywords, please see the <EM>slapo-unique(5)</EM> man page.</P> +<H3><A NAME="Further Information">12.16.3. Further Information</A></H3> +<P><EM>slapo-unique(5)</EM></P> +<H2><A NAME="Value Sorting">12.17. Value Sorting</A></H2> +<H3><A NAME="Overview">12.17.1. Overview</A></H3> +<P>The Value Sorting overlay can be used with a backend database to sort the values of specific multi-valued attributes within a subtree. The sorting occurs whenever the attributes are returned in a search response.</P> +<H3><A NAME="Value Sorting Configuration">12.17.2. Value Sorting Configuration</A></H3> +<P>Sorting can be specified in ascending or descending order, using either numeric or alphanumeric sort methods. Additionally, a "weighted" sort can be specified, which uses a numeric weight prepended to the attribute values.</P> +<P>The weighted sort is always performed in ascending order, but may be combined with the other methods for values that all have equal weights. The weight is specified by prepending an integer weight {<weight>} in front of each value of the attribute for which weighted sorting is desired. This weighting factor is stripped off and never returned in search results.</P> +<P>Here are a few examples:</P> +<PRE> + loglevel sync stats + + database hdb + suffix "dc=suretecsystems,dc=com" + directory /usr/local/var/openldap-data + + ...... + + overlay valsort + valsort-attr memberUid ou=Groups,dc=suretecsystems,dc=com alpha-ascend +</PRE> +<P>For example, ascend:</P> +<PRE> + # sharedemail, Groups, suretecsystems.com + dn: cn=sharedemail,ou=Groups,dc=suretecsystems,dc=com + objectClass: posixGroup + objectClass: top + cn: sharedemail + gidNumber: 517 + memberUid: admin + memberUid: dovecot + memberUid: laura + memberUid: suretec +</PRE> +<P>For weighted, we change our data to:</P> +<PRE> + # sharedemail, Groups, suretecsystems.com + dn: cn=sharedemail,ou=Groups,dc=suretecsystems,dc=com + objectClass: posixGroup + objectClass: top + cn: sharedemail + gidNumber: 517 + memberUid: {4}admin + memberUid: {2}dovecot + memberUid: {1}laura + memberUid: {3}suretec +</PRE> +<P>and change the config to:</P> +<PRE> + overlay valsort + valsort-attr memberUid ou=Groups,dc=suretecsystems,dc=com weighted +</PRE> +<P>Searching now results in:</P> +<PRE> + # sharedemail, Groups, OxObjects, suretecsystems.com + dn: cn=sharedemail,ou=Groups,ou=OxObjects,dc=suretecsystems,dc=com + objectClass: posixGroup + objectClass: top + cn: sharedemail + gidNumber: 517 + memberUid: laura + memberUid: dovecot + memberUid: suretec + memberUid: admin +</PRE> +<H3><A NAME="Further Information">12.17.3. Further Information</A></H3> +<P><EM>slapo-valsort(5)</EM></P> +<H2><A NAME="Overlay Stacking">12.18. Overlay Stacking</A></H2> +<H3><A NAME="Overview">12.18.1. Overview</A></H3> +<P>Overlays can be stacked, which means that more than one overlay can be instantiated for each database, or for the <TT>frontend</TT>. As a consequence, each overlays function is called, if defined, when overlay execution is invoked. Multiple overlays are executed in reverse order (as a stack) with respect to their definition in slapd.conf (5), or with respect to their ordering in the config database, as documented in slapd-config (5).</P> +<H3><A NAME="Example Scenarios">12.18.2. Example Scenarios</A></H3> +<H4><A NAME="Samba">12.18.2.1. Samba</A></H4> +<P></P> +<HR> +<H1><A NAME="Schema Specification">13. Schema Specification</A></H1> +<P>This chapter describes how to extend the user schema used by <EM>slapd</EM>(8). The chapter assumes the reader is familiar with the <TERM>LDAP</TERM>/<TERM>X.500</TERM> information model.</P> +<P>The first section, <A HREF="#Distributed Schema Files">Distributed Schema Files</A> details optional schema definitions provided in the distribution and where to obtain other definitions. The second section, <A HREF="#Extending Schema">Extending Schema</A>, details how to define new schema items.</P> +<P>This chapter does not discuss how to extend system schema used by <EM>slapd</EM>(8) as this requires source code modification. System schema includes all operational attribute types or any object class which allows or requires an operational attribute (directly or indirectly).</P> +<H2><A NAME="Distributed Schema Files">13.1. Distributed Schema Files</A></H2> +<P>OpenLDAP Software is distributed with a set of schema specifications for your use. Each set is defined in a file suitable for inclusion (using the <TT>include</TT> directive) in your <EM>slapd.conf</EM>(5) file. These schema files are normally installed in the <TT>/usr/local/etc/openldap/schema</TT> directory.</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 8.1: Provided Schema Specifications</CAPTION> +<TR CLASS="heading"> +<TD ALIGN='Left'> +<STRONG>File</STRONG> +</TD> +<TD ALIGN='Right'> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>core.schema</TT> +</TD> +<TD ALIGN='Right'> +OpenLDAP <EM>core</EM> (required) +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>cosine.schema</TT> +</TD> +<TD ALIGN='Right'> +Cosine and Internet X.500 (useful) +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>inetorgperson.schema</TT> +</TD> +<TD ALIGN='Right'> +InetOrgPerson (useful) +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>misc.schema</TT> +</TD> +<TD ALIGN='Right'> +Assorted (experimental) +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>nis.schema</TT> +</TD> +<TD ALIGN='Right'> +Network Information Services (FYI) +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>openldap.schema</TT> +</TD> +<TD ALIGN='Right'> +OpenLDAP Project (experimental) +</TD> +</TR> +</TABLE> + +<P>To use any of these schema files, you only need to include the desired file in the global definitions portion of your <EM>slapd.conf</EM>(5) file. For example:</P> +<PRE> + # include schema + include /usr/local/etc/openldap/schema/core.schema + include /usr/local/etc/openldap/schema/cosine.schema + include /usr/local/etc/openldap/schema/inetorgperson.schema +</PRE> +<P>Additional files may be available. Please consult the OpenLDAP <TERM>FAQ</TERM> (<A HREF="http://www.openldap.org/faq/">http://www.openldap.org/faq/</A>).</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>You should not modify any of the schema items defined in provided files. +<HR WIDTH="80%" ALIGN="Left"></P> +<H2><A NAME="Extending Schema">13.2. Extending Schema</A></H2> +<P>Schema used by <EM>slapd</EM>(8) may be extended to support additional syntaxes, matching rules, attribute types, and object classes. This chapter details how to add user application attribute types and object classes using the syntaxes and matching rules already supported by slapd. slapd can also be extended to support additional syntaxes, matching rules and system schema, but this requires some programming and hence is not discussed here.</P> +<P>There are five steps to defining new schema:</P> +<OL> +<LI>obtain Object Identifier +<LI>choose a name prefix +<LI>create local schema file +<LI>define custom attribute types (if necessary) +<LI>define custom object classes</OL> +<H3><A NAME="Object Identifiers">13.2.1. Object Identifiers</A></H3> +<P>Each schema element is identified by a globally unique <TERM>Object Identifier</TERM> (OID). OIDs are also used to identify other objects. They are commonly found in protocols described by <TERM>ASN.1</TERM>. In particular, they are heavily used by the <TERM>Simple Network Management Protocol</TERM> (SNMP). As OIDs are hierarchical, your organization can obtain one OID and branch it as needed. For example, if your organization were assigned OID <TT>1.1</TT>, you could branch the tree as follows:</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 8.2: Example OID hierarchy</CAPTION> +<TR CLASS="heading"> +<TD ALIGN='Left'> +<STRONG>OID</STRONG> +</TD> +<TD ALIGN='Right'> +<STRONG>Assignment</STRONG> +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>1.1</TT> +</TD> +<TD ALIGN='Right'> +Organization's OID +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>1.1.1</TT> +</TD> +<TD ALIGN='Right'> +SNMP Elements +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>1.1.2</TT> +</TD> +<TD ALIGN='Right'> +LDAP Elements +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>1.1.2.1</TT> +</TD> +<TD ALIGN='Right'> +AttributeTypes +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>1.1.2.1.1</TT> +</TD> +<TD ALIGN='Right'> +x-my-Attribute +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>1.1.2.2</TT> +</TD> +<TD ALIGN='Right'> +ObjectClasses +</TD> +</TR> +<TR> +<TD ALIGN='Left'> +<TT>1.1.2.2.1</TT> +</TD> +<TD ALIGN='Right'> +x-my-ObjectClass +</TD> +</TR> +</TABLE> + +<P>You are, of course, free to design a hierarchy suitable to your organizational needs under your organization's OID. No matter what hierarchy you choose, you should maintain a registry of assignments you make. This can be a simple flat file or something more sophisticated such as the <EM>OpenLDAP OID Registry</EM> (<A HREF="http://www.openldap.org/faq/index.cgi?file=197">http://www.openldap.org/faq/index.cgi?file=197</A>).</P> +<P>For more information about Object Identifiers (and a listing service) see <A HREF="http://www.alvestrand.no/objectid/">http://www.alvestrand.no/objectid/</A>.</P> +<UL> +<EM>Under no circumstances should you hijack OID namespace!</EM></UL> +<P>To obtain a registered OID at <EM>no cost</EM>, apply for a OID under the <A HREF="http://www.iana.org/">Internet Assigned Numbers Authority</A> (ORG:IANA) maintained <EM>Private Enterprise</EM> arc. Any private enterprise (organization) may request a <TERM>Private Enterprise Number</TERM> (PEN) to be assigned under this arc. Just fill out the IANA form at <A HREF="http://pen.iana.org/pen/PenApplication.page">http://pen.iana.org/pen/PenApplication.page</A> and your official PEN will be sent to you usually within a few days. Your base OID will be something like <TT>1.3.6.1.4.1.X</TT> where <TT>X</TT> is an integer.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>PENs obtained using this form may be used for any purpose including identifying LDAP schema elements. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>Alternatively, OID name space may be available from a national authority (e.g., <A HREF="http://www.ansi.org/">ANSI</A>, <A HREF="http://www.bsi-global.com/">BSI</A>).</P> +<H3><A NAME="Naming Elements">13.2.2. Naming Elements</A></H3> +<P>In addition to assigning a unique object identifier to each schema element, you should provide at least one textual name for each element. Names should be registered with the <A HREF="http://www.iana.org/">IANA</A> or prefixed with "x-" to place in the "private use" name space.</P> +<P>The name should be both descriptive and not likely to clash with names of other schema elements. In particular, any name you choose should not clash with present or future Standard Track names (this is assured if you registered names or use names beginning with "x-").</P> +<P>It is noted that you can obtain your own registered name prefix so as to avoid having to register your names individually. See <A HREF="http://www.rfc-editor.org/rfc/rfc4520.txt">RFC4520</A> for details.</P> +<P>In the examples below, we have used a short prefix '<TT>x-my-</TT>'. Such a short prefix would only be suitable for a very large, global organization. In general, we recommend something like '<TT>x-de-Firm-</TT>' (German company) or '<TT>x-com-Example</TT>' (elements associated with organization associated with <TT>example.com</TT>).</P> +<H3><A NAME="Local schema file">13.2.3. Local schema file</A></H3> +<P>The <TT>objectclass</TT> and <TT>attributeTypes</TT> configuration file directives can be used to define schema rules on entries in the directory. It is customary to create a file to contain definitions of your custom schema items. We recommend you create a file <TT>local.schema</TT> in <TT>/usr/local/etc/openldap/schema/local.schema</TT> and then include this file in your <EM>slapd.conf</EM>(5) file immediately after other schema <TT>include</TT> directives.</P> +<PRE> + # include schema + include /usr/local/etc/openldap/schema/core.schema + include /usr/local/etc/openldap/schema/cosine.schema + include /usr/local/etc/openldap/schema/inetorgperson.schema + # include local schema + include /usr/local/etc/openldap/schema/local.schema +</PRE> +<H3><A NAME="Attribute Type Specification">13.2.4. Attribute Type Specification</A></H3> +<P>The <EM>attributetype</EM> directive is used to define a new attribute type. The directive uses the same Attribute Type Description (as defined in <A HREF="http://www.rfc-editor.org/rfc/rfc4512.txt">RFC4512</A>) used by the attributeTypes attribute found in the subschema subentry, e.g.:</P> +<PRE> + attributetype <<A HREF="http://www.rfc-editor.org/rfc/rfc4512.txt">RFC4512</A> Attribute Type Description> +</PRE> +<P>where Attribute Type Description is defined by the following <TERM>ABNF</TERM>:</P> +<PRE> + AttributeTypeDescription = "(" whsp + numericoid whsp ; AttributeType identifier + [ "NAME" qdescrs ] ; name used in AttributeType + [ "DESC" qdstring ] ; description + [ "OBSOLETE" whsp ] + [ "SUP" woid ] ; derived from this other + ; AttributeType + [ "EQUALITY" woid ; Matching Rule name + [ "ORDERING" woid ; Matching Rule name + [ "SUBSTR" woid ] ; Matching Rule name + [ "SYNTAX" whsp noidlen whsp ] ; Syntax OID + [ "SINGLE-VALUE" whsp ] ; default multi-valued + [ "COLLECTIVE" whsp ] ; default not collective + [ "NO-USER-MODIFICATION" whsp ]; default user modifiable + [ "USAGE" whsp AttributeUsage ]; default userApplications + whsp ")" + + AttributeUsage = + "userApplications" / + "directoryOperation" / + "distributedOperation" / ; DSA-shared + "dSAOperation" ; DSA-specific, value depends on server + +</PRE> +<P>where whsp is a space ('<TT> </TT>'), numericoid is a globally unique OID in dotted-decimal form (e.g. <TT>1.1.0</TT>), qdescrs is one or more names, woid is either the name or OID optionally followed by a length specifier (e.g <TT>{10</TT>}).</P> +<P>For example, the attribute types <TT>name</TT> and <TT>cn</TT> are defined in <TT>core.schema</TT> as:</P> +<PRE> + attributeType ( 2.5.4.41 NAME 'name' + DESC 'name(s) associated with the object' + EQUALITY caseIgnoreMatch + SUBSTR caseIgnoreSubstringsMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) + attributeType ( 2.5.4.3 NAME ( 'cn' 'commonName' ) + DESC 'common name(s) associated with the object' + SUP name ) +</PRE> +<P>Notice that each defines the attribute's OID, provides a short name, and a brief description. Each name is an alias for the OID. <EM>slapd</EM>(8) returns the first listed name when returning results.</P> +<P>The first attribute, <TT>name</TT>, holds values of <TT>directoryString</TT> (<TERM>UTF-8</TERM> encoded Unicode) syntax. The syntax is specified by OID (1.3.6.1.4.1.1466.115.121.1.15 identifies the directoryString syntax). A length recommendation of 32768 is specified. Servers should support values of this length, but may support longer values. The field does NOT specify a size constraint, so is ignored on servers (such as slapd) which don't impose such size limits. In addition, the equality and substring matching uses case ignore rules. Below are tables listing commonly used syntax and matching rules (<EM>slapd</EM>(8) supports these and many more).</P> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 8.3: Commonly Used Syntaxes</CAPTION> +<TR CLASS="heading"> +<TD> +<STRONG>Name</STRONG> +</TD> +<TD> +<STRONG>OID</STRONG> +</TD> +<TD> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD> +<TT>boolean</TT> +</TD> +<TD> +<TT>1.3.6.1.4.1.1466.115.121.1.7</TT> +</TD> +<TD> +boolean value +</TD> +</TR> +<TR> +<TD> +<TT>directoryString</TT> +</TD> +<TD> +<TT>1.3.6.1.4.1.1466.115.121.1.15</TT> +</TD> +<TD> +Unicode (UTF-8) string +</TD> +</TR> +<TR> +<TD> +<TT>distinguishedName</TT> +</TD> +<TD> +<TT>1.3.6.1.4.1.1466.115.121.1.12</TT> +</TD> +<TD> +LDAP <TERM>DN</TERM> +</TD> +</TR> +<TR> +<TD> +<TT>integer</TT> +</TD> +<TD> +<TT>1.3.6.1.4.1.1466.115.121.1.27</TT> +</TD> +<TD> +integer +</TD> +</TR> +<TR> +<TD> +<TT>numericString</TT> +</TD> +<TD> +<TT>1.3.6.1.4.1.1466.115.121.1.36</TT> +</TD> +<TD> +numeric string +</TD> +</TR> +<TR> +<TD> +<TT>OID</TT> +</TD> +<TD> +<TT>1.3.6.1.4.1.1466.115.121.1.38</TT> +</TD> +<TD> +object identifier +</TD> +</TR> +<TR> +<TD> +<TT>octetString</TT> +</TD> +<TD> +<TT>1.3.6.1.4.1.1466.115.121.1.40</TT> +</TD> +<TD> +arbitrary octets +</TD> +</TR> +</TABLE> + +<PRE> + +</PRE> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 8.4: Commonly Used Matching Rules</CAPTION> +<TR CLASS="heading"> +<TD> +<STRONG>Name</STRONG> +</TD> +<TD> +<STRONG>Type</STRONG> +</TD> +<TD> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD> +<TT>booleanMatch</TT> +</TD> +<TD> +equality +</TD> +<TD> +boolean +</TD> +</TR> +<TR> +<TD> +<TT>caseIgnoreMatch</TT> +</TD> +<TD> +equality +</TD> +<TD> +case insensitive, space insensitive +</TD> +</TR> +<TR> +<TD> +<TT>caseIgnoreOrderingMatch</TT> +</TD> +<TD> +ordering +</TD> +<TD> +case insensitive, space insensitive +</TD> +</TR> +<TR> +<TD> +<TT>caseIgnoreSubstringsMatch</TT> +</TD> +<TD> +substrings +</TD> +<TD> +case insensitive, space insensitive +</TD> +</TR> +<TR> +<TD> +<TT>caseExactMatch</TT> +</TD> +<TD> +equality +</TD> +<TD> +case sensitive, space insensitive +</TD> +</TR> +<TR> +<TD> +<TT>caseExactOrderingMatch</TT> +</TD> +<TD> +ordering +</TD> +<TD> +case sensitive, space insensitive +</TD> +</TR> +<TR> +<TD> +<TT>caseExactSubstringsMatch</TT> +</TD> +<TD> +substrings +</TD> +<TD> +case sensitive, space insensitive +</TD> +</TR> +<TR> +<TD> +<TT>distinguishedNameMatch</TT> +</TD> +<TD> +equality +</TD> +<TD> +distinguished name +</TD> +</TR> +<TR> +<TD> +<TT>integerMatch</TT> +</TD> +<TD> +equality +</TD> +<TD> +integer +</TD> +</TR> +<TR> +<TD> +<TT>integerOrderingMatch</TT> +</TD> +<TD> +ordering +</TD> +<TD> +integer +</TD> +</TR> +<TR> +<TD> +<TT>numericStringMatch</TT> +</TD> +<TD> +equality +</TD> +<TD> +numerical +</TD> +</TR> +<TR> +<TD> +<TT>numericStringOrderingMatch</TT> +</TD> +<TD> +ordering +</TD> +<TD> +numerical +</TD> +</TR> +<TR> +<TD> +<TT>numericStringSubstringsMatch</TT> +</TD> +<TD> +substrings +</TD> +<TD> +numerical +</TD> +</TR> +<TR> +<TD> +<TT>octetStringMatch</TT> +</TD> +<TD> +equality +</TD> +<TD> +octet string +</TD> +</TR> +<TR> +<TD> +<TT>octetStringOrderingMatch</TT> +</TD> +<TD> +ordering +</TD> +<TD> +octet string +</TD> +</TR> +<TR> +<TD> +<TT>octetStringSubstringsMatch ordering</TT> +</TD> +<TD> +octet st +</TD> +<TD> +ring +</TD> +</TR> +<TR> +<TD> +<TT>objectIdentiferMatch</TT> +</TD> +<TD> +equality +</TD> +<TD> +object identifier +</TD> +</TR> +</TABLE> + +<P>The second attribute, <TT>cn</TT>, is a subtype of <TT>name</TT> hence it inherits the syntax, matching rules, and usage of <TT>name</TT>. <TT>commonName</TT> is an alternative name.</P> +<P>Neither attribute is restricted to a single value. Both are meant for usage by user applications. Neither is obsolete nor collective.</P> +<P>The following subsections provide a couple of examples.</P> +<H4><A NAME="x-my-UniqueName">13.2.4.1. x-my-UniqueName</A></H4> +<P>Many organizations maintain a single unique name for each user. Though one could use <TT>displayName</TT> (<A HREF="http://www.rfc-editor.org/rfc/rfc2798.txt">RFC2798</A>), this attribute is really meant to be controlled by the user, not the organization. We could just copy the definition of <TT>displayName</TT> from <TT>inetorgperson.schema</TT> and replace the OID, name, and description, e.g:</P> +<PRE> + attributetype ( 1.1.2.1.1 NAME 'x-my-UniqueName' + DESC 'unique name with my organization' + EQUALITY caseIgnoreMatch + SUBSTR caseIgnoreSubstringsMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 + SINGLE-VALUE ) +</PRE> +<P>However, if we want this name to be used in <TT>name</TT> assertions, e.g. <TT>(name=*Jane*)</TT>, the attribute could alternatively be defined as a subtype of <TT>name</TT>, e.g.:</P> +<PRE> + attributetype ( 1.1.2.1.1 NAME 'x-my-UniqueName' + DESC 'unique name with my organization' + SUP name ) +</PRE> +<H4><A NAME="x-my-Photo">13.2.4.2. x-my-Photo</A></H4> +<P>Many organizations maintain a photo of each each user. A <TT>x-my-Photo</TT> attribute type could be defined to hold a photo. Of course, one could use just use <TT>jpegPhoto</TT> (<A HREF="http://www.rfc-editor.org/rfc/rfc2798.txt">RFC2798</A>) (or a subtype) to hold the photo. However, you can only do this if the photo is in <EM>JPEG File Interchange Format</EM>. Alternatively, an attribute type which uses the <EM>Octet String</EM> syntax can be defined, e.g.:</P> +<PRE> + attributetype ( 1.1.2.1.2 NAME 'x-my-Photo' + DESC 'a photo (application defined format)' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 + SINGLE-VALUE ) +</PRE> +<P>In this case, the syntax doesn't specify the format of the photo. It's assumed (maybe incorrectly) that all applications accessing this attribute agree on the handling of values.</P> +<P>If you wanted to support multiple photo formats, you could define a separate attribute type for each format, prefix the photo with some typing information, or describe the value using <TERM>ASN.1</TERM> and use the <TT>;binary</TT> transfer option.</P> +<P>Another alternative is for the attribute to hold a <TERM>URI</TERM> pointing to the photo. You can model such an attribute after <TT>labeledURI</TT> (<A HREF="http://www.rfc-editor.org/rfc/rfc2079.txt">RFC2079</A>) or simply create a subtype, e.g.:</P> +<PRE> + attributetype ( 1.1.2.1.3 NAME 'x-my-PhotoURI' + DESC 'URI and optional label referring to a photo' + SUP labeledURI ) +</PRE> +<H3><A NAME="Object Class Specification">13.2.5. Object Class Specification</A></H3> +<P>The <EM>objectclasses</EM> directive is used to define a new object class. The directive uses the same Object Class Description (as defined in <A HREF="http://www.rfc-editor.org/rfc/rfc4512.txt">RFC4512</A>) used by the objectClasses attribute found in the subschema subentry, e.g.:</P> +<PRE> + objectclass <<A HREF="http://www.rfc-editor.org/rfc/rfc4512.txt">RFC4512</A> Object Class Description> +</PRE> +<P>where Object Class Description is defined by the following <TERM>ABNF</TERM>:</P> +<PRE> + ObjectClassDescription = "(" whsp + numericoid whsp ; ObjectClass identifier + [ "NAME" qdescrs ] + [ "DESC" qdstring ] + [ "OBSOLETE" whsp ] + [ "SUP" oids ] ; Superior ObjectClasses + [ ( "ABSTRACT" / "STRUCTURAL" / "AUXILIARY" ) whsp ] + ; default structural + [ "MUST" oids ] ; AttributeTypes + [ "MAY" oids ] ; AttributeTypes + whsp ")" +</PRE> +<P>where whsp is a space ('<TT> </TT>'), numericoid is a globally unique OID in dotted-decimal form (e.g. <TT>1.1.0</TT>), qdescrs is one or more names, and oids is one or more names and/or OIDs.</P> +<H4><A NAME="x-my-PhotoObject">13.2.5.1. x-my-PhotoObject</A></H4> +<P>To define an <EM>auxiliary</EM> object class which allows x-my-Photo to be added to any existing entry.</P> +<PRE> + objectclass ( 1.1.2.2.1 NAME 'x-my-PhotoObject' + DESC 'mixin x-my-Photo' + AUXILIARY + MAY x-my-Photo ) +</PRE> +<H4><A NAME="x-my-Person">13.2.5.2. x-my-Person</A></H4> +<P>If your organization would like have a private <EM>structural</EM> object class to instantiate users, you can subclass one of the existing person classes, such as <TT>inetOrgPerson</TT> (<A HREF="http://www.rfc-editor.org/rfc/rfc2798.txt">RFC2798</A>), and add any additional attributes which you desire.</P> +<PRE> + objectclass ( 1.1.2.2.2 NAME 'x-my-Person' + DESC 'my person' + SUP inetOrgPerson + MUST ( x-my-UniqueName $ givenName ) + MAY x-my-Photo ) +</PRE> +<P>The object class inherits the required/allowed attribute types of <TT>inetOrgPerson</TT> but requires <TT>x-my-UniqueName</TT> and <TT>givenName</TT> and allows <TT>x-my-Photo</TT>.</P> +<H3><A NAME="OID Macros">13.2.6. OID Macros</A></H3> +<P>To ease the management and use of OIDs, <EM>slapd</EM>(8) supports <EM>Object Identifier</EM> macros. The <TT>objectIdentifier</TT> directive is used to equate a macro (name) with a OID. The OID may possibly be derived from a previously defined OID macro. The <EM>slapd.conf</EM>(5) syntax is:</P> +<PRE> + objectIdentifier <name> { <oid> | <name>[:<suffix>] } +</PRE> +<P>The following demonstrates definition of a set of OID macros and their use in defining schema elements:</P> +<PRE> + objectIdentifier myOID 1.1 + objectIdentifier mySNMP myOID:1 + objectIdentifier myLDAP myOID:2 + objectIdentifier myAttributeType myLDAP:1 + objectIdentifier myObjectClass myLDAP:2 + attributetype ( myAttributeType:3 NAME 'x-my-PhotoURI' + DESC 'URI and optional label referring to a photo' + SUP labeledURI ) + objectclass ( myObjectClass:1 NAME 'x-my-PhotoObject' + DESC 'mixin x-my-Photo' + AUXILIARY + MAY x-my-Photo ) +</PRE> +<P></P> +<HR> +<H1><A NAME="Security Considerations">14. Security Considerations</A></H1> +<P>OpenLDAP Software is designed to run in a wide variety of computing environments from tightly-controlled closed networks to the global Internet. Hence, OpenLDAP Software supports many different security mechanisms. This chapter describes these mechanisms and discusses security considerations for using OpenLDAP Software.</P> +<H2><A NAME="Network Security">14.1. Network Security</A></H2> +<H3><A NAME="Selective Listening">14.1.1. Selective Listening</A></H3> +<P>By default, <EM>slapd</EM>(8) will listen on both the IPv4 and IPv6 "any" addresses. It is often desirable to have <EM>slapd</EM> listen on select address/port pairs. For example, listening only on the IPv4 address <TT>127.0.0.1</TT> will disallow remote access to the directory server. E.g.:</P> +<PRE> + slapd -h ldap://127.0.0.1 +</PRE> +<P>While the server can be configured to listen on a particular interface address, this doesn't necessarily restrict access to the server to only those networks accessible via that interface. To selective restrict remote access, it is recommend that an <A HREF="#IP Firewall">IP Firewall</A> be used to restrict access.</P> +<P>See <A HREF="#Command-line Options">Command-line Options</A> and <EM>slapd</EM>(8) for more information.</P> +<H3><A NAME="IP Firewall">14.1.2. IP Firewall</A></H3> +<P><TERM>IP</TERM> firewall capabilities of the server system can be used to restrict access based upon the client's IP address and/or network interface used to communicate with the client.</P> +<P>Generally, <EM>slapd</EM>(8) listens on port 389/tcp for <A HREF="ldap://">ldap://</A> sessions and port 636/tcp for <A HREF="ldaps://">ldaps://</A>) sessions. <EM>slapd</EM>(8) may be configured to listen on other ports.</P> +<P>As specifics of how to configure IP firewall are dependent on the particular kind of IP firewall used, no examples are provided here. See the document associated with your IP firewall.</P> +<H3><A NAME="TCP Wrappers">14.1.3. TCP Wrappers</A></H3> +<P><EM>slapd</EM>(8) supports <TERM>TCP</TERM> Wrappers. TCP Wrappers provide a rule-based access control system for controlling TCP/IP access to the server. For example, the <EM>host_options</EM>(5) rule:</P> +<PRE> + slapd: 10.0.0.0/255.0.0.0 127.0.0.1 : ALLOW + slapd: ALL : DENY +</PRE> +<P>allows only incoming connections from the private network <TT>10.0.0.0</TT> and localhost (<TT>127.0.0.1</TT>) to access the directory service.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>IP addresses are used as <EM>slapd</EM>(8) is not normally configured to perform reverse lookups. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>It is noted that TCP wrappers require the connection to be accepted. As significant processing is required just to deny a connection, it is generally advised that IP firewall protection be used instead of TCP wrappers.</P> +<P>See <EM>hosts_access</EM>(5) for more information on TCP wrapper rules.</P> +<H2><A NAME="Data Integrity and Confidentiality Protection">14.2. Data Integrity and Confidentiality Protection</A></H2> +<P><TERM>Transport Layer Security</TERM> (TLS) can be used to provide data integrity and confidentiality protection. OpenLDAP supports negotiation of <TERM>TLS</TERM> (<TERM>SSL</TERM>) via both StartTLS and <A HREF="ldaps://">ldaps://</A>. See the <A HREF="#Using TLS">Using TLS</A> chapter for more information. StartTLS is the standard track mechanism.</P> +<P>A number of <TERM>Simple Authentication and Security Layer</TERM> (SASL) mechanisms, such as <TERM>DIGEST-MD5</TERM> and <TERM>GSSAPI</TERM>, also provide data integrity and confidentiality protection. See the <A HREF="#Using SASL">Using SASL</A> chapter for more information.</P> +<H3><A NAME="Security Strength Factors">14.2.1. Security Strength Factors</A></H3> +<P>The server uses <TERM>Security Strength Factor</TERM>s (SSF) to indicate the relative strength of protection. A SSF of zero (0) indicates no protections are in place. A SSF of one (1) indicates integrity protection are in place. A SSF greater than one (>1) roughly correlates to the effective encryption key length. For example, <TERM>DES</TERM> is 56, <TERM>3DES</TERM> is 112, and <TERM>AES</TERM> 128, 192, or 256.</P> +<P>A number of administrative controls rely on SSFs associated with TLS and SASL protection in place on an LDAP session.</P> +<P><TT>security</TT> controls disallow operations when appropriate protections are not in place. For example:</P> +<PRE> + security ssf=1 update_ssf=112 +</PRE> +<P>requires integrity protection for all operations and encryption protection, 3DES equivalent, for update operations (e.g. add, delete, modify, etc.). See <EM>slapd.conf</EM>(5) for details.</P> +<P>For fine-grained control, SSFs may be used in access controls. See the <A HREF="#Access Control">Access Control</A> section for more information.</P> +<H2><A NAME="Authentication Methods">14.3. Authentication Methods</A></H2> +<H3><A NAME=""simple" method">14.3.1. "simple" method</A></H3> +<P>The LDAP "simple" method has three modes of operation:</P> +<UL> +<LI>anonymous, +<LI>unauthenticated, and +<LI>user/password authenticated.</UL> +<P>Anonymous access is requested by providing no name and no password to the "simple" bind operation. Unauthenticated access is requested by providing a name but no password. Authenticated access is requested by providing a valid name and password.</P> +<P>An anonymous bind results in an <EM>anonymous</EM> authorization association. Anonymous bind mechanism is enabled by default, but can be disabled by specifying "<TT>disallow bind_anon</TT>" in <EM>slapd.conf</EM>(5).</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Disabling the anonymous bind mechanism does not prevent anonymous access to the directory. To require authentication to access the directory, one should instead specify "<TT>require authc</TT>". +<HR WIDTH="80%" ALIGN="Left"></P> +<P>An unauthenticated bind also results in an <EM>anonymous</EM> authorization association. Unauthenticated bind mechanism is disabled by default, but can be enabled by specifying "<TT>allow bind_anon_cred</TT>" in <EM>slapd.conf</EM>(5). As a number of LDAP applications mistakenly generate unauthenticated bind request when authenticated access was intended (that is, they do not ensure a password was provided), this mechanism should generally remain disabled.</P> +<P>A successful user/password authenticated bind results in a user authorization identity, the provided name, being associated with the session. User/password authenticated bind is enabled by default. However, as this mechanism itself offers no eavesdropping protection (e.g., the password is set in the clear), it is recommended that it be used only in tightly controlled systems or when the LDAP session is protected by other means (e.g., TLS, <TERM>IPsec</TERM>). Where the administrator relies on TLS to protect the password, it is recommended that unprotected authentication be disabled. This is done using the <TT>security</TT> directive's <TT>simple_bind</TT> option, which provides fine grain control over the level of confidential protection to require for <EM>simple</EM> user/password authentication. E.g., using <TT>security simple_bind=56</TT> would require <EM>simple</EM> binds to use encryption of DES equivalent or better.</P> +<P>The user/password authenticated bind mechanism can be completely disabled by setting "<TT>disallow bind_simple</TT>".</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>An unsuccessful bind always results in the session having an <EM>anonymous</EM> authorization association. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="SASL method">14.3.2. SASL method</A></H3> +<P>The LDAP <TERM>SASL</TERM> method allows the use of any SASL authentication mechanism. The <A HREF="#Using SASL">Using SASL</A> section discusses the use of SASL.</P> +<H2><A NAME="Password Storage">14.4. Password Storage</A></H2> +<P>LDAP passwords are normally stored in the <EM>userPassword</EM> attribute. <A HREF="http://www.rfc-editor.org/rfc/rfc4519.txt">RFC4519</A> specifies that passwords are not stored in encrypted (or hashed) form. This allows a wide range of password-based authentication mechanisms, such as <TT>DIGEST-MD5</TT> to be used. This is also the most interoperable storage scheme.</P> +<P>However, it may be desirable to store a hash of password instead. <EM>slapd</EM>(8) supports a variety of storage schemes for the administrator to choose from.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Values of password attributes, regardless of storage scheme used, should be protected as if they were clear text. Hashed passwords are subject to <EM>dictionary attacks</EM> and <EM>brute-force attacks</EM>. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>The <EM>userPassword</EM> attribute is allowed to have more than one value, and it is possible for each value to be stored in a different form. During authentication, <EM>slapd</EM> will iterate through the values until it finds one that matches the offered password or until it runs out of values to inspect. The storage scheme is stored as a prefix on the value, so a hashed password using the Salted SHA1 (<TT>SSHA</TT>) scheme looks like:</P> +<PRE> + userPassword: {SSHA}DkMTwBl+a/3DQTxCYEApdUtNXGgdUac3 +</PRE> +<P>The advantage of hashed passwords is that an attacker which discovers the hash does not have direct access to the actual password. Unfortunately, as dictionary and brute force attacks are generally quite easy for attackers to successfully mount, this advantage is marginal at best (this is why all modern Unix systems use shadow password files).</P> +<P>The disadvantages of hashed storage is that they are non-standard, may cause interoperability problem, and generally preclude the use of stronger than Simple (or SASL/PLAIN) password-based authentication mechanisms such as <TT>DIGEST-MD5</TT>.</P> +<H3><A NAME="SSHA password storage scheme">14.4.1. SSHA password storage scheme</A></H3> +<P>This is the salted version of the SHA scheme. It is believed to be the most secure password storage scheme supported by <EM>slapd</EM>.</P> +<P>These values represent the same password:</P> +<PRE> + userPassword: {SSHA}DkMTwBl+a/3DQTxCYEApdUtNXGgdUac3 + userPassword: {SSHA}d0Q0626PSH9VUld7yWpR0k6BlpQmtczb +</PRE> +<H3><A NAME="CRYPT password storage scheme">14.4.2. CRYPT password storage scheme</A></H3> +<P>This scheme uses the operating system's <EM>crypt(3)</EM> hash function. It normally produces the traditional Unix-style 13 character hash, but on systems with <TT>glibc2</TT> it can also generate the more secure 34-byte MD5 hash.</P> +<PRE> + userPassword: {CRYPT}aUihad99hmev6 + userPassword: {CRYPT}$1$czBJdDqS$TmkzUAb836oMxg/BmIwN.1 +</PRE> +<P>The advantage of the CRYPT scheme is that passwords can be transferred to or from an existing Unix password file without having to know the cleartext form. Both forms of <EM>crypt</EM> include salt so they have some resistance to dictionary attacks.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Since this scheme uses the operating system's <EM>crypt(3)</EM> hash function, it is therefore operating system specific. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="MD5 password storage scheme">14.4.3. MD5 password storage scheme</A></H3> +<P>This scheme simply takes the MD5 hash of the password and stores it in base64 encoded form:</P> +<PRE> + userPassword: {MD5}Xr4ilOzQ4PCOq3aQ0qbuaQ== +</PRE> +<P>Although safer than cleartext storage, this is not a very secure scheme. The MD5 algorithm is fast, and because there is no salt the scheme is vulnerable to a dictionary attack.</P> +<H3><A NAME="SMD5 password storage scheme">14.4.4. SMD5 password storage scheme</A></H3> +<P>This improves on the basic MD5 scheme by adding salt (random data which means that there are many possible representations of a given plaintext password). For example, both of these values represent the same password:</P> +<PRE> + userPassword: {SMD5}4QWGWZpj9GCmfuqEvm8HtZhZS6E= + userPassword: {SMD5}g2/J/7D5EO6+oPdklp5p8YtNFk4= +</PRE> +<H3><A NAME="SHA password storage scheme">14.4.5. SHA password storage scheme</A></H3> +<P>Like the MD5 scheme, this simply feeds the password through an SHA hash process. SHA is thought to be more secure than MD5, but the lack of salt leaves the scheme exposed to dictionary attacks.</P> +<PRE> + userPassword: {SHA}5en6G6MezRroT3XKqkdPOmY/BfQ= +</PRE> +<H3><A NAME="SASL password storage scheme">14.4.6. SASL password storage scheme</A></H3> +<P>This is not really a password storage scheme at all. It uses the value of the <EM>userPassword</EM> attribute to delegate password verification to another process. See below for more information.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>This is not the same as using SASL to authenticate the LDAP session. +<HR WIDTH="80%" ALIGN="Left"></P> +<H2><A NAME="Pass-Through authentication">14.5. Pass-Through authentication</A></H2> +<P>Since OpenLDAP 2.0 <EM>slapd</EM> has had the ability to delegate password verification to a separate process. This uses the <EM>sasl_checkpass(3)</EM> function so it can use any back-end server that Cyrus SASL supports for checking passwords. The choice is very wide, as one option is to use <EM>saslauthd(8)</EM> which in turn can use local files, Kerberos, an IMAP server, another LDAP server, or anything supported by the PAM mechanism.</P> +<P>The server must be built with the <TT>--enable-spasswd</TT> configuration option to enable pass-through authentication.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>This is not the same as using a SASL mechanism to authenticate the LDAP session. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>Pass-Through authentication works only with plaintext passwords, as used in the "simple bind" and "SASL PLAIN" authentication mechanisms.}}</P> +<P>Pass-Through authentication is selective: it only affects users whose <EM>userPassword</EM> attribute has a value marked with the "{SASL}" scheme. The format of the attribute is:</P> +<PRE> + userPassword: {SASL}username@realm +</PRE> +<P>The <EM>username</EM> and <EM>realm</EM> are passed to the SASL authentication mechanism and are used to identify the account whose password is to be verified. This allows arbitrary mapping between entries in OpenLDAP and accounts known to the backend authentication service.</P> +<P>It would be wise to use access control to prevent users from changing their passwords through LDAP where they have pass-through authentication enabled.</P> +<H3><A NAME="Configuring slapd to use an authentication provider">14.5.1. Configuring slapd to use an authentication provider</A></H3> +<P>Where an entry has a "{SASL}" password value, OpenLDAP delegates the whole process of validating that entry's password to Cyrus SASL. All the configuration is therefore done in SASL config files.</P> +<P>The first file to be considered is confusingly named <EM>slapd.conf</EM> and is typically found in the SASL library directory, often <TT>/usr/lib/sasl2/slapd.conf</TT> This file governs the use of SASL when talking LDAP to <EM>slapd</EM> as well as the use of SASL backends for pass-through authentication. See <TT>options.html</TT> in the <A HREF="http://asg.web.cmu.edu/sasl/sasl-library.html">Cyrus SASL</A> docs for full details. Here is a simple example for a server that will use <EM>saslauthd</EM> to verify passwords:</P> +<PRE> + mech_list: plain + pwcheck_method: saslauthd + saslauthd_path: /var/run/sasl2/mux +</PRE> +<H3><A NAME="Configuring saslauthd">14.5.2. Configuring saslauthd</A></H3> +<P><EM>saslauthd</EM> is capable of using many different authentication services: see <EM>saslauthd(8)</EM> for details. A common requirement is to delegate some or all authentication to another LDAP server. Here is a sample <TT>saslauthd.conf</TT> that uses Microsoft Active Directory (AD):</P> +<PRE> + ldap_servers: ldap://dc1.example.com/ ldap://dc2.example.com/ + + ldap_search_base: cn=Users,DC=ad,DC=example,DC=com + ldap_filter: (userPrincipalName=%u) + + ldap_bind_dn: cn=saslauthd,cn=Users,DC=ad,DC=example,DC=com + ldap_password: secret +</PRE> +<P>In this case, <EM>saslauthd</EM> is run with the <TT>ldap</TT> authentication mechanism and is set to combine the SASL realm with the login name:</P> +<PRE> + saslauthd -a ldap -r +</PRE> +<P>This means that the "username@realm" string from the <EM>userPassword</EM> attribute ends up being used to search AD for "userPrincipalName=username@realm" - the password is then verified by attempting to bind to AD using the entry found by the search and the password supplied by the LDAP client.</P> +<H3><A NAME="Testing pass-through authentication">14.5.3. Testing pass-through authentication</A></H3> +<P>It is usually best to start with the back-end authentication provider and work through <EM>saslauthd</EM> and <EM>slapd</EM> towards the LDAP client.</P> +<P>In the AD example above, first check that the DN and password that <EM>saslauthd</EM> will use when it connects to AD are valid:</P> +<PRE> + ldapsearch -x -H ldap://dc1.example.com/ \ + -D cn=saslauthd,cn=Users,DC=ad,DC=example,DC=com \ + -w secret \ + -b '' \ + -s base +</PRE> +<P>Next check that a sample AD user can be found:</P> +<PRE> + ldapsearch -x -H ldap://dc1.example.com/ \ + -D cn=saslauthd,cn=Users,DC=ad,DC=example,DC=com \ + -w secret \ + -b cn=Users,DC=ad,DC=example,DC=com \ + "(userPrincipalName=user@ad.example.com)" +</PRE> +<P>Check that the user can bind to AD:</P> +<PRE> + ldapsearch -x -H ldap://dc1.example.com/ \ + -D cn=user,cn=Users,DC=ad,DC=example,DC=com \ + -w userpassword \ + -b cn=user,cn=Users,DC=ad,DC=example,DC=com \ + -s base \ + "(objectclass=*)" +</PRE> +<P>If all that works then <EM>saslauthd</EM> should be able to do the same:</P> +<PRE> + testsaslauthd -u user@ad.example.com -p userpassword + testsaslauthd -u user@ad.example.com -p wrongpassword +</PRE> +<P>Now put the magic token into an entry in OpenLDAP:</P> +<PRE> + userPassword: {SASL}user@ad.example.com +</PRE> +<P>It should now be possible to bind to OpenLDAP using the DN of that entry and the password of the AD user.</P> +<P></P> +<HR> +<H1><A NAME="Using SASL">15. Using SASL</A></H1> +<P>OpenLDAP clients and servers are capable of authenticating via the <TERM>Simple Authentication and Security Layer</TERM> (<TERM>SASL</TERM>) framework, which is detailed in <A HREF="http://www.rfc-editor.org/rfc/rfc4422.txt">RFC4422</A>. This chapter describes how to make use of SASL in OpenLDAP.</P> +<P>There are several industry standard authentication mechanisms that can be used with SASL, including <TERM>GSSAPI</TERM> for <TERM>Kerberos</TERM> V, <TERM>DIGEST-MD5</TERM>, and <TERM>PLAIN</TERM> and <TERM>EXTERNAL</TERM> for use with <TERM>Transport Layer Security</TERM> (TLS).</P> +<P>The standard client tools provided with OpenLDAP Software, such as <EM>ldapsearch</EM>(1) and <EM>ldapmodify</EM>(1), will by default attempt to authenticate the user to the <TERM>LDAP</TERM> directory server using SASL. Basic authentication service can be set up by the LDAP administrator with a few steps, allowing users to be authenticated to the slapd server as their LDAP entry. With a few extra steps, some users and services can be allowed to exploit SASL's proxy authorization feature, allowing them to authenticate themselves and then switch their identity to that of another user or service.</P> +<P>This chapter assumes you have read <EM>Cyrus SASL for System Administrators</EM>, provided with the <A HREF="http://asg.web.cmu.edu/sasl/sasl-library.html">Cyrus SASL</A> package (in <TT>doc/sysadmin.html</TT>) and have a working Cyrus SASL installation. You should use the Cyrus SASL <TT>sample_client</TT> and <TT>sample_server</TT> to test your SASL installation before attempting to make use of it with OpenLDAP Software.</P> +<P>Note that in the following text the term <EM>user</EM> is used to describe a person or application entity who is connecting to the LDAP server via an LDAP client, such as <EM>ldapsearch</EM>(1). That is, the term <EM>user</EM> not only applies to both an individual using an LDAP client, but to an application entity which issues LDAP client operations without direct user control. For example, an e-mail server which uses LDAP operations to access information held in an LDAP server is an application entity.</P> +<H2><A NAME="SASL Security Considerations">15.1. SASL Security Considerations</A></H2> +<P>SASL offers many different authentication mechanisms. This section briefly outlines security considerations.</P> +<P>Some mechanisms, such as PLAIN and LOGIN, offer no greater security over LDAP <EM>simple</EM> authentication. Like LDAP <EM>simple</EM> authentication, such mechanisms should not be used unless you have adequate security protections in place. It is recommended that these mechanisms be used only in conjunction with <TERM>Transport Layer Security</TERM> (TLS). Use of PLAIN and LOGIN are not discussed further in this document.</P> +<P>The DIGEST-MD5 mechanism is the mandatory-to-implement authentication mechanism for LDAPv3. Though DIGEST-MD5 is not a strong authentication mechanism in comparison with trusted third party authentication systems (such as <TERM>Kerberos</TERM> or public key systems), it does offer significant protections against a number of attacks. Unlike the <TERM>CRAM-MD5</TERM> mechanism, it prevents chosen plaintext attacks. DIGEST-MD5 is favored over the use of plaintext password mechanisms. The CRAM-MD5 mechanism is deprecated in favor of DIGEST-MD5. Use of <A HREF="#DIGEST-MD5">DIGEST-MD5</A> is discussed below.</P> +<P>The GSSAPI mechanism utilizes <TERM>GSS-API</TERM> <TERM>Kerberos</TERM> V to provide secure authentication services. The KERBEROS_V4 mechanism is available for those using Kerberos IV. Kerberos is viewed as a secure, distributed authentication system suitable for both small and large enterprises. Use of <A HREF="#GSSAPI">GSSAPI</A> and <A HREF="#KERBEROS_V4">KERBEROS_V4</A> are discussed below.</P> +<P>The EXTERNAL mechanism utilizes authentication services provided by lower level network services such as <TERM>Transport Layer Security</TERM> (<TERM>TLS</TERM>). When used in conjunction with <TERM>TLS</TERM> <TERM>X.509</TERM>-based public key technology, EXTERNAL offers strong authentication. TLS is discussed in the <A HREF="#Using TLS">Using TLS</A> chapter.</P> +<P>EXTERNAL can also be used with the <TT>ldapi:///</TT> transport, as Unix-domain sockets can report the UID and GID of the client process.</P> +<P>There are other strong authentication mechanisms to choose from, including <TERM>OTP</TERM> (one time passwords) and <TERM>SRP</TERM> (secure remote passwords). These mechanisms are not discussed in this document.</P> +<H2><A NAME="SASL Authentication">15.2. SASL Authentication</A></H2> +<P>Getting basic SASL authentication running involves a few steps. The first step configures your slapd server environment so that it can communicate with client programs using the security system in place at your site. This usually involves setting up a service key, a public key, or other form of secret. The second step concerns mapping authentication identities to LDAP <TERM>DN</TERM>'s, which depends on how entries are laid out in your directory. An explanation of the first step will be given in the next section using Kerberos V4 as an example mechanism. The steps necessary for your site's authentication mechanism will be similar, but a guide to every mechanism available under SASL is beyond the scope of this chapter. The second step is described in the section <A HREF="#Mapping Authentication Identities">Mapping Authentication Identities</A>.</P> +<H3><A NAME="GSSAPI">15.2.1. GSSAPI</A></H3> +<P>This section describes the use of the SASL GSSAPI mechanism and Kerberos V with OpenLDAP. It will be assumed that you have Kerberos V deployed, you are familiar with the operation of the system, and that your users are trained in its use. This section also assumes you have familiarized yourself with the use of the GSSAPI mechanism by reading <EM>Configuring GSSAPI and Cyrus SASL</EM> (provided with Cyrus SASL in the <TT>doc/gssapi</TT> file) and successfully experimented with the Cyrus provided <TT>sample_server</TT> and <TT>sample_client</TT> applications. General information about Kerberos is available at <A HREF="http://web.mit.edu/kerberos/www/">http://web.mit.edu/kerberos/www/</A>.</P> +<P>To use the GSSAPI mechanism with <EM>slapd</EM>(8) one must create a service key with a principal for <EM>ldap</EM> service within the realm for the host on which the service runs. For example, if you run <EM>slapd</EM> on <TT>directory.example.com</TT> and your realm is <TT>EXAMPLE.COM</TT>, you need to create a service key with the principal:</P> +<PRE> + ldap/directory.example.com@EXAMPLE.COM +</PRE> +<P>When <EM>slapd</EM>(8) runs, it must have access to this key. This is generally done by placing the key into a keytab file, <TT>/etc/krb5.keytab</TT>. See your Kerberos and Cyrus SASL documentation for information regarding keytab location settings.</P> +<P>To use the GSSAPI mechanism to authenticate to the directory, the user obtains a Ticket Granting Ticket (TGT) prior to running the LDAP client. When using OpenLDAP client tools, the user may mandate use of the GSSAPI mechanism by specifying <TT>-Y GSSAPI</TT> as a command option.</P> +<P>For the purposes of authentication and authorization, <EM>slapd</EM>(8) associates an authentication request DN of the form:</P> +<PRE> + uid=<primary[/instance]>,cn=<realm>,cn=gssapi,cn=auth +</PRE> +<P>Continuing our example, a user with the Kerberos principal <TT>kurt@EXAMPLE.COM</TT> would have the associated DN:</P> +<PRE> + uid=kurt,cn=example.com,cn=gssapi,cn=auth +</PRE> +<P>and the principal <TT>ursula/admin@FOREIGN.REALM</TT> would have the associated DN:</P> +<PRE> + uid=ursula/admin,cn=foreign.realm,cn=gssapi,cn=auth +</PRE> +<P>The authentication request DN can be used directly ACLs and <TT>groupOfNames</TT> "member" attributes, since it is of legitimate LDAP DN format. Or alternatively, the authentication DN could be mapped before use. See the section <A HREF="#Mapping Authentication Identities">Mapping Authentication Identities</A> for details.</P> +<H3><A NAME="KERBEROS_V4">15.2.2. KERBEROS_V4</A></H3> +<P>This section describes the use of the SASL KERBEROS_V4 mechanism with OpenLDAP. It will be assumed that you are familiar with the workings of the Kerberos IV security system, and that your site has Kerberos IV deployed. Your users should be familiar with authentication policy, how to receive credentials in a Kerberos ticket cache, and how to refresh expired credentials.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>KERBEROS_V4 and Kerberos IV are deprecated in favor of GSSAPI and Kerberos V. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>Client programs will need to be able to obtain a session key for use when connecting to your LDAP server. This allows the LDAP server to know the identity of the user, and allows the client to know it is connecting to a legitimate server. If encryption layers are to be used, the session key can also be used to help negotiate that option.</P> +<P>The slapd server runs the service called "<EM>ldap</EM>", and the server will require a srvtab file with a service key. SASL aware client programs will be obtaining an "ldap" service ticket with the user's ticket granting ticket (TGT), with the instance of the ticket matching the hostname of the OpenLDAP server. For example, if your realm is named <TT>EXAMPLE.COM</TT> and the slapd server is running on the host named <TT>directory.example.com</TT>, the <TT>/etc/srvtab</TT> file on the server will have a service key</P> +<PRE> + ldap.directory@EXAMPLE.COM +</PRE> +<P>When an LDAP client is authenticating a user to the directory using the KERBEROS_IV mechanism, it will request a session key for that same principal, either from the ticket cache or by obtaining a new one from the Kerberos server. This will require the TGT to be available and valid in the cache as well. If it is not present or has expired, the client may print out the message:</P> +<PRE> + ldap_sasl_interactive_bind_s: Local error +</PRE> +<P>When the service ticket is obtained, it will be passed to the LDAP server as proof of the user's identity. The server will extract the identity and realm out of the service ticket using SASL library calls, and convert them into an <EM>authentication request DN</EM> of the form</P> +<PRE> + uid=<username>,cn=<realm>,cn=<mechanism>,cn=auth +</PRE> +<P>So in our above example, if the user's name were "adamson", the authentication request DN would be:</P> +<PRE> + uid=adamsom,cn=example.com,cn=kerberos_v4,cn=auth +</PRE> +<P>This authentication request DN can be used directly ACLs or, alternatively, mapped prior to use. See the section <A HREF="#Mapping Authentication Identities">Mapping Authentication Identities</A> for details.</P> +<H3><A NAME="DIGEST-MD5">15.2.3. DIGEST-MD5</A></H3> +<P>This section describes the use of the SASL DIGEST-MD5 mechanism using secrets stored either in the directory itself or in Cyrus SASL's own database. DIGEST-MD5 relies on the client and the server sharing a "secret", usually a password. The server generates a challenge and the client a response proving that it knows the shared secret. This is much more secure than simply sending the secret over the wire.</P> +<P>Cyrus SASL supports several shared-secret mechanisms. To do this, it needs access to the plaintext password (unlike mechanisms which pass plaintext passwords over the wire, where the server can store a hashed version of the password).</P> +<P>The server's copy of the shared-secret may be stored in Cyrus SASL's own <EM>sasldb</EM> database, in an external system accessed via <EM>saslauthd</EM>, or in LDAP database itself. In either case it is very important to apply file access controls and LDAP access controls to prevent exposure of the passwords. The configuration and commands discussed in this section assume the use of Cyrus SASL 2.1.</P> +<P>To use secrets stored in <EM>sasldb</EM>, simply add users with the <EM>saslpasswd2</EM> command:</P> +<PRE> + saslpasswd2 -c <username> +</PRE> +<P>The passwords for such users must be managed with the <EM>saslpasswd2</EM> command.</P> +<P>To use secrets stored in the LDAP directory, place plaintext passwords in the <TT>userPassword</TT> attribute. It will be necessary to add an option to <TT>slapd.conf</TT> to make sure that passwords set using the LDAP Password Modify Operation are stored in plaintext:</P> +<PRE> + password-hash {CLEARTEXT} +</PRE> +<P>Passwords stored in this way can be managed either with <EM>ldappasswd</EM>(1) or by simply modifying the <TT>userPassword</TT> attribute. Regardless of where the passwords are stored, a mapping will be needed from authentication request DN to user's DN.</P> +<P>The DIGEST-MD5 mechanism produces authentication IDs of the form:</P> +<PRE> + uid=<username>,cn=<realm>,cn=digest-md5,cn=auth +</PRE> +<P>If the default realm is used, the realm name is omitted from the ID, giving:</P> +<PRE> + uid=<username>,cn=digest-md5,cn=auth +</PRE> +<P>See <A HREF="#Mapping Authentication Identities">Mapping Authentication Identities</A> below for information on optional mapping of identities.</P> +<P>With suitable mappings in place, users can specify SASL IDs when performing LDAP operations, and the password stored in <EM>sasldb</EM> or in the directory itself will be used to verify the authentication. For example, the user identified by the directory entry:</P> +<PRE> + dn: cn=Andrew Findlay+uid=u000997,dc=example,dc=com + objectclass: inetOrgPerson + objectclass: person + sn: Findlay + uid: u000997 + userPassword: secret +</PRE> +<P>can issue commands of the form:</P> +<PRE> + ldapsearch -Y DIGEST-MD5 -U u000997 ... +</PRE> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>in each of the above cases, no authorization identity (e.g. <TT>-X</TT>) was provided. Unless you are attempting <A HREF="#SASL Proxy Authorization">SASL Proxy Authorization</A>, no authorization identity should be specified. The server will infer an authorization identity from authentication identity (as described below). +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="EXTERNAL">15.2.4. EXTERNAL</A></H3> +<P>The SASL EXTERNAL mechanism makes use of an authentication performed by a lower-level protocol: usually <TERM>TLS</TERM> or Unix <TERM>IPC</TERM></P> +<P>Each transport protocol returns Authentication Identities in its own format:</P> +<H4><A NAME="TLS Authentication Identity Format">15.2.4.1. TLS Authentication Identity Format</A></H4> +<P>This is the Subject DN from the client-side certificate. Note that DNs are displayed differently by LDAP and by X.509, so a certificate issued to</P> +<PRE> + C=gb, O=The Example Organisation, CN=A Person +</PRE> +<P>will produce an authentication identity of:</P> +<PRE> + cn=A Person,o=The Example Organisation,c=gb +</PRE> +<P>Note that you must set a suitable value for TLSVerifyClient to make the server request the use of a client-side certificate. Without this, the SASL EXTERNAL mechanism will not be offered. Refer to the <A HREF="#Using TLS">Using TLS</A> chapter for details.</P> +<H4><A NAME="IPC (ldapi:///) Identity Format">15.2.4.2. IPC (ldapi:///) Identity Format</A></H4> +<P>This is formed from the Unix UID and GID of the client process:</P> +<PRE> + gidNumber=<number>+uidNumber=<number>,cn=peercred,cn=external,cn=auth +</PRE> +<P>Thus, a client process running as <TT>root</TT> will be:</P> +<PRE> + gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth +</PRE> +<H3><A NAME="Mapping Authentication Identities">15.2.5. Mapping Authentication Identities</A></H3> +<P>The authentication mechanism in the slapd server will use SASL library calls to obtain the authenticated user's "username", based on whatever underlying authentication mechanism was used. This username is in the namespace of the authentication mechanism, and not in the normal LDAP namespace. As stated in the sections above, that username is reformatted into an authentication request DN of the form</P> +<PRE> + uid=<username>,cn=<realm>,cn=<mechanism>,cn=auth +</PRE> +<P>or</P> +<PRE> + uid=<username>,cn=<mechanism>,cn=auth +</PRE> +<P>depending on whether or not <mechanism> employs the concept of "realms". Note also that the realm part will be omitted if the default realm was used in the authentication.</P> +<P>The <EM>ldapwhoami</EM>(1) command may be used to determine the identity associated with the user. It is very useful for determining proper function of mappings.</P> +<P>It is not intended that you should add LDAP entries of the above form to your LDAP database. Chances are you have an LDAP entry for each of the persons that will be authenticating to LDAP, laid out in your directory tree, and the tree does not start at cn=auth. But if your site has a clear mapping between the "username" and an LDAP entry for the person, you will be able to configure your LDAP server to automatically map a authentication request DN to the user's <EM>authentication DN</EM>.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>it is not required that the authentication request DN nor the user's authentication DN resulting from the mapping refer to an entry held in the directory. However, additional capabilities become available (see below). +<HR WIDTH="80%" ALIGN="Left"></P> +<P>The LDAP administrator will need to tell the slapd server how to map an authentication request DN to a user's authentication DN. This is done by adding one or more <TT>authz-regexp</TT> directives to the <EM>slapd.conf</EM>(5) file. This directive takes two arguments:</P> +<PRE> + authz-regexp <search pattern> <replacement pattern> +</PRE> +<P>The authentication request DN is compared to the search pattern using the regular expression functions <EM>regcomp</EM>() and <EM>regexec</EM>(), and if it matches, it is rewritten as the replacement pattern. If there are multiple <TT>authz-regexp</TT> directives, only the first whose search pattern matches the authentication identity is used. The string that is output from the replacement pattern should be the authentication DN of the user or an LDAP URL. If replacement string produces a DN, the entry named by this DN need not be held by this server. If the replace string produces an LDAP URL, that LDAP URL must evaluate to one and only one entry held by this server.</P> +<P>The search pattern can contain any of the regular expression characters listed in <EM>regexec</EM>(3C). The main characters of note are dot ".", asterisk "*", and the open and close parenthesis "(" and ")". Essentially, the dot matches any character, the asterisk allows zero or more repeats of the immediately preceding character or pattern, and terms in parenthesis are remembered for the replacement pattern.</P> +<P>The replacement pattern will produce either a DN or URL referring to the user. Anything from the authentication request DN that matched a string in parenthesis in the search pattern is stored in the variable "$1". That variable "$1" can appear in the replacement pattern, and will be replaced by the string from the authentication request DN. If there were multiple sets of parentheses in the search pattern, the variables $2, $3, etc are used.</P> +<H3><A NAME="Direct Mapping">15.2.6. Direct Mapping</A></H3> +<P>Where possible, direct mapping of the authentication request DN to the user's DN is generally recommended. Aside from avoiding the expense of searching for the user's DN, it allows mapping to DNs which refer to entries not held by this server.</P> +<P>Suppose the authentication request DN is written as:</P> +<PRE> + uid=adamson,cn=example.com,cn=gssapi,cn=auth +</PRE> +<P>and the user's actual LDAP entry is:</P> +<PRE> + uid=adamson,ou=people,dc=example,dc=com +</PRE> +<P>then the following <TT>authz-regexp</TT> directive in <EM>slapd.conf</EM>(5) would provide for direct mapping.</P> +<PRE> + authz-regexp + uid=([^,]*),cn=example.com,cn=gssapi,cn=auth + uid=$1,ou=people,dc=example,dc=com +</PRE> +<P>An even more lenient rule could be written as</P> +<PRE> + authz-regexp + uid=([^,]*),cn=[^,]*,cn=auth + uid=$1,ou=people,dc=example,dc=com +</PRE> +<P>Be careful about setting the search pattern too leniently, however, since it may mistakenly allow persons to become authenticated as a DN to which they should not have access. It is better to write several strict directives than one lenient directive which has security holes. If there is only one authentication mechanism in place at your site, and zero or one realms in use, you might be able to map between authentication identities and LDAP DN's with a single <TT>authz-regexp</TT> directive.</P> +<P>Don't forget to allow for the case where the realm is omitted as well as the case with an explicitly specified realm. This may well require a separate <TT>authz-regexp</TT> directive for each case, with the explicit-realm entry being listed first.</P> +<H3><A NAME="Search-based mappings">15.2.7. Search-based mappings</A></H3> +<P>There are a number of cases where mapping to a LDAP URL may be appropriate. For instance, some sites may have person objects located in multiple areas of the LDAP tree, such as if there were an <TT>ou=accounting</TT> tree and an <TT>ou=engineering</TT> tree, with persons interspersed between them. Or, maybe the desired mapping must be based upon information in the user's information. Consider the need to map the above authentication request DN to user whose entry is as follows:</P> +<PRE> + dn: cn=Mark Adamson,ou=People,dc=Example,dc=COM + objectclass: person + cn: Mark Adamson + uid: adamson +</PRE> +<P>The information in the authentication request DN is insufficient to allow the user's DN to be directly derived, instead the user's DN must be searched for. For these situations, a replacement pattern which produces a LDAP URL can be used in the <TT>authz-regexp</TT> directives. This URL will then be used to perform an internal search of the LDAP database to find the person's authentication DN.</P> +<P>An LDAP URL, similar to other URL's, is of the form</P> +<PRE> + ldap://<host>/<base>?<attrs>?<scope>?<filter> +</PRE> +<P>This contains all of the elements necessary to perform an LDAP search: the name of the server <host>, the LDAP DN search base <base>, the LDAP attributes to retrieve <attrs>, the search scope <scope> which is one of the three options "base", "one", or "sub", and lastly an LDAP search filter <filter>. Since the search is for an LDAP DN within the current server, the <host> portion should be empty. The <attrs> field is also ignored since only the DN is of concern. These two elements are left in the format of the URL to maintain the clarity of what information goes where in the string.</P> +<P>Suppose that the person in the example from above did in fact have an authentication username of "adamson" and that information was kept in the attribute "uid" in their LDAP entry. The <TT>authz-regexp</TT> directive might be written as</P> +<PRE> + authz-regexp + uid=([^,]*),cn=example.com,cn=gssapi,cn=auth + ldap:///ou=people,dc=example,dc=com??one?(uid=$1) +</PRE> +<P>This will initiate an internal search of the LDAP database inside the slapd server. If the search returns exactly one entry, it is accepted as being the DN of the user. If there are more than one entries returned, or if there are zero entries returned, the authentication fails and the user's connection is left bound as the authentication request DN.</P> +<P>The attributes that are used in the search filter <filter> in the URL should be indexed to allow faster searching. If they are not, the authentication step alone can take uncomfortably long periods, and users may assume the server is down.</P> +<P>A more complex site might have several realms in use, each mapping to a different subtree in the directory. These can be handled with statements of the form:</P> +<PRE> + # Match Engineering realm + authz-regexp + uid=([^,]*),cn=engineering.example.com,cn=digest-md5,cn=auth + ldap:///dc=eng,dc=example,dc=com??one?(&(uid=$1)(objectClass=person)) + + # Match Accounting realm + authz-regexp + uid=([^,].*),cn=accounting.example.com,cn=digest-md5,cn=auth + ldap:///dc=accounting,dc=example,dc=com??one?(&(uid=$1)(objectClass=person)) + + # Default realm is customers.example.com + authz-regexp + uid=([^,]*),cn=digest-md5,cn=auth + ldap:///dc=customers,dc=example,dc=com??one?(&(uid=$1)(objectClass=person)) +</PRE> +<P>Note that the explicitly-named realms are handled first, to avoid the realm name becoming part of the UID. Also note the use of scope and filters to limit matching to desirable entries.</P> +<P>Note as well that <TT>authz-regexp</TT> internal search are subject to access controls. Specifically, the authentication identity must have <TT>auth</TT> access.</P> +<P>See <EM>slapd.conf</EM>(5) for more detailed information.</P> +<H2><A NAME="SASL Proxy Authorization">15.3. SASL Proxy Authorization</A></H2> +<P>The SASL offers a feature known as <EM>proxy authorization</EM>, which allows an authenticated user to request that they act on the behalf of another user. This step occurs after the user has obtained an authentication DN, and involves sending an authorization identity to the server. The server will then make a decision on whether or not to allow the authorization to occur. If it is allowed, the user's LDAP connection is switched to have a binding DN derived from the authorization identity, and the LDAP session proceeds with the access of the new authorization DN.</P> +<P>The decision to allow an authorization to proceed depends on the rules and policies of the site where LDAP is running, and thus cannot be made by SASL alone. The SASL library leaves it up to the server to make the decision. The LDAP administrator sets the guidelines of who can authorize to what identity by adding information into the LDAP database entries. By default, the authorization features are disabled, and must be explicitly configured by the LDAP administrator before use.</P> +<H3><A NAME="Uses of Proxy Authorization">15.3.1. Uses of Proxy Authorization</A></H3> +<P>This sort of service is useful when one entity needs to act on the behalf of many other users. For example, users may be directed to a web page to make changes to their personal information in their LDAP entry. The users authenticate to the web server to establish their identity, but the web server CGI cannot authenticate to the LDAP server as that user to make changes for them. Instead, the web server authenticates itself to the LDAP server as a service identity, say,</P> +<PRE> + cn=WebUpdate,dc=example,dc=com +</PRE> +<P>and then it will SASL authorize to the DN of the user. Once so authorized, the CGI makes changes to the LDAP entry of the user, and as far as the slapd server can tell for its ACLs, it is the user themself on the other end of the connection. The user could have connected to the LDAP server directly and authenticated as themself, but that would require the user to have more knowledge of LDAP clients, knowledge which the web page provides in an easier format.</P> +<P>Proxy authorization can also be used to limit access to an account that has greater access to the database. Such an account, perhaps even the root DN specified in <EM>slapd.conf</EM>(5), can have a strict list of people who can authorize to that DN. Changes to the LDAP database could then be only allowed by that DN, and in order to become that DN, users must first authenticate as one of the persons on the list. This allows for better auditing of who made changes to the LDAP database. If people were allowed to authenticate directly to the privileged account, possibly through the <TT>rootpw</TT> <EM>slapd.conf</EM>(5) directive or through a <TT>userPassword</TT> attribute, then auditing becomes more difficult.</P> +<P>Note that after a successful proxy authorization, the original authentication DN of the LDAP connection is overwritten by the new DN from the authorization request. If a service program is able to authenticate itself as its own authentication DN and then authorize to other DN's, and it is planning on switching to several different identities during one LDAP session, it will need to authenticate itself each time before authorizing to another DN (or use a different proxy authorization mechanism). The slapd server does not keep record of the service program's ability to switch to other DN's. On authentication mechanisms like Kerberos this will not require multiple connections being made to the Kerberos server, since the user's TGT and "ldap" session key are valid for multiple uses for the several hours of the ticket lifetime.</P> +<H3><A NAME="SASL Authorization Identities">15.3.2. SASL Authorization Identities</A></H3> +<P>The SASL authorization identity is sent to the LDAP server via the <TT>-X</TT> switch for <EM>ldapsearch</EM>(1) and other tools, or in the <TT>*authzid</TT> parameter to the <EM>lutil_sasl_defaults</EM>() call. The identity can be in one of two forms, either</P> +<PRE> + u:<username> +</PRE> +<P>or</P> +<PRE> + dn:<dn> +</PRE> +<P>In the first form, the <username> is from the same namespace as the authentication identities above. It is the user's username as it is referred to by the underlying authentication mechanism. Authorization identities of this form are converted into a DN format by the same function that the authentication process used, producing an <EM>authorization request DN</EM> of the form</P> +<PRE> + uid=<username>,cn=<realm>,cn=<mechanism>,cn=auth +</PRE> +<P>That authorization request DN is then run through the same <TT>authz-regexp</TT> process to convert it into a legitimate authorization DN from the database. If it cannot be converted due to a failed search from an LDAP URL, the authorization request fails with "inappropriate access". Otherwise, the DN string is now a legitimate authorization DN ready to undergo approval.</P> +<P>If the authorization identity was provided in the second form, with a <TT>"dn:"</TT> prefix, the string after the prefix is already in authorization DN form, ready to undergo approval.</P> +<H3><A NAME="Proxy Authorization Rules">15.3.3. Proxy Authorization Rules</A></H3> +<P>Once slapd has the authorization DN, the actual approval process begins. There are two attributes that the LDAP administrator can put into LDAP entries to allow authorization:</P> +<PRE> + authzTo + authzFrom +</PRE> +<P>Both can be multivalued. The <TT>authzTo</TT> attribute is a source rule, and it is placed into the entry associated with the authentication DN to tell what authorization DNs the authenticated DN is allowed to assume. The second attribute is a destination rule, and it is placed into the entry associated with the requested authorization DN to tell which authenticated DNs may assume it.</P> +<P>The choice of which authorization policy attribute to use is up to the administrator. Source rules are checked first in the person's authentication DN entry, and if none of the <TT>authzTo</TT> rules specify the authorization is permitted, the <TT>authzFrom</TT> rules in the authorization DN entry are then checked. If neither case specifies that the request be honored, the request is denied. Since the default behavior is to deny authorization requests, rules only specify that a request be allowed; there are no negative rules telling what authorizations to deny.</P> +<P>The value(s) in the two attributes are of the same form as the output of the replacement pattern of a <TT>authz-regexp</TT> directive: either a DN or an LDAP URL. For example, if a <TT>authzTo</TT> value is a DN, that DN is one the authenticated user can authorize to. On the other hand, if the <TT>authzTo</TT> value is an LDAP URL, the URL is used as an internal search of the LDAP database, and the authenticated user can become ANY DN returned by the search. If an LDAP entry looked like:</P> +<PRE> + dn: cn=WebUpdate,dc=example,dc=com + authzTo: ldap:///dc=example,dc=com??sub?(objectclass=person) +</PRE> +<P>then any user who authenticated as <TT>cn=WebUpdate,dc=example,dc=com</TT> could authorize to any other LDAP entry under the search base <TT>dc=example,dc=com</TT> which has an objectClass of <TT>Person</TT>.</P> +<H4><A NAME="Notes on Proxy Authorization Rules">15.3.3.1. Notes on Proxy Authorization Rules</A></H4> +<P>An LDAP URL in a <TT>authzTo</TT> or <TT>authzFrom</TT> attribute will return a set of DNs. Each DN returned will be checked. Searches which return a large set can cause the authorization process to take an uncomfortably long time. Also, searches should be performed on attributes that have been indexed by slapd.</P> +<P>To help produce more sweeping rules for <TT>authzFrom</TT> and <TT>authzTo</TT>, the values of these attributes are allowed to be DNs with regular expression characters in them. This means a source rule like</P> +<PRE> + authzTo: dn.regex:^uid=[^,]*,dc=example,dc=com$ +</PRE> +<P>would allow that authenticated user to authorize to any DN that matches the regular expression pattern given. This regular expression comparison can be evaluated much faster than an LDAP search for <TT>(uid=*)</TT>.</P> +<P>Also note that the values in an authorization rule must be one of the two forms: an LDAP URL or a DN (with or without regular expression characters). Anything that does not begin with "<TT>ldap://</TT>" is taken as a DN. It is not permissible to enter another authorization identity of the form "<TT>u:<username></TT>" as an authorization rule.</P> +<H4><A NAME="Policy Configuration">15.3.3.2. Policy Configuration</A></H4> +<P>The decision of which type of rules to use, <TT>authzFrom</TT> or <TT>authzTo</TT>, will depend on the site's situation. For example, if the set of people who may become a given identity can easily be written as a search filter, then a single destination rule could be written. If the set of people is not easily defined by a search filter, and the set of people is small, it may be better to write a source rule in the entries of each of those people who should be allowed to perform the proxy authorization.</P> +<P>By default, processing of proxy authorization rules is disabled. The <TT>authz-policy</TT> directive must be set in the <EM>slapd.conf</EM>(5) file to enable authorization. This directive can be set to <TT>none</TT> for no rules (the default), <TT>to</TT> for source rules, <TT>from</TT> for destination rules, or <TT>both</TT> for both source and destination rules.</P> +<P>Source rules are extremely powerful. If ordinary users have access to write the <TT>authzTo</TT> attribute in their own entries, then they can write rules that would allow them to authorize as anyone else. As such, when using source rules, the <TT>authzTo</TT> attribute should be protected with an ACL that only allows privileged users to set its values.</P> +<P></P> +<HR> +<H1><A NAME="Using TLS">16. Using TLS</A></H1> +<P>OpenLDAP clients and servers are capable of using the <TERM>Transport Layer Security</TERM> (<TERM>TLS</TERM>) framework to provide integrity and confidentiality protections and to support LDAP authentication using the <TERM>SASL</TERM> <TERM>EXTERNAL</TERM> mechanism. TLS is defined in <A HREF="http://www.rfc-editor.org/rfc/rfc4346.txt">RFC4346</A>.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>For generating certifcates, please reference <A HREF="http://www.openldap.org/faq/data/cache/185.html">http://www.openldap.org/faq/data/cache/185.html</A> +<HR WIDTH="80%" ALIGN="Left"></P> +<H2><A NAME="TLS Certificates">16.1. TLS Certificates</A></H2> +<P>TLS uses <TERM>X.509</TERM> certificates to carry client and server identities. All servers are required to have valid certificates, whereas client certificates are optional. Clients must have a valid certificate in order to authenticate via SASL EXTERNAL. For more information on creating and managing certificates, see the <A HREF="http://www.openssl.org/">OpenSSL</A>, <A HREF="http://www.gnu.org/software/gnutls/">GnuTLS</A>, or <A HREF="http://developer.mozilla.org/en/NSS">MozNSS</A> documentation, depending on which TLS implementation libraries you are using.</P> +<H3><A NAME="Server Certificates">16.1.1. Server Certificates</A></H3> +<P>The <TERM>DN</TERM> of a server certificate must use the <TT>CN</TT> attribute to name the server, and the <TT>CN</TT> must carry the server's fully qualified domain name. Additional alias names and wildcards may be present in the <TT>subjectAltName</TT> certificate extension. More details on server certificate names are in <A HREF="http://www.rfc-editor.org/rfc/rfc4513.txt">RFC4513</A>.</P> +<H3><A NAME="Client Certificates">16.1.2. Client Certificates</A></H3> +<P>The DN of a client certificate can be used directly as an authentication DN. Since X.509 is a part of the <TERM>X.500</TERM> standard and LDAP is also based on X.500, both use the same DN formats and generally the DN in a user's X.509 certificate should be identical to the DN of their LDAP entry. However, sometimes the DNs may not be exactly the same, and so the mapping facility described in <A HREF="#Mapping Authentication Identities">Mapping Authentication Identities</A> can be applied to these DNs as well.</P> +<H2><A NAME="TLS Configuration">16.2. TLS Configuration</A></H2> +<P>After obtaining the required certificates, a number of options must be configured on both the client and the server to enable TLS and make use of the certificates. At a minimum, the clients must be configured with the name of the file containing all of the <TERM>Certificate Authority</TERM> (CA) certificates it will trust. The server must be configured with the <TERM>CA</TERM> certificates and also its own server certificate and private key.</P> +<P>Typically a single CA will have issued the server certificate and all of the trusted client certificates, so the server only needs to trust that one signing CA. However, a client may wish to connect to a variety of secure servers managed by different organizations, with server certificates generated by many different CAs. As such, a client is likely to need a list of many different trusted CAs in its configuration.</P> +<H3><A NAME="Server Configuration">16.2.1. Server Configuration</A></H3> +<P>The configuration directives for slapd belong in the global directives section of <EM>slapd.conf</EM>(5).</P> +<H4><A NAME="TLSCACertificateFile <filename>">16.2.1.1. TLSCACertificateFile <filename></A></H4> +<P>This directive specifies the <TERM>PEM</TERM>-format file containing certificates for the CA's that slapd will trust. The certificate for the CA that signed the server certificate must be included among these certificates. If the signing CA was not a top-level (root) CA, certificates for the entire sequence of CA's from the signing CA to the top-level CA should be present. Multiple certificates are simply appended to the file; the order is not significant.</P> +<H4><A NAME="TLSCACertificatePath <path>">16.2.1.2. TLSCACertificatePath <path></A></H4> +<P>This directive specifies the path of a directory that contains individual <TERM>CA</TERM> certificates in separate files. In addition, this directory must be specially managed using the OpenSSL <EM>c_rehash</EM> utility. When using this feature, the OpenSSL library will attempt to locate certificate files based on a hash of their name and serial number. The <EM>c_rehash</EM> utility is used to generate symbolic links with the hashed names that point to the actual certificate files. As such, this option can only be used with a filesystem that actually supports symbolic links. In general, it is simpler to use the <TT>TLSCACertificateFile</TT> directive instead.</P> +<P>When using Mozilla NSS, this directive can be used to specify the path of the directory containing the NSS certificate and key database files. The <EM>certutil</EM> command can be used to add a <TERM>CA</TERM> certificate:</P> +<PRE> + certutil -d <path> -A -n "name of CA cert" -t CT,, -a -i /path/to/cacertfile.pem +</PRE> +<UL> +This command will add a CA certficate stored in the PEM (ASCII) formatted +<BR> +file named /path/to/cacertfile.pem. <TT>-t CT,,</TT> means that the certificate is +<BR> +trusted to be a CA issuing certs for use in TLS clients and servers.</UL> +<H4><A NAME="TLSCertificateFile <filename>">16.2.1.3. TLSCertificateFile <filename></A></H4> +<P>This directive specifies the file that contains the slapd server certificate. Certificates are generally public information and require no special protection.</P> +<P>When using Mozilla NSS, if using a cert/key database (specified with <TT>TLSCACertificatePath</TT>), this directive specifies the name of the certificate to use:</P> +<PRE> + TLSCertificateFile Server-Cert +</PRE> +<UL> +If using a token other than the internal built in token, specify the +<BR> +token name first, followed by a colon:</UL> +<PRE> + TLSCertificateFile my hardware device:Server-Cert +</PRE> +<UL> +Use <TT>certutil -L</TT> to list the certificates by name:</UL> +<PRE> + certutil -d /path/to/certdbdir -L +</PRE> +<H4><A NAME="TLSCertificateKeyFile <filename>">16.2.1.4. TLSCertificateKeyFile <filename></A></H4> +<P>This directive specifies the file that contains the private key that matches the certificate stored in the <TT>TLSCertificateFile</TT> file. Private keys themselves are sensitive data and are usually password encrypted for protection. However, the current implementation doesn't support encrypted keys so the key must not be encrypted and the file itself must be protected carefully.</P> +<P>When using Mozilla NSS, this directive specifies the name of a file that contains the password for the key for the certificate specified with <TT>TLSCertificateFile</TT>. The modutil command can be used to turn off password protection for the cert/key database. For example, if <TT>TLSCACertificatePath</TT> specifes /etc/openldap/certdb as the location of the cert/key database, use modutil to change the password to the empty string:</P> +<PRE> + modutil -dbdir /etc/openldap/certdb -changepw 'NSS Certificate DB' +</PRE> +<UL> +You must have the old password, if any. Ignore the WARNING about the running +<BR> +browser. Press 'Enter' for the new password.</UL> +<H4><A NAME="TLSCipherSuite <cipher-suite-spec>">16.2.1.5. TLSCipherSuite <cipher-suite-spec></A></H4> +<P>This directive configures what ciphers will be accepted and the preference order. <TT><cipher-suite-spec></TT> should be a cipher specification for OpenSSL. You can use the command</P> +<PRE> + openssl ciphers -v ALL +</PRE> +<P>to obtain a verbose list of available cipher specifications.</P> +<P>Besides the individual cipher names, the specifiers <TT>HIGH</TT>, <TT>MEDIUM</TT>, <TT>LOW</TT>, <TT>EXPORT</TT>, and <TT>EXPORT40</TT> may be helpful, along with <TT>TLSv1</TT>, <TT>SSLv3</TT>, and <TT>SSLv2</TT>.</P> +<P>To obtain the list of ciphers in GnuTLS use:</P> +<PRE> + gnutls-cli -l +</PRE> +<P>When using Mozilla NSS, the OpenSSL cipher suite specifications are used and translated into the format used internally by Mozilla NSS. There isn't an easy way to list the cipher suites from the command line. The authoritative list is in the source code for Mozilla NSS in the file sslinfo.c in the structure</P> +<PRE> + static const SSLCipherSuiteInfo suiteInfo[] +</PRE> +<H4><A NAME="TLSRandFile <filename>">16.2.1.6. TLSRandFile <filename></A></H4> +<P>This directive specifies the file to obtain random bits from when <TT>/dev/urandom</TT> is not available. If the system provides <TT>/dev/urandom</TT> then this option is not needed, otherwise a source of random data must be configured. Some systems (e.g. Linux) provide <TT>/dev/urandom</TT> by default, while others (e.g. Solaris) require the installation of a patch to provide it, and others may not support it at all. In the latter case, EGD or PRNGD should be installed, and this directive should specify the name of the EGD/PRNGD socket. The environment variable <TT>RANDFILE</TT> can also be used to specify the filename. Also, in the absence of these options, the <TT>.rnd</TT> file in the slapd user's home directory may be used if it exists. To use the <TT>.rnd</TT> file, just create the file and copy a few hundred bytes of arbitrary data into the file. The file is only used to provide a seed for the pseudo-random number generator, and it doesn't need very much data to work.</P> +<P>This directive is ignored with GnuTLS and Mozilla NSS.</P> +<H4><A NAME="TLSDHParamFile <filename>">16.2.1.7. TLSDHParamFile <filename></A></H4> +<P>This directive specifies the file that contains parameters for Diffie-Hellman ephemeral key exchange. This is required in order to use DHE-based cipher suites, including all DSA-based suites (i.e. <TT>TLSCertificateKeyFile</TT> points to a DSA key), and RSA when the 'key encipherment' key usage is not specified in the certificate. Parameters can be generated using the following command</P> +<PRE> + openssl dhparam [-dsaparam] -out <filename> <numbits> or + certtool --generate-dh-params --bits <numbits> --outfile <filename> +</PRE> +<P>This directive is ignored with Mozilla NSS.</P> +<H4><A NAME="TLSVerifyClient { never | allow | try | demand }">16.2.1.8. TLSVerifyClient { never | allow | try | demand }</A></H4> +<P>This directive specifies what checks to perform on client certificates in an incoming TLS session, if any. This option is set to <TT>never</TT> by default, in which case the server never asks the client for a certificate. With a setting of <TT>allow</TT> the server will ask for a client certificate; if none is provided the session proceeds normally. If a certificate is provided but the server is unable to verify it, the certificate is ignored and the session proceeds normally, as if no certificate had been provided. With a setting of <TT>try</TT> the certificate is requested, and if none is provided, the session proceeds normally. If a certificate is provided and it cannot be verified, the session is immediately terminated. With a setting of <TT>demand</TT> the certificate is requested and a valid certificate must be provided, otherwise the session is immediately terminated.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>The server must request a client certificate in order to use the SASL EXTERNAL authentication mechanism with a TLS session. As such, a non-default <TT>TLSVerifyClient</TT> setting must be configured before SASL EXTERNAL authentication may be attempted, and the SASL EXTERNAL mechanism will only be offered to the client if a valid client certificate was received. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="Client Configuration">16.2.2. Client Configuration</A></H3> +<P>Most of the client configuration directives parallel the server directives. The names of the directives are different, and they go into <EM>ldap.conf</EM>(5) instead of <EM>slapd.conf</EM>(5), but their functionality is mostly the same. Also, while most of these options may be configured on a system-wide basis, they may all be overridden by individual users in their <EM>.ldaprc</EM> files.</P> +<P>The LDAP Start TLS operation is used in LDAP to initiate TLS negotiation. All OpenLDAP command line tools support a <TT>-Z</TT> and <TT>-ZZ</TT> flag to indicate whether a Start TLS operation is to be issued. The latter flag indicates that the tool is to cease processing if TLS cannot be started while the former allows the command to continue.</P> +<P>In LDAPv2 environments, TLS is normally started using the LDAP Secure URI scheme (<TT>ldaps://</TT>) instead of the normal LDAP URI scheme (<TT>ldap://</TT>). OpenLDAP command line tools allow either scheme to used with the <TT>-H</TT> flag and with the <TT>URI</TT> <EM>ldap.conf</EM>(5) option.</P> +<H4><A NAME="TLS_CACERT <filename>">16.2.2.1. TLS_CACERT <filename></A></H4> +<P>This is equivalent to the server's <TT>TLSCACertificateFile</TT> option. As noted in the <A HREF="#TLS Configuration">TLS Configuration</A> section, a client typically may need to know about more CAs than a server, but otherwise the same considerations apply.</P> +<H4><A NAME="TLS_CACERTDIR <path>">16.2.2.2. TLS_CACERTDIR <path></A></H4> +<P>This is equivalent to the server's <TT>TLSCACertificatePath</TT> option. The specified directory must be managed with the OpenSSL <EM>c_rehash</EM> utility as well. If using Mozilla NSS, <path> may contain a cert/key database.</P> +<H4><A NAME="TLS_CERT <filename>">16.2.2.3. TLS_CERT <filename></A></H4> +<P>This directive specifies the file that contains the client certificate. This is a user-only directive and can only be specified in a user's <EM>.ldaprc</EM> file.</P> +<P>When using Mozilla NSS, if using a cert/key database (specified with <TT>TLS_CACERTDIR</TT>), this directive specifies the name of the certificate to use:</P> +<PRE> + TLS_CERT Certificate for Sam Carter +</PRE> +<UL> +If using a token other than the internal built in token, specify the +<BR> +token name first, followed by a colon:</UL> +<PRE> + TLS_CERT my hardware device:Certificate for Sam Carter +</PRE> +<UL> +Use <TT>certutil -L</TT> to list the certificates by name:</UL> +<PRE> + certutil -d /path/to/certdbdir -L +</PRE> +<H4><A NAME="TLS_KEY <filename>">16.2.2.4. TLS_KEY <filename></A></H4> +<P>This directive specifies the file that contains the private key that matches the certificate stored in the <TT>TLS_CERT</TT> file. The same constraints mentioned for <TT>TLSCertificateKeyFile</TT> apply here. This is also a user-only directive.</P> +<H4><A NAME="TLS_RANDFILE <filename>">16.2.2.5. TLS_RANDFILE <filename></A></H4> +<P>This directive is the same as the server's <TT>TLSRandFile</TT> option.</P> +<H4><A NAME="TLS_REQCERT { never | allow | try | demand }">16.2.2.6. TLS_REQCERT { never | allow | try | demand }</A></H4> +<P>This directive is equivalent to the server's <TT>TLSVerifyClient</TT> option. However, for clients the default value is <TT>demand</TT> and there generally is no good reason to change this setting.</P> +<P></P> +<HR> +<H1><A NAME="Constructing a Distributed Directory Service">17. Constructing a Distributed Directory Service</A></H1> +<P>For many sites, running one or more <EM>slapd</EM>(8) that hold an entire subtree of data is sufficient. But often it is desirable to have one <EM>slapd</EM> refer to other directory services for a certain part of the tree (which may or may not be running <EM>slapd</EM>).</P> +<P><EM>slapd</EM> supports <EM>subordinate</EM> and <EM>superior</EM> knowledge information. Subordinate knowledge information is held in <TT>referral</TT> objects (<A HREF="http://www.rfc-editor.org/rfc/rfc3296.txt">RFC3296</A>).</P> +<H2><A NAME="Subordinate Knowledge Information">17.1. Subordinate Knowledge Information</A></H2> +<P>Subordinate knowledge information may be provided to delegate a subtree. Subordinate knowledge information is maintained in the directory as a special <EM>referral</EM> object at the delegate point. The referral object acts as a delegation point, gluing two services together. This mechanism allows for hierarchical directory services to be constructed.</P> +<P>A referral object has a structural object class of <TT>referral</TT> and has the same <TERM>Distinguished Name</TERM> as the delegated subtree. Generally, the referral object will also provide the auxiliary object class <TT>extensibleObject</TT>. This allows the entry to contain appropriate <TERM>Relative Distinguished Name</TERM> values. This is best demonstrated by example.</P> +<P>If the server <TT>a.example.net</TT> holds <TT>dc=example,dc=net</TT> and wished to delegate the subtree <TT>ou=subtree,dc=example,dc=net</TT> to another server <TT>b.example.net</TT>, the following named referral object would be added to <TT>a.example.net</TT>:</P> +<PRE> + dn: dc=subtree,dc=example,dc=net + objectClass: referral + objectClass: extensibleObject + dc: subtree + ref: ldap://b.example.net/dc=subtree,dc=example,dc=net +</PRE> +<P>The server uses this information to generate referrals and search continuations to subordinate servers.</P> +<P>For those familiar with <TERM>X.500</TERM>, a <EM>named referral</EM> object is similar to an X.500 knowledge reference held in a <EM>subr</EM> <TERM>DSE</TERM>.</P> +<H2><A NAME="Superior Knowledge Information">17.2. Superior Knowledge Information</A></H2> +<P>Superior knowledge information may be specified using the <TT>referral</TT> directive. The value is a list of <TERM>URI</TERM>s referring to superior directory services. For servers without immediate superiors, such as for <TT>a.example.net</TT> in the example above, the server can be configured to use a directory service with <EM>global knowledge</EM>, such as the <EM>OpenLDAP Root Service</EM> (<A HREF="http://www.openldap.org/faq/index.cgi?file=393">http://www.openldap.org/faq/index.cgi?file=393</A>).</P> +<PRE> + referral ldap://root.openldap.org/ +</PRE> +<P>However, as <TT>a.example.net</TT> is the <EM>immediate superior</EM> to <TT>b.example.net</TT>, <EM>b.example.net</EM> would be configured as follows:</P> +<PRE> + referral ldap://a.example.net/ +</PRE> +<P>The server uses this information to generate referrals for operations acting upon entries not within or subordinate to any of the naming contexts held by the server.</P> +<P>For those familiar with <TERM>X.500</TERM>, this use of the <TT>ref</TT> attribute is similar to an X.500 knowledge reference held in a <EM>Supr</EM> <TERM>DSE</TERM>.</P> +<H2><A NAME="The ManageDsaIT Control">17.3. The ManageDsaIT Control</A></H2> +<P>Adding, modifying, and deleting referral objects is generally done using <EM>ldapmodify</EM>(1) or similar tools which support the ManageDsaIT control. The ManageDsaIT control informs the server that you intend to manage the referral object as a regular entry. This keeps the server from sending a referral result for requests which interrogate or update referral objects.</P> +<P>The ManageDsaIT control should not be specified when managing regular entries.</P> +<P>The <TT>-M</TT> option of <EM>ldapmodify</EM>(1) (and other tools) enables ManageDsaIT. For example:</P> +<PRE> + ldapmodify -M -f referral.ldif -x -D "cn=Manager,dc=example,dc=net" -W +</PRE> +<P>or with <EM>ldapsearch</EM>(1):</P> +<PRE> + ldapsearch -M -b "dc=example,dc=net" -x "(objectclass=referral)" '*' ref +</PRE> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>the <TT>ref</TT> attribute is operational and must be explicitly requested when desired in search results. +<HR WIDTH="80%" ALIGN="Left"></P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>the use of referrals to construct a Distributed Directory Service is extremely clumsy and not well supported by common clients. If an existing installation has already been built using referrals, the use of the <EM>chain</EM> overlay to hide the referrals will greatly improve the usability of the Directory system. A better approach would be to use explicitly defined local and proxy databases in <EM>subordinate</EM> configurations to provide a seamless view of the Distributed Directory. +<HR WIDTH="80%" ALIGN="Left"></P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>LDAP operations, even subtree searches, normally access only one database. That can be changed by gluing databases together with the <B>subordinate</B>/<B>olcSubordinate</B> keyword. Please see <EM>slapd.conf</EM>(5) and <EM>slapd-config</EM>(5). +<HR WIDTH="80%" ALIGN="Left"></P> +<P></P> +<HR> +<H1><A NAME="Replication">18. Replication</A></H1> +<P>Replicated directories are a fundamental requirement for delivering a resilient enterprise deployment.</P> +<P><A HREF="http://www.openldap.org/">OpenLDAP</A> has various configuration options for creating a replicated directory. In previous releases, replication was discussed in terms of a <EM>master</EM> server and some number of <EM>slave</EM> servers. A master accepted directory updates from other clients, and a slave only accepted updates from a (single) master. The replication structure was rigidly defined and any particular database could only fulfill a single role, either master or slave.</P> +<P>As OpenLDAP now supports a wide variety of replication topologies, these terms have been deprecated in favor of <EM>provider</EM> and <EM>consumer</EM>: A provider replicates directory updates to consumers; consumers receive replication updates from providers. Unlike the rigidly defined master/slave relationships, provider/consumer roles are quite fluid: replication updates received in a consumer can be further propagated by that consumer to other servers, so a consumer can also act simultaneously as a provider. Also, a consumer need not be an actual LDAP server; it may be just an LDAP client.</P> +<P>The following sections will describe the replication technology and discuss the various replication options that are available.</P> +<H2><A NAME="Replication Technology">18.1. Replication Technology</A></H2> +<H3><A NAME="LDAP Sync Replication">18.1.1. LDAP Sync Replication</A></H3> +<P>The <TERM>LDAP Sync</TERM> Replication engine, <TERM>syncrepl</TERM> for short, is a consumer-side replication engine that enables the consumer <TERM>LDAP</TERM> server to maintain a shadow copy of a <TERM>DIT</TERM> fragment. A syncrepl engine resides at the consumer and executes as one of the <EM>slapd</EM>(8) threads. It creates and maintains a consumer replica by connecting to the replication provider to perform the initial DIT content load followed either by periodic content polling or by timely updates upon content changes.</P> +<P>Syncrepl uses the LDAP Content Synchronization protocol (or LDAP Sync for short) as the replica synchronization protocol. LDAP Sync provides a stateful replication which supports both pull-based and push-based synchronization and does not mandate the use of a history store. In pull-based replication the consumer periodically polls the provider for updates. In push-based replication the consumer listens for updates that are sent by the provider in realtime. Since the protocol does not require a history store, the provider does not need to maintain any log of updates it has received (Note that the syncrepl engine is extensible and additional replication protocols may be supported in the future.).</P> +<P>Syncrepl keeps track of the status of the replication content by maintaining and exchanging synchronization cookies. Because the syncrepl consumer and provider maintain their content status, the consumer can poll the provider content to perform incremental synchronization by asking for the entries required to make the consumer replica up-to-date with the provider content. Syncrepl also enables convenient management of replicas by maintaining replica status. The consumer replica can be constructed from a consumer-side or a provider-side backup at any synchronization status. Syncrepl can automatically resynchronize the consumer replica up-to-date with the current provider content.</P> +<P>Syncrepl supports both pull-based and push-based synchronization. In its basic refreshOnly synchronization mode, the provider uses pull-based synchronization where the consumer servers need not be tracked and no history information is maintained. The information required for the provider to process periodic polling requests is contained in the synchronization cookie of the request itself. To optimize the pull-based synchronization, syncrepl utilizes the present phase of the LDAP Sync protocol as well as its delete phase, instead of falling back on frequent full reloads. To further optimize the pull-based synchronization, the provider can maintain a per-scope session log as a history store. In its refreshAndPersist mode of synchronization, the provider uses a push-based synchronization. The provider keeps track of the consumer servers that have requested a persistent search and sends them necessary updates as the provider replication content gets modified.</P> +<P>With syncrepl, a consumer server can create a replica without changing the provider's configurations and without restarting the provider server, if the consumer server has appropriate access privileges for the DIT fragment to be replicated. The consumer server can stop the replication also without the need for provider-side changes and restart.</P> +<P>Syncrepl supports partial, sparse, and fractional replications. The shadow DIT fragment is defined by a general search criteria consisting of base, scope, filter, and attribute list. The replica content is also subject to the access privileges of the bind identity of the syncrepl replication connection.</P> +<H4><A NAME="The LDAP Content Synchronization Protocol">18.1.1.1. The LDAP Content Synchronization Protocol</A></H4> +<P>The LDAP Sync protocol allows a client to maintain a synchronized copy of a DIT fragment. The LDAP Sync operation is defined as a set of controls and other protocol elements which extend the LDAP search operation. This section introduces the LDAP Content Sync protocol only briefly. For more information, refer to <A HREF="http://www.rfc-editor.org/rfc/rfc4533.txt">RFC4533</A>.</P> +<P>The LDAP Sync protocol supports both polling and listening for changes by defining two respective synchronization operations: <EM>refreshOnly</EM> and <EM>refreshAndPersist</EM>. Polling is implemented by the <EM>refreshOnly</EM> operation. The consumer polls the provider using an LDAP Search request with an LDAP Sync control attached. The consumer copy is synchronized to the provider copy at the time of polling using the information returned in the search. The provider finishes the search operation by returning <EM>SearchResultDone</EM> at the end of the search operation as in the normal search. Listening is implemented by the <EM>refreshAndPersist</EM> operation. As the name implies, it begins with a search, like refreshOnly. Instead of finishing the search after returning all entries currently matching the search criteria, the synchronization search remains persistent in the provider. Subsequent updates to the synchronization content in the provider cause additional entry updates to be sent to the consumer.</P> +<P>The <EM>refreshOnly</EM> operation and the refresh stage of the <EM>refreshAndPersist</EM> operation can be performed with a present phase or a delete phase.</P> +<P>In the present phase, the provider sends the consumer the entries updated within the search scope since the last synchronization. The provider sends all requested attributes, be they changed or not, of the updated entries. For each unchanged entry which remains in the scope, the provider sends a present message consisting only of the name of the entry and the synchronization control representing state present. The present message does not contain any attributes of the entry. After the consumer receives all update and present entries, it can reliably determine the new consumer copy by adding the entries added to the provider, by replacing the entries modified at the provider, and by deleting entries in the consumer copy which have not been updated nor specified as being present at the provider.</P> +<P>The transmission of the updated entries in the delete phase is the same as in the present phase. The provider sends all the requested attributes of the entries updated within the search scope since the last synchronization to the consumer. In the delete phase, however, the provider sends a delete message for each entry deleted from the search scope, instead of sending present messages. The delete message consists only of the name of the entry and the synchronization control representing state delete. The new consumer copy can be determined by adding, modifying, and removing entries according to the synchronization control attached to the <EM>SearchResultEntry</EM> message.</P> +<P>In the case that the LDAP Sync provider maintains a history store and can determine which entries are scoped out of the consumer copy since the last synchronization time, the provider can use the delete phase. If the provider does not maintain any history store, cannot determine the scoped-out entries from the history store, or the history store does not cover the outdated synchronization state of the consumer, the provider should use the present phase. The use of the present phase is much more efficient than a full content reload in terms of the synchronization traffic. To reduce the synchronization traffic further, the LDAP Sync protocol also provides several optimizations such as the transmission of the normalized <TT>entryUUID</TT>s and the transmission of multiple <TT>entryUUIDs</TT> in a single <EM>syncIdSet</EM> message.</P> +<P>At the end of the <EM>refreshOnly</EM> synchronization, the provider sends a synchronization cookie to the consumer as a state indicator of the consumer copy after the synchronization is completed. The consumer will present the received cookie when it requests the next incremental synchronization to the provider.</P> +<P>When <EM>refreshAndPersist</EM> synchronization is used, the provider sends a synchronization cookie at the end of the refresh stage by sending a Sync Info message with refreshDone=TRUE. It also sends a synchronization cookie by attaching it to <EM>SearchResultEntry</EM> messages generated in the persist stage of the synchronization search. During the persist stage, the provider can also send a Sync Info message containing the synchronization cookie at any time the provider wants to update the consumer-side state indicator.</P> +<P>In the LDAP Sync protocol, entries are uniquely identified by the <TT>entryUUID</TT> attribute value. It can function as a reliable identifier of the entry. The DN of the entry, on the other hand, can be changed over time and hence cannot be considered as the reliable identifier. The <TT>entryUUID</TT> is attached to each <EM>SearchResultEntry</EM> or <EM>SearchResultReference</EM> as a part of the synchronization control.</P> +<H4><A NAME="Syncrepl Details">18.1.1.2. Syncrepl Details</A></H4> +<P>The syncrepl engine utilizes both the <EM>refreshOnly</EM> and the <EM>refreshAndPersist</EM> operations of the LDAP Sync protocol. If a syncrepl specification is included in a database definition, <EM>slapd</EM>(8) launches a syncrepl engine as a <EM>slapd</EM>(8) thread and schedules its execution. If the <EM>refreshOnly</EM> operation is specified, the syncrepl engine will be rescheduled at the interval time after a synchronization operation is completed. If the <EM>refreshAndPersist</EM> operation is specified, the engine will remain active and process the persistent synchronization messages from the provider.</P> +<P>The syncrepl engine utilizes both the present phase and the delete phase of the refresh synchronization. It is possible to configure a session log in the provider which stores the <TT>entryUUID</TT>s of a finite number of entries deleted from a database. Multiple replicas share the same session log. The syncrepl engine uses the delete phase if the session log is present and the state of the consumer server is recent enough that no session log entries are truncated after the last synchronization of the client. The syncrepl engine uses the present phase if no session log is configured for the replication content or if the consumer replica is too outdated to be covered by the session log. The current design of the session log store is memory based, so the information contained in the session log is not persistent over multiple provider invocations. It is not currently supported to access the session log store by using LDAP operations. It is also not currently supported to impose access control to the session log.</P> +<P>As a further optimization, even in the case the synchronization search is not associated with any session log, no entries will be transmitted to the consumer server when there has been no update in the replication context.</P> +<P>The syncrepl engine, which is a consumer-side replication engine, can work with any backends. The LDAP Sync provider can be configured as an overlay on any backend, but works best with the <EM>back-bdb</EM>, <EM>back-hdb</EM>, or <EM>back-mdb</EM> backends.</P> +<P>The LDAP Sync provider maintains a <TT>contextCSN</TT> for each database as the current synchronization state indicator of the provider content. It is the largest <TT>entryCSN</TT> in the provider context such that no transactions for an entry having smaller <TT>entryCSN</TT> value remains outstanding. The <TT>contextCSN</TT> could not just be set to the largest issued <TT>entryCSN</TT> because <TT>entryCSN</TT> is obtained before a transaction starts and transactions are not committed in the issue order.</P> +<P>The provider stores the <TT>contextCSN</TT> of a context in the <TT>contextCSN</TT> attribute of the context suffix entry. The attribute is not written to the database after every update operation though; instead it is maintained primarily in memory. At database start time the provider reads the last saved <TT>contextCSN</TT> into memory and uses the in-memory copy exclusively thereafter. By default, changes to the <TT>contextCSN</TT> as a result of database updates will not be written to the database until the server is cleanly shut down. A checkpoint facility exists to cause the <TT>contextCSN</TT> to be written out more frequently if desired.</P> +<P>Note that at startup time, if the provider is unable to read a <TT>contextCSN</TT> from the suffix entry, it will scan the entire database to determine the value, and this scan may take quite a long time on a large database. When a <TT>contextCSN</TT> value is read, the database will still be scanned for any <TT>entryCSN</TT> values greater than it, to make sure the <TT>contextCSN</TT> value truly reflects the greatest committed <TT>entryCSN</TT> in the database. On databases which support inequality indexing, setting an eq index on the <TT>entryCSN</TT> attribute and configuring <EM>contextCSN</EM> checkpoints will greatly speed up this scanning step.</P> +<P>If no <TT>contextCSN</TT> can be determined by reading and scanning the database, a new value will be generated. Also, if scanning the database yielded a greater <TT>entryCSN</TT> than was previously recorded in the suffix entry's <TT>contextCSN</TT> attribute, a checkpoint will be immediately written with the new value.</P> +<P>The consumer also stores its replica state, which is the provider's <TT>contextCSN</TT> received as a synchronization cookie, in the <TT>contextCSN</TT> attribute of the suffix entry. The replica state maintained by a consumer server is used as the synchronization state indicator when it performs subsequent incremental synchronization with the provider server. It is also used as a provider-side synchronization state indicator when it functions as a secondary provider server in a cascading replication configuration. Since the consumer and provider state information are maintained in the same location within their respective databases, any consumer can be promoted to a provider (and vice versa) without any special actions.</P> +<P>Because a general search filter can be used in the syncrepl specification, some entries in the context may be omitted from the synchronization content. The syncrepl engine creates a glue entry to fill in the holes in the replica context if any part of the replica content is subordinate to the holes. The glue entries will not be returned in the search result unless <EM>ManageDsaIT</EM> control is provided.</P> +<P>Also as a consequence of the search filter used in the syncrepl specification, it is possible for a modification to remove an entry from the replication scope even though the entry has not been deleted on the provider. Logically the entry must be deleted on the consumer but in <EM>refreshOnly</EM> mode the provider cannot detect and propagate this change without the use of the session log on the provider.</P> +<P>For configuration, please see the <A HREF="#Syncrepl">Syncrepl</A> section.</P> +<H2><A NAME="Deployment Alternatives">18.2. Deployment Alternatives</A></H2> +<P>While the LDAP Sync specification only defines a narrow scope for replication, the OpenLDAP implementation is extremely flexible and supports a variety of operating modes to handle other scenarios not explicitly addressed in the spec.</P> +<H3><A NAME="Delta-syncrepl replication">18.2.1. Delta-syncrepl replication</A></H3> +<UL> +<LI>Disadvantages of LDAP Sync replication:</UL> +<P>LDAP Sync replication is an object-based replication mechanism. When any attribute value in a replicated object is changed on the provider, each consumer fetches and processes the complete changed object, including <B>both the changed and unchanged attribute values</B> during replication. One advantage of this approach is that when multiple changes occur to a single object, the precise sequence of those changes need not be preserved; only the final state of the entry is significant. But this approach may have drawbacks when the usage pattern involves single changes to multiple objects.</P> +<P>For example, suppose you have a database consisting of 102,400 objects of 1 KB each. Further, suppose you routinely run a batch job to change the value of a single two-byte attribute value that appears in each of the 102,400 objects on the master. Not counting LDAP and TCP/IP protocol overhead, each time you run this job each consumer will transfer and process <B>100 MB</B> of data to process <B>200KB of changes!</B></P> +<P>99.98% of the data that is transmitted and processed in a case like this will be redundant, since it represents values that did not change. This is a waste of valuable transmission and processing bandwidth and can cause an unacceptable replication backlog to develop. While this situation is extreme, it serves to demonstrate a very real problem that is encountered in some LDAP deployments.</P> +<UL> +<LI>Where Delta-syncrepl comes in:</UL> +<P>Delta-syncrepl, a changelog-based variant of syncrepl, is designed to address situations like the one described above. Delta-syncrepl works by maintaining a changelog of a selectable depth in a separate database on the provider. The replication consumer checks the changelog for the changes it needs and, as long as the changelog contains the needed changes, the consumer fetches the changes from the changelog and applies them to its database. If, however, a replica is too far out of sync (or completely empty), conventional syncrepl is used to bring it up to date and replication then switches back to the delta-syncrepl mode.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>since the database state is stored in both the changelog DB and the main DB on the provider, it is important to backup/restore both the changelog DB and the main DB using slapcat/slapadd when restoring a DB or copying it to another machine. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>For configuration, please see the <A HREF="#Delta-syncrepl">Delta-syncrepl</A> section.</P> +<H3><A NAME="N-Way Multi-Master replication">18.2.2. N-Way Multi-Master replication</A></H3> +<P>Multi-Master replication is a replication technique using Syncrepl to replicate data to multiple provider ("Master") Directory servers.</P> +<H4><A NAME="Valid Arguments for Multi-Master replication">18.2.2.1. Valid Arguments for Multi-Master replication</A></H4> +<UL> +<LI>If any provider fails, other providers will continue to accept updates +<LI>Avoids a single point of failure +<LI>Providers can be located in several physical sites i.e. distributed across the network/globe. +<LI>Good for Automatic failover/High Availability</UL> +<H4><A NAME="Invalid Arguments for Multi-Master replication">18.2.2.2. Invalid Arguments for Multi-Master replication</A></H4> +<P>(These are often claimed to be advantages of Multi-Master replication but those claims are false):</P> +<UL> +<LI>It has <B>NOTHING</B> to do with load balancing +<LI>Providers <B>must</B> propagate writes to <B>all</B> the other servers, which means the network traffic and write load spreads across all of the servers the same as for single-master. +<LI>Server utilization and performance are at best identical for Multi-Master and Single-Master replication; at worst Single-Master is superior because indexing can be tuned differently to optimize for the different usage patterns between the provider and the consumers.</UL> +<H4><A NAME="Arguments against Multi-Master replication">18.2.2.3. Arguments against Multi-Master replication</A></H4> +<UL> +<LI>Breaks the data consistency guarantees of the directory model +<LI><A HREF="http://www.openldap.org/faq/data/cache/1240.html">http://www.openldap.org/faq/data/cache/1240.html</A> +<LI>If connectivity with a provider is lost because of a network partition, then "automatic failover" can just compound the problem +<LI>Typically, a particular machine cannot distinguish between losing contact with a peer because that peer crashed, or because the network link has failed +<LI>If a network is partitioned and multiple clients start writing to each of the "masters" then reconciliation will be a pain; it may be best to simply deny writes to the clients that are partitioned from the single provider</UL> +<P>For configuration, please see the <A HREF="#N-Way Multi-Master">N-Way Multi-Master</A> section below</P> +<H3><A NAME="MirrorMode replication">18.2.3. MirrorMode replication</A></H3> +<P>MirrorMode is a hybrid configuration that provides all of the consistency guarantees of single-master replication, while also providing the high availability of multi-master. In MirrorMode two providers are set up to replicate from each other (as a multi-master configuration), but an external frontend is employed to direct all writes to only one of the two servers. The second provider will only be used for writes if the first provider crashes, at which point the frontend will switch to directing all writes to the second provider. When a crashed provider is repaired and restarted it will automatically catch up to any changes on the running provider and resync.</P> +<H4><A NAME="Arguments for MirrorMode">18.2.3.1. Arguments for MirrorMode</A></H4> +<UL> +<LI>Provides a high-availability (HA) solution for directory writes (replicas handle reads) +<LI>As long as one provider is operational, writes can safely be accepted +<LI>Provider nodes replicate from each other, so they are always up to date and can be ready to take over (hot standby) +<LI>Syncrepl also allows the provider nodes to re-synchronize after any downtime</UL> +<H4><A NAME="Arguments against MirrorMode">18.2.3.2. Arguments against MirrorMode</A></H4> +<UL> +<LI>MirrorMode is not what is termed as a Multi-Master solution. This is because writes have to go to just one of the mirror nodes at a time +<LI>MirrorMode can be termed as Active-Active Hot-Standby, therefore an external server (slapd in proxy mode) or device (hardware load balancer) is needed to manage which provider is currently active +<LI>Backups are managed slightly differently<UL> +<LI>If backing up the Berkeley database itself and periodically backing up the transaction log files, then the same member of the mirror pair needs to be used to collect logfiles until the next database backup is taken</UL></UL> +<P>For configuration, please see the <A HREF="#MirrorMode">MirrorMode</A> section below</P> +<H3><A NAME="Syncrepl Proxy Mode">18.2.4. Syncrepl Proxy Mode</A></H3> +<P>While the LDAP Sync protocol supports both pull- and push-based replication, the push mode (refreshAndPersist) must still be initiated from the consumer before the provider can begin pushing changes. In some network configurations, particularly where firewalls restrict the direction in which connections can be made, a provider-initiated push mode may be needed.</P> +<P>This mode can be configured with the aid of the LDAP Backend (<A HREF="#Backends">Backends</A> and <EM>slapd-ldap(8)</EM>). Instead of running the syncrepl engine on the actual consumer, a slapd-ldap proxy is set up near (or collocated with) the provider that points to the consumer, and the syncrepl engine runs on the proxy.</P> +<P>For configuration, please see the <A HREF="#Syncrepl Proxy">Syncrepl Proxy</A> section.</P> +<H4><A NAME="Replacing Slurpd">18.2.4.1. Replacing Slurpd</A></H4> +<P>The old <EM>slurpd</EM> mechanism only operated in provider-initiated push mode. Slurpd replication was deprecated in favor of Syncrepl replication and has been completely removed from OpenLDAP 2.4.</P> +<P>The slurpd daemon was the original replication mechanism inherited from UMich's LDAP and operated in push mode: the master pushed changes to the slaves. It was replaced for many reasons, in brief:</P> +<UL> +<LI>It was not reliable<UL> +<LI>It was extremely sensitive to the ordering of records in the replog +<LI>It could easily go out of sync, at which point manual intervention was required to resync the slave database with the master directory +<LI>It wasn't very tolerant of unavailable servers. If a slave went down for a long time, the replog could grow to a size that was too large for slurpd to process</UL> +<LI>It only worked in push mode +<LI>It required stopping and restarting the master to add new slaves +<LI>It only supported single master replication</UL> +<P>Syncrepl has none of those weaknesses:</P> +<UL> +<LI>Syncrepl is self-synchronizing; you can start with a consumer database in any state from totally empty to fully synced and it will automatically do the right thing to achieve and maintain synchronization<UL> +<LI>It is completely insensitive to the order in which changes occur +<LI>It guarantees convergence between the consumer and the provider content without manual intervention +<LI>It can resynchronize regardless of how long a consumer stays out of contact with the provider</UL> +<LI>Syncrepl can operate in either direction +<LI>Consumers can be added at any time without touching anything on the provider +<LI>Multi-master replication is supported</UL> +<H2><A NAME="Configuring the different replication types">18.3. Configuring the different replication types</A></H2> +<H3><A NAME="Syncrepl">18.3.1. Syncrepl</A></H3> +<H4><A NAME="Syncrepl configuration">18.3.1.1. Syncrepl configuration</A></H4> +<P>Because syncrepl is a consumer-side replication engine, the syncrepl specification is defined in <EM>slapd.conf</EM>(5) of the consumer server, not in the provider server's configuration file. The initial loading of the replica content can be performed either by starting the syncrepl engine with no synchronization cookie or by populating the consumer replica by loading an <TERM>LDIF</TERM> file dumped as a backup at the provider.</P> +<P>When loading from a backup, it is not required to perform the initial loading from the up-to-date backup of the provider content. The syncrepl engine will automatically synchronize the initial consumer replica to the current provider content. As a result, it is not required to stop the provider server in order to avoid the replica inconsistency caused by the updates to the provider content during the content backup and loading process.</P> +<P>When replicating a large scale directory, especially in a bandwidth constrained environment, it is advised to load the consumer replica from a backup instead of performing a full initial load using syncrepl.</P> +<H4><A NAME="Set up the provider slapd">18.3.1.2. Set up the provider slapd</A></H4> +<P>The provider is implemented as an overlay, so the overlay itself must first be configured in <EM>slapd.conf</EM>(5) before it can be used. The provider has two primary configuration directives and two secondary directives for when delta-syncrepl is being used. Because the LDAP Sync search is subject to access control, proper access control privileges should be set up for the replicated content.</P> +<P>The two primary options to configure are the checkpoint and sessionlog behaviors.</P> +<P>The <TT>contextCSN</TT> checkpoint is configured by the</P> +<PRE> + syncprov-checkpoint <ops> <minutes> +</PRE> +<P>directive. Checkpoints are only tested after successful write operations. If <EM><ops></EM> operations or more than <EM><minutes></EM> time has passed since the last checkpoint, a new checkpoint is performed. Checkpointing is disabled by default.</P> +<P>The session log is configured by the</P> +<PRE> + syncprov-sessionlog <ops> +</PRE> +<P>directive, where <EM><ops></EM> is the maximum number of session log entries the session log can record. All write operations (except Adds) are recorded in the log.</P> +<P>Note that using the session log requires searching on the <EM>entryUUID</EM> attribute. Setting an eq index on this attribute will greatly benefit the performance of the session log on the provider.</P> +<P>The reloadhint option is configured by the</P> +<PRE> + syncprov-reloadhint <TRUE|FALSE> +</PRE> +<P>directive. It must be set TRUE when using the accesslog overlay for delta-based syncrepl replication support. The default is FALSE.</P> +<P>The nonpresent option should only be configured if the overlay is being placed on top of a log database, such as when used with delta-syncrepl.</P> +<P>The nonpresent option is configured by the</P> +<PRE> + syncprov-nopresent <TRUE|FALSE> +</PRE> +<P>directive. This value should only be set TRUE for a syncprov instance on top of a log database (such as one managed by the accesslog overlay). The default is FALSE.</P> +<P>A more complete example of the <EM>slapd.conf</EM>(5) content is thus:</P> +<PRE> + database mdb + maxsize 1073741824 + suffix dc=Example,dc=com + rootdn dc=Example,dc=com + directory /var/ldap/db + index objectclass,entryCSN,entryUUID eq + + overlay syncprov + syncprov-checkpoint 100 10 + syncprov-sessionlog 100 +</PRE> +<H4><A NAME="Set up the consumer slapd">18.3.1.3. Set up the consumer slapd</A></H4> +<P>The syncrepl replication is specified in the database section of <EM>slapd.conf</EM>(5) for the replica context. The syncrepl engine is backend independent and the directive can be defined with any database type.</P> +<PRE> + database mdb + maxsize 1073741824 + suffix dc=Example,dc=com + rootdn dc=Example,dc=com + directory /var/ldap/db + index objectclass,entryCSN,entryUUID eq + + syncrepl rid=123 + provider=ldap://provider.example.com:389 + type=refreshOnly + interval=01:00:00:00 + searchbase="dc=example,dc=com" + filter="(objectClass=organizationalPerson)" + scope=sub + attrs="cn,sn,ou,telephoneNumber,title,l" + schemachecking=off + bindmethod=simple + binddn="cn=syncuser,dc=example,dc=com" + credentials=secret +</PRE> +<P>In this example, the consumer will connect to the provider <EM>slapd</EM>(8) at port 389 of <A HREF="ldap://provider.example.com">ldap://provider.example.com</A> to perform a polling (<EM>refreshOnly</EM>) mode of synchronization once a day. It will bind as <TT>cn=syncuser,dc=example,dc=com</TT> using simple authentication with password "secret". Note that the access control privilege of <TT>cn=syncuser,dc=example,dc=com</TT> should be set appropriately in the provider to retrieve the desired replication content. Also the search limits must be high enough on the provider to allow the syncuser to retrieve a complete copy of the requested content. The consumer uses the rootdn to write to its database so it always has full permissions to write all content.</P> +<P>The synchronization search in the above example will search for the entries whose objectClass is organizationalPerson in the entire subtree rooted at <TT>dc=example,dc=com</TT>. The requested attributes are <TT>cn</TT>, <TT>sn</TT>, <TT>ou</TT>, <TT>telephoneNumber</TT>, <TT>title</TT>, and <TT>l</TT>. The schema checking is turned off, so that the consumer <EM>slapd</EM>(8) will not enforce entry schema checking when it processes updates from the provider <EM>slapd</EM>(8).</P> +<P>For more detailed information on the syncrepl directive, see the <A HREF="#syncrepl">syncrepl</A> section of <A HREF="#The slapd Configuration File">The slapd Configuration File</A> chapter of this admin guide.</P> +<H4><A NAME="Start the provider and the consumer slapd">18.3.1.4. Start the provider and the consumer slapd</A></H4> +<P>The provider <EM>slapd</EM>(8) is not required to be restarted. <EM>contextCSN</EM> is automatically generated as needed: it might be originally contained in the <TERM>LDIF</TERM> file, generated by <EM>slapadd</EM> (8), generated upon changes in the context, or generated when the first LDAP Sync search arrives at the provider. If an LDIF file is being loaded which did not previously contain the <EM>contextCSN</EM>, the <EM>-w</EM> option should be used with <EM>slapadd</EM> (8) to cause it to be generated. This will allow the server to startup a little quicker the first time it runs.</P> +<P>When starting a consumer <EM>slapd</EM>(8), it is possible to provide a synchronization cookie as the <EM>-c cookie</EM> command line option in order to start the synchronization from a specific state. The cookie is a comma separated list of name=value pairs. Currently supported syncrepl cookie fields are <EM>csn=<csn></EM> and <EM>rid=<rid></EM>. <EM><csn></EM> represents the current synchronization state of the consumer replica. <EM><rid></EM> identifies a consumer replica locally within the consumer server. It is used to relate the cookie to the syncrepl definition in <EM>slapd.conf</EM>(5) which has the matching replica identifier. The <EM><rid></EM> must have no more than 3 decimal digits. The command line cookie overrides the synchronization cookie stored in the consumer replica database.</P> +<H3><A NAME="Delta-syncrepl">18.3.2. Delta-syncrepl</A></H3> +<H4><A NAME="Delta-syncrepl Provider configuration">18.3.2.1. Delta-syncrepl Provider configuration</A></H4> +<P>Setting up delta-syncrepl requires configuration changes on both the master and replica servers:</P> +<PRE> + # Give the replica DN unlimited read access. This ACL needs to be + # merged with other ACL statements, and/or moved within the scope + # of a database. The "by * break" portion causes evaluation of + # subsequent rules. See slapd.access(5) for details. + access to * + by dn.base="cn=replicator,dc=symas,dc=com" read + by * break + + # Set the module path location + modulepath /opt/symas/lib/openldap + + # Load the hdb backend + moduleload back_hdb.la + + # Load the accesslog overlay + moduleload accesslog.la + + #Load the syncprov overlay + moduleload syncprov.la + + # Accesslog database definitions + database hdb + suffix cn=accesslog + directory /db/accesslog + rootdn cn=accesslog + index default eq + index entryCSN,objectClass,reqEnd,reqResult,reqStart + + overlay syncprov + syncprov-nopresent TRUE + syncprov-reloadhint TRUE + + # Let the replica DN have limitless searches + limits dn.exact="cn=replicator,dc=symas,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited + + # Primary database definitions + database hdb + suffix "dc=symas,dc=com" + rootdn "cn=manager,dc=symas,dc=com" + + ## Whatever other configuration options are desired + + # syncprov specific indexing + index entryCSN eq + index entryUUID eq + + # syncrepl Provider for primary db + overlay syncprov + syncprov-checkpoint 1000 60 + + # accesslog overlay definitions for primary db + overlay accesslog + logdb cn=accesslog + logops writes + logsuccess TRUE + # scan the accesslog DB every day, and purge entries older than 7 days + logpurge 07+00:00 01+00:00 + + # Let the replica DN have limitless searches + limits dn.exact="cn=replicator,dc=symas,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited +</PRE> +<P>For more information, always consult the relevant man pages (<EM>slapo-accesslog</EM>(5) and <EM>slapd.conf</EM>(5))</P> +<H4><A NAME="Delta-syncrepl Consumer configuration">18.3.2.2. Delta-syncrepl Consumer configuration</A></H4> +<PRE> + # Replica database configuration + database hdb + suffix "dc=symas,dc=com" + rootdn "cn=manager,dc=symas,dc=com" + + ## Whatever other configuration bits for the replica, like indexing + ## that you want + + # syncrepl specific indices + index entryUUID eq + + # syncrepl directives + syncrepl rid=0 + provider=ldap://ldapmaster.symas.com:389 + bindmethod=simple + binddn="cn=replicator,dc=symas,dc=com" + credentials=secret + searchbase="dc=symas,dc=com" + logbase="cn=accesslog" + logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" + schemachecking=on + type=refreshAndPersist + retry="60 +" + syncdata=accesslog + + # Refer updates to the master + updateref ldap://ldapmaster.symas.com +</PRE> +<P>The above configuration assumes that you have a replicator identity defined in your database that can be used to bind to the provider. In addition, all of the databases (primary, replica, and the accesslog storage database) should also have properly tuned <EM>DB_CONFIG</EM> files that meet your needs.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>An accesslog database is unique to a given master. It should never be replicated. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="N-Way Multi-Master">18.3.3. N-Way Multi-Master</A></H3> +<P>For the following example we will be using 3 Master nodes. Keeping in line with <B>test050-syncrepl-multimaster</B> of the OpenLDAP test suite, we will be configuring <EM>slapd(8)</EM> via <B>cn=config</B></P> +<P>This sets up the config database:</P> +<PRE> + dn: cn=config + objectClass: olcGlobal + cn: config + olcServerID: 1 + + dn: olcDatabase={0}config,cn=config + objectClass: olcDatabaseConfig + olcDatabase: {0}config + olcRootPW: secret +</PRE> +<P>second and third servers will have a different olcServerID obviously:</P> +<PRE> + dn: cn=config + objectClass: olcGlobal + cn: config + olcServerID: 2 + + dn: olcDatabase={0}config,cn=config + objectClass: olcDatabaseConfig + olcDatabase: {0}config + olcRootPW: secret +</PRE> +<P>This sets up syncrepl as a provider (since these are all masters):</P> +<PRE> + dn: cn=module,cn=config + objectClass: olcModuleList + cn: module + olcModulePath: /usr/local/libexec/openldap + olcModuleLoad: syncprov.la +</PRE> +<P>Now we setup the first Master Node (replace $URI1, $URI2 and $URI3 etc. with your actual ldap urls):</P> +<PRE> + dn: cn=config + changetype: modify + replace: olcServerID + olcServerID: 1 $URI1 + olcServerID: 2 $URI2 + olcServerID: 3 $URI3 + + dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config + changetype: add + objectClass: olcOverlayConfig + objectClass: olcSyncProvConfig + olcOverlay: syncprov + + dn: olcDatabase={0}config,cn=config + changetype: modify + add: olcSyncRepl + olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple + credentials=secret searchbase="cn=config" type=refreshAndPersist + retry="5 5 300 5" timeout=1 + olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple + credentials=secret searchbase="cn=config" type=refreshAndPersist + retry="5 5 300 5" timeout=1 + olcSyncRepl: rid=003 provider=$URI3 binddn="cn=config" bindmethod=simple + credentials=secret searchbase="cn=config" type=refreshAndPersist + retry="5 5 300 5" timeout=1 + - + add: olcMirrorMode + olcMirrorMode: TRUE +</PRE> +<P>Now start up the Master and a consumer/s, also add the above LDIF to the first consumer, second consumer etc. It will then replicate <B>cn=config</B>. You now have N-Way Multimaster on the config database.</P> +<P>We still have to replicate the actual data, not just the config, so add to the master (all active and configured consumers/masters will pull down this config, as they are all syncing). Also, replace all <EM>${</EM>} variables with whatever is applicable to your setup:</P> +<PRE> + dn: olcDatabase={1}$BACKEND,cn=config + objectClass: olcDatabaseConfig + objectClass: olc${BACKEND}Config + olcDatabase: {1}$BACKEND + olcSuffix: $BASEDN + olcDbDirectory: ./db + olcRootDN: $MANAGERDN + olcRootPW: $PASSWD + olcLimits: dn.exact="$MANAGERDN" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited + olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple + credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly + interval=00:00:00:10 retry="5 5 300 5" timeout=1 + olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple + credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly + interval=00:00:00:10 retry="5 5 300 5" timeout=1 + olcSyncRepl: rid=006 provider=$URI3 binddn="$MANAGERDN" bindmethod=simple + credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly + interval=00:00:00:10 retry="5 5 300 5" timeout=1 + olcMirrorMode: TRUE + + dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config + changetype: add + objectClass: olcOverlayConfig + objectClass: olcSyncProvConfig + olcOverlay: syncprov +</PRE> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>All of your servers' clocks must be tightly synchronized using e.g. NTP <A HREF="http://www.ntp.org/">http://www.ntp.org/</A>, atomic clock, or some other reliable time reference. +<HR WIDTH="80%" ALIGN="Left"></P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>As stated in <EM>slapd-config</EM>(5), URLs specified in <EM>olcSyncRepl</EM> directives are the URLs of the servers from which to replicate. These must exactly match the URLs <EM>slapd</EM> listens on (<EM>-h</EM> in <A HREF="#Command-Line Options">Command-Line Options</A>). Otherwise slapd may attempt to replicate from itself, causing a loop. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="MirrorMode">18.3.4. MirrorMode</A></H3> +<P>MirrorMode configuration is actually very easy. If you have ever setup a normal slapd syncrepl provider, then the only change is the following two directives:</P> +<PRE> + mirrormode on + serverID 1 +</PRE> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>You need to make sure that the <EM>serverID</EM> of each mirror node is different and add it as a global configuration option. +<HR WIDTH="80%" ALIGN="Left"></P> +<H4><A NAME="Mirror Node Configuration">18.3.4.1. Mirror Node Configuration</A></H4> +<P>The first step is to configure the syncrepl provider the same as in the <A HREF="#Set up the provider slapd">Set up the provider slapd</A> section.</P> +<P>Here's a specific cut down example using <A HREF="#LDAP Sync Replication">LDAP Sync Replication</A> in <EM>refreshAndPersist</EM> mode:</P> +<P>MirrorMode node 1:</P> +<PRE> + # Global section + serverID 1 + # database section + + # syncrepl directive + syncrepl rid=001 + provider=ldap://ldap-sid2.example.com + bindmethod=simple + binddn="cn=mirrormode,dc=example,dc=com" + credentials=mirrormode + searchbase="dc=example,dc=com" + schemachecking=on + type=refreshAndPersist + retry="60 +" + + mirrormode on +</PRE> +<P>MirrorMode node 2:</P> +<PRE> + # Global section + serverID 2 + # database section + + # syncrepl directive + syncrepl rid=001 + provider=ldap://ldap-sid1.example.com + bindmethod=simple + binddn="cn=mirrormode,dc=example,dc=com" + credentials=mirrormode + searchbase="dc=example,dc=com" + schemachecking=on + type=refreshAndPersist + retry="60 +" + + mirrormode on +</PRE> +<P>It's simple really; each MirrorMode node is setup <B>exactly</B> the same, except that the <EM>serverID</EM> is unique, and each consumer is pointed to the other server.</P> +<H5><A NAME="Failover Configuration">18.3.4.1.1. Failover Configuration</A></H5> +<P>There are generally 2 choices for this; 1. Hardware proxies/load-balancing or dedicated proxy software, 2. using a Back-LDAP proxy as a syncrepl provider</P> +<P>A typical enterprise example might be:</P> +<P><CENTER><IMG SRC="dual_dc.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure X.Y: MirrorMode in a Dual Data Center Configuration</P> +<H5><A NAME="Normal Consumer Configuration">18.3.4.1.2. Normal Consumer Configuration</A></H5> +<P>This is exactly the same as the <A HREF="#Set up the consumer slapd">Set up the consumer slapd</A> section. It can either setup in normal <A HREF="#syncrepl replication">syncrepl replication</A> mode, or in <A HREF="#delta-syncrepl replication">delta-syncrepl replication</A> mode.</P> +<H4><A NAME="MirrorMode Summary">18.3.4.2. MirrorMode Summary</A></H4> +<P>You will now have a directory architecture that provides all of the consistency guarantees of single-master replication, while also providing the high availability of multi-master replication.</P> +<H3><A NAME="Syncrepl Proxy">18.3.5. Syncrepl Proxy</A></H3> +<P><CENTER><IMG SRC="push-based-complete.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure X.Y: Replacing slurpd</P> +<P>The following example is for a self-contained push-based replication solution:</P> +<PRE> + ####################################################################### + # Standard OpenLDAP Master/Provider + ####################################################################### + + include /usr/local/etc/openldap/schema/core.schema + include /usr/local/etc/openldap/schema/cosine.schema + include /usr/local/etc/openldap/schema/nis.schema + include /usr/local/etc/openldap/schema/inetorgperson.schema + + include /usr/local/etc/openldap/slapd.acl + + modulepath /usr/local/libexec/openldap + moduleload back_hdb.la + moduleload syncprov.la + moduleload back_monitor.la + moduleload back_ldap.la + + pidfile /usr/local/var/slapd.pid + argsfile /usr/local/var/slapd.args + + loglevel sync stats + + database hdb + suffix "dc=suretecsystems,dc=com" + directory /usr/local/var/openldap-data + + checkpoint 1024 5 + cachesize 10000 + idlcachesize 10000 + + index objectClass eq + # rest of indexes + index default sub + + rootdn "cn=admin,dc=suretecsystems,dc=com" + rootpw testing + + # syncprov specific indexing + index entryCSN eq + index entryUUID eq + + # syncrepl Provider for primary db + overlay syncprov + syncprov-checkpoint 1000 60 + + # Let the replica DN have limitless searches + limits dn.exact="cn=replicator,dc=suretecsystems,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited + + database monitor + + database config + rootpw testing + + ############################################################################## + # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap + ############################################################################## + + database ldap + # ignore conflicts with other databases, as we need to push out to same suffix + hidden on + suffix "dc=suretecsystems,dc=com" + rootdn "cn=slapd-ldap" + uri ldap://localhost:9012/ + + lastmod on + + # We don't need any access to this DSA + restrict all + + acl-bind bindmethod=simple + binddn="cn=replicator,dc=suretecsystems,dc=com" + credentials=testing + + syncrepl rid=001 + provider=ldap://localhost:9011/ + binddn="cn=replicator,dc=suretecsystems,dc=com" + bindmethod=simple + credentials=testing + searchbase="dc=suretecsystems,dc=com" + type=refreshAndPersist + retry="5 5 300 5" + + overlay syncprov +</PRE> +<P>A replica configuration for this type of setup could be:</P> +<PRE> + ####################################################################### + # Standard OpenLDAP Slave without Syncrepl + ####################################################################### + + include /usr/local/etc/openldap/schema/core.schema + include /usr/local/etc/openldap/schema/cosine.schema + include /usr/local/etc/openldap/schema/nis.schema + include /usr/local/etc/openldap/schema/inetorgperson.schema + + include /usr/local/etc/openldap/slapd.acl + + modulepath /usr/local/libexec/openldap + moduleload back_hdb.la + moduleload syncprov.la + moduleload back_monitor.la + moduleload back_ldap.la + + pidfile /usr/local/var/slapd.pid + argsfile /usr/local/var/slapd.args + + loglevel sync stats + + database hdb + suffix "dc=suretecsystems,dc=com" + directory /usr/local/var/openldap-slave/data + + checkpoint 1024 5 + cachesize 10000 + idlcachesize 10000 + + index objectClass eq + # rest of indexes + index default sub + + rootdn "cn=admin,dc=suretecsystems,dc=com" + rootpw testing + + # Let the replica DN have limitless searches + limits dn.exact="cn=replicator,dc=suretecsystems,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited + + updatedn "cn=replicator,dc=suretecsystems,dc=com" + + # Refer updates to the master + updateref ldap://localhost:9011 + + database monitor + + database config + rootpw testing +</PRE> +<P>You can see we use the <EM>updatedn</EM> directive here and example ACLs (<TT>usr/local/etc/openldap/slapd.acl</TT>) for this could be:</P> +<PRE> + # Give the replica DN unlimited read access. This ACL may need to be + # merged with other ACL statements. + + access to * + by dn.base="cn=replicator,dc=suretecsystems,dc=com" write + by * break + + access to dn.base="" + by * read + + access to dn.base="cn=Subschema" + by * read + + access to dn.subtree="cn=Monitor" + by dn.exact="uid=admin,dc=suretecsystems,dc=com" write + by users read + by * none + + access to * + by self write + by * read +</PRE> +<P>In order to support more replicas, just add more <EM>database ldap</EM> sections and increment the <EM>syncrepl rid</EM> number accordingly.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>You must populate the Master and Slave directories with the same data, unlike when using normal Syncrepl +<HR WIDTH="80%" ALIGN="Left"></P> +<P>If you do not have access to modify the master directory configuration you can configure a standalone ldap proxy, which might look like:</P> +<P><CENTER><IMG SRC="push-based-standalone.png" ALIGN="center"></CENTER></P> +<P ALIGN="Center">Figure X.Y: Replacing slurpd with a standalone version</P> +<P>The following configuration is an example of a standalone LDAP Proxy:</P> +<PRE> + include /usr/local/etc/openldap/schema/core.schema + include /usr/local/etc/openldap/schema/cosine.schema + include /usr/local/etc/openldap/schema/nis.schema + include /usr/local/etc/openldap/schema/inetorgperson.schema + + include /usr/local/etc/openldap/slapd.acl + + modulepath /usr/local/libexec/openldap + moduleload syncprov.la + moduleload back_ldap.la + + ############################################################################## + # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap + ############################################################################## + + database ldap + # ignore conflicts with other databases, as we need to push out to same suffix + hidden on + suffix "dc=suretecsystems,dc=com" + rootdn "cn=slapd-ldap" + uri ldap://localhost:9012/ + + lastmod on + + # We don't need any access to this DSA + restrict all + + acl-bind bindmethod=simple + binddn="cn=replicator,dc=suretecsystems,dc=com" + credentials=testing + + syncrepl rid=001 + provider=ldap://localhost:9011/ + binddn="cn=replicator,dc=suretecsystems,dc=com" + bindmethod=simple + credentials=testing + searchbase="dc=suretecsystems,dc=com" + type=refreshAndPersist + retry="5 5 300 5" + + overlay syncprov +</PRE> +<P>As you can see, you can let your imagination go wild using Syncrepl and <EM>slapd-ldap(8)</EM> tailoring your replication to fit your specific network topology.</P> +<P></P> +<HR> +<H1><A NAME="Maintenance">19. Maintenance</A></H1> +<P>System Administration is all about maintenance, so it is only fair that we discuss how to correctly maintain an OpenLDAP deployment.</P> +<H2><A NAME="Directory Backups">19.1. Directory Backups</A></H2> +<P>Backup strategies largely depend on the amount of change in the database and how much of that change an administrator might be willing to lose in a catastrophic failure. There are two basic methods that can be used:</P> +<P>1. Backup the Berkeley database itself and periodically back up the transaction log files:</P> +<P>Berkeley DB produces transaction logs that can be used to reconstruct changes from a given point in time. For example, if an administrator were willing to only lose one hour's worth of changes, they could take down the server in the middle of the night, copy the Berkeley database files offsite, and bring the server back online. Then, on an hourly basis, they could force a database checkpoint, capture the log files that have been generated in the past hour, and copy them offsite. The accumulated log files, in combination with the previous database backup, could be used with db_recover to reconstruct the database up to the time the last collection of log files was copied offsite. This method affords good protection, with minimal space overhead.</P> +<P>2. Periodically run slapcat and back up the LDIF file:</P> +<P>Slapcat can be run while slapd is active. However, one runs the risk of an inconsistent database- not from the point of slapd, but from the point of the applications using LDAP. For example, if a provisioning application performed tasks that consisted of several LDAP operations, and the slapcat took place concurrently with those operations, then there might be inconsistencies in the LDAP database from the point of view of that provisioning application and applications that depended on it. One must, therefore, be convinced something like that won't happen. One way to do that would be to put the database in read-only mode while performing the slapcat. The other disadvantage of this approach is that the generated LDIF files can be rather large and the accumulation of the day's backups could add up to a substantial amount of space.</P> +<P>You can use <EM>slapcat</EM>(8) to generate an LDIF file for each of your <EM>slapd</EM>(8) back-bdb or back-hdb databases.</P> +<PRE> + slapcat -f slapd.conf -b "dc=example,dc=com" +</PRE> +<P>For back-bdb and back-hdb, this command may be ran while slapd(8) is running.</P> +<P>MORE on actual Berkeley DB backups later covering db_recover etc.</P> +<H2><A NAME="Berkeley DB Logs">19.2. Berkeley DB Logs</A></H2> +<P>Berkeley DB log files grow, and the administrator has to deal with it. The procedure is known as log file archival or log file rotation.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>The actual log file rotation is handled by the Berkeley DB engine. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>Logs of current transactions need to be stored into files so that the database can be recovered in the event of an application crash. Administrators can change the size limit of a single log file (by default 10MB), and have old log files removed automatically, by setting up DB environment (see below). The reason Berkeley DB never deletes any log files by default is that the administrator may wish to backup the log files before removal to make database recovery possible even after a catastrophic failure, such as file system corruption.</P> +<P>Log file names are <TT>log.XXXXXXXXXX</TT> (X is a digit). By default the log files are located in the BDB backend directory. The <TT>db_archive</TT> tool knows what log files are used in current transactions, and what are not. Administrators can move unused log files to a backup media, and delete them. To have them removed automatically, place set_flags <EM>DB_LOG_AUTOREMOVE</EM> directive in <TT>DB_CONFIG</TT>.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>If the log files are removed automatically, recovery after a catastrophic failure is likely to be impossible. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>The files with names <TT>__db.001</TT>, <TT>__db.002</TT>, etc are just shared memory regions (or whatever). These ARE NOT 'logs', they must be left alone. Don't be afraid of them, they do not grow like logs do.</P> +<P>To understand the <TT>db_archive</TT> interface, the reader should refer to chapter 9 of the Berkeley DB guide. In particular, the following chapters are recommended:</P> +<UL> +<LI>Database and log file archival - <A HREF="http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/archival.html">http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/archival.html</A> +<LI>Log file removal - <A HREF="http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/logfile.html">http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/logfile.html</A> +<LI>Recovery procedures - <A HREF="http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/recovery.html">http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/recovery.html</A> +<LI>Hot failover - <A HREF="http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/hotfail.html">http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/hotfail.html</A> +<LI>Complete list of Berkeley DB flags - <A HREF="http://www.oracle.com/technology/documentation/berkeley-db/db/api_c/env_set_flags.html">http://www.oracle.com/technology/documentation/berkeley-db/db/api_c/env_set_flags.html</A></UL> +<P>Advanced installations can use special environment settings to fine-tune some Berkeley DB options (change the log file limit, etc). This can be done by using the <TT>DB_CONFIG</TT> file. This magic file can be created in BDB backend directory set up by <EM>slapd.conf</EM>(5). More information on this file can be found in File naming chapter. Specific directives can be found in C Interface, look for <EM>DB_ENV->set_XXXX</EM> calls.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>options set in <TT>DB_CONFIG</TT> file override options set by OpenLDAP. Use them with extreme caution. Do not use them unless You know what You are doing. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>The advantages of <TT>DB_CONFIG</TT> usage can be the following:</P> +<UL> +<LI>to keep data files and log files on different mediums (i.e. disks) to improve performance and/or reliability; +<LI>to fine-tune some specific options (such as shared memory region sizes); +<LI>to set the log file limit (please read Log file limits before doing this).</UL> +<P>To figure out the best-practice BDB backup scenario, the reader is highly recommended to read the whole Chapter 9: Berkeley DB Transactional Data Store Applications. This chapter is a set of small pages with examples in C language. Non-programming people can skip these examples without loss of knowledge.</P> +<H2><A NAME="Checkpointing">19.3. Checkpointing</A></H2> +<P>MORE/TIDY</P> +<P>If you put "checkpoint 1024 5" in slapd.conf (to checkpoint after 1024kb or 5 minutes, for example), this does not checkpoint every 5 minutes as you may think. The explanation from Howard is:</P> +<P>'In OpenLDAP 2.1 and 2.2 the checkpoint directive acts as follows - *when there is a write operation*, and more than <check> minutes have occurred since the last checkpoint, perform the checkpoint. If more than <check> minutes pass after a write without any other write operations occurring, no checkpoint is performed, so it's possible to lose the last write that occurred.''</P> +<P>In other words, a write operation occurring less than "check" minutes after the last checkpoint will not be checkpointed until the next write occurs after "check" minutes have passed since the checkpoint.</P> +<P>This has been modified in 2.3 to indeed checkpoint every so often; in the meantime a workaround is to invoke "db_checkpoint" from a cron script every so often, say 5 minutes.</P> +<H2><A NAME="Migration">19.4. Migration</A></H2> +<P>The simplest steps needed to migrate between versions or upgrade, depending on your deployment type are:</P> +<UL> + </UL><OL> +<LI><B>Stop the current server when convenient</B> +<BR> + +<LI><B>slapcat the current data out</B> +<BR> + +<LI><B>Clear out the current data directory (/usr/local/var/openldap-data/) leaving DB_CONFIG in place</B> +<BR> + +<LI><B>Perform the software upgrades</B> +<BR> + +<LI><B>slapadd the exported data back into the directory</B> +<BR> + +<LI><B>Start the server</B></OL> +<P>Obviously this doesn't cater for any complicated deployments like <A HREF="#MirrorMode">MirrorMode</A> or <A HREF="#N-Way Multi-Master">N-Way Multi-Master</A>, but following the above sections and using either commercial support or community support should help. Also check the <A HREF="#Troubleshooting">Troubleshooting</A> section.</P> +<P></P> +<HR> +<H1><A NAME="Monitoring">20. Monitoring</A></H1> +<P><EM>slapd</EM>(8) supports an optional <TERM>LDAP</TERM> monitoring interface you can use to obtain information regarding the current state of your <EM>slapd</EM> instance. For instance, the interface allows you to determine how many clients are connected to the server currently. The monitoring information is provided by a specialized backend, the <EM>monitor</EM> backend. A manual page, <EM>slapd-monitor</EM>(5) is available.</P> +<P>When the monitoring interface is enabled, LDAP clients may be used to access information provided by the <EM>monitor</EM> backend, subject to access and other controls.</P> +<P>When enabled, the <EM>monitor</EM> backend dynamically generates and returns objects in response to search requests in the <EM>cn=Monitor</EM> subtree. Each object contains information about a particular aspect of the server. The information is held in a combination of user applications and operational attributes. This information can be access with <EM>ldapsearch(1)</EM>, with any general-purpose LDAP browser, or with specialized monitoring tools. The <A HREF="#Accessing Monitoring Information">Accessing Monitoring Information</A> section provides a brief tutorial on how to use <EM>ldapsearch</EM>(1) to access monitoring information, while the <A HREF="#Monitor information">Monitor information</A> section details monitoring information base and its organization.</P> +<P>While support for the monitor backend is included in default builds of slapd(8), this support requires some configuration to become active. This may be done using either <TT>cn=config</TT> or <EM>slapd.conf</EM>(5). The former is discussed in the <A HREF="#Monitor configuration via cn=config">Monitor configuration via cn=config</A> section of this of this chapter. The latter is discussed in the <A HREF="#Monitor configuration via slapd.conf(5)">Monitor configuration via slapd.conf(5)</A> section of this chapter. These sections assume monitor backend is built into <EM>slapd</EM> (e.g., <TT>--enable-monitor=yes</TT>, the default). If the monitor backend was built as a module (e.g., <TT>--enable-monitor=mod</TT>, this module must loaded. Loading of modules is discussed in the <A HREF="#Configuring slapd">Configuring slapd</A> and <A HREF="#The slapd Configuration File">The slapd Configuration File</A> chapters.</P> +<H2><A NAME="Monitor configuration via cn=config(5)">20.1. Monitor configuration via cn=config(5)</A></H2> +<P><EM>This section has yet to be written.</EM></P> +<H2><A NAME="Monitor configuration via slapd.conf(5)">20.2. Monitor configuration via slapd.conf(5)</A></H2> +<P>Configuration of the slapd.conf(5) to support LDAP monitoring is quite simple.</P> +<P>First, ensure <EM>core.schema</EM> schema configuration file is included by your <EM>slapd.conf</EM>(5) file. The <EM>monitor</EM> backend requires it.</P> +<P>Second, instantiate the <EM>monitor backend</EM> by adding a <EM>database monitor</EM> directive below your existing database sections. For instance:</P> +<PRE> + database monitor +</PRE> +<P>Lastly, add additional global or database directives as needed.</P> +<P>Like most other database backends, the monitor backend does honor slapd(8) access and other administrative controls. As some monitor information may be sensitive, it is generally recommend access to cn=monitor be restricted to directory administrators and their monitoring agents. Adding an <EM>access</EM> directive immediately below the <EM>database monitor</EM> directive is a clear and effective approach for controlling access. For instance, the addition of the following <EM>access</EM> directive immediately below the <EM>database monitor</EM> directive restricts access to monitoring information to the specified directory manager.</P> +<PRE> + access to * + by dn.exact="cn=Manager,dc=example,dc=com + by * none +</PRE> +<P>More information on <EM>slapd</EM>(8) access controls, see <EM>The access Control Directive</EM> section of the <A HREF="#The slapd Configuration File">The slapd Configuration File</A> chapter and <EM>slapd.access</EM>(5).</P> +<P>After restarting <EM>slapd</EM>(8), you are ready to start exploring the monitoring information provided in <TT>cn=config</TT> as discussed in the <A HREF="#Accessing Monitoring Information">Accessing Monitoring Information</A> section of this chapter.</P> +<P>One can verify slapd(8) is properly configured to provide monitoring information by attempting to read the <TT>cn=monitor</TT> object. For instance, if the following <EM>ldapsearch</EM>(1) command returns the cn=monitor object (with, as requested, no attributes), it's working.</P> +<PRE> + ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -W \ + -b 'cn=Monitor' -s base 1.1 +</PRE> +<P>Note that unlike general purpose database backends, the database suffix is hardcoded. It's always <TT>cn=Monitor</TT>. So no <EM>suffix</EM> directive should be provided. Also note that general purpose database backends, the monitor backend cannot be instantiated multiple times. That is, there can only be one (or zero) occurrences of <TT>database monitor</TT> in the server's configuration.</P> +<H2><A NAME="Accessing Monitoring Information">20.3. Accessing Monitoring Information</A></H2> +<P>As previously discussed, when enabled, the <EM>monitor</EM> backend dynamically generates and returns objects in response to search requests in the <EM>cn=Monitor</EM> subtree. Each object contains information about a particular aspect of the server. The information is held in a combination of user applications and operational attributes. This information can be accessed with <EM>ldapsearch(1)</EM>, with any general-purpose LDAP browser, or with specialized monitoring tools.</P> +<P>This section provides a provides a brief tutorial on how to use <EM>ldapsearch</EM>(1) to access monitoring information.</P> +<P>To inspect any particular monitor object, one performs search operation on the object with a baseObject scope and a <TT>(objectClass=*)</TT> filter. As the monitoring information is contained in a combination of user applications and operational attributes, the return all user applications attributes (e.g., <TT>'*'</TT>) and all operational attributes (e.g., <TT>'+'</TT>) should be requested. For instance, to read the <TT>cn=Monitor</TT> object itself, the <EM>ldapsearch</EM>(1) command (modified to fit your configuration) can be used:</P> +<PRE> + ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -W \ + -b 'cn=Monitor' -s base '(objectClass=*)' '*' '+' +</PRE> +<P>When run against your server, this should produce output similar to:</P> +<PRE> + dn: cn=Monitor + objectClass: monitorServer + structuralObjectClass: monitorServer + cn: Monitor + creatorsName: + modifiersName: + createTimestamp: 20061208223558Z + modifyTimestamp: 20061208223558Z + description: This subtree contains monitoring/managing objects. + description: This object contains information about this server. + description: Most of the information is held in operational attributes, which + must be explicitly requested. + monitoredInfo: OpenLDAP: slapd 2.4 (Dec 7 2006 17:30:29) + entryDN: cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: TRUE +</PRE> +<P>To reduce the number of uninteresting attributes returned, one can be more selective when requesting which attributes are to be returned. For instance, one could request the return of all attributes allowed by the <EM>monitorServer</EM> object class (e.g., <TT>@objectClass</TT>) instead of all user and all operational attributes:</P> +<PRE> + ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -W \ + -b 'cn=Monitor' -s base '(objectClass=*)' '@monitorServer' +</PRE> +<P>This limits the output as follows:</P> +<PRE> + dn: cn=Monitor + objectClass: monitorServer + cn: Monitor + description: This subtree contains monitoring/managing objects. + description: This object contains information about this server. + description: Most of the information is held in operational attributes, which + must be explicitly requested. + monitoredInfo: OpenLDAP: slapd 2.X (Dec 7 2006 17:30:29) +</PRE> +<P>To return the names of all the monitoring objects, one performs a search of <TT>cn=Monitor</TT> with subtree scope and <TT>(objectClass=*)</TT> filter and requesting no attributes (e.g., <TT>1.1</TT>) be returned.</P> +<PRE> + ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -W -b 'cn=Monitor' -s sub 1.1 +</PRE> +<P>If you run this command you will discover that there are many objects in the <EM>cn=Monitor</EM> subtree. The following section describes some of the commonly available monitoring objects.</P> +<H2><A NAME="Monitor Information">20.4. Monitor Information</A></H2> +<P>The <EM>monitor</EM> backend provides a wealth of information useful for monitoring the slapd(8) contained in set of monitor objects. Each object contains information about a particular aspect of the server, such as a backends, a connection, or a thread. Some objects serve as containers for other objects and used to construct a hierarchy of objects.</P> +<P>In this hierarchy, the most superior object is {cn=Monitor}. While this object primarily serves as a container for other objects, most of which are containers, this object provides information about this server. In particular, it provides the slapd(8) version string. Example:</P> +<PRE> + dn: cn=Monitor + monitoredInfo: OpenLDAP: slapd 2.X (Dec 7 2006 17:30:29) +</PRE> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Examples in this section (and its subsections) have been trimmed to show only key information. +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="Backends">20.4.1. Backends</A></H3> +<P>The <TT>cn=Backends,cn=Monitor</TT> object, itself, provides a list of available backends. The list of available backends all builtin backends, as well as backends loaded by modules. For example:</P> +<PRE> + dn: cn=Backends,cn=Monitor + monitoredInfo: config + monitoredInfo: ldif + monitoredInfo: monitor + monitoredInfo: bdb + monitoredInfo: hdb +</PRE> +<P>This indicates the <EM>config</EM>, <EM>ldif</EM>, <EM>monitor</EM>, <EM>bdb</EM>, and <EM>hdb</EM> backends are available.</P> +<P>The <TT>cn=Backends,cn=Monitor</TT> object is also a container for available backend objects. Each available backend object contains information about a particular backend. For example:</P> +<PRE> + dn: cn=Backend 0,cn=Backends,cn=Monitor + monitoredInfo: config + monitorRuntimeConfig: TRUE + supportedControl: 2.16.840.1.113730.3.4.2 + seeAlso: cn=Database 0,cn=Databases,cn=Monitor + + dn: cn=Backend 1,cn=Backends,cn=Monitor + monitoredInfo: ldif + monitorRuntimeConfig: TRUE + supportedControl: 2.16.840.1.113730.3.4.2 + + dn: cn=Backend 2,cn=Backends,cn=Monitor + monitoredInfo: monitor + monitorRuntimeConfig: TRUE + supportedControl: 2.16.840.1.113730.3.4.2 + seeAlso: cn=Database 2,cn=Databases,cn=Monitor + + dn: cn=Backend 3,cn=Backends,cn=Monitor + monitoredInfo: bdb + monitorRuntimeConfig: TRUE + supportedControl: 1.3.6.1.1.12 + supportedControl: 2.16.840.1.113730.3.4.2 + supportedControl: 1.3.6.1.4.1.4203.666.5.2 + supportedControl: 1.2.840.113556.1.4.319 + supportedControl: 1.3.6.1.1.13.1 + supportedControl: 1.3.6.1.1.13.2 + supportedControl: 1.3.6.1.4.1.4203.1.10.1 + supportedControl: 1.2.840.113556.1.4.1413 + supportedControl: 1.3.6.1.4.1.4203.666.11.7.2 + seeAlso: cn=Database 1,cn=Databases,cn=Monitor + + dn: cn=Backend 4,cn=Backends,cn=Monitor + monitoredInfo: hdb + monitorRuntimeConfig: TRUE + supportedControl: 1.3.6.1.1.12 + supportedControl: 2.16.840.1.113730.3.4.2 + supportedControl: 1.3.6.1.4.1.4203.666.5.2 + supportedControl: 1.2.840.113556.1.4.319 + supportedControl: 1.3.6.1.1.13.1 + supportedControl: 1.3.6.1.1.13.2 + supportedControl: 1.3.6.1.4.1.4203.1.10.1 + supportedControl: 1.2.840.113556.1.4.1413 + supportedControl: 1.3.6.1.4.1.4203.666.11.7.2 +</PRE> +<P>For each of these objects, monitorInfo indicates which backend the information in the object is about. For instance, the <TT>cn=Backend 3,cn=Backends,cn=Monitor</TT> object contains (in the example) information about the <EM>bdb</EM> backend.</P> +<TABLE CLASS="columns" BORDER> +<TR CLASS="heading"> +<TD> +<STRONG>Attribute</STRONG> +</TD> +<TD> +<STRONG>Description</STRONG> +</TD> +</TR> +<TR> +<TD> +monitoredInfo +</TD> +<TD> +Name of backend +</TD> +</TR> +<TR> +<TD> +supportedControl +</TD> +<TD> +supported LDAP control extensions +</TD> +</TR> +<TR> +<TD> +seeAlso +</TD> +<TD> +Database objects of instances of this backend +</TD> +</TR> +</TABLE> + +<H3><A NAME="Connections">20.4.2. Connections</A></H3> +<P>The main entry is empty; it should contain some statistics on the number of connections.</P> +<P>Dynamic child entries are created for each open connection, with stats on the activity on that connection (the format will be detailed later). There are two special child entries that show the number of total and current connections respectively.</P> +<P>For example:</P> +<P>Total Connections:</P> +<PRE> + dn: cn=Total,cn=Connections,cn=Monitor + structuralObjectClass: monitorCounterObject + monitorCounter: 4 + entryDN: cn=Total,cn=Connections,cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: FALSE +</PRE> +<P>Current Connections:</P> +<PRE> + dn: cn=Current,cn=Connections,cn=Monitor + structuralObjectClass: monitorCounterObject + monitorCounter: 2 + entryDN: cn=Current,cn=Connections,cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: FALSE +</PRE> +<H3><A NAME="Databases">20.4.3. Databases</A></H3> +<P>The main entry contains the naming context of each configured database; the child entries contain, for each database, the type and the naming context.</P> +<P>For example:</P> +<PRE> + dn: cn=Database 2,cn=Databases,cn=Monitor + structuralObjectClass: monitoredObject + monitoredInfo: monitor + monitorIsShadow: FALSE + monitorContext: cn=Monitor + readOnly: FALSE + entryDN: cn=Database 2,cn=Databases,cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: FALSE +</PRE> +<H3><A NAME="Listener">20.4.4. Listener</A></H3> +<P>It contains the description of the devices the server is currently listening on:</P> +<PRE> + dn: cn=Listener 0,cn=Listeners,cn=Monitor + structuralObjectClass: monitoredObject + monitorConnectionLocalAddress: IP=0.0.0.0:389 + entryDN: cn=Listener 0,cn=Listeners,cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: FALSE +</PRE> +<H3><A NAME="Log">20.4.5. Log</A></H3> +<P>It contains the currently active log items. The <EM>Log</EM> subsystem allows user modify operations on the <EM>description</EM> attribute, whose values <EM>MUST</EM> be in the list of admittable log switches:</P> +<PRE> + Trace + Packets + Args + Conns + BER + Filter + Config + ACL + Stats + Stats2 + Shell + Parse + Sync +</PRE> +<P>These values can be added, replaced or deleted; they affect what messages are sent to the syslog device. Custom values could be added by custom modules.</P> +<H3><A NAME="Operations">20.4.6. Operations</A></H3> +<P>It shows some statistics on the operations performed by the server:</P> +<PRE> + Initiated + Completed +</PRE> +<P>and for each operation type, i.e.:</P> +<PRE> + Bind + Unbind + Add + Delete + Modrdn + Modify + Compare + Search + Abandon + Extended +</PRE> +<P>There are too many types to list example here, so please try for yourself using <A HREF="#Monitor search example">Monitor search example</A></P> +<H3><A NAME="Overlays">20.4.7. Overlays</A></H3> +<P>The main entry contains the type of overlays available at run-time; the child entries, for each overlay, contain the type of the overlay.</P> +<P>It should also contain the modules that have been loaded if dynamic overlays are enabled:</P> +<PRE> + # Overlays, Monitor + dn: cn=Overlays,cn=Monitor + structuralObjectClass: monitorContainer + monitoredInfo: syncprov + monitoredInfo: accesslog + monitoredInfo: glue + entryDN: cn=Overlays,cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: TRUE +</PRE> +<H3><A NAME="SASL">20.4.8. SASL</A></H3> +<P>Currently empty.</P> +<H3><A NAME="Statistics">20.4.9. Statistics</A></H3> +<P>It shows some statistics on the data sent by the server:</P> +<PRE> + Bytes + PDU + Entries + Referrals +</PRE> +<P>e.g.</P> +<PRE> + # Entries, Statistics, Monitor + dn: cn=Entries,cn=Statistics,cn=Monitor + structuralObjectClass: monitorCounterObject + monitorCounter: 612248 + entryDN: cn=Entries,cn=Statistics,cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: FALSE +</PRE> +<H3><A NAME="Threads">20.4.10. Threads</A></H3> +<P>It contains the maximum number of threads enabled at startup and the current backload.</P> +<P>e.g.</P> +<PRE> + # Max, Threads, Monitor + dn: cn=Max,cn=Threads,cn=Monitor + structuralObjectClass: monitoredObject + monitoredInfo: 16 + entryDN: cn=Max,cn=Threads,cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: FALSE +</PRE> +<H3><A NAME="Time">20.4.11. Time</A></H3> +<P>It contains two child entries with the start time and the current time of the server.</P> +<P>e.g.</P> +<P>Start time:</P> +<PRE> + dn: cn=Start,cn=Time,cn=Monitor + structuralObjectClass: monitoredObject + monitorTimestamp: 20061205124040Z + entryDN: cn=Start,cn=Time,cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: FALSE +</PRE> +<P>Current time:</P> +<PRE> + dn: cn=Current,cn=Time,cn=Monitor + structuralObjectClass: monitoredObject + monitorTimestamp: 20061207120624Z + entryDN: cn=Current,cn=Time,cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: FALSE +</PRE> +<H3><A NAME="TLS">20.4.12. TLS</A></H3> +<P>Currently empty.</P> +<H3><A NAME="Waiters">20.4.13. Waiters</A></H3> +<P>It contains the number of current read waiters.</P> +<P>e.g.</P> +<P>Read waiters:</P> +<PRE> + dn: cn=Read,cn=Waiters,cn=Monitor + structuralObjectClass: monitorCounterObject + monitorCounter: 7 + entryDN: cn=Read,cn=Waiters,cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: FALSE +</PRE> +<P>Write waiters:</P> +<PRE> + dn: cn=Write,cn=Waiters,cn=Monitor + structuralObjectClass: monitorCounterObject + monitorCounter: 0 + entryDN: cn=Write,cn=Waiters,cn=Monitor + subschemaSubentry: cn=Subschema + hasSubordinates: FALSE +</PRE> +<P>Add new monitored things here and discuss, referencing man pages and present examples</P> +<P></P> +<HR> +<H1><A NAME="Tuning">21. Tuning</A></H1> +<P>This is perhaps one of the most important chapters in the guide, because if you have not tuned <EM>slapd</EM>(8) correctly or grasped how to design your directory and environment, you can expect very poor performance.</P> +<P>Reading, understanding and experimenting using the instructions and information in the following sections, will enable you to fully understand how to tailor your directory server to your specific requirements.</P> +<P>It should be noted that the following information has been collected over time from our community based FAQ. So obviously the benefit of this real world experience and advice should be of great value to the reader.</P> +<H2><A NAME="Performance Factors">21.1. Performance Factors</A></H2> +<P>Various factors can play a part in how your directory performs on your chosen hardware and environment. We will attempt to discuss these here.</P> +<H3><A NAME="Memory">21.1.1. Memory</A></H3> +<P>Scale your cache to use available memory and increase system memory if you can.</P> +<P>See <A HREF="#Caching">Caching</A> for BDB cache tuning hints. Note that LMDB uses no cache of its own and has no tuning options, so the Caching section can be ignored when using LMDB.</P> +<H3><A NAME="Disks">21.1.2. Disks</A></H3> +<P>Use fast filesystems, and conduct your own testing to see which filesystem types perform best with your workload. (On our own Linux testing, EXT2 and JFS tend to provide better write performance than everything else, including newer filesystems like EXT4, BTRFS, etc.)</P> +<P>Use fast subsystems. Put each database and logs on separate disks (for BDB this is configurable via <EM>DB_CONFIG</EM>):</P> +<PRE> + # Data Directory + set_data_dir /data/db + + # Transaction Log settings + set_lg_dir /logs +</PRE> +<H3><A NAME="Network Topology">21.1.3. Network Topology</A></H3> +<P>http://www.openldap.org/faq/data/cache/363.html</P> +<P>Drawing here.</P> +<H3><A NAME="Directory Layout Design">21.1.4. Directory Layout Design</A></H3> +<P>Reference to other sections and good/bad drawing here.</P> +<H3><A NAME="Expected Usage">21.1.5. Expected Usage</A></H3> +<P>Discussion.</P> +<H2><A NAME="Indexes">21.2. Indexes</A></H2> +<H3><A NAME="Understanding how a search works">21.2.1. Understanding how a search works</A></H3> +<P>If you're searching on a filter that has been indexed, then the search reads the index and pulls exactly the entries that are referenced by the index. If the filter term has not been indexed, then the search must read every single entry in the target scope and test to see if each entry matches the filter. Obviously indexing can save a lot of work when it's used correctly.</P> +<H3><A NAME="What to index">21.2.2. What to index</A></H3> +<P>You should create indices to match the actual filter terms used in search queries.</P> +<PRE> + index cn,sn,givenname,mail eq +</PRE> +<P>Each attribute index can be tuned further by selecting the set of index types to generate. For example, substring and approximate search for organizations (o) may make little sense (and isn't like done very often). And searching for <EM>userPassword</EM> likely makes no sense what so ever.</P> +<P>General rule: don't go overboard with indexes. Unused indexes must be maintained and hence can only slow things down.</P> +<P>See <EM>slapd.conf</EM>(8) and <EM>slapdindex</EM>(8) for more information</P> +<H3><A NAME="Presence indexing">21.2.3. Presence indexing</A></H3> +<P>If your client application uses presence filters and if the target attribute exists on the majority of entries in your target scope, then all of those entries are going to be read anyway, because they are valid members of the result set. In a subtree where 100% of the entries are going to contain the same attributes, the presence index does absolutely NOTHING to benefit the search, because 100% of the entries match that presence filter.</P> +<P>So the resource cost of generating the index is a complete waste of CPU time, disk, and memory. Don't do it unless you know that it will be used, and that the attribute in question occurs very infrequently in the target data.</P> +<P>Almost no applications use presence filters in their search queries. Presence indexing is pointless when the target attribute exists on the majority of entries in the database. In most LDAP deployments, presence indexing should not be done, it's just wasted overhead.</P> +<P>See the <EM>Logging</EM> section below on what to watch out for if you have a frequently searched for attribute that is unindexed.</P> +<H2><A NAME="Logging">21.3. Logging</A></H2> +<H3><A NAME="What log level to use">21.3.1. What log level to use</A></H3> +<P>The default of <EM>loglevel stats</EM> (256) is really the best bet. There's a corollary to this when problems *do* arise, don't try to trace them using syslog. Use the debug flag instead, and capture slapd's stderr output. syslog is too slow for debug tracing, and it's inherently lossy - it will throw away messages when it can't keep up.</P> +<P>Contrary to popular belief, <EM>loglevel 0</EM> is not ideal for production as you won't be able to track when problems first arise.</P> +<H3><A NAME="What to watch out for">21.3.2. What to watch out for</A></H3> +<P>The most common message you'll see that you should pay attention to is:</P> +<PRE> + "<= bdb_equality_candidates: (foo) index_param failed (18)" +</PRE> +<P>That means that some application tried to use an equality filter (<EM>foo=<somevalue></EM>) and attribute <EM>foo</EM> does not have an equality index. If you see a lot of these messages, you should add the index. If you see one every month or so, it may be acceptable to ignore it.</P> +<P>The default syslog level is stats (256) which logs the basic parameters of each request; it usually produces 1-3 lines of output. On Solaris and systems that only provide synchronous syslog, you may want to turn it off completely, but usually you want to leave it enabled so that you'll be able to see index messages whenever they arise. On Linux you can configure syslogd to run asynchronously, in which case the performance hit for moderate syslog traffic pretty much disappears.</P> +<H3><A NAME="Improving throughput">21.3.3. Improving throughput</A></H3> +<P>You can improve logging performance on some systems by configuring syslog not to sync the file system with every write (<EM>man syslogd/syslog.conf</EM>). In Linux, you can prepend the log file name with a "-" in <EM>syslog.conf</EM>. For example, if you are using the default LOCAL4 logging you could try:</P> +<PRE> + # LDAP logs + LOCAL4.* -/var/log/ldap +</PRE> +<P>For syslog-ng, add or modify the following line in <EM>syslog-ng.conf</EM>:</P> +<PRE> + options { sync(n); }; +</PRE> +<P>where n is the number of lines which will be buffered before a write.</P> +<H2><A NAME="Caching">21.4. Caching</A></H2> +<P>We all know what caching is, don't we?</P> +<P>In brief, "A cache is a block of memory for temporary storage of data likely to be used again" - <A HREF="http://en.wikipedia.org/wiki/Cache">http://en.wikipedia.org/wiki/Cache</A></P> +<P>There are 3 types of caches, BerkeleyDB's own cache, <EM>slapd</EM>(8) entry cache and <TERM>IDL</TERM> (IDL) cache.</P> +<H3><A NAME="Berkeley DB Cache">21.4.1. Berkeley DB Cache</A></H3> +<P>There are two ways to tune for the BDB cachesize:</P> +<P>(a) BDB cache size necessary to load the database via slapadd in optimal time</P> +<P>(b) BDB cache size necessary to have a high performing running slapd once the data is loaded</P> +<P>For (a), the optimal cachesize is the size of the entire database. If you already have the database loaded, this is simply a</P> +<PRE> + du -c -h *.bdb +</PRE> +<P>in the directory containing the OpenLDAP (<EM>/usr/local/var/openldap-data</EM>) data.</P> +<P>For (b), the optimal cachesize is just the size of the <EM>id2entry.bdb</EM> file, plus about 10% for growth.</P> +<P>The tuning of <EM>DB_CONFIG</EM> should be done for each BDB type database instantiated (back-bdb, back-hdb).</P> +<P>Note that while the <TERM>BDB</TERM> cache is just raw chunks of memory and configured as a memory size, the <EM>slapd</EM>(8) entry cache holds parsed entries, and the size of each entry is variable.</P> +<P>There is also an IDL cache which is used for Index Data Lookups. If you can fit all of your database into slapd's entry cache, and all of your index lookups fit in the IDL cache, that will provide the maximum throughput.</P> +<P>If not, but you can fit the entire database into the BDB cache, then you should do that and shrink the slapd entry cache as appropriate.</P> +<P>Failing that, you should balance the BDB cache against the entry cache.</P> +<P>It is worth noting that it is not absolutely necessary to configure a BerkeleyDB cache equal in size to your entire database. All that you need is a cache that's large enough for your "working set."</P> +<P>That means, large enough to hold all of the most frequently accessed data, plus a few less-frequently accessed items.</P> +<P>For more information, please see: <A HREF="http://www.oracle.com/technology/documentation/berkeley-db/db/ref/am_conf/cachesize.html">http://www.oracle.com/technology/documentation/berkeley-db/db/ref/am_conf/cachesize.html</A></P> +<H4><A NAME="Calculating Cachesize">21.4.1.1. Calculating Cachesize</A></H4> +<P>The back-bdb database lives in two main files, <TT>dn2id.bdb</TT> and <TT>id2entry.bdb</TT>. These are B-tree databases. We have never documented the back-bdb internal layout before, because it didn't seem like something anyone should have to worry about, nor was it necessarily cast in stone. But here's how it works today, in OpenLDAP 2.4.</P> +<P>A B-tree is a balanced tree; it stores data in its leaf nodes and bookkeeping data in its interior nodes (If you don't know what tree data structures look like in general, Google for some references, because that's getting far too elementary for the purposes of this discussion).</P> +<P>For decent performance, you need enough cache memory to contain all the nodes along the path from the root of the tree down to the particular data item you're accessing. That's enough cache for a single search. For the general case, you want enough cache to contain all the internal nodes in the database.</P> +<PRE> + db_stat -d +</PRE> +<P>will tell you how many internal pages are present in a database. You should check this number for both dn2id and id2entry.</P> +<P>Also note that <EM>id2entry</EM> always uses 16KB per "page", while <EM>dn2id</EM> uses whatever the underlying filesystem uses, typically 4 or 8KB. To avoid thrashing, your cache must be at least as large as the number of internal pages in both the <EM>dn2id</EM> and <EM>id2entry</EM> databases, plus some extra space to accommodate the actual leaf data pages.</P> +<P>For example, in my OpenLDAP 2.4 test database, I have an input LDIF file that's about 360MB. With the back-hdb backend this creates a <EM>dn2id.bdb</EM> that's 68MB, and an <EM>id2entry</EM> that's 800MB. db_stat tells me that <EM>dn2id</EM> uses 4KB pages, has 433 internal pages, and 6378 leaf pages. The id2entry uses 16KB pages, has 52 internal pages, and 45912 leaf pages. In order to efficiently retrieve any single entry in this database, the cache should be at least</P> +<PRE> + (433+1) * 4KB + (52+1) * 16KB in size: 1736KB + 848KB =~ 2.5MB. +</PRE> +<P>This doesn't take into account other library overhead, so this is even lower than the barest minimum. The default cache size, when nothing is configured, is only 256KB.</P> +<P>This 2.5MB number also doesn't take indexing into account. Each indexed attribute results in another database file. Earlier versions of OpenLDAP kept these index databases in Hash format, but from OpenLDAP 2.2 onward the index databases are in B-tree format so the same procedure can be used to calculate the necessary amount of cache for each index database.</P> +<P>For example, if your only index is for the objectClass attribute and db_stat reveals that <EM>objectClass.bdb</EM> has 339 internal pages and uses 4096 byte pages, the additional cache needed for just this attribute index is</P> +<PRE> + (339+1) * 4KB =~ 1.3MB. +</PRE> +<P>With only this index enabled, I'd figure at least a 4MB cache for this backend. (Of course you're using a single cache shared among all of the database files, so the cache pages will most likely get used for something other than what you accounted for, but this gives you a fighting chance.)</P> +<P>With this 4MB cache I can slapcat this entire database on my 1.3GHz PIII in 1 minute, 40 seconds. With the cache doubled to 8MB, it still takes the same 1:40s. Once you've got enough cache to fit the B-tree internal pages, increasing it further won't have any effect until the cache really is large enough to hold 100% of the data pages. I don't have enough free RAM to hold all the 800MB id2entry data, so 4MB is good enough.</P> +<P>With back-bdb and back-hdb you can use "db_stat -m" to check how well the database cache is performing.</P> +<P>For more information on <EM>db_stat</EM>: <A HREF="http://www.oracle.com/technology/documentation/berkeley-db/db/utility/db_stat.html">http://www.oracle.com/technology/documentation/berkeley-db/db/utility/db_stat.html</A></P> +<H3><A NAME="{{slapd}}(8) Entry Cache (cachesize)">21.4.2. <EM>slapd</EM>(8) Entry Cache (cachesize)</A></H3> +<P>The <EM>slapd</EM>(8) entry cache operates on decoded entries. The rationale - entries in the entry cache can be used directly, giving the fastest response. If an entry isn't in the entry cache but can be extracted from the BDB page cache, that will avoid an I/O but it will still require parsing, so this will be slower.</P> +<P>If the entry is in neither cache then BDB will have to flush some of its current cached pages and bring in the needed pages, resulting in a couple of expensive I/Os as well as parsing.</P> +<P>The most optimal value is of course, the entire number of entries in the database. However, most directory servers don't consistently serve out their entire database, so setting this to a lesser number that more closely matches the believed working set of data is sufficient. This is the second most important parameter for the DB.</P> +<P>As far as balancing the entry cache vs the BDB cache - parsed entries in memory are generally about twice as large as they are on disk.</P> +<P>As we have already mentioned, not having a proper database cache size will cause performance issues. These issues are not an indication of corruption occurring in the database. It is merely the fact that the cache is thrashing itself that causes performance/response time to slowdown.</P> +<H3><A NAME="{{TERM:IDL}} Cache (idlcachesize)">21.4.3. <TERM>IDL</TERM> Cache (idlcachesize)</A></H3> +<P>Each IDL holds the search results from a given query, so the IDL cache will end up holding the most frequently requested search results. For back-bdb, it is generally recommended to match the "cachesize" setting. For back-hdb, it is generally recommended to be 3x"cachesize".</P> +<P>{NOTE: The idlcachesize setting directly affects search performance}</P> +<H2><A NAME="{{slapd}}(8) Threads">21.5. <EM>slapd</EM>(8) Threads</A></H2> +<P><EM>slapd</EM>(8) can process requests via a configurable number of threads, which in turn affects the in/out rate of connections.</P> +<P>This value should generally be a function of the number of "real" cores on the system, for example on a server with 2 CPUs with one core each, set this to 8, or 4 threads per real core. This is a "read" maximized value. The more threads that are configured per core, the slower <EM>slapd</EM>(8) responds for "read" operations. On the flip side, it appears to handle write operations faster in a heavy write/low read scenario.</P> +<P>The upper bound for good read performance appears to be 16 threads (which also happens to be the default setting).</P> +<P></P> +<HR> +<H1><A NAME="Troubleshooting">22. Troubleshooting</A></H1> +<P>If you're having trouble using OpenLDAP, get onto the OpenLDAP-Software mailing list, or:</P> +<UL> +<LI>Browse the list archives at <A HREF="http://www.openldap.org/lists/#archives">http://www.openldap.org/lists/#archives</A> +<LI>Search the FAQ at <A HREF="http://www.openldap.org/faq/">http://www.openldap.org/faq/</A> +<LI>Search the Issue Tracking System at <A HREF="http://www.openldap.org/its/">http://www.openldap.org/its/</A></UL> +<P>Chances are the problem has been solved and explained in detail many times before.</P> +<H2><A NAME="User or Software errors">22.1. User or Software errors?</A></H2> +<P>More often than not, an error is caused by a configuration problem or a misunderstanding of what you are trying to implement and/or achieve.</P> +<P>We will now attempt to discuss common user errors.</P> +<H2><A NAME="Checklist">22.2. Checklist</A></H2> +<P>The following checklist can help track down your problem. Please try to use if <B>before</B> posting to the list, or in the rare circumstances of reporting a bug.</P> +<UL> + </UL><OL> +<LI><B>Use the <EM>slaptest</EM> tool to verify configurations before starting <EM>slapd</EM></B> +<BR> + +<LI><B>Verify that <EM>slapd</EM> is listening to the specified port(s) (389 and 636, generally) before trying the <EM>ldapsearch</EM></B> +<BR> + +<LI><B>Can you issue an <EM>ldapsearch</EM>?</B> +<BR> + +<LI><B>If not, have you enabled complex ACLs without fully understanding them?</B> +<BR> + +<LI><B>Do you have a system wide LDAP setting pointing to the wrong LDAP Directory?</B> +<BR> + +<LI><B>Are you using TLS?</B> +<BR> + +<LI><B>Have your certificates expired?</B></OL> +<H2><A NAME="OpenLDAP Bugs">22.3. OpenLDAP Bugs</A></H2> +<P>Sometimes you may encounter an actual OpenLDAP bug, in which case please visit our Issue Tracking system <A HREF="http://www.openldap.org/its/">http://www.openldap.org/its/</A> and report it. However, make sure it's not already a known bug or a common user problem.</P> +<UL> +<LI>bugs in historic versions of OpenLDAP will not be considered; +<LI>bugs in released versions that are no longer present in the Git master branch, either because they have been fixed or because they no longer apply, will not be considered as well; +<LI>bugs in distributions of OpenLDAP software that are not related to the software as provided by OpenLDAP will not be considered; in those cases please refer to the distributor.</UL> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>Our Issue Tracking system is <B>NOT</B> for OpenLDAP <B>Support</B>, please join our mailing Lists: <A HREF="http://www.openldap.org/lists/">http://www.openldap.org/lists/</A> for that. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>The information you should provide in your bug report is discussed in our FAQ-O-MATIC at <A HREF="http://www.openldap.org/faq/data/cache/59.html">http://www.openldap.org/faq/data/cache/59.html</A></P> +<H2><A NAME="3rd party software error">22.4. 3rd party software error</A></H2> +<P>The OpenLDAP Project only supports OpenLDAP software.</P> +<P>You may however seek commercial support (<A HREF="http://www.openldap.org/support/">http://www.openldap.org/support/</A>) or join the general LDAP forum for non-commercial discussions and information relating to LDAP at: <A HREF="http://www.umich.edu/~dirsvcs/ldap/mailinglist.html">http://www.umich.edu/~dirsvcs/ldap/mailinglist.html</A></P> +<H2><A NAME="How to contact the OpenLDAP Project">22.5. How to contact the OpenLDAP Project</A></H2> +<UL> +<LI>Mailing Lists: <A HREF="http://www.openldap.org/lists/">http://www.openldap.org/lists/</A> +<LI>Project: <A HREF="http://www.openldap.org/project/">http://www.openldap.org/project/</A> +<LI>Issue Tracking: <A HREF="http://www.openldap.org/its/">http://www.openldap.org/its/</A></UL> +<H2><A NAME="How to present your problem">22.6. How to present your problem</A></H2> +<H2><A NAME="Debugging {{slapd}}(8)">22.7. Debugging <EM>slapd</EM>(8)</A></H2> +<P>After reading through the above sections and before e-mailing the OpenLDAP lists, you might want to try out some of the following to track down the cause of your problems:</P> +<UL> +<LI>Loglevel stats (256) is generally a good first loglevel to try for getting information useful to list members on issues +<LI>Running <EM>slapd -d -1</EM> can often track down fairly simple issues, such as missing schemas and incorrect file permissions for the <EM>slapd</EM> user to things like certs +<LI>Check your logs for errors, as discussed at <A HREF="http://www.openldap.org/faq/data/cache/358.html">http://www.openldap.org/faq/data/cache/358.html</A></UL> +<H2><A NAME="Commercial Support">22.8. Commercial Support</A></H2> +<P>The firms listed at <A HREF="http://www.openldap.org/support/">http://www.openldap.org/support/</A> offer technical support services catering to OpenLDAP community.</P> +<P>The listing of any given firm should not be viewed as an endorsement or recommendation of any kind, nor as otherwise indicating there exists a business relationship or an affiliation between any listed firm and the OpenLDAP Foundation or the OpenLDAP Project or its contributors.</P> +<P></P> +<HR> +<H1><A NAME="Changes Since Previous Release">A. Changes Since Previous Release</A></H1> +<P>The following sections attempt to summarize the new features and changes in OpenLDAP software since the 2.3.x release and the OpenLDAP Admin Guide.</P> +<H2><A NAME="New Guide Sections">A.1. New Guide Sections</A></H2> +<P>In order to make the Admin Guide more thorough and cover the majority of questions asked on the OpenLDAP mailing lists and scenarios discussed there, we have added the following new sections:</P> +<UL> +<LI><A HREF="#When should I use LDAP">When should I use LDAP?</A> +<LI><A HREF="#When should I not use LDAP">When should I not use LDAP?</A> +<LI><A HREF="#LDAP vs RDBMS">LDAP vs RDBMS</A> +<LI><A HREF="#Access Control">Access Control</A> +<LI><A HREF="#Backends">Backends</A> +<LI><A HREF="#Overlays">Overlays</A> +<LI><A HREF="#Replication">Replication</A> +<LI><A HREF="#Maintenance">Maintenance</A> +<LI><A HREF="#Monitoring">Monitoring</A> +<LI><A HREF="#Tuning">Tuning</A> +<LI><A HREF="#Troubleshooting">Troubleshooting</A> +<LI><A HREF="#Changes Since Previous Release">Changes Since Previous Release</A> +<LI><A HREF="#Upgrading from 2.3.x">Upgrading from 2.3.x</A> +<LI><A HREF="#Common errors encountered when using OpenLDAP Software">Common errors encountered when using OpenLDAP Software</A> +<LI><A HREF="#Recommended OpenLDAP Software Dependency Versions">Recommended OpenLDAP Software Dependency Versions</A> +<LI><A HREF="#Real World OpenLDAP Deployments and Examples">Real World OpenLDAP Deployments and Examples</A> +<LI><A HREF="#OpenLDAP Software Contributions">OpenLDAP Software Contributions</A> +<LI><A HREF="#Configuration File Examples">Configuration File Examples</A> +<LI><A HREF="#LDAP Result Codes">LDAP Result Codes</A> +<LI><A HREF="#Glossary">Glossary</A></UL> +<P>Also, the table of contents is now 3 levels deep to ease navigation.</P> +<H2><A NAME="New Features and Enhancements in 2.4">A.2. New Features and Enhancements in 2.4</A></H2> +<H3><A NAME="Better {{B:cn=config}} functionality">A.2.1. Better <B>cn=config</B> functionality</A></H3> +<P>There is a new slapd-config(5) manpage for the <B>cn=config</B> backend. The original design called for auto-renaming of config entries when you insert or delete entries with ordered names, but that was not implemented in 2.3. It is now in 2.4. This means, e.g., if you have</P> +<PRE> + olcDatabase={1}mdb,cn=config + olcSuffix: dc=example,dc=com +</PRE> +<P>and you want to add a new subordinate, now you can ldapadd:</P> +<PRE> + olcDatabase={1}mdb,cn=config + olcSuffix: dc=foo,dc=example,dc=com +</PRE> +<P>This will insert a new back-mdb database in slot 1 and bump all following databases down one, so the original back-mdb database will now be named:</P> +<PRE> + olcDatabase={2}mdb,cn=config + olcSuffix: dc=example,dc=com +</PRE> +<H3><A NAME="Better {{B:cn=schema}} functionality">A.2.2. Better <B>cn=schema</B> functionality</A></H3> +<P>In 2.3 you were only able to add new schema elements, not delete or modify existing elements. In 2.4 you can modify schema at will. (Except for the hardcoded system schema, of course.)</P> +<H3><A NAME="More sophisticated Syncrepl configurations">A.2.3. More sophisticated Syncrepl configurations</A></H3> +<P>The original implementation of Syncrepl in OpenLDAP 2.2 was intended to support multiple consumers within the same database, but that feature never worked and was removed from OpenLDAP 2.3; you could only configure a single consumer in any database.</P> +<P>In 2.4 you can configure multiple consumers in a single database. The configuration possibilities here are quite complex and numerous. You can configure consumers over arbitrary subtrees of a database (disjoint or overlapping). Any portion of the database may in turn be provided to other consumers using the Syncprov overlay. The Syncprov overlay works with any number of consumers over a single database or over arbitrarily many glued databases.</P> +<H3><A NAME="N-Way Multimaster Replication">A.2.4. N-Way Multimaster Replication</A></H3> +<P>As a consequence of the work to support multiple consumer contexts, the syncrepl system now supports full N-Way multimaster replication with entry-level conflict resolution. There are some important constraints, of course: In order to maintain consistent results across all servers, you must maintain tightly synchronized clocks across all participating servers (e.g., you must use NTP on all servers).</P> +<P>The entryCSNs used for replication now record timestamps with microsecond resolution, instead of just seconds. The delta-syncrepl code has not been updated to support multimaster usage yet, that will come later in the 2.4 cycle.</P> +<H3><A NAME="Replicating {{slapd}} Configuration (syncrepl and {{B:cn=config}})">A.2.5. Replicating <EM>slapd</EM> Configuration (syncrepl and <B>cn=config</B>)</A></H3> +<P>Syncrepl was explicitly disabled on cn=config in 2.3. It is now fully supported in 2.4; you can use syncrepl to replicate an entire server configuration from one server to arbitrarily many other servers. It's possible to clone an entire running slapd using just a small (less than 10 lines) seed configuration, or you can just replicate the schema subtrees, etc. Tests 049 and 050 in the test suite provide working examples of these capabilities.</P> +<H3><A NAME="Push-Mode Replication">A.2.6. Push-Mode Replication</A></H3> +<P>In 2.3 you could configure syncrepl as a full push-mode replicator by using it in conjunction with a back-ldap pointed at the target server. But because the back-ldap database needs to have a suffix corresponding to the target's suffix, you could only configure one instance per slapd.</P> +<P>In 2.4 you can define a database to be "hidden", which means that its suffix is ignored when checking for name collisions, and the database will never be used to answer requests received by the frontend. Using this "hidden" database feature allows you to configure multiple databases with the same suffix, allowing you to set up multiple back-ldap instances for pushing replication of a single database to multiple targets. There may be other uses for hidden databases as well (e.g., using a syncrepl consumer to maintain a *local* mirror of a database on a separate filesystem).</P> +<H3><A NAME="More extensive TLS configuration control">A.2.7. More extensive TLS configuration control</A></H3> +<P>In 2.3, the TLS configuration in slapd was only used by the slapd listeners. For outbound connections used by e.g. back-ldap or syncrepl their TLS parameters came from the system's ldap.conf file.</P> +<P>In 2.4 all of these sessions inherit their settings from the main slapd configuration, but settings can be individually overridden on a per-config-item basis. This is particularly helpful if you use certificate-based authentication and need to use a different client certificate for different destinations.</P> +<H3><A NAME="Performance enhancements">A.2.8. Performance enhancements</A></H3> +<P>Too many to list. Some notable changes - ldapadd used to be a couple of orders of magnitude slower than "slapadd -q". It's now at worst only about half the speed of slapadd -q. Some comparisons of all the 2.x OpenLDAP releases are available at <A HREF="http://www.openldap.org/pub/hyc/scale2007.pdf">http://www.openldap.org/pub/hyc/scale2007.pdf</A></P> +<P>That compared 2.0.27, 2.1.30, 2.2.30, 2.3.33, and CVS HEAD). Toward the latter end of the "Cached Search Performance" chart it gets hard to see the difference because the run times are so small, but the new code is about 25% faster than 2.3, which was about 20% faster than 2.2, which was about 100% faster than 2.1, which was about 100% faster than 2.0, in that particular search scenario. That test basically searched a 1.3GB DB of 380836 entries (all in the slapd entry cache) in under 1 second. i.e., on a 2.4GHz CPU with DDR400 ECC/Registered RAM we can search over 500 thousand entries per second. The search was on an unindexed attribute using a filter that would not match any entry, forcing slapd to examine every entry in the DB, testing the filter for a match.</P> +<P>Essentially the slapd entry cache in back-bdb/back-hdb is so efficient the search processing time is almost invisible; the runtime is limited only by the memory bandwidth of the machine. (The search data rate corresponds to about 3.5GB/sec; the memory bandwidth on the machine is only about 4GB/sec due to ECC and register latency.)</P> +<H3><A NAME="New overlays">A.2.9. New overlays</A></H3> +<UL> +<LI>slapo-constraint (Attribute value constraints) +<LI>slapo-dds (Dynamic Directory Services, RFC 2589) +<LI>slapo-memberof (reverse group membership maintenance)</UL> +<H3><A NAME="New features in existing Overlays">A.2.10. New features in existing Overlays</A></H3> +<UL> +<LI>slapo-pcache<UL> +<LI>Inspection/Maintenance<UL> +<LI>the cache database can be directly accessed via LDAP by adding a specific control to each LDAP request; a specific extended operation allows to consistently remove cached entries and entire cached queries</UL> +<LI>Hot Restart<UL> +<LI>cached queries are saved on disk at shutdown, and reloaded if not expired yet at subsequent restart</UL></UL> +<LI>slapo-rwm can safely interoperate with other overlays +<LI>Dyngroup/Dynlist merge, plus security enhancements<UL> +<LI>added dgIdentity support (draft-haripriya-dynamicgroup)</UL></UL> +<H3><A NAME="New features in slapd">A.2.11. New features in slapd</A></H3> +<UL> +<LI>monitoring of back-{b,h}db: cache fill-in, non-indexed searches, +<LI>session tracking control (draft-wahl-ldap-session) +<LI>subtree delete in back-sql (draft-armijo-ldap-treedelete) +<LI>sorted values in multivalued attributes for faster matching +<LI>lightweight dispatcher for greater throughput under heavy load and on multiprocessor machines. (33% faster than 2.3 on AMD quad-socket dual-core server.)</UL> +<H3><A NAME="New features in libldap">A.2.12. New features in libldap</A></H3> +<UL> +<LI>ldap_sync client API (LDAP Content Sync Operation, RFC 4533)</UL> +<H3><A NAME="New clients, tools and tool enhancements">A.2.13. New clients, tools and tool enhancements</A></H3> +<UL> +<LI>ldapexop for arbitrary extended operations +<LI>Complete support of controls in request/response for all clients +<LI>LDAP Client tools now honor SRV records</UL> +<H3><A NAME="New build options">A.2.14. New build options</A></H3> +<UL> +<LI>Support for building against GnuTLS</UL> +<H2><A NAME="Obsolete Features Removed From 2.4">A.3. Obsolete Features Removed From 2.4</A></H2> +<P>These features were strongly deprecated in 2.3 and removed in 2.4.</P> +<H3><A NAME="Slurpd">A.3.1. Slurpd</A></H3> +<P>Please read the <A HREF="#Replication">Replication</A> section as to why this is no longer in OpenLDAP</P> +<H3><A NAME="back-ldbm">A.3.2. back-ldbm</A></H3> +<P>back-ldbm was both slow and unreliable. Its byzantine indexing code was prone to spontaneous corruption, as were the underlying database libraries that were commonly used (e.g. GDBM or NDBM). back-bdb and back-hdb are superior in every aspect, with simplified indexing to avoid index corruption, fine-grained locking for greater concurrency, hierarchical caching for greater performance, streamlined on-disk format for greater efficiency and portability, and full transaction support for greater reliability.</P> +<P></P> +<HR> +<H1><A NAME="Upgrading from 2.3.x">B. Upgrading from 2.3.x</A></H1> +<P>The following sections attempt to document the steps you will need to take in order to upgrade from the latest 2.3.x OpenLDAP version.</P> +<P>The normal upgrade procedure, as discussed in the <A HREF="#Maintenance">Maintenance</A> section, should of course still be followed prior to doing any of this.</P> +<H2><A NAME="{{B:cn=config}} olc* attributes">B.1. <B>cn=config</B> olc* attributes</A></H2> +<P>Quite a few <EM>olc*</EM> attributes have now become obsolete, if you see in your logs entries like below, just remove them from the relevant ldif file.</P> +<PRE> + olcReplicationInterval: value #0: <olcReplicationInterval> keyword is obsolete (ignored) +</PRE> +<H2><A NAME="ACLs: searches require privileges on the search base">B.2. ACLs: searches require privileges on the search base</A></H2> +<P>Search operations now require "search" privileges on the "entry" pseudo-attribute of the search base. While upgrading from 2.3.x, make sure your ACLs grant such privileges to all desired search bases.</P> +<P>For example, assuming you have the following ACL:</P> +<PRE> + access to dn.sub="ou=people,dc=example,dc=com" by * search +</PRE> +<P>Searches using a base of "dc=example,dc=com" will only be allowed if you add the following ACL:</P> +<PRE> + access to dn.base="dc=example,dc=com" attrs=entry by * search +</PRE> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>The <EM>slapd.access</EM>(5) man page states that this requirement was introduced with OpenLDAP 2.3. However, it is the default behavior only since 2.4. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>ADD MORE HERE</P> +<P></P> +<HR> +<H1><A NAME="Common errors encountered when using OpenLDAP Software">C. Common errors encountered when using OpenLDAP Software</A></H1> +<P>The following sections attempt to summarize the most common causes of LDAP errors when using OpenLDAP</P> +<H2><A NAME="Common causes of LDAP errors">C.1. Common causes of LDAP errors</A></H2> +<H3><A NAME="ldap_*: Can\'t contact LDAP server">C.1.1. ldap_*: Can't contact LDAP server</A></H3> +<P>The <B>Can't contact LDAP server</B> error is usually returned when the LDAP server cannot be contacted. This may occur for many reasons:</P> +<UL> +<LI>the LDAP server is not running; this can be checked by running, for example,</UL> +<PRE> + telnet <host> <port> +</PRE> +<P>replacing <EM><host></EM> and <EM><port></EM> with the hostname and the port the server is supposed to listen on.</P> +<UL> +<LI>the client has not been instructed to contact a running server; with OpenLDAP command-line tools this is accomplished by providing the -H switch, whose argument is a valid LDAP url corresponding to the interface the server is supposed to be listening on.</UL> +<H3><A NAME="ldap_*: No such object">C.1.2. ldap_*: No such object</A></H3> +<P>The <B>no such object</B> error is generally returned when the target DN of the operation cannot be located. This section details reasons common to all operations. You should also look for answers specific to the operation (as indicated in the error message).</P> +<P>The most common reason for this error is non-existence of the named object. First, check for typos.</P> +<P>Also note that, by default, a new directory server holds no objects (except for a few system entries). So, if you are setting up a new directory server and get this message, it may simply be that you have yet to add the object you are trying to locate.</P> +<P>The error commonly occurs because a DN was not specified and a default was not properly configured.</P> +<P>If you have a suffix specified in slapd.conf eg.</P> +<PRE> + suffix "dc=example,dc=com" +</PRE> +<P>You should use</P> +<PRE> + ldapsearch -b 'dc=example,dc=com' '(cn=jane*)' +</PRE> +<P>to tell it where to start the search.</P> +<P>The <TT>-b</TT> should be specified for all LDAP commands unless you have an <EM>ldap.conf</EM>(5) default configured.</P> +<P>See <EM>ldapsearch</EM>(1), <EM>ldapmodify</EM>(1)</P> +<P>Also, <EM>slapadd</EM>(8) and its ancillary programs are very strict about the syntax of the LDIF file.</P> +<P>Some liberties in the LDIF file may result in an apparently successful creation of the database, but accessing some parts of it may be difficult.</P> +<P>One known common error in database creation is putting a blank line before the first entry in the LDIF file. <B>There must be no leading blank lines in the LDIF file.</B></P> +<P>It is generally recommended that <EM>ldapadd</EM>(1) be used instead of <EM>slapadd</EM>(8) when adding new entries your directory. <EM>slapadd</EM>(8) should be used to bulk load entries known to be valid.</P> +<P>Another cause of this message is a referral ({SECT:Constructing a Distributed Directory Service}}) entry to an unpopulated directory.</P> +<P>Either remove the referral, or add a single record with the referral base DN to the empty directory.</P> +<P>This error may also occur when slapd is unable to access the contents of its database because of file permission problems. For instance, on a Red Hat Linux system, slapd runs as user 'ldap'. When slapadd is run as root to create a database from scratch, the contents of <TT>/var/lib/ldap</TT> are created with user and group root and with permission 600, making the contents inaccessible to the slapd server.</P> +<H3><A NAME="ldap_*: Can\'t chase referral">C.1.3. ldap_*: Can't chase referral</A></H3> +<P>This is caused by the line</P> +<PRE> + referral ldap://root.openldap.org +</PRE> +<P>In <TT>slapd.conf</TT>, it was provided as an example for how to use referrals in the original file. However if your machine is not permanently connected to the Internet, it will fail to find the server, and hence produce an error message.</P> +<P>To resolve, just place a # in front of line and restart slapd or point it to an available ldap server.</P> +<P>See also: <EM>ldapadd</EM>(1), <EM>ldapmodify</EM>(1) and <EM>slapd.conf</EM>(5)</P> +<H3><A NAME="ldap_*: server is unwilling to perform">C.1.4. ldap_*: server is unwilling to perform</A></H3> +<P>slapd will return an unwilling to perform error if the backend holding the target entry does not support the given operation.</P> +<P>The password backend is only willing to perform searches. It will return an unwilling to perform error for all other operations.</P> +<P>The shell backend is configurable and may support a limited subset of operations. Check for other errors indicating a shortage of resources required by the directory server. i.e. you may have a full disk etc</P> +<H3><A NAME="ldap_*: Insufficient access">C.1.5. ldap_*: Insufficient access</A></H3> +<P>This error occurs when server denies the operation due to insufficient access. This is usually caused by binding to a DN with insufficient privileges (or binding anonymously) to perform the operation.</P> +<P>You can bind as the rootdn/rootpw specified in <EM>slapd.conf</EM>(5) to gain full access. Otherwise, you must bind to an entry which has been granted the appropriate rights through access controls.</P> +<H3><A NAME="ldap_*: Invalid DN syntax">C.1.6. ldap_*: Invalid DN syntax</A></H3> +<P>The target (or other) DN of the operation is invalid. This implies that either the string representation of the DN is not in the required form, one of the types in the attribute value assertions is not defined, or one of the values in the attribute value assertions does not conform to the appropriate syntax.</P> +<H3><A NAME="ldap_*: Referral hop limit exceeded">C.1.7. ldap_*: Referral hop limit exceeded</A></H3> +<P>This error generally occurs when the client chases a referral which refers itself back to a server it already contacted. The server responds as it did before and the client loops. This loop is detected when the hop limit is exceeded.</P> +<P>This is most often caused through misconfiguration of the server's default referral. The default referral should not be itself:</P> +<P>That is, on <A HREF="ldap://myldap/">ldap://myldap/</A> the default referral should not be <A HREF="ldap://myldap/">ldap://myldap/</A> (or any hostname/ip which is equivalent to myldap).</P> +<H3><A NAME="ldap_*: operations error">C.1.8. ldap_*: operations error</A></H3> +<P>In some versions of <EM>slapd</EM>(8), <EM>operationsError</EM> was returned instead of other.</P> +<H3><A NAME="ldap_*: other error">C.1.9. ldap_*: other error</A></H3> +<P>The other result code indicates an internal error has occurred. While the additional information provided with the result code might provide some hint as to the problem, often one will need to consult the server's log files.</P> +<H3><A NAME="ldap_add/modify: Invalid syntax">C.1.10. ldap_add/modify: Invalid syntax</A></H3> +<P>This error is reported when a value of an attribute does not conform to syntax restrictions. Additional information is commonly provided stating which value of which attribute was found to be invalid. Double check this value and other values (the server will only report the first error it finds).</P> +<P>Common causes include:</P> +<UL> +<LI>extraneous whitespace (especially trailing whitespace) +<LI>improperly encoded characters (LDAPv3 uses UTF-8 encoded Unicode) +<LI>empty values (few syntaxes allow empty values)</UL> +<P>For certain syntax, like OBJECT IDENTIFIER (OID), this error can indicate that the OID descriptor (a "short name") provided is unrecognized. For instance, this error is returned if the <EM>objectClass</EM> value provided is unrecognized.</P> +<H3><A NAME="ldap_add/modify: Object class violation">C.1.11. ldap_add/modify: Object class violation</A></H3> +<P>This error is returned with the entry to be added or the entry as modified violates the object class schema rules. Normally additional information is returned the error detailing the violation. Some of these are detailed below.</P> +<P>Violations related to the entry's attributes:</P> +<PRE> + Attribute not allowed +</PRE> +<P>A provided attribute is not allowed by the entry's object class(es).</P> +<PRE> + Missing required attribute +</PRE> +<P>An attribute required by the entry's object class(es) was not provided.</P> +<P>Violations related to the entry's class(es):</P> +<PRE> + Entry has no objectClass attribute +</PRE> +<P>The entry did not state which object classes it belonged to.</P> +<PRE> + Unrecognized objectClass +</PRE> +<P>One (or more) of the listed objectClass values is not recognized.</P> +<PRE> + No structural object class provided +</PRE> +<P>None of the listed objectClass values is structural.</P> +<PRE> + Invalid structural object class chain +</PRE> +<P>Two or more structural objectClass values are not in same structural object class chain.</P> +<PRE> + Structural object class modification +</PRE> +<P>Modify operation attempts to change the structural class of the entry.</P> +<PRE> + Instanstantiation of abstract objectClass. +</PRE> +<P>An abstract class is not subordinate to any listed structural or auxiliary class.</P> +<PRE> + Invalid structural object class +</PRE> +<P>Other structural object class problem.</P> +<PRE> + No structuralObjectClass operational attribute +</PRE> +<P>This is commonly returned when a shadow server is provided an entry which does not contain the structuralObjectClass operational attribute.</P> +<P>Note that the above error messages as well as the above answer assumes basic knowledge of LDAP/X.500 schema.</P> +<H3><A NAME="ldap_add: No such object">C.1.12. ldap_add: No such object</A></H3> +<P>The "ldap_add: No such object" error is commonly returned if parent of the entry being added does not exist. Add the parent entry first...</P> +<P>For example, if you are adding "cn=bob,dc=domain,dc=com" and you get:</P> +<PRE> + ldap_add: No such object +</PRE> +<P>The entry "dc=domain,dc=com" likely doesn't exist. You can use ldapsearch to see if does exist:</P> +<PRE> + ldapsearch -b 'dc=domain,dc=com' -s base '(objectclass=*)' +</PRE> +<P>If it doesn't, add it. See <A HREF="#A Quick-Start Guide">A Quick-Start Guide</A> for assistance.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>if the entry being added is the same as database suffix, it's parent isn't required. i.e.: if your suffix is "dc=domain,dc=com", "dc=com" doesn't need to exist to add "dc=domain,dc=com". +<HR WIDTH="80%" ALIGN="Left"></P> +<P>This error will also occur if you try to add any entry that the server is not configured to hold.</P> +<P>For example, if your database suffix is "dc=domain,dc=com" and you attempt to add "dc=domain2,dc=com", "dc=com", "dc=domain,dc=org", "o=domain,c=us", or an other DN in the "dc=domain,dc=com" subtree, the server will return a "No such object" (or referral) error.</P> +<P><EM>slapd</EM>(8) will generally return "no global superior knowledge" as additional information indicating its return noSuchObject instead of a referral as the server is not configured with knowledge of a global superior server.</P> +<H3><A NAME="ldap add: invalid structural object class chain">C.1.13. ldap add: invalid structural object class chain</A></H3> +<P>This particular error refers to the rule about STRUCTURAL objectclasses, which states that an object is of one STRUCTURAL class, the structural class of the object. The object is said to belong to this class, zero or more auxiliaries classes, and their super classes.</P> +<P>While all of these classes are commonly listed in the objectClass attribute of the entry, one of these classes is the structural object class of the entry. Thus, it is OK for an objectClass attribute to contain inetOrgPerson, organizationalPerson, and person because they inherit one from another to form a single super class chain. That is, inetOrgPerson SUPs organizationPerson SUPs person. On the other hand, it is invalid for both inetOrgPerson and account to be listed in objectClass as inetOrgPerson and account are not part of the same super class chain (unless some other class is also listed with is a subclass of both).</P> +<P>To resolve this problem, one must determine which class will better serve structural object class for the entry, adding this class to the objectClass attribute (if not already present), and remove any other structural class from the entry's objectClass attribute which is not a super class of the structural object class.</P> +<P>Which object class is better depends on the particulars of the situation. One generally should consult the documentation for the applications one is using for help in making the determination.</P> +<H3><A NAME="ldap_add: no structuralObjectClass operational attribute">C.1.14. ldap_add: no structuralObjectClass operational attribute</A></H3> +<P>ldapadd(1) may error:</P> +<PRE> + adding new entry "uid=XXX,ou=People,o=campus,c=ru" + ldap_add: Internal (implementation specific) error (80) + additional info: no structuralObjectClass operational attribute +</PRE> +<P>when slapd(8) cannot determine, based upon the contents of the objectClass attribute, what the structural class of the object should be.</P> +<H3><A NAME="ldap_add/modify/rename: Naming violation">C.1.15. ldap_add/modify/rename: Naming violation</A></H3> +<P>OpenLDAP's slapd checks for naming attributes and distinguished values consistency, according to RFC 4512.</P> +<P>Naming attributes are those attributeTypes that appear in an entry's RDN; distinguished values are the values of the naming attributes that appear in an entry's RDN, e.g, in</P> +<PRE> + cn=Someone+mail=someone@example.com,dc=example,dc=com +</PRE> +<P>the naming attributes are cn and mail, and the distinguished values are Someone and someone@example.com.</P> +<P>OpenLDAP's slapd checks for consistency when:</P> +<UL> +<LI>adding an entry +<LI>modifying an entry, if the values of the naming attributes are changed +<LI>renaming an entry, if the RDN of the entry changes</UL> +<P>Possible causes of error are:</P> +<UL> +<LI>the naming attributes are not present in the entry; for example:</UL> +<PRE> + dn: dc=example,dc=com + objectClass: organization + o: Example + # note: "dc: example" is missing +</PRE> +<UL> +<LI>the naming attributes are present in the entry, but in the attributeType definition they are marked as:<UL> +<LI>collective +<LI>operational +<LI>obsolete</UL> +<LI>the naming attributes are present in the entry, but the distinguished values are not; for example:</UL> +<PRE> + dn: dc=example,dc=com + objectClass: domain + dc: foobar + # note: "dc" is present, but the value is not "example" +</PRE> +<UL> +<LI>the naming attributes are present in the entry, with the distinguished values, but the naming attributes:<UL> +<LI>do not have an equality field, so equality cannot be asserted +<LI>the matching rule is not supported (yet) +<LI>the matching rule is not appropriate</UL> +<LI>the given distinguished values do not comply with their syntax +<LI>other errors occurred during the validation/normalization/match process; this is a catchall: look at previous logs for details in case none of the above apply to your case.</UL> +<P>In any case, make sure that the attributeType definition for the naming attributes contains an appropriate EQUALITY field; or that of the superior, if they are defined based on a superior attributeType (look at the SUP field). See RFC 4512 for details.</P> +<H3><A NAME="ldap_add/delete/modify/rename: no global superior knowledge">C.1.16. ldap_add/delete/modify/rename: no global superior knowledge</A></H3> +<P>If the target entry name places is not within any of the databases the server is configured to hold and the server has no knowledge of a global superior, the server will indicate it is unwilling to perform the operation and provide the text "no global superior knowledge" as additional text.</P> +<P>Likely the entry name is incorrect, or the server is not properly configured to hold the named entry, or, in distributed directory environments, a default referral was not configured.</P> +<H3><A NAME="ldap_bind: Insufficient access">C.1.17. ldap_bind: Insufficient access</A></H3> +<P>Current versions of slapd(8) requires that clients have authentication permission to attribute types used for authentication purposes before accessing them to perform the bind operation. As all bind operations are done anonymously (regardless of previous bind success), the auth access must be granted to anonymous.</P> +<P>In the example ACL below grants the following access:</P> +<UL> +<LI>to anonymous users:<UL> +<LI>permission to authenticate using values of userPassword</UL> +<LI>to authenticated users:<UL> +<LI>permission to update (but not read) their userPassword +<LI>permission to read any object excepting values of userPassword</UL></UL> +<P>All other access is denied.</P> +<PRE> + access to attr=userPassword + by self =w + by anonymous auth + access * + by self write + by users read +</PRE> +<H3><A NAME="ldap_bind: Invalid credentials">C.1.18. ldap_bind: Invalid credentials</A></H3> +<P>The error usually occurs when the credentials (password) provided does not match the userPassword held in entry you are binding to.</P> +<P>The error can also occur when the bind DN specified is not known to the server.</P> +<P>Check both! In addition to the cases mentioned above you should check if the server denied access to userPassword on selected parts of the directory. In fact, slapd always returns "Invalid credentials" in case of failed bind, regardless of the failure reason, since other return codes could reveal the validity of the user's name.</P> +<P>To debug access rules defined in slapd.conf, add "ACL" to log level.</P> +<H3><A NAME="ldap_bind: Protocol error">C.1.19. ldap_bind: Protocol error</A></H3> +<P>There error is generally occurs when the LDAP version requested by the client is not supported by the server.</P> +<P>The OpenLDAP Software 2.x server, by default, only accepts version 3 LDAP Bind requests but can be configured to accept a version 2 LDAP Bind request.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>The 2.x server expects LDAPv3 [RFC4510] to be used when the client requests version 3 and expects a limited LDAPv3 variant (basically, LDAPv3 syntax and semantics in an LDAPv2 PDUs) to be used when version 2 is expected. +<HR WIDTH="80%" ALIGN="Left"></P> +<P>This variant is also sometimes referred to as LDAPv2+, but differs from the U-Mich LDAP variant in a number of ways.</P> +<H3><A NAME="ldap_modify: cannot modify object class">C.1.20. ldap_modify: cannot modify object class</A></H3> +<P>This message is commonly returned when attempting to modify the objectClass attribute in a manner inconsistent with the LDAP/X.500 information model. In particular, it commonly occurs when one tries to change the structure of the object from one class to another, for instance, trying to change an 'apple' into a 'pear' or a 'fruit' into a 'pear'.</P> +<P>Such changes are disallowed by the slapd(8) in accordance with LDAP and X.500 restrictions.</P> +<H3><A NAME="ldap_sasl_interactive_bind_s: ..">C.1.21. ldap_sasl_interactive_bind_s: ...</A></H3> +<P>If you intended to bind using a DN and password and get an error from ldap_sasl_interactive_bind_s, you likely forgot to provide a '-x' option to the command. By default, SASL authentication is used. '-x' is necessary to select "simple" authentication.</P> +<H3><A NAME="ldap_sasl_interactive_bind_s: No such Object">C.1.22. ldap_sasl_interactive_bind_s: No such Object</A></H3> +<P>This indicates that LDAP SASL authentication function could not read the Root DSE. The error will occur when the server doesn't provide a root DSE. This may be due to access controls.</P> +<H3><A NAME="ldap_sasl_interactive_bind_s: No such attribute">C.1.23. ldap_sasl_interactive_bind_s: No such attribute</A></H3> +<P>This indicates that LDAP SASL authentication function could read the Root DSE but it contained no supportedSASLMechanism attribute.</P> +<P>The supportedSASLmechanism attribute lists mechanisms currently available. The list may be empty because none of the supported mechanisms are currently available. For example, EXTERNAL is listed only if the client has established its identity by authenticating at a lower level (e.g. TLS).</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>the attribute may not be visible due to access controls +<HR WIDTH="80%" ALIGN="Left"></P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>SASL bind is the default for all OpenLDAP tools, e.g. ldapsearch(1), ldapmodify(1). To force use of "simple" bind, use the "-x" option. Use of "simple" bind is not recommended unless one has adequate confidentiality protection in place (e.g. TLS/SSL, IPSEC). +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="ldap_sasl_interactive_bind_s: Unknown authentication method">C.1.24. ldap_sasl_interactive_bind_s: Unknown authentication method</A></H3> +<P>This indicates that none of the SASL authentication supported by the server are supported by the client, or that they are too weak or otherwise inappropriate for use by the client. Note that the default security options disallows the use of certain mechanisms such as ANONYMOUS and PLAIN (without TLS).</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>SASL bind is the default for all OpenLDAP tools. To force use of "simple" bind, use the "-x" option. Use of "simple" bind is not recommended unless one has adequate confidentiality protection in place (e.g. TLS/SSL, IPSEC). +<HR WIDTH="80%" ALIGN="Left"></P> +<H3><A NAME="ldap_sasl_interactive_bind_s: Local error (82)">C.1.25. ldap_sasl_interactive_bind_s: Local error (82)</A></H3> +<P>Apparently not having forward and reverse DNS entries for the LDAP server can result in this error.</P> +<H3><A NAME="ldap_search: Partial results and referral received">C.1.26. ldap_search: Partial results and referral received</A></H3> +<P>This error is returned with the server responses to an LDAPv2 search query with both results (zero or more matched entries) and references (referrals to other servers). See also: ldapsearch(1).</P> +<P>If the updatedn on the replica does not exist, a referral will be returned. It may do this as well if the ACL needs tweaking.</P> +<H3><A NAME="ldap_start_tls: Operations error">C.1.27. ldap_start_tls: Operations error</A></H3> +<P>ldapsearch(1) and other tools will return</P> +<PRE> + ldap_start_tls: Operations error (1) + additional info: TLS already started +</PRE> +<P>When the user (though command line options and/or ldap.conf(5)) has requested TLS (SSL) be started twice. For instance, when specifying both "-H ldaps://server.do.main" and "-ZZ".</P> +<H2><A NAME="Other Errors">C.2. Other Errors</A></H2> +<H3><A NAME="ber_get_next on fd X failed errno=34 (Numerical result out of range)">C.2.1. ber_get_next on fd X failed errno=34 (Numerical result out of range)</A></H3> +<P>This slapd error generally indicates that the client sent a message that exceeded an administrative limit. See sockbuf_max_incoming and sockbuf_max_incoming_auth configuration directives in slapd.conf(5).</P> +<H3><A NAME="ber_get_next on fd X failed errno=11 (Resource temporarily unavailable)">C.2.2. ber_get_next on fd X failed errno=11 (Resource temporarily unavailable)</A></H3> +<P>This message is not indicative of abnormal behavior or error. It simply means that expected data is not yet available from the resource, in this context, a network socket. slapd(8) will process the data once it does becomes available.</P> +<H3><A NAME="daemon: socket() failed errno=97 (Address family not supported)">C.2.3. daemon: socket() failed errno=97 (Address family not supported)</A></H3> +<P>This message indicates that the operating system does not support one of the (protocol) address families which slapd(8) was configured to support. Most commonly, this occurs when slapd(8) was configured to support IPv6 yet the operating system kernel wasn't. In such cases, the message can be ignored.</P> +<H3><A NAME="GSSAPI: gss_acquire_cred: Miscellaneous failure; Permission denied;">C.2.4. GSSAPI: gss_acquire_cred: Miscellaneous failure; Permission denied;</A></H3> +<P>This message means that slapd is not running as root and, thus, it cannot get its Kerberos 5 key from the keytab, usually file /etc/krb5.keytab.</P> +<P>A keytab file is used to store keys that are to be used by services or daemons that are started at boot time. It is very important that these secrets are kept beyond reach of intruders.</P> +<P>That's why the default keytab file is owned by root and protected from being read by others. Do not mess with these permissions, build a different keytab file for slapd instead, and make sure it is owned by the user that slapd runs as.</P> +<P>To do this, start kadmin, and enter the following commands:</P> +<PRE> + addprinc -randkey ldap/ldap.example.com@EXAMPLE.COM + ktadd -k /etc/openldap/ldap.keytab ldap/ldap.example.com@EXAMPLE.COM +</PRE> +<P>Then, on the shell, do:</P> +<PRE> + chown ldap:ldap /etc/openldap/ldap.keytab + chmod 600 /etc/openldap/ldap.keytab +</PRE> +<P>Now you have to tell slapd (well, actually tell the gssapi library in Kerberos 5 that is invoked by Cyrus SASL) where to find the new keytab. You do this by setting the environment variable KRB5_KTNAME like this:</P> +<PRE> + export KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab" +</PRE> +<P>Set that environment variable on the slapd start script (Red Hat users might find /etc/sysconfig/ldap a perfect place).</P> +<P>This only works if you are using MIT kerberos. It doesn't work with Heimdal, for instance.</P> +<P>In Heimdal there is a function gsskrb5_register_acceptor_identity() that sets the path of the keytab file you want to use. In Cyrus SASL 2 you can add</P> +<PRE> + keytab: /path/to/file +</PRE> +<P>to your application's SASL config file to use this feature. This only works with Heimdal.</P> +<H3><A NAME="access from unknown denied">C.2.5. access from unknown denied</A></H3> +<P>This related to TCP wrappers. See hosts_access(5) for more information. in the log file: "access from unknown denied" This related to TCP wrappers. See hosts_access(5) for more information. for example: add the line "slapd: .hosts.you.want.to.allow" in /etc/hosts.allow to get rid of the error.</P> +<H3><A NAME="ldap_read: want=# error=Resource temporarily unavailable">C.2.6. ldap_read: want=# error=Resource temporarily unavailable</A></H3> +<P>This message occurs normally. It means that pending data is not yet available from the resource, a network socket. slapd(8) will process the data once it becomes available.</P> +<H3><A NAME="`make test\' fails">C.2.7. `make test' fails</A></H3> +<P>Some times, `make test' fails at the very first test with an obscure message like</P> +<PRE> + make test + make[1]: Entering directory `/ldap_files/openldap-2.4.6/tests' + make[2]: Entering directory `/ldap_files/openldap-2.4.6/tests' + Initiating LDAP tests for BDB... + Cleaning up test run directory leftover from previous run. + Running ./scripts/all... + >>>>> Executing all LDAP tests for bdb + >>>>> Starting test000-rootdse ... + running defines.sh + Starting slapd on TCP/IP port 9011... + Using ldapsearch to retrieve the root DSE... + Waiting 5 seconds for slapd to start... + ./scripts/test000-rootdse: line 40: 10607 Segmentation fault $SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING >$LOG1 2>&1 + Waiting 5 seconds for slapd to start... + Waiting 5 seconds for slapd to start... + Waiting 5 seconds for slapd to start... + Waiting 5 seconds for slapd to start... + Waiting 5 seconds for slapd to start... + ./scripts/test000-rootdse: kill: (10607) - No such pid + ldap_sasl_bind_s: Can't contact LDAP server (-1) + >>>>> Test failed + >>>>> ./scripts/test000-rootdse failed (exit 1) + make[2]: *** [bdb-yes] Error 1 + make[2]: Leaving directory `/ldap_files/openldap-2.4.6/tests' + make[1]: *** [test] Error 2 + make[1]: Leaving directory `/ldap_files/openldap-2.4.6/tests' + make: *** [test] Error 2 +</PRE> +<P>or so. Usually, the five lines</P> +<P>Waiting 5 seconds for slapd to start...</P> +<P>indicate that slapd didn't start at all.</P> +<P>In tests/testrun/slapd.1.log there is a full log of what slapd wrote while trying to start. The log level can be increased by setting the environment variable SLAPD_DEBUG to the corresponding value; see loglevel in slapd.conf(5) for the meaning of log levels.</P> +<P>A typical reason for this behavior is a runtime link problem, i.e. slapd cannot find some dynamic libraries it was linked against. Try running ldd(1) on slapd (for those architectures that support runtime linking).</P> +<P>There might well be other reasons; the contents of the log file should help clarifying them.</P> +<P>Tests that fire up multiple instances of slapd typically log to tests/testrun/slapd.<n>.log, with a distinct <n> for each instance of slapd; list tests/testrun/ for possible values of <n>.</P> +<H3><A NAME="ldap_*: Internal (implementation specific) error (80) - additional info: entry index delete failed">C.2.8. ldap_*: Internal (implementation specific) error (80) - additional info: entry index delete failed</A></H3> +<P>This seems to be related with wrong ownership of the BDB's dir (/var/lib/ldap) and files. The files must be owned by the user that slapd runs as.</P> +<PRE> + chown -R ldap:ldap /var/lib/ldap +</PRE> +<P>fixes it in Debian</P> +<H3><A NAME="ldap_sasl_interactive_bind_s: Can\'t contact LDAP server (-1)">C.2.9. ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)</A></H3> +<P>Using SASL, when a client contacts LDAP server, the slapd service dies immediately and client gets an error :</P> +<PRE> + SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) +</PRE> +<P>Then check the slapd service, it stopped.</P> +<P>This may come from incompatible of using different versions of BerkeleyDB for installing of SASL and installing of OpenLDAP. The problem arises in case of using multiple version of BerkeleyDB. Solution: - Check which version of BerkeleyDB when install Cyrus SASL.</P> +<P>Reinstall OpenLDAP with the version of BerkeleyDB above.</P> +<P></P> +<HR> +<H1><A NAME="Recommended OpenLDAP Software Dependency Versions">D. Recommended OpenLDAP Software Dependency Versions</A></H1> +<P>This appendix details the recommended versions of the software that OpenLDAP depends on.</P> +<P>Please read the <A HREF="#Prerequisite software">Prerequisite software</A> section for more information on the following software dependencies.</P> +<H2><A NAME="Dependency Versions">D.1. Dependency Versions</A></H2> +<TABLE CLASS="columns" BORDER ALIGN='Center'> +<CAPTION ALIGN=top>Table 8.5: OpenLDAP Software Dependency Versions</CAPTION> +<TR CLASS="heading"> +<TD> +<STRONG>Feature</STRONG> +</TD> +<TD> +<STRONG>Software</STRONG> +</TD> +<TD> +<STRONG>Version</STRONG> +</TD> +</TR> +<TR> +<TD> + <TERM>Transport Layer Security</TERM>: +</TD> +<TD> +<TT> </TT> +</TD> +<TD> +<TT> </TT> +</TD> +</TR> +<TR> +<TD> + +</TD> +<TD> +<TT> <A HREF="http://www.openssl.org/">OpenSSL</A></TT> +</TD> +<TD> +<TT>0.9.7+</TT> +</TD> +</TR> +<TR> +<TD> + +</TD> +<TD> +<TT> <A HREF="http://www.gnu.org/software/gnutls/">GnuTLS</A></TT> +</TD> +<TD> +<TT>2.12.0</TT> +</TD> +</TR> +<TR> +<TD> + +</TD> +<TD> +<TT> <A HREF="http://developer.mozilla.org/en/NSS">MozNSS</A></TT> +</TD> +<TD> +<TT>3.12.9</TT> +</TD> +</TR> +<TR> +<TD> + <TERM>Simple Authentication and Security Layer</TERM> +</TD> +<TD> +<TT> <A HREF="http://asg.web.cmu.edu/sasl/sasl-library.html">Cyrus SASL</A></TT> +</TD> +<TD> +<TT>2.1.21+</TT> +</TD> +</TR> +<TR> +<TD> + <TERM>Kerberos Authentication Service</TERM>: +</TD> +<TD> +<TT> </TT> +</TD> +<TD> +<TT> </TT> +</TD> +</TR> +<TR> +<TD> + +</TD> +<TD> +<TT> <A HREF="http://www.pdc.kth.se/heimdal/">Heimdal</A></TT> +</TD> +<TD> +<TT>Version</TT> +</TD> +</TR> +<TR> +<TD> + +</TD> +<TD> +<TT> <A HREF="http://web.mit.edu/kerberos/www/">MIT Kerberos</A></TT> +</TD> +<TD> +<TT>Version</TT> +</TD> +</TR> +<TR> +<TD> +Threads: +</TD> +<TD> +<TT> </TT> +</TD> +<TD> +<TT> </TT> +</TD> +</TR> +<TR> +<TD> + +</TD> +<TD> +<TT>POSIX <EM>pthreads</EM></TT> +</TD> +<TD> +<TT>Version</TT> +</TD> +</TR> +<TR> +<TD> + +</TD> +<TD> +<TT>Mach <EM>CThreads</EM></TT> +</TD> +<TD> +<TT>Version</TT> +</TD> +</TR> +<TR> +<TD> +TCP Wrappers +</TD> +<TD> +<TT>Name</TT> +</TD> +<TD> +<TT>Version</TT> +</TD> +</TR> +</TABLE> + +<P></P> +<HR> +<H1><A NAME="Real World OpenLDAP Deployments and Examples">E. Real World OpenLDAP Deployments and Examples</A></H1> +<P>Examples and discussions</P> +<P></P> +<HR> +<H1><A NAME="OpenLDAP Software Contributions">F. OpenLDAP Software Contributions</A></H1> +<P>The following sections attempt to summarize the various contributions in OpenLDAP software, as found in <TT>openldap_src/contrib</TT></P> +<H2><A NAME="Client APIs">F.1. Client APIs</A></H2> +<P>Intro and discuss</P> +<H3><A NAME="ldapc++">F.1.1. ldapc++</A></H3> +<P>Intro and discuss</P> +<H3><A NAME="ldaptcl">F.1.2. ldaptcl</A></H3> +<P>Intro and discuss</P> +<H2><A NAME="Overlays">F.2. Overlays</A></H2> +<H3><A NAME="acl">F.2.1. acl</A></H3> +<P>Plugins that implement access rules. Currently only posixGroup, which implements access control based on posixGroup membership.</P> +<H3><A NAME="addpartial">F.2.2. addpartial</A></H3> +<P>Treat Add requests as Modify requests if the entry exists.</P> +<H3><A NAME="allop">F.2.3. allop</A></H3> +<P>Return operational attributes for root DSE even when not requested, since some clients expect this.</P> +<H3><A NAME="autogroup">F.2.4. autogroup</A></H3> +<P>Automated updates of group memberships.</P> +<H3><A NAME="comp_match">F.2.5. comp_match</A></H3> +<P>Component Matching rules (RFC 3687).</P> +<H3><A NAME="denyop">F.2.6. denyop</A></H3> +<P>Deny selected operations, returning <EM>unwillingToPerform</EM>.</P> +<H3><A NAME="dsaschema">F.2.7. dsaschema</A></H3> +<P>Permit loading DSA-specific schema, including operational attrs.</P> +<H3><A NAME="lastmod">F.2.8. lastmod</A></H3> +<P>Track the time of the last write operation to a database.</P> +<H3><A NAME="nops">F.2.9. nops</A></H3> +<P>Remove null operations, e.g. changing a value to same as before.</P> +<H3><A NAME="nssov">F.2.10. nssov</A></H3> +<P>Handle NSS lookup requests through a local Unix Domain socket.</P> +<H3><A NAME="passwd">F.2.11. passwd</A></H3> +<P>Support additional password mechanisms.</P> +<H3><A NAME="proxyOld">F.2.12. proxyOld</A></H3> +<P>Proxy Authorization compatibility with obsolete internet-draft.</P> +<H3><A NAME="smbk5pwd">F.2.13. smbk5pwd</A></H3> +<P>Make the PasswordModify Extended Operation update Kerberos keys and Samba password hashes as well as <EM>userPassword</EM>.</P> +<H3><A NAME="trace">F.2.14. trace</A></H3> +<P>Trace overlay invocation.</P> +<H3><A NAME="usn">F.2.15. usn</A></H3> +<P>Maintain <EM>usnCreated</EM> and <EM>usnChanged</EM> attrs similar to Microsoft AD.</P> +<H2><A NAME="Tools">F.3. Tools</A></H2> +<P>Intro and discuss</P> +<H3><A NAME="Statistic Logging">F.3.1. Statistic Logging</A></H3> +<P>statslog</P> +<H2><A NAME="SLAPI Plugins">F.4. SLAPI Plugins</A></H2> +<P>Intro and discuss</P> +<H3><A NAME="addrdnvalues">F.4.1. addrdnvalues</A></H3> +<P>More</P> +<P></P> +<HR> +<H1><A NAME="Configuration File Examples">G. Configuration File Examples</A></H1> +<H2><A NAME="slapd.conf">G.1. slapd.conf</A></H2> +<H2><A NAME="ldap.conf">G.2. ldap.conf</A></H2> +<H2><A NAME="a-n-other.conf">G.3. a-n-other.conf</A></H2> +<P></P> +<HR> +<H1><A NAME="LDAP Result Codes">H. LDAP Result Codes</A></H1> +<P>For the purposes of this guide, we have incorporated the standard LDAP result codes from <EM>Appendix A. LDAP Result Codes</EM> of <A HREF="http://www.rfc-editor.org/rfc/rfc4511.txt">RFC4511</A>, a copy of which can be found in <TT>doc/rfc</TT> of the OpenLDAP source code.</P> +<P>We have expanded the description of each error in relation to the OpenLDAP toolsets. LDAP extensions may introduce extension-specific result codes, which are not part of RFC4511. OpenLDAP returns the result codes related to extensions it implements. Their meaning is documented in the extension they are related to.</P> +<H2><A NAME="Non-Error Result Codes">H.1. Non-Error Result Codes</A></H2> +<P>These result codes (called "non-error" result codes) do not indicate an error condition:</P> +<PRE> + success (0), + compareFalse (5), + compareTrue (6), + referral (10), and + saslBindInProgress (14). +</PRE> +<P>The <EM>success</EM>, <EM>compareTrue</EM>, and <EM>compareFalse</EM> result codes indicate successful completion (and, hence, are referred to as "successful" result codes).</P> +<P>The <EM>referral</EM> and <EM>saslBindInProgress</EM> result codes indicate the client needs to take additional action to complete the operation.</P> +<H2><A NAME="Result Codes">H.2. Result Codes</A></H2> +<P>Existing LDAP result codes are described as follows:</P> +<H2><A NAME="success (0)">H.3. success (0)</A></H2> +<P>Indicates the successful completion of an operation.</P> +<P><HR WIDTH="80%" ALIGN="Left"> +<STRONG>Note: </STRONG>this code is not used with the Compare operation. See <A HREF="#compareFalse (5)">compareFalse (5)</A> and <A HREF="#compareTrue (6)">compareTrue (6)</A>. +<HR WIDTH="80%" ALIGN="Left"></P> +<H2><A NAME="operationsError (1)">H.4. operationsError (1)</A></H2> +<P>Indicates that the operation is not properly sequenced with relation to other operations (of same or different type).</P> +<P>For example, this code is returned if the client attempts to StartTLS (<A HREF="http://www.rfc-editor.org/rfc/rfc4511.txt">RFC4511</A> Section 4.14) while there are other uncompleted operations or if a TLS layer was already installed.</P> +<H2><A NAME="protocolError (2)">H.5. protocolError (2)</A></H2> +<P>Indicates the server received data that is not well-formed.</P> +<P>For Bind operation only, this code is also used to indicate that the server does not support the requested protocol version.</P> +<P>For Extended operations only, this code is also used to indicate that the server does not support (by design or configuration) the Extended operation associated with the <EM>requestName</EM>.</P> +<P>For request operations specifying multiple controls, this may be used to indicate that the server cannot ignore the order of the controls as specified, or that the combination of the specified controls is invalid or unspecified.</P> +<H2><A NAME="timeLimitExceeded (3)">H.6. timeLimitExceeded (3)</A></H2> +<P>Indicates that the time limit specified by the client was exceeded before the operation could be completed.</P> +<H2><A NAME="sizeLimitExceeded (4)">H.7. sizeLimitExceeded (4)</A></H2> +<P>Indicates that the size limit specified by the client was exceeded before the operation could be completed.</P> +<H2><A NAME="compareFalse (5)">H.8. compareFalse (5)</A></H2> +<P>Indicates that the Compare operation has successfully completed and the assertion has evaluated to FALSE or Undefined.</P> +<H2><A NAME="compareTrue (6)">H.9. compareTrue (6)</A></H2> +<P>Indicates that the Compare operation has successfully completed and the assertion has evaluated to TRUE.</P> +<H2><A NAME="authMethodNotSupported (7)">H.10. authMethodNotSupported (7)</A></H2> +<P>Indicates that the authentication method or mechanism is not supported.</P> +<H2><A NAME="strongerAuthRequired (8)">H.11. strongerAuthRequired (8)</A></H2> +<P>Indicates the server requires strong(er) authentication in order to complete the operation.</P> +<P>When used with the Notice of Disconnection operation, this code indicates that the server has detected that an established security association between the client and server has unexpectedly failed or been compromised.</P> +<H2><A NAME="referral (10)">H.12. referral (10)</A></H2> +<P>Indicates that a referral needs to be chased to complete the operation (see <A HREF="http://www.rfc-editor.org/rfc/rfc4511.txt">RFC4511</A> Section 4.1.10).</P> +<H2><A NAME="adminLimitExceeded (11)">H.13. adminLimitExceeded (11)</A></H2> +<P>Indicates that an administrative limit has been exceeded.</P> +<H2><A NAME="unavailableCriticalExtension (12)">H.14. unavailableCriticalExtension (12)</A></H2> +<P>Indicates a critical control is unrecognized (see <A HREF="http://www.rfc-editor.org/rfc/rfc4511.txt">RFC4511</A> Section 4.1.11).</P> +<H2><A NAME="confidentialityRequired (13)">H.15. confidentialityRequired (13)</A></H2> +<P>Indicates that data confidentiality protections are required.</P> +<H2><A NAME="saslBindInProgress (14)">H.16. saslBindInProgress (14)</A></H2> +<P>Indicates the server requires the client to send a new bind request, with the same SASL mechanism, to continue the authentication process (see <A HREF="http://www.rfc-editor.org/rfc/rfc4511.txt">RFC4511</A> Section 4.2).</P> +<H2><A NAME="noSuchAttribute (16)">H.17. noSuchAttribute (16)</A></H2> +<P>Indicates that the named entry does not contain the specified attribute or attribute value.</P> +<H2><A NAME="undefinedAttributeType (17)">H.18. undefinedAttributeType (17)</A></H2> +<P>Indicates that a request field contains an unrecognized attribute description.</P> +<H2><A NAME="inappropriateMatching (18)">H.19. inappropriateMatching (18)</A></H2> +<P>Indicates that an attempt was made (e.g., in an assertion) to use a matching rule not defined for the attribute type concerned.</P> +<H2><A NAME="constraintViolation (19)">H.20. constraintViolation (19)</A></H2> +<P>Indicates that the client supplied an attribute value that does not conform to the constraints placed upon it by the data model.</P> +<P>For example, this code is returned when multiple values are supplied to an attribute that has a SINGLE-VALUE constraint.</P> +<H2><A NAME="attributeOrValueExists (20)">H.21. attributeOrValueExists (20)</A></H2> +<P>Indicates that the client supplied an attribute or value to be added to an entry, but the attribute or value already exists.</P> +<H2><A NAME="invalidAttributeSyntax (21)">H.22. invalidAttributeSyntax (21)</A></H2> +<P>Indicates that a purported attribute value does not conform to the syntax of the attribute.</P> +<H2><A NAME="noSuchObject (32)">H.23. noSuchObject (32)</A></H2> +<P>Indicates that the object does not exist in the DIT.</P> +<H2><A NAME="aliasProblem (33)">H.24. aliasProblem (33)</A></H2> +<P>Indicates that an alias problem has occurred. For example, the code may used to indicate an alias has been dereferenced that names no object.</P> +<H2><A NAME="invalidDNSyntax (34)">H.25. invalidDNSyntax (34)</A></H2> +<P>Indicates that an LDAPDN or RelativeLDAPDN field (e.g., search base, target entry, ModifyDN newrdn, etc.) of a request does not conform to the required syntax or contains attribute values that do not conform to the syntax of the attribute's type.</P> +<H2><A NAME="aliasDereferencingProblem (36)">H.26. aliasDereferencingProblem (36)</A></H2> +<P>Indicates that a problem occurred while dereferencing an alias. Typically, an alias was encountered in a situation where it was not allowed or where access was denied.</P> +<H2><A NAME="inappropriateAuthentication (48)">H.27. inappropriateAuthentication (48)</A></H2> +<P>Indicates the server requires the client that had attempted to bind anonymously or without supplying credentials to provide some form of credentials.</P> +<H2><A NAME="invalidCredentials (49)">H.28. invalidCredentials (49)</A></H2> +<P>Indicates that the provided credentials (e.g., the user's name and password) are invalid.</P> +<H2><A NAME="insufficientAccessRights (50)">H.29. insufficientAccessRights (50)</A></H2> +<P>Indicates that the client does not have sufficient access rights to perform the operation.</P> +<H2><A NAME="busy (51)">H.30. busy (51)</A></H2> +<P>Indicates that the server is too busy to service the operation.</P> +<H2><A NAME="unavailable (52)">H.31. unavailable (52)</A></H2> +<P>Indicates that the server is shutting down or a subsystem necessary to complete the operation is offline.</P> +<H2><A NAME="unwillingToPerform (53)">H.32. unwillingToPerform (53)</A></H2> +<P>Indicates that the server is unwilling to perform the operation.</P> +<H2><A NAME="loopDetect (54)">H.33. loopDetect (54)</A></H2> +<P>Indicates that the server has detected an internal loop (e.g., while dereferencing aliases or chaining an operation).</P> +<H2><A NAME="namingViolation (64)">H.34. namingViolation (64)</A></H2> +<P>Indicates that the entry's name violates naming restrictions.</P> +<H2><A NAME="objectClassViolation (65)">H.35. objectClassViolation (65)</A></H2> +<P>Indicates that the entry violates object class restrictions.</P> +<H2><A NAME="notAllowedOnNonLeaf (66)">H.36. notAllowedOnNonLeaf (66)</A></H2> +<P>Indicates that the operation is inappropriately acting upon a non-leaf entry.</P> +<H2><A NAME="notAllowedOnRDN (67)">H.37. notAllowedOnRDN (67)</A></H2> +<P>Indicates that the operation is inappropriately attempting to remove a value that forms the entry's relative distinguished name.</P> +<H2><A NAME="entryAlreadyExists (68)">H.38. entryAlreadyExists (68)</A></H2> +<P>Indicates that the request cannot be fulfilled (added, moved, or renamed) as the target entry already exists.</P> +<H2><A NAME="objectClassModsProhibited (69)">H.39. objectClassModsProhibited (69)</A></H2> +<P>Indicates that an attempt to modify the object class(es) of an entry's 'objectClass' attribute is prohibited.</P> +<P>For example, this code is returned when a client attempts to modify the structural object class of an entry.</P> +<H2><A NAME="affectsMultipleDSAs (71)">H.40. affectsMultipleDSAs (71)</A></H2> +<P>Indicates that the operation cannot be performed as it would affect multiple servers (DSAs).</P> +<H2><A NAME="other (80)">H.41. other (80)</A></H2> +<P>Indicates the server has encountered an internal error.</P> +<P></P> +<HR> +<H1><A NAME="Glossary">I. Glossary</A></H1> +<H2><A NAME="Terms">I.1. Terms</A></H2> +<TABLE CLASS="plain"> +<TR CLASS="heading"> +<TD> +<STRONG>Term</STRONG> +</TD> +<TD> +<STRONG>Definition</STRONG> +</TD> +</TR> +<TR> +<TD> +3DES +</TD> +<TD> +Triple DES +</TD> +</TR> +<TR> +<TD> +ABNF +</TD> +<TD> +Augmented Backus-Naur Form +</TD> +</TR> +<TR> +<TD> +ACDF +</TD> +<TD> +Access Control Decision Function +</TD> +</TR> +<TR> +<TD> +ACE +</TD> +<TD> +ASCII Compatible Encoding +</TD> +</TR> +<TR> +<TD> +ASCII +</TD> +<TD> +American Standard Code for Information Interchange +</TD> +</TR> +<TR> +<TD> +ACID +</TD> +<TD> +Atomicity, Consistency, Isolation, and Durability +</TD> +</TR> +<TR> +<TD> +ACI +</TD> +<TD> +Access Control Information +</TD> +</TR> +<TR> +<TD> +ACL +</TD> +<TD> +Access Control List +</TD> +</TR> +<TR> +<TD> +AES +</TD> +<TD> +Advance Encryption Standard +</TD> +</TR> +<TR> +<TD> +ABI +</TD> +<TD> +Application Binary Interface +</TD> +</TR> +<TR> +<TD> +API +</TD> +<TD> +Application Program Interface +</TD> +</TR> +<TR> +<TD> +ASN.1 +</TD> +<TD> +Abstract Syntax Notation - One +</TD> +</TR> +<TR> +<TD> +AVA +</TD> +<TD> +Attribute Value Assertion +</TD> +</TR> +<TR> +<TD> +AuthcDN +</TD> +<TD> +Authentication DN +</TD> +</TR> +<TR> +<TD> +AuthcId +</TD> +<TD> +Authentication Identity +</TD> +</TR> +<TR> +<TD> +AuthzDN +</TD> +<TD> +Authorization DN +</TD> +</TR> +<TR> +<TD> +AuthzId +</TD> +<TD> +Authorization Identity +</TD> +</TR> +<TR> +<TD> +BCP +</TD> +<TD> +Best Current Practice +</TD> +</TR> +<TR> +<TD> +BDB +</TD> +<TD> +Berkeley DB (Backend) +</TD> +</TR> +<TR> +<TD> +BER +</TD> +<TD> +Basic Encoding Rules +</TD> +</TR> +<TR> +<TD> +BNF +</TD> +<TD> +Backus-Naur Form +</TD> +</TR> +<TR> +<TD> +C +</TD> +<TD> +The C Programming Language +</TD> +</TR> +<TR> +<TD> +CA +</TD> +<TD> +Certificate Authority +</TD> +</TR> +<TR> +<TD> +CER +</TD> +<TD> +Canonical Encoding Rules +</TD> +</TR> +<TR> +<TD> +CLDAP +</TD> +<TD> +Connection-less LDAP +</TD> +</TR> +<TR> +<TD> +CN +</TD> +<TD> +Common Name +</TD> +</TR> +<TR> +<TD> +CRAM-MD5 +</TD> +<TD> +SASL MD5 Challenge/Response Authentication Mechanism +</TD> +</TR> +<TR> +<TD> +CRL +</TD> +<TD> +Certificate Revocation List +</TD> +</TR> +<TR> +<TD> +DAP +</TD> +<TD> +Directory Access Protocol +</TD> +</TR> +<TR> +<TD> +DC +</TD> +<TD> +Domain Component +</TD> +</TR> +<TR> +<TD> +DER +</TD> +<TD> +Distinguished Encoding Rules +</TD> +</TR> +<TR> +<TD> +DES +</TD> +<TD> +Data Encryption Standard +</TD> +</TR> +<TR> +<TD> +DIB +</TD> +<TD> +Directory Information Base +</TD> +</TR> +<TR> +<TD> +DIGEST-MD5 +</TD> +<TD> +SASL Digest MD5 Authentication Mechanism +</TD> +</TR> +<TR> +<TD> +DISP +</TD> +<TD> +Directory Information Shadowing Protocol +</TD> +</TR> +<TR> +<TD> +DIT +</TD> +<TD> +Directory Information Tree +</TD> +</TR> +<TR> +<TD> +DNS +</TD> +<TD> +Domain Name System +</TD> +</TR> +<TR> +<TD> +DN +</TD> +<TD> +Distinguished Name +</TD> +</TR> +<TR> +<TD> +DOP +</TD> +<TD> +Directory Operational Binding Management Protocol +</TD> +</TR> +<TR> +<TD> +DSAIT +</TD> +<TD> +DSA Information Tree +</TD> +</TR> +<TR> +<TD> +DSA +</TD> +<TD> +Directory System Agent +</TD> +</TR> +<TR> +<TD> +DSE +</TD> +<TD> +DSA-specific Entry +</TD> +</TR> +<TR> +<TD> +DSP +</TD> +<TD> +Directory System Protocol +</TD> +</TR> +<TR> +<TD> +DS +</TD> +<TD> +Draft Standard +</TD> +</TR> +<TR> +<TD> +DUA +</TD> +<TD> +Directory User Agent +</TD> +</TR> +<TR> +<TD> +EXTERNAL +</TD> +<TD> +SASL External Authentication Mechanism +</TD> +</TR> +<TR> +<TD> +FAQ +</TD> +<TD> +Frequently Asked Questions +</TD> +</TR> +<TR> +<TD> +FTP +</TD> +<TD> +File Transfer Protocol +</TD> +</TR> +<TR> +<TD> +FYI +</TD> +<TD> +For Your Information +</TD> +</TR> +<TR> +<TD> +GSER +</TD> +<TD> +Generic String Encoding Rules +</TD> +</TR> +<TR> +<TD> +GSS-API +</TD> +<TD> +Generic Security Service Application Program Interface +</TD> +</TR> +<TR> +<TD> +GSSAPI +</TD> +<TD> +SASL Kerberos V GSS-API Authentication Mechanism +</TD> +</TR> +<TR> +<TD> +HDB +</TD> +<TD> +Hierarchical Database (Backend) +</TD> +</TR> +<TR> +<TD> +I-D +</TD> +<TD> +Internet-Draft +</TD> +</TR> +<TR> +<TD> +IA5 +</TD> +<TD> +International Alphabet 5 +</TD> +</TR> +<TR> +<TD> +IDNA +</TD> +<TD> +Internationalized Domain Names in Applications +</TD> +</TR> +<TR> +<TD> +IDN +</TD> +<TD> +Internationalized Domain Name +</TD> +</TR> +<TR> +<TD> +ID +</TD> +<TD> +Identifier +</TD> +</TR> +<TR> +<TD> +IDL +</TD> +<TD> +Index Data Lookups +</TD> +</TR> +<TR> +<TD> +IP +</TD> +<TD> +Internet Protocol +</TD> +</TR> +<TR> +<TD> +IPC +</TD> +<TD> +Inter-process communication +</TD> +</TR> +<TR> +<TD> +IPsec +</TD> +<TD> +Internet Protocol Security +</TD> +</TR> +<TR> +<TD> +IPv4 +</TD> +<TD> +Internet Protocol, version 4 +</TD> +</TR> +<TR> +<TD> +IPv6 +</TD> +<TD> +Internet Protocol, version 6 +</TD> +</TR> +<TR> +<TD> +ITS +</TD> +<TD> +Issue Tracking System +</TD> +</TR> +<TR> +<TD> +JPEG +</TD> +<TD> +Joint Photographic Experts Group +</TD> +</TR> +<TR> +<TD> +Kerberos +</TD> +<TD> +Kerberos Authentication Service +</TD> +</TR> +<TR> +<TD> +LBER +</TD> +<TD> +Lightweight BER +</TD> +</TR> +<TR> +<TD> +LDAP +</TD> +<TD> +Lightweight Directory Access Protocol +</TD> +</TR> +<TR> +<TD> +LDAP Sync +</TD> +<TD> +LDAP Content Synchronization +</TD> +</TR> +<TR> +<TD> +LDAPv3 +</TD> +<TD> +LDAP, version 3 +</TD> +</TR> +<TR> +<TD> +LDIF +</TD> +<TD> +LDAP Data Interchange Format +</TD> +</TR> +<TR> +<TD> +LMDB +</TD> +<TD> +Lightning Memory-Mapped Database +</TD> +</TR> +<TR> +<TD> +MD5 +</TD> +<TD> +Message Digest 5 +</TD> +</TR> +<TR> +<TD> +MDB +</TD> +<TD> +Memory-Mapped Database (Backend) +</TD> +</TR> +<TR> +<TD> +MIB +</TD> +<TD> +Management Information Base +</TD> +</TR> +<TR> +<TD> +MODDN +</TD> +<TD> +Modify DN +</TD> +</TR> +<TR> +<TD> +MODRDN +</TD> +<TD> +Modify RDN +</TD> +</TR> +<TR> +<TD> +NSSR +</TD> +<TD> +Non-specific Subordinate Reference +</TD> +</TR> +<TR> +<TD> +OID +</TD> +<TD> +Object Identifier +</TD> +</TR> +<TR> +<TD> +OSI +</TD> +<TD> +Open Systems Interconnect +</TD> +</TR> +<TR> +<TD> +OTP +</TD> +<TD> +One Time Password +</TD> +</TR> +<TR> +<TD> +PDU +</TD> +<TD> +Protocol Data Unit +</TD> +</TR> +<TR> +<TD> +PEM +</TD> +<TD> +Privacy Enhanced eMail +</TD> +</TR> +<TR> +<TD> +PEN +</TD> +<TD> +Private Enterprise Number +</TD> +</TR> +<TR> +<TD> +PKCS +</TD> +<TD> +Public Key Cryptosystem +</TD> +</TR> +<TR> +<TD> +PKI +</TD> +<TD> +Public Key Infrastructure +</TD> +</TR> +<TR> +<TD> +PKIX +</TD> +<TD> +Public Key Infrastructure (X.509) +</TD> +</TR> +<TR> +<TD> +PLAIN +</TD> +<TD> +SASL Plaintext Password Authentication Mechanism +</TD> +</TR> +<TR> +<TD> +POSIX +</TD> +<TD> +Portable Operating System Interface +</TD> +</TR> +<TR> +<TD> +PS +</TD> +<TD> +Proposed Standard +</TD> +</TR> +<TR> +<TD> +RDN +</TD> +<TD> +Relative Distinguished Name +</TD> +</TR> +<TR> +<TD> +RFC +</TD> +<TD> +Request for Comments +</TD> +</TR> +<TR> +<TD> +RPC +</TD> +<TD> +Remote Procedure Call +</TD> +</TR> +<TR> +<TD> +RXER +</TD> +<TD> +Robust XML Encoding Rules +</TD> +</TR> +<TR> +<TD> +SASL +</TD> +<TD> +Simple Authentication and Security Layer +</TD> +</TR> +<TR> +<TD> +SDF +</TD> +<TD> +Simple Document Format +</TD> +</TR> +<TR> +<TD> +SDSE +</TD> +<TD> +Shadowed DSE +</TD> +</TR> +<TR> +<TD> +SHA1 +</TD> +<TD> +Secure Hash Algorithm 1 +</TD> +</TR> +<TR> +<TD> +SLAPD +</TD> +<TD> +Standalone LDAP Daemon +</TD> +</TR> +<TR> +<TD> +SLURPD +</TD> +<TD> +Standalone LDAP Update Replication Daemon +</TD> +</TR> +<TR> +<TD> +SMTP +</TD> +<TD> +Simple Mail Transfer Protocol +</TD> +</TR> +<TR> +<TD> +SNMP +</TD> +<TD> +Simple Network Management Protocol +</TD> +</TR> +<TR> +<TD> +SQL +</TD> +<TD> +Structured Query Language +</TD> +</TR> +<TR> +<TD> +SRP +</TD> +<TD> +Secure Remote Password +</TD> +</TR> +<TR> +<TD> +SSF +</TD> +<TD> +Security Strength Factor +</TD> +</TR> +<TR> +<TD> +SSL +</TD> +<TD> +Secure Socket Layer +</TD> +</TR> +<TR> +<TD> +STD +</TD> +<TD> +Internet Standard +</TD> +</TR> +<TR> +<TD> +TCP +</TD> +<TD> +Transmission Control Protocol +</TD> +</TR> +<TR> +<TD> +TLS +</TD> +<TD> +Transport Layer Security +</TD> +</TR> +<TR> +<TD> +UCS +</TD> +<TD> +Universal Multiple-Octet Coded Character Set +</TD> +</TR> +<TR> +<TD> +UDP +</TD> +<TD> +User Datagram Protocol +</TD> +</TR> +<TR> +<TD> +UID +</TD> +<TD> +User Identifier +</TD> +</TR> +<TR> +<TD> +Unicode +</TD> +<TD> +The Unicode Standard +</TD> +</TR> +<TR> +<TD> +UNIX +</TD> +<TD> +Unix +</TD> +</TR> +<TR> +<TD> +URI +</TD> +<TD> +Uniform Resource Identifier +</TD> +</TR> +<TR> +<TD> +URL +</TD> +<TD> +Uniform Resource Locator +</TD> +</TR> +<TR> +<TD> +URN +</TD> +<TD> +Uniform Resource Name +</TD> +</TR> +<TR> +<TD> +UTF-8 +</TD> +<TD> +8-bit UCS/Unicode Transformation Format +</TD> +</TR> +<TR> +<TD> +UTR +</TD> +<TD> +Unicode Technical Report +</TD> +</TR> +<TR> +<TD> +UUID +</TD> +<TD> +Universally Unique Identifier +</TD> +</TR> +<TR> +<TD> +WWW +</TD> +<TD> +World Wide Web +</TD> +</TR> +<TR> +<TD> +X.500 +</TD> +<TD> +X.500 Directory Services +</TD> +</TR> +<TR> +<TD> +X.509 +</TD> +<TD> +X.509 Public Key and Attribute Certificate Frameworks +</TD> +</TR> +<TR> +<TD> +XED +</TD> +<TD> +XML Enabled Directory +</TD> +</TR> +<TR> +<TD> +XER +</TD> +<TD> +XML Encoding Rules +</TD> +</TR> +<TR> +<TD> +XML +</TD> +<TD> +Extensible Markup Language +</TD> +</TR> +<TR> +<TD> +syncrepl +</TD> +<TD> +LDAP Sync-based Replication +</TD> +</TR> +</TABLE> + +<H2><A NAME="Related Organizations">I.2. Related Organizations</A></H2> +<TABLE CLASS="plain"> +<TR CLASS="heading"> +<TD> +<STRONG>Name</STRONG> +</TD> +<TD> +<STRONG>Long</STRONG> +</TD> +<TD> +<STRONG>Jump</STRONG> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.ansi.org/">ANSI</A> +</TD> +<TD> +American National Standards Institute +</TD> +<TD> +<A HREF="http://www.ansi.org/">http://www.ansi.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.bsi-global.com/">BSI</A> +</TD> +<TD> +British Standards Institute +</TD> +<TD> +<A HREF="http://www.bsi-global.com/">http://www.bsi-global.com/</A> +</TD> +</TR> +<TR> +<TD> +<ORG>COSINE</ORG> +</TD> +<TD> +Co-operation and Open Systems Interconnection in Europe +</TD> +<TD> +<JUMP> </JUMP> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://cpan.org/">CPAN</A> +</TD> +<TD> +Comprehensive Perl Archive Network +</TD> +<TD> +<A HREF="http://cpan.org/">http://cpan.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://cyrusimap.web.cmu.edu/">Cyrus</A> +</TD> +<TD> +Project Cyrus +</TD> +<TD> +<A HREF="http://cyrusimap.web.cmu.edu/">http://cyrusimap.web.cmu.edu/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.fsf.org/">FSF</A> +</TD> +<TD> +Free Software Foundation +</TD> +<TD> +<A HREF="http://www.fsf.org/">http://www.fsf.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.gnu.org/">GNU</A> +</TD> +<TD> +GNU Not Unix Project +</TD> +<TD> +<A HREF="http://www.gnu.org/">http://www.gnu.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.iab.org/">IAB</A> +</TD> +<TD> +Internet Architecture Board +</TD> +<TD> +<A HREF="http://www.iab.org/">http://www.iab.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.iana.org/">IANA</A> +</TD> +<TD> +Internet Assigned Numbers Authority +</TD> +<TD> +<A HREF="http://www.iana.org/">http://www.iana.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.ieee.org">IEEE</A> +</TD> +<TD> +Institute of Electrical and Electronics Engineers +</TD> +<TD> +<A HREF="http://www.ieee.org">http://www.ieee.org</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.ietf.org/iesg/">IESG</A> +</TD> +<TD> +Internet Engineering Steering Group +</TD> +<TD> +<A HREF="http://www.ietf.org/iesg/">http://www.ietf.org/iesg/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.ietf.org/">IETF</A> +</TD> +<TD> +Internet Engineering Task Force +</TD> +<TD> +<A HREF="http://www.ietf.org/">http://www.ietf.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.irtf.org/">IRTF</A> +</TD> +<TD> +Internet Research Task Force +</TD> +<TD> +<A HREF="http://www.irtf.org/">http://www.irtf.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.iso.org/">ISO</A> +</TD> +<TD> +International Standards Organisation +</TD> +<TD> +<A HREF="http://www.iso.org/">http://www.iso.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.isoc.org/">ISOC</A> +</TD> +<TD> +Internet Society +</TD> +<TD> +<A HREF="http://www.isoc.org/">http://www.isoc.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.itu.int/">ITU</A> +</TD> +<TD> +International Telephone Union +</TD> +<TD> +<A HREF="http://www.itu.int/">http://www.itu.int/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.openldap.org/foundation/">OLF</A> +</TD> +<TD> +OpenLDAP Foundation +</TD> +<TD> +<A HREF="http://www.openldap.org/foundation/">http://www.openldap.org/foundation/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.openldap.org/project/">OLP</A> +</TD> +<TD> +OpenLDAP Project +</TD> +<TD> +<A HREF="http://www.openldap.org/project/">http://www.openldap.org/project/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.openssl.org/">OpenSSL</A> +</TD> +<TD> +OpenSSL Project +</TD> +<TD> +<A HREF="http://www.openssl.org/">http://www.openssl.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/">RFC Editor</A> +</TD> +<TD> +RFC Editor +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/">http://www.rfc-editor.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.oracle.com/">Oracle</A> +</TD> +<TD> +Oracle Corporation +</TD> +<TD> +<A HREF="http://www.oracle.com/">http://www.oracle.com/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.umich.edu/">UM</A> +</TD> +<TD> +University of Michigan +</TD> +<TD> +<A HREF="http://www.umich.edu/">http://www.umich.edu/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.umich.edu/~dirsvcs/ldap/ldap.html">UMLDAP</A> +</TD> +<TD> +University of Michigan LDAP Team +</TD> +<TD> +<A HREF="http://www.umich.edu/~dirsvcs/ldap/ldap.html">http://www.umich.edu/~dirsvcs/ldap/ldap.html</A> +</TD> +</TR> +</TABLE> + +<H2><A NAME="Related Products">I.3. Related Products</A></H2> +<TABLE CLASS="plain"> +<TR CLASS="heading"> +<TD> +<STRONG>Name</STRONG> +</TD> +<TD> +<STRONG>Jump</STRONG> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html">SDF</A> +</TD> +<TD> +<A HREF="http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html">http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://cyrusimap.web.cmu.edu/generalinfo.html">Cyrus</A> +</TD> +<TD> +<A HREF="http://cyrusimap.web.cmu.edu/generalinfo.html">http://cyrusimap.web.cmu.edu/generalinfo.html</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://asg.web.cmu.edu/sasl/sasl-library.html">Cyrus SASL</A> +</TD> +<TD> +<A HREF="http://asg.web.cmu.edu/sasl/sasl-library.html">http://asg.web.cmu.edu/sasl/sasl-library.html</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://git-scm.com/">Git</A> +</TD> +<TD> +<A HREF="http://git-scm.com/">http://git-scm.com/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.gnu.org/software/">GNU</A> +</TD> +<TD> +<A HREF="http://www.gnu.org/software/">http://www.gnu.org/software/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.gnu.org/software/gnutls/">GnuTLS</A> +</TD> +<TD> +<A HREF="http://www.gnu.org/software/gnutls/">http://www.gnu.org/software/gnutls/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.pdc.kth.se/heimdal/">Heimdal</A> +</TD> +<TD> +<A HREF="http://www.pdc.kth.se/heimdal/">http://www.pdc.kth.se/heimdal/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.openldap.org/jldap/">JLDAP</A> +</TD> +<TD> +<A HREF="http://www.openldap.org/jldap/">http://www.openldap.org/jldap/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://web.mit.edu/kerberos/www/">MIT Kerberos</A> +</TD> +<TD> +<A HREF="http://web.mit.edu/kerberos/www/">http://web.mit.edu/kerberos/www/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://developer.mozilla.org/en/NSS">MozNSS</A> +</TD> +<TD> +<A HREF="http://developer.mozilla.org/en/NSS">http://developer.mozilla.org/en/NSS</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.openldap.org/">OpenLDAP</A> +</TD> +<TD> +<A HREF="http://www.openldap.org/">http://www.openldap.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.openldap.org/faq/">OpenLDAP FAQ</A> +</TD> +<TD> +<A HREF="http://www.openldap.org/faq/">http://www.openldap.org/faq/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.openldap.org/its/">OpenLDAP ITS</A> +</TD> +<TD> +<A HREF="http://www.openldap.org/its/">http://www.openldap.org/its/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.openldap.org/software/">OpenLDAP Software</A> +</TD> +<TD> +<A HREF="http://www.openldap.org/software/">http://www.openldap.org/software/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.openssl.org/">OpenSSL</A> +</TD> +<TD> +<A HREF="http://www.openssl.org/">http://www.openssl.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.perl.org/">Perl</A> +</TD> +<TD> +<A HREF="http://www.perl.org/">http://www.perl.org/</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.umich.edu/~dirsvcs/ldap/ldap.html">UMLDAP</A> +</TD> +<TD> +<A HREF="http://www.umich.edu/~dirsvcs/ldap/ldap.html">http://www.umich.edu/~dirsvcs/ldap/ldap.html</A> +</TD> +</TR> +</TABLE> + +<H2><A NAME="References">I.4. References</A></H2> +<TABLE CLASS="plain"> +<TR CLASS="heading"> +<TD> +<STRONG>Reference</STRONG> +</TD> +<TD> +<STRONG>Document</STRONG> +</TD> +<TD> +<STRONG>Status</STRONG> +</TD> +<TD> +<STRONG>Jump</STRONG> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.umich.edu/~dirsvcs/ldap/doc/guides/slapd/guide.pdf">UM-GUIDE</A> +</TD> +<TD> +The SLAPD and SLURPD Administrators Guide +</TD> +<TD> +O +</TD> +<TD> +<A HREF="http://www.umich.edu/~dirsvcs/ldap/doc/guides/slapd/guide.pdf">http://www.umich.edu/~dirsvcs/ldap/doc/guides/slapd/guide.pdf</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2079.txt">RFC2079</A> +</TD> +<TD> +Definition of an X.500 Attribute Type and an Object Class to Hold Uniform Resource Identifers +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2079.txt">http://www.rfc-editor.org/rfc/rfc2079.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2296.txt">RFC2296</A> +</TD> +<TD> +Use of Language Codes in LDAP +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2296.txt">http://www.rfc-editor.org/rfc/rfc2296.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2307.txt">RFC2307</A> +</TD> +<TD> +An Approach for Using LDAP as a Network Information Service +</TD> +<TD> +X +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2307.txt">http://www.rfc-editor.org/rfc/rfc2307.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2589.txt">RFC2589</A> +</TD> +<TD> +Lightweight Directory Access Protocol (v3): Extensions for Dynamic Directory Services +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2589.txt">http://www.rfc-editor.org/rfc/rfc2589.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2798.txt">RFC2798</A> +</TD> +<TD> +Definition of the inetOrgPerson LDAP Object Class +</TD> +<TD> +I +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2798.txt">http://www.rfc-editor.org/rfc/rfc2798.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2831.txt">RFC2831</A> +</TD> +<TD> +Using Digest Authentication as a SASL Mechanism +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2831.txt">http://www.rfc-editor.org/rfc/rfc2831.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2849.txt">RFC2849</A> +</TD> +<TD> +The LDAP Data Interchange Format +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc2849.txt">http://www.rfc-editor.org/rfc/rfc2849.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc3088.txt">RFC3088</A> +</TD> +<TD> +OpenLDAP Root Service +</TD> +<TD> +X +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc3088.txt">http://www.rfc-editor.org/rfc/rfc3088.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc3296.txt">RFC3296</A> +</TD> +<TD> +Named Subordinate References in LDAP +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc3296.txt">http://www.rfc-editor.org/rfc/rfc3296.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc3384.txt">RFC3384</A> +</TD> +<TD> +Lightweight Directory Access Protocol (version 3) Replication Requirements +</TD> +<TD> +I +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc3384.txt">http://www.rfc-editor.org/rfc/rfc3384.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc3494.txt">RFC3494</A> +</TD> +<TD> +Lightweight Directory Access Protocol version 2 (LDAPv2) to Historic Status +</TD> +<TD> +I +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc3494.txt">http://www.rfc-editor.org/rfc/rfc3494.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4013.txt">RFC4013</A> +</TD> +<TD> +SASLprep: Stringprep Profile for User Names and Passwords +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4013.txt">http://www.rfc-editor.org/rfc/rfc4013.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4346.txt">RFC4346</A> +</TD> +<TD> +The Transport Layer Security (TLS) Protocol, Version 1.1 +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4346.txt">http://www.rfc-editor.org/rfc/rfc4346.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4422.txt">RFC4422</A> +</TD> +<TD> +Simple Authentication and Security Layer (SASL) +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4422.txt">http://www.rfc-editor.org/rfc/rfc4422.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4510.txt">RFC4510</A> +</TD> +<TD> +Lightweight Directory Access Protocol (LDAP): Technical Specification Roadmap +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4510.txt">http://www.rfc-editor.org/rfc/rfc4510.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4511.txt">RFC4511</A> +</TD> +<TD> +Lightweight Directory Access Protocol (LDAP): The Protocol +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4511.txt">http://www.rfc-editor.org/rfc/rfc4511.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4512.txt">RFC4512</A> +</TD> +<TD> +Lightweight Directory Access Protocol (LDAP): Directory Information Models +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4512.txt">http://www.rfc-editor.org/rfc/rfc4512.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4513.txt">RFC4513</A> +</TD> +<TD> +Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4513.txt">http://www.rfc-editor.org/rfc/rfc4513.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4514.txt">RFC4514</A> +</TD> +<TD> +Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4514.txt">http://www.rfc-editor.org/rfc/rfc4514.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4515.txt">RFC4515</A> +</TD> +<TD> +Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4515.txt">http://www.rfc-editor.org/rfc/rfc4515.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4516.txt">RFC4516</A> +</TD> +<TD> +Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4516.txt">http://www.rfc-editor.org/rfc/rfc4516.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4517.txt">RFC4517</A> +</TD> +<TD> +Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4517.txt">http://www.rfc-editor.org/rfc/rfc4517.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4518.txt">RFC4518</A> +</TD> +<TD> +Lightweight Directory Access Protocol (LDAP): Internationalized String Preparation +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4518.txt">http://www.rfc-editor.org/rfc/rfc4518.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4519.txt">RFC4519</A> +</TD> +<TD> +Lightweight Directory Access Protocol (LDAP): Schema for User Applications +</TD> +<TD> +PS +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4519.txt">http://www.rfc-editor.org/rfc/rfc4519.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4520.txt">RFC4520</A> +</TD> +<TD> +IANA Considerations for LDAP +</TD> +<TD> +BCP +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4520.txt">http://www.rfc-editor.org/rfc/rfc4520.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4533.txt">RFC4533</A> +</TD> +<TD> +The Lightweight Directory Access Protocol (LDAP) Content Synchronization Operation +</TD> +<TD> +X +</TD> +<TD> +<A HREF="http://www.rfc-editor.org/rfc/rfc4533.txt">http://www.rfc-editor.org/rfc/rfc4533.txt</A> +</TD> +</TR> +<TR> +<TD> +<A HREF="http://tools.ietf.org/html/draft-chu-ldap-ldapi-00">Chu-LDAPI</A> +</TD> +<TD> +Using LDAP Over IPC Mechanisms +</TD> +<TD> +ID +</TD> +<TD> +<A HREF="http://tools.ietf.org/html/draft-chu-ldap-ldapi-00">http://tools.ietf.org/html/draft-chu-ldap-ldapi-00</A> +</TD> +</TR> +</TABLE> + +<P></P> +<HR> +<H1><A NAME="Generic configure Instructions">J. Generic configure Instructions</A></H1> +<PRE> +Basic Installation +================== + + These are generic installation instructions. + + The `configure' shell script attempts to guess correct values for +various system-dependent variables used during compilation. It uses +those values to create a `Makefile' in each directory of the package. +It may also create one or more `.h' files containing system-dependent +definitions. Finally, it creates a shell script `config.status' that +you can run in the future to recreate the current configuration, a file +`config.cache' that saves the results of its tests to speed up +reconfiguring, and a file `config.log' containing compiler output +(useful mainly for debugging `configure'). + + If you need to do unusual things to compile the package, please try +to figure out how `configure' could check whether to do them, and mail +diffs or instructions to the address given in the `README' so they can +be considered for the next release. If at some point `config.cache' +contains results you don't want to keep, you may remove or edit it. + + The file `configure.in' is used to create `configure' by a program +called `autoconf'. You only need `configure.in' if you want to change +it or regenerate `configure' using a newer version of `autoconf'. + +The simplest way to compile this package is: + + 1. `cd' to the directory containing the package's source code and type + `./configure' to configure the package for your system. If you're + using `csh' on an old version of System V, you might need to type + `sh ./configure' instead to prevent `csh' from trying to execute + `configure' itself. + + Running `configure' takes awhile. While running, it prints some + messages telling which features it is checking for. + + 2. Type `make' to compile the package. + + 3. Optionally, type `make check' to run any self-tests that come with + the package. + + 4. Type `make install' to install the programs and any data files and + documentation. + + 5. You can remove the program binaries and object files from the + source code directory by typing `make clean'. To also remove the + files that `configure' created (so you can compile the package for + a different kind of computer), type `make distclean'. There is + also a `make maintainer-clean' target, but that is intended mainly + for the package's developers. If you use it, you may have to get + all sorts of other programs in order to regenerate files that came + with the distribution. + +Compilers and Options +===================== + + Some systems require unusual options for compilation or linking that +the `configure' script does not know about. You can give `configure' +initial values for variables by setting them in the environment. Using +a Bourne-compatible shell, you can do that on the command line like +this: + CC=c89 CFLAGS=-O2 LIBS=-lposix ./configure + +Or on systems that have the `env' program, you can do it like this: + env CPPFLAGS=-I/usr/local/include LDFLAGS=-s ./configure + +Compiling For Multiple Architectures +==================================== + + You can compile the package for more than one kind of computer at the +same time, by placing the object files for each architecture in their +own directory. To do this, you must use a version of `make' that +supports the `VPATH' variable, such as GNU `make'. `cd' to the +directory where you want the object files and executables to go and run +the `configure' script. `configure' automatically checks for the +source code in the directory that `configure' is in and in `..'. + + If you have to use a `make' that does not supports the `VPATH' +variable, you have to compile the package for one architecture at a time +in the source code directory. After you have installed the package for +one architecture, use `make distclean' before reconfiguring for another +architecture. + +Installation Names +================== + + By default, `make install' will install the package's files in +`/usr/local/bin', `/usr/local/man', etc. You can specify an +installation prefix other than `/usr/local' by giving `configure' the +option `--prefix=PATH'. + + You can specify separate installation prefixes for +architecture-specific files and architecture-independent files. If you +give `configure' the option `--exec-prefix=PATH', the package will use +PATH as the prefix for installing programs and libraries. +Documentation and other data files will still use the regular prefix. + + In addition, if you use an unusual directory layout you can give +options like `--bindir=PATH' to specify different values for particular +kinds of files. Run `configure --help' for a list of the directories +you can set and what kinds of files go in them. + + If the package supports it, you can cause programs to be installed +with an extra prefix or suffix on their names by giving `configure' the +option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'. + +Optional Features +================= + + Some packages pay attention to `--enable-FEATURE' options to +`configure', where FEATURE indicates an optional part of the package. +They may also pay attention to `--with-PACKAGE' options, where PACKAGE +is something like `gnu-as' or `x' (for the X Window System). The +`README' should mention any `--enable-' and `--with-' options that the +package recognizes. + + For packages that use the X Window System, `configure' can usually +find the X include and library files automatically, but if it doesn't, +you can use the `configure' options `--x-includes=DIR' and +`--x-libraries=DIR' to specify their locations. + +Specifying the System Type +========================== + + There may be some features `configure' can not figure out +automatically, but needs to determine by the type of host the package +will run on. Usually `configure' can figure that out, but if it prints +a message saying it can not guess the host type, give it the +`--host=TYPE' option. TYPE can either be a short name for the system +type, such as `sun4', or a canonical name with three fields: + CPU-COMPANY-SYSTEM + +See the file `config.sub' for the possible values of each field. If +`config.sub' isn't included in this package, then this package doesn't +need to know the host type. + + If you are building compiler tools for cross-compiling, you can also +use the `--target=TYPE' option to select the type of system they will +produce code for and the `--build=TYPE' option to select the type of +system on which you are compiling the package. + +Sharing Defaults +================ + + If you want to set default values for `configure' scripts to share, +you can create a site shell script called `config.site' that gives +default values for variables like `CC', `cache_file', and `prefix'. +`configure' looks for `PREFIX/share/config.site' if it exists, then +`PREFIX/etc/config.site' if it exists. Or, you can set the +`CONFIG_SITE' environment variable to the location of the site script. +A warning: not all `configure' scripts look for a site script. + +Operation Controls +================== + + `configure' recognizes the following options to control how it +operates. + +`--cache-file=FILE' + Use and save the results of the tests in FILE instead of + `./config.cache'. Set FILE to `/dev/null' to disable caching, for + debugging `configure'. + +`--help' + Print a summary of the options to `configure', and exit. + +`--quiet' +`--silent' +`-q' + Do not print messages saying which checks are being made. To + suppress all normal output, redirect it to `/dev/null' (any error + messages will still be shown). + +`--srcdir=DIR' + Look for the package's source code in directory DIR. Usually + `configure' can determine that directory automatically. + +`--version' + Print the version of Autoconf used to generate the `configure' + script, and exit. + +`configure' also accepts some other, not widely useful, options. + +</PRE> +<P></P> +<HR> +<H1><A NAME="OpenLDAP Software Copyright Notices">K. OpenLDAP Software Copyright Notices</A></H1> +<H2><A NAME="OpenLDAP Copyright Notice">K.1. OpenLDAP Copyright Notice</A></H2> +<P>Copyright 1998-2012 The OpenLDAP Foundation.<BR><EM>All rights reserved.</EM></P> +<P>Redistribution and use in source and binary forms, with or without modification, are permitted <EM>only as authorized</EM> by the <A HREF="#OpenLDAP Public License">OpenLDAP Public License</A>.</P> +<P>A copy of this license is available in file <TT>LICENSE</TT> in the top-level directory of the distribution or, alternatively, at <<A HREF="http://www.OpenLDAP.org/license.html">http://www.OpenLDAP.org/license.html</A>>.</P> +<P>OpenLDAP is a registered trademark of the OpenLDAP Foundation.</P> +<P>Individual files and/or contributed packages may be copyright by other parties and their use subject to additional restrictions.</P> +<P>This work is derived from the University of Michigan LDAP v3.3 distribution. Information concerning this software is available at <<A HREF="http://www.umich.edu/~dirsvcs/ldap/ldap.html">http://www.umich.edu/~dirsvcs/ldap/ldap.html</A>>.</P> +<P>This work also contains materials derived from public sources.</P> +<P>Additional information about OpenLDAP software can be obtained at <<A HREF="http://www.OpenLDAP.org/">http://www.OpenLDAP.org/</A>>.</P> +<H2><A NAME="Additional Copyright Notices">K.2. Additional Copyright Notices</A></H2> +<P>Portions Copyright 1998-2012 Kurt D. Zeilenga.<BR>Portions Copyright 1998-2006 Net Boolean Incorporated.<BR>Portions Copyright 2001-2006 IBM Corporation.<BR><EM>All rights reserved.</EM></P> +<P>Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the <A HREF="#OpenLDAP Public License">OpenLDAP Public License</A>.</P> +<P>Portions Copyright 1999-2008 Howard Y.H. Chu.<BR>Portions Copyright 1999-2008 Symas Corporation.<BR>Portions Copyright 1998-2003 Hallvard B. Furuseth.<BR>Portions Copyright 2007-2011 Gavin Henry.<BR>Portions Copyright 2007-2011 Suretec Systems Limited.<BR><EM>All rights reserved.</EM></P> +<P>Redistribution and use in source and binary forms, with or without modification, are permitted provided that this notice is preserved. The names of the copyright holders may not be used to endorse or promote products derived from this software without their specific prior written permission. This software is provided ``as is'' without express or implied warranty.</P> +<H2><A NAME="University of Michigan Copyright Notice">K.3. University of Michigan Copyright Notice</A></H2> +<P>Portions Copyright 1992-1996 Regents of the University of Michigan.<BR><EM>All rights reserved.</EM></P> +<P>Redistribution and use in source and binary forms are permitted provided that this notice is preserved and that due credit is given to the University of Michigan at Ann Arbor. The name of the University may not be used to endorse or promote products derived from this software without specific prior written permission. This software is provided ``as is'' without express or implied warranty.</P> +<P></P> +<HR> +<H1><A NAME="OpenLDAP Public License">L. OpenLDAP Public License</A></H1> +<PRE> +The OpenLDAP Public License + Version 2.8, 17 August 2003 + +Redistribution and use of this software and associated documentation +("Software"), with or without modification, are permitted provided +that the following conditions are met: + +1. Redistributions in source form must retain copyright statements + and notices, + +2. Redistributions in binary form must reproduce applicable copyright + statements and notices, this list of conditions, and the following + disclaimer in the documentation and/or other materials provided + with the distribution, and + +3. Redistributions must contain a verbatim copy of this document. + +The OpenLDAP Foundation may revise this license from time to time. +Each revision is distinguished by a version number. You may use +this Software under terms of this license revision or under the +terms of any subsequent revision of the license. + +THIS SOFTWARE IS PROVIDED BY THE OPENLDAP FOUNDATION AND ITS +CONTRIBUTORS ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, +INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT +SHALL THE OPENLDAP FOUNDATION, ITS CONTRIBUTORS, OR THE AUTHOR(S) +OR OWNER(S) OF THE SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT, +INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, +BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN +ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. + +The names of the authors and copyright holders must not be used in +advertising or otherwise to promote the sale, use or other dealing +in this Software without specific, written prior permission. Title +to copyright in this Software shall at all times remain with copyright +holders. + +OpenLDAP is a registered trademark of the OpenLDAP Foundation. + +Copyright 1999-2003 The OpenLDAP Foundation, Redwood City, +California, USA. All Rights Reserved. Permission to copy and +distribute verbatim copies of this document is granted. +</PRE> +</DIV> +<DIV CLASS="footer"> +<HR> +<DIV CLASS="navigate"> +<P ALIGN="Center"><A HREF="http://www.openldap.org/">Home</A> | <A HREF="../index.html">Catalog</A></P> +</DIV> +<P> +<FONT COLOR="#808080" FACE="Arial,Verdana,Helvetica" SIZE="1"><B> +________________<BR> +<SMALL>© Copyright 2011, <A HREF="http://www.OpenLDAP.org/foundation/">OpenLDAP Foundation</A>, <A HREF="mailto:info@OpenLDAP.org">info@OpenLDAP.org</A></SMALL></B></FONT> + +</DIV> + +</BODY> +</HTML> diff --git a/doc/guide/admin/guide.sdf b/doc/guide/admin/guide.sdf new file mode 100644 index 0000000..072b114 --- /dev/null +++ b/doc/guide/admin/guide.sdf @@ -0,0 +1,8 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +# +# guide.sdf +# + +!include "master.sdf" diff --git a/doc/guide/admin/index.sdf b/doc/guide/admin/index.sdf new file mode 100644 index 0000000..3ba3339 --- /dev/null +++ b/doc/guide/admin/index.sdf @@ -0,0 +1,8 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +# +# index.sdf +# + +!include "master.sdf" diff --git a/doc/guide/admin/install.sdf b/doc/guide/admin/install.sdf new file mode 100644 index 0000000..e0a2083 --- /dev/null +++ b/doc/guide/admin/install.sdf @@ -0,0 +1,263 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Building and Installing OpenLDAP Software + +This chapter details how to build and install the {{PRD:OpenLDAP}} +Software package including {{slapd}}(8), the Standalone {{TERM:LDAP}} +Daemon. Building and installing OpenLDAP Software requires several +steps: installing prerequisite software, configuring OpenLDAP +Software itself, making, and finally installing. The following +sections describe this process in detail. + + +H2: Obtaining and Extracting the Software + +You can obtain OpenLDAP Software from the project's download +page at {{URL: http://www.openldap.org/software/download/}} or +directly from the project's {{TERM:FTP}} service at +{{URL: ftp://ftp.openldap.org/pub/OpenLDAP/}}. + +The project makes available two series of packages for {{general +use}}. The project makes {{releases}} as new features and bug fixes +come available. Though the project takes steps to improve stability +of these releases, it is common for problems to arise only after +{{release}}. The {{stable}} release is the latest {{release}} which +has demonstrated stability through general use. + +Users of OpenLDAP Software can choose, depending on their desire +for the {{latest features}} versus {{demonstrated stability}}, the +most appropriate series to install. + +After downloading OpenLDAP Software, you need to extract the +distribution from the compressed archive file and change your working +directory to the top directory of the distribution: + +.{{EX:gunzip -c openldap-VERSION.tgz | tar xf -}} +.{{EX:cd openldap-VERSION}} + +You'll have to replace {{EX:VERSION}} with the version name of +the release. + +You should now review the {{F:COPYRIGHT}}, {{F:LICENSE}}, {{F:README}} +and {{F:INSTALL}} documents provided with the distribution. The +{{F:COPYRIGHT}} and {{F:LICENSE}} provide information on acceptable +use, copying, and limitation of warranty of OpenLDAP Software. The +{{F:README}} and {{F:INSTALL}} documents provide detailed information +on prerequisite software and installation procedures. + + +H2: Prerequisite software + +OpenLDAP Software relies upon a number of software packages distributed +by third parties. Depending on the features you intend to use, you +may have to download and install a number of additional software +packages. This section details commonly needed third party software +packages you might have to install. However, for an up-to-date +prerequisite information, the {{F:README}} document should be +consulted. Note that some of these third party packages may depend +on additional software packages. Install each package per the +installation instructions provided with it. + + +H3: {{TERM[expand]TLS}} + +OpenLDAP clients and servers require installation of {{PRD:OpenSSL}}, + {{PRD:GnuTLS}}, or {{PRD:MozNSS}} +{{TERM:TLS}} libraries to provide {{TERM[expand]TLS}} services. Though +some operating systems may provide these libraries as part of the +base system or as an optional software component, OpenSSL, GnuTLS, and +Mozilla NSS often require separate installation. + +OpenSSL is available from {{URL: http://www.openssl.org/}}. +GnuTLS is available from {{URL: http://www.gnu.org/software/gnutls/}}. +Mozilla NSS is available from {{URL: http://developer.mozilla.org/en/NSS}}. + +OpenLDAP Software will not be fully LDAPv3 compliant unless OpenLDAP's +{{EX:configure}} detects a usable TLS library. + + +H3: {{TERM[expand]SASL}} + +OpenLDAP clients and servers require installation of {{PRD:Cyrus SASL}} +libraries to provide {{TERM[expand]SASL}} services. Though +some operating systems may provide this library as part of the +base system or as an optional software component, Cyrus SASL +often requires separate installation. + +Cyrus SASL is available from +{{URL:http://asg.web.cmu.edu/sasl/sasl-library.html}}. +Cyrus SASL will make use of OpenSSL and Kerberos/GSSAPI libraries +if preinstalled. + +OpenLDAP Software will not be fully LDAPv3 compliant unless OpenLDAP's +configure detects a usable Cyrus SASL installation. + + +H3: {{TERM[expand]Kerberos}} + +OpenLDAP clients and servers support {{TERM:Kerberos}} authentication +services. In particular, OpenLDAP supports the Kerberos V +{{TERM:GSS-API}} {{TERM:SASL}} authentication mechanism known as +the {{TERM:GSSAPI}} mechanism. This feature requires, in addition to +Cyrus SASL libraries, either {{PRD:Heimdal}} or {{PRD:MIT Kerberos}} +V libraries. + +Heimdal Kerberos is available from {{URL:http://www.pdc.kth.se/heimdal/}}. +MIT Kerberos is available from {{URL:http://web.mit.edu/kerberos/www/}}. + +Use of strong authentication services, such as those provided by +Kerberos, is highly recommended. + + + +H3: Database Software + +OpenLDAP's {{slapd}}(8) {{TERM:MDB}} primary database backend uses the {{TERM:LMDB}} +software included with the OpenLDAP source. There is no need to download any +additional software to have {{MDB}} support. + +OpenLDAP's {{slapd}}(8) {{TERM:BDB}} and {{TERM:HDB}} deprecated database backends +require {{ORG[expand]Oracle}}'s Berkeley DB. +If not available at configure time, you will not be able to build +{{slapd}}(8) with these deprecated database backends. + +Your operating system may provide a supported version of +Berkeley DB in the base system or as an optional +software component. If not, you'll have to obtain and +install it yourself. Berkeley DB is available from +{{ORG[expand]Oracle}}'s Berkeley DB download page if required. + +There are several versions available from {{ORG[expand]Oracle}}. +Berkeley DB version 6.0.20 and later uses a software license that is +incompatible with LDAP technology and should not be used with OpenLDAP. + +Note: Please see {{SECT:Recommended OpenLDAP Software Dependency Versions}} for +more information. + + +H3: Threads + +OpenLDAP is designed to take advantage of threads. OpenLDAP +supports POSIX {{pthreads}}, Mach {{CThreads}}, and a number of +other varieties. {{EX:configure}} will complain if it cannot +find a suitable thread subsystem. If this occurs, please +consult the {{F:Software|Installation|Platform Hints}} section +of the OpenLDAP FAQ {{URL: http://www.openldap.org/faq/}}. + + +H3: TCP Wrappers + +{{slapd}}(8) supports TCP Wrappers (IP level access control filters) +if preinstalled. Use of TCP Wrappers or other IP-level access +filters (such as those provided by an IP-level firewall) is recommended +for servers containing non-public information. + + +H2: Running configure + +Now you should probably run the {{EX:configure}} script with the +{{EX:--help}} option. +This will give you a list of options that you can change when building +OpenLDAP. Many of the features of OpenLDAP can be enabled or disabled +using this method. +!if 0 +Please see the appendix for a more detailed list of configure options, +and their usage. +!endif +> ./configure --help + +The {{EX:configure}} script also looks for certain variables +on the command line and in the environment. These include: + +!block table; align=Center; coltags="EX,N"; title="Table 4.1: Variables" +Variable Description +CC Specify alternative C Compiler +CFLAGS Specify additional compiler flags +CPPFLAGS Specify C Preprocessor flags +LDFLAGS Specify linker flags +LIBS Specify additional libraries +!endblock + +Now run the configure script with any desired configuration options or +variables. + +> ./configure [options] [variable=value ...] + +As an example, let's assume that we want to install OpenLDAP with +BDB backend and TCP Wrappers support. By default, BDB +is enabled and TCP Wrappers is not. So, we just need to specify +{{EX:--enable-wrappers}} to include TCP Wrappers support: + +> ./configure --enable-wrappers + +However, this will fail to locate dependent software not +installed in system directories. For example, if TCP Wrappers +headers and libraries are installed in {{F:/usr/local/include}} +and {{F:/usr/local/lib}} respectively, the {{EX:configure}} +script should typically be called as follows: + +> ./configure --enable-wrappers \ +> CPPFLAGS="-I/usr/local/include" \ +> LDFLAGS="-L/usr/local/lib -Wl,-rpath,/usr/local/lib" + +The {{EX:configure}} script will normally auto-detect appropriate +settings. If you have problems at this stage, consult any platform +specific hints and check your {{EX:configure}} options, if any. + + +H2: Building the Software + +Once you have run the {{EX:configure}} script the last line of output +should be: +> Please "make depend" to build dependencies + +If the last line of output does not match, {{EX:configure}} has failed, +and you will need to review its output to determine what went wrong. +You should not proceed until {{EX:configure}} completes successfully. + +To build dependencies, run: +> make depend + +Now build the software, this step will actually compile OpenLDAP. +> make + +You should examine the output of this command carefully to make sure +everything is built correctly. Note that this command builds the LDAP +libraries and associated clients as well as {{slapd}}(8). + + +H2: Testing the Software + +Once the software has been properly configured and successfully +made, you should run the test suite to verify the build. + +> make test + +Tests which apply to your configuration will run and they should pass. +Some tests, such as the replication test, may be skipped if not supported +by your configuration. + + +H2: Installing the Software + +Once you have successfully tested the software, you are ready to +install it. You will need to have write permission to the installation +directories you specified when you ran configure. By default +OpenLDAP Software is installed in {{F:/usr/local}}. If you changed +this setting with the {{EX:--prefix}} configure option, it will be +installed in the location you provided. + +Typically, the installation requires {{super-user}} privileges. +From the top level OpenLDAP source directory, type: + +> su root -c 'make install' + +and enter the appropriate password when requested. + +You should examine the output of this command carefully to make sure +everything is installed correctly. You will find the configuration files +for {{slapd}}(8) in {{F:/usr/local/etc/openldap}} by default. See the +chapter {{SECT:Configuring slapd}} for additional information. + diff --git a/doc/guide/admin/intro.sdf b/doc/guide/admin/intro.sdf new file mode 100644 index 0000000..58a6411 --- /dev/null +++ b/doc/guide/admin/intro.sdf @@ -0,0 +1,456 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +H1: Introduction to OpenLDAP Directory Services + +This document describes how to build, configure, and operate +{{PRD:OpenLDAP}} Software to provide directory services. This +includes details on how to configure and run the Standalone +{{TERM:LDAP}} Daemon, {{slapd}}(8). It is intended for new and +experienced administrators alike. This section provides a basic +introduction to directory services and, in particular, the directory +services provided by {{slapd}}(8). This introduction is only +intended to provide enough information so one might get started +learning about {{TERM:LDAP}}, {{TERM:X.500}}, and directory services. + + +H2: What is a directory service? + +A directory is a specialized database specifically designed for +searching and browsing, in additional to supporting basic lookup +and update functions. + +Note: A directory is defined by some as merely a database optimized +for read access. This definition, at best, is overly simplistic. + +Directories tend to contain descriptive, attribute-based information +and support sophisticated filtering capabilities. Directories +generally do not support complicated transaction or roll-back schemes +found in database management systems designed for handling high-volume +complex updates. Directory updates are typically simple all-or-nothing +changes, if they are allowed at all. Directories are generally +tuned to give quick response to high-volume lookup or search +operations. They may have the ability to replicate information +widely in order to increase availability and reliability, while +reducing response time. When directory information is replicated, +temporary inconsistencies between the replicas may be okay, as long +as inconsistencies are resolved in a timely manner. + +There are many different ways to provide a directory service. +Different methods allow different kinds of information to be stored +in the directory, place different requirements on how that information +can be referenced, queried and updated, how it is protected from +unauthorized access, etc. Some directory services are {{local}}, +providing service to a restricted context (e.g., the finger service +on a single machine). Other services are global, providing service +to a much broader context (e.g., the entire Internet). Global +services are usually {{distributed}}, meaning that the data they +contain is spread across many machines, all of which cooperate to +provide the directory service. Typically a global service defines +a uniform {{namespace}} which gives the same view of the data no +matter where you are in relation to the data itself. + +A web directory, such as provided by the {{Open Directory Project}} +<{{URL:http://dmoz.org}}>, is a good example of a directory service. +These services catalog web pages and are specifically designed to +support browsing and searching. + +While some consider the Internet {{TERM[expand]DNS}} (DNS) is an +example of a globally distributed directory service, DNS is not +browseable nor searchable. It is more properly described as a +globally distributed {{lookup}} service. + + +H2: What is LDAP? + +{{TERM:LDAP}} stands for {{TERM[expand]LDAP}}. As the name suggests, +it is a lightweight protocol for accessing directory services, +specifically {{TERM:X.500}}-based directory services. LDAP runs +over {{TERM:TCP}}/{{TERM:IP}} or other connection oriented transfer +services. LDAP is an {{ORG:IETF}} Standard Track protocol and is +specified in "Lightweight Directory Access Protocol (LDAP) Technical +Specification Road Map" {{REF:RFC4510}}. + +This section gives an overview of LDAP from a user's perspective. + +{{What kind of information can be stored in the directory?}} The +LDAP information model is based on {{entries}}. An entry is a +collection of attributes that has a globally-unique {{TERM[expand]DN}} +(DN). The DN is used to refer to the entry unambiguously. Each of +the entry's attributes has a {{type}} and one or more {{values}}. +The types are typically mnemonic strings, like "{{EX:cn}}" for +common name, or "{{EX:mail}}" for email address. The syntax of +values depend on the attribute type. For example, a {{EX:cn}} +attribute might contain the value {{EX:Babs Jensen}}. A {{EX:mail}} +attribute might contain the value "{{EX:babs@example.com}}". A +{{EX:jpegPhoto}} attribute would contain a photograph in the +{{TERM:JPEG}} (binary) format. + +{{How is the information arranged?}} In LDAP, directory entries +are arranged in a hierarchical tree-like structure. Traditionally, +this structure reflected the geographic and/or organizational +boundaries. Entries representing countries appear at the top of +the tree. Below them are entries representing states and national +organizations. Below them might be entries representing organizational +units, people, printers, documents, or just about anything else +you can think of. Figure 1.1 shows an example LDAP directory tree +using traditional naming. + +!import "intro_tree.png"; align="center"; \ + title="LDAP directory tree (traditional naming)" +FT[align="Center"] Figure 1.1: LDAP directory tree (traditional naming) + +The tree may also be arranged based upon Internet domain names. +This naming approach is becoming increasing popular as it allows +for directory services to be located using the {{DNS}}. +Figure 1.2 shows an example LDAP directory tree using domain-based +naming. + +!import "intro_dctree.png"; align="center"; \ + title="LDAP directory tree (Internet naming)" +FT[align="Center"] Figure 1.2: LDAP directory tree (Internet naming) + +In addition, LDAP allows you to control which attributes are required +and allowed in an entry through the use of a special attribute +called {{EX:objectClass}}. The values of the {{EX:objectClass}} +attribute determine the {{schema}} rules the entry must obey. + +{{How is the information referenced?}} An entry is referenced by +its distinguished name, which is constructed by taking the name of +the entry itself (called the {{TERM[expand]RDN}} or RDN) and +concatenating the names of its ancestor entries. For example, the +entry for Barbara Jensen in the Internet naming example above has +an RDN of {{EX:uid=babs}} and a DN of +{{EX:uid=babs,ou=People,dc=example,dc=com}}. The full DN format is +described in {{REF:RFC4514}}, "LDAP: String Representation of +Distinguished Names." + +{{How is the information accessed?}} LDAP defines operations for +interrogating and updating the directory. Operations are provided +for adding and deleting an entry from the directory, changing an +existing entry, and changing the name of an entry. Most of the +time, though, LDAP is used to search for information in the directory. +The LDAP search operation allows some portion of the directory to +be searched for entries that match some criteria specified by a +search filter. Information can be requested from each entry that +matches the criteria. + +For example, you might want to search the entire directory subtree +at and below {{EX:dc=example,dc=com}} for people with the name +{{EX:Barbara Jensen}}, retrieving the email address of each entry +found. LDAP lets you do this easily. Or you might want to search +the entries directly below the {{EX:st=California,c=US}} entry for +organizations with the string {{EX:Acme}} in their name, and that +have a fax number. LDAP lets you do this too. The next section +describes in more detail what you can do with LDAP and how it might +be useful to you. + +{{How is the information protected from unauthorized access?}} Some +directory services provide no protection, allowing anyone to see +the information. LDAP provides a mechanism for a client to authenticate, +or prove its identity to a directory server, paving the way for +rich access control to protect the information the server contains. +LDAP also supports data security (integrity and confidentiality) +services. + + +H2: When should I use LDAP? + +This is a very good question. In general, you should use a Directory +server when you require data to be centrally managed, stored and accessible via +standards based methods. + +Some common examples found throughout the industry are, but not limited to: + +* Machine Authentication +* User Authentication +* User/System Groups +* Address book +* Organization Representation +* Asset Tracking +* Telephony Information Store +* User resource management +* E-mail address lookups +* Application Configuration store +* PBX Configuration store +* etc..... + +There are various {{SECT:Distributed Schema Files}} that are standards based, but +you can always create your own {{SECT:Schema Specification}}. + +There are always new ways to use a Directory and apply LDAP principles to address +certain problems, therefore there is no simple answer to this question. + +If in doubt, join the general LDAP forum for non-commercial discussions and +information relating to LDAP at: +{{URL:http://www.umich.edu/~dirsvcs/ldap/mailinglist.html}} and ask + +H2: When should I not use LDAP? + +When you start finding yourself bending the directory to do what you require, +maybe a redesign is needed. Or if you only require one application to use and +manipulate your data (for discussion of LDAP vs RDBMS, please read the +{{SECT:LDAP vs RDBMS}} section). + +It will become obvious when LDAP is the right tool for the job. + + +H2: How does LDAP work? + +LDAP utilizes a {{client-server model}}. One or more LDAP servers +contain the data making up the directory information tree ({{TERM:DIT}}). +The client connects to servers and asks it a question. The server +responds with an answer and/or with a pointer to where the client +can get additional information (typically, another LDAP server). +No matter which LDAP server a client connects to, it sees the same +view of the directory; a name presented to one LDAP server references +the same entry it would at another LDAP server. This is an important +feature of a global directory service. + + +H2: What about X.500? + +Technically, {{TERM:LDAP}} is a directory access protocol to an +{{TERM:X.500}} directory service, the {{TERM:OSI}} directory service. +Initially, LDAP clients accessed gateways to the X.500 directory service. +This gateway ran LDAP between the client and gateway and X.500's +{{TERM[expand]DAP}} ({{TERM:DAP}}) between the gateway and the +X.500 server. DAP is a heavyweight protocol that operates over a +full OSI protocol stack and requires a significant amount of +computing resources. LDAP is designed to operate over +{{TERM:TCP}}/{{TERM:IP}} and provides most of the functionality of +DAP at a much lower cost. + +While LDAP is still used to access X.500 directory service via +gateways, LDAP is now more commonly directly implemented in X.500 +servers. + +The Standalone LDAP Daemon, or {{slapd}}(8), can be viewed as a +{{lightweight}} X.500 directory server. That is, it does not +implement the X.500's DAP nor does it support the complete X.500 +models. + +If you are already running a X.500 DAP service and you want to +continue to do so, you can probably stop reading this guide. This +guide is all about running LDAP via {{slapd}}(8), without running +X.500 DAP. If you are not running X.500 DAP, want to stop running +X.500 DAP, or have no immediate plans to run X.500 DAP, read on. + +It is possible to replicate data from an LDAP directory server to +a X.500 DAP {{TERM:DSA}}. This requires an LDAP/DAP gateway. +OpenLDAP Software does not include such a gateway. + + +H2: What is the difference between LDAPv2 and LDAPv3? + +LDAPv3 was developed in the late 1990's to replace LDAPv2. +LDAPv3 adds the following features to LDAP: + + * Strong authentication and data security services via {{TERM:SASL}} + * Certificate authentication and data security services via {{TERM:TLS}} (SSL) + * Internationalization through the use of Unicode + * Referrals and Continuations + * Schema Discovery + * Extensibility (controls, extended operations, and more) + +LDAPv2 is historic ({{REF:RFC3494}}). As most {{so-called}} LDAPv2 +implementations (including {{slapd}}(8)) do not conform to the +LDAPv2 technical specification, interoperability amongst +implementations claiming LDAPv2 support is limited. As LDAPv2 +differs significantly from LDAPv3, deploying both LDAPv2 and LDAPv3 +simultaneously is quite problematic. LDAPv2 should be avoided. +LDAPv2 is disabled by default. + + +H2: LDAP vs RDBMS + +This question is raised many times, in different forms. The most common, +however, is: {{Why doesn't OpenLDAP use a relational database management + system (RDBMS) instead of an embedded key/value store like LMDB?}} In +general, expecting that the sophisticated algorithms implemented by +commercial-grade RDBMS would make {{OpenLDAP}} be faster or somehow better +and, at the same time, permitting sharing of data with other applications. + +The short answer is that use of an embedded database and custom indexing system +allows OpenLDAP to provide greater performance and scalability without loss of +reliability. OpenLDAP uses {{TERM:LMDB}} concurrent / transactional +database software. + +Now for the long answer. We are all confronted all the time with the choice +RDBMSes vs. directories. It is a hard choice and no simple answer exists. + +It is tempting to think that having a RDBMS backend to the directory solves all +problems. However, it is a pig. This is because the data models are very +different. Representing directory data with a relational database is going to +require splitting data into multiple tables. + +Think for a moment about the person objectclass. Its definition requires +attribute types objectclass, sn and cn and allows attribute types userPassword, +telephoneNumber, seeAlso and description. All of these attributes are multivalued, +so a normalization requires putting each attribute type in a separate table. + +Now you have to decide on appropriate keys for those tables. The primary key +might be a combination of the DN, but this becomes rather inefficient on most +database implementations. + +The big problem now is that accessing data from one entry requires seeking on +different disk areas. On some applications this may be OK but in many +applications performance suffers. + +The only attribute types that can be put in the main table entry are those that +are mandatory and single-value. You may add also the optional single-valued +attributes and set them to NULL or something if not present. + +But wait, the entry can have multiple objectclasses and they are organized in +an inheritance hierarchy. An entry of objectclass organizationalPerson now has +the attributes from person plus a few others and some formerly optional attribute +types are now mandatory. + +What to do? Should we have different tables for the different objectclasses? +This way the person would have an entry on the person table, another on +organizationalPerson, etc. Or should we get rid of person and put everything on +the second table? + +But what do we do with a filter like (cn=*) where cn is an attribute type that +appears in many, many objectclasses. Should we search all possible tables for +matching entries? Not very attractive. + +Once this point is reached, three approaches come to mind. One is to do full +normalization so that each attribute type, no matter what, has its own separate +table. The simplistic approach where the DN is part of the primary key is +extremely wasteful, and calls for an approach where the entry has a unique +numeric id that is used instead for the keys and a main table that maps DNs to +ids. The approach, anyway, is very inefficient when several attribute types from +one or more entries are requested. Such a database, though cumbersomely, +can be managed from SQL applications. + +The second approach is to put the whole entry as a blob in a table shared by all +entries regardless of the objectclass and have additional tables that act as +indices for the first table. Index tables are not database indices, but are +fully managed by the LDAP server-side implementation. However, the database +becomes unusable from SQL. And, thus, a fully fledged database system provides +little or no advantage. The full generality of the database is unneeded. +Much better to use something light and fast, like {{TERM:LMDB}}. + +A completely different way to see this is to give up any hopes of implementing +the directory data model. In this case, LDAP is used as an access protocol to +data that provides only superficially the directory data model. For instance, +it may be read only or, where updates are allowed, restrictions are applied, +such as making single-value attribute types that would allow for multiple values. +Or the impossibility to add new objectclasses to an existing entry or remove +one of those present. The restrictions span the range from allowed restrictions +(that might be elsewhere the result of access control) to outright violations of +the data model. It can be, however, a method to provide LDAP access to preexisting +data that is used by other applications. But in the understanding that we don't +really have a "directory". + +Existing commercial LDAP server implementations that use a relational database +are either from the first kind or the third. I don't know of any implementation +that uses a relational database to do inefficiently what BDB does efficiently. +For those who are interested in "third way" (exposing EXISTING data from RDBMS +as LDAP tree, having some limitations compared to classic LDAP model, but making +it possible to interoperate between LDAP and SQL applications): + +OpenLDAP includes back-sql - the backend that makes it possible. It uses ODBC + +additional metainformation about translating LDAP queries to SQL queries in your +RDBMS schema, providing different levels of access - from read-only to full +access depending on RDBMS you use, and your schema. + +For more information on concept and limitations, see {{slapd-sql}}(5) man page, +or the {{SECT: Backends}} section. There are also several examples for several +RDBMSes in {{F:back-sql/rdbms_depend/*}} subdirectories. + + +H2: What is slapd and what can it do? + +{{slapd}}(8) is an LDAP directory server that runs on many different +platforms. You can use it to provide a directory service of your +very own. Your directory can contain pretty much anything you want +to put in it. You can connect it to the global LDAP directory +service, or run a service all by yourself. Some of slapd's more +interesting features and capabilities include: + +{{B:LDAPv3}}: {{slapd}} implements version 3 of {{TERM[expand]LDAP}}. +{{slapd}} supports LDAP over both {{TERM:IPv4}} and {{TERM:IPv6}} +and Unix {{TERM:IPC}}. + +{{B:{{TERM[expand]SASL}}}}: {{slapd}} supports strong authentication +and data security (integrity and confidentiality) services through +the use of SASL. {{slapd}}'s SASL implementation utilizes {{PRD:Cyrus +SASL}} software which supports a number of mechanisms including +{{TERM:DIGEST-MD5}}, {{TERM:EXTERNAL}}, and {{TERM:GSSAPI}}. + +{{B:{{TERM[expand]TLS}}}}: {{slapd}} supports certificate-based +authentication and data security (integrity and confidentiality) +services through the use of TLS (or SSL). {{slapd}}'s TLS +implementation can utilize {{PRD:OpenSSL}}, {{PRD:GnuTLS}}, +or {{PRD:MozNSS}} software. + +{{B:Topology control}}: {{slapd}} can be configured to restrict +access at the socket layer based upon network topology information. +This feature utilizes {{TCP wrappers}}. + +{{B:Access control}}: {{slapd}} provides a rich and powerful access +control facility, allowing you to control access to the information +in your database(s). You can control access to entries based on +LDAP authorization information, {{TERM:IP}} address, domain name +and other criteria. {{slapd}} supports both {{static}} and {{dynamic}} +access control information. + +{{B:Internationalization}}: {{slapd}} supports Unicode and language +tags. + +{{B:Choice of database backends}}: {{slapd}} comes with a variety +of different database backends you can choose from. They include +{{TERM:MDB}}, a hierarchical high-performance transactional database backend; +{{TERM:BDB}}, a high-performance transactional database backend (deprecated); +{{TERM:HDB}}, a hierarchical high-performance transactional +backend (deprecated); {{SHELL}}, a backend interface to arbitrary shell scripts; +and PASSWD, a simple backend interface to the {{passwd}}(5) file. +The MDB backend utilizes {{TERM:LMDB}}, a high performance replacement +for {{ORG[expand]Oracle}}'s Berkeley DB. +The BDB and HDB backends utilize {{ORG[expand]Oracle}} Berkeley DB. These +backends have been deprecated as LMDB provides significantly higher read +and write throughput and data reliability. + +{{B:Multiple database instances}}: {{slapd}} can be configured to +serve multiple databases at the same time. This means that a single +{{slapd}} server can respond to requests for many logically different +portions of the LDAP tree, using the same or different database +backends. + +{{B:Generic modules API}}: If you require even more customization, +{{slapd}} lets you write your own modules easily. {{slapd}} consists +of two distinct parts: a front end that handles protocol communication +with LDAP clients; and modules which handle specific tasks such as +database operations. Because these two pieces communicate via a +well-defined {{TERM:C}} {{TERM:API}}, you can write your own +customized modules which extend {{slapd}} in numerous ways. Also, +a number of {{programmable database}} modules are provided. These +allow you to expose external data sources to {{slapd}} using popular +programming languages ({{PRD:Perl}}, {{shell}}, and {{TERM:SQL}}). + +{{B:Threads}}: {{slapd}} is threaded for high performance. A single +multi-threaded {{slapd}} process handles all incoming requests using +a pool of threads. This reduces the amount of system overhead +required while providing high performance. + +{{B:Replication}}: {{slapd}} can be configured to maintain shadow +copies of directory information. This {{single-master/multiple-slave}} +replication scheme is vital in high-volume environments where a +single {{slapd}} installation just doesn't provide the necessary availability +or reliability. For extremely demanding environments where a +single point of failure is not acceptable, {{multi-master}} replication +is also available. {{slapd}} includes support for {{LDAP Sync}}-based +replication. + +{{B:Proxy Cache}}: {{slapd}} can be configured as a caching +LDAP proxy service. + +{{B:Configuration}}: {{slapd}} is highly configurable through a +single configuration file which allows you to change just about +everything you'd ever want to change. Configuration options have +reasonable defaults, making your job much easier. Configuration can +also be performed dynamically using LDAP itself, which greatly +improves manageability. + diff --git a/doc/guide/admin/intro_dctree.png b/doc/guide/admin/intro_dctree.png Binary files differnew file mode 100644 index 0000000..099588c --- /dev/null +++ b/doc/guide/admin/intro_dctree.png diff --git a/doc/guide/admin/intro_tree.png b/doc/guide/admin/intro_tree.png Binary files differnew file mode 100644 index 0000000..043b51e --- /dev/null +++ b/doc/guide/admin/intro_tree.png diff --git a/doc/guide/admin/ldap-sync-refreshandpersist.png b/doc/guide/admin/ldap-sync-refreshandpersist.png Binary files differnew file mode 100644 index 0000000..f6a2232 --- /dev/null +++ b/doc/guide/admin/ldap-sync-refreshandpersist.png diff --git a/doc/guide/admin/ldap-sync-refreshonly.png b/doc/guide/admin/ldap-sync-refreshonly.png Binary files differnew file mode 100644 index 0000000..7f4a95e --- /dev/null +++ b/doc/guide/admin/ldap-sync-refreshonly.png diff --git a/doc/guide/admin/limits.sdf b/doc/guide/admin/limits.sdf new file mode 100644 index 0000000..a284961 --- /dev/null +++ b/doc/guide/admin/limits.sdf @@ -0,0 +1,244 @@ +# $Id$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +# This contribution is derived from OpenLDAP Software. +# All of the modifications to OpenLDAP Software represented in this contribution +# were developed by Andrew Findlay <andrew.findlay@skills-1st.co.uk>. +# I have not assigned rights and/or interest in this work to any party. +# +# Copyright 2008 Andrew Findlay +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP Public License. + +H1: Limits + +H2: Introduction + +It is usually desirable to limit the server resources that can be +consumed by each LDAP client. OpenLDAP provides two sets of limits: +a size limit, which can restrict the {{number}} of entries that a +client can retrieve in a single operation, and a time limit +which restricts the length of time that an operation may continue. +Both types of limit can be given different values depending on who +initiated the operation. + +H2: Soft and Hard limits + +The server administrator can specify both {{soft limits}} and +{{hard limits}}. Soft limits can be thought of as being the +default limit value. Hard limits cannot be exceeded by ordinary +LDAP users. + +LDAP clients can specify their own +size and time limits when issuing search operations. +This feature has been present since the earliest version of X.500. + +If the client specifies a limit then the lower of the requested value +and the {{hard limit}} will become the limit for the operation. + +If the client does not specify a limit then the server applies the +{{soft limit}}. + +Soft and Hard limits are often referred to together as {{administrative +limits}}. Thus, if an LDAP client requests a search that would return +more results than the limits allow it will get an {{adminLimitExceeded}} +error. Note that the server will usually return some results even if +the limit has been exceeded: this feature is useful to clients that +just want to check for the existence of some entries without needing +to see them all. + +The {{rootdn}} is not subject to any limits. + +H2: Global Limits + +Limits specified in the global part of the server configuration act +as defaults which are used if no database has more specific limits set. + +In a {{slapd.conf}}(5) configuration the keywords are {{EX:sizelimit}} and +{{EX:timelimit}}. When using the {{slapd config}} backend, the corresponding +attributes are {{EX:olcSizeLimit}} and {{EX:olcTimeLimit}}. The syntax of +these values are the same in both cases. + +The simple form sets both soft and hard limits to the same value: + +> sizelimit {<integer>|unlimited} +> timelimit {<integer>|unlimited} + +The default sizelimit is 500 entries and the default timelimit is +3600 seconds. + +An extended form allows soft and hard limits to be set separately: + +> sizelimit size[.{soft|hard|unchecked}]=<integer> [...] +> timelimit time[.{soft|hard}]=<integer> [...] + +Thus, to set a soft sizelimit of 10 entries and a hard limit of 75 entries: + +E: sizelimit size.soft=10 size.hard=75 + +The {{unchecked}} keyword sets a limit on how many entries the server +will examine once it has created an initial set of candidate results by +using indices. This can be very important in a large directory, as a +search that cannot be satisfied from an index might cause the server to +examine millions of entries, therefore always make sure the correct indexes +are configured. + +H2: Per-Database Limits + +Each database can have its own set of limits that override the global +ones. The syntax is more flexible, and it allows different limits to +be applied to different entities. Note that an {{entity}} is different from +an {{entry}}: the term {{entity}} is used here to indicate the ID of the +person or process that has initiated the LDAP operation. + +In a {{slapd.conf}}(5) configuration the keyword is {{EX:limits}}. +When using the {{slapd config}} backend, the corresponding +attribute is {{EX:olcLimits}}. The syntax of +the values is the same in both cases. + +> limits <selector> <limit> [<limit> [...]] + +The {{limits}} clause can be specified multiple times to apply different +limits to different initiators. The server examines each clause in turn +until it finds one that matches the operation's initiator or base DN. +If no match is found, the global limits will be used. + +H3: Specify who the limits apply to + +The {{EX:<selector>}} part of the {{limits}} clause can take any of these values: + +!block table; align=Center; coltags="EX,N"; \ + title="Table 9.1: Limits Entity Specifiers" +Specifier|Entities +*|All, including anonymous and authenticated users +anonymous|Anonymous (non-authenticated) users +users|Authenticated users +dn[.<type>][.<style>]=<pattern>]|Entry or entries within a scope that match <pattern> +group[/oc[/at]]=<pattern>|Members of a group +!endblock + +Where + +{{type}} can be one of self or this and + +{{style}} can be one of exact, base, onelevel, subtree, children, regex, or anonymous + +More information can be found in the {{slapd.conf}}(5) or {{slapd-config}}(5) manual +pages. + +H3: Specify time limits + +The syntax for time limits is + +E: time[.{soft|hard}]=<integer> + +where integer is the number of seconds slapd will spend +answering a search request. + +If neither {{soft}} nor {{hard}} is specified, the value is used for both, +e.g.: + +E: limits anonymous time=27 + +The value {{unlimited}} may be used to remove the hard time limit entirely, +e.g.: + +E: limits dn.exact="cn=anyuser,dc=example,dc=org" time.hard=unlimited + +H3: Specifying size limits + +The syntax for size limit is + +E: size[.{soft|hard|unchecked}]=<integer> + +where {{EX:<integer>}} is the maximum number of entries slapd will return +when answering a search request. + +Soft, hard, and "unchecked" limits are available, with the same meanings +described for the global limits configuration above. + +H3: Size limits and Paged Results + +If the LDAP client adds the {{pagedResultsControl}} to the search operation, +the hard size limit is used by default, because the request for a specific +page size is considered an explicit request for a limitation on the number +of entries to be returned. However, the size limit applies to the total +count of entries returned within the search, and not to a single page. + +Additional size limits may be enforced for paged searches. + +The {{EX:size.pr}} limit controls the maximum page size: + +> size.pr={<integer>|noEstimate|unlimited} + +{{EX:<integer>}} is the maximum page size if no explicit size is set. +{{EX:noEstimate}} has no effect in the current implementation as the +server does not return an estimate of the result size anyway. +{{EX:unlimited}} indicates that no limit is applied to the maximum +page size. + +The {{EX:size.prtotal}} limit controls the total number of entries +that can be returned by a paged search. By default the limit is the +same as the normal {{EX:size.hard}} limit. + +> size.prtotal={<integer>|unlimited|disabled} + +{{EX:unlimited}} removes the limit on the number of entries that can be +returned by a paged search. +{{EX:disabled}} can be used to selectively disable paged result searches. + +H2: Example Limit Configurations + +H3: Simple Global Limits + +This simple global configuration fragment applies size and time limits +to all searches by all users except {{rootdn}}. It limits searches to +50 results and sets an overall time limit of 10 seconds. + +E: sizelimit 50 +E: timelimit 10 + +H3: Global Hard and Soft Limits + +It is sometimes useful to limit the size of result sets but to allow +clients to request a higher limit where needed. This can be achieved +by setting separate hard and soft limits. + +E: sizelimit size.soft=5 size.hard=100 + +To prevent clients from doing very inefficient non-indexed searches, +add the {{unchecked}} limit: + +E: sizelimit size.soft=5 size.hard=100 size.unchecked=100 + +H3: Giving specific users larger limits + +Having set appropriate default limits in the global configuration, +you may want to give certain users the ability to retrieve larger +result sets. Here is a way to do that in the per-database configuration: + +E: limits dn.exact="cn=anyuser,dc=example,dc=org" size=100000 +E: limits dn.exact="cn=personnel,dc=example,dc=org" size=100000 +E: limits dn.exact="cn=dirsync,dc=example,dc=org" size=100000 + +It is generally best to avoid mentioning specific users in the server +configuration. A better way is to give the higher limits to a group: + +E: limits group/groupOfNames/member="cn=bigwigs,dc=example,dc=org" size=100000 + +H3: Limiting who can do paged searches + +It may be required that certain applications need very large result sets that +they retrieve using paged searches, but that you do not want ordinary +LDAP users to use the pagedResults control. The {{pr}} and {{prtotal}} +limits can help: + +E: limits group/groupOfNames/member="cn=dirsync,dc=example,dc=org" size.prtotal=unlimited +E: limits users size.soft=5 size.hard=100 size.prtotal=disabled +E: limits anonymous size.soft=2 size.hard=5 size.prtotal=disabled + +H2: Further Information + +For further information please see {{slapd.conf}}(5), {{ldapsearch}}(1) and {{slapd.access}}(5) + diff --git a/doc/guide/admin/maintenance.sdf b/doc/guide/admin/maintenance.sdf new file mode 100644 index 0000000..db4b584 --- /dev/null +++ b/doc/guide/admin/maintenance.sdf @@ -0,0 +1,166 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Maintenance + +System Administration is all about maintenance, so it is only fair that we +discuss how to correctly maintain an OpenLDAP deployment. + + +H2: Directory Backups + +Backup strategies largely depend on the amount of change in the database +and how much of that change an administrator might be willing to lose in a +catastrophic failure. There are two basic methods that can be used: + +1. Backup the Berkeley database itself and periodically back up the transaction +log files: + +Berkeley DB produces transaction logs that can be used to reconstruct +changes from a given point in time. For example, if an administrator were willing to only +lose one hour's worth of changes, they could take down the server in +the middle of the night, copy the Berkeley database files offsite, and bring +the server back online. Then, on an hourly basis, they could force a +database checkpoint, capture the log files that have been generated in the +past hour, and copy them offsite. The accumulated log files, in combination +with the previous database backup, could be used with db_recover to +reconstruct the database up to the time the last collection of log files was +copied offsite. This method affords good protection, with minimal space +overhead. + + +2. Periodically run slapcat and back up the LDIF file: + +Slapcat can be run while slapd is active. However, one runs the risk of an +inconsistent database- not from the point of slapd, but from the point of +the applications using LDAP. For example, if a provisioning application +performed tasks that consisted of several LDAP operations, and the slapcat +took place concurrently with those operations, then there might be +inconsistencies in the LDAP database from the point of view of that +provisioning application and applications that depended on it. One must, +therefore, be convinced something like that won't happen. One way to do that +would be to put the database in read-only mode while performing the +slapcat. The other disadvantage of this approach is that the generated LDIF +files can be rather large and the accumulation of the day's backups could +add up to a substantial amount of space. + +You can use {{slapcat}}(8) to generate an LDIF file for each of your {{slapd}}(8) +back-bdb or back-hdb databases. + +> slapcat -f slapd.conf -b "dc=example,dc=com" + +For back-bdb and back-hdb, this command may be ran while slapd(8) is running. + +MORE on actual Berkeley DB backups later covering db_recover etc. + +H2: Berkeley DB Logs + +Berkeley DB log files grow, and the administrator has to deal with it. The +procedure is known as log file archival or log file rotation. + +Note: The actual log file rotation is handled by the Berkeley DB engine. + +Logs of current transactions need to be stored into files so that the database +can be recovered in the event of an application crash. Administrators can change +the size limit of a single log file (by default 10MB), and have old log files +removed automatically, by setting up DB environment (see below). The reason +Berkeley DB never deletes any log files by default is that the administrator +may wish to backup the log files before removal to make database recovery +possible even after a catastrophic failure, such as file system corruption. + +Log file names are {{F:log.XXXXXXXXXX}} (X is a digit). By default the log files +are located in the BDB backend directory. The {{F:db_archive}} tool knows what +log files are used in current transactions, and what are not. Administrators can +move unused log files to a backup media, and delete them. To have them removed +automatically, place set_flags {{DB_LOG_AUTOREMOVE}} directive in {{F:DB_CONFIG}}. + +Note: If the log files are removed automatically, recovery after a catastrophic +failure is likely to be impossible. + +The files with names {{F:__db.001}}, {{F:__db.002}}, etc are just shared memory +regions (or whatever). These ARE NOT 'logs', they must be left alone. Don't be +afraid of them, they do not grow like logs do. + +To understand the {{F:db_archive}} interface, the reader should refer to +chapter 9 of the Berkeley DB guide. In particular, the following chapters are +recommended: + +* Database and log file archival - {{URL:http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/archival.html}} +* Log file removal - {{URL:http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/logfile.html}} +* Recovery procedures - {{URL:http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/recovery.html}} +* Hot failover - {{URL:http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/hotfail.html}} +* Complete list of Berkeley DB flags - {{URL:http://www.oracle.com/technology/documentation/berkeley-db/db/api_c/env_set_flags.html}} + +Advanced installations can use special environment settings to fine-tune some +Berkeley DB options (change the log file limit, etc). This can be done by using +the {{F:DB_CONFIG}} file. This magic file can be created in BDB backend directory +set up by {{slapd.conf}}(5). More information on this file can be found in File +naming chapter. Specific directives can be found in C Interface, look for +{{DB_ENV->set_XXXX}} calls. + +Note: options set in {{F:DB_CONFIG}} file override options set by OpenLDAP. +Use them with extreme caution. Do not use them unless You know what You are doing. + +The advantages of {{F:DB_CONFIG}} usage can be the following: + +* to keep data files and log files on different mediums (i.e. disks) to improve + performance and/or reliability; +* to fine-tune some specific options (such as shared memory region sizes); +* to set the log file limit (please read Log file limits before doing this). + +To figure out the best-practice BDB backup scenario, the reader is highly +recommended to read the whole Chapter 9: Berkeley DB Transactional Data Store Applications. +This chapter is a set of small pages with examples in C language. Non-programming +people can skip these examples without loss of knowledge. + + +H2: Checkpointing + +MORE/TIDY + +If you put "checkpoint 1024 5" in slapd.conf (to checkpoint after 1024kb or 5 minutes, +for example), this does not checkpoint every 5 minutes as you may think. +The explanation from Howard is: + +'In OpenLDAP 2.1 and 2.2 the checkpoint directive acts as follows - *when there +is a write operation*, and more than <check> minutes have occurred since the +last checkpoint, perform the checkpoint. If more than <check> minutes pass after +a write without any other write operations occurring, no checkpoint is performed, +so it's possible to lose the last write that occurred.'' + +In other words, a write operation occurring less than "check" minutes after the +last checkpoint will not be checkpointed until the next write occurs after "check" +minutes have passed since the checkpoint. + +This has been modified in 2.3 to indeed checkpoint every so often; in the meantime +a workaround is to invoke "db_checkpoint" from a cron script every so often, say 5 minutes. + +H2: Migration + +The simplest steps needed to migrate between versions or upgrade, depending on your deployment +type are: + +.{{S: }} +^{{B: Stop the current server when convenient}} + +.{{S: }} ++{{B: slapcat the current data out}} + +.{{S: }} ++{{B: Clear out the current data directory (/usr/local/var/openldap-data/) leaving DB_CONFIG in place}} + +.{{S: }} ++{{B: Perform the software upgrades}} + +.{{S: }} ++{{B: slapadd the exported data back into the directory}} + +.{{S: }} ++{{B: Start the server}} + +Obviously this doesn't cater for any complicated deployments like {{SECT: MirrorMode}} or {{SECT: N-Way Multi-Master}}, +but following the above sections and using either commercial support or community support should help. Also check the +{{SECT: Troubleshooting}} section. + + diff --git a/doc/guide/admin/master.sdf b/doc/guide/admin/master.sdf new file mode 100644 index 0000000..7e0c3a8 --- /dev/null +++ b/doc/guide/admin/master.sdf @@ -0,0 +1,138 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +# +# master file for the OpenLDAP Administrator's Guide +# +# +# To generate guide for distribution: +# sdf -2html guide.sdf +# sdf -2txt guide.sdf +# cp guide.{html,txt} $distribution/doc/guide +# +# To generate pages for web +# sdf -2topics index.sdf +# +!include "../preamble.sdf"; plain + +# title information +!include "title.sdf" +PB: + +# Document copyright, publishing info, acknowledgements, preface +!include "preface.sdf"; about +PB: + +# Chapters +!include "intro.sdf"; chapter +PB: + +!include "quickstart.sdf"; chapter +PB: + +!include "config.sdf"; chapter +PB: + +!include "install.sdf"; chapter +PB: + +!include "slapdconf2.sdf"; chapter +PB: + +!include "slapdconfig.sdf"; chapter +PB: + +!include "runningslapd.sdf"; chapter +PB: + +!include "access-control.sdf"; chapter +PB: + +!include "limits.sdf"; chapter +PB: + +!include "dbtools.sdf"; chapter +PB: + +!include "backends.sdf"; chapter +PB: + +!include "overlays.sdf"; chapter +PB: + +!include "schema.sdf"; chapter +PB: + +!include "security.sdf"; chapter +PB: + +!include "sasl.sdf"; chapter +PB: + +!include "tls.sdf"; chapter +PB: + +!include "referrals.sdf"; chapter +PB: + +!include "replication.sdf"; chapter +PB: + +!include "maintenance.sdf"; chapter +PB: + +!include "monitoringslapd.sdf"; chapter +PB: + +!include "tuning.sdf"; chapter +PB: + +!include "troubleshooting.sdf"; chapter +PB: + +# Appendices +!include "appendix-changes.sdf"; appendix +PB: + +# Upgrade from 2.3.x +!include "appendix-upgrading.sdf"; appendix +PB: + +# Common Errors +!include "appendix-common-errors.sdf"; appendix +PB: + +# What versions we recommend +!include "appendix-recommended-versions.sdf"; appendix +PB: + +# Real Deployments +!include "appendix-deployments.sdf"; appendix +PB: + +# Contributions +!include "appendix-contrib.sdf"; appendix +PB: + +# Config file examples +!include "appendix-configs.sdf"; appendix +PB: + +# LDAP Result Codes +!include "appendix-ldap-result-codes.sdf"; appendix +PB: + + +# Terms +!include "glossary.sdf"; appendix +PB: + +# Autoconf +!include "../release/autoconf.sdf"; appendix +PB: + +# Software Copyright/License +!include "../release/copyright.sdf"; appendix +PB: + +!include "../release/license.sdf"; appendix diff --git a/doc/guide/admin/monitoringslapd.sdf b/doc/guide/admin/monitoringslapd.sdf new file mode 100644 index 0000000..aa40a86 --- /dev/null +++ b/doc/guide/admin/monitoringslapd.sdf @@ -0,0 +1,505 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +H1: Monitoring + +{{slapd}}(8) supports an optional {{TERM:LDAP}} monitoring interface +you can use to obtain information regarding the current state of +your {{slapd}} instance. For instance, the interface allows you +to determine how many clients are connected to the server currently. +The monitoring information is provided by a specialized backend, +the {{monitor}} backend. A manual page, {{slapd-monitor}}(5) is +available. + +When the monitoring interface is enabled, LDAP clients may be used +to access information provided by the {{monitor}} backend, subject +to access and other controls. + +When enabled, the {{monitor}} backend dynamically generates and +returns objects in response to search requests in the {{cn=Monitor}} +subtree. Each object contains information about a particular aspect +of the server. The information is held in a combination of user +applications and operational attributes. This information can be +access with {{ldapsearch(1)}}, with any general-purpose LDAP browser, +or with specialized monitoring tools. The {{SECT:Accessing Monitoring +Information}} section provides a brief tutorial on how to use +{{ldapsearch}}(1) to access monitoring information, while the +{{SECT:Monitor information}} section details monitoring information +base and its organization. + +While support for the monitor backend is included in default builds +of slapd(8), this support requires some configuration to become +active. This may be done using either {{EX:cn=config}} or +{{slapd.conf}}(5). The former is discussed in the {{SECT:Monitor +configuration via cn=config}} section of this of this chapter. The +latter is discussed in the {{SECT:Monitor configuration via +slapd.conf(5)}} section of this chapter. These sections assume +monitor backend is built into {{slapd}} (e.g., {{EX:--enable-monitor=yes}}, +the default). If the monitor backend was built as a module (e.g., +{{EX:--enable-monitor=mod}}, this module must loaded. Loading of +modules is discussed in the {{SECT:Configuring slapd}} and {{SECT:The +slapd Configuration File}} chapters. + + +H2: Monitor configuration via cn=config(5) + +{{This section has yet to be written.}} + + +H2: Monitor configuration via slapd.conf(5) + +Configuration of the slapd.conf(5) to support LDAP monitoring +is quite simple. + +First, ensure {{core.schema}} schema configuration file is included +by your {{slapd.conf}}(5) file. The {{monitor}} backend requires +it. + +Second, instantiate the {{monitor backend}} by adding a +{{database monitor}} directive below your existing database +sections. For instance: + +> database monitor + +Lastly, add additional global or database directives as needed. + +Like most other database backends, the monitor backend does honor +slapd(8) access and other administrative controls. As some monitor +information may be sensitive, it is generally recommend access to +cn=monitor be restricted to directory administrators and their +monitoring agents. Adding an {{access}} directive immediately below +the {{database monitor}} directive is a clear and effective approach +for controlling access. For instance, the addition of the following +{{access}} directive immediately below the {{database monitor}} +directive restricts access to monitoring information to the specified +directory manager. + +> access to * +> by dn.exact="cn=Manager,dc=example,dc=com +> by * none + +More information on {{slapd}}(8) access controls, see {{The access +Control Directive}} section of the {{SECT:The slapd Configuration +File}} chapter and {{slapd.access}}(5). + +After restarting {{slapd}}(8), you are ready to start exploring the +monitoring information provided in {{EX:cn=config}} as discussed +in the {{SECT:Accessing Monitoring Information}} section of this +chapter. + +One can verify slapd(8) is properly configured to provide monitoring +information by attempting to read the {{EX:cn=monitor}} object. +For instance, if the following {{ldapsearch}}(1) command returns the +cn=monitor object (with, as requested, no attributes), it's working. + +> ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -W \ +> -b 'cn=Monitor' -s base 1.1 + +Note that unlike general purpose database backends, the database +suffix is hardcoded. It's always {{EX:cn=Monitor}}. So no {{suffix}} +directive should be provided. Also note that general purpose +database backends, the monitor backend cannot be instantiated +multiple times. That is, there can only be one (or zero) occurrences +of {{EX:database monitor}} in the server's configuration. + + +H2: Accessing Monitoring Information + +As previously discussed, when enabled, the {{monitor}} backend +dynamically generates and returns objects in response to search +requests in the {{cn=Monitor}} subtree. Each object contains +information about a particular aspect of the server. The information +is held in a combination of user applications and operational +attributes. This information can be accessed with {{ldapsearch(1)}}, +with any general-purpose LDAP browser, or with specialized monitoring +tools. + +This section provides a provides a brief tutorial on how to use +{{ldapsearch}}(1) to access monitoring information. + +To inspect any particular monitor object, one performs search +operation on the object with a baseObject scope and a +{{EX:(objectClass=*)}} filter. As the monitoring information is +contained in a combination of user applications and operational +attributes, the return all user applications attributes (e.g., +{{EX:'*'}}) and all operational attributes (e.g., {{EX:'+'}}) should +be requested. For instance, to read the {{EX:cn=Monitor}} object +itself, the {{ldapsearch}}(1) command (modified to fit your configuration) +can be used: + +> ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -W \ +> -b 'cn=Monitor' -s base '(objectClass=*)' '*' '+' + +When run against your server, this should produce output +similar to: + +> dn: cn=Monitor +> objectClass: monitorServer +> structuralObjectClass: monitorServer +> cn: Monitor +> creatorsName: +> modifiersName: +> createTimestamp: 20061208223558Z +> modifyTimestamp: 20061208223558Z +> description: This subtree contains monitoring/managing objects. +> description: This object contains information about this server. +> description: Most of the information is held in operational attributes, which +> must be explicitly requested. +> monitoredInfo: OpenLDAP: slapd 2.4 (Dec 7 2006 17:30:29) +> entryDN: cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: TRUE + +To reduce the number of uninteresting attributes returned, one +can be more selective when requesting which attributes are to be +returned. For instance, one could request the return of all +attributes allowed by the {{monitorServer}} object class (e.g., +{{EX:@objectClass}}) instead of all user and all operational +attributes: + +> ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -W \ +> -b 'cn=Monitor' -s base '(objectClass=*)' '@monitorServer' + +This limits the output as follows: + +> dn: cn=Monitor +> objectClass: monitorServer +> cn: Monitor +> description: This subtree contains monitoring/managing objects. +> description: This object contains information about this server. +> description: Most of the information is held in operational attributes, which +> must be explicitly requested. +> monitoredInfo: OpenLDAP: slapd 2.X (Dec 7 2006 17:30:29) + +To return the names of all the monitoring objects, one performs a +search of {{EX:cn=Monitor}} with subtree scope and {{EX:(objectClass=*)}} +filter and requesting no attributes (e.g., {{EX:1.1}}) be returned. + +> ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -W -b 'cn=Monitor' -s sub 1.1 + +If you run this command you will discover that there are many objects +in the {{cn=Monitor}} subtree. The following section describes +some of the commonly available monitoring objects. + + +H2: Monitor Information + +The {{monitor}} backend provides a wealth of information useful +for monitoring the slapd(8) contained in set of monitor objects. +Each object contains information about a particular aspect of +the server, such as a backends, a connection, or a thread. +Some objects serve as containers for other objects and used +to construct a hierarchy of objects. + +In this hierarchy, the most superior object is {cn=Monitor}. +While this object primarily serves as a container for other +objects, most of which are containers, this object provides +information about this server. In particular, it provides the +slapd(8) version string. Example: + +> dn: cn=Monitor +> monitoredInfo: OpenLDAP: slapd 2.X (Dec 7 2006 17:30:29) + +Note: Examples in this section (and its subsections) have been +trimmed to show only key information. + + +H3: Backends + +The {{EX:cn=Backends,cn=Monitor}} object, itself, provides a list +of available backends. The list of available backends all builtin +backends, as well as backends loaded by modules. For example: + +> dn: cn=Backends,cn=Monitor +> monitoredInfo: config +> monitoredInfo: ldif +> monitoredInfo: monitor +> monitoredInfo: bdb +> monitoredInfo: hdb + +This indicates the {{config}}, {{ldif}}, {{monitor}}, {{bdb}}, +and {{hdb}} backends are available. + +The {{EX:cn=Backends,cn=Monitor}} object is also a container +for available backend objects. Each available backend object +contains information about a particular backend. For example: + +> dn: cn=Backend 0,cn=Backends,cn=Monitor +> monitoredInfo: config +> monitorRuntimeConfig: TRUE +> supportedControl: 2.16.840.1.113730.3.4.2 +> seeAlso: cn=Database 0,cn=Databases,cn=Monitor +> +> dn: cn=Backend 1,cn=Backends,cn=Monitor +> monitoredInfo: ldif +> monitorRuntimeConfig: TRUE +> supportedControl: 2.16.840.1.113730.3.4.2 +> +> dn: cn=Backend 2,cn=Backends,cn=Monitor +> monitoredInfo: monitor +> monitorRuntimeConfig: TRUE +> supportedControl: 2.16.840.1.113730.3.4.2 +> seeAlso: cn=Database 2,cn=Databases,cn=Monitor +> +> dn: cn=Backend 3,cn=Backends,cn=Monitor +> monitoredInfo: bdb +> monitorRuntimeConfig: TRUE +> supportedControl: 1.3.6.1.1.12 +> supportedControl: 2.16.840.1.113730.3.4.2 +> supportedControl: 1.3.6.1.4.1.4203.666.5.2 +> supportedControl: 1.2.840.113556.1.4.319 +> supportedControl: 1.3.6.1.1.13.1 +> supportedControl: 1.3.6.1.1.13.2 +> supportedControl: 1.3.6.1.4.1.4203.1.10.1 +> supportedControl: 1.2.840.113556.1.4.1413 +> supportedControl: 1.3.6.1.4.1.4203.666.11.7.2 +> seeAlso: cn=Database 1,cn=Databases,cn=Monitor +> +> dn: cn=Backend 4,cn=Backends,cn=Monitor +> monitoredInfo: hdb +> monitorRuntimeConfig: TRUE +> supportedControl: 1.3.6.1.1.12 +> supportedControl: 2.16.840.1.113730.3.4.2 +> supportedControl: 1.3.6.1.4.1.4203.666.5.2 +> supportedControl: 1.2.840.113556.1.4.319 +> supportedControl: 1.3.6.1.1.13.1 +> supportedControl: 1.3.6.1.1.13.2 +> supportedControl: 1.3.6.1.4.1.4203.1.10.1 +> supportedControl: 1.2.840.113556.1.4.1413 +> supportedControl: 1.3.6.1.4.1.4203.666.11.7.2 + +For each of these objects, monitorInfo indicates which backend the +information in the object is about. For instance, the {{EX:cn=Backend +3,cn=Backends,cn=Monitor}} object contains (in the example) information +about the {{bdb}} backend. + +!block table +Attribute|Description +monitoredInfo|Name of backend +supportedControl|supported LDAP control extensions +seeAlso|Database objects of instances of this backend +!endblock + +H3: Connections + +The main entry is empty; it should contain some statistics on the number +of connections. + +Dynamic child entries are created for each open connection, with stats on +the activity on that connection (the format will be detailed later). +There are two special child entries that show the number of total and +current connections respectively. + +For example: + +Total Connections: + +> dn: cn=Total,cn=Connections,cn=Monitor +> structuralObjectClass: monitorCounterObject +> monitorCounter: 4 +> entryDN: cn=Total,cn=Connections,cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: FALSE + +Current Connections: + +> dn: cn=Current,cn=Connections,cn=Monitor +> structuralObjectClass: monitorCounterObject +> monitorCounter: 2 +> entryDN: cn=Current,cn=Connections,cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: FALSE + + +H3: Databases + +The main entry contains the naming context of each configured database; +the child entries contain, for each database, the type and the naming +context. + +For example: + +> dn: cn=Database 2,cn=Databases,cn=Monitor +> structuralObjectClass: monitoredObject +> monitoredInfo: monitor +> monitorIsShadow: FALSE +> monitorContext: cn=Monitor +> readOnly: FALSE +> entryDN: cn=Database 2,cn=Databases,cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: FALSE + +H3: Listener + +It contains the description of the devices the server is currently +listening on: + +> dn: cn=Listener 0,cn=Listeners,cn=Monitor +> structuralObjectClass: monitoredObject +> monitorConnectionLocalAddress: IP=0.0.0.0:389 +> entryDN: cn=Listener 0,cn=Listeners,cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: FALSE + + +H3: Log + +It contains the currently active log items. The {{Log}} subsystem allows +user modify operations on the {{description}} attribute, whose values {{MUST}} +be in the list of admittable log switches: + +> Trace +> Packets +> Args +> Conns +> BER +> Filter +> Config +> ACL +> Stats +> Stats2 +> Shell +> Parse +> Sync + +These values can be added, replaced or deleted; they affect what +messages are sent to the syslog device. +Custom values could be added by custom modules. + +H3: Operations + +It shows some statistics on the operations performed by the server: + +> Initiated +> Completed + +and for each operation type, i.e.: + +> Bind +> Unbind +> Add +> Delete +> Modrdn +> Modify +> Compare +> Search +> Abandon +> Extended + +There are too many types to list example here, so please try for yourself +using {{SECT: Monitor search example}} + +H3: Overlays + +The main entry contains the type of overlays available at run-time; +the child entries, for each overlay, contain the type of the overlay. + +It should also contain the modules that have been loaded if dynamic +overlays are enabled: + +> # Overlays, Monitor +> dn: cn=Overlays,cn=Monitor +> structuralObjectClass: monitorContainer +> monitoredInfo: syncprov +> monitoredInfo: accesslog +> monitoredInfo: glue +> entryDN: cn=Overlays,cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: TRUE + +H3: SASL + +Currently empty. + +H3: Statistics + +It shows some statistics on the data sent by the server: + +> Bytes +> PDU +> Entries +> Referrals + +e.g. + +> # Entries, Statistics, Monitor +> dn: cn=Entries,cn=Statistics,cn=Monitor +> structuralObjectClass: monitorCounterObject +> monitorCounter: 612248 +> entryDN: cn=Entries,cn=Statistics,cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: FALSE + +H3: Threads + +It contains the maximum number of threads enabled at startup and the +current backload. + +e.g. + +> # Max, Threads, Monitor +> dn: cn=Max,cn=Threads,cn=Monitor +> structuralObjectClass: monitoredObject +> monitoredInfo: 16 +> entryDN: cn=Max,cn=Threads,cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: FALSE + + +H3: Time + +It contains two child entries with the start time and the current time +of the server. + +e.g. + +Start time: + +> dn: cn=Start,cn=Time,cn=Monitor +> structuralObjectClass: monitoredObject +> monitorTimestamp: 20061205124040Z +> entryDN: cn=Start,cn=Time,cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: FALSE + +Current time: + +> dn: cn=Current,cn=Time,cn=Monitor +> structuralObjectClass: monitoredObject +> monitorTimestamp: 20061207120624Z +> entryDN: cn=Current,cn=Time,cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: FALSE + +H3: TLS + +Currently empty. + +H3: Waiters + +It contains the number of current read waiters. + +e.g. + +Read waiters: + +> dn: cn=Read,cn=Waiters,cn=Monitor +> structuralObjectClass: monitorCounterObject +> monitorCounter: 7 +> entryDN: cn=Read,cn=Waiters,cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: FALSE + +Write waiters: + +> dn: cn=Write,cn=Waiters,cn=Monitor +> structuralObjectClass: monitorCounterObject +> monitorCounter: 0 +> entryDN: cn=Write,cn=Waiters,cn=Monitor +> subschemaSubentry: cn=Subschema +> hasSubordinates: FALSE + +Add new monitored things here and discuss, referencing man pages and present +examples + + diff --git a/doc/guide/admin/n-way-multi-master.png b/doc/guide/admin/n-way-multi-master.png Binary files differnew file mode 100644 index 0000000..8eadf77 --- /dev/null +++ b/doc/guide/admin/n-way-multi-master.png diff --git a/doc/guide/admin/overlays.sdf b/doc/guide/admin/overlays.sdf new file mode 100644 index 0000000..5a91dc5 --- /dev/null +++ b/doc/guide/admin/overlays.sdf @@ -0,0 +1,1469 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Overlays + +Overlays are software components that provide hooks to functions analogous to +those provided by backends, which can be stacked on top of the backend calls +and as callbacks on top of backend responses to alter their behavior. + +Overlays may be compiled statically into {{slapd}}, or when module support +is enabled, they may be dynamically loaded. Most of the overlays +are only allowed to be configured on individual databases. + +Some can be stacked on the {{EX:frontend}} as well, for global use. This means that +they can be executed after a request is parsed and validated, but right before the +appropriate database is selected. The main purpose is to affect operations +regardless of the database they will be handled by, and, in some cases, +to influence the selection of the database by massaging the request DN. + +Essentially, overlays represent a means to: + + * customize the behavior of existing backends without changing the backend + code and without requiring one to write a new custom backend with + complete functionality + * write functionality of general usefulness that can be applied to + different backend types + +When using {{slapd.conf}}(5), overlays that are configured before any other +databases are considered global, as mentioned above. In fact they are implicitly +stacked on top of the {{EX:frontend}} database. They can also be explicitly +configured as such: + +> database frontend +> overlay <overlay name> + +Overlays are usually documented by separate specific man pages in section 5; +the naming convention is + +> slapo-<overlay name> + +All distributed core overlays have a man page. Feel free to contribute to any, +if you think there is anything missing in describing the behavior of the component +and the implications of all the related configuration directives. + +Official overlays are located in + +> servers/slapd/overlays/ + +That directory also contains the file slapover.txt, which describes the +rationale of the overlay implementation, and may serve as a guideline for the +development of custom overlays. + +Contribware overlays are located in + +> contrib/slapd-modules/<overlay name>/ + +along with other types of run-time loadable components; they are officially +distributed, but not maintained by the project. + +All the current overlays in OpenLDAP are listed and described in detail in the +following sections. + + +H2: Access Logging + + +H3: Overview + +This overlay can record accesses to a given backend database on another +database. + +This allows all of the activity on a given database to be reviewed using arbitrary +LDAP queries, instead of just logging to local flat text files. Configuration +options are available for selecting a subset of operation types to log, and to +automatically prune older log records from the logging database. Log records +are stored with audit schema to assure their readability whether viewed as LDIF +or in raw form. + +It is also used for {{SECT:delta-syncrepl replication}} + +Note: An accesslog database is unique to a given master. It should +never be replicated. + +H3: Access Logging Configuration + +The following is a basic example that implements Access Logging: + +> database bdb +> suffix dc=example,dc=com +> ... +> overlay accesslog +> logdb cn=log +> logops writes reads +> logold (objectclass=person) +> +> database bdb +> suffix cn=log +> ... +> index reqStart eq +> access to * +> by dn.base="cn=admin,dc=example,dc=com" read + +The following is an example used for {{SECT:delta-syncrepl replication}}: + +> database hdb +> suffix cn=accesslog +> directory /usr/local/var/openldap-accesslog +> rootdn cn=accesslog +> index default eq +> index entryCSN,objectClass,reqEnd,reqResult,reqStart + +Accesslog overlay definitions for the primary db + +> database bdb +> suffix dc=example,dc=com +> ... +> overlay accesslog +> logdb cn=accesslog +> logops writes +> logsuccess TRUE +> # scan the accesslog DB every day, and purge entries older than 7 days +> logpurge 07+00:00 01+00:00 + +An example search result against {{B:cn=accesslog}} might look like: + +> [ghenry@suretec ghenry]# ldapsearch -x -b cn=accesslog +> # extended LDIF +> # +> # LDAPv3 +> # base <cn=accesslog> with scope subtree +> # filter: (objectclass=*) +> # requesting: ALL +> # +> +> # accesslog +> dn: cn=accesslog +> objectClass: auditContainer +> cn: accesslog +> +> # 20080110163829.000004Z, accesslog +> dn: reqStart=20080110163829.000004Z,cn=accesslog +> objectClass: auditModify +> reqStart: 20080110163829.000004Z +> reqEnd: 20080110163829.000005Z +> reqType: modify +> reqSession: 196696 +> reqAuthzID: cn=admin,dc=suretecsystems,dc=com +> reqDN: uid=suretec-46022f8$,ou=Users,dc=suretecsystems,dc=com +> reqResult: 0 +> reqMod: sambaPwdCanChange:- ###CENSORED### +> reqMod: sambaPwdCanChange:+ ###CENSORED### +> reqMod: sambaNTPassword:- ###CENSORED### +> reqMod: sambaNTPassword:+ ###CENSORED### +> reqMod: sambaPwdLastSet:- ###CENSORED### +> reqMod: sambaPwdLastSet:+ ###CENSORED### +> reqMod: entryCSN:= 20080110163829.095157Z#000000#000#000000 +> reqMod: modifiersName:= cn=admin,dc=suretecsystems,dc=com +> reqMod: modifyTimestamp:= 20080110163829Z +> +> # search result +> search: 2 +> result: 0 Success +> +> # numResponses: 3 +> # numEntries: 2 + + +H3: Further Information + +{{slapo-accesslog(5)}} and the {{SECT:delta-syncrepl replication}} section. + + +H2: Audit Logging + +The Audit Logging overlay can be used to record all changes on a given backend database to a specified log file. + +H3: Overview + +If the need arises whereby changes need to be logged as standard LDIF, then the auditlog overlay {{B:slapo-auditlog (5)}} +can be used. Full examples are available in the man page {{B:slapo-auditlog (5)}} + +H3: Audit Logging Configuration + +If the directory is running vi {{F:slapd.d}}, then the following LDIF could be used to add the overlay to the overlay list +in {{B:cn=config}} and set what file the {{TERM:LDIF}} gets logged to (adjust to suit) + +> dn: olcOverlay=auditlog,olcDatabase={1}mdb,cn=config +> changetype: add +> objectClass: olcOverlayConfig +> objectClass: olcAuditLogConfig +> olcOverlay: auditlog +> olcAuditlogFile: /tmp/auditlog.ldif + + +In this example for testing, we are logging changes to {{F:/tmp/auditlog.ldif}} + +A typical {{TERM:LDIF}} file created by {{B:slapo-auditlog(5)}} would look like: + +> # add 1196797576 dc=suretecsystems,dc=com cn=admin,dc=suretecsystems,dc=com +> dn: dc=suretecsystems,dc=com +> changetype: add +> objectClass: dcObject +> objectClass: organization +> dc: suretecsystems +> o: Suretec Systems Ltd. +> structuralObjectClass: organization +> entryUUID: 1606f8f8-f06e-1029-8289-f0cc9d81e81a +> creatorsName: cn=admin,dc=suretecsystems,dc=com +> modifiersName: cn=admin,dc=suretecsystems,dc=com +> createTimestamp: 20051123130912Z +> modifyTimestamp: 20051123130912Z +> entryCSN: 20051123130912.000000Z#000001#000#000000 +> auditContext: cn=accesslog +> # end add 1196797576 +> +> # add 1196797577 dc=suretecsystems,dc=com cn=admin,dc=suretecsystems,dc=com +> dn: ou=Groups,dc=suretecsystems,dc=com +> changetype: add +> objectClass: top +> objectClass: organizationalUnit +> ou: Groups +> structuralObjectClass: organizationalUnit +> entryUUID: 160aaa2a-f06e-1029-828a-f0cc9d81e81a +> creatorsName: cn=admin,dc=suretecsystems,dc=com +> modifiersName: cn=admin,dc=suretecsystems,dc=com +> createTimestamp: 20051123130912Z +> modifyTimestamp: 20051123130912Z +> entryCSN: 20051123130912.000000Z#000002#000#000000 +> # end add 1196797577 + + +H3: Further Information + +{{:slapo-auditlog(5)}} + + +H2: Chaining + + +H3: Overview + +The chain overlay provides basic chaining capability to the underlying +database. + +What is chaining? It indicates the capability of a DSA to follow referrals on +behalf of the client, so that distributed systems are viewed as a single +virtual DSA by clients that are otherwise unable to "chase" (i.e. follow) +referrals by themselves. + +The chain overlay is built on top of the ldap backend; it is compiled by +default when {{B:--enable-ldap}}. + + +H3: Chaining Configuration + +In order to demonstrate how this overlay works, we shall discuss a typical +scenario which might be one master server and three Syncrepl slaves. + +On each replica, add this near the top of the {{slapd.conf}}(5) file +(global), before any database definitions: + +> overlay chain +> chain-uri "ldap://ldapmaster.example.com" +> chain-idassert-bind bindmethod="simple" +> binddn="cn=Manager,dc=example,dc=com" +> credentials="<secret>" +> mode="self" +> chain-tls start +> chain-return-error TRUE + +Add this below your {{syncrepl}} statement: + +> updateref "ldap://ldapmaster.example.com/" + +The {{B:chain-tls}} statement enables TLS from the slave to the ldap master. +The DITs are exactly the same between these machines, therefore whatever user +bound to the slave will also exist on the master. If that DN does not have +update privileges on the master, nothing will happen. + +You will need to restart the slave after these {{slapd.conf}} changes. +Then, if you are using {{loglevel stats}} (256), you can monitor an +{{ldapmodify}} on the slave and the master. (If you're using {{cn=config}} +no restart is required.) + +Now start an {{ldapmodify}} on the slave and watch the logs. You should expect +something like: + +> Sep 6 09:27:25 slave1 slapd[29274]: conn=11 fd=31 ACCEPT from IP=143.199.102.216:45181 (IP=143.199.102.216:389) +> Sep 6 09:27:25 slave1 slapd[29274]: conn=11 op=0 STARTTLS +> Sep 6 09:27:25 slave1 slapd[29274]: conn=11 op=0 RESULT oid= err=0 text= +> Sep 6 09:27:25 slave1 slapd[29274]: conn=11 fd=31 TLS established tls_ssf=256 ssf=256 +> Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=1 BIND dn="uid=user1,ou=people,dc=example,dc=com" method=128 +> Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=1 BIND dn="uid=user1,ou=People,dc=example,dc=com" mech=SIMPLE ssf=0 +> Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=1 RESULT tag=97 err=0 text= +> Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=2 MOD dn="uid=user1,ou=People,dc=example,dc=com" +> Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=2 MOD attr=mail +> Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=2 RESULT tag=103 err=0 text= +> Sep 6 09:27:28 slave1 slapd[29274]: conn=11 op=3 UNBIND +> Sep 6 09:27:28 slave1 slapd[29274]: conn=11 fd=31 closed +> Sep 6 09:27:28 slave1 slapd[29274]: syncrepl_entry: LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) +> Sep 6 09:27:28 slave1 slapd[29274]: syncrepl_entry: be_search (0) +> Sep 6 09:27:28 slave1 slapd[29274]: syncrepl_entry: uid=user1,ou=People,dc=example,dc=com +> Sep 6 09:27:28 slave1 slapd[29274]: syncrepl_entry: be_modify (0) + +And on the master you will see this: + +> Sep 6 09:23:57 ldapmaster slapd[2961]: conn=55902 op=3 PROXYAUTHZ dn="uid=user1,ou=people,dc=example,dc=com" +> Sep 6 09:23:57 ldapmaster slapd[2961]: conn=55902 op=3 MOD dn="uid=user1,ou=People,dc=example,dc=com" +> Sep 6 09:23:57 ldapmaster slapd[2961]: conn=55902 op=3 MOD attr=mail +> Sep 6 09:23:57 ldapmaster slapd[2961]: conn=55902 op=3 RESULT tag=103 err=0 text= + +Note: You can clearly see the PROXYAUTHZ line on the master, indicating the +proper identity assertion for the update on the master. Also note the slave +immediately receiving the Syncrepl update from the master. + +H3: Handling Chaining Errors + +By default, if chaining fails, the original referral is returned to the client +under the assumption that the client might want to try and follow the referral. + +With the following directive however, if the chaining fails at the provider +side, the actual error is returned to the client. + +> chain-return-error TRUE + + +H3: Read-Back of Chained Modifications + +Occasionally, applications want to read back the data that they just wrote. +If a modification requested to a shadow server was silently chained to its +provider, an immediate read could result in receiving data not yet synchronized. +In those cases, clients should use the {{B:dontusecopy}} control to ensure +they are directed to the authoritative source for that piece of data. + +This control usually causes a referral to the actual source of the data +to be returned. However, when the {{slapo-chain(5)}} overlay is used, +it intercepts the referral being returned in response to the +{{B:dontusecopy}} control, and tries to fetch the requested data. + + +H3: Further Information + +{{:slapo-chain(5)}} + + +H2: Constraints + + +H3: Overview + +This overlay enforces a regular expression constraint on all values +of specified attributes during an LDAP modify request that contains add or modify +commands. It is used to enforce a more rigorous syntax when the underlying attribute +syntax is too general. + + +H3: Constraint Configuration + +Configuration via {{slapd.conf}}(5) would look like: + +> overlay constraint +> constraint_attribute mail regex ^[[:alnum:]]+@mydomain.com$ +> constraint_attribute title uri +> ldap:///dc=catalog,dc=example,dc=com?title?sub?(objectClass=titleCatalog) + +A specification like the above would reject any {{mail}} attribute which did not +look like {{<alpha-numeric string>@mydomain.com}}. + +It would also reject any title attribute whose values were not listed in the +title attribute of any {{titleCatalog}} entries in the given scope. + +An example for use with {{cn=config}}: + +> dn: olcOverlay=constraint,olcDatabase={1}mdb,cn=config +> changetype: add +> objectClass: olcOverlayConfig +> objectClass: olcConstraintConfig +> olcOverlay: constraint +> olcConstraintAttribute: mail regex ^[[:alnum:]]+@mydomain.com$ +> olcConstraintAttribute: title uri ldap:///dc=catalog,dc=example,dc=com?title?sub?(objectClass=titleCatalog) + + +H3: Further Information + +{{:slapo-constraint(5)}} + + +H2: Dynamic Directory Services + + +H3: Overview + +The {{dds}} overlay to {{slapd}}(8) implements dynamic objects as per {{REF:RFC2589}}. +The name {{dds}} stands for Dynamic Directory Services. It allows to define +dynamic objects, characterized by the {{dynamicObject}} objectClass. + +Dynamic objects have a limited lifetime, determined by a time-to-live (TTL) +that can be refreshed by means of a specific refresh extended operation. This +operation allows to set the Client Refresh Period (CRP), namely the period +between refreshes that is required to preserve the dynamic object from expiration. +The expiration time is computed by adding the requested TTL to the current time. +When dynamic objects reach the end of their lifetime without being further +refreshed, they are automatically {{deleted}}. There is no guarantee of immediate +deletion, so clients should not count on it. + +H3: Dynamic Directory Service Configuration + +A usage of dynamic objects might be to implement dynamic meetings; in this case, +all the participants to the meeting are allowed to refresh the meeting object, +but only the creator can delete it (otherwise it will be deleted when the TTL expires). + +If we add the overlay to an example database, specifying a Max TTL of 1 day, a +min of 10 seconds, with a default TTL of 1 hour. We'll also specify an interval +of 120 (less than 60s might be too small) seconds between expiration checks and a +tolerance of 5 second (lifetime of a dynamic object will be {{entryTtl + tolerance}}). + +> overlay dds +> dds-max-ttl 1d +> dds-min-ttl 10s +> dds-default-ttl 1h +> dds-interval 120s +> dds-tolerance 5s + +and add an index: + +> entryExpireTimestamp + +Creating a meeting is as simple as adding the following: + +> dn: cn=OpenLDAP Documentation Meeting,ou=Meetings,dc=example,dc=com +> objectClass: groupOfNames +> objectClass: dynamicObject +> cn: OpenLDAP Documentation Meeting +> member: uid=ghenry,ou=People,dc=example,dc=com +> member: uid=hyc,ou=People,dc=example,dc=com + +H4: Dynamic Directory Service ACLs + +Allow users to start a meeting and to join it; restrict refresh to the {{member}}; +restrict delete to the creator: + +> access to attrs=userPassword +> by self write +> by * read +> +> access to dn.base="ou=Meetings,dc=example,dc=com" +> attrs=children +> by users write +> +> access to dn.onelevel="ou=Meetings,dc=example,dc=com" +> attrs=entry +> by dnattr=creatorsName write +> by * read +> +> access to dn.onelevel="ou=Meetings,dc=example,dc=com" +> attrs=participant +> by dnattr=creatorsName write +> by users selfwrite +> by * read +> +> access to dn.onelevel="ou=Meetings,dc=example,dc=com" +> attrs=entryTtl +> by dnattr=member manage +> by * read + +In simple terms, the user who created the {{OpenLDAP Documentation Meeting}} can add new attendees, +refresh the meeting using (basically complete control): + +> ldapexop -x -H ldap://ldaphost "refresh" "cn=OpenLDAP Documentation Meeting,ou=Meetings,dc=example,dc=com" "120" -D "uid=ghenry,ou=People,dc=example,dc=com" -W + +Any user can join the meeting, but not add another attendee, but they can refresh the meeting. The ACLs above are quite straight forward to understand. + + +H3: Further Information + +{{:slapo-dds(5)}} + + +H2: Dynamic Groups + + +H3: Overview + +This overlay extends the Compare operation to detect +members of a dynamic group. This overlay is now deprecated +as all of its functions are available using the +{{SECT:Dynamic Lists}} overlay. + + +H3: Dynamic Group Configuration + + +H2: Dynamic Lists + + +H3: Overview + +This overlay allows expansion of dynamic groups and lists. Instead of having the +group members or list attributes hard coded, this overlay allows us to define +an LDAP search whose results will make up the group or list. + +H3: Dynamic List Configuration + +This module can behave both as a dynamic list and dynamic group, depending on +the configuration. The syntax is as follows: + +> overlay dynlist +> dynlist-attrset <group-oc> <URL-ad> [member-ad] + +The parameters to the {{F:dynlist-attrset}} directive have the following meaning: +* {{F:<group-oc>}}: specifies which object class triggers the subsequent LDAP search. +Whenever an entry with this object class is retrieved, the search is performed. +* {{F:<URL-ad>}}: is the name of the attribute which holds the search URI. It +has to be a subtype of {{F:labeledURI}}. The attributes and values present in +the search result are added to the entry unless {{F:member-ad}} is used (see +below). +* {{F:member-ad}}: if present, changes the overlay behavior into a dynamic group. +Instead of inserting the results of the search in the entry, the distinguished name +of the results are added as values of this attribute. + +Here is an example which will allow us to have an email alias which automatically +expands to all user's emails according to our LDAP filter: + +In {{slapd.conf}}(5): + +> overlay dynlist +> dynlist-attrset nisMailAlias labeledURI + +This means that whenever an entry which has the {{F:nisMailAlias}} object class is +retrieved, the search specified in the {{F:labeledURI}} attribute is performed. + +Let's say we have this entry in our directory: + +> cn=all,ou=aliases,dc=example,dc=com +> cn: all +> objectClass: nisMailAlias +> labeledURI: ldap:///ou=People,dc=example,dc=com?mail?one?(objectClass=inetOrgPerson) + +If this entry is retrieved, the search specified in {{F:labeledURI}} will be +performed and the results will be added to the entry just as if they have always +been there. In this case, the search filter selects all entries directly +under {{F:ou=People}} that have the {{F:inetOrgPerson}} object class and retrieves +the {{F:mail}} attribute, if it exists. + +This is what gets added to the entry when we have two users under {{F:ou=People}} +that match the filter: +!import "allmail-en.png"; align="center"; title="Dynamic list for email aliases" +FT[align="Center"] Figure X.Y: Dynamic List for all emails + +The configuration for a dynamic group is similar. Let's see an example which would +automatically populate an {{F:allusers}} group with all the user accounts in the +directory. + +In {{F:slapd.conf}}(5): + +> include /path/to/dyngroup.schema +> ... +> overlay dynlist +> dynlist-attrset groupOfURLs labeledURI member ++ ++Note: We must include the {{F:dyngroup.schema}} file that defines the ++{{F:groupOfURLs}} objectClass used in this example. + +Let's apply it to the following entry: + +> cn=allusers,ou=group,dc=example,dc=com +> cn: all +> objectClass: groupOfURLs +> labeledURI: ldap:///ou=people,dc=example,dc=com??one?(objectClass=inetOrgPerson) + +The behavior is similar to the dynamic list configuration we had before: +whenever an entry with the {{F:groupOfURLs}} object class is retrieved, the +search specified in the {{F:labeledURI}} attribute is performed. But this time, +only the distinguished names of the results are added, and as values of the +{{F:member}} attribute. + +This is what we get: +!import "allusersgroup-en.png"; align="center"; title="Dynamic group for all users" +FT[align="Center"] Figure X.Y: Dynamic Group for all users + +Note that a side effect of this scheme of dynamic groups is that the members +need to be specified as full DNs. So, if you are planning in using this for +{{F:posixGroup}}s, be sure to use RFC2307bis and some attribute which can hold +distinguished names. The {{F:memberUid}} attribute used in the {{F:posixGroup}} +object class can hold only names, not DNs, and is therefore not suitable for +dynamic groups. + + +H3: Further Information + +{{:slapo-dynlist(5)}} + + +H2: Reverse Group Membership Maintenance + +H3: Overview + +In some scenarios, it may be desirable for a client to be able to determine +which groups an entry is a member of, without performing an additional search. +Examples of this are applications using the {{TERM:DIT}} for access control +based on group authorization. + +The {{B:memberof}} overlay updates an attribute (by default {{B:memberOf}}) whenever +changes occur to the membership attribute (by default {{B:member}}) of entries of the +objectclass (by default {{B:groupOfNames}}) configured to trigger updates. + +Thus, it provides maintenance of the list of groups an entry is a member of, +when usual maintenance of groups is done by modifying the members on the group +entry. + +H3: Member Of Configuration + +The typical use of this overlay requires just enabling the overlay for a +specific database. For example, with the following minimal slapd.conf: + +> include /usr/share/openldap/schema/core.schema +> include /usr/share/openldap/schema/cosine.schema +> +> authz-regexp "gidNumber=0\\\+uidNumber=0,cn=peercred,cn=external,cn=auth" +> "cn=Manager,dc=example,dc=com" +> database bdb +> suffix "dc=example,dc=com" +> rootdn "cn=Manager,dc=example,dc=com" +> rootpw secret +> directory /var/lib/ldap2.4 +> checkpoint 256 5 +> index objectClass eq +> index uid eq,sub +> +> overlay memberof + +adding the following ldif: + +> cat memberof.ldif +> dn: dc=example,dc=com +> objectclass: domain +> dc: example +> +> dn: ou=Group,dc=example,dc=com +> objectclass: organizationalUnit +> ou: Group +> +> dn: ou=People,dc=example,dc=com +> objectclass: organizationalUnit +> ou: People +> +> dn: uid=test1,ou=People,dc=example,dc=com +> objectclass: account +> uid: test1 +> +> dn: cn=testgroup,ou=Group,dc=example,dc=com +> objectclass: groupOfNames +> cn: testgroup +> member: uid=test1,ou=People,dc=example,dc=com + +Results in the following output from a search on the test1 user: + +> # ldapsearch -LL -Y EXTERNAL -H ldapi:/// "(uid=test1)" -b dc=example,dc=com memberOf +> SASL/EXTERNAL authentication started +> SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth +> SASL SSF: 0 +> version: 1 +> +> dn: uid=test1,ou=People,dc=example,dc=com +> memberOf: cn=testgroup,ou=Group,dc=example,dc=com + +Note that the {{B:memberOf}} attribute is an operational attribute, so it must be +requested explicitly. + + +H3: Further Information + +{{:slapo-memberof(5)}} + + +H2: The Proxy Cache Engine + +{{TERM:LDAP}} servers typically hold one or more subtrees of a +{{TERM:DIT}}. Replica (or shadow) servers hold shadow copies of +entries held by one or more master servers. Changes are propagated +from the master server to replica (slave) servers using LDAP Sync +replication. An LDAP cache is a special type of replica which holds +entries corresponding to search filters instead of subtrees. + +H3: Overview + +The proxy cache extension of slapd is designed to improve the +responsiveness of the ldap and meta backends. It handles a search +request (query) +by first determining whether it is contained in any cached search +filter. Contained requests are answered from the proxy cache's local +database. Other requests are passed on to the underlying ldap or +meta backend and processed as usual. + +E.g. {{EX:(shoesize>=9)}} is contained in {{EX:(shoesize>=8)}} and +{{EX:(sn=Richardson)}} is contained in {{EX:(sn=Richards*)}} + +Correct matching rules and syntaxes are used while comparing +assertions for query containment. To simplify the query containment +problem, a list of cacheable "templates" (defined below) is specified +at configuration time. A query is cached or answered only if it +belongs to one of these templates. The entries corresponding to +cached queries are stored in the proxy cache local database while +its associated meta information (filter, scope, base, attributes) +is stored in main memory. + +A template is a prototype for generating LDAP search requests. +Templates are described by a prototype search filter and a list of +attributes which are required in queries generated from the template. +The representation for prototype filter is similar to {{REF:RFC4515}}, +except that the assertion values are missing. Examples of prototype +filters are: (sn=),(&(sn=)(givenname=)) which are instantiated by +search filters (sn=Doe) and (&(sn=Doe)(givenname=John)) respectively. + +The cache replacement policy removes the least recently used (LRU) +query and entries belonging to only that query. Queries are allowed +a maximum time to live (TTL) in the cache thus providing weak +consistency. A background task periodically checks the cache for +expired queries and removes them. + +The Proxy Cache paper +({{URL:http://www.openldap.org/pub/kapurva/proxycaching.pdf}}) provides +design and implementation details. + + +H3: Proxy Cache Configuration + +The cache configuration specific directives described below must +appear after a {{EX:overlay pcache}} directive within a +{{EX:"database meta"}} or {{EX:"database ldap"}} section of +the server's {{slapd.conf}}(5) file. + +H4: Setting cache parameters + +> pcache <DB> <maxentries> <nattrsets> <entrylimit> <period> + +This directive enables proxy caching and sets general cache +parameters. The <DB> parameter specifies which underlying database +is to be used to hold cached entries. It should be set to +{{EX:bdb}} or {{EX:hdb}}. The <maxentries> parameter specifies the +total number of entries which may be held in the cache. The +<nattrsets> parameter specifies the total number of attribute sets +(as specified by the {{EX:pcacheAttrset}} directive) that may be +defined. The <entrylimit> parameter specifies the maximum number of +entries in a cacheable query. The <period> specifies the consistency +check period (in seconds). In each period, queries with expired +TTLs are removed. + +H4: Defining attribute sets + +> pcacheAttrset <index> <attrs...> + +Used to associate a set of attributes to an index. Each attribute +set is associated with an index number from 0 to <numattrsets>-1. +These indices are used by the pcacheTemplate directive to define +cacheable templates. + +H4: Specifying cacheable templates + +> pcacheTemplate <prototype_string> <attrset_index> <TTL> + +Specifies a cacheable template and the "time to live" (in sec) <TTL> +for queries belonging to the template. A template is described by +its prototype filter string and set of required attributes identified +by <attrset_index>. + + +H4: Example for slapd.conf + +An example {{slapd.conf}}(5) database section for a caching server +which proxies for the {{EX:"dc=example,dc=com"}} subtree held +at server {{EX:ldap.example.com}}. + +> database ldap +> suffix "dc=example,dc=com" +> rootdn "dc=example,dc=com" +> uri ldap://ldap.example.com/ +> overlay pcache +> pcache hdb 100000 1 1000 100 +> pcacheAttrset 0 mail postaladdress telephonenumber +> pcacheTemplate (sn=) 0 3600 +> pcacheTemplate (&(sn=)(givenName=)) 0 3600 +> pcacheTemplate (&(departmentNumber=)(secretary=*)) 0 3600 +> +> cachesize 20 +> directory ./testrun/db.2.a +> index objectClass eq +> index cn,sn,uid,mail pres,eq,sub + +H4: Example for slapd-config + +The same example as a LDIF file for back-config for a caching server +which proxies for the {{EX:"dc=example,dc=com"}} subtree held +at server {{EX:ldap.example.com}}. + +> dn: olcDatabase={2}ldap,cn=config +> objectClass: olcDatabaseConfig +> objectClass: olcLDAPConfig +> olcDatabase: {2}ldap +> olcSuffix: dc=example,dc=com +> olcRootDN: dc=example,dc=com +> olcDbURI: "ldap://ldap.example.com" +> +> dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config +> objectClass: olcOverlayConfig +> objectClass: olcPcacheConfig +> olcOverlay: {0}pcache +> olcPcache: hdb 100000 1 1000 100 +> olcPcacheAttrset: 0 mail postalAddress telephoneNumber +> olcPcacheTemplate: "(sn=)" 0 3600 0 0 0 +> olcPcacheTemplate: "(&(sn=)(givenName=))" 0 3600 0 0 0 +> olcPcacheTemplate: "(&(departmentNumber=)(secretary=))" 0 3600 +> +> dn: olcDatabase={0}mdb,olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config +> objectClass: olcMdbConfig +> objectClass: olcPcacheDatabase +> olcDatabase: {0}mdb +> olcDbDirectory: ./testrun/db.2.a +> olcDbCacheSize: 20 +> olcDbIndex: objectClass eq +> olcDbIndex: cn,sn,uid,mail pres,eq,sub + + +H5: Cacheable Queries + +A LDAP search query is cacheable when its filter matches one of the +templates as defined in the "pcacheTemplate" statements and when it references +only the attributes specified in the corresponding attribute set. +In the example above the attribute set number 0 defines that only the +attributes: {{EX:mail postaladdress telephonenumber}} are cached for the following +pcacheTemplates. + +H5: Examples: + +> Filter: (&(sn=Richard*)(givenName=jack)) +> Attrs: mail telephoneNumber + + is cacheable, because it matches the template {{EX:(&(sn=)(givenName=))}} and its + attributes are contained in pcacheAttrset 0. + +> Filter: (&(sn=Richard*)(telephoneNumber)) +> Attrs: givenName + + is not cacheable, because the filter does not match the template, + nor is the attribute givenName stored in the cache + +> Filter: (|(sn=Richard*)(givenName=jack)) +> Attrs: mail telephoneNumber + + is not cacheable, because the filter does not match the template ( logical + OR "|" condition instead of logical AND "&" ) + + +H3: Further Information + +{{:slapo-pcache(5)}} + + +H2: Password Policies + + +H3: Overview + +This overlay follows the specifications contained in the draft RFC titled +draft-behera-ldap-password-policy-09. While the draft itself is expired, it has +been implemented in several directory servers, including slapd. Nonetheless, +it is important to note that it is a draft, meaning that it is subject to change +and is a work-in-progress. + +The key abilities of the password policy overlay are as follows: + +* Enforce a minimum length for new passwords +* Make sure passwords are not changed too frequently +* Cause passwords to expire, provide warnings before they need to be changed, and allow a fixed number of 'grace' logins to allow them to be changed after they have expired +* Maintain a history of passwords to prevent password re-use +* Prevent password guessing by locking a password for a specified period of time after repeated authentication failures +* Force a password to be changed at the next authentication +* Set an administrative lock on an account +* Support multiple password policies on a default or a per-object basis. +* Perform arbitrary quality checks using an external loadable module. This is a non-standard extension of the draft RFC. + + +H3: Password Policy Configuration + +Instantiate the module in the database where it will be used, after adding the +new ppolicy schema and loading the ppolicy module. The following example shows +the ppolicy module being added to the database that handles the naming +context "dc=example,dc=com". In this example we are also specifying the DN of +a policy object to use if none other is specified in a user's object. + +> database bdb +> suffix "dc=example,dc=com" +> [...additional database configuration directives go here...] +> +> overlay ppolicy +> ppolicy_default "cn=default,ou=policies,dc=example,dc=com" + + +Now we need a container for the policy objects. In our example the password +policy objects are going to be placed in a section of the tree called +"ou=policies,dc=example,dc=com": + +> dn: ou=policies,dc=example,dc=com +> objectClass: organizationalUnit +> objectClass: top +> ou: policies + + +The default policy object that we are creating defines the following policies: + +* The user is allowed to change his own password. Note that the directory ACLs for this attribute can also affect this ability (pwdAllowUserChange: TRUE). +* The name of the password attribute is "userPassword" (pwdAttribute: userPassword). Note that this is the only value that is accepted by OpenLDAP for this attribute. +* The server will check the syntax of the password. If the server is unable to check the syntax (i.e., it was hashed or otherwise encoded by the client) it will return an error refusing the password (pwdCheckQuality: 2). +* When a client includes the Password Policy Request control with a bind request, the server will respond with a password expiration warning if it is going to expire in ten minutes or less (pwdExpireWarning: 600). The warnings themselves are returned in a Password Policy Response control. +* When the password for a DN has expired, the server will allow five additional "grace" logins (pwdGraceAuthNLimit: 5). +* The server will maintain a history of the last five passwords that were used for a DN (pwdInHistory: 5). +* The server will lock the account after the maximum number of failed bind attempts has been exceeded (pwdLockout: TRUE). +* When the server has locked an account, the server will keep it locked until an administrator unlocks it (pwdLockoutDuration: 0) +* The server will reset its failed bind count after a period of 30 seconds. +* Passwords will not expire (pwdMaxAge: 0). +* Passwords can be changed as often as desired (pwdMinAge: 0). +* Passwords must be at least 5 characters in length (pwdMinLength: 5). +* The password does not need to be changed at the first bind or when the administrator has reset the password (pwdMustChange: FALSE) +* The current password does not need to be included with password change requests (pwdSafeModify: FALSE) +* The server will only allow five failed binds in a row for a particular DN (pwdMaxFailure: 5). + + +The actual policy would be: + +> dn: cn=default,ou=policies,dc=example,dc=com +> cn: default +> objectClass: pwdPolicy +> objectClass: person +> objectClass: top +> pwdAllowUserChange: TRUE +> pwdAttribute: userPassword +> pwdCheckQuality: 2 +> pwdExpireWarning: 600 +> pwdFailureCountInterval: 30 +> pwdGraceAuthNLimit: 5 +> pwdInHistory: 5 +> pwdLockout: TRUE +> pwdLockoutDuration: 0 +> pwdMaxAge: 0 +> pwdMaxFailure: 5 +> pwdMinAge: 0 +> pwdMinLength: 5 +> pwdMustChange: FALSE +> pwdSafeModify: FALSE +> sn: dummy value + +You can create additional policy objects as needed. + + +There are two ways password policy can be applied to individual objects: + +1. The pwdPolicySubentry in a user's object - If a user's object has a +pwdPolicySubEntry attribute specifying the DN of a policy object, then +the policy defined by that object is applied. + +2. Default password policy - If there is no specific pwdPolicySubentry set +for an object, and the password policy module was configured with the DN of a +default policy object and if that object exists, then the policy defined in +that object is applied. + +Please see {{slapo-ppolicy(5)}} for complete explanations of features and discussion of + "Password Management Issues" at {{URL:http://www.symas.com/blog/?page_id=66}} + + +H3: Further Information + +{{:slapo-ppolicy(5)}} + + +H2: Referential Integrity + + +H3: Overview + +This overlay can be used with a backend database such as slapd-bdb(5) +to maintain the cohesiveness of a schema which utilizes reference +attributes. + +Whenever a {{modrdn}} or {{delete}} is performed, that is, when an entry's DN +is renamed or an entry is removed, the server will search the directory for +references to this DN (in selected attributes: see below) and update them +accordingly. If it was a {{delete}} operation, the reference is deleted. If it +was a {{modrdn}} operation, then the reference is updated with the new DN. + +For example, a very common administration task is to maintain group membership +lists, specially when users are removed from the directory. When an +user account is deleted or renamed, all groups this user is a member of have to be +updated. LDAP administrators usually have scripts for that. But we can use the +{{F:refint}} overlay to automate this task. In this example, if the user is +removed from the directory, the overlay will take care to remove the user from +all the groups he/she was a member of. No more scripting for this. + +H3: Referential Integrity Configuration + +The configuration for this overlay is as follows: + +> overlay refint +> refint_attributes <attribute [attribute ...]> +> refint_nothing <string> + +* {{F:refint_attributes}}: this parameter specifies a space separated list of +attributes which will have the referential integrity maintained. When an entry is +removed or has its DN renamed, the server will do an internal search for any of the +{{F:refint_attributes}} that point to the affected DN and update them accordingly. IMPORTANT: +the attributes listed here must have the {{F:distinguishedName}} syntax, that is, +hold DNs as values. +* {{F:refint_nothing}}: some times, while trying to maintain the referential +integrity, the server has to remove the last attribute of its kind from an +entry. This may be prohibited by the schema: for example, the +{{F:groupOfNames}} object class requires at least one member. In these cases, +the server will add the attribute value specified in {{F:refint_nothing}} +to the entry. + +To illustrate this overlay, we will use the group membership scenario. + +In {{F:slapd.conf}}: + +> overlay refint +> refint_attributes member +> refint_nothing "cn=admin,dc=example,dc=com" + +This configuration tells the overlay to maintain the referential integrity of the {{F:member}} +attribute. This attribute is used in the {{F:groupOfNames}} object class which always needs +a member, so we add the {{F:refint_nothing}} directive to fill in the group with a standard +member should all the members vanish. + +If we have the following group membership, the refint overlay will +automatically remove {{F:john}} from the group if his entry is removed from the +directory: + +!import "refint.png"; align="center"; title="Group membership" +FT[align="Center"] Figure X.Y: Maintaining referential integrity in groups + +Notice that if we rename ({{F:modrdn}}) the {{F:john}} entry to, say, {{F:jsmith}}, the refint +overlay will also rename the reference in the {{F:member}} attribute, so the group membership +stays correct. + +If we removed all users from the directory who are a member of this group, then the end result +would be a single member in the group: {{F:cn=admin,dc=example,dc=com}}. This is the +{{F:refint_nothing}} parameter kicking into action so that the schema is not violated. + +The {{rootdn}} must be set for the database as refint runs as the {{rootdn}} to gain access to +make its updates. The {{rootpw}} does not need to be set. + +H3: Further Information + +{{:slapo-refint(5)}} + + +H2: Return Code + + +H3: Overview + +This overlay is useful to test the behavior of clients when +server-generated erroneous and/or unusual responses occur, +for example; error codes, referrals, excessive response times and so on. + +This would be classed as a debugging tool whilst developing client software +or additional Overlays. + +For detailed information, please see the {{slapo-retcode(5)}} man page. + + +H3: Return Code Configuration + +The retcode overlay utilizes the "return code" schema described in the man page. +This schema is specifically designed for use with this overlay and is not intended +to be used otherwise. + +Note: The necessary schema is loaded automatically by the overlay. + +An example configuration might be: + +> overlay retcode +> retcode-parent "ou=RetCodes,dc=example,dc=com" +> include ./retcode.conf +> +> retcode-item "cn=Unsolicited" 0x00 unsolicited="0" +> retcode-item "cn=Notice of Disconnect" 0x00 unsolicited="1.3.6.1.4.1.1466.20036" +> retcode-item "cn=Pre-disconnect" 0x34 flags="pre-disconnect" +> retcode-item "cn=Post-disconnect" 0x34 flags="post-disconnect" + +Note: {{retcode.conf}} can be found in the openldap source at: {{F:tests/data/retcode.conf}} + +An excerpt of a {{F:retcode.conf}} would be something like: + +> retcode-item "cn=success" 0x00 +> +> retcode-item "cn=success w/ delay" 0x00 sleeptime=2 +> +> retcode-item "cn=operationsError" 0x01 +> retcode-item "cn=protocolError" 0x02 +> retcode-item "cn=timeLimitExceeded" 0x03 op=search +> retcode-item "cn=sizeLimitExceeded" 0x04 op=search +> retcode-item "cn=compareFalse" 0x05 op=compare +> retcode-item "cn=compareTrue" 0x06 op=compare +> retcode-item "cn=authMethodNotSupported" 0x07 +> retcode-item "cn=strongAuthNotSupported" 0x07 text="same as authMethodNotSupported" +> retcode-item "cn=strongAuthRequired" 0x08 +> retcode-item "cn=strongerAuthRequired" 0x08 text="same as strongAuthRequired" + +Please see {{F:tests/data/retcode.conf}} for a complete {{F:retcode.conf}} + + +H3: Further Information + +{{:slapo-retcode(5)}} + + +H2: Rewrite/Remap + + +H3: Overview + +It performs basic DN/data rewrite and objectClass/attributeType mapping. Its +usage is mostly intended to provide virtual views of existing data either +remotely, in conjunction with the proxy backend described in {{slapd-ldap(5)}}, +or locally, in conjunction with the relay backend described in {{slapd-relay(5)}}. + +This overlay is extremely configurable and advanced, therefore recommended +reading is the {{slapo-rwm(5)}} man page. + + +H3: Rewrite/Remap Configuration + + +H3: Further Information + +{{:slapo-rwm(5)}} + + +H2: Sync Provider + + +H3: Overview + +This overlay implements the provider-side support for the LDAP Content Synchronization +({{REF:RFC4533}}) as well as syncrepl replication support, including persistent search functionality. + +H3: Sync Provider Configuration + +There is very little configuration needed for this overlay, in fact for many situations merely loading +the overlay will suffice. + +However, because the overlay creates a contextCSN attribute in the root entry of the database which is +updated for every write operation performed against the database and only updated in memory, it is +recommended to configure a checkpoint so that the contextCSN is written into the underlying database to +minimize recovery time after an unclean shutdown: + +> overlay syncprov +> syncprov-checkpoint 100 10 + +For every 100 operations or 10 minutes, which ever is sooner, the contextCSN will be checkpointed. + +The four configuration directives available are {{B:syncprov-checkpoint}}, {{B:syncprov-sessionlog}}, +{{B:syncprov-nopresent}} and {{B:syncprov-reloadhint}} which are covered in the man page discussing +various other scenarios where this overlay can be used. + +H3: Further Information + +The {{:slapo-syncprov(5)}} man page and the {{SECT:Configuring the different replication types}} section + + +H2: Translucent Proxy + + +H3: Overview + +This overlay can be used with a backend database such as {{:slapd-bdb}}(5) +to create a "translucent proxy". + +Entries retrieved from a remote LDAP server may have some or all attributes +overridden, or new attributes added, by entries in the local database before +being presented to the client. + +A search operation is first populated with entries from the remote LDAP server, +the attributes of which are then overridden with any attributes defined in the +local database. Local overrides may be populated with the add, modify, and +modrdn operations, the use of which is restricted to the root user of the +translucent local database. + +A compare operation will perform a comparison with attributes defined in the +local database record (if any) before any comparison is made with data in the +remote database. + + +H3: Translucent Proxy Configuration + +There are various options available with this overlay, but for this example we +will demonstrate adding new attributes to a remote entry and also searching +against these newly added local attributes. For more information about overriding remote +entries and search configuration, please see {{:slapo-translucent(5)}} + +Note: The Translucent Proxy overlay will disable schema checking in the local +database, so that an entry consisting of overlay attributes need not adhere + to the complete schema. + +First we configure the overlay in the normal manner: + +> include /usr/local/etc/openldap/schema/core.schema +> include /usr/local/etc/openldap/schema/cosine.schema +> include /usr/local/etc/openldap/schema/nis.schema +> include /usr/local/etc/openldap/schema/inetorgperson.schema +> +> pidfile ./slapd.pid +> argsfile ./slapd.args +> +> database bdb +> suffix "dc=suretecsystems,dc=com" +> rootdn "cn=trans,dc=suretecsystems,dc=com" +> rootpw secret +> directory ./openldap-data +> +> index objectClass eq +> +> overlay translucent +> translucent_local carLicense +> +> uri ldap://192.168.X.X:389 +> lastmod off +> acl-bind binddn="cn=admin,dc=suretecsystems,dc=com" credentials="blahblah" + +You will notice the overlay directive and a directive to say what attribute we +want to be able to search against in the local database. We must also load the +ldap backend which will connect to the remote directory server. + +Now we take an example LDAP group: + +> # itsupport, Groups, suretecsystems.com +> dn: cn=itsupport,ou=Groups,dc=suretecsystems,dc=com +> objectClass: posixGroup +> objectClass: sambaGroupMapping +> cn: itsupport +> gidNumber: 1000 +> sambaSID: S-1-5-21-XXX +> sambaGroupType: 2 +> displayName: itsupport +> memberUid: ghenry +> memberUid: joebloggs + +and create an LDIF file we can use to add our data to the local database, using + some pretty strange choices of new attributes for demonstration purposes: + +> [ghenry@suretec test_configs]$ cat test-translucent-add.ldif +> dn: cn=itsupport,ou=Groups,dc=suretecsystems,dc=com +> businessCategory: frontend-override +> carLicense: LIVID +> employeeType: special +> departmentNumber: 9999999 +> roomNumber: 41L-535 + +Searching against the proxy gives: + +> [ghenry@suretec test_configs]$ ldapsearch -x -H ldap://127.0.0.1:9001 "(cn=itsupport)" +> # itsupport, Groups, OxObjects, suretecsystems.com +> dn: cn=itsupport,ou=Groups,ou=OxObjects,dc=suretecsystems,dc=com +> objectClass: posixGroup +> objectClass: sambaGroupMapping +> cn: itsupport +> gidNumber: 1003 +> SAMBASID: S-1-5-21-XXX +> SAMBAGROUPTYPE: 2 +> displayName: itsupport +> memberUid: ghenry +> memberUid: joebloggs +> roomNumber: 41L-535 +> departmentNumber: 9999999 +> employeeType: special +> carLicense: LIVID +> businessCategory: frontend-override + +Here we can see that the 5 new attributes are added to the remote entry before +being returned to the our client. + +Because we have configured a local attribute to search against: + +> overlay translucent +> translucent_local carLicense + +we can also search for that to return the completely fabricated entry: + +> ldapsearch -x -H ldap://127.0.0.1:9001 (carLicense=LIVID) + +This is an extremely feature because you can then extend a remote directory server +locally and also search against the local entries. + +Note: Because the translucent overlay does not perform any DN rewrites, the local + and remote database instances must have the same suffix. Other configurations +will probably fail with No Such Object and other errors + +H3: Further Information + +{{:slapo-translucent(5)}} + + +H2: Attribute Uniqueness + + +H3: Overview + +This overlay can be used with a backend database such as {{slapd-bdb(5)}} +to enforce the uniqueness of some or all attributes within a subtree. + + +H3: Attribute Uniqueness Configuration + +This overlay is only effective on new data from the point the overlay is enabled. To +check uniqueness for existing data, you can export and import your data again via the +LDAP Add operation, which will not be suitable for large amounts of data, unlike {{B:slapcat}}. + +For the following example, if uniqueness were enforced for the {{B:mail}} attribute, +the subtree would be searched for any other records which also have a {{B:mail}} attribute +containing the same value presented with an {{B:add}}, {{B:modify}} or {{B:modrdn}} operation +which are unique within the configured scope. If any are found, the request is rejected. + +Note: If no attributes are specified, for example {{B:ldap:///??sub?}}, then the URI applies to all non-operational attributes. However, +the keyword {{B:ignore}} can be specified to exclude certain non-operational attributes. + +To search at the base dn of the current backend database ensuring uniqueness of the {{B:mail}} +attribute, we simply add the following configuration: + +> overlay unique +> unique_uri ldap:///?mail?sub? + +For an existing entry of: + +> dn: cn=gavin,dc=suretecsystems,dc=com +> objectClass: top +> objectClass: inetorgperson +> cn: gavin +> sn: henry +> mail: ghenry@suretecsystems.com + +and we then try to add a new entry of: + +> dn: cn=robert,dc=suretecsystems,dc=com +> objectClass: top +> objectClass: inetorgperson +> cn: robert +> sn: jones +> mail: ghenry@suretecsystems.com + +would result in an error like so: + +> adding new entry "cn=robert,dc=example,dc=com" +> ldap_add: Constraint violation (19) +> additional info: some attributes not unique + +The overlay can have multiple URIs specified within a domain, allowing complex +selections of objects and also have multiple {{B:unique_uri}} statements or +{{B:olcUniqueURI}} attributes which will create independent domains. + +For more information and details about the {{B:strict}} and {{B:ignore}} keywords, +please see the {{:slapo-unique(5)}} man page. + +H3: Further Information + +{{:slapo-unique(5)}} + + +H2: Value Sorting + + +H3: Overview + +The Value Sorting overlay can be used with a backend database to sort the +values of specific multi-valued attributes within a subtree. The sorting occurs +whenever the attributes are returned in a search response. + +H3: Value Sorting Configuration + +Sorting can be specified in ascending or descending order, using either numeric +or alphanumeric sort methods. Additionally, a "weighted" sort can be specified, + which uses a numeric weight prepended to the attribute values. + +The weighted sort is always performed in ascending order, but may be combined +with the other methods for values that all have equal weights. The weight is +specified by prepending an integer weight {<weight>} in front of each value +of the attribute for which weighted sorting is desired. This weighting factor +is stripped off and never returned in search results. + +Here are a few examples: + +> loglevel sync stats +> +> database hdb +> suffix "dc=suretecsystems,dc=com" +> directory /usr/local/var/openldap-data +> +> ...... +> +> overlay valsort +> valsort-attr memberUid ou=Groups,dc=suretecsystems,dc=com alpha-ascend + +For example, ascend: + +> # sharedemail, Groups, suretecsystems.com +> dn: cn=sharedemail,ou=Groups,dc=suretecsystems,dc=com +> objectClass: posixGroup +> objectClass: top +> cn: sharedemail +> gidNumber: 517 +> memberUid: admin +> memberUid: dovecot +> memberUid: laura +> memberUid: suretec + +For weighted, we change our data to: + +> # sharedemail, Groups, suretecsystems.com +> dn: cn=sharedemail,ou=Groups,dc=suretecsystems,dc=com +> objectClass: posixGroup +> objectClass: top +> cn: sharedemail +> gidNumber: 517 +> memberUid: {4}admin +> memberUid: {2}dovecot +> memberUid: {1}laura +> memberUid: {3}suretec + +and change the config to: + +> overlay valsort +> valsort-attr memberUid ou=Groups,dc=suretecsystems,dc=com weighted + +Searching now results in: + +> # sharedemail, Groups, OxObjects, suretecsystems.com +> dn: cn=sharedemail,ou=Groups,ou=OxObjects,dc=suretecsystems,dc=com +> objectClass: posixGroup +> objectClass: top +> cn: sharedemail +> gidNumber: 517 +> memberUid: laura +> memberUid: dovecot +> memberUid: suretec +> memberUid: admin + + +H3: Further Information + +{{:slapo-valsort(5)}} + + +H2: Overlay Stacking + + +H3: Overview + +Overlays can be stacked, which means that more than one overlay +can be instantiated for each database, or for the {{EX:frontend}}. +As a consequence, each overlays function is called, if defined, +when overlay execution is invoked. +Multiple overlays are executed in reverse order (as a stack) +with respect to their definition in slapd.conf (5), or with respect +to their ordering in the config database, as documented in slapd-config (5). + + +H3: Example Scenarios + + +H4: Samba diff --git a/doc/guide/admin/preface.sdf b/doc/guide/admin/preface.sdf new file mode 100644 index 0000000..a3faf6e --- /dev/null +++ b/doc/guide/admin/preface.sdf @@ -0,0 +1,85 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +# + +P1: Preface + + +# document's copyright +P2[notoc] Copyright + +Copyright 1998-2012, The {{ORG[expand]OLF}}, {{All Rights Reserved}}. + +Copyright 1992-1996, Regents of the {{ORG[expand]UM}}, {{All Rights Reserved}}. + +This document is considered a part of OpenLDAP Software. This +document is subject to terms of conditions set forth in {{SECT:OpenLDAP +Software Copyright Notices}} and the {{SECT:OpenLDAP Public License}}. +Complete copies of the notices and associated license can be found +in Appendix K and L, respectively. + +Portions of OpenLDAP Software and this document may be copyright +by other parties and/or subject to additional restrictions. Individual +source files should be consulted for additional copyright notices. + +P2[notoc] Scope of this Document + +This document provides a guide for installing [[DOC_NAME]] +({{URL:http://www.openldap.org/software/}}) on {{TERM:UNIX}} (and +UNIX-like) systems. The document is aimed at experienced system +administrators with basic understanding of {{TERM:LDAP}}-based +directory services. + +This document is meant to be used in conjunction with other OpenLDAP +information resources provided with the software package and on the +project's site ({{URL:http://www.OpenLDAP.org/}}) on the +{{TERM[expand]WWW}}. The site makes available a number of resources. + +!block table; align=Center; coltags="N,URL"; \ + title="OpenLDAP Resources" +Resource|URL +Document Catalog|http://www.OpenLDAP.org/doc/ +Frequently Asked Questions|http://www.OpenLDAP.org/faq/ +Issue Tracking System|http://www.OpenLDAP.org/its/ +Mailing Lists|http://www.OpenLDAP.org/lists/ +Manual Pages|http://www.OpenLDAP.org/software/man.cgi +Software Pages|http://www.OpenLDAP.org/software/ +Support Pages|http://www.OpenLDAP.org/support/ +!endblock + +This document is not a complete reference for OpenLDAP software; the +manual pages are the definitive documentation. For best results, +you should use the manual pages that were installed on your system +with your version of OpenLDAP software so that you're looking at +documentation that matches the code. While the OpenLDAP web site +also provides the manual pages for convenience, you can not assume +that they corresond to the particular version you're running. + +P2[notoc] Acknowledgments + +The {{ORG[expand]OLP}} is comprised of a team of volunteers. This +document would not be possible without their contribution of time +and energy. + +The OpenLDAP Project would also like to thank the {{ORG[expand]UMLDAP}} +for building the foundation of LDAP software and information to +which OpenLDAP Software is built upon. This document is based upon +University of Michigan document: {{REF[expand]UM-GUIDE}}. + + +P2[notoc] Amendments + +Suggested enhancements and corrections to this document should be +submitted using the {{PRD:OpenLDAP}} {{TERM[expand]ITS}} +({{URL: http://www.openldap.org/its/}}). + + +P2[notoc] About this document + +This document was produced using the {{TERM[expand]SDF}} ({{TERM:SDF}}) +documentation system +({{URL:http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html}}) +developed by {{Ian Clatworthy}}. Tools for SDF are available from +{{ORG:CPAN}} ({{URL:http://search.cpan.org/search?query=SDF&mode=dist}}). + diff --git a/doc/guide/admin/push-based-complete.png b/doc/guide/admin/push-based-complete.png Binary files differnew file mode 100644 index 0000000..4a1b182 --- /dev/null +++ b/doc/guide/admin/push-based-complete.png diff --git a/doc/guide/admin/push-based-standalone.png b/doc/guide/admin/push-based-standalone.png Binary files differnew file mode 100644 index 0000000..0f8c997 --- /dev/null +++ b/doc/guide/admin/push-based-standalone.png diff --git a/doc/guide/admin/quickstart.sdf b/doc/guide/admin/quickstart.sdf new file mode 100644 index 0000000..c131c48 --- /dev/null +++ b/doc/guide/admin/quickstart.sdf @@ -0,0 +1,300 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: A Quick-Start Guide + +The following is a quick start guide to [[DOC_NAME]], +including the Standalone {{TERM:LDAP}} Daemon, {{slapd}}(8). + +It is meant to walk you through the basic steps needed to install +and configure {{PRD:OpenLDAP Software}}. It should be used in +conjunction with the other chapters of this document, manual pages, +and other materials provided with the distribution (e.g. the +{{F:INSTALL}} document) or on the {{PRD:OpenLDAP}} web site +({{URL: http://www.OpenLDAP.org}}), in particular the OpenLDAP +Software {{TERM:FAQ}} ({{URL: http://www.OpenLDAP.org/faq/?file=2}}). + +If you intend to run OpenLDAP Software seriously, you should review +all of this document before attempting to install the software. + +Note: This quick start guide does not use strong authentication +nor any integrity or confidential protection services. These +services are described in other chapters of the +OpenLDAP Administrator's Guide. + + +.{{S: }} +^{{B: Get the software}} + +. You can obtain a copy of the software by following the +instructions on the OpenLDAP Software download page +({{URL: http://www.openldap.org/software/download/}}). It is +recommended that new users start with the latest {{release}}. + + +.{{S: }} ++{{B: Unpack the distribution}} + +.Pick a directory for the source to live under, change +directory to there, and unpack the distribution using the +following commands: + +..{{EX:gunzip -c openldap-VERSION.tgz | tar xvfB -}} + +. then relocate yourself into the distribution directory: + +..{{EX:cd openldap-VERSION}} + +. You'll have to replace {{F:VERSION}} with the version +name of the release. + + +.{{S: }} ++{{B: Review documentation}} + +. You should now review the {{F:COPYRIGHT}}, {{F:LICENSE}}, +{{F:README}} and {{F:INSTALL}} documents provided with the distribution. +The {{F:COPYRIGHT}} and {{F:LICENSE}} provide information on +acceptable use, copying, and limitation of warranty of OpenLDAP +Software. + +.{{S: }} +. You should also review other chapters of this document. +In particular, the {{SECT:Building and Installing OpenLDAP Software}} +chapter of this document provides detailed information on prerequisite +software and installation procedures. + + +.{{S: }} ++{{B: Run {{EX:configure}}}} + +. You will need to run the provided {{EX:configure}} script to +{{configure}} the distribution for building on your system. The +{{EX:configure}} script accepts many command line options that enable or +disable optional software features. Usually the defaults are okay, +but you may want to change them. To get a complete list of options +that {{EX:configure}} accepts, use the {{EX:--help}} option: + +..{{EX:./configure --help}} + +. However, given that you are using this guide, we'll assume you +are brave enough to just let {{EX:configure}} determine +what's best: + +..{{EX:./configure}} + +. Assuming {{EX:configure}} doesn't dislike your system, you can +proceed with building the software. If {{EX:configure}} did +complain, well, you'll likely need to go to the Software FAQ +{{Installation}} section ({{URL:http://www.openldap.org/faq/?file=8}}) +and/or actually read the {{SECT:Building and Installing OpenLDAP Software}} +chapter of this document. + + +.{{S: }} ++{{B:Build the software}}. + +. The next step is to build the software. This step has two +parts, first we construct dependencies and then we compile the +software: + +..{{EX:make depend}} +..{{EX:make}} + + +. Both makes should complete without error. + + +.{{S: }} ++{{B:Test the build}}. + +. To ensure a correct build, you should run the test suite +(it only takes a few minutes): + +..{{EX:make test}} + +. Tests which apply to your configuration will run and they +should pass. Some tests, such as the replication test, may +be skipped. + + +.{{S: }} ++{{B:Install the software}}. + +. You are now ready to install the software; this usually requires +{{super-user}} privileges: + +..{{EX:su root -c 'make install'}} + +. Everything should now be installed under {{F:/usr/local}} (or +whatever installation prefix was used by {{EX:configure}}). + +.{{S: }} ++{{B:Edit the configuration file}}. + +. Use your favorite editor to edit the provided {{slapd.ldif}} +example (usually installed as {{F:/usr/local/etc/openldap/slapd.ldif}}) +to contain a MDB database definition of the form: + +..{{EX:dn: olcDatabase=mdb,cn=config}} +..{{EX:objectClass: olcDatabaseConfig}} +..{{EX:objectClass: olcMdbConfig}} +..{{EX:olcDatabase: mdb}} +..{{EX:OlcDbMaxSize: 1073741824}} +..{{EX:olcSuffix: dc=<MY-DOMAIN>,dc=<COM>}} +..{{EX:olcRootDN: cn=Manager,dc=<MY-DOMAIN>,dc=<COM>}} +..{{EX:olcRootPW: secret}} +..{{EX:olcDbDirectory: /usr/local/var/openldap-data}} +..{{EX:olcDbIndex: objectClass eq}} + +. Be sure to replace {{EX:<MY-DOMAIN>}} and {{EX:<COM>}} with +the appropriate domain components of your domain name. For +example, for {{EX:example.com}}, use: + +..{{EX:dn: olcDatabase=mdb,cn=config}} +..{{EX:objectClass: olcDatabaseConfig}} +..{{EX:objectClass: olcMdbConfig}} +..{{EX:olcDatabase: mdb}} +..{{EX:OlcDbMaxSize: 1073741824}} +..{{EX:olcSuffix: dc=example,dc=com}} +..{{EX:olcRootDN: cn=Manager,dc=example,dc=com}} +..{{EX:olcRootPW: secret}} +..{{EX:olcDbDirectory: /usr/local/var/openldap-data}} +..{{EX:olcDbIndex: objectClass eq}} + +.If your domain contains additional components, such as +{{EX:eng.uni.edu.eu}}, use: + +..{{EX:dn: olcDatabase=mdb,cn=config}} +..{{EX:objectClass: olcDatabaseConfig}} +..{{EX:objectClass: olcMdbConfig}} +..{{EX:olcDatabase: mdb}} +..{{EX:OlcDbMaxSize: 1073741824}} +..{{EX:olcSuffix: dc=eng,dc=uni,dc=edu,dc=eu}} +..{{EX:olcRootDN: cn=Manager,dc=eng,dc=uni,dc=edu,dc=eu}} +..{{EX:olcRootPW: secret}} +..{{EX:olcDbDirectory: /usr/local/var/openldap-data}} +..{{EX:olcDbIndex: objectClass eq}} + +. Details regarding configuring {{slapd}}(8) can be found +in the {{slapd-config}}(5) manual page and the {{SECT:Configuring +slapd}} chapter of this document. Note that the +specified olcDbDirectory must exist prior to starting {{slapd}}(8). + + +.{{S: }} ++{{B:Import the configuration database}} +. You are now ready to import your configration database for use by +{{slapd}}(8), by running the command: + +..{{EX: su root -c /usr/local/sbin/slapadd -n 0 -F /usr/local/etc/slapd.d -l /usr/local/etc/openldap/slapd.ldif}} + +.{{S: }} ++{{B:Start SLAPD}}. + +. You are now ready to start the Standalone LDAP Daemon, {{slapd}}(8), +by running the command: + +..{{EX:su root -c /usr/local/libexec/slapd -F /usr/local/etc/slapd.d}} + + +. To check to see if the server is running and configured correctly, +you can run a search against it with {{ldapsearch}}(1). By default, +{{ldapsearch}} is installed as {{F:/usr/local/bin/ldapsearch}}: + +..{{EX:ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts}} + +. Note the use of single quotes around command parameters to prevent +special characters from being interpreted by the shell. This should return: + +..{{EX:dn:}} +..{{EX:namingContexts: dc=example,dc=com}} + +. Details regarding running {{slapd}}(8) can be found +in the {{slapd}}(8) manual page and the +{{SECT:Running slapd}} chapter of this document. + + +.{{S: }} ++{{B:Add initial entries to your directory}}. + +. You can use {{ldapadd}}(1) to add entries to your LDAP directory. +{{ldapadd}} expects input in {{TERM:LDIF}} form. We'll do it in two +steps: + +^^ create an LDIF file +++ run ldapadd + +. Use your favorite editor and create an LDIF file that contains: + +..{{EX:dn: dc=<MY-DOMAIN>,dc=<COM>}} +..{{EX:objectclass: dcObject}} +..{{EX:objectclass: organization}} +..{{EX:o: <MY ORGANIZATION>}} +..{{EX:dc: <MY-DOMAIN>}} +..{{EX:}} +..{{EX:dn: cn=Manager,dc=<MY-DOMAIN>,dc=<COM>}} +..{{EX:objectclass: organizationalRole}} +..{{EX:cn: Manager}} + +. Be sure to replace {{EX:<MY-DOMAIN>}} and {{EX:<COM>}} with the +appropriate domain components of your domain name. {{EX:<MY +ORGANIZATION>}} should be replaced with the name of your organization. +When you cut and paste, be sure to trim any leading and trailing +whitespace from the example. + +..{{EX:dn: dc=example,dc=com}} +..{{EX:objectclass: dcObject}} +..{{EX:objectclass: organization}} +..{{EX:o: Example Company}} +..{{EX:dc: example}} +..{{EX:}} +..{{EX:dn: cn=Manager,dc=example,dc=com}} +..{{EX:objectclass: organizationalRole}} +..{{EX:cn: Manager}} + +. Now, you may run {{ldapadd}}(1) to insert these entries into +your directory. + +..{{EX:ldapadd -x -D "cn=Manager,dc=<MY-DOMAIN>,dc=<COM>" -W -f example.ldif}} + +. Be sure to replace {{EX:<MY-DOMAIN>}} and {{EX:<COM>}} with the +appropriate domain components of your domain name. You will be +prompted for the "{{EX:secret}}" specified in {{F:slapd.conf}}. +For example, for {{EX:example.com}}, use: + +..{{EX:ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f example.ldif}} + +. where {{F:example.ldif}} is the file you created above. +..{{EX: }} +. Additional information regarding directory creation can be found +in the {{SECT:Database Creation and Maintenance Tools}} chapter of +this document. + +.{{S: }} ++{{B:See if it works}}. + +. Now we're ready to verify the added entries are in your directory. +You can use any LDAP client to do this, but our example uses the +{{ldapsearch}}(1) tool. Remember to replace {{EX:dc=example,dc=com}} +with the correct values for your site: + +..{{EX:ldapsearch -x -b 'dc=example,dc=com' '(objectclass=*)'}} + +. This command will search for and retrieve every entry in the database. + +You are now ready to add more entries using {{ldapadd}}(1) or +another LDAP client, experiment with various configuration options, +backend arrangements, etc.. + +Note that by default, the {{slapd}}(8) database grants {{read access +to everybody}} excepting the {{super-user}} (as specified by the +{{EX:rootdn}} configuration directive). It is highly recommended +that you establish controls to restrict access to authorized users. +Access controls are discussed in the {{SECT:Access Control}} chapter. +You are also encouraged to read the {{SECT:Security Considerations}}, +{{SECT:Using SASL}} and {{SECT:Using TLS}} sections. + +The following chapters provide more detailed information on making, +installing, and running {{slapd}}(8). diff --git a/doc/guide/admin/referrals.sdf b/doc/guide/admin/referrals.sdf new file mode 100644 index 0000000..4884ce2 --- /dev/null +++ b/doc/guide/admin/referrals.sdf @@ -0,0 +1,146 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Constructing a Distributed Directory Service + +For many sites, running one or more {{slapd}}(8) that hold an +entire subtree of data is sufficient. But often it is desirable +to have one {{slapd}} refer to other directory services for a +certain part of the tree (which may or may not be running {{slapd}}). + +!if 0 +{{slapd}} supports {{subordinate}}, {{immediate superior}}, +and {{superior}} knowledge information. +!else +{{slapd}} supports {{subordinate}} and {{superior}} knowledge information. +Subordinate knowledge information is held in {{EX:referral}} +objects ({{REF:RFC3296}}). +!endif + + +H2: Subordinate Knowledge Information + +Subordinate knowledge information may be provided to delegate +a subtree. +Subordinate knowledge information is maintained in the directory +as a special {{referral}} object at the delegate point. +The referral object acts as a delegation point, gluing two services +together. +This mechanism allows for hierarchical directory services to be +constructed. + +A referral object has a structural object class of +{{EX:referral}} and has the same {{TERM[expand]DN}} as the +delegated subtree. Generally, the referral object will also +provide the auxiliary object class {{EX:extensibleObject}}. +This allows the entry to contain appropriate {{TERM[expand]RDN}} +values. This is best demonstrated by example. + +If the server {{EX:a.example.net}} holds {{EX:dc=example,dc=net}} +and wished to delegate the subtree {{EX:ou=subtree,dc=example,dc=net}} +to another server {{EX:b.example.net}}, the following named referral +object would be added to {{EX:a.example.net}}: + +> dn: dc=subtree,dc=example,dc=net +> objectClass: referral +> objectClass: extensibleObject +> dc: subtree +> ref: ldap://b.example.net/dc=subtree,dc=example,dc=net + +The server uses this information to generate referrals and +search continuations to subordinate servers. + +For those familiar with {{TERM:X.500}}, a {{named referral}} object is +similar to an X.500 knowledge reference held in a {{subr}} +{{TERM:DSE}}. + + +!if 0 +H2: Immediate Superior Knowledge Information + +Immediate superior knowledge information may be provided in the +entry at the root of a delegated subtree. The knowledge information +is contained with {{EX:ref}} operational attribute. + +Extending the example above, a {{ref}} attribute can be added +to the entry {{EX:dc=subtree,dc=example,dc=net}} in server B indicating +that A holds the immediate superior naming context. + +> dn: dc=subtree,dc=example,dc=net +> changetype: modify +> add: ref +> ref: ldap://a.example.net/ + +The server uses this information to generate referrals to +management operations. + +For those familiar with {{TERM:X.500}}, this use of the {{EX:ref}} +attribute is similar to an X.500 knowledge reference held in a +{{immSupr}} {{TERM:DSE}}. +!endif + + +H2: Superior Knowledge Information + +Superior knowledge information may be specified using the {{EX:referral}} +directive. The value is a list of {{TERM:URI}}s referring to +superior directory services. For servers without immediate superiors, +such as for {{EX:a.example.net}} in the example above, the server +can be configured to use a directory service with {{global knowledge}}, +such as the {{OpenLDAP Root Service}} +({{URL:http://www.openldap.org/faq/index.cgi?file=393}}). + +> referral ldap://root.openldap.org/ + +However, as {{EX:a.example.net}} is the {{immediate superior}} +to {{EX:b.example.net}}, {{b.example.net}} would be configured +as follows: + +> referral ldap://a.example.net/ + +The server uses this information to generate referrals for operations +acting upon entries not within or subordinate to any of the naming +contexts held by the server. + +For those familiar with {{TERM:X.500}}, this use of the {{EX:ref}} +attribute is similar to an X.500 knowledge reference held in a +{{Supr}} {{TERM:DSE}}. + + +H2: The ManageDsaIT Control + +Adding, modifying, and deleting referral objects is generally done +using {{ldapmodify}}(1) or similar tools which support the ManageDsaIT +control. The ManageDsaIT control informs the server that you intend +to manage the referral object as a regular entry. This keeps the +server from sending a referral result for requests which interrogate +or update referral objects. + +The ManageDsaIT control should not be specified when managing regular +entries. + +The {{EX:-M}} option of {{ldapmodify}}(1) (and other tools) enables +ManageDsaIT. For example: + +> ldapmodify -M -f referral.ldif -x -D "cn=Manager,dc=example,dc=net" -W + +or with {{ldapsearch}}(1): + +> ldapsearch -M -b "dc=example,dc=net" -x "(objectclass=referral)" '*' ref + +Note: the {{EX:ref}} attribute is operational and must be explicitly +requested when desired in search results. + +Note: the use of referrals to construct a Distributed Directory Service is +extremely clumsy and not well supported by common clients. If an existing +installation has already been built using referrals, the use of the +{{chain}} overlay to hide the referrals will greatly improve the usability +of the Directory system. A better approach would be to use explicitly +defined local and proxy databases in {{subordinate}} configurations to +provide a seamless view of the Distributed Directory. + +Note: LDAP operations, even subtree searches, normally access only one +database. That can be changed by gluing databases together with the +{{B:subordinate}}/{{B:olcSubordinate}} keyword. Please see {{slapd.conf}}(5) +and {{slapd-config}}(5). diff --git a/doc/guide/admin/refint.png b/doc/guide/admin/refint.png Binary files differnew file mode 100644 index 0000000..41843e7 --- /dev/null +++ b/doc/guide/admin/refint.png diff --git a/doc/guide/admin/replication.sdf b/doc/guide/admin/replication.sdf new file mode 100644 index 0000000..52cf6a2 --- /dev/null +++ b/doc/guide/admin/replication.sdf @@ -0,0 +1,1187 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Replication + +Replicated directories are a fundamental requirement for delivering a +resilient enterprise deployment. + +{{PRD:OpenLDAP}} has various configuration options for creating a replicated +directory. In previous releases, replication was discussed in terms of +a {{master}} server and some number of {{slave}} servers. A master +accepted directory updates from other clients, and a slave only +accepted updates from a (single) master. The replication structure +was rigidly defined and any particular database could only fulfill +a single role, either master or slave. + +As OpenLDAP now supports a wide variety of replication topologies, these +terms have been deprecated in favor of {{provider}} and +{{consumer}}: A provider replicates directory updates to consumers; +consumers receive replication updates from providers. Unlike the +rigidly defined master/slave relationships, provider/consumer roles +are quite fluid: replication updates received in a consumer can be +further propagated by that consumer to other servers, so a consumer +can also act simultaneously as a provider. Also, a consumer need not +be an actual LDAP server; it may be just an LDAP client. + +The following sections will describe the replication technology and +discuss the various replication options that are available. + +H2: Replication Technology + +H3: LDAP Sync Replication + +The {{TERM:LDAP Sync}} Replication engine, {{TERM:syncrepl}} for +short, is a consumer-side replication engine that enables the +consumer {{TERM:LDAP}} server to maintain a shadow copy of a +{{TERM:DIT}} fragment. A syncrepl engine resides at the consumer +and executes as one of the {{slapd}}(8) threads. It creates and maintains a +consumer replica by connecting to the replication provider to perform +the initial DIT content load followed either by periodic content +polling or by timely updates upon content changes. + +Syncrepl uses the LDAP Content Synchronization protocol (or LDAP Sync for +short) as the replica synchronization protocol. LDAP Sync provides +a stateful replication which supports both pull-based and push-based +synchronization and does not mandate the use of a history store. +In pull-based replication the consumer periodically +polls the provider for updates. In push-based replication the consumer +listens for updates that are sent by the provider in realtime. Since the +protocol does not require a history store, the provider does not need to +maintain any log of updates it has received (Note +that the syncrepl engine is extensible and additional replication +protocols may be supported in the future.). + +Syncrepl keeps track of the status of the replication content by +maintaining and exchanging synchronization cookies. Because the +syncrepl consumer and provider maintain their content status, the +consumer can poll the provider content to perform incremental +synchronization by asking for the entries required to make the +consumer replica up-to-date with the provider content. Syncrepl +also enables convenient management of replicas by maintaining replica +status. The consumer replica can be constructed from a consumer-side +or a provider-side backup at any synchronization status. Syncrepl +can automatically resynchronize the consumer replica up-to-date +with the current provider content. + +Syncrepl supports both pull-based and push-based synchronization. +In its basic refreshOnly synchronization mode, the provider uses +pull-based synchronization where the consumer servers need not be +tracked and no history information is maintained. The information +required for the provider to process periodic polling requests is +contained in the synchronization cookie of the request itself. To +optimize the pull-based synchronization, syncrepl utilizes the +present phase of the LDAP Sync protocol as well as its delete phase, +instead of falling back on frequent full reloads. To further optimize +the pull-based synchronization, the provider can maintain a per-scope +session log as a history store. In its refreshAndPersist mode of +synchronization, the provider uses a push-based synchronization. +The provider keeps track of the consumer servers that have requested +a persistent search and sends them necessary updates as the provider +replication content gets modified. + +With syncrepl, a consumer server can create a replica without +changing the provider's configurations and without restarting the +provider server, if the consumer server has appropriate access +privileges for the DIT fragment to be replicated. The consumer +server can stop the replication also without the need for provider-side +changes and restart. + +Syncrepl supports partial, sparse, and fractional replications. The shadow +DIT fragment is defined by a general search criteria consisting of +base, scope, filter, and attribute list. The replica content is +also subject to the access privileges of the bind identity of the +syncrepl replication connection. + + +H4: The LDAP Content Synchronization Protocol + +The LDAP Sync protocol allows a client to maintain a synchronized +copy of a DIT fragment. The LDAP Sync operation is defined as a set +of controls and other protocol elements which extend the LDAP search +operation. This section introduces the LDAP Content Sync protocol +only briefly. For more information, refer to {{REF:RFC4533}}. + +The LDAP Sync protocol supports both polling and listening for changes +by defining two respective synchronization operations: +{{refreshOnly}} and {{refreshAndPersist}}. Polling is implemented +by the {{refreshOnly}} operation. The consumer +polls the provider using an LDAP Search request with an LDAP Sync +control attached. The consumer copy is synchronized +to the provider copy at the time of polling using the information +returned in the search. The provider finishes the +search operation by returning {{SearchResultDone}} at the end of +the search operation as in the normal search. Listening is +implemented by the {{refreshAndPersist}} operation. As the name +implies, it begins with a search, like refreshOnly. Instead of +finishing the search after returning all entries currently matching +the search criteria, the synchronization search remains persistent +in the provider. Subsequent updates to the synchronization content +in the provider cause additional entry updates to be sent to the +consumer. + +The {{refreshOnly}} operation and the refresh stage of the +{{refreshAndPersist}} operation can be performed with a present +phase or a delete phase. + +In the present phase, the provider sends the consumer the entries updated +within the search scope since the last synchronization. The provider +sends all requested attributes, be they changed or not, of the updated +entries. For each unchanged entry which remains in the scope, the +provider sends a present message consisting only of the name of the +entry and the synchronization control representing state present. +The present message does not contain any attributes of the entry. +After the consumer receives all update and present entries, it can +reliably determine the new consumer copy by adding the entries added +to the provider, by replacing the entries modified at the provider, and +by deleting entries in the consumer copy which have not been updated +nor specified as being present at the provider. + +The transmission of the updated entries in the delete phase is the +same as in the present phase. The provider sends all the requested +attributes of the entries updated within the search scope since the +last synchronization to the consumer. In the delete phase, however, +the provider sends a delete message for each entry deleted from the +search scope, instead of sending present messages. The delete +message consists only of the name of the entry and the synchronization +control representing state delete. The new consumer copy can be +determined by adding, modifying, and removing entries according to +the synchronization control attached to the {{SearchResultEntry}} +message. + +In the case that the LDAP Sync provider maintains a history store and +can determine which entries are scoped out of the consumer copy since +the last synchronization time, the provider can use the delete phase. +If the provider does not maintain any history store, cannot determine +the scoped-out entries from the history store, or the history store +does not cover the outdated synchronization state of the consumer, +the provider should use the present phase. The use of the present +phase is much more efficient than a full content reload in terms +of the synchronization traffic. To reduce the synchronization +traffic further, the LDAP Sync protocol also provides several +optimizations such as the transmission of the normalized {{EX:entryUUID}}s +and the transmission of multiple {{EX:entryUUIDs}} in a single +{{syncIdSet}} message. + +At the end of the {{refreshOnly}} synchronization, the provider sends +a synchronization cookie to the consumer as a state indicator of the +consumer copy after the synchronization is completed. The consumer +will present the received cookie when it requests the next incremental +synchronization to the provider. + +When {{refreshAndPersist}} synchronization is used, the provider sends +a synchronization cookie at the end of the refresh stage by sending +a Sync Info message with refreshDone=TRUE. It also sends a +synchronization cookie by attaching it to {{SearchResultEntry}} +messages generated in the persist stage of the synchronization search. During +the persist stage, the provider can also send a Sync Info message +containing the synchronization cookie at any time the provider wants +to update the consumer-side state indicator. + +In the LDAP Sync protocol, entries are uniquely identified by the +{{EX:entryUUID}} attribute value. It can function as a reliable +identifier of the entry. The DN of the entry, on the other hand, +can be changed over time and hence cannot be considered as the +reliable identifier. The {{EX:entryUUID}} is attached to each +{{SearchResultEntry}} or {{SearchResultReference}} as a part of the +synchronization control. + +H4: Syncrepl Details + +The syncrepl engine utilizes both the {{refreshOnly}} and the +{{refreshAndPersist}} operations of the LDAP Sync protocol. If a +syncrepl specification is included in a database definition, +{{slapd}}(8) launches a syncrepl engine as a {{slapd}}(8) thread +and schedules its execution. If the {{refreshOnly}} operation is +specified, the syncrepl engine will be rescheduled at the interval +time after a synchronization operation is completed. If the +{{refreshAndPersist}} operation is specified, the engine will remain +active and process the persistent synchronization messages from the +provider. + +The syncrepl engine utilizes both the present phase and the delete +phase of the refresh synchronization. It is possible to configure +a session log in the provider which stores the +{{EX:entryUUID}}s of a finite number of entries deleted from a +database. Multiple replicas share the same session log. The syncrepl +engine uses the +delete phase if the session log is present and the state of the +consumer server is recent enough that no session log entries are +truncated after the last synchronization of the client. The syncrepl +engine uses the present phase if no session log is configured for +the replication content or if the consumer replica is too outdated +to be covered by the session log. The current design of the session +log store is memory based, so the information contained in the +session log is not persistent over multiple provider invocations. +It is not currently supported to access the session log store by +using LDAP operations. It is also not currently supported to impose +access control to the session log. + +As a further optimization, even in the case the synchronization +search is not associated with any session log, no entries will be +transmitted to the consumer server when there has been no update +in the replication context. + +The syncrepl engine, which is a consumer-side replication engine, +can work with any backends. The LDAP Sync provider can be configured +as an overlay on any backend, but works best with the {{back-bdb}}, +{{back-hdb}}, or {{back-mdb}} backends. + +The LDAP Sync provider maintains a {{EX:contextCSN}} for each +database as the current synchronization state indicator of the +provider content. It is the largest {{EX:entryCSN}} in the provider +context such that no transactions for an entry having smaller +{{EX:entryCSN}} value remains outstanding. The {{EX:contextCSN}} +could not just be set to the largest issued {{EX:entryCSN}} because +{{EX:entryCSN}} is obtained before a transaction starts and +transactions are not committed in the issue order. + +The provider stores the {{EX:contextCSN}} of a context in the +{{EX:contextCSN}} attribute of the context suffix entry. The attribute +is not written to the database after every update operation though; +instead it is maintained primarily in memory. At database start +time the provider reads the last saved {{EX:contextCSN}} into memory +and uses the in-memory copy exclusively thereafter. By default, +changes to the {{EX:contextCSN}} as a result of database updates +will not be written to the database until the server is cleanly +shut down. A checkpoint facility exists to cause the {{EX:contextCSN}} to +be written out more frequently if desired. + +Note that at startup time, if the provider is unable to read a +{{EX:contextCSN}} from the suffix entry, it will scan the entire +database to determine the value, and this scan may take quite a +long time on a large database. When a {{EX:contextCSN}} value is +read, the database will still be scanned for any {{EX:entryCSN}} +values greater than it, to make sure the {{EX:contextCSN}} value +truly reflects the greatest committed {{EX:entryCSN}} in the database. +On databases which support inequality indexing, setting an eq index +on the {{EX:entryCSN}} attribute and configuring {{contextCSN}} +checkpoints will greatly speed up this scanning step. + +If no {{EX:contextCSN}} can be determined by reading and scanning +the database, a new value will be generated. Also, if scanning the +database yielded a greater {{EX:entryCSN}} than was previously +recorded in the suffix entry's {{EX:contextCSN}} attribute, a +checkpoint will be immediately written with the new value. + +The consumer also stores its replica state, which is the provider's +{{EX:contextCSN}} received as a synchronization cookie, in the +{{EX:contextCSN}} attribute of the suffix entry. The replica state +maintained by a consumer server is used as the synchronization state +indicator when it performs subsequent incremental synchronization +with the provider server. It is also used as a provider-side +synchronization state indicator when it functions as a secondary +provider server in a cascading replication configuration. Since +the consumer and provider state information are maintained in the +same location within their respective databases, any consumer can +be promoted to a provider (and vice versa) without any special +actions. + +Because a general search filter can be used in the syncrepl +specification, some entries in the context may be omitted from the +synchronization content. The syncrepl engine creates a glue entry +to fill in the holes in the replica context if any part of the +replica content is subordinate to the holes. The glue entries will +not be returned in the search result unless {{ManageDsaIT}} control +is provided. + +Also as a consequence of the search filter used in the syncrepl +specification, it is possible for a modification to remove an entry +from the replication scope even though the entry has not been deleted +on the provider. Logically the entry must be deleted on the consumer +but in {{refreshOnly}} mode the provider cannot detect and propagate +this change without the use of the session log on the provider. + +For configuration, please see the {{SECT:Syncrepl}} section. + + +H2: Deployment Alternatives + +While the LDAP Sync specification only defines a narrow scope for replication, +the OpenLDAP implementation is extremely flexible and supports a variety of +operating modes to handle other scenarios not explicitly addressed in the spec. + + +H3: Delta-syncrepl replication + +* Disadvantages of LDAP Sync replication: + +LDAP Sync replication is an object-based replication mechanism. +When any attribute value in a replicated object is changed on the provider, +each consumer fetches and processes the complete changed object, including +{{B:both the changed and unchanged attribute values}} during replication. +One advantage of this approach is that when multiple changes occur to +a single object, the precise sequence of those changes need not be preserved; +only the final state of the entry is significant. But this approach +may have drawbacks when the usage pattern involves single changes to +multiple objects. + +For example, suppose you have a database consisting of 102,400 objects of 1 KB +each. Further, suppose you routinely run a batch job to change the value of +a single two-byte attribute value that appears in each of the 102,400 objects +on the master. Not counting LDAP and TCP/IP protocol overhead, each time you +run this job each consumer will transfer and process {{B:100 MB}} of data to +process {{B:200KB of changes!}} + +99.98% of the data that is transmitted and processed in a case like this will +be redundant, since it represents values that did not change. This is a waste +of valuable transmission and processing bandwidth and can cause an unacceptable +replication backlog to develop. While this situation is extreme, it serves to +demonstrate a very real problem that is encountered in some LDAP deployments. + + +* Where Delta-syncrepl comes in: + +Delta-syncrepl, a changelog-based variant of syncrepl, is designed to address +situations like the one described above. Delta-syncrepl works by maintaining a +changelog of a selectable depth in a separate database on the provider. The replication consumer +checks the changelog for the changes it needs and, as long as +the changelog contains the needed changes, the consumer fetches the changes +from the changelog and applies them to its database. If, however, a replica +is too far out of sync (or completely empty), conventional syncrepl is used to +bring it up to date and replication then switches back to the delta-syncrepl +mode. + +Note: since the database state is stored in both the changelog DB and the +main DB on the provider, it is important to backup/restore both the changelog +DB and the main DB using slapcat/slapadd when restoring a DB or copying +it to another machine. + +For configuration, please see the {{SECT:Delta-syncrepl}} section. + + +H3: N-Way Multi-Master replication + +Multi-Master replication is a replication technique using Syncrepl to replicate +data to multiple provider ("Master") Directory servers. + +H4: Valid Arguments for Multi-Master replication + +* If any provider fails, other providers will continue to accept updates +* Avoids a single point of failure +* Providers can be located in several physical sites i.e. distributed across +the network/globe. +* Good for Automatic failover/High Availability + +H4: Invalid Arguments for Multi-Master replication + +(These are often claimed to be advantages of Multi-Master replication but +those claims are false): + +* It has {{B:NOTHING}} to do with load balancing +* Providers {{B:must}} propagate writes to {{B:all}} the other servers, which +means the network traffic and write load spreads across all +of the servers the same as for single-master. +* Server utilization and performance are at best identical for +Multi-Master and Single-Master replication; at worst Single-Master is +superior because indexing can be tuned differently to optimize for the +different usage patterns between the provider and the consumers. + +H4: Arguments against Multi-Master replication + +* Breaks the data consistency guarantees of the directory model +* {{URL:http://www.openldap.org/faq/data/cache/1240.html}} +* If connectivity with a provider is lost because of a network partition, then +"automatic failover" can just compound the problem +* Typically, a particular machine cannot distinguish between losing contact + with a peer because that peer crashed, or because the network link has failed +* If a network is partitioned and multiple clients start writing to each of the +"masters" then reconciliation will be a pain; it may be best to simply deny +writes to the clients that are partitioned from the single provider + + +For configuration, please see the {{SECT:N-Way Multi-Master}} section below + +H3: MirrorMode replication + +MirrorMode is a hybrid configuration that provides all of the consistency +guarantees of single-master replication, while also providing the high +availability of multi-master. In MirrorMode two providers are set up to +replicate from each other (as a multi-master configuration), but an +external frontend is employed to direct all writes to only one of +the two servers. The second provider will only be used for writes if +the first provider crashes, at which point the frontend will switch to +directing all writes to the second provider. When a crashed provider is +repaired and restarted it will automatically catch up to any changes +on the running provider and resync. + +H4: Arguments for MirrorMode + +* Provides a high-availability (HA) solution for directory writes (replicas handle reads) +* As long as one provider is operational, writes can safely be accepted +* Provider nodes replicate from each other, so they are always up to date and +can be ready to take over (hot standby) +* Syncrepl also allows the provider nodes to re-synchronize after any downtime + + +H4: Arguments against MirrorMode + +* MirrorMode is not what is termed as a Multi-Master solution. This is because +writes have to go to just one of the mirror nodes at a time +* MirrorMode can be termed as Active-Active Hot-Standby, therefore an external +server (slapd in proxy mode) or device (hardware load balancer) +is needed to manage which provider is currently active +* Backups are managed slightly differently +- If backing up the Berkeley database itself and periodically backing up the +transaction log files, then the same member of the mirror pair needs to be +used to collect logfiles until the next database backup is taken + +For configuration, please see the {{SECT:MirrorMode}} section below + + +H3: Syncrepl Proxy Mode + +While the LDAP Sync protocol supports both pull- and push-based replication, +the push mode (refreshAndPersist) must still be initiated from the consumer +before the provider can begin pushing changes. In some network configurations, +particularly where firewalls restrict the direction in which connections +can be made, a provider-initiated push mode may be needed. + +This mode can be configured with the aid of the LDAP Backend +({{SECT: Backends}} and {{slapd-ldap(8)}}). Instead of running the +syncrepl engine on the actual consumer, a slapd-ldap proxy is set up +near (or collocated with) the provider that points to the consumer, +and the syncrepl engine runs on the proxy. + +For configuration, please see the {{SECT:Syncrepl Proxy}} section. + +H4: Replacing Slurpd + +The old {{slurpd}} mechanism only operated in provider-initiated +push mode. Slurpd replication was deprecated in favor of Syncrepl +replication and has been completely removed from OpenLDAP 2.4. + +The slurpd daemon was the original replication mechanism inherited from +UMich's LDAP and operated in push mode: the master pushed changes to the +slaves. It was replaced for many reasons, in brief: + + * It was not reliable + ** It was extremely sensitive to the ordering of records in the replog + ** It could easily go out of sync, at which point manual intervention was + required to resync the slave database with the master directory + ** It wasn't very tolerant of unavailable servers. If a slave went down + for a long time, the replog could grow to a size that was too large for + slurpd to process + * It only worked in push mode + * It required stopping and restarting the master to add new slaves + * It only supported single master replication + +Syncrepl has none of those weaknesses: + + * Syncrepl is self-synchronizing; you can start with a consumer database + in any state from totally empty to fully synced and it will automatically + do the right thing to achieve and maintain synchronization + ** It is completely insensitive to the order in which changes occur + ** It guarantees convergence between the consumer and the provider + content without manual intervention + ** It can resynchronize regardless of how long a consumer stays out + of contact with the provider + * Syncrepl can operate in either direction + * Consumers can be added at any time without touching anything on the + provider + * Multi-master replication is supported + + +H2: Configuring the different replication types + +H3: Syncrepl + +H4: Syncrepl configuration + +Because syncrepl is a consumer-side replication engine, the syncrepl +specification is defined in {{slapd.conf}}(5) of the consumer +server, not in the provider server's configuration file. The initial +loading of the replica content can be performed either by starting +the syncrepl engine with no synchronization cookie or by populating +the consumer replica by loading an {{TERM:LDIF}} file dumped as a +backup at the provider. + +When loading from a backup, it is not required to perform the initial +loading from the up-to-date backup of the provider content. The +syncrepl engine will automatically synchronize the initial consumer +replica to the current provider content. As a result, it is not +required to stop the provider server in order to avoid the replica +inconsistency caused by the updates to the provider content during +the content backup and loading process. + +When replicating a large scale directory, especially in a bandwidth +constrained environment, it is advised to load the consumer replica +from a backup instead of performing a full initial load using +syncrepl. + + +H4: Set up the provider slapd + +The provider is implemented as an overlay, so the overlay itself +must first be configured in {{slapd.conf}}(5) before it can be +used. The provider has two primary configuration directives and +two secondary directives for when delta-syncrepl is being used. +Because the LDAP Sync search is subject to access control, proper +access control privileges should be set up for the replicated +content. + +The two primary options to configure are the checkpoint and +sessionlog behaviors. + +The {{EX:contextCSN}} checkpoint is configured by the + +> syncprov-checkpoint <ops> <minutes> + +directive. Checkpoints are only tested after successful write +operations. If {{<ops>}} operations or more than {{<minutes>}} +time has passed since the last checkpoint, a new checkpoint is +performed. Checkpointing is disabled by default. + +The session log is configured by the + +> syncprov-sessionlog <ops> + +directive, where {{<ops>}} is the maximum number of session log +entries the session log can record. All write operations (except Adds) +are recorded in the log. + +Note that using the session log requires searching on the {{entryUUID}} +attribute. Setting an eq index on this attribute will greatly benefit +the performance of the session log on the provider. + +The reloadhint option is configured by the + +> syncprov-reloadhint <TRUE|FALSE> + +directive. It must be set TRUE when using the accesslog overlay for +delta-based syncrepl replication support. The default is FALSE. + +The nonpresent option should only be configured if the overlay is +being placed on top of a log database, such as when used with +delta-syncrepl. + +The nonpresent option is configured by the + +> syncprov-nopresent <TRUE|FALSE> + +directive. This value should only be set TRUE for a syncprov instance +on top of a log database (such as one managed by the accesslog overlay). +The default is FALSE. + +A more complete example of the {{slapd.conf}}(5) content is thus: + +> database mdb +> maxsize 1073741824 +> suffix dc=Example,dc=com +> rootdn dc=Example,dc=com +> directory /var/ldap/db +> index objectclass,entryCSN,entryUUID eq +> +> overlay syncprov +> syncprov-checkpoint 100 10 +> syncprov-sessionlog 100 + + +H4: Set up the consumer slapd + +The syncrepl replication is specified in the database section of +{{slapd.conf}}(5) for the replica context. The syncrepl engine +is backend independent and the directive can be defined with any +database type. + +> database mdb +> maxsize 1073741824 +> suffix dc=Example,dc=com +> rootdn dc=Example,dc=com +> directory /var/ldap/db +> index objectclass,entryCSN,entryUUID eq +> +> syncrepl rid=123 +> provider=ldap://provider.example.com:389 +> type=refreshOnly +> interval=01:00:00:00 +> searchbase="dc=example,dc=com" +> filter="(objectClass=organizationalPerson)" +> scope=sub +> attrs="cn,sn,ou,telephoneNumber,title,l" +> schemachecking=off +> bindmethod=simple +> binddn="cn=syncuser,dc=example,dc=com" +> credentials=secret + +In this example, the consumer will connect to the provider {{slapd}}(8) +at port 389 of {{FILE:ldap://provider.example.com}} to perform a +polling ({{refreshOnly}}) mode of synchronization once a day. It +will bind as {{EX:cn=syncuser,dc=example,dc=com}} using simple +authentication with password "secret". Note that the access control +privilege of {{EX:cn=syncuser,dc=example,dc=com}} should be set +appropriately in the provider to retrieve the desired replication +content. Also the search limits must be high enough on the provider +to allow the syncuser to retrieve a complete copy of the requested +content. The consumer uses the rootdn to write to its database so +it always has full permissions to write all content. + +The synchronization search in the above example will search for the +entries whose objectClass is organizationalPerson in the entire +subtree rooted at {{EX:dc=example,dc=com}}. The requested attributes +are {{EX:cn}}, {{EX:sn}}, {{EX:ou}}, {{EX:telephoneNumber}}, +{{EX:title}}, and {{EX:l}}. The schema checking is turned off, so +that the consumer {{slapd}}(8) will not enforce entry schema +checking when it processes updates from the provider {{slapd}}(8). + +For more detailed information on the syncrepl directive, see the +{{SECT:syncrepl}} section of {{SECT:The slapd Configuration File}} +chapter of this admin guide. + + +H4: Start the provider and the consumer slapd + +The provider {{slapd}}(8) is not required to be restarted. +{{contextCSN}} is automatically generated as needed: it might be +originally contained in the {{TERM:LDIF}} file, generated by +{{slapadd}} (8), generated upon changes in the context, or generated +when the first LDAP Sync search arrives at the provider. If an +LDIF file is being loaded which did not previously contain the +{{contextCSN}}, the {{-w}} option should be used with {{slapadd}} +(8) to cause it to be generated. This will allow the server to +startup a little quicker the first time it runs. + +When starting a consumer {{slapd}}(8), it is possible to provide +a synchronization cookie as the {{-c cookie}} command line option +in order to start the synchronization from a specific state. The +cookie is a comma separated list of name=value pairs. Currently +supported syncrepl cookie fields are {{csn=<csn>}} and {{rid=<rid>}}. +{{<csn>}} represents the current synchronization state of the +consumer replica. {{<rid>}} identifies a consumer replica locally +within the consumer server. It is used to relate the cookie to the +syncrepl definition in {{slapd.conf}}(5) which has the matching +replica identifier. The {{<rid>}} must have no more than 3 decimal +digits. The command line cookie overrides the synchronization +cookie stored in the consumer replica database. + + +H3: Delta-syncrepl + +H4: Delta-syncrepl Provider configuration + +Setting up delta-syncrepl requires configuration changes on both the master and +replica servers: + +> # Give the replica DN unlimited read access. This ACL needs to be +> # merged with other ACL statements, and/or moved within the scope +> # of a database. The "by * break" portion causes evaluation of +> # subsequent rules. See slapd.access(5) for details. +> access to * +> by dn.base="cn=replicator,dc=symas,dc=com" read +> by * break +> +> # Set the module path location +> modulepath /opt/symas/lib/openldap +> +> # Load the hdb backend +> moduleload back_hdb.la +> +> # Load the accesslog overlay +> moduleload accesslog.la +> +> #Load the syncprov overlay +> moduleload syncprov.la +> +> # Accesslog database definitions +> database hdb +> suffix cn=accesslog +> directory /db/accesslog +> rootdn cn=accesslog +> index default eq +> index entryCSN,objectClass,reqEnd,reqResult,reqStart +> +> overlay syncprov +> syncprov-nopresent TRUE +> syncprov-reloadhint TRUE +> +> # Let the replica DN have limitless searches +> limits dn.exact="cn=replicator,dc=symas,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited +> +> # Primary database definitions +> database hdb +> suffix "dc=symas,dc=com" +> rootdn "cn=manager,dc=symas,dc=com" +> +> ## Whatever other configuration options are desired +> +> # syncprov specific indexing +> index entryCSN eq +> index entryUUID eq +> +> # syncrepl Provider for primary db +> overlay syncprov +> syncprov-checkpoint 1000 60 +> +> # accesslog overlay definitions for primary db +> overlay accesslog +> logdb cn=accesslog +> logops writes +> logsuccess TRUE +> # scan the accesslog DB every day, and purge entries older than 7 days +> logpurge 07+00:00 01+00:00 +> +> # Let the replica DN have limitless searches +> limits dn.exact="cn=replicator,dc=symas,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited + +For more information, always consult the relevant man pages ({{slapo-accesslog}}(5) and {{slapd.conf}}(5)) + + +H4: Delta-syncrepl Consumer configuration + +> # Replica database configuration +> database hdb +> suffix "dc=symas,dc=com" +> rootdn "cn=manager,dc=symas,dc=com" +> +> ## Whatever other configuration bits for the replica, like indexing +> ## that you want +> +> # syncrepl specific indices +> index entryUUID eq +> +> # syncrepl directives +> syncrepl rid=0 +> provider=ldap://ldapmaster.symas.com:389 +> bindmethod=simple +> binddn="cn=replicator,dc=symas,dc=com" +> credentials=secret +> searchbase="dc=symas,dc=com" +> logbase="cn=accesslog" +> logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" +> schemachecking=on +> type=refreshAndPersist +> retry="60 +" +> syncdata=accesslog +> +> # Refer updates to the master +> updateref ldap://ldapmaster.symas.com + + +The above configuration assumes that you have a replicator identity defined +in your database that can be used to bind to the provider. In addition, +all of the databases (primary, replica, and the accesslog +storage database) should also have properly tuned {{DB_CONFIG}} files that meet +your needs. + +Note: An accesslog database is unique to a given master. It should +never be replicated. + +H3: N-Way Multi-Master + +For the following example we will be using 3 Master nodes. Keeping in line with +{{B:test050-syncrepl-multimaster}} of the OpenLDAP test suite, we will be configuring +{{slapd(8)}} via {{B:cn=config}} + +This sets up the config database: + +> dn: cn=config +> objectClass: olcGlobal +> cn: config +> olcServerID: 1 +> +> dn: olcDatabase={0}config,cn=config +> objectClass: olcDatabaseConfig +> olcDatabase: {0}config +> olcRootPW: secret + +second and third servers will have a different olcServerID obviously: + +> dn: cn=config +> objectClass: olcGlobal +> cn: config +> olcServerID: 2 +> +> dn: olcDatabase={0}config,cn=config +> objectClass: olcDatabaseConfig +> olcDatabase: {0}config +> olcRootPW: secret + +This sets up syncrepl as a provider (since these are all masters): + +> dn: cn=module,cn=config +> objectClass: olcModuleList +> cn: module +> olcModulePath: /usr/local/libexec/openldap +> olcModuleLoad: syncprov.la + +Now we setup the first Master Node (replace $URI1, $URI2 and $URI3 etc. with your actual ldap urls): + +> dn: cn=config +> changetype: modify +> replace: olcServerID +> olcServerID: 1 $URI1 +> olcServerID: 2 $URI2 +> olcServerID: 3 $URI3 +> +> dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config +> changetype: add +> objectClass: olcOverlayConfig +> objectClass: olcSyncProvConfig +> olcOverlay: syncprov +> +> dn: olcDatabase={0}config,cn=config +> changetype: modify +> add: olcSyncRepl +> olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple +> credentials=secret searchbase="cn=config" type=refreshAndPersist +> retry="5 5 300 5" timeout=1 +> olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple +> credentials=secret searchbase="cn=config" type=refreshAndPersist +> retry="5 5 300 5" timeout=1 +> olcSyncRepl: rid=003 provider=$URI3 binddn="cn=config" bindmethod=simple +> credentials=secret searchbase="cn=config" type=refreshAndPersist +> retry="5 5 300 5" timeout=1 +> - +> add: olcMirrorMode +> olcMirrorMode: TRUE + +Now start up the Master and a consumer/s, also add the above LDIF to the first consumer, second consumer etc. It will then replicate {{B:cn=config}}. You now have N-Way Multimaster on the config database. + +We still have to replicate the actual data, not just the config, so add to the master (all active and configured consumers/masters will pull down this config, as they are all syncing). Also, replace all {{${}}} variables with whatever is applicable to your setup: + +> dn: olcDatabase={1}$BACKEND,cn=config +> objectClass: olcDatabaseConfig +> objectClass: olc${BACKEND}Config +> olcDatabase: {1}$BACKEND +> olcSuffix: $BASEDN +> olcDbDirectory: ./db +> olcRootDN: $MANAGERDN +> olcRootPW: $PASSWD +> olcLimits: dn.exact="$MANAGERDN" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited +> olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple +> credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly +> interval=00:00:00:10 retry="5 5 300 5" timeout=1 +> olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple +> credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly +> interval=00:00:00:10 retry="5 5 300 5" timeout=1 +> olcSyncRepl: rid=006 provider=$URI3 binddn="$MANAGERDN" bindmethod=simple +> credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly +> interval=00:00:00:10 retry="5 5 300 5" timeout=1 +> olcMirrorMode: TRUE +> +> dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config +> changetype: add +> objectClass: olcOverlayConfig +> objectClass: olcSyncProvConfig +> olcOverlay: syncprov + +Note: All of your servers' clocks must be tightly synchronized using +e.g. NTP {{http://www.ntp.org/}}, atomic clock, or some other reliable +time reference. + +Note: As stated in {{slapd-config}}(5), URLs specified in {{olcSyncRepl}} +directives are the URLs of the servers from which to replicate. These +must exactly match the URLs {{slapd}} listens on ({{-h}} in {{SECT:Command-Line Options}}). +Otherwise slapd may attempt to replicate from itself, causing a loop. + +H3: MirrorMode + +MirrorMode configuration is actually very easy. If you have ever setup a normal +slapd syncrepl provider, then the only change is the following two directives: + +> mirrormode on +> serverID 1 + +Note: You need to make sure that the {{serverID}} of each mirror node is +different and add it as a global configuration option. + +H4: Mirror Node Configuration + +The first step is to configure the syncrepl provider the same as in the +{{SECT:Set up the provider slapd}} section. + +Here's a specific cut down example using {{SECT:LDAP Sync Replication}} in +{{refreshAndPersist}} mode: + +MirrorMode node 1: + +> # Global section +> serverID 1 +> # database section +> +> # syncrepl directive
+> syncrepl rid=001
+> provider=ldap://ldap-sid2.example.com
+> bindmethod=simple
+> binddn="cn=mirrormode,dc=example,dc=com"
+> credentials=mirrormode
+> searchbase="dc=example,dc=com"
+> schemachecking=on
+> type=refreshAndPersist
+> retry="60 +"
+> +> mirrormode on + +MirrorMode node 2: + +> # Global section +> serverID 2 +> # database section +> +> # syncrepl directive
+> syncrepl rid=001
+> provider=ldap://ldap-sid1.example.com
+> bindmethod=simple
+> binddn="cn=mirrormode,dc=example,dc=com"
+> credentials=mirrormode
+> searchbase="dc=example,dc=com"
+> schemachecking=on
+> type=refreshAndPersist
+> retry="60 +"
+>
+> mirrormode on + +It's simple really; each MirrorMode node is setup {{B:exactly}} the same, except +that the {{serverID}} is unique, and each consumer is pointed to +the other server. + +H5: Failover Configuration + +There are generally 2 choices for this; 1. Hardware proxies/load-balancing or +dedicated proxy software, 2. using a Back-LDAP proxy as a syncrepl provider + +A typical enterprise example might be: + +!import "dual_dc.png"; align="center"; title="MirrorMode Enterprise Configuration" +FT[align="Center"] Figure X.Y: MirrorMode in a Dual Data Center Configuration + +H5: Normal Consumer Configuration + +This is exactly the same as the {{SECT:Set up the consumer slapd}} section. It +can either setup in normal {{SECT:syncrepl replication}} mode, or in +{{SECT:delta-syncrepl replication}} mode. + +H4: MirrorMode Summary + +You will now have a directory architecture that provides all of the +consistency guarantees of single-master replication, while also providing the +high availability of multi-master replication. + + +H3: Syncrepl Proxy + +!import "push-based-complete.png"; align="center"; title="Syncrepl Proxy Mode" +FT[align="Center"] Figure X.Y: Replacing slurpd + +The following example is for a self-contained push-based replication solution: + +> ####################################################################### +> # Standard OpenLDAP Master/Provider +> ####################################################################### +> +> include /usr/local/etc/openldap/schema/core.schema +> include /usr/local/etc/openldap/schema/cosine.schema +> include /usr/local/etc/openldap/schema/nis.schema +> include /usr/local/etc/openldap/schema/inetorgperson.schema +> +> include /usr/local/etc/openldap/slapd.acl +> +> modulepath /usr/local/libexec/openldap +> moduleload back_hdb.la +> moduleload syncprov.la +> moduleload back_monitor.la +> moduleload back_ldap.la +> +> pidfile /usr/local/var/slapd.pid +> argsfile /usr/local/var/slapd.args +> +> loglevel sync stats +> +> database hdb +> suffix "dc=suretecsystems,dc=com" +> directory /usr/local/var/openldap-data +> +> checkpoint 1024 5 +> cachesize 10000 +> idlcachesize 10000 +> +> index objectClass eq +> # rest of indexes +> index default sub +> +> rootdn "cn=admin,dc=suretecsystems,dc=com" +> rootpw testing +> +> # syncprov specific indexing +> index entryCSN eq +> index entryUUID eq +> +> # syncrepl Provider for primary db +> overlay syncprov +> syncprov-checkpoint 1000 60 +> +> # Let the replica DN have limitless searches +> limits dn.exact="cn=replicator,dc=suretecsystems,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited +> +> database monitor +> +> database config +> rootpw testing +> +> ############################################################################## +> # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap +> ############################################################################## +> +> database ldap +> # ignore conflicts with other databases, as we need to push out to same suffix +> hidden on +> suffix "dc=suretecsystems,dc=com" +> rootdn "cn=slapd-ldap" +> uri ldap://localhost:9012/ +> +> lastmod on +> +> # We don't need any access to this DSA +> restrict all +> +> acl-bind bindmethod=simple +> binddn="cn=replicator,dc=suretecsystems,dc=com" +> credentials=testing +> +> syncrepl rid=001 +> provider=ldap://localhost:9011/ +> binddn="cn=replicator,dc=suretecsystems,dc=com" +> bindmethod=simple +> credentials=testing +> searchbase="dc=suretecsystems,dc=com" +> type=refreshAndPersist +> retry="5 5 300 5" +> +> overlay syncprov + +A replica configuration for this type of setup could be: + +> ####################################################################### +> # Standard OpenLDAP Slave without Syncrepl +> ####################################################################### +> +> include /usr/local/etc/openldap/schema/core.schema +> include /usr/local/etc/openldap/schema/cosine.schema +> include /usr/local/etc/openldap/schema/nis.schema +> include /usr/local/etc/openldap/schema/inetorgperson.schema +> +> include /usr/local/etc/openldap/slapd.acl +> +> modulepath /usr/local/libexec/openldap +> moduleload back_hdb.la +> moduleload syncprov.la +> moduleload back_monitor.la +> moduleload back_ldap.la +> +> pidfile /usr/local/var/slapd.pid +> argsfile /usr/local/var/slapd.args +> +> loglevel sync stats +> +> database hdb +> suffix "dc=suretecsystems,dc=com" +> directory /usr/local/var/openldap-slave/data +> +> checkpoint 1024 5 +> cachesize 10000 +> idlcachesize 10000 +> +> index objectClass eq +> # rest of indexes +> index default sub +> +> rootdn "cn=admin,dc=suretecsystems,dc=com" +> rootpw testing +> +> # Let the replica DN have limitless searches +> limits dn.exact="cn=replicator,dc=suretecsystems,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited +> +> updatedn "cn=replicator,dc=suretecsystems,dc=com" +> +> # Refer updates to the master +> updateref ldap://localhost:9011 +> +> database monitor +> +> database config +> rootpw testing + +You can see we use the {{updatedn}} directive here and example ACLs ({{F:usr/local/etc/openldap/slapd.acl}}) for this could be: + +> # Give the replica DN unlimited read access. This ACL may need to be +> # merged with other ACL statements. +> +> access to * +> by dn.base="cn=replicator,dc=suretecsystems,dc=com" write +> by * break +> +> access to dn.base="" +> by * read +> +> access to dn.base="cn=Subschema" +> by * read +> +> access to dn.subtree="cn=Monitor" +> by dn.exact="uid=admin,dc=suretecsystems,dc=com" write +> by users read +> by * none +> +> access to * +> by self write +> by * read + +In order to support more replicas, just add more {{database ldap}} sections and +increment the {{syncrepl rid}} number accordingly. + +Note: You must populate the Master and Slave directories with the same data, +unlike when using normal Syncrepl + +If you do not have access to modify the master directory configuration you can +configure a standalone ldap proxy, which might look like: + +!import "push-based-standalone.png"; align="center"; title="Syncrepl Standalone Proxy Mode" +FT[align="Center"] Figure X.Y: Replacing slurpd with a standalone version + +The following configuration is an example of a standalone LDAP Proxy: + +> include /usr/local/etc/openldap/schema/core.schema +> include /usr/local/etc/openldap/schema/cosine.schema +> include /usr/local/etc/openldap/schema/nis.schema +> include /usr/local/etc/openldap/schema/inetorgperson.schema +> +> include /usr/local/etc/openldap/slapd.acl +> +> modulepath /usr/local/libexec/openldap +> moduleload syncprov.la +> moduleload back_ldap.la +> +> ############################################################################## +> # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap +> ############################################################################## +> +> database ldap +> # ignore conflicts with other databases, as we need to push out to same suffix +> hidden on +> suffix "dc=suretecsystems,dc=com" +> rootdn "cn=slapd-ldap" +> uri ldap://localhost:9012/ +> +> lastmod on +> +> # We don't need any access to this DSA +> restrict all +> +> acl-bind bindmethod=simple +> binddn="cn=replicator,dc=suretecsystems,dc=com" +> credentials=testing +> +> syncrepl rid=001 +> provider=ldap://localhost:9011/ +> binddn="cn=replicator,dc=suretecsystems,dc=com" +> bindmethod=simple +> credentials=testing +> searchbase="dc=suretecsystems,dc=com" +> type=refreshAndPersist +> retry="5 5 300 5" +> +> overlay syncprov + +As you can see, you can let your imagination go wild using Syncrepl and +{{slapd-ldap(8)}} tailoring your replication to fit your specific network +topology. diff --git a/doc/guide/admin/runningslapd.sdf b/doc/guide/admin/runningslapd.sdf new file mode 100644 index 0000000..9664d12 --- /dev/null +++ b/doc/guide/admin/runningslapd.sdf @@ -0,0 +1,151 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +H1: Running slapd + +{{slapd}}(8) is designed to be run as a standalone service. This +allows the server to take advantage of caching, manage concurrency +issues with underlying databases, and conserve system resources. +Running from {{inetd}}(8) is {{NOT}} an option. + + +H2: Command-Line Options + +{{slapd}}(8) supports a number of command-line options as detailed +in the manual page. This section details a few commonly used options. + +> -f <filename> + +This option specifies an alternate configuration file for slapd. +The default is normally {{F:/usr/local/etc/openldap/slapd.conf}}. + +> -F <slapd-config-directory> + +Specifies the slapd configuration directory. The default is {{F:/usr/local/etc/openldap/slapd.d}}. + +If both {{EX:-f}} and {{EX:-F}} are specified, the config file will be read and converted +to config directory format and written to the specified directory. +If neither option is specified, slapd will attempt to read the default config +directory before trying to use the default config file. If a valid config +directory exists then the default config file is ignored. All of the slap tools +that use the config options observe this same behavior. + +> -h <URLs> + +This option specifies alternative listener configurations. The +default is {{EX:ldap:///}} which implies {{TERM:LDAP}} over +{{TERM:TCP}} on all interfaces on the default LDAP port 389. You +can specify specific host-port pairs or other protocol schemes (such +as {{EX:ldaps://}} or {{EX:ldapi://}}). + +!block table +URL Protocol Transport +ldap:/// LDAP TCP port 389 +ldaps:/// LDAP over SSL TCP port 636 +ldapi:/// LDAP IPC (Unix-domain socket) +!endblock + +For example, {{EX:-h +"ldaps:// ldap://127.0.0.1:666"}} will create two listeners: one +for the (non-standard) {{EX:ldaps://}} scheme on all interfaces on +the default {{EX:ldaps://}} port 636, and one for the standard +{{EX:ldap://}} scheme on the {{EX:localhost}} ({{loopback}}) interface +on port 666. Hosts may be specified using using hostnames or +{{TERM:IPv4}} or {{TERM:IPv6}} addresses. Port values must be +numeric. + +For LDAP over IPC, the pathname of the Unix-domain socket can be encoded +in the URL. Note that directory separators must be +URL-encoded, like any other characters that are special to URLs. +Thus the socket {{EX:/usr/local/var/ldapi}} must be encoded as + +> ldapi://%2Fusr%2Flocal%2Fvar%2Fldapi + +ldapi: is described in detail in {{Using LDAP Over IPC Mechanisms}} [{{REF:Chu-LDAPI}}] + +Note that the ldapi:/// transport is not widely implemented: non-OpenLDAP clients +may not be able to use it. + +> -n <service-name> + +This option specifies the service name used for logging and +other purposes. The default service name is {{EX:slapd}}. + +> -l <syslog-local-user> + +This option specifies the local user for the {{syslog}}(8) +facility. Values can be {{EX:LOCAL0}}, {{EX:LOCAL1}}, {{EX:LOCAL2}}, ..., +and {{EX:LOCAL7}}. The default is {{EX:LOCAL4}}. This option +may not be supported on all systems. + +> -u user -g group + +These options specify the user and group, respectively, to run +as. {{EX:user}} can be either a user name or uid. {{EX:group}} +can be either a group name or gid. + +> -r directory + +This option specifies a run-time directory. slapd will +{{chroot}}(2) to this directory after opening listeners but +before reading any configuration files or initializing +any backends. +. + +> -d <level> | ? + +This option sets the slapd debug level to <level>. When level is a +`?' character, the various debugging levels are printed and slapd +exits, regardless of any other options you give it. Current +debugging levels are + +!block table; colaligns="RL"; align=Center; \ + title="Table 7.1: Debugging Levels" +Level Keyword Description +-1 any enable all debugging +0 no debugging +1 (0x1 trace) trace function calls +2 (0x2 packets) debug packet handling +4 (0x4 args) heavy trace debugging +8 (0x8 conns) connection management +16 (0x10 BER) print out packets sent and received +32 (0x20 filter) search filter processing +64 (0x40 config) configuration processing +128 (0x80 ACL) access control list processing +256 (0x100 stats) stats log connections/operations/results +512 (0x200 stats2) stats log entries sent +1024 (0x400 shell) print communication with shell backends +2048 (0x800 parse) print entry parsing debugging +16384 (0x4000 sync) syncrepl consumer processing +32768 (0x8000 none) only messages that get logged whatever log level is set +!endblock + +You may enable multiple levels by specifying the debug option once for each desired level. Or, since debugging levels are additive, you can do the math yourself. That is, if you want to trace function calls and watch the config file being processed, you could set level to the sum of those two levels (in this case, {{EX: -d 65}}). Or, you can let slapd do the math, (e.g. {{EX: -d 1 -d 64}}). Consult {{F: <ldap_log.h>}} for more details. + +Note: slapd must have been compiled with {{EX:--enable-debug}} +defined for any debugging information beyond the two stats levels +to be available (the default). + + +H2: Starting slapd + +In general, slapd is run like this: + +> /usr/local/libexec/slapd [<option>]* + +where {{F:/usr/local/libexec}} is determined by {{EX:configure}} +and <option> is one of the options described above (or in {{slapd}}(8)). +Unless you have specified a debugging level (including level {{EX:0}}), +slapd will automatically fork and detach itself from its controlling +terminal and run in the background. + +H2: Stopping slapd + +To kill off {{slapd}}(8) safely, you should give a command like this + +> kill -INT `cat /usr/local/var/slapd.pid` + +where {{F:/usr/local/var}} is determined by {{EX:configure}}. + +Killing slapd by a more drastic method may cause information loss or +database corruption. diff --git a/doc/guide/admin/sasl.sdf b/doc/guide/admin/sasl.sdf new file mode 100644 index 0000000..48bcbe1 --- /dev/null +++ b/doc/guide/admin/sasl.sdf @@ -0,0 +1,731 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Using SASL + +OpenLDAP clients and servers are capable of authenticating via the +{{TERM[expand]SASL}} ({{TERM:SASL}}) framework, which is detailed +in {{REF:RFC4422}}. This chapter describes how to make use of +SASL in OpenLDAP. + +There are several industry standard authentication mechanisms that +can be used with SASL, including {{TERM:GSSAPI}} for {{TERM:Kerberos}} +V, {{TERM:DIGEST-MD5}}, and {{TERM:PLAIN}} and {{TERM:EXTERNAL}} +for use with {{TERM[expand]TLS}} (TLS). + +The standard client tools provided with OpenLDAP Software, such as +{{ldapsearch}}(1) and {{ldapmodify}}(1), will by default attempt +to authenticate the user to the {{TERM:LDAP}} directory server using +SASL. Basic authentication service can be set up by the LDAP +administrator with a few steps, allowing users to be authenticated +to the slapd server as their LDAP entry. With a few extra steps, +some users and services can be allowed to exploit SASL's proxy +authorization feature, allowing them to authenticate themselves and +then switch their identity to that of another user or service. + +This chapter assumes you have read {{Cyrus SASL for System +Administrators}}, provided with the {{PRD:Cyrus SASL}} +package (in {{FILE:doc/sysadmin.html}}) and have a working Cyrus +SASL installation. You should use the Cyrus SASL {{EX:sample_client}} +and {{EX:sample_server}} to test your SASL installation before +attempting to make use of it with OpenLDAP Software. + +Note that in the following text the term {{user}} is used to describe +a person or application entity who is connecting to the LDAP server +via an LDAP client, such as {{ldapsearch}}(1). That is, the term +{{user}} not only applies to both an individual using an LDAP client, +but to an application entity which issues LDAP client operations +without direct user control. For example, an e-mail server which +uses LDAP operations to access information held in an LDAP server +is an application entity. + + +H2: SASL Security Considerations + +SASL offers many different authentication mechanisms. This section +briefly outlines security considerations. + +Some mechanisms, such as PLAIN and LOGIN, offer no greater security +over LDAP {{simple}} authentication. Like LDAP {{simple}} +authentication, such mechanisms should not be used unless you have +adequate security protections in place. It is recommended that +these mechanisms be used only in conjunction with {{TERM[expand]TLS}} +(TLS). Use of PLAIN and LOGIN are not discussed further in this +document. + +The DIGEST-MD5 mechanism is the mandatory-to-implement authentication +mechanism for LDAPv3. Though DIGEST-MD5 is not a strong authentication +mechanism in comparison with trusted third party authentication +systems (such as {{TERM:Kerberos}} or public key systems), it does +offer significant protections against a number of attacks. Unlike +the {{TERM:CRAM-MD5}} mechanism, it prevents chosen plaintext +attacks. DIGEST-MD5 is favored over the use of plaintext password +mechanisms. The CRAM-MD5 mechanism is deprecated in favor of +DIGEST-MD5. Use of {{SECT:DIGEST-MD5}} is discussed below. + +The GSSAPI mechanism utilizes {{TERM:GSS-API}} {{TERM:Kerberos}} V +to provide secure authentication services. The KERBEROS_V4 mechanism +is available for those using Kerberos IV. Kerberos is viewed as a +secure, distributed authentication system suitable for both small +and large enterprises. Use of {{SECT:GSSAPI}} and {{SECT:KERBEROS_V4}} +are discussed below. + +The EXTERNAL mechanism utilizes authentication services provided +by lower level network services such as {{TERM[expand]TLS}} ({{TERM:TLS}}). When +used in conjunction with {{TERM:TLS}} {{TERM:X.509}}-based public +key technology, EXTERNAL offers strong authentication. +TLS is discussed in the {{SECT:Using TLS}} chapter. + +EXTERNAL can also be used with the {{EX:ldapi:///}} transport, as +Unix-domain sockets can report the UID and GID of the client process. + +There are other strong authentication mechanisms to choose from, +including {{TERM:OTP}} (one time passwords) and {{TERM:SRP}} (secure +remote passwords). These mechanisms are not discussed in this +document. + + +H2: SASL Authentication + +Getting basic SASL authentication running involves a few steps. +The first step configures your slapd server environment so that it +can communicate with client programs using the security system in +place at your site. This usually involves setting up a service key, +a public key, or other form of secret. The second step concerns +mapping authentication identities to LDAP {{TERM:DN}}'s, which +depends on how entries are laid out in your directory. An explanation +of the first step will be given in the next section using Kerberos +V4 as an example mechanism. The steps necessary for your site's +authentication mechanism will be similar, but a guide to every +mechanism available under SASL is beyond the scope of this chapter. +The second step is described in the section {{SECT:Mapping +Authentication Identities}}. + + +H3: GSSAPI + +This section describes the use of the SASL GSSAPI mechanism and +Kerberos V with OpenLDAP. It will be assumed that you have Kerberos +V deployed, you are familiar with the operation of the system, and +that your users are trained in its use. This section also assumes +you have familiarized yourself with the use of the GSSAPI mechanism +by reading {{Configuring GSSAPI and Cyrus SASL}} (provided with +Cyrus SASL in the {{FILE:doc/gssapi}} file) and successfully +experimented with the Cyrus provided {{EX:sample_server}} and +{{EX:sample_client}} applications. General information about +Kerberos is available at {{URL:http://web.mit.edu/kerberos/www/}}. + +To use the GSSAPI mechanism with {{slapd}}(8) one must create a service +key with a principal for {{ldap}} service within the realm for the host +on which the service runs. For example, if you run {{slapd}} on +{{EX:directory.example.com}} and your realm is {{EX:EXAMPLE.COM}}, +you need to create a service key with the principal: + +> ldap/directory.example.com@EXAMPLE.COM + +When {{slapd}}(8) runs, it must have access to this key. This is +generally done by placing the key into a keytab file, +{{FILE:/etc/krb5.keytab}}. See your Kerberos and Cyrus SASL +documentation for information regarding keytab location settings. + +To use the GSSAPI mechanism to authenticate to the directory, the +user obtains a Ticket Granting Ticket (TGT) prior to running the +LDAP client. When using OpenLDAP client tools, the user may mandate +use of the GSSAPI mechanism by specifying {{EX:-Y GSSAPI}} as a +command option. + +For the purposes of authentication and authorization, {{slapd}}(8) +associates an authentication request DN of the form: + +> uid=<primary[/instance]>,cn=<realm>,cn=gssapi,cn=auth + +Continuing our example, a user with the Kerberos principal +{{EX:kurt@EXAMPLE.COM}} would have the associated DN: + +> uid=kurt,cn=example.com,cn=gssapi,cn=auth + +and the principal {{EX:ursula/admin@FOREIGN.REALM}} would have the +associated DN: + +> uid=ursula/admin,cn=foreign.realm,cn=gssapi,cn=auth + + +The authentication request DN can be used directly ACLs and +{{EX:groupOfNames}} "member" attributes, since it is of legitimate +LDAP DN format. Or alternatively, the authentication DN could be +mapped before use. See the section {{SECT:Mapping Authentication +Identities}} for details. + + +H3: KERBEROS_V4 + +This section describes the use of the SASL KERBEROS_V4 mechanism +with OpenLDAP. It will be assumed that you are familiar with the +workings of the Kerberos IV security system, and that your site has +Kerberos IV deployed. Your users should be familiar with +authentication policy, how to receive credentials in +a Kerberos ticket cache, and how to refresh expired credentials. + +Note: KERBEROS_V4 and Kerberos IV are deprecated in favor of GSSAPI +and Kerberos V. + +Client programs will need to be able to obtain a session key for +use when connecting to your LDAP server. This allows the LDAP server +to know the identity of the user, and allows the client to know it +is connecting to a legitimate server. If encryption layers are to +be used, the session key can also be used to help negotiate that +option. + +The slapd server runs the service called "{{ldap}}", and the server +will require a srvtab file with a service key. SASL aware client +programs will be obtaining an "ldap" service ticket with the user's +ticket granting ticket (TGT), with the instance of the ticket +matching the hostname of the OpenLDAP server. For example, if your +realm is named {{EX:EXAMPLE.COM}} and the slapd server is running +on the host named {{EX:directory.example.com}}, the {{FILE:/etc/srvtab}} +file on the server will have a service key + +> ldap.directory@EXAMPLE.COM + +When an LDAP client is authenticating a user to the directory using +the KERBEROS_IV mechanism, it will request a session key for that +same principal, either from the ticket cache or by obtaining a new +one from the Kerberos server. This will require the TGT to be +available and valid in the cache as well. If it is not present or +has expired, the client may print out the message: + +> ldap_sasl_interactive_bind_s: Local error + +When the service ticket is obtained, it will be passed to the LDAP +server as proof of the user's identity. The server will extract +the identity and realm out of the service ticket using SASL +library calls, and convert them into an {{authentication request +DN}} of the form + +> uid=<username>,cn=<realm>,cn=<mechanism>,cn=auth + +So in our above example, if the user's name were "adamson", the +authentication request DN would be: + +> uid=adamsom,cn=example.com,cn=kerberos_v4,cn=auth + +This authentication request DN can be used directly ACLs or, +alternatively, mapped prior to use. See the section {{SECT:Mapping +Authentication Identities}} for details. + + +H3: DIGEST-MD5 + +This section describes the use of the SASL DIGEST-MD5 mechanism +using secrets stored either in the directory itself or in Cyrus +SASL's own database. DIGEST-MD5 relies on the client and the server +sharing a "secret", usually a password. The server generates a +challenge and the client a response proving that it knows the shared +secret. This is much more secure than simply sending the secret +over the wire. + +Cyrus SASL supports several shared-secret mechanisms. To do this, +it needs access to the plaintext password (unlike mechanisms which +pass plaintext passwords over the wire, where the server can store +a hashed version of the password). + +The server's copy of the shared-secret may be stored in Cyrus SASL's +own {{sasldb}} database, in an external system accessed via +{{saslauthd}}, or in LDAP database itself. In either case it is +very important to apply file access controls and LDAP access controls +to prevent exposure of the passwords. The configuration and commands +discussed in this section assume the use of Cyrus SASL 2.1. + +To use secrets stored in {{sasldb}}, simply add users with the +{{saslpasswd2}} command: + +> saslpasswd2 -c <username> + +The passwords for such users must be managed with the {{saslpasswd2}} +command. + +To use secrets stored in the LDAP directory, place plaintext passwords +in the {{EX:userPassword}} attribute. It will be necessary to add +an option to {{EX:slapd.conf}} to make sure that passwords set using +the LDAP Password Modify Operation are stored in plaintext: + +> password-hash {CLEARTEXT} + +Passwords stored in this way can be managed either with {{ldappasswd}}(1) +or by simply modifying the {{EX:userPassword}} attribute. Regardless of +where the passwords are stored, a mapping will be needed from +authentication request DN to user's DN. + +The DIGEST-MD5 mechanism produces authentication IDs of the form: + +> uid=<username>,cn=<realm>,cn=digest-md5,cn=auth + +If the default realm is used, the realm name is omitted from the ID, +giving: + +> uid=<username>,cn=digest-md5,cn=auth + +See {{SECT: Mapping Authentication Identities}} below for information +on optional mapping of identities. + +With suitable mappings in place, users can specify SASL IDs when +performing LDAP operations, and the password stored in {{sasldb}} or in +the directory itself will be used to verify the authentication. +For example, the user identified by the directory entry: + +> dn: cn=Andrew Findlay+uid=u000997,dc=example,dc=com +> objectclass: inetOrgPerson +> objectclass: person +> sn: Findlay +> uid: u000997 +> userPassword: secret + +can issue commands of the form: + +> ldapsearch -Y DIGEST-MD5 -U u000997 ... + +Note: in each of the above cases, no authorization identity (e.g. +{{EX:-X}}) was provided. Unless you are attempting {{SECT:SASL +Proxy Authorization}}, no authorization identity should be specified. +The server will infer an authorization identity from authentication +identity (as described below). + + +H3: EXTERNAL + +The SASL EXTERNAL mechanism makes use of an authentication performed +by a lower-level protocol: usually {{TERM:TLS}} or Unix {{TERM:IPC}} + +Each transport protocol returns Authentication Identities in its own +format: + +H4: TLS Authentication Identity Format + +This is the Subject DN from the client-side certificate. +Note that DNs are displayed differently by LDAP and by X.509, so +a certificate issued to +> C=gb, O=The Example Organisation, CN=A Person + +will produce an authentication identity of: + +> cn=A Person,o=The Example Organisation,c=gb + +Note that you must set a suitable value for TLSVerifyClient to make the server +request the use of a client-side certificate. Without this, the SASL EXTERNAL +mechanism will not be offered. +Refer to the {{SECT:Using TLS}} chapter for details. + +H4: IPC (ldapi:///) Identity Format + +This is formed from the Unix UID and GID of the client process: + +> gidNumber=<number>+uidNumber=<number>,cn=peercred,cn=external,cn=auth + +Thus, a client process running as {{EX:root}} will be: + +> gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth + + +H3: Mapping Authentication Identities + +The authentication mechanism in the slapd server will use SASL +library calls to obtain the authenticated user's "username", based +on whatever underlying authentication mechanism was used. This +username is in the namespace of the authentication mechanism, and +not in the normal LDAP namespace. As stated in the sections above, +that username is reformatted into an authentication request DN of +the form + +> uid=<username>,cn=<realm>,cn=<mechanism>,cn=auth + +or + +> uid=<username>,cn=<mechanism>,cn=auth + +depending on whether or not <mechanism> employs the concept of +"realms". Note also that the realm part will be omitted if the +default realm was used in the authentication. + +The {{ldapwhoami}}(1) command may be used to determine the identity +associated with the user. It is very useful for determining proper +function of mappings. + +It is not intended that you should add LDAP entries of the above +form to your LDAP database. Chances are you have an LDAP entry for +each of the persons that will be authenticating to LDAP, laid out +in your directory tree, and the tree does not start at cn=auth. +But if your site has a clear mapping between the "username" and an +LDAP entry for the person, you will be able to configure your LDAP +server to automatically map a authentication request DN to the +user's {{authentication DN}}. + +Note: it is not required that the authentication request DN nor the +user's authentication DN resulting from the mapping refer to an +entry held in the directory. However, additional capabilities +become available (see below). + +The LDAP administrator will need to tell the slapd server how to +map an authentication request DN to a user's authentication DN. +This is done by adding one or more {{EX:authz-regexp}} directives to +the {{slapd.conf}}(5) file. This directive takes two arguments: + +> authz-regexp <search pattern> <replacement pattern> + +The authentication request DN is compared to the search pattern +using the regular expression functions {{regcomp}}() and {{regexec}}(), +and if it matches, it is rewritten as the replacement pattern. If +there are multiple {{EX:authz-regexp}} directives, only the first +whose search pattern matches the authentication identity is used. +The string that is output from the replacement pattern should be +the authentication DN of the user or an LDAP URL. If replacement +string produces a DN, the entry named by this DN need not be held +by this server. If the replace string produces an LDAP URL, that +LDAP URL must evaluate to one and only one entry held by this server. + +The search pattern can contain any of the regular expression +characters listed in {{regexec}}(3C). The main characters of note +are dot ".", asterisk "*", and the open and close parenthesis "(" +and ")". Essentially, the dot matches any character, the asterisk +allows zero or more repeats of the immediately preceding character +or pattern, and terms in parenthesis are remembered for the replacement +pattern. + +The replacement pattern will produce either a DN or URL referring +to the user. Anything from the authentication request DN that +matched a string in parenthesis in the search pattern is stored in +the variable "$1". That variable "$1" can appear in the replacement +pattern, and will be replaced by the string from the authentication +request DN. If there were multiple sets of parentheses in the search +pattern, the variables $2, $3, etc are used. + +H3: Direct Mapping + +Where possible, direct mapping of the authentication request DN to +the user's DN is generally recommended. Aside from avoiding the +expense of searching for the user's DN, it allows mapping to +DNs which refer to entries not held by this server. + +Suppose the authentication request DN is written as: + +> uid=adamson,cn=example.com,cn=gssapi,cn=auth + +and the user's actual LDAP entry is: + +> uid=adamson,ou=people,dc=example,dc=com + +then the following {{EX:authz-regexp}} directive in {{slapd.conf}}(5) +would provide for direct mapping. + +> authz-regexp +> uid=([^,]*),cn=example.com,cn=gssapi,cn=auth +> uid=$1,ou=people,dc=example,dc=com + +An even more lenient rule could be written as + +> authz-regexp +> uid=([^,]*),cn=[^,]*,cn=auth +> uid=$1,ou=people,dc=example,dc=com + +Be careful about setting the search pattern too leniently, however, +since it may mistakenly allow persons to become authenticated as a +DN to which they should not have access. It is better to write +several strict directives than one lenient directive which has +security holes. If there is only one authentication mechanism in +place at your site, and zero or one realms in use, you might be +able to map between authentication identities and LDAP DN's with a +single {{EX:authz-regexp}} directive. + +Don't forget to allow for the case where the realm is omitted as +well as the case with an explicitly specified realm. This may well +require a separate {{EX:authz-regexp}} directive for each case, with +the explicit-realm entry being listed first. + +H3: Search-based mappings + +There are a number of cases where mapping to a LDAP URL may be +appropriate. For instance, some sites may have person objects +located in multiple areas of the LDAP tree, such as if there were +an {{EX:ou=accounting}} tree and an {{EX:ou=engineering}} tree, +with persons interspersed between them. Or, maybe the desired +mapping must be based upon information in the user's information. +Consider the need to map the above authentication request DN to +user whose entry is as follows: + +> dn: cn=Mark Adamson,ou=People,dc=Example,dc=COM +> objectclass: person +> cn: Mark Adamson +> uid: adamson + +The information in the authentication request DN is insufficient +to allow the user's DN to be directly derived, instead the user's +DN must be searched for. For these situations, a replacement pattern +which produces a LDAP URL can be used in the {{EX:authz-regexp}} +directives. This URL will then be used to perform an internal +search of the LDAP database to find the person's authentication DN. + +An LDAP URL, similar to other URL's, is of the form + +> ldap://<host>/<base>?<attrs>?<scope>?<filter> + +This contains all of the elements necessary to perform an LDAP +search: the name of the server <host>, the LDAP DN search base +<base>, the LDAP attributes to retrieve <attrs>, the search scope +<scope> which is one of the three options "base", "one", or "sub", +and lastly an LDAP search filter <filter>. Since the search is for +an LDAP DN within the current server, the <host> portion should be +empty. The <attrs> field is also ignored since only the DN is of +concern. These two elements are left in the format of the URL to +maintain the clarity of what information goes where in the string. + +Suppose that the person in the example from above did in fact have +an authentication username of "adamson" and that information was +kept in the attribute "uid" in their LDAP entry. The {{EX:authz-regexp}} +directive might be written as + +> authz-regexp +> uid=([^,]*),cn=example.com,cn=gssapi,cn=auth +> ldap:///ou=people,dc=example,dc=com??one?(uid=$1) + +This will initiate an internal search of the LDAP database inside +the slapd server. If the search returns exactly one entry, it is +accepted as being the DN of the user. If there are more than one +entries returned, or if there are zero entries returned, the +authentication fails and the user's connection is left bound as the +authentication request DN. + +The attributes that are used in the search filter <filter> in the +URL should be indexed to allow faster searching. If they are not, +the authentication step alone can take uncomfortably long periods, +and users may assume the server is down. + +A more complex site might have several realms in use, each mapping +to a different subtree in the directory. These can be handled with +statements of the form: + +> # Match Engineering realm +> authz-regexp +> uid=([^,]*),cn=engineering.example.com,cn=digest-md5,cn=auth +> ldap:///dc=eng,dc=example,dc=com??one?(&(uid=$1)(objectClass=person)) +> +> # Match Accounting realm +> authz-regexp +> uid=([^,].*),cn=accounting.example.com,cn=digest-md5,cn=auth +> ldap:///dc=accounting,dc=example,dc=com??one?(&(uid=$1)(objectClass=person)) +> +> # Default realm is customers.example.com +> authz-regexp +> uid=([^,]*),cn=digest-md5,cn=auth +> ldap:///dc=customers,dc=example,dc=com??one?(&(uid=$1)(objectClass=person)) + +Note that the explicitly-named realms are handled first, to avoid +the realm name becoming part of the UID. Also note the use of scope +and filters to limit matching to desirable entries. + +Note as well that {{EX:authz-regexp}} internal search are subject +to access controls. Specifically, the authentication identity +must have {{EX:auth}} access. + +See {{slapd.conf}}(5) for more detailed information. + + +H2: SASL Proxy Authorization + +The SASL offers a feature known as {{proxy authorization}}, which +allows an authenticated user to request that they act on the behalf +of another user. This step occurs after the user has obtained an +authentication DN, and involves sending an authorization identity +to the server. The server will then make a decision on whether or +not to allow the authorization to occur. If it is allowed, the +user's LDAP connection is switched to have a binding DN derived +from the authorization identity, and the LDAP session proceeds with +the access of the new authorization DN. + +The decision to allow an authorization to proceed depends on the +rules and policies of the site where LDAP is running, and thus +cannot be made by SASL alone. The SASL library leaves it up to the +server to make the decision. The LDAP administrator sets the +guidelines of who can authorize to what identity by adding information +into the LDAP database entries. By default, the authorization +features are disabled, and must be explicitly configured by the +LDAP administrator before use. + + +H3: Uses of Proxy Authorization + +This sort of service is useful when one entity needs to act on the +behalf of many other users. For example, users may be directed to +a web page to make changes to their personal information in their +LDAP entry. The users authenticate to the web server to establish +their identity, but the web server CGI cannot authenticate to the +LDAP server as that user to make changes for them. Instead, the +web server authenticates itself to the LDAP server as a service +identity, say, + +> cn=WebUpdate,dc=example,dc=com + +and then it will SASL authorize to the DN of the user. Once so +authorized, the CGI makes changes to the LDAP entry of the user, +and as far as the slapd server can tell for its ACLs, it is the +user themself on the other end of the connection. The user could +have connected to the LDAP server directly and authenticated as +themself, but that would require the user to have more knowledge +of LDAP clients, knowledge which the web page provides in an easier +format. + +Proxy authorization can also be used to limit access to an account +that has greater access to the database. Such an account, perhaps +even the root DN specified in {{slapd.conf}}(5), can have a strict +list of people who can authorize to that DN. Changes to the LDAP +database could then be only allowed by that DN, and in order to +become that DN, users must first authenticate as one of the persons +on the list. This allows for better auditing of who made changes +to the LDAP database. If people were allowed to authenticate +directly to the privileged account, possibly through the {{EX:rootpw}} +{{slapd.conf}}(5) directive or through a {{EX:userPassword}} +attribute, then auditing becomes more difficult. + +Note that after a successful proxy authorization, the original +authentication DN of the LDAP connection is overwritten by the new +DN from the authorization request. If a service program is able to +authenticate itself as its own authentication DN and then authorize +to other DN's, and it is planning on switching to several different +identities during one LDAP session, it will need to authenticate +itself each time before authorizing to another DN (or use a different +proxy authorization mechanism). The slapd server does not keep +record of the service program's ability to switch to other DN's. +On authentication mechanisms like Kerberos this will not require +multiple connections being made to the Kerberos server, since the +user's TGT and "ldap" session key are valid for multiple uses for +the several hours of the ticket lifetime. + + +H3: SASL Authorization Identities + +The SASL authorization identity is sent to the LDAP server via the +{{EX:-X}} switch for {{ldapsearch}}(1) and other tools, or in the +{{EX:*authzid}} parameter to the {{lutil_sasl_defaults}}() call. +The identity can be in one of two forms, either + +> u:<username> + +or + +> dn:<dn> + +In the first form, the <username> is from the same namespace as +the authentication identities above. It is the user's username as +it is referred to by the underlying authentication mechanism. +Authorization identities of this form are converted into a DN format +by the same function that the authentication process used, producing +an {{authorization request DN}} of the form + +> uid=<username>,cn=<realm>,cn=<mechanism>,cn=auth + +That authorization request DN is then run through the same +{{EX:authz-regexp}} process to convert it into a legitimate authorization +DN from the database. If it cannot be converted due to a failed +search from an LDAP URL, the authorization request fails with +"inappropriate access". Otherwise, the DN string is now a legitimate +authorization DN ready to undergo approval. + +If the authorization identity was provided in the second form, with +a {{EX:"dn:"}} prefix, the string after the prefix is already in +authorization DN form, ready to undergo approval. + + +H3: Proxy Authorization Rules + +Once slapd has the authorization DN, the actual approval process +begins. There are two attributes that the LDAP administrator can +put into LDAP entries to allow authorization: + +> authzTo +> authzFrom + +Both can be multivalued. The {{EX:authzTo}} attribute is a +source rule, and it is placed into the entry associated with the +authentication DN to tell what authorization DNs the authenticated +DN is allowed to assume. The second attribute is a destination +rule, and it is placed into the entry associated with the requested +authorization DN to tell which authenticated DNs may assume it. + +The choice of which authorization policy attribute to use is up to +the administrator. Source rules are checked first in the person's +authentication DN entry, and if none of the {{EX:authzTo}} rules +specify the authorization is permitted, the {{EX:authzFrom}} +rules in the authorization DN entry are then checked. If neither +case specifies that the request be honored, the request is denied. +Since the default behavior is to deny authorization requests, rules +only specify that a request be allowed; there are no negative rules +telling what authorizations to deny. + +The value(s) in the two attributes are of the same form as the +output of the replacement pattern of a {{EX:authz-regexp}} directive: +either a DN or an LDAP URL. For example, if a {{EX:authzTo}} +value is a DN, that DN is one the authenticated user can authorize +to. On the other hand, if the {{EX:authzTo}} value is an LDAP +URL, the URL is used as an internal search of the LDAP database, +and the authenticated user can become ANY DN returned by the search. +If an LDAP entry looked like: + +> dn: cn=WebUpdate,dc=example,dc=com +> authzTo: ldap:///dc=example,dc=com??sub?(objectclass=person) + +then any user who authenticated as {{EX:cn=WebUpdate,dc=example,dc=com}} +could authorize to any other LDAP entry under the search base +{{EX:dc=example,dc=com}} which has an objectClass of {{EX:Person}}. + + +H4: Notes on Proxy Authorization Rules + +An LDAP URL in a {{EX:authzTo}} or {{EX:authzFrom}} attribute +will return a set of DNs. Each DN returned will be checked. Searches +which return a large set can cause the authorization process to +take an uncomfortably long time. Also, searches should be performed +on attributes that have been indexed by slapd. + +To help produce more sweeping rules for {{EX:authzFrom}} and +{{EX:authzTo}}, the values of these attributes are allowed to +be DNs with regular expression characters in them. This means a +source rule like + +> authzTo: dn.regex:^uid=[^,]*,dc=example,dc=com$ + +would allow that authenticated user to authorize to any DN that +matches the regular expression pattern given. This regular expression +comparison can be evaluated much faster than an LDAP search for +{{EX:(uid=*)}}. + +Also note that the values in an authorization rule must be one of +the two forms: an LDAP URL or a DN (with or without regular expression +characters). Anything that does not begin with "{{EX:ldap://}}" is +taken as a DN. It is not permissible to enter another authorization +identity of the form "{{EX:u:<username>}}" as an authorization rule. + + +H4: Policy Configuration + +The decision of which type of rules to use, {{EX:authzFrom}} +or {{EX:authzTo}}, will depend on the site's situation. For +example, if the set of people who may become a given identity can +easily be written as a search filter, then a single destination +rule could be written. If the set of people is not easily defined +by a search filter, and the set of people is small, it may be better +to write a source rule in the entries of each of those people who +should be allowed to perform the proxy authorization. + +By default, processing of proxy authorization rules is disabled. +The {{EX:authz-policy}} directive must be set in the +{{slapd.conf}}(5) file to enable authorization. This directive can +be set to {{EX:none}} for no rules (the default), {{EX:to}} for +source rules, {{EX:from}} for destination rules, or {{EX:both}} for +both source and destination rules. + +Source rules are extremely powerful. If ordinary users have +access to write the {{EX:authzTo}} attribute in their own +entries, then they can write rules that would allow them to authorize +as anyone else. As such, when using source rules, the +{{EX:authzTo}} attribute should be protected with an ACL that +only allows privileged users to set its values. + diff --git a/doc/guide/admin/schema.sdf b/doc/guide/admin/schema.sdf new file mode 100644 index 0000000..dfb6700 --- /dev/null +++ b/doc/guide/admin/schema.sdf @@ -0,0 +1,491 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Schema Specification + +This chapter describes how to extend the user schema used by +{{slapd}}(8). The chapter assumes the reader is familiar with the +{{TERM:LDAP}}/{{TERM:X.500}} information model. + +The first section, {{SECT:Distributed Schema Files}} details optional +schema definitions provided in the distribution and where to obtain +other definitions. +The second section, {{SECT:Extending Schema}}, details how to define +new schema items. +!if 0 +The third section, {{SECT:Transferring Schema}} details how you can +export schema definitions from an LDAPv3 server and transform it +to {{slapd.conf}}(5) format. +!endif + +This chapter does not discuss how to extend system schema used by +{{slapd}}(8) as this requires source code modification. System +schema includes all operational attribute types or any object class +which allows or requires an operational attribute (directly or +indirectly). + + +H2: Distributed Schema Files + +OpenLDAP Software is distributed with a set of schema specifications for +your use. Each set is defined in a file suitable for inclusion +(using the {{EX:include}} directive) in your {{slapd.conf}}(5) +file. These schema files are normally installed in the +{{F:/usr/local/etc/openldap/schema}} directory. + +!block table; colaligns="LR"; coltags="F,N"; align=Center; \ + title="Table 8.1: Provided Schema Specifications" +File Description +core.schema OpenLDAP {{core}} (required) +cosine.schema Cosine and Internet X.500 (useful) +inetorgperson.schema InetOrgPerson (useful) +misc.schema Assorted (experimental) +nis.schema Network Information Services (FYI) +openldap.schema OpenLDAP Project (experimental) +!endblock + +To use any of these schema files, you only need to include the +desired file in the global definitions portion of your +{{slapd.conf}}(5) file. For example: + +> # include schema +> include /usr/local/etc/openldap/schema/core.schema +> include /usr/local/etc/openldap/schema/cosine.schema +> include /usr/local/etc/openldap/schema/inetorgperson.schema + +Additional files may be available. Please consult the OpenLDAP +{{TERM:FAQ}} ({{URL:http://www.openldap.org/faq/}}). + +Note: You should not modify any of the schema items defined +in provided files. + + +H2: Extending Schema + +Schema used by {{slapd}}(8) may be extended to support additional +syntaxes, matching rules, attribute types, and object classes. This +chapter details how to add user application attribute types and +object classes using the syntaxes and matching rules already supported +by slapd. slapd can also be extended to support additional syntaxes, +matching rules and system schema, but this requires some programming +and hence is not discussed here. + +There are five steps to defining new schema: +^ obtain Object Identifier ++ choose a name prefix ++ create local schema file ++ define custom attribute types (if necessary) ++ define custom object classes + + +H3: Object Identifiers + +Each schema element is identified by a globally unique {{TERM[expand]OID}} +(OID). OIDs are also used to identify other objects. They are +commonly found in protocols described by {{TERM:ASN.1}}. In +particular, they are heavily used by the {{TERM[expand]SNMP}} (SNMP). +As OIDs are hierarchical, your organization can obtain one OID and +branch it as needed. For example, if your organization were assigned +OID {{EX:1.1}}, you could branch the tree as follows: + +!block table; colaligns="LR"; coltags="EX,N"; align=Center; \ + title="Table 8.2: Example OID hierarchy" +OID Assignment +1.1 Organization's OID +1.1.1 SNMP Elements +1.1.2 LDAP Elements +1.1.2.1 AttributeTypes +1.1.2.1.1 x-my-Attribute +1.1.2.2 ObjectClasses +1.1.2.2.1 x-my-ObjectClass +!endblock + +You are, of course, free to design a hierarchy suitable to your +organizational needs under your organization's OID. No matter what hierarchy you choose, you should maintain a registry of assignments you make. This can be a simple flat file or something more sophisticated such as the {{OpenLDAP OID Registry}} ({{URL:http://www.openldap.org/faq/index.cgi?file=197}}). + +For more information about Object Identifiers (and a listing service) +see {{URL:http://www.alvestrand.no/objectid/}}. + +.{{Under no circumstances should you hijack OID namespace!}} + +To obtain a registered OID at {{no cost}}, apply for a OID +under the {{ORG[expand]IANA}} (ORG:IANA) maintained {{Private Enterprise}} arc. +Any private enterprise (organization) may request a {{TERM[expand]PEN}} (PEN) to be assigned under this arc. Just fill out the IANA form at {{URL: http://pen.iana.org/pen/PenApplication.page}} and your official PEN will be sent to you usually within a few days. Your base OID will be something like {{EX:1.3.6.1.4.1.X}} where {{EX:X}} is an integer. + +Note: PENs obtained using this form may be used for any purpose +including identifying LDAP schema elements. + +Alternatively, OID name space may be available from a national +authority (e.g., {{ORG:ANSI}}, {{ORG:BSI}}). + + +H3: Naming Elements + +In addition to assigning a unique object identifier to each schema +element, you should provide at least one textual name for each +element. Names should be registered with the {{ORG:IANA}} or +prefixed with "x-" to place in the "private use" name space. + +The name should be both descriptive and not likely to clash with +names of other schema elements. In particular, any name you choose +should not clash with present or future Standard Track names (this +is assured if you registered names or use names beginning with "x-"). + +It is noted that you can obtain your own registered name +prefix so as to avoid having to register your names individually. +See {{REF:RFC4520}} for details. + +In the examples below, we have used a short prefix '{{EX:x-my-}}'. +Such a short prefix would only be suitable for a very large, global +organization. In general, we recommend something like '{{EX:x-de-Firm-}}' +(German company) or '{{EX:x-com-Example}}' (elements associated with +organization associated with {{EX:example.com}}). + + +H3: Local schema file + +The {{EX:objectclass}} and {{EX:attributeTypes}} configuration file +directives can be used to define schema rules on entries in the +directory. It is customary to create a file to contain definitions +of your custom schema items. We recommend you create a file +{{F:local.schema}} in {{F:/usr/local/etc/openldap/schema/local.schema}} +and then include this file in your {{slapd.conf}}(5) file immediately +after other schema {{EX:include}} directives. + +> # include schema +> include /usr/local/etc/openldap/schema/core.schema +> include /usr/local/etc/openldap/schema/cosine.schema +> include /usr/local/etc/openldap/schema/inetorgperson.schema +> # include local schema +> include /usr/local/etc/openldap/schema/local.schema + + +H3: Attribute Type Specification + +The {{attributetype}} directive is used to define a new attribute +type. The directive uses the same Attribute Type Description +(as defined in {{REF:RFC4512}}) used by the attributeTypes +attribute found in the subschema subentry, e.g.: + +E: attributetype <{{REF:RFC4512}} Attribute Type Description> + +where Attribute Type Description is defined by the following +{{TERM:ABNF}}: + +> AttributeTypeDescription = "(" whsp +> numericoid whsp ; AttributeType identifier +> [ "NAME" qdescrs ] ; name used in AttributeType +> [ "DESC" qdstring ] ; description +> [ "OBSOLETE" whsp ] +> [ "SUP" woid ] ; derived from this other +> ; AttributeType +> [ "EQUALITY" woid ; Matching Rule name +> [ "ORDERING" woid ; Matching Rule name +> [ "SUBSTR" woid ] ; Matching Rule name +> [ "SYNTAX" whsp noidlen whsp ] ; Syntax OID +> [ "SINGLE-VALUE" whsp ] ; default multi-valued +> [ "COLLECTIVE" whsp ] ; default not collective +> [ "NO-USER-MODIFICATION" whsp ]; default user modifiable +> [ "USAGE" whsp AttributeUsage ]; default userApplications +> whsp ")" +> +> AttributeUsage = +> "userApplications" / +> "directoryOperation" / +> "distributedOperation" / ; DSA-shared +> "dSAOperation" ; DSA-specific, value depends on server +> + +where whsp is a space ('{{EX: }}'), numericoid is a globally unique +OID in dotted-decimal form (e.g. {{EX:1.1.0}}), qdescrs is one or +more names, woid is either the name or OID optionally followed +by a length specifier (e.g {{EX:{10}}}). + +For example, the attribute types {{EX:name}} and {{EX:cn}} are defined +in {{F:core.schema}} as: + +> attributeType ( 2.5.4.41 NAME 'name' +> DESC 'name(s) associated with the object' +> EQUALITY caseIgnoreMatch +> SUBSTR caseIgnoreSubstringsMatch +> SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) +> attributeType ( 2.5.4.3 NAME ( 'cn' 'commonName' ) +> DESC 'common name(s) associated with the object' +> SUP name ) + +Notice that each defines the attribute's OID, provides a short name, +and a brief description. Each name is an alias for the OID. +{{slapd}}(8) returns the first listed name when returning results. + +The first attribute, {{EX:name}}, holds values of {{EX:directoryString}} +({{TERM:UTF-8}} encoded Unicode) syntax. The syntax is +specified by OID (1.3.6.1.4.1.1466.115.121.1.15 identifies the +directoryString syntax). A length recommendation of 32768 is +specified. Servers should support values of this length, but may +support longer values. The field does NOT specify a size constraint, +so is ignored on servers (such as slapd) which don't impose such +size limits. In addition, the equality and substring matching uses +case ignore rules. Below are tables listing commonly used syntax +and matching rules ({{slapd}}(8) supports these and many more). + +!block table; align=Center; coltags="EX,EX,N"; \ + title="Table 8.3: Commonly Used Syntaxes" +Name OID Description +boolean 1.3.6.1.4.1.1466.115.121.1.7 boolean value +directoryString 1.3.6.1.4.1.1466.115.121.1.15 Unicode (UTF-8) string +distinguishedName 1.3.6.1.4.1.1466.115.121.1.12 LDAP {{TERM:DN}} +integer 1.3.6.1.4.1.1466.115.121.1.27 integer +numericString 1.3.6.1.4.1.1466.115.121.1.36 numeric string +OID 1.3.6.1.4.1.1466.115.121.1.38 object identifier +octetString 1.3.6.1.4.1.1466.115.121.1.40 arbitrary octets +!endblock + +> + +!block table; align=Center; coltags="EX,N"; \ + title="Table 8.4: Commonly Used Matching Rules" +Name Type Description +booleanMatch equality boolean +caseIgnoreMatch equality case insensitive, space insensitive +caseIgnoreOrderingMatch ordering case insensitive, space insensitive +caseIgnoreSubstringsMatch substrings case insensitive, space insensitive +caseExactMatch equality case sensitive, space insensitive +caseExactOrderingMatch ordering case sensitive, space insensitive +caseExactSubstringsMatch substrings case sensitive, space insensitive +distinguishedNameMatch equality distinguished name +integerMatch equality integer +integerOrderingMatch ordering integer +numericStringMatch equality numerical +numericStringOrderingMatch ordering numerical +numericStringSubstringsMatch substrings numerical +octetStringMatch equality octet string +octetStringOrderingMatch ordering octet string +octetStringSubstringsMatch ordering octet string +objectIdentiferMatch equality object identifier +!endblock + +The second attribute, {{EX:cn}}, is a subtype of {{EX:name}} hence +it inherits the syntax, matching rules, and usage of {{EX:name}}. +{{EX:commonName}} is an alternative name. + +Neither attribute is restricted to a single value. Both are meant +for usage by user applications. Neither is obsolete nor collective. + +The following subsections provide a couple of examples. + + +H4: x-my-UniqueName + +Many organizations maintain a single unique name for each user. +Though one could use {{EX:displayName}} ({{REF:RFC2798}}), this +attribute is really meant to be controlled by the user, not the +organization. We could just copy the definition of {{EX:displayName}} +from {{F:inetorgperson.schema}} and replace the OID, name, and +description, e.g: + +> attributetype ( 1.1.2.1.1 NAME 'x-my-UniqueName' +> DESC 'unique name with my organization' +> EQUALITY caseIgnoreMatch +> SUBSTR caseIgnoreSubstringsMatch +> SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 +> SINGLE-VALUE ) + +However, if we want this name to be used in {{EX:name}} assertions, +e.g. {{EX:(name=*Jane*)}}, the attribute could alternatively be +defined as a subtype of {{EX:name}}, e.g.: + +> attributetype ( 1.1.2.1.1 NAME 'x-my-UniqueName' +> DESC 'unique name with my organization' +> SUP name ) + + +H4: x-my-Photo + +Many organizations maintain a photo of each each user. A +{{EX:x-my-Photo}} attribute type could be defined to hold a photo. +Of course, one could use just use {{EX:jpegPhoto}} ({{REF:RFC2798}}) +(or a subtype) to hold the photo. However, you can only do +this if the photo is in {{JPEG File Interchange Format}}. +Alternatively, an attribute type which uses the {{Octet String}} +syntax can be defined, e.g.: + +> attributetype ( 1.1.2.1.2 NAME 'x-my-Photo' +> DESC 'a photo (application defined format)' +> SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 +> SINGLE-VALUE ) + +In this case, the syntax doesn't specify the format of the photo. +It's assumed (maybe incorrectly) that all applications accessing +this attribute agree on the handling of values. + +If you wanted to support multiple photo formats, you could define +a separate attribute type for each format, prefix the photo +with some typing information, or describe the value using +{{TERM:ASN.1}} and use the {{EX:;binary}} transfer option. + +Another alternative is for the attribute to hold a {{TERM:URI}} +pointing to the photo. You can model such an attribute after +{{EX:labeledURI}} ({{REF:RFC2079}}) or simply create a subtype, +e.g.: + +> attributetype ( 1.1.2.1.3 NAME 'x-my-PhotoURI' +> DESC 'URI and optional label referring to a photo' +> SUP labeledURI ) + + +H3: Object Class Specification + +The {{objectclasses}} directive is used to define a new object +class. The directive uses the same Object Class Description +(as defined in {{REF:RFC4512}}) used by the objectClasses +attribute found in the subschema subentry, e.g.: + +E: objectclass <{{REF:RFC4512}} Object Class Description> + +where Object Class Description is defined by the following +{{TERM:ABNF}}: + +> ObjectClassDescription = "(" whsp +> numericoid whsp ; ObjectClass identifier +> [ "NAME" qdescrs ] +> [ "DESC" qdstring ] +> [ "OBSOLETE" whsp ] +> [ "SUP" oids ] ; Superior ObjectClasses +> [ ( "ABSTRACT" / "STRUCTURAL" / "AUXILIARY" ) whsp ] +> ; default structural +> [ "MUST" oids ] ; AttributeTypes +> [ "MAY" oids ] ; AttributeTypes +> whsp ")" + +where whsp is a space ('{{EX: }}'), numericoid is a globally unique +OID in dotted-decimal form (e.g. {{EX:1.1.0}}), qdescrs is one or more +names, and oids is one or more names and/or OIDs. + + +H4: x-my-PhotoObject + +To define an {{auxiliary}} object class which allows +x-my-Photo to be added to any existing entry. + +> objectclass ( 1.1.2.2.1 NAME 'x-my-PhotoObject' +> DESC 'mixin x-my-Photo' +> AUXILIARY +> MAY x-my-Photo ) + + +H4: x-my-Person + +If your organization would like have a private {{structural}} +object class to instantiate users, you can subclass one of +the existing person classes, such as {{EX:inetOrgPerson}} +({{REF:RFC2798}}), and add any additional attributes which +you desire. + +> objectclass ( 1.1.2.2.2 NAME 'x-my-Person' +> DESC 'my person' +> SUP inetOrgPerson +> MUST ( x-my-UniqueName $ givenName ) +> MAY x-my-Photo ) + +The object class inherits the required/allowed attribute +types of {{EX:inetOrgPerson}} but requires {{EX:x-my-UniqueName}} +and {{EX:givenName}} and allows {{EX:x-my-Photo}}. + +!if 0 +H2: Transferring Schema + +Since the {{slapd.conf}}(5) schema directives use {{REF:RFC4512}} +format values, you can extract schema elements published by any +{{TERM:LDAPv3}} server and easily construct directives for use with +{{slapd}}(8). + +LDAPv3 servers publish schema elements in special {{subschema}} +entries (or subentries). While {{slapd}}(8) publishes a single +subschema subentry normally named {{EX:cn=Subschema}}, this behavior +cannot be expected from other servers. The subschema subentry +controlling a particular entry can be obtained by examining the +{{EX:subschemaSubentry}} attribute contained in the entry at the +root of each administrative context. For example, + +> ldapsearch -LLL -x -b "dc=example,dc=com" -s base "(objectclass=*)" subschemaSubentry + +To obtain the schema from a subschema subentry, you can use +ldapsearch(1) as follows (replace the search base as needed): + +> ldapsearch -LLL -x -b "cn=Subschema" -s base "(objectclass=subschema)" attributeTypes objectClasses + +where "cn=Subschema" is the value of subschemaSubentry returned in +the prior search. + +This will return {{TERM:LDIF}} output containing many type/value +pairs. The following is an abbreviated example: + +> dn: cn=Subschema +> objectClasses: ( 1.1.2.2.2 NAME 'x-my-Person' DESC 'my person' SUP inet +> OrgPerson MUST ( x-my-UniqueName $ givenName ) MAY x-my-Photo ) +> attributeTypes: ( 1.1.2.1.1 NAME 'x-my-UniqueName' DESC 'unique name wi +> th my organization' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrin +> gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) +> attributeTypes: ( 1.1.2.1.2 NAME 'x-my-Photo' DESC 'a photo (applicatio +> n defined format)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 + +Capture the output of the search in a file and then edit the file: + ++ to contain only desired type/value pairs +^ join LDIF continuation lines +^ replace attribute type with directive name +(e.g. {{EX:s/attributeTypes:/attributeType /}} and +{{EX:s/objectClasses:/objectClass /}}). +^ reorder lines so each element is defined before first use +^ continue long directives over multiple lines + +For the three type/value pairs in our example, the edit should +result in a file with contains of: + +> attributetype ( 1.1.2.1.1 NAME 'x-my-UniqueName' +> DESC 'unique name with my organization' +> EQUALITY caseIgnoreMatch +> SUBSTR caseIgnoreSubstringsMatch +> SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 +> SINGLE-VALUE ) +> attributeType ( 1.1.2.1.2 NAME 'x-my-Photo' +> DESC 'a photo (application defined format)' +> SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 +> objectClass ( 1.1.2.2.2 NAME 'x-my-Person' +> DESC 'my person' +> SUP inetOrgPerson +> MUST ( x-my-UniqueName $ givenName ) +> MAY x-my-Photo ) + +Save in an appropriately named file (e.g. {{F:local.schema}}). +You may now include this file in your {{slapd.conf}}(5) file. +!endif + + +H3: OID Macros + +To ease the management and use of OIDs, {{slapd}}(8) supports +{{Object Identifier}} macros. The {{EX:objectIdentifier}} directive +is used to equate a macro (name) with a OID. The OID may possibly +be derived from a previously defined OID macro. The {{slapd.conf}}(5) +syntax is: + +E: objectIdentifier <name> { <oid> | <name>[:<suffix>] } + +The following demonstrates definition of a set of OID macros +and their use in defining schema elements: + +> objectIdentifier myOID 1.1 +> objectIdentifier mySNMP myOID:1 +> objectIdentifier myLDAP myOID:2 +> objectIdentifier myAttributeType myLDAP:1 +> objectIdentifier myObjectClass myLDAP:2 +> attributetype ( myAttributeType:3 NAME 'x-my-PhotoURI' +> DESC 'URI and optional label referring to a photo' +> SUP labeledURI ) +> objectclass ( myObjectClass:1 NAME 'x-my-PhotoObject' +> DESC 'mixin x-my-Photo' +> AUXILIARY +> MAY x-my-Photo ) + diff --git a/doc/guide/admin/security.sdf b/doc/guide/admin/security.sdf new file mode 100644 index 0000000..86d2ca3 --- /dev/null +++ b/doc/guide/admin/security.sdf @@ -0,0 +1,398 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# Portions Copyright 2008 Andrew Findlay. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Security Considerations + +OpenLDAP Software is designed to run in a wide variety of computing +environments from tightly-controlled closed networks to the global +Internet. Hence, OpenLDAP Software supports many different security +mechanisms. This chapter describes these mechanisms and discusses +security considerations for using OpenLDAP Software. + +H2: Network Security + +H3: Selective Listening + +By default, {{slapd}}(8) will listen on both the IPv4 and IPv6 "any" +addresses. It is often desirable to have {{slapd}} listen on select +address/port pairs. For example, listening only on the IPv4 address +{{EX:127.0.0.1}} will disallow remote access to the directory server. +E.g.: + +> slapd -h ldap://127.0.0.1 + +While the server can be configured to listen on a particular interface +address, this doesn't necessarily restrict access to the server to +only those networks accessible via that interface. To selective +restrict remote access, it is recommend that an {{SECT:IP Firewall}} +be used to restrict access. + +See {{SECT:Command-line Options}} and {{slapd}}(8) for more +information. + + +H3: IP Firewall + +{{TERM:IP}} firewall capabilities of the server system can be used +to restrict access based upon the client's IP address and/or network +interface used to communicate with the client. + +Generally, {{slapd}}(8) listens on port 389/tcp for {{F:ldap://}} +sessions and port 636/tcp for {{F:ldaps://}}) sessions. {{slapd}}(8) +may be configured to listen on other ports. + +As specifics of how to configure IP firewall are dependent on the +particular kind of IP firewall used, no examples are provided here. +See the document associated with your IP firewall. + + +H3: TCP Wrappers + +{{slapd}}(8) supports {{TERM:TCP}} Wrappers. TCP Wrappers provide +a rule-based access control system for controlling TCP/IP access +to the server. For example, the {{host_options}}(5) rule: + +> slapd: 10.0.0.0/255.0.0.0 127.0.0.1 : ALLOW +> slapd: ALL : DENY + +allows only incoming connections from the private network {{F:10.0.0.0}} +and localhost ({{F:127.0.0.1}}) to access the directory service. + +Note: IP addresses are used as {{slapd}}(8) is not normally +configured to perform reverse lookups. + +It is noted that TCP wrappers require the connection to be accepted. +As significant processing is required just to deny a connection, +it is generally advised that IP firewall protection be used instead +of TCP wrappers. + +See {{hosts_access}}(5) for more information on TCP wrapper rules. + + +H2: Data Integrity and Confidentiality Protection + +{{TERM[expand]TLS}} (TLS) can be used to provide data integrity and +confidentiality protection. OpenLDAP supports negotiation of +{{TERM:TLS}} ({{TERM:SSL}}) via both StartTLS and {{F:ldaps://}}. +See the {{SECT:Using TLS}} chapter for more information. StartTLS +is the standard track mechanism. + +A number of {{TERM[expand]SASL}} (SASL) mechanisms, such as +{{TERM:DIGEST-MD5}} and {{TERM:GSSAPI}}, also provide data integrity +and confidentiality protection. See the {{SECT:Using SASL}} chapter +for more information. + + +H3: Security Strength Factors + +The server uses {{TERM[expand]SSF}}s (SSF) to indicate the relative +strength of protection. A SSF of zero (0) indicates no protections +are in place. A SSF of one (1) indicates integrity protection are +in place. A SSF greater than one (>1) roughly correlates to the +effective encryption key length. For example, {{TERM:DES}} is 56, +{{TERM:3DES}} is 112, and {{TERM:AES}} 128, 192, or 256. + +A number of administrative controls rely on SSFs associated with +TLS and SASL protection in place on an LDAP session. + +{{EX:security}} controls disallow operations when appropriate +protections are not in place. For example: + +> security ssf=1 update_ssf=112 + +requires integrity protection for all operations and encryption +protection, 3DES equivalent, for update operations (e.g. add, delete, +modify, etc.). See {{slapd.conf}}(5) for details. + +For fine-grained control, SSFs may be used in access controls. +See the {{SECT:Access Control}} section for more information. + + +H2: Authentication Methods + +H3: "simple" method + +The LDAP "simple" method has three modes of operation: + +* anonymous, +* unauthenticated, and +* user/password authenticated. + +Anonymous access is requested by providing no name and no password +to the "simple" bind operation. Unauthenticated access is requested +by providing a name but no password. Authenticated access is +requested by providing a valid name and password. + +An anonymous bind results in an {{anonymous}} authorization +association. Anonymous bind mechanism is enabled by default, but +can be disabled by specifying "{{EX:disallow bind_anon}}" in +{{slapd.conf}}(5). + +Note: Disabling the anonymous bind mechanism does not prevent +anonymous access to the directory. To require authentication to +access the directory, one should instead specify "{{EX:require authc}}". + +An unauthenticated bind also results in an {{anonymous}} authorization +association. Unauthenticated bind mechanism is disabled by default, +but can be enabled by specifying "{{EX:allow bind_anon_cred}}" in +{{slapd.conf}}(5). As a number of LDAP applications mistakenly +generate unauthenticated bind request when authenticated access was +intended (that is, they do not ensure a password was provided), +this mechanism should generally remain disabled. + +A successful user/password authenticated bind results in a user +authorization identity, the provided name, being associated with +the session. User/password authenticated bind is enabled by default. +However, as this mechanism itself offers no eavesdropping protection +(e.g., the password is set in the clear), it is recommended that +it be used only in tightly controlled systems or when the LDAP +session is protected by other means (e.g., TLS, {{TERM:IPsec}}). +Where the administrator relies on TLS to protect the password, it +is recommended that unprotected authentication be disabled. This +is done using the {{EX:security}} directive's {{EX:simple_bind}} +option, which provides fine grain control over the level of confidential +protection to require for {{simple}} user/password authentication. +E.g., using {{EX:security simple_bind=56}} would require {{simple}} +binds to use encryption of DES equivalent or better. + +The user/password authenticated bind mechanism can be completely +disabled by setting "{{EX:disallow bind_simple}}". + +Note: An unsuccessful bind always results in the session having +an {{anonymous}} authorization association. + + +H3: SASL method + +The LDAP {{TERM:SASL}} method allows the use of any SASL authentication +mechanism. The {{SECT:Using SASL}} section discusses the use of SASL. + +H2: Password Storage + +LDAP passwords are normally stored in the {{userPassword}} attribute. +{{REF:RFC4519}} specifies that passwords are not stored in encrypted +(or hashed) form. This allows a wide range of password-based +authentication mechanisms, such as {{EX:DIGEST-MD5}} to be used. +This is also the most interoperable storage scheme. + +However, it may be desirable to store a hash of password instead. +{{slapd}}(8) supports a variety of storage schemes for the administrator +to choose from. + +Note: Values of password attributes, regardless of storage scheme +used, should be protected as if they were clear text. Hashed +passwords are subject to {{dictionary attacks}} and {{brute-force +attacks}}. + +The {{userPassword}} attribute is allowed to have more than one value, +and it is possible for each value to be stored in a different form. +During authentication, {{slapd}} will iterate through the values +until it finds one that matches the offered password or until it +runs out of values to inspect. The storage scheme is stored as a prefix +on the value, so a hashed password using the Salted SHA1 ({{EX:SSHA}}) +scheme looks like: + +> userPassword: {SSHA}DkMTwBl+a/3DQTxCYEApdUtNXGgdUac3 + +The advantage of hashed passwords is that an attacker which +discovers the hash does not have direct access to the actual password. +Unfortunately, as dictionary and brute force attacks are generally +quite easy for attackers to successfully mount, this advantage is +marginal at best (this is why all modern Unix systems use shadow +password files). + +The disadvantages of hashed storage is that they are non-standard, may +cause interoperability problem, and generally preclude the use +of stronger than Simple (or SASL/PLAIN) password-based authentication +mechanisms such as {{EX:DIGEST-MD5}}. + +H3: SSHA password storage scheme + +This is the salted version of the SHA scheme. It is believed to be the +most secure password storage scheme supported by {{slapd}}. + +These values represent the same password: + +> userPassword: {SSHA}DkMTwBl+a/3DQTxCYEApdUtNXGgdUac3 +> userPassword: {SSHA}d0Q0626PSH9VUld7yWpR0k6BlpQmtczb + +H3: CRYPT password storage scheme + +This scheme uses the operating system's {{crypt(3)}} hash function. +It normally produces the traditional Unix-style 13 character hash, but +on systems with {{EX:glibc2}} it can also generate the more secure +34-byte MD5 hash. + +> userPassword: {CRYPT}aUihad99hmev6 +> userPassword: {CRYPT}$1$czBJdDqS$TmkzUAb836oMxg/BmIwN.1 + +The advantage of the CRYPT scheme is that passwords can be +transferred to or from an existing Unix password file without having +to know the cleartext form. Both forms of {{crypt}} include salt so +they have some resistance to dictionary attacks. + +Note: Since this scheme uses the operating system's {{crypt(3)}} +hash function, it is therefore operating system specific. + +H3: MD5 password storage scheme + +This scheme simply takes the MD5 hash of the password and stores it in +base64 encoded form: + +> userPassword: {MD5}Xr4ilOzQ4PCOq3aQ0qbuaQ== + +Although safer than cleartext storage, this is not a very secure +scheme. The MD5 algorithm is fast, and because there is no salt the +scheme is vulnerable to a dictionary attack. + +H3: SMD5 password storage scheme + +This improves on the basic MD5 scheme by adding salt (random data +which means that there are many possible representations of a given +plaintext password). For example, both of these values represent the +same password: + +> userPassword: {SMD5}4QWGWZpj9GCmfuqEvm8HtZhZS6E= +> userPassword: {SMD5}g2/J/7D5EO6+oPdklp5p8YtNFk4= + +H3: SHA password storage scheme + +Like the MD5 scheme, this simply feeds the password through an SHA +hash process. SHA is thought to be more secure than MD5, but the lack +of salt leaves the scheme exposed to dictionary attacks. + +> userPassword: {SHA}5en6G6MezRroT3XKqkdPOmY/BfQ= + +H3: SASL password storage scheme + +This is not really a password storage scheme at all. It uses the +value of the {{userPassword}} attribute to delegate password +verification to another process. See below for more information. + +Note: This is not the same as using SASL to authenticate the LDAP +session. + +H2: Pass-Through authentication + +Since OpenLDAP 2.0 {{slapd}} has had the ability to delegate password +verification to a separate process. This uses the {{sasl_checkpass(3)}} +function so it can use any back-end server that Cyrus SASL supports for +checking passwords. The choice is very wide, as one option is to use +{{saslauthd(8)}} which in turn can use local files, Kerberos, an IMAP +server, another LDAP server, or anything supported by the PAM mechanism. + +The server must be built with the {{EX:--enable-spasswd}} +configuration option to enable pass-through authentication. + +Note: This is not the same as using a SASL mechanism to +authenticate the LDAP session. + +Pass-Through authentication works only with plaintext passwords, as +used in the "simple bind" and "SASL PLAIN" authentication mechanisms.}} + +Pass-Through authentication is selective: it only affects users whose +{{userPassword}} attribute has a value marked with the "{SASL}" +scheme. The format of the attribute is: + +> userPassword: {SASL}username@realm + +The {{username}} and {{realm}} are passed to the SASL authentication +mechanism and are used to identify the account whose password is to be +verified. This allows arbitrary mapping between entries in OpenLDAP +and accounts known to the backend authentication service. + +It would be wise to use access control to prevent users from changing +their passwords through LDAP where they have pass-through authentication +enabled. + + +H3: Configuring slapd to use an authentication provider + +Where an entry has a "{SASL}" password value, OpenLDAP delegates the +whole process of validating that entry's password to Cyrus SASL. All +the configuration is therefore done in SASL config files. + +The first +file to be considered is confusingly named {{slapd.conf}} and is +typically found in the SASL library directory, often +{{EX:/usr/lib/sasl2/slapd.conf}} This file governs the use of SASL +when talking LDAP to {{slapd}} as well as the use of SASL backends for +pass-through authentication. See {{EX:options.html}} in the {{PRD:Cyrus SASL}} +docs for full details. Here is a simple example for a server that will +use {{saslauthd}} to verify passwords: + +> mech_list: plain +> pwcheck_method: saslauthd +> saslauthd_path: /var/run/sasl2/mux + +H3: Configuring saslauthd + +{{saslauthd}} is capable of using many different authentication +services: see {{saslauthd(8)}} for details. A common requirement is to +delegate some or all authentication to another LDAP server. Here is a +sample {{EX:saslauthd.conf}} that uses Microsoft Active Directory (AD): + +> ldap_servers: ldap://dc1.example.com/ ldap://dc2.example.com/ +> +> ldap_search_base: cn=Users,DC=ad,DC=example,DC=com +> ldap_filter: (userPrincipalName=%u) +> +> ldap_bind_dn: cn=saslauthd,cn=Users,DC=ad,DC=example,DC=com +> ldap_password: secret + +In this case, {{saslauthd}} is run with the {{EX:ldap}} authentication +mechanism and is set to combine the SASL realm with the login name: + +> saslauthd -a ldap -r + +This means that the "username@realm" string from the {{userPassword}} +attribute ends up being used to search AD for +"userPrincipalName=username@realm" - the password is then verified by +attempting to bind to AD using the entry found by the search and the +password supplied by the LDAP client. + +H3: Testing pass-through authentication + +It is usually best to start with the back-end authentication provider +and work through {{saslauthd}} and {{slapd}} towards the LDAP client. + +In the AD example above, first check that the DN and password that +{{saslauthd}} will use when it connects to AD are valid: + +> ldapsearch -x -H ldap://dc1.example.com/ \ +> -D cn=saslauthd,cn=Users,DC=ad,DC=example,DC=com \ +> -w secret \ +> -b '' \ +> -s base + +Next check that a sample AD user can be found: + +> ldapsearch -x -H ldap://dc1.example.com/ \ +> -D cn=saslauthd,cn=Users,DC=ad,DC=example,DC=com \ +> -w secret \ +> -b cn=Users,DC=ad,DC=example,DC=com \ +> "(userPrincipalName=user@ad.example.com)" + +Check that the user can bind to AD: + +> ldapsearch -x -H ldap://dc1.example.com/ \ +> -D cn=user,cn=Users,DC=ad,DC=example,DC=com \ +> -w userpassword \ +> -b cn=user,cn=Users,DC=ad,DC=example,DC=com \ +> -s base \ +> "(objectclass=*)" + +If all that works then {{saslauthd}} should be able to do the same: + +> testsaslauthd -u user@ad.example.com -p userpassword +> testsaslauthd -u user@ad.example.com -p wrongpassword + +Now put the magic token into an entry in OpenLDAP: + +> userPassword: {SASL}user@ad.example.com + +It should now be possible to bind to OpenLDAP using the DN of that +entry and the password of the AD user. + diff --git a/doc/guide/admin/set-following-references.png b/doc/guide/admin/set-following-references.png Binary files differnew file mode 100644 index 0000000..2e6ef93 --- /dev/null +++ b/doc/guide/admin/set-following-references.png diff --git a/doc/guide/admin/set-memberUid.png b/doc/guide/admin/set-memberUid.png Binary files differnew file mode 100644 index 0000000..0b8e037 --- /dev/null +++ b/doc/guide/admin/set-memberUid.png diff --git a/doc/guide/admin/set-recursivegroup.png b/doc/guide/admin/set-recursivegroup.png Binary files differnew file mode 100644 index 0000000..604a5db --- /dev/null +++ b/doc/guide/admin/set-recursivegroup.png diff --git a/doc/guide/admin/slapdconf2.sdf b/doc/guide/admin/slapdconf2.sdf new file mode 100644 index 0000000..ab52fb1 --- /dev/null +++ b/doc/guide/admin/slapdconf2.sdf @@ -0,0 +1,1173 @@ +# $OpenLDAP$ +# Copyright 2005-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Configuring slapd + +Once the software has been built and installed, you are ready +to configure {{slapd}}(8) for use at your site. + +OpenLDAP 2.3 and later have transitioned to using a dynamic runtime +configuration engine, {{slapd-config}}(5). {{slapd-config}}(5) +* is fully LDAP-enabled +* is managed using the standard LDAP operations +* stores its configuration data in an {{TERM:LDIF}} database, generally +in the {{F:/usr/local/etc/openldap/slapd.d}} directory. +* allows all of slapd's configuration options to be changed on the fly, +generally without requiring a server restart for the changes +to take effect. + +This chapter describes the general format of the {{slapd-config}}(5) +configuration system, followed by a detailed description of commonly used +settings. + +The older style {{slapd.conf}}(5) file is still supported, but its use +is deprecated and support for it will be withdrawn in a future OpenLDAP +release. Configuring {{slapd}}(8) via {{slapd.conf}}(5) is described in +the next chapter. + +Refer to {{slapd}}(8) for information on how to have slapd automatically +convert from {{slapd.conf}}(5) to {{slapd-config}}(5). + + +Note: Although the {{slapd-config}}(5) system stores its configuration +as (text-based) LDIF files, you should {{1:never}} edit any of +the LDIF files directly. Configuration changes should be performed via LDAP +operations, e.g. {{ldapadd}}(1), {{ldapdelete}}(1), or {{ldapmodify}}(1). + + +Note: You will need to continue to use the older {{slapd.conf}}(5) +configuration system if your OpenLDAP installation requires the use of one +or more backends or overlays that have not been updated to use the +{{slapd-config}}(5) system. As of OpenLDAP 2.4.33, all of the official +backends have been updated. There may be additional contributed or experimental +overlays that also have not been updated. + + +H2: Configuration Layout + +The slapd configuration is stored as a special LDAP directory with +a predefined schema and DIT. There are specific objectClasses used to +carry global configuration options, schema definitions, backend and +database definitions, and assorted other items. A sample config tree +is shown in Figure 5.1. + +!import "config_dit.png"; align="center"; title="Sample configuration tree" +FT[align="Center"] Figure 5.1: Sample configuration tree. + +Other objects may be part of the configuration but were omitted from +the illustration for clarity. + +The {{slapd-config}} configuration tree has a very specific structure. The +root of the tree is named {{EX:cn=config}} and contains global configuration +settings. Additional settings are contained in separate child entries: +* Dynamically loaded modules +.. These may only be used if the {{EX:--enable-modules}} option was +used to configure the software. +* Schema definitions +.. The {{EX:cn=schema,cn=config}} entry contains the system schema (all +the schema that is hard-coded in slapd). +.. Child entries of {{EX:cn=schema,cn=config}} contain user schema as +loaded from config files or added at runtime. +* Backend-specific configuration +* Database-specific configuration +.. Overlays are defined in children of the Database entry. +.. Databases and Overlays may also have other miscellaneous children. + +The usual rules for LDIF files apply to the configuration information: +Comment lines beginning with a '{{EX:#}}' character +are ignored. If a line begins with a single space, it is considered a +continuation of the previous line (even if the previous line is a +comment) and the single leading space is removed. Entries are separated by blank lines. + +The general layout of the config LDIF is as follows: + +> # global configuration settings +> dn: cn=config +> objectClass: olcGlobal +> cn: config +> <global config settings> +> +> # schema definitions +> dn: cn=schema,cn=config +> objectClass: olcSchemaConfig +> cn: schema +> <system schema> +> +> dn: cn={X}core,cn=schema,cn=config +> objectClass: olcSchemaConfig +> cn: {X}core +> <core schema> +> +> # additional user-specified schema +> ... +> +> # backend definitions +> dn: olcBackend=<typeA>,cn=config +> objectClass: olcBackendConfig +> olcBackend: <typeA> +> <backend-specific settings> +> +> # database definitions +> dn: olcDatabase={X}<typeA>,cn=config +> objectClass: olcDatabaseConfig +> olcDatabase: {X}<typeA> +> <database-specific settings> +> +> # subsequent definitions and settings +> ... + +Some of the entries listed above have a numeric index {{EX:"{X}"}} in +their names. While most configuration settings have an inherent ordering +dependency (i.e., one setting must take effect before a subsequent one +may be set), LDAP databases are inherently unordered. The numeric index +is used to enforce a consistent ordering in the configuration database, +so that all ordering dependencies are preserved. In most cases the index +does not have to be provided; it will be automatically generated based +on the order in which entries are created. + +Configuration directives are specified as values of individual +attributes. +Most of the attributes and objectClasses used in the slapd +configuration have a prefix of {{EX:"olc"}} (OpenLDAP Configuration) +in their names. Generally there is a one-to-one correspondence +between the attributes and the old-style {{EX:slapd.conf}} configuration +keywords, using the keyword as the attribute name, with the "olc" +prefix attached. + +A configuration directive may take arguments. If so, the arguments are +separated by whitespace. If an argument contains whitespace, +the argument should be enclosed in double quotes {{EX:"like this"}}. +In the descriptions that follow, arguments that should be replaced +by actual text are shown in brackets {{EX:<>}}. + +The distribution contains an example configuration file that will +be installed in the {{F: /usr/local/etc/openldap}} directory. +A number of files containing schema definitions (attribute types +and object classes) are also provided in the +{{F: /usr/local/etc/openldap/schema}} directory. + + +H2: Configuration Directives + +This section details commonly used configuration directives. For +a complete list, see the {{slapd-config}}(5) manual page. This section +will treat the configuration directives in a top-down order, starting +with the global directives in the {{EX:cn=config}} entry. Each +directive will be described along with its default value (if any) and +an example of its use. + + +H3: cn=config + +Directives contained in this entry generally apply to the server as a whole. +Most of them are system or connection oriented, not database related. This +entry must have the {{EX:olcGlobal}} objectClass. + + +H4: olcIdleTimeout: <integer> + +Specify the number of seconds to wait before forcibly closing +an idle client connection. A value of 0, the default, +disables this feature. + + +H4: olcLogLevel: <level> + +This directive specifies the level at which debugging statements +and operation statistics should be syslogged (currently logged to +the {{syslogd}}(8) {{EX:LOG_LOCAL4}} facility). You must have +configured OpenLDAP {{EX:--enable-debug}} (the default) for this +to work (except for the two statistics levels, which are always +enabled). Log levels may be specified as integers or by keyword. +Multiple log levels may be used and the levels are additive. +To display what levels +correspond to what kind of debugging, invoke slapd with {{EX:-d?}} +or consult the table below. The possible values for <level> are: + +!block table; colaligns="RL"; align=Center; \ + title="Table 5.1: Debugging Levels" +Level Keyword Description +-1 any enable all debugging +0 no debugging +1 (0x1 trace) trace function calls +2 (0x2 packets) debug packet handling +4 (0x4 args) heavy trace debugging +8 (0x8 conns) connection management +16 (0x10 BER) print out packets sent and received +32 (0x20 filter) search filter processing +64 (0x40 config) configuration processing +128 (0x80 ACL) access control list processing +256 (0x100 stats) stats log connections/operations/results +512 (0x200 stats2) stats log entries sent +1024 (0x400 shell) print communication with shell backends +2048 (0x800 parse) print entry parsing debugging +16384 (0x4000 sync) syncrepl consumer processing +32768 (0x8000 none) only messages that get logged whatever log level is set +!endblock + +The desired log level can be input as a single integer that +combines the (ORed) desired levels, both in decimal or in hexadecimal +notation, as a list of integers (that are ORed internally), or as a list of the names that are shown between brackets, such that + +> olcLogLevel 129 +> olcLogLevel 0x81 +> olcLogLevel 128 1 +> olcLogLevel 0x80 0x1 +> olcLogLevel acl trace + +are equivalent. + +\Examples: + +E: olcLogLevel -1 + +This will cause lots and lots of debugging information to be +logged. + +E: olcLogLevel conns filter + +Just log the connection and search filter processing. + +E: olcLogLevel none + +Log those messages that are logged regardless of the configured loglevel. This +differs from setting the log level to 0, when no logging occurs. At least the +{{EX:None}} level is required to have high priority messages logged. + +\Default: + +E: olcLogLevel stats + +Basic stats logging is configured by default. However, if no olcLogLevel is +defined, no logging occurs (equivalent to a 0 level). + + +H4: olcReferral <URI> + +This directive specifies the referral to pass back when slapd +cannot find a local database to handle a request. + +\Example: + +> olcReferral: ldap://root.openldap.org + +This will refer non-local queries to the global root LDAP server +at the OpenLDAP Project. Smart LDAP clients can re-ask their +query at that server, but note that most of these clients are +only going to know how to handle simple LDAP URLs that +contain a host part and optionally a distinguished name part. + + +H4: Sample Entry + +>dn: cn=config +>objectClass: olcGlobal +>cn: config +>olcIdleTimeout: 30 +>olcLogLevel: Stats +>olcReferral: ldap://root.openldap.org + + +H3: cn=module + +If support for dynamically loaded modules was enabled when configuring +slapd, {{EX:cn=module}} entries may be used to specify sets of modules to load. +Module entries must have the {{EX:olcModuleList}} objectClass. + + +H4: olcModuleLoad: <filename> + +Specify the name of a dynamically loadable module to load. The filename +may be an absolute path name or a simple filename. Non-absolute names +are searched for in the directories specified by the {{EX:olcModulePath}} +directive. + + +H4: olcModulePath: <pathspec> + +Specify a list of directories to search for loadable modules. Typically the +path is colon-separated but this depends on the operating system. + + +H4: Sample Entries + +>dn: cn=module{0},cn=config +>objectClass: olcModuleList +>cn: module{0} +>olcModuleLoad: /usr/local/lib/smbk5pwd.la +> +>dn: cn=module{1},cn=config +>objectClass: olcModuleList +>cn: module{1} +>olcModulePath: /usr/local/lib:/usr/local/lib/slapd +>olcModuleLoad: accesslog.la +>olcModuleLoad: pcache.la + + +H3: cn=schema + +The cn=schema entry holds all of the schema definitions that are hard-coded +in slapd. As such, the values in this entry are generated by slapd so no +schema values need to be provided in the config file. The entry must still +be defined though, to serve as a base for the user-defined schema to add +in underneath. Schema entries must have the {{EX:olcSchemaConfig}} +objectClass. + + +H4: olcAttributeTypes: <{{REF:RFC4512}} Attribute Type Description> + +This directive defines an attribute type. +Please see the {{SECT:Schema Specification}} chapter +for information regarding how to use this directive. + + +H4: olcObjectClasses: <{{REF:RFC4512}} Object Class Description> + +This directive defines an object class. +Please see the {{SECT:Schema Specification}} chapter for +information regarding how to use this directive. + + +H4: Sample Entries + +>dn: cn=schema,cn=config +>objectClass: olcSchemaConfig +>cn: schema +> +>dn: cn=test,cn=schema,cn=config +>objectClass: olcSchemaConfig +>cn: test +>olcAttributeTypes: ( 1.1.1 +> NAME 'testAttr' +> EQUALITY integerMatch +> SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) +>olcAttributeTypes: ( 1.1.2 NAME 'testTwo' EQUALITY caseIgnoreMatch +> SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 ) +>olcObjectClasses: ( 1.1.3 NAME 'testObject' +> MAY ( testAttr $ testTwo ) AUXILIARY ) + + +H3: Backend-specific Directives + +Backend directives apply to all database instances of the +same type and, depending on the directive, may be overridden +by database directives. Backend entries must have the +{{EX:olcBackendConfig}} objectClass. + +H4: olcBackend: <type> + +This directive names a backend-specific configuration entry. +{{EX:<type>}} should be one of the +supported backend types listed in Table 5.2. + +!block table; align=Center; coltags="EX,N"; \ + title="Table 5.2: Database Backends" +Types Description +bdb Berkeley DB transactional backend (deprecated) +config Slapd configuration backend +dnssrv DNS SRV backend +hdb Hierarchical variant of bdb backend (deprecated) +ldap Lightweight Directory Access Protocol (Proxy) backend +ldif Lightweight Data Interchange Format backend +mdb Memory-Mapped DB backend +meta Meta Directory backend +monitor Monitor backend +passwd Provides read-only access to {{passwd}}(5) +perl Perl Programmable backend +shell Shell (extern program) backend +sql SQL Programmable backend +!endblock + +\Example: + +> olcBackend: bdb + +There are no other directives defined for this entry. Specific backend +types may define additional attributes for their particular use but so +far none have ever been defined. As such, these directives usually do +not appear in any actual configurations. + + +H4: Sample Entry + +> dn: olcBackend=bdb,cn=config +> objectClass: olcBackendConfig +> olcBackend: bdb + + +H3: Database-specific Directives + +Directives in this section are supported by every type of database. +Database entries must have the {{EX:olcDatabaseConfig}} objectClass. + +H4: olcDatabase: [{<index>}]<type> + +This directive names a specific database instance. The numeric {<index>} may +be provided to distinguish multiple databases of the same type. Usually the +index can be omitted, and slapd will generate it automatically. +{{EX:<type>}} should be one of the +supported backend types listed in Table 5.2 or the {{EX:frontend}} type. + +The {{EX:frontend}} is a special database that is used to hold +database-level options that should be applied to all the other +databases. Subsequent database definitions may also override some +frontend settings. + +The {{EX:config}} database is also special; both the {{EX:config}} and +the {{EX:frontend}} databases are always created implicitly even if they +are not explicitly configured, and they are created before any other +databases. + +\Example: + +> olcDatabase: bdb + +This marks the beginning of a new {{TERM:BDB}} database instance. + + +H4: olcAccess: to <what> [ by <who> [<accesslevel>] [<control>] ]+ + +This directive grants access (specified by <accesslevel>) to a +set of entries and/or attributes (specified by <what>) by one or +more requestors (specified by <who>). +See the {{SECT:Access Control}} section of this guide for basic usage. + +!if 0 +More detailed discussion of this directive can be found in the +{{SECT:Advanced Access Control}} chapter. +!endif + +Note: If no {{EX:olcAccess}} directives are specified, the default +access control policy, {{EX:to * by * read}}, allows all +users (both authenticated and anonymous) read access. + +Note: Access controls defined in the frontend are appended to all +other databases' controls. + + +H4: olcReadonly { TRUE | FALSE } + +This directive puts the database into "read-only" mode. Any +attempts to modify the database will return an "unwilling to +perform" error. If set on a consumer, modifications sent by +syncrepl will still occur. + +\Default: + +> olcReadonly: FALSE + + +H4: olcRootDN: <DN> + +This directive specifies the DN that is not subject to +access control or administrative limit restrictions for +operations on this database. The DN need not refer to +an entry in this database or even in the directory. The +DN may refer to a SASL identity. + +Entry-based Example: + +> olcRootDN: "cn=Manager,dc=example,dc=com" + +SASL-based Example: + +> olcRootDN: "uid=root,cn=example.com,cn=digest-md5,cn=auth" + +See the {{SECT:SASL Authentication}} section for information on +SASL authentication identities. + + +H4: olcRootPW: <password> + +This directive can be used to specify a password for the DN for +the rootdn (when the rootdn is set to a DN within the database). + +\Example: + +> olcRootPW: secret + +It is also permissible to provide a hash of the password in +{{REF:RFC2307}} form. {{slappasswd}}(8) may be used to generate +the password hash. + +\Example: + +> olcRootPW: {SSHA}ZKKuqbEKJfKSXhUbHG3fG8MDn9j1v4QN + +The hash was generated using the command {{EX:slappasswd -s secret}}. + + +H4: olcSizeLimit: <integer> + +This directive specifies the maximum number of entries to return +from a search operation. + +\Default: + +> olcSizeLimit: 500 + +See the {{SECT:Limits}} section of this guide and slapd-config(5) +for more details. + + +H4: olcSuffix: <dn suffix> + +This directive specifies the DN suffix of queries that will be +passed to this backend database. Multiple suffix lines can be +given, and usually at least one is required for each database +definition. (Some backend types, such as {{EX:frontend}} and +{{EX:monitor}} use a hard-coded suffix which may not be overridden +in the configuration.) + +\Example: + +> olcSuffix: "dc=example,dc=com" + +Queries with a DN ending in "dc=example,dc=com" +will be passed to this backend. + +Note: When the backend to pass a query to is selected, slapd +looks at the suffix value(s) in each database definition in the +order in which they were configured. Thus, if one database suffix is a +prefix of another, it must appear after it in the configuration. + + +H4: olcSyncrepl + +> olcSyncrepl: rid=<replica ID> +> provider=ldap[s]://<hostname>[:port] +> [type=refreshOnly|refreshAndPersist] +> [interval=dd:hh:mm:ss] +> [retry=[<retry interval> <# of retries>]+] +> searchbase=<base DN> +> [filter=<filter str>] +> [scope=sub|one|base] +> [attrs=<attr list>] +> [attrsonly] +> [sizelimit=<limit>] +> [timelimit=<limit>] +> [schemachecking=on|off] +> [bindmethod=simple|sasl] +> [binddn=<DN>] +> [saslmech=<mech>] +> [authcid=<identity>] +> [authzid=<identity>] +> [credentials=<passwd>] +> [realm=<realm>] +> [secprops=<properties>] +> [starttls=yes|critical] +> [tls_cert=<file>] +> [tls_key=<file>] +> [tls_cacert=<file>] +> [tls_cacertdir=<path>] +> [tls_reqcert=never|allow|try|demand] +> [tls_cipher_suite=<ciphers>] +> [tls_crlcheck=none|peer|all] +> [logbase=<base DN>] +> [logfilter=<filter str>] +> [syncdata=default|accesslog|changelog] + + +This directive specifies the current database as a replica of the +master content by establishing the current {{slapd}}(8) as a +replication consumer site running a syncrepl replication engine. +The master database is located at the replication provider site +specified by the {{EX:provider}} parameter. The replica database is +kept up-to-date with the master content using the LDAP Content +Synchronization protocol. See {{REF:RFC4533}} +for more information on the protocol. + +The {{EX:rid}} parameter is used for identification of the current +{{EX:syncrepl}} directive within the replication consumer server, +where {{EX:<replica ID>}} uniquely identifies the syncrepl specification +described by the current {{EX:syncrepl}} directive. {{EX:<replica ID>}} +is non-negative and is no more than three decimal digits in length. + +The {{EX:provider}} parameter specifies the replication provider site +containing the master content as an LDAP URI. The {{EX:provider}} +parameter specifies a scheme, a host and optionally a port where the +provider slapd instance can be found. Either a domain name or IP +address may be used for <hostname>. Examples are +{{EX:ldap://provider.example.com:389}} or {{EX:ldaps://192.168.1.1:636}}. +If <port> is not given, the standard LDAP port number (389 or 636) is used. +Note that the syncrepl uses a consumer-initiated protocol, and hence its +specification is located at the consumer site, whereas the {{EX:replica}} +specification is located at the provider site. {{EX:syncrepl}} and +{{EX:replica}} directives define two independent replication +mechanisms. They do not represent the replication peers of each other. + +The content of the syncrepl replica is defined using a search +specification as its result set. The consumer slapd will +send search requests to the provider slapd according to the search +specification. The search specification includes {{EX:searchbase}}, +{{EX:scope}}, {{EX:filter}}, {{EX:attrs}}, {{EX:attrsonly}}, +{{EX:sizelimit}}, and {{EX:timelimit}} parameters as in the normal +search specification. The {{EX:searchbase}} parameter has no +default value and must always be specified. The {{EX:scope}} defaults +to {{EX:sub}}, the {{EX:filter}} defaults to {{EX:(objectclass=*)}}, +{{EX:attrs}} defaults to {{EX:"*,+"}} to replicate all user and operational +attributes, and {{EX:attrsonly}} is unset by default. Both {{EX:sizelimit}} +and {{EX:timelimit}} default to "unlimited", and only positive integers +or "unlimited" may be specified. + +The {{TERM[expand]LDAP Sync}} protocol has two operation +types: {{EX:refreshOnly}} and {{EX:refreshAndPersist}}. +The operation type is specified by the {{EX:type}} parameter. +In the {{EX:refreshOnly}} operation, the next synchronization search operation +is periodically rescheduled at an interval time after each +synchronization operation finishes. The interval is specified +by the {{EX:interval}} parameter. It is set to one day by default. +In the {{EX:refreshAndPersist}} operation, a synchronization search +remains persistent in the provider {{slapd}} instance. Further updates to the +master replica will generate {{EX:searchResultEntry}} to the consumer slapd +as the search responses to the persistent synchronization search. + +If an error occurs during replication, the consumer will attempt to reconnect +according to the retry parameter which is a list of the <retry interval> +and <# of retries> pairs. For example, retry="60 10 300 3" lets the consumer +retry every 60 seconds for the first 10 times and then retry every 300 seconds +for the next three times before stop retrying. + in <# of retries> means +indefinite number of retries until success. + +The schema checking can be enforced at the LDAP Sync consumer site +by turning on the {{EX:schemachecking}} parameter. +If it is turned on, every replicated entry will be checked for its +schema as the entry is stored into the replica content. +Every entry in the replica should contain those attributes +required by the schema definition. +If it is turned off, entries will be stored without checking +schema conformance. The default is off. + +The {{EX:binddn}} parameter gives the DN to bind as for the +syncrepl searches to the provider slapd. It should be a DN +which has read access to the replication content in the +master database. + +The {{EX:bindmethod}} is {{EX:simple}} or {{EX:sasl}}, +depending on whether simple password-based authentication or +{{TERM:SASL}} authentication is to be used when connecting +to the provider {{slapd}} instance. + +Simple authentication should not be used unless adequate data +integrity and confidentiality protections are in place (e.g. TLS +or IPsec). Simple authentication requires specification of {{EX:binddn}} +and {{EX:credentials}} parameters. + +SASL authentication is generally recommended. SASL authentication +requires specification of a mechanism using the {{EX:saslmech}} parameter. +Depending on the mechanism, an authentication identity and/or +credentials can be specified using {{EX:authcid}} and {{EX:credentials}}, +respectively. The {{EX:authzid}} parameter may be used to specify +an authorization identity. + +The {{EX:realm}} parameter specifies a realm which a certain +mechanisms authenticate the identity within. The {{EX:secprops}} +parameter specifies Cyrus SASL security properties. + +The {{EX:starttls}} parameter specifies use of the StartTLS extended +operation to establish a TLS session before authenticating to the provider. +If the {{EX:critical}} argument is supplied, the session will be aborted +if the StartTLS request fails. Otherwise the syncrepl session continues +without TLS. The tls_reqcert setting defaults to {{EX:"demand"}} and the +other TLS settings default to the same as the main slapd TLS settings. + +Rather than replicating whole entries, the consumer can query logs +of data modifications. This mode of operation is referred to as +{{delta syncrepl}}. In addition to the above parameters, the +{{EX:logbase}} and {{EX:logfilter}} parameters must be set appropriately +for the log that will be used. The {{EX:syncdata}} parameter must +be set to either {{EX:"accesslog"}} if the log conforms to the +{{slapo-accesslog}}(5) log format, or {{EX:"changelog"}} if the log +conforms to the obsolete {{changelog}} format. If the {{EX:syncdata}} +parameter is omitted or set to {{EX:"default"}} then the log +parameters are ignored. + +The {{syncrepl}} replication mechanism is supported by the {{bdb}}, +{{hdb}}, and {{mdb}} backends. + +See the {{SECT:LDAP Sync Replication}} chapter of this guide for +more information on how to use this directive. + + +H4: olcTimeLimit: <integer> + +This directive specifies the maximum number of seconds (in real +time) slapd will spend answering a search request. If a +request is not finished in this time, a result indicating an +exceeded timelimit will be returned. + +\Default: + +> olcTimeLimit: 3600 + +See the {{SECT:Limits}} section of this guide and slapd-config(5) +for more details. + + +H4: olcUpdateref: <URL> + +This directive is only applicable in a slave slapd. It +specifies the URL to return to clients which submit update +requests upon the replica. +If specified multiple times, each {{TERM:URL}} is provided. + +\Example: + +> olcUpdateref: ldap://master.example.net + + +H4: Sample Entries + +>dn: olcDatabase=frontend,cn=config +>objectClass: olcDatabaseConfig +>objectClass: olcFrontendConfig +>olcDatabase: frontend +>olcReadOnly: FALSE +> +>dn: olcDatabase=config,cn=config +>objectClass: olcDatabaseConfig +>olcDatabase: config +>olcRootDN: cn=Manager,dc=example,dc=com + + +H3: BDB and HDB Database Directives + +Directives in this category apply to both the {{TERM:BDB}} +and the {{TERM:HDB}} database. +They are used in an olcDatabase entry in addition to the generic +database directives defined above. For a complete reference +of BDB/HDB configuration directives, see {{slapd-bdb}}(5). In +addition to the {{EX:olcDatabaseConfig}} objectClass, BDB and HDB +database entries must have the {{EX:olcBdbConfig}} and +{{EX:olcHdbConfig}} objectClass, respectively. + + +H4: olcDbDirectory: <directory> + +This directive specifies the directory where the BDB files +containing the database and associated indices live. + +\Default: + +> olcDbDirectory: /usr/local/var/openldap-data + + +H4: olcDbCachesize: <integer> + +This directive specifies the size in entries of the in-memory +cache maintained by the BDB backend database instance. + +\Default: + +> olcDbCachesize: 1000 + + +H4: olcDbCheckpoint: <kbyte> <min> + +This directive specifies how often to checkpoint the BDB transaction log. +A checkpoint operation flushes the database buffers to disk and writes a +checkpoint record in the log. +The checkpoint will occur if either <kbyte> data has been written or +<min> minutes have passed since the last checkpoint. Both arguments default +to zero, in which case they are ignored. When the <min> argument is +non-zero, an internal task will run every <min> minutes to perform the +checkpoint. See the Berkeley DB reference guide for more details. + +\Example: + +> olcDbCheckpoint: 1024 10 + + +H4: olcDbConfig: <DB_CONFIG setting> + +This attribute specifies a configuration directive to be placed in the +{{EX:DB_CONFIG}} file of the database directory. At server startup time, if +no such file exists yet, the {{EX:DB_CONFIG}} file will be created and the +settings in this attribute will be written to it. If the file exists, +its contents will be read and displayed in this attribute. The attribute +is multi-valued, to accommodate multiple configuration directives. No default +is provided, but it is essential to use proper settings here to get the +best server performance. + +Any changes made to this attribute will be written to the {{EX:DB_CONFIG}} +file and will cause the database environment to be reset so the changes +can take immediate effect. If the environment cache is large and has not +been recently checkpointed, this reset operation may take a long time. It +may be advisable to manually perform a single checkpoint using the Berkeley DB +{{db_checkpoint}} utility before using LDAP Modify to change this +attribute. + +\Example: + +> olcDbConfig: set_cachesize 0 10485760 0 +> olcDbConfig: set_lg_bsize 2097512 +> olcDbConfig: set_lg_dir /var/tmp/bdb-log +> olcDbConfig: set_flags DB_LOG_AUTOREMOVE + +In this example, the BDB cache is set to 10MB, the BDB transaction log +buffer size is set to 2MB, and the transaction log files are to be stored +in the /var/tmp/bdb-log directory. Also a flag is set to tell BDB to +delete transaction log files as soon as their contents have been +checkpointed and they are no longer needed. Without this setting the +transaction log files will continue to accumulate until some other +cleanup procedure removes them. See the Berkeley DB documentation for the +{{EX:db_archive}} command for details. For a complete list of Berkeley DB +flags please see - {{URL:http://www.oracle.com/technology/documentation/berkeley-db/db/api_c/env_set_flags.html}} + +Ideally the BDB cache must be +at least as large as the working set of the database, the log buffer size +should be large enough to accommodate most transactions without overflowing, +and the log directory must be on a separate physical disk from the main +database files. And both the database directory and the log directory +should be separate from disks used for regular system activities such as +the root, boot, or swap filesystems. See the FAQ-o-Matic and the Berkeley DB +documentation for more details. + + +H4: olcDbNosync: { TRUE | FALSE } + +This option causes on-disk database contents to not be immediately +synchronized with in memory changes upon change. Setting this option +to {{EX:TRUE}} may improve performance at the expense of data integrity. This +directive has the same effect as using +> olcDbConfig: set_flags DB_TXN_NOSYNC + + +H4: olcDbIDLcacheSize: <integer> + +Specify the size of the in-memory index cache, in index slots. The +default is zero. A larger value will speed up frequent searches of +indexed entries. The optimal size will depend on the data and search +characteristics of the database, but using a number three times +the entry cache size is a good starting point. + +\Example: + +> olcDbIDLcacheSize: 3000 + + +H4: olcDbIndex: {<attrlist> | default} [pres,eq,approx,sub,none] + +This directive specifies the indices to maintain for the given +attribute. If only an {{EX:<attrlist>}} is given, the default +indices are maintained. The index keywords correspond to the +common types of matches that may be used in an LDAP search filter. + +\Example: + +> olcDbIndex: default pres,eq +> olcDbIndex: uid +> olcDbIndex: cn,sn pres,eq,sub +> olcDbIndex: objectClass eq + +The first line sets the default set of indices to maintain to +present and equality. The second line causes the default (pres,eq) +set of indices to be maintained for the {{EX:uid}} attribute type. +The third line causes present, equality, and substring indices to +be maintained for {{EX:cn}} and {{EX:sn}} attribute types. The +fourth line causes an equality index for the {{EX:objectClass}} +attribute type. + +There is no index keyword for inequality matches. Generally these +matches do not use an index. However, some attributes do support +indexing for inequality matches, based on the equality index. + +A substring index can be more explicitly specified as {{EX:subinitial}}, +{{EX:subany}}, or {{EX:subfinal}}, corresponding to the three +possible components +of a substring match filter. A subinitial index only indexes +substrings that appear at the beginning of an attribute value. +A subfinal index only indexes substrings that appear at the end +of an attribute value, while subany indexes substrings that occur +anywhere in a value. + +Note that by default, setting an index for an attribute also +affects every subtype of that attribute. E.g., setting an equality +index on the {{EX:name}} attribute causes {{EX:cn}}, {{EX:sn}}, and every other +attribute that inherits from {{EX:name}} to be indexed. + +By default, no indices are maintained. It is generally advised +that minimally an equality index upon objectClass be maintained. + +> olcDbindex: objectClass eq + +Additional indices should be configured corresponding to the +most common searches that are used on the database. +Presence indexing should not be configured for an attribute +unless the attribute occurs very rarely in the database, and +presence searches on the attribute occur very frequently during +normal use of the directory. Most applications don't use presence +searches, so usually presence indexing is not very useful. + +If this setting is changed while slapd is running, an internal task +will be run to generate the changed index data. All server operations +can continue as normal while the indexer does its work. If slapd is +stopped before the index task completes, indexing will have to be +manually completed using the slapindex tool. + + +H4: olcDbLinearIndex: { TRUE | FALSE } + +If this setting is {{EX:TRUE}} slapindex will index one attribute +at a time. The default settings is {{EX:FALSE}} in which case all +indexed attributes of an entry are processed at the same time. When +enabled, each indexed attribute is processed individually, using +multiple passes through the entire database. This option improves +slapindex performance when the database size exceeds the BDB cache +size. When the BDB cache is large enough, this option is not needed +and will decrease performance. Also by default, slapadd performs +full indexing and so a separate slapindex run is not needed. With +this option, slapadd does no indexing and slapindex must be used. + + +H4: olcDbMode: { <octal> | <symbolic> } + +This directive specifies the file protection mode that newly +created database index files should have. This can be in the form +{{EX:0600}} or {{EX:-rw-------}} + +\Default: + +> olcDbMode: 0600 + + +H4: olcDbSearchStack: <integer> + +Specify the depth of the stack used for search filter evaluation. +Search filters are evaluated on a stack to accommodate nested {{EX:AND}} / +{{EX:OR}} clauses. An individual stack is allocated for each server thread. +The depth of the stack determines how complex a filter can be evaluated +without requiring any additional memory allocation. Filters that are +nested deeper than the search stack depth will cause a separate stack to +be allocated for that particular search operation. These separate allocations +can have a major negative impact on server performance, but specifying +too much stack will also consume a great deal of memory. Each search +uses 512K bytes per level on a 32-bit machine, or 1024K bytes per level +on a 64-bit machine. The default stack depth is 16, thus 8MB or 16MB +per thread is used on 32 and 64 bit machines, respectively. Also the +512KB size of a single stack slot is set by a compile-time constant which +may be changed if needed; the code must be recompiled for the change +to take effect. + +\Default: + +> olcDbSearchStack: 16 + + +H4: olcDbShmKey: <integer> + +Specify a key for a shared memory BDB environment. By default the BDB +environment uses memory mapped files. If a non-zero value is specified, +it will be used as the key to identify a shared memory region that will +house the environment. + +\Example: + +> olcDbShmKey: 42 + + +H4: Sample Entry + +>dn: olcDatabase=hdb,cn=config +>objectClass: olcDatabaseConfig +>objectClass: olcHdbConfig +>olcDatabase: hdb +>olcSuffix: "dc=example,dc=com" +>olcDbDirectory: /usr/local/var/openldap-data +>olcDbCacheSize: 1000 +>olcDbCheckpoint: 1024 10 +>olcDbConfig: set_cachesize 0 10485760 0 +>olcDbConfig: set_lg_bsize 2097152 +>olcDbConfig: set_lg_dir /var/tmp/bdb-log +>olcDbConfig: set_flags DB_LOG_AUTOREMOVE +>olcDbIDLcacheSize: 3000 +>olcDbIndex: objectClass eq + + +H2: Configuration Example + +The following is an example configuration, interspersed +with explanatory text. It defines two databases to handle +different parts of the {{TERM:X.500}} tree; both are {{TERM:BDB}} +database instances. The line numbers shown are provided for +reference only and are not included in the actual file. First, the +global configuration section: + +E: 1. # example config file - global configuration entry +E: 2. dn: cn=config +E: 3. objectClass: olcGlobal +E: 4. cn: config +E: 5. olcReferral: ldap://root.openldap.org +E: 6. + +Line 1 is a comment. Lines 2-4 identify this as the global +configuration entry. +The {{EX:olcReferral:}} directive on line 5 +means that queries not local to one of the databases defined +below will be referred to the LDAP server running on the +standard port (389) at the host {{EX:root.openldap.org}}. +Line 6 is a blank line, indicating the end of this entry. + +E: 7. # internal schema +E: 8. dn: cn=schema,cn=config +E: 9. objectClass: olcSchemaConfig +E: 10. cn: schema +E: 11. + +Line 7 is a comment. Lines 8-10 identify this as the root of +the schema subtree. The actual schema definitions in this entry +are hardcoded into slapd so no additional attributes are specified here. +Line 11 is a blank line, indicating the end of this entry. + +E: 12. # include the core schema +E: 13. include: file:///usr/local/etc/openldap/schema/core.ldif +E: 14. + +Line 12 is a comment. Line 13 is an LDIF include directive which +accesses the {{core}} schema definitions in LDIF format. Line 14 +is a blank line. + +Next comes the database definitions. The first database is the +special {{EX:frontend}} database whose settings are applied globally +to all the other databases. + +E: 15. # global database parameters +E: 16. dn: olcDatabase=frontend,cn=config +E: 17. objectClass: olcDatabaseConfig +E: 18. olcDatabase: frontend +E: 19. olcAccess: to * by * read +E: 20. + +Line 15 is a comment. Lines 16-18 identify this entry as the global +database entry. Line 19 is a global access control. It applies to all +entries (after any applicable database-specific access controls). +Line 20 is a blank line. + +The next entry defines the config backend. + +E: 21. # set a rootpw for the config database so we can bind. +E: 22. # deny access to everyone else. +E: 23. dn: olcDatabase=config,cn=config +E: 24. objectClass: olcDatabaseConfig +E: 25. olcDatabase: config +E: 26. olcRootPW: {SSHA}XKYnrjvGT3wZFQrDD5040US592LxsdLy +E: 27. olcAccess: to * by * none +E: 28. + +Lines 21-22 are comments. Lines 23-25 identify this entry as the config +database entry. Line 26 defines the {{super-user}} password for this +database. (The DN defaults to {{"cn=config"}}.) Line 27 denies all access +to this database, so only the super-user will be able to access it. (This +is already the default access on the config database. It is just listed +here for illustration, and to reiterate that unless a means to authenticate +as the super-user is explicitly configured, the config database will be +inaccessible.) + +Line 28 is a blank line. + +The next entry defines a BDB backend that will handle queries for things +in the "dc=example,dc=com" portion of the tree. Indices are to be maintained +for several attributes, and the {{EX:userPassword}} attribute is to be +protected from unauthorized access. + +E: 29. # BDB definition for example.com +E: 30. dn: olcDatabase=bdb,cn=config +E: 31. objectClass: olcDatabaseConfig +E: 32. objectClass: olcBdbConfig +E: 33. olcDatabase: bdb +E: 34. olcSuffix: dc=example,dc=com +E: 35. olcDbDirectory: /usr/local/var/openldap-data +E: 36. olcRootDN: cn=Manager,dc=example,dc=com +E: 37. olcRootPW: secret +E: 38. olcDbIndex: uid pres,eq +E: 39. olcDbIndex: cn,sn pres,eq,approx,sub +E: 40. olcDbIndex: objectClass eq +E: 41. olcAccess: to attrs=userPassword +E: 42. by self write +E: 43. by anonymous auth +E: 44. by dn.base="cn=Admin,dc=example,dc=com" write +E: 45. by * none +E: 46. olcAccess: to * +E: 47. by self write +E: 48. by dn.base="cn=Admin,dc=example,dc=com" write +E: 49. by * read +E: 50. + +Line 29 is a comment. Lines 30-33 identify this entry as a BDB database +configuration entry. Line 34 specifies the DN suffix +for queries to pass to this database. Line 35 specifies the directory +in which the database files will live. + +Lines 36 and 37 identify the database {{super-user}} entry and associated +password. This entry is not subject to access control or size or +time limit restrictions. + +Lines 38 through 40 indicate the indices to maintain for various +attributes. + +Lines 41 through 49 specify access control for entries in this +database. For all applicable entries, the {{EX:userPassword}} attribute is writable +by the entry itself and by the "admin" entry. It may be used for +authentication/authorization purposes, but is otherwise not readable. +All other attributes are writable by the entry and the "admin" +entry, but may be read by all users (authenticated or not). + +Line 50 is a blank line, indicating the end of this entry. + +The next entry defines another +BDB database. This one handles queries involving the +{{EX:dc=example,dc=net}} subtree but is managed by the same entity +as the first database. Note that without line 60, the read access +would be allowed due to the global access rule at line 19. + +E: 51. # BDB definition for example.net +E: 52. dn: olcDatabase=bdb,cn=config +E: 53. objectClass: olcDatabaseConfig +E: 54. objectClass: olcBdbConfig +E: 55. olcDatabase: bdb +E: 56. olcSuffix: "dc=example,dc=net" +E: 57. olcDbDirectory: /usr/local/var/openldap-data-net +E: 58. olcRootDN: "cn=Manager,dc=example,dc=com" +E: 59. olcDbIndex: objectClass eq +E: 60. olcAccess: to * by users read + + +H2: Converting old style {{slapd.conf}}(5) file to {{cn=config}} format + +Before converting to the {{cn=config}} format you should make sure that the +config backend is properly configured in your existing config file. While +the config backend is always present inside slapd, by default it is only +accessible by its rootDN, and there are no default credentials assigned +so unless you explicitly configure a means to authenticate to it, it will be +unusable. + +If you do not already have a {{EX:database config}} section, add something +like this to the end of {{EX:slapd.conf}} + +> database config +> rootpw VerySecret + +Note: Since the config backend can be used to load arbitrary code into the +slapd process, it is extremely important to carefully guard whatever +credentials are used to access it. Since simple passwords are vulnerable to +password guessing attacks, it is usually better to omit the rootpw and only +use SASL authentication for the config rootDN. + +An existing {{slapd.conf}}(5) file can be converted to the new format using +{{slaptest}}(8) or any of the slap tools: + +> slaptest -f /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d + +Test that you can access entries under {{EX:cn=config}} using the +default {{rootdn}} and the {{rootpw}} configured above: + +> ldapsearch -x -D cn=config -w VerySecret -b cn=config + +You can then discard the old {{slapd.conf}}(5) file. Make sure to launch +{{slapd}}(8) with the {{-F}} option to specify the configuration directory +if you are not using the default directory path. + +Note: When converting from the slapd.conf format to slapd.d format, any +included files will also be integrated into the resulting configuration +database. diff --git a/doc/guide/admin/slapdconfig.sdf b/doc/guide/admin/slapdconfig.sdf new file mode 100644 index 0000000..f0c0330 --- /dev/null +++ b/doc/guide/admin/slapdconfig.sdf @@ -0,0 +1,692 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: The slapd Configuration File + +This chapter describes configuring {{slapd}}(8) via the {{slapd.conf}}(5) +configuration file. {{slapd.conf}}(5) has been deprecated and should +only be used if your site requires one of the backends that hasn't yet +been updated to work with the newer {{slapd-config}}(5) system. Configuring +{{slapd}}(8) via {{slapd-config}}(5) is described in the previous chapter. + +The {{slapd.conf}}(5) file is normally installed in the +{{EX:/usr/local/etc/openldap}} directory. An alternate configuration +file location can be specified via a command-line option to {{slapd}}(8). + + +H2: Configuration File Format + +The {{slapd.conf}}(5) file consists of three types of configuration +information: global, backend specific, and database specific. Global +information is specified first, followed by information associated +with a particular backend type, which is then followed by information +associated with a particular database instance. Global directives can +be overridden in backend and/or database directives, and backend directives +can be overridden by database directives. + +Blank lines and comment lines beginning with a '{{EX:#}}' character +are ignored. If a line begins with whitespace, it is considered a +continuation of the previous line (even if the previous line is a +comment). + +The general format of slapd.conf is as follows: + +> # global configuration directives +> <global config directives> +> +> # backend definition +> backend <typeA> +> <backend-specific directives> +> +> # first database definition & config directives +> database <typeA> +> <database-specific directives> +> +> # second database definition & config directives +> database <typeB> +> <database-specific directives> +> +> # second database definition & config directives +> database <typeA> +> <database-specific directives> +> +> # subsequent backend & database definitions & config directives +> ... + +A configuration directive may take arguments. If so, they are +separated by whitespace. If an argument contains whitespace, +the argument should be enclosed in double quotes {{EX:"like this"}}. If +an argument contains a double quote or a backslash character `{{EX:\}}', +the character should be preceded by a backslash character `{{EX:\}}'. + +The distribution contains an example configuration file that will +be installed in the {{F: /usr/local/etc/openldap}} directory. +A number of files containing schema definitions (attribute types +and object classes) are also provided in the +{{F: /usr/local/etc/openldap/schema}} directory. + + +H2: Configuration File Directives + +This section details commonly used configuration directives. For +a complete list, see the {{slapd.conf}}(5) manual page. This section +separates the configuration file directives into global, +backend-specific and data-specific categories, describing each +directive and its default value (if any), and giving an example of +its use. + + + +H3: Global Directives + +Directives described in this section apply to all backends +and databases unless specifically overridden in a backend or +database definition. Arguments that should be replaced +by actual text are shown in brackets {{EX:<>}}. + + +H4: access to <what> [ by <who> [<accesslevel>] [<control>] ]+ + +This directive grants access (specified by <accesslevel>) to a set +of entries and/or attributes (specified by <what>) by one or more +requestors (specified by <who>). See the {{SECT:Access Control}} section of +this guide for basic usage. + +!if 0 +More details discussion of this directive can be found in the +{{SECT:Advanced Access Control}} chapter. +!endif + +Note: If no {{EX:access}} directives are specified, the default +access control policy, {{EX:access to * by * read}}, allows all +both authenticated and anonymous users read access. + + +H4: attributetype <{{REF:RFC4512}} Attribute Type Description> + +This directive defines an attribute type. +Please see the {{SECT:Schema Specification}} chapter +for information regarding how to use this directive. + +H4: idletimeout <integer> + +Specify the number of seconds to wait before forcibly closing +an idle client connection. An idletimeout of 0, the default, +disables this feature. + + +H4: include <filename> + +This directive specifies that slapd should read additional +configuration information from the given file before continuing +with the next line of the current file. The included file should +follow the normal slapd config file format. The file is commonly +used to include files containing schema specifications. + +Note: You should be careful when using this directive - there is +no small limit on the number of nested include directives, and no +loop detection is done. + +H4: loglevel <level> + +This directive specifies the level at which debugging statements +and operation statistics should be syslogged (currently logged to +the {{syslogd}}(8) {{EX:LOG_LOCAL4}} facility). You must have +configured OpenLDAP {{EX:--enable-debug}} (the default) for this +to work (except for the two statistics levels, which are always +enabled). Log levels may be specified as integers or by keyword. +Multiple log levels may be used and the levels are additive. To display what +numbers correspond to what kind of debugging, invoke slapd with {{EX:-d?}} +or consult the table below. The possible values for <integer> are: + +!block table; colaligns="RL"; align=Center; \ + title="Table 6.1: Debugging Levels" +Level Keyword Description +-1 any enable all debugging +0 no debugging +1 (0x1 trace) trace function calls +2 (0x2 packets) debug packet handling +4 (0x4 args) heavy trace debugging +8 (0x8 conns) connection management +16 (0x10 BER) print out packets sent and received +32 (0x20 filter) search filter processing +64 (0x40 config) configuration processing +128 (0x80 ACL) access control list processing +256 (0x100 stats) stats log connections/operations/results +512 (0x200 stats2) stats log entries sent +1024 (0x400 shell) print communication with shell backends +2048 (0x800 parse) print entry parsing debugging +16384 (0x4000 sync) syncrepl consumer processing +32768 (0x8000 none) only messages that get logged whatever log level is set +!endblock + +The desired log level can be input as a single integer that +combines the (ORed) desired levels, both in decimal or in hexadecimal +notation, as a list of integers (that are ORed internally), or as a list of the names that are shown between brackets, such that + +> loglevel 129 +> loglevel 0x81 +> loglevel 128 1 +> loglevel 0x80 0x1 +> loglevel acl trace + +are equivalent. + +\Examples: + +E: loglevel -1 + +This will cause lots and lots of debugging information to be +logged. + +E: loglevel conns filter + +Just log the connection and search filter processing. + +E: loglevel none + +Log those messages that are logged regardless of the configured loglevel. This +differs from setting the log level to 0, when no logging occurs. At least the +{{EX:None}} level is required to have high priority messages logged. + +\Default: + +E: loglevel stats + +Basic stats logging is configured by default. However, if no loglevel is +defined, no logging occurs (equivalent to a 0 level). + +H4: objectclass <{{REF:RFC4512}} Object Class Description> + +This directive defines an object class. +Please see the {{SECT:Schema Specification}} chapter for +information regarding how to use this directive. + + +H4: referral <URI> + +This directive specifies the referral to pass back when slapd +cannot find a local database to handle a request. + +\Example: + +> referral ldap://root.openldap.org + +This will refer non-local queries to the global root LDAP server +at the OpenLDAP Project. Smart LDAP clients can re-ask their +query at that server, but note that most of these clients are +only going to know how to handle simple LDAP URLs that +contain a host part and optionally a distinguished name part. + + +H4: sizelimit <integer> + +This directive specifies the maximum number of entries to return +from a search operation. + +\Default: + +> sizelimit 500 + +See the {{SECT:Limits}} section of this guide and {{slapd.conf}}(5) +for more details. + +H4: timelimit <integer> + +This directive specifies the maximum number of seconds (in real +time) slapd will spend answering a search request. If a +request is not finished in this time, a result indicating an +exceeded timelimit will be returned. + +\Default: + +> timelimit 3600 + +See the {{SECT:Limits}} section of this guide and {{slapd.conf}}(5) +for more details. + + +H3: General Backend Directives + +Directives in this section apply only to the backend in which +they are defined. They are supported by every type of backend. +Backend directives apply to all databases instances of the +same type and, depending on the directive, may be overridden +by database directives. + +H4: backend <type> + +This directive marks the beginning of a backend declaration. +{{EX:<type>}} should be one of the +supported backend types listed in Table 6.2. + +!block table; align=Center; coltags="EX,N"; \ + title="Table 6.2: Database Backends" +Types Description +bdb Berkeley DB transactional backend (deprecated) +dnssrv DNS SRV backend +hdb Hierarchical variant of bdb backend (deprecated) +ldap Lightweight Directory Access Protocol (Proxy) backend +mdb Memory-Mapped DB backend +meta Meta Directory backend +monitor Monitor backend +passwd Provides read-only access to {{passwd}}(5) +perl Perl Programmable backend +shell Shell (extern program) backend +sql SQL Programmable backend +!endblock + +\Example: + +> backend bdb + +This marks the beginning of a new {{TERM:BDB}} backend +definition. + + +H3: General Database Directives + +Directives in this section apply only to the database in which +they are defined. They are supported by every type of database. + +H4: database <type> + +This directive marks the beginning of a database instance +declaration. +{{EX:<type>}} should be one of the +supported backend types listed in Table 6.2. + +\Example: + +> database bdb + +This marks the beginning of a new {{TERM:BDB}} database instance +declaration. + + +H4: limits <selector> <limit> [<limit> [...]] + +Specify time and size limits based on the operation's initiator or base +DN. + +See the {{SECT:Limits}} section of this guide and {{slapd.conf}}(5) +for more details. + + +H4: readonly { on | off } + +This directive puts the database into "read-only" mode. Any +attempts to modify the database will return an "unwilling to +perform" error. If set on a consumer, modifications sent by +syncrepl will still occur. + +\Default: + +> readonly off + + +H4: rootdn <DN> + +This directive specifies the DN that is not subject to +access control or administrative limit restrictions for +operations on this database. The DN need not refer to +an entry in this database or even in the directory. The +DN may refer to a SASL identity. + +Entry-based Example: + +> rootdn "cn=Manager,dc=example,dc=com" + +SASL-based Example: + +> rootdn "uid=root,cn=example.com,cn=digest-md5,cn=auth" + +See the {{SECT:SASL Authentication}} section for information on +SASL authentication identities. + + +H4: rootpw <password> + +This directive can be used to specifies a password for the DN for +the rootdn (when the rootdn is set to a DN within the database). + +\Example: + +> rootpw secret + +It is also permissible to provide hash of the password in {{REF:RFC2307}} +form. {{slappasswd}}(8) may be used to generate the password hash. + +\Example: + +> rootpw {SSHA}ZKKuqbEKJfKSXhUbHG3fG8MDn9j1v4QN + +The hash was generated using the command {{EX:slappasswd -s secret}}. + + +H4: suffix <dn suffix> + +This directive specifies the DN suffix of queries that will be +passed to this backend database. Multiple suffix lines can be +given, and at least one is required for each database +definition. + +\Example: + +> suffix "dc=example,dc=com" + +Queries with a DN ending in "dc=example,dc=com" +will be passed to this backend. + +Note: When the backend to pass a query to is selected, slapd +looks at the suffix line(s) in each database definition in the +order they appear in the file. Thus, if one database suffix is a +prefix of another, it must appear after it in the config file. + + +H4: syncrepl + +> syncrepl rid=<replica ID> +> provider=ldap[s]://<hostname>[:port] +> searchbase=<base DN> +> [type=refreshOnly|refreshAndPersist] +> [interval=dd:hh:mm:ss] +> [retry=[<retry interval> <# of retries>]+] +> [filter=<filter str>] +> [scope=sub|one|base] +> [attrs=<attr list>] +> [exattrs=<attr list>] +> [attrsonly] +> [sizelimit=<limit>] +> [timelimit=<limit>] +> [schemachecking=on|off] +> [network-timeout=<seconds>] +> [timeout=<seconds>] +> [bindmethod=simple|sasl] +> [binddn=<DN>] +> [saslmech=<mech>] +> [authcid=<identity>] +> [authzid=<identity>] +> [credentials=<passwd>] +> [realm=<realm>] +> [secprops=<properties>] +> [keepalive=<idle>:<probes>:<interval>] +> [starttls=yes|critical] +> [tls_cert=<file>] +> [tls_key=<file>] +> [tls_cacert=<file>] +> [tls_cacertdir=<path>] +> [tls_reqcert=never|allow|try|demand] +> [tls_cipher_suite=<ciphers>] +> [tls_crlcheck=none|peer|all] +> [tls_protocol_min=<major>[.<minor>]] +> [suffixmassage=<real DN>] +> [logbase=<base DN>] +> [logfilter=<filter str>] +> [syncdata=default|accesslog|changelog] + + +This directive specifies the current database as a replica of the +master content by establishing the current {{slapd}}(8) as a +replication consumer site running a syncrepl replication engine. +The master database is located at the replication provider site +specified by the {{EX:provider}} parameter. The replica database is +kept up-to-date with the master content using the LDAP Content +Synchronization protocol. See {{REF:RFC4533}} +for more information on the protocol. + +The {{EX:rid}} parameter is used for identification of the current +{{EX:syncrepl}} directive within the replication consumer server, +where {{EX:<replica ID>}} uniquely identifies the syncrepl specification +described by the current {{EX:syncrepl}} directive. {{EX:<replica ID>}} +is non-negative and is no more than three decimal digits in length. + +The {{EX:provider}} parameter specifies the replication provider site +containing the master content as an LDAP URI. The {{EX:provider}} +parameter specifies a scheme, a host and optionally a port where the +provider slapd instance can be found. Either a domain name or IP +address may be used for <hostname>. Examples are +{{EX:ldap://provider.example.com:389}} or {{EX:ldaps://192.168.1.1:636}}. +If <port> is not given, the standard LDAP port number (389 or 636) is used. +Note that the syncrepl uses a consumer-initiated protocol, and hence its +specification is located at the consumer site, whereas the {{EX:replica}} +specification is located at the provider site. {{EX:syncrepl}} and +{{EX:replica}} directives define two independent replication +mechanisms. They do not represent the replication peers of each other. + +The content of the syncrepl replica is defined using a search +specification as its result set. The consumer slapd will +send search requests to the provider slapd according to the search +specification. The search specification includes {{EX:searchbase}}, +{{EX:scope}}, {{EX:filter}}, {{EX:attrs}}, {{EX:exattrs}}, {{EX:attrsonly}}, +{{EX:sizelimit}}, and {{EX:timelimit}} parameters as in the normal +search specification. The {{EX:searchbase}} parameter has no +default value and must always be specified. The {{EX:scope}} defaults +to {{EX:sub}}, the {{EX:filter}} defaults to {{EX:(objectclass=*)}}, +{{EX:attrs}} defaults to {{EX:"*,+"}} to replicate all user and operational +attributes, and {{EX:attrsonly}} is unset by default. Both {{EX:sizelimit}} +and {{EX:timelimit}} default to "unlimited", and only positive integers +or "unlimited" may be specified. The {{EX:exattrs}} option may also be used +to specify attributes that should be omitted from incoming entries. + +The {{TERM[expand]LDAP Sync}} protocol has two operation +types: {{EX:refreshOnly}} and {{EX:refreshAndPersist}}. +The operation type is specified by the {{EX:type}} parameter. +In the {{EX:refreshOnly}} operation, the next synchronization search operation +is periodically rescheduled at an interval time after each +synchronization operation finishes. The interval is specified +by the {{EX:interval}} parameter. It is set to one day by default. +In the {{EX:refreshAndPersist}} operation, a synchronization search +remains persistent in the provider {{slapd}} instance. Further updates to the +master replica will generate {{EX:searchResultEntry}} to the consumer slapd +as the search responses to the persistent synchronization search. + +If an error occurs during replication, the consumer will attempt to reconnect +according to the retry parameter which is a list of the <retry interval> +and <# of retries> pairs. For example, retry="60 10 300 3" lets the consumer +retry every 60 seconds for the first 10 times and then retry every 300 seconds +for the next three times before stop retrying. + in <# of retries> means +indefinite number of retries until success. + +The schema checking can be enforced at the LDAP Sync consumer site +by turning on the {{EX:schemachecking}} parameter. +If it is turned on, every replicated entry will be checked for its +schema as the entry is stored into the replica content. +Every entry in the replica should contain those attributes +required by the schema definition. +If it is turned off, entries will be stored without checking +schema conformance. The default is off. + +The {{EX:network-timeout}} parameter sets how long the consumer will +wait to establish a network connection to the provider. Once a +connection is established, the {{EX:timeout}} parameter determines how +long the consumer will wait for the initial Bind request to complete. The +defaults for these parameters come from {{ldap.conf}}(5). + +The {{EX:binddn}} parameter gives the DN to bind as for the +syncrepl searches to the provider slapd. It should be a DN +which has read access to the replication content in the +master database. + +The {{EX:bindmethod}} is {{EX:simple}} or {{EX:sasl}}, +depending on whether simple password-based authentication or +{{TERM:SASL}} authentication is to be used when connecting +to the provider {{slapd}} instance. + +Simple authentication should not be used unless adequate data +integrity and confidentiality protections are in place (e.g. TLS +or IPsec). Simple authentication requires specification of {{EX:binddn}} +and {{EX:credentials}} parameters. + +SASL authentication is generally recommended. SASL authentication +requires specification of a mechanism using the {{EX:saslmech}} parameter. +Depending on the mechanism, an authentication identity and/or +credentials can be specified using {{EX:authcid}} and {{EX:credentials}}, +respectively. The {{EX:authzid}} parameter may be used to specify +an authorization identity. + +The {{EX:realm}} parameter specifies a realm which a certain +mechanisms authenticate the identity within. The {{EX:secprops}} +parameter specifies Cyrus SASL security properties. + +The {{EX:keepalive}} parameter sets the values of idle, probes, and interval +used to check whether a socket is alive; idle is the number of seconds a +connection needs to remain idle before TCP starts sending keepalive probes; +probes is the maximum number of keepalive probes TCP should send before +dropping the connection; interval is interval in seconds between individual +keepalive probes. Only some systems support the customization of these +values; the keepalive parameter is ignored otherwise, and system-wide +settings are used. For example, keepalive="240:10:30" will send a keepalive +probe 10 times, every 30 seconds, after 240 seconds of idle activity. If +no response to the probes is received, the connection will be dropped. + +The {{EX:starttls}} parameter specifies use of the StartTLS extended +operation to establish a TLS session before authenticating to the provider. +If the {{EX:critical}} argument is supplied, the session will be aborted +if the StartTLS request fails. Otherwise the syncrepl session continues +without TLS. The tls_reqcert setting defaults to {{EX:"demand"}} and the +other TLS settings default to the same as the main slapd TLS settings. + +The {{EX:suffixmassage}} parameter allows the consumer to pull entries +from a remote directory whose DN suffix differs from the local directory. +The portion of the remote entries' DNs that matches the searchbase will +be replaced with the suffixmassage DN. + +Rather than replicating whole entries, the consumer can query logs +of data modifications. This mode of operation is referred to as +{{delta syncrepl}}. In addition to the above parameters, the +{{EX:logbase}} and {{EX:logfilter}} parameters must be set appropriately +for the log that will be used. The {{EX:syncdata}} parameter must +be set to either {{EX:"accesslog"}} if the log conforms to the +{{slapo-accesslog}}(5) log format, or {{EX:"changelog"}} if the log +conforms to the obsolete {{changelog}} format. If the {{EX:syncdata}} +parameter is omitted or set to {{EX:"default"}} then the log +parameters are ignored. + +The {{syncrepl}} replication mechanism is supported by the {{bdb}}, +{{hdb}}, and {{mdb}} backends. + +See the {{SECT:LDAP Sync Replication}} chapter of this guide for +more information on how to use this directive. + + +H4: updateref <URL> + +This directive is only applicable in a {{slave}} (or {{shadow}}) +{{slapd}}(8) instance. It +specifies the URL to return to clients which submit update +requests upon the replica. +If specified multiple times, each {{TERM:URL}} is provided. + +\Example: + +> updateref ldap://master.example.net + + +H3: BDB and HDB Database Directives + +Directives in this category only apply to both the {{TERM:BDB}} +and the {{TERM:HDB}} database. +That is, they must follow a "database bdb" or "database hdb" line +and come before any +subsequent "backend" or "database" line. For a complete reference +of BDB/HDB configuration directives, see {{slapd-bdb}}(5). + + +H4: directory <directory> + +This directive specifies the directory where the BDB files +containing the database and associated indices live. + +\Default: + +> directory /usr/local/var/openldap-data + + +H2: Configuration File Example + +The following is an example configuration file, interspersed +with explanatory text. It defines two databases to handle +different parts of the {{TERM:X.500}} tree; both are {{TERM:BDB}} +database instances. The line numbers shown are provided for +reference only and are not included in the actual file. First, the +global configuration section: + +E: 1. # example config file - global configuration section +E: 2. include /usr/local/etc/schema/core.schema +E: 3. referral ldap://root.openldap.org +E: 4. access to * by * read + +Line 1 is a comment. Line 2 includes another config file +which contains {{core}} schema definitions. +The {{EX:referral}} directive on line 3 +means that queries not local to one of the databases defined +below will be referred to the LDAP server running on the +standard port (389) at the host {{EX:root.openldap.org}}. + +Line 4 is a global access control. It applies to all +entries (after any applicable database-specific access +controls). + +The next section of the configuration file defines a BDB +backend that will handle queries for things in the +"dc=example,dc=com" portion of the tree. The +database is to be replicated to two slave slapds, one on +truelies, the other on judgmentday. Indices are to be +maintained for several attributes, and the {{EX:userPassword}} +attribute is to be protected from unauthorized access. + +E: 5. # BDB definition for the example.com +E: 6. database bdb +E: 7. suffix "dc=example,dc=com" +E: 8. directory /usr/local/var/openldap-data +E: 9. rootdn "cn=Manager,dc=example,dc=com" +E: 10. rootpw secret +E: 11. # indexed attribute definitions +E: 12. index uid pres,eq +E: 13. index cn,sn pres,eq,approx,sub +E: 14. index objectClass eq +E: 15. # database access control definitions +E: 16. access to attrs=userPassword +E: 17. by self write +E: 18. by anonymous auth +E: 19. by dn.base="cn=Admin,dc=example,dc=com" write +E: 20. by * none +E: 21. access to * +E: 22. by self write +E: 23. by dn.base="cn=Admin,dc=example,dc=com" write +E: 24. by * read + +Line 5 is a comment. The start of the database definition is marked +by the database keyword on line 6. Line 7 specifies the DN suffix +for queries to pass to this database. Line 8 specifies the directory +in which the database files will live. + +Lines 9 and 10 identify the database {{super-user}} entry and associated +password. This entry is not subject to access control or size or +time limit restrictions. + +Lines 12 through 14 indicate the indices to maintain for various +attributes. + +Lines 16 through 24 specify access control for entries in this +database. For all applicable entries, the {{EX:userPassword}} attribute is writable +by the entry itself and by the "admin" entry. It may be used for +authentication/authorization purposes, but is otherwise not readable. +All other attributes are writable by the entry and the "admin" +entry, but may be read by all users (authenticated or not). + +The next section of the example configuration file defines another +BDB database. This one handles queries involving the +{{EX:dc=example,dc=net}} subtree but is managed by the same entity +as the first database. Note that without line 39, the read access +would be allowed due to the global access rule at line 4. + +E: 33. # BDB definition for example.net +E: 34. database bdb +E: 35. suffix "dc=example,dc=net" +E: 36. directory /usr/local/var/openldap-data-net +E: 37. rootdn "cn=Manager,dc=example,dc=com" +E: 38. index objectClass eq +E: 39. access to * by users read diff --git a/doc/guide/admin/title.sdf b/doc/guide/admin/title.sdf new file mode 100644 index 0000000..cb7d0d2 --- /dev/null +++ b/doc/guide/admin/title.sdf @@ -0,0 +1,13 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +# +# Document: OpenLDAP Administrator's Guide +# Master: master.sdf +# + +!define DOC_TOC 3 +!define DOC_TYPE "Administrator's Guide" + +!build_title + diff --git a/doc/guide/admin/tls.sdf b/doc/guide/admin/tls.sdf new file mode 100644 index 0000000..47dc9dc --- /dev/null +++ b/doc/guide/admin/tls.sdf @@ -0,0 +1,305 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Using TLS + +OpenLDAP clients and servers are capable of using the +{{TERM[expand]TLS}} ({{TERM:TLS}}) framework to provide +integrity and confidentiality protections and to support +LDAP authentication using the {{TERM:SASL}} {{TERM:EXTERNAL}} mechanism. +TLS is defined in {{REF:RFC4346}}. + +Note: For generating certifcates, please reference {{URL:http://www.openldap.org/faq/data/cache/185.html}} + +H2: TLS Certificates + +TLS uses {{TERM:X.509}} certificates to carry client and server +identities. All servers are required to have valid certificates, +whereas client certificates are optional. Clients must have a +valid certificate in order to authenticate via SASL EXTERNAL. +For more information on creating and managing certificates, +see the {{PRD:OpenSSL}}, {{PRD:GnuTLS}}, or {{PRD:MozNSS}} documentation, +depending on which TLS implementation libraries you are using. + +H3: Server Certificates + +The {{TERM:DN}} of a server certificate must use the {{EX:CN}} +attribute to name the server, and the {{EX:CN}} must carry the +server's fully qualified domain name. Additional alias names and +wildcards may be present in the {{EX:subjectAltName}} certificate +extension. More details on server certificate names are in +{{REF:RFC4513}}. + +H3: Client Certificates + +The DN of a client certificate can be used directly as an +authentication DN. +Since X.509 is a part of the {{TERM:X.500}} standard and LDAP +is also based on X.500, both use the same DN formats and +generally the DN in a user's X.509 certificate should be +identical to the DN of their LDAP entry. However, sometimes +the DNs may not be exactly the same, and so the mapping +facility described in +{{SECT:Mapping Authentication Identities}} +can be applied to these DNs as well. + +H2: TLS Configuration + +After obtaining the required certificates, a number of options must +be configured on both the client and the server to enable TLS and +make use of the certificates. At a minimum, the clients must be +configured with the name of the file containing all of the +{{TERM[expand]CA}} (CA) certificates it will trust. The server must +be configured with the {{TERM:CA}} certificates and also its own +server certificate and private key. + +Typically a single CA will have issued the server certificate +and all of the trusted client certificates, so the server only +needs to trust that one signing CA. However, a client may wish +to connect to a variety of secure servers managed by different +organizations, with server certificates generated by many +different CAs. As such, a client is likely to need a list of +many different trusted CAs in its configuration. + +H3: Server Configuration + +The configuration directives for slapd belong in the global directives +section of {{slapd.conf}}(5). + +H4: TLSCACertificateFile <filename> + +This directive specifies the {{TERM:PEM}}-format file containing +certificates for the CA's that slapd will trust. The certificate for +the CA that signed the server certificate must be included among +these certificates. If the signing CA was not a top-level (root) CA, +certificates for the entire sequence of CA's from the signing CA to +the top-level CA should be present. Multiple certificates are simply +appended to the file; the order is not significant. + +H4: TLSCACertificatePath <path> + +This directive specifies the path of a directory that contains +individual {{TERM:CA}} certificates in separate files. In addition, +this directory must be specially managed using the OpenSSL {{c_rehash}} +utility. When using this feature, the OpenSSL library will attempt to +locate certificate files based on a hash of their name and serial number. +The {{c_rehash}} utility is used to generate symbolic links with the +hashed names that point to the actual certificate files. As such, +this option can only be used with a filesystem that actually supports +symbolic links. In general, it is simpler to use the +{{EX:TLSCACertificateFile}} directive instead. + +When using Mozilla NSS, this directive can be used to specify the +path of the directory containing the NSS certificate and key database +files. The {{certutil}} command can be used to add a {{TERM:CA}} certificate: + +> certutil -d <path> -A -n "name of CA cert" -t CT,, -a -i /path/to/cacertfile.pem + +. This command will add a CA certficate stored in the PEM (ASCII) formatted +. file named /path/to/cacertfile.pem. {{EX:-t CT,,}} means that the certificate is +. trusted to be a CA issuing certs for use in TLS clients and servers. + +H4: TLSCertificateFile <filename> + +This directive specifies the file that contains the slapd server +certificate. Certificates are generally public information and +require no special protection. + +When using Mozilla NSS, if using a cert/key database (specified with +{{EX:TLSCACertificatePath}}), this directive specifies +the name of the certificate to use: + +> TLSCertificateFile Server-Cert + +. If using a token other than the internal built in token, specify the +. token name first, followed by a colon: + +> TLSCertificateFile my hardware device:Server-Cert + +. Use {{EX:certutil -L}} to list the certificates by name: + +> certutil -d /path/to/certdbdir -L + +H4: TLSCertificateKeyFile <filename> + +This directive specifies the file that contains the private key +that matches the certificate stored in the {{EX:TLSCertificateFile}} +file. Private keys themselves are sensitive data and are usually +password encrypted for protection. However, the current implementation +doesn't support encrypted keys so the key must not be encrypted +and the file itself must be protected carefully. + +When using Mozilla NSS, this directive specifies the name of +a file that contains the password for the key for the certificate specified with +{{EX:TLSCertificateFile}}. The modutil command can be used to turn off password +protection for the cert/key database. For example, if {{EX:TLSCACertificatePath}} +specifes /etc/openldap/certdb as the location of the cert/key database, use +modutil to change the password to the empty string: + +> modutil -dbdir /etc/openldap/certdb -changepw 'NSS Certificate DB' + +. You must have the old password, if any. Ignore the WARNING about the running +. browser. Press 'Enter' for the new password. + +H4: TLSCipherSuite <cipher-suite-spec> + +This directive configures what ciphers will be accepted and the +preference order. {{EX:<cipher-suite-spec>}} should be a cipher +specification for OpenSSL. You can use the command + +> openssl ciphers -v ALL + +to obtain a verbose list of available cipher specifications. + +Besides the individual cipher names, the specifiers {{EX:HIGH}}, +{{EX:MEDIUM}}, {{EX:LOW}}, {{EX:EXPORT}}, and {{EX:EXPORT40}} +may be helpful, along with {{EX:TLSv1}}, {{EX:SSLv3}}, +and {{EX:SSLv2}}. + +To obtain the list of ciphers in GnuTLS use: + +> gnutls-cli -l + +When using Mozilla NSS, the OpenSSL cipher suite specifications are used and +translated into the format used internally by Mozilla NSS. There isn't an easy +way to list the cipher suites from the command line. The authoritative list +is in the source code for Mozilla NSS in the file sslinfo.c in the structure + +> static const SSLCipherSuiteInfo suiteInfo[] + +H4: TLSRandFile <filename> + +This directive specifies the file to obtain random bits from when +{{FILE:/dev/urandom}} is not available. If the system provides +{{FILE:/dev/urandom}} then this option is not needed, otherwise a +source of random data must be configured. Some systems (e.g. Linux) +provide {{FILE:/dev/urandom}} by default, while others (e.g. Solaris) +require the installation of a patch to provide it, and others may +not support it at all. In the latter case, EGD or PRNGD should be +installed, and this directive should specify the name of the EGD/PRNGD +socket. The environment variable {{EX:RANDFILE}} can also be used +to specify the filename. Also, in the absence of these options, the +{{EX:.rnd}} file in the slapd user's home directory may be used if +it exists. To use the {{EX:.rnd}} file, just create the file and +copy a few hundred bytes of arbitrary data into the file. The file +is only used to provide a seed for the pseudo-random number generator, +and it doesn't need very much data to work. + +This directive is ignored with GnuTLS and Mozilla NSS. + +H4: TLSDHParamFile <filename> + +This directive specifies the file that contains parameters for +Diffie-Hellman ephemeral key exchange. This is required in order +to use DHE-based cipher suites, including all DSA-based suites (i.e. +{{EX:TLSCertificateKeyFile}} points to a DSA key), and RSA when the 'key +encipherment' key usage is not specified in the certificate. Parameters can be +generated using the following command + +> openssl dhparam [-dsaparam] -out <filename> <numbits> +or +> certtool --generate-dh-params --bits <numbits> --outfile <filename> + +This directive is ignored with Mozilla NSS. + +H4: TLSVerifyClient { never | allow | try | demand } + +This directive specifies what checks to perform on client certificates +in an incoming TLS session, if any. This option is set to {{EX:never}} +by default, in which case the server never asks the client for a +certificate. With a setting of {{EX:allow}} the server will ask +for a client certificate; if none is provided the session proceeds +normally. If a certificate is provided but the server is unable to +verify it, the certificate is ignored and the session proceeds +normally, as if no certificate had been provided. With a setting of +{{EX:try}} the certificate is requested, and if none is provided, +the session proceeds normally. If a certificate is provided and it +cannot be verified, the session is immediately terminated. With a +setting of {{EX:demand}} the certificate is requested and a valid +certificate must be provided, otherwise the session is immediately +terminated. + +Note: The server must request a client certificate in order to +use the SASL EXTERNAL authentication mechanism with a TLS session. +As such, a non-default {{EX:TLSVerifyClient}} setting must be configured +before SASL EXTERNAL authentication may be attempted, and the +SASL EXTERNAL mechanism will only be offered to the client if a valid +client certificate was received. + +H3: Client Configuration + +Most of the client configuration directives parallel the server +directives. The names of the directives are different, and they go +into {{ldap.conf}}(5) instead of {{slapd.conf}}(5), but their +functionality is mostly the same. Also, while most of these options may +be configured on a system-wide basis, they may all be overridden by +individual users in their {{.ldaprc}} files. + +The LDAP Start TLS operation is used in LDAP to initiate TLS +negotiation. All OpenLDAP command line tools support a {{EX:-Z}} +and {{EX:-ZZ}} flag to indicate whether a Start TLS operation is to +be issued. The latter flag indicates that the tool is to cease +processing if TLS cannot be started while the former allows the +command to continue. + +In LDAPv2 environments, TLS is normally started using the LDAP +Secure URI scheme ({{EX:ldaps://}}) instead of the normal LDAP URI +scheme ({{EX:ldap://}}). OpenLDAP command line tools allow either +scheme to used with the {{EX:-H}} flag and with the {{EX:URI}} +{{ldap.conf}}(5) option. + + +H4: TLS_CACERT <filename> + +This is equivalent to the server's {{EX:TLSCACertificateFile}} option. As +noted in the {{SECT:TLS Configuration}} section, a client typically +may need to know about more CAs than a server, but otherwise the +same considerations apply. + +H4: TLS_CACERTDIR <path> + +This is equivalent to the server's {{EX:TLSCACertificatePath}} option. The +specified directory must be managed with the OpenSSL {{c_rehash}} +utility as well. If using Mozilla NSS, <path> may contain a cert/key database. + +H4: TLS_CERT <filename> + +This directive specifies the file that contains the client certificate. +This is a user-only directive and can only be specified in a user's +{{.ldaprc}} file. + +When using Mozilla NSS, if using a cert/key database (specified with +{{EX:TLS_CACERTDIR}}), this directive specifies +the name of the certificate to use: + +> TLS_CERT Certificate for Sam Carter + +. If using a token other than the internal built in token, specify the +. token name first, followed by a colon: + +> TLS_CERT my hardware device:Certificate for Sam Carter + +. Use {{EX:certutil -L}} to list the certificates by name: + +> certutil -d /path/to/certdbdir -L + + +H4: TLS_KEY <filename> + +This directive specifies the file that contains the private key +that matches the certificate stored in the {{EX:TLS_CERT}} +file. The same constraints mentioned for {{EX:TLSCertificateKeyFile}} +apply here. This is also a user-only directive. + +H4: TLS_RANDFILE <filename> + +This directive is the same as the server's {{EX:TLSRandFile}} +option. + +H4: TLS_REQCERT { never | allow | try | demand } + +This directive is equivalent to the server's {{EX:TLSVerifyClient}} +option. However, for clients the default value is {{EX:demand}} +and there generally is no good reason to change this setting. + diff --git a/doc/guide/admin/troubleshooting.sdf b/doc/guide/admin/troubleshooting.sdf new file mode 100644 index 0000000..2d6bb37 --- /dev/null +++ b/doc/guide/admin/troubleshooting.sdf @@ -0,0 +1,104 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Troubleshooting + +If you're having trouble using OpenLDAP, get onto the +OpenLDAP-Software mailing list, or: + +* Browse the list archives at {{URL:http://www.openldap.org/lists/#archives}} +* Search the FAQ at {{URL:http://www.openldap.org/faq/}} +* Search the Issue Tracking System at {{URL:http://www.openldap.org/its/}} + +Chances are the problem has been solved and explained in detail many times before. + +H2: User or Software errors? + +More often than not, an error is caused by a configuration problem or a misunderstanding +of what you are trying to implement and/or achieve. + +We will now attempt to discuss common user errors. + +H2: Checklist + +The following checklist can help track down your problem. Please try to use if {{B:before}} +posting to the list, or in the rare circumstances of reporting a bug. + +.{{S: }} +^{{B: Use the {{slaptest}} tool to verify configurations before starting {{slapd}}}} + +.{{S: }} ++{{B: Verify that {{slapd}} is listening to the specified port(s) (389 and 636, generally) before trying the {{ldapsearch}}}} + +.{{S: }} ++{{B: Can you issue an {{ldapsearch}}?}} + +.{{S: }} ++{{B: If not, have you enabled complex ACLs without fully understanding them?}} + +.{{S: }} ++{{B: Do you have a system wide LDAP setting pointing to the wrong LDAP Directory?}} + +.{{S: }} ++{{B: Are you using TLS?}} + +.{{S: }} ++{{B: Have your certificates expired?}} + +H2: OpenLDAP Bugs + +Sometimes you may encounter an actual OpenLDAP bug, in which case please visit +our Issue Tracking system {{URL:http://www.openldap.org/its/}} and report it. +However, make sure it's not already a known bug or a common user problem. + +* bugs in historic versions of OpenLDAP will not be considered; +* bugs in released versions that are no longer present in the Git master branch, +either because they have been fixed or because they no longer apply, +will not be considered as well; +* bugs in distributions of OpenLDAP software that are not related to the +software as provided by OpenLDAP will not be considered; in those cases please +refer to the distributor. + +Note: Our Issue Tracking system is {{B:NOT}} for OpenLDAP {{B:Support}}, please join our +mailing Lists: {{URL:http://www.openldap.org/lists/}} for that. + +The information you should provide in your bug report is discussed in our FAQ-O-MATIC at +{{URL:http://www.openldap.org/faq/data/cache/59.html}} + +H2: 3rd party software error + +The OpenLDAP Project only supports OpenLDAP software. + +You may however seek commercial support ({{URL:http://www.openldap.org/support/}}) or join +the general LDAP forum for non-commercial discussions and information relating to LDAP at: +{{URL:http://www.umich.edu/~dirsvcs/ldap/mailinglist.html}} + + +H2: How to contact the OpenLDAP Project + +* Mailing Lists: {{URL:http://www.openldap.org/lists/}} +* Project: {{URL: http://www.openldap.org/project/}} +* Issue Tracking: {{URL:http://www.openldap.org/its/}} + + +H2: How to present your problem + + +H2: Debugging {{slapd}}(8) + +After reading through the above sections and before e-mailing the OpenLDAP lists, you +might want to try out some of the following to track down the cause of your problems: + +* Loglevel stats (256) is generally a good first loglevel to try for getting + information useful to list members on issues +* Running {{slapd -d -1}} can often track down fairly simple issues, such as + missing schemas and incorrect file permissions for the {{slapd}} user to things like certs +* Check your logs for errors, as discussed at {{URL:http://www.openldap.org/faq/data/cache/358.html}} + +H2: Commercial Support + +The firms listed at {{URL:http://www.openldap.org/support/}} offer technical support services catering to OpenLDAP community. + +The listing of any given firm should not be viewed as an endorsement or recommendation of any kind, nor as otherwise indicating +there exists a business relationship or an affiliation between any listed firm and the OpenLDAP Foundation or the OpenLDAP Project or its contributors. diff --git a/doc/guide/admin/tuning.sdf b/doc/guide/admin/tuning.sdf new file mode 100644 index 0000000..7ae72e4 --- /dev/null +++ b/doc/guide/admin/tuning.sdf @@ -0,0 +1,338 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: Tuning + +This is perhaps one of the most important chapters in the guide, because if +you have not tuned {{slapd}}(8) correctly or grasped how to design your +directory and environment, you can expect very poor performance. + +Reading, understanding and experimenting using the instructions and information +in the following sections, will enable you to fully understand how to tailor +your directory server to your specific requirements. + +It should be noted that the following information has been collected over time +from our community based FAQ. So obviously the benefit of this real world experience +and advice should be of great value to the reader. + + +H2: Performance Factors + +Various factors can play a part in how your directory performs on your chosen +hardware and environment. We will attempt to discuss these here. + + +H3: Memory + +Scale your cache to use available memory and increase system memory if you can. + +See {{SECT:Caching}} for BDB cache tuning hints. +Note that LMDB uses no cache of its own and has no tuning options, so the Caching +section can be ignored when using LMDB. + + +H3: Disks + +Use fast filesystems, and conduct your own testing to see which filesystem +types perform best with your workload. (On our own Linux testing, EXT2 and JFS +tend to provide better write performance than everything else, including +newer filesystems like EXT4, BTRFS, etc.) + +Use fast subsystems. Put each database and logs on separate disks +(for BDB this is configurable via {{DB_CONFIG}}): + +> # Data Directory +> set_data_dir /data/db +> +> # Transaction Log settings +> set_lg_dir /logs + + +H3: Network Topology + +http://www.openldap.org/faq/data/cache/363.html + +Drawing here. + + +H3: Directory Layout Design + +Reference to other sections and good/bad drawing here. + + +H3: Expected Usage + +Discussion. + + +H2: Indexes + +H3: Understanding how a search works + +If you're searching on a filter that has been indexed, then the search reads +the index and pulls exactly the entries that are referenced by the index. +If the filter term has not been indexed, then the search must read every single + entry in the target scope and test to see if each entry matches the filter. +Obviously indexing can save a lot of work when it's used correctly. + +H3: What to index + +You should create indices to match the actual filter terms used in +search queries. + +> index cn,sn,givenname,mail eq + +Each attribute index can be tuned further by selecting the set of index types to generate. For example, substring and approximate search for organizations (o) may make little sense (and isn't like done very often). And searching for {{userPassword}} likely makes no sense what so ever. + +General rule: don't go overboard with indexes. Unused indexes must be maintained and hence can only slow things down. + +See {{slapd.conf}}(8) and {{slapdindex}}(8) for more information + + +H3: Presence indexing + +If your client application uses presence filters and if the +target attribute exists on the majority of entries in your target scope, then +all of those entries are going to be read anyway, because they are valid +members of the result set. In a subtree where 100% of the +entries are going to contain the same attributes, the presence index does +absolutely NOTHING to benefit the search, because 100% of the entries match +that presence filter. + +So the resource cost of generating the index is a +complete waste of CPU time, disk, and memory. Don't do it unless you know +that it will be used, and that the attribute in question occurs very +infrequently in the target data. + +Almost no applications use presence filters in their search queries. Presence +indexing is pointless when the target attribute exists on the majority of +entries in the database. In most LDAP deployments, presence indexing should +not be done, it's just wasted overhead. + +See the {{Logging}} section below on what to watch out for if you have a frequently searched +for attribute that is unindexed. + + +H2: Logging + +H3: What log level to use + +The default of {{loglevel stats}} (256) is really the best bet. There's a corollary to +this when problems *do* arise, don't try to trace them using syslog. +Use the debug flag instead, and capture slapd's stderr output. syslog is too +slow for debug tracing, and it's inherently lossy - it will throw away messages when it +can't keep up. + +Contrary to popular belief, {{loglevel 0}} is not ideal for production as you +won't be able to track when problems first arise. + +H3: What to watch out for + +The most common message you'll see that you should pay attention to is: + +> "<= bdb_equality_candidates: (foo) index_param failed (18)" + +That means that some application tried to use an equality filter ({{foo=<somevalue>}}) +and attribute {{foo}} does not have an equality index. If you see a lot of these +messages, you should add the index. If you see one every month or so, it may +be acceptable to ignore it. + +The default syslog level is stats (256) which logs the basic parameters of each +request; it usually produces 1-3 lines of output. On Solaris and systems that +only provide synchronous syslog, you may want to turn it off completely, but +usually you want to leave it enabled so that you'll be able to see index +messages whenever they arise. On Linux you can configure syslogd to run +asynchronously, in which case the performance hit for moderate syslog traffic +pretty much disappears. + +H3: Improving throughput + +You can improve logging performance on some systems by configuring syslog not +to sync the file system with every write ({{man syslogd/syslog.conf}}). In Linux, +you can prepend the log file name with a "-" in {{syslog.conf}}. For example, +if you are using the default LOCAL4 logging you could try: + +> # LDAP logs +> LOCAL4.* -/var/log/ldap + +For syslog-ng, add or modify the following line in {{syslog-ng.conf}}: + +> options { sync(n); }; + +where n is the number of lines which will be buffered before a write. + + +H2: Caching + +We all know what caching is, don't we? + +In brief, "A cache is a block of memory for temporary storage of data likely +to be used again" - {{URL:http://en.wikipedia.org/wiki/Cache}} + +There are 3 types of caches, BerkeleyDB's own cache, {{slapd}}(8) +entry cache and {{TERM:IDL}} (IDL) cache. + + +H3: Berkeley DB Cache + +There are two ways to tune for the BDB cachesize: + +(a) BDB cache size necessary to load the database via slapadd in optimal time + +(b) BDB cache size necessary to have a high performing running slapd once the data is loaded + +For (a), the optimal cachesize is the size of the entire database. If you +already have the database loaded, this is simply a + +> du -c -h *.bdb + +in the directory containing the OpenLDAP ({{/usr/local/var/openldap-data}}) data. + +For (b), the optimal cachesize is just the size of the {{id2entry.bdb}} file, +plus about 10% for growth. + +The tuning of {{DB_CONFIG}} should be done for each BDB type database +instantiated (back-bdb, back-hdb). + +Note that while the {{TERM:BDB}} cache is just raw chunks of memory and +configured as a memory size, the {{slapd}}(8) entry cache holds parsed entries, +and the size of each entry is variable. + +There is also an IDL cache which is used for Index Data Lookups. +If you can fit all of your database into slapd's entry cache, and all of your +index lookups fit in the IDL cache, that will provide the maximum throughput. + +If not, but you can fit the entire database into the BDB cache, then you +should do that and shrink the slapd entry cache as appropriate. + +Failing that, you should balance the BDB cache against the entry cache. + +It is worth noting that it is not absolutely necessary to configure a BerkeleyDB +cache equal in size to your entire database. All that you need is a cache +that's large enough for your "working set." + +That means, large enough to hold all of the most frequently accessed data, +plus a few less-frequently accessed items. + +For more information, please see: {{URL:http://www.oracle.com/technology/documentation/berkeley-db/db/ref/am_conf/cachesize.html}} + +H4: Calculating Cachesize + +The back-bdb database lives in two main files, {{F:dn2id.bdb}} and {{F:id2entry.bdb}}. +These are B-tree databases. We have never documented the back-bdb internal +layout before, because it didn't seem like something anyone should have to worry +about, nor was it necessarily cast in stone. But here's how it works today, +in OpenLDAP 2.4. + +A B-tree is a balanced tree; it stores data in its leaf nodes and bookkeeping +data in its interior nodes (If you don't know what tree data structures look + like in general, Google for some references, because that's getting far too +elementary for the purposes of this discussion). + +For decent performance, you need enough cache memory to contain all the nodes +along the path from the root of the tree down to the particular data item +you're accessing. That's enough cache for a single search. For the general case, +you want enough cache to contain all the internal nodes in the database. + +> db_stat -d + +will tell you how many internal pages are present in a database. You should +check this number for both dn2id and id2entry. + +Also note that {{id2entry}} always uses 16KB per "page", while {{dn2id}} uses whatever +the underlying filesystem uses, typically 4 or 8KB. To avoid thrashing, +your cache must be at least as large as the number of internal pages in both +the {{dn2id}} and {{id2entry}} databases, plus some extra space to accommodate +the actual leaf data pages. + +For example, in my OpenLDAP 2.4 test database, I have an input LDIF file that's +about 360MB. With the back-hdb backend this creates a {{dn2id.bdb}} that's 68MB, +and an {{id2entry}} that's 800MB. db_stat tells me that {{dn2id}} uses 4KB pages, has +433 internal pages, and 6378 leaf pages. The id2entry uses 16KB pages, has 52 +internal pages, and 45912 leaf pages. In order to efficiently retrieve any +single entry in this database, the cache should be at least + +> (433+1) * 4KB + (52+1) * 16KB in size: 1736KB + 848KB =~ 2.5MB. + +This doesn't take into account other library overhead, so this is even lower +than the barest minimum. The default cache size, when nothing is configured, +is only 256KB. + +This 2.5MB number also doesn't take indexing into account. Each indexed +attribute results in another database file. Earlier versions of OpenLDAP +kept these index databases in Hash format, but from OpenLDAP 2.2 onward +the index databases are in B-tree format so the same procedure can +be used to calculate the necessary amount of cache for each index database. + +For example, if your only index is for the objectClass attribute and db_stat +reveals that {{objectClass.bdb}} has 339 internal pages and uses 4096 byte +pages, the additional cache needed for just this attribute index is + +> (339+1) * 4KB =~ 1.3MB. + +With only this index enabled, I'd figure at least a 4MB cache for this backend. +(Of course you're using a single cache shared among all of the database files, +so the cache pages will most likely get used for something other than what you +accounted for, but this gives you a fighting chance.) + +With this 4MB cache I can slapcat this entire database on my 1.3GHz PIII in +1 minute, 40 seconds. With the cache doubled to 8MB, it still takes the same 1:40s. +Once you've got enough cache to fit the B-tree internal pages, increasing it +further won't have any effect until the cache really is large enough to hold +100% of the data pages. I don't have enough free RAM to hold all the 800MB +id2entry data, so 4MB is good enough. + +With back-bdb and back-hdb you can use "db_stat -m" to check how well the +database cache is performing. + +For more information on {{db_stat}}: {{URL:http://www.oracle.com/technology/documentation/berkeley-db/db/utility/db_stat.html}} + +H3: {{slapd}}(8) Entry Cache (cachesize) + +The {{slapd}}(8) entry cache operates on decoded entries. The rationale - entries +in the entry cache can be used directly, giving the fastest response. If an entry +isn't in the entry cache but can be extracted from the BDB page cache, that will +avoid an I/O but it will still require parsing, so this will be slower. + +If the entry is in neither cache then BDB will have to flush some of its current +cached pages and bring in the needed pages, resulting in a couple of expensive +I/Os as well as parsing. + +The most optimal value is of course, the entire number of entries in the database. +However, most directory servers don't consistently serve out their entire database, so setting this to a lesser number that more closely matches the believed working set of data is +sufficient. This is the second most important parameter for the DB. + +As far as balancing the entry cache vs the BDB cache - parsed entries in memory +are generally about twice as large as they are on disk. + +As we have already mentioned, not having a proper database cache size will +cause performance issues. These issues are not an indication of corruption +occurring in the database. It is merely the fact that the cache is thrashing +itself that causes performance/response time to slowdown. + + +H3: {{TERM:IDL}} Cache (idlcachesize) + +Each IDL holds the search results from a given query, so the IDL cache will +end up holding the most frequently requested search results. For back-bdb, +it is generally recommended to match the "cachesize" setting. For back-hdb, +it is generally recommended to be 3x"cachesize". + +{NOTE: The idlcachesize setting directly affects search performance} + + +H2: {{slapd}}(8) Threads + +{{slapd}}(8) can process requests via a configurable number of threads, which +in turn affects the in/out rate of connections. + +This value should generally be a function of the number of "real" cores on +the system, for example on a server with 2 CPUs with one core each, set this +to 8, or 4 threads per real core. This is a "read" maximized value. The more +threads that are configured per core, the slower {{slapd}}(8) responds for +"read" operations. On the flip side, it appears to handle write operations +faster in a heavy write/low read scenario. + +The upper bound for good read performance appears to be 16 threads (which +also happens to be the default setting). diff --git a/doc/guide/images/LDAPlogo.gif b/doc/guide/images/LDAPlogo.gif Binary files differnew file mode 100644 index 0000000..31b58b3 --- /dev/null +++ b/doc/guide/images/LDAPlogo.gif diff --git a/doc/guide/images/LDAPwww.gif b/doc/guide/images/LDAPwww.gif Binary files differnew file mode 100644 index 0000000..875d8cf --- /dev/null +++ b/doc/guide/images/LDAPwww.gif diff --git a/doc/guide/images/src/README.fonts b/doc/guide/images/src/README.fonts new file mode 100644 index 0000000..abf3cd7 --- /dev/null +++ b/doc/guide/images/src/README.fonts @@ -0,0 +1,10 @@ +# $OpenLDAP$ +# Copyright 2007-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. +# +# README.fonts +# + +In dia we use: + +sans Normal 1.00 #000000 diff --git a/doc/guide/images/src/allmail-en.svg b/doc/guide/images/src/allmail-en.svg new file mode 100644 index 0000000..baefb54 --- /dev/null +++ b/doc/guide/images/src/allmail-en.svg @@ -0,0 +1,230 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://web.resource.org/cc/" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + width="487.42709" + height="139.10474" + id="svg2" + sodipodi:version="0.32" + inkscape:version="0.45.1" + version="1.0" + sodipodi:docbase="/home/andreas/palestra" + sodipodi:docname="allmail-en.svg" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + inkscape:export-filename="/home/andreas/palestra/ppolicy.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2"> + <defs + id="defs4"> + <marker + inkscape:stockid="Arrow1Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lend" + style="overflow:visible"> + <path + id="path3186" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.8,0,0,-0.8,-10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lstart" + style="overflow:visible"> + <path + id="path3183" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.8,0,0,0.8,10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Send" + orient="auto" + refY="0" + refX="0" + id="Arrow1Send" + style="overflow:visible"> + <path + id="path3198" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.2,0,0,-0.2,-1.2,0)" /> + </marker> + <marker + inkscape:stockid="Arrow2Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow2Lstart" + style="overflow:visible"> + <path + id="path3201" + style="font-size:12px;fill-rule:evenodd;stroke-width:0.625;stroke-linejoin:round" + d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.97309,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " + transform="matrix(1.1,0,0,1.1,1.1,0)" /> + </marker> + <marker + inkscape:stockid="Arrow2Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow2Lend" + style="overflow:visible"> + <path + id="path8347" + style="font-size:12px;fill-rule:evenodd;stroke-width:0.625;stroke-linejoin:round" + d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.97309,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " + transform="matrix(-1.1,0,0,-1.1,-1.1,0)" /> + </marker> + </defs> + <sodipodi:namedview + id="base" + pagecolor="#ffffff" + bordercolor="#666666" + borderopacity="1.0" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:zoom="2.351189" + inkscape:cx="115.68184" + inkscape:cy="40.808267" + inkscape:document-units="px" + inkscape:current-layer="layer1" + showgrid="true" + showguides="false" + inkscape:window-width="1272" + inkscape:window-height="724" + inkscape:window-x="0" + inkscape:window-y="24" /> + <metadata + id="metadata7"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + </cc:Work> + </rdf:RDF> + </metadata> + <g + inkscape:label="Camada 1" + inkscape:groupmode="layer" + id="layer1" + transform="translate(-29.405584,-34.695505)"> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="116.88309" + y="48.033184" + id="text2170" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2"><tspan + sodipodi:role="line" + id="tspan2172" + x="116.88309" + y="48.033184">DN: cn=all,ou=aliases,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="63.033184" + id="tspan2174">cn: all</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="78.033184" + id="tspan5373">objectClass: <tspan + style="font-weight:bold" + id="tspan5377">nisMailAlias</tspan></tspan><tspan + sodipodi:role="line" + x="116.88309" + y="92.036435" + id="tspan3404" + style="font-size:11px;font-weight:bold">labeledURI: <tspan + style="font-weight:normal" + id="tspan5513">ldap:///ou=People,dc=example,dc=com?mail?</tspan></tspan><tspan + sodipodi:role="line" + x="116.88309" + y="105.78643" + id="tspan3413" + style="font-size:11px;font-weight:normal"> one?(objectClass=inetOrgPerson)</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="120.53318" + id="tspan2180">mail: john@example.com</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="135.53318" + id="tspan3411">mail: mary@example.com</tspan></text> + <rect + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.15456796px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + id="rect7321" + width="403.52588" + height="106.68739" + x="112.72952" + y="35.272789" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + <rect + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none;stroke-width:0.69669151;stroke-opacity:1" + id="rect7323" + width="168.38275" + height="31.950695" + x="113.71371" + y="107.91574" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="28.755194" + y="104.6917" + id="text4394" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2"><tspan + sodipodi:role="line" + x="28.755194" + y="104.6917" + id="tspan5371">search</tspan><tspan + sodipodi:role="line" + x="28.755194" + y="119.6917" + id="tspan2187">results</tspan></text> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Lend);stroke-opacity:1" + d="M 108.91035,92.832512 C 59.12768,98.112492 59.881964,116.96956 108.15606,124.51239" + id="path4400" + sodipodi:nodetypes="cc" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + <path + style="opacity:1;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-miterlimit:4;stroke-dasharray:1, 1;stroke-dashoffset:0;stroke-opacity:1" + d="M 417.4481,61.482433 C 381.50911,141.44198 176.87108,164.40908 132.69882,105.71538" + id="path5515" + transform="translate(11.556417,34.695505)" + sodipodi:nodetypes="cc" /> + <rect + inkscape:export-ydpi="136.2" + inkscape:export-xdpi="136.2" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + y="81.541206" + x="417.55688" + height="12.386127" + width="24.625708" + id="rect6492" + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none;stroke-width:0.69669151;stroke-opacity:1" /> + </g> +</svg> diff --git a/doc/guide/images/src/allusersgroup-en.svg b/doc/guide/images/src/allusersgroup-en.svg new file mode 100644 index 0000000..a50ee90 --- /dev/null +++ b/doc/guide/images/src/allusersgroup-en.svg @@ -0,0 +1,193 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> + +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://creativecommons.org/ns#" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + width="419.4133" + height="107.84196" + id="svg2" + sodipodi:version="0.32" + inkscape:version="0.46+devel" + version="1.0" + sodipodi:docname="allusersgroup-en.svg" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/admin/allusersgroup-en.png" + inkscape:export-xdpi="107.65753" + inkscape:export-ydpi="107.65753"> + <defs + id="defs4"> + <inkscape:perspective + sodipodi:type="inkscape:persp3d" + inkscape:vp_x="0 : 53.920979 : 1" + inkscape:vp_y="0 : 1000 : 0" + inkscape:vp_z="419.4133 : 53.920979 : 1" + inkscape:persp3d-origin="209.70665 : 35.947319 : 1" + id="perspective30" /> + <marker + inkscape:stockid="Arrow2Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow2Lstart" + style="overflow:visible"> + <path + id="path3201" + style="font-size:12px;fill-rule:evenodd;stroke-width:0.625;stroke-linejoin:round" + d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.97309,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " + transform="matrix(1.1,0,0,1.1,1.1,0)" /> + </marker> + <marker + inkscape:stockid="Arrow2Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow2Lend" + style="overflow:visible"> + <path + id="path8347" + style="font-size:12px;fill-rule:evenodd;stroke-width:0.625;stroke-linejoin:round" + d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.97309,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " + transform="matrix(-1.1,0,0,-1.1,-1.1,0)" /> + </marker> + </defs> + <sodipodi:namedview + id="base" + pagecolor="#ffffff" + bordercolor="#666666" + borderopacity="1.0" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:zoom="2.3724279" + inkscape:cx="216.23418" + inkscape:cy="53.920976" + inkscape:document-units="px" + inkscape:current-layer="layer1" + showgrid="true" + showguides="true" + inkscape:window-width="1274" + inkscape:window-height="950" + inkscape:window-x="0" + inkscape:window-y="25" + inkscape:guide-bbox="true" + inkscape:window-maximized="0" /> + <metadata + id="metadata7"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + <dc:title></dc:title> + </cc:Work> + </rdf:RDF> + </metadata> + <g + inkscape:label="Camada 1" + inkscape:groupmode="layer" + id="layer1" + transform="translate(-29.134918,-34.695504)"> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="116.88309" + y="48.033184" + id="text2170" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2"><tspan + sodipodi:role="line" + id="tspan2172" + x="116.88309" + y="48.033184">DN: cn=allusers,ou=group,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="63.033184" + id="tspan2174">cn: all</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="78.033184" + id="tspan5379">objectClass: <tspan + style="font-weight:bold" + id="tspan5396">groupOfURLs</tspan></tspan><tspan + sodipodi:role="line" + x="116.88309" + y="92.036435" + id="tspan3413" + style="font-size:11px;font-weight:bold">labeledURI<tspan + style="font-weight:normal" + id="tspan5410">: ldap:///ou=People,dc=example,dc=com??</tspan></tspan><tspan + sodipodi:role="line" + x="116.88309" + y="105.78643" + style="font-size:11px;font-weight:normal" + id="tspan5386"> one?(objectClass=inetOrgPerson)</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="120.53318" + id="tspan2180"><tspan + style="font-weight:bold" + id="tspan5400">member</tspan>: uid=john,ou=people,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="135.53318" + id="tspan3411"><tspan + style="font-weight:bold" + id="tspan5404">member</tspan>: uid=mary,ou=people,dc=example,dc=com</tspan></text> + <rect + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.05301607px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + id="rect7321" + width="335.34296" + height="106.78895" + x="112.67875" + y="35.222012" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + <rect + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none;stroke-width:0.69669151;stroke-opacity:1" + id="rect7323" + width="329.5397" + height="29.000132" + x="114.97823" + y="110.02328" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="28.484528" + y="99.799805" + id="text4394" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2"><tspan + sodipodi:role="line" + x="28.484528" + y="99.799805" + id="tspan5390">DNs of</tspan><tspan + sodipodi:role="line" + x="28.484528" + y="114.7998" + id="tspan2186">search</tspan><tspan + sodipodi:role="line" + x="28.484528" + y="129.7998" + id="tspan2188">results</tspan></text> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Lend);stroke-opacity:1" + d="M 108.91035,92.832512 C 59.12768,98.112492 59.881964,116.96956 108.15606,124.51239" + id="path4400" + sodipodi:nodetypes="cc" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + </g> +</svg> diff --git a/doc/guide/images/src/config_dit.dia b/doc/guide/images/src/config_dit.dia Binary files differnew file mode 100644 index 0000000..fc9d7c0 --- /dev/null +++ b/doc/guide/images/src/config_dit.dia diff --git a/doc/guide/images/src/config_local.dia b/doc/guide/images/src/config_local.dia Binary files differnew file mode 100644 index 0000000..a460368 --- /dev/null +++ b/doc/guide/images/src/config_local.dia diff --git a/doc/guide/images/src/config_ref.dia b/doc/guide/images/src/config_ref.dia Binary files differnew file mode 100644 index 0000000..7bcc733 --- /dev/null +++ b/doc/guide/images/src/config_ref.dia diff --git a/doc/guide/images/src/config_repl.dia b/doc/guide/images/src/config_repl.dia Binary files differnew file mode 100644 index 0000000..813168f --- /dev/null +++ b/doc/guide/images/src/config_repl.dia diff --git a/doc/guide/images/src/delta-syncrepl.dia b/doc/guide/images/src/delta-syncrepl.dia Binary files differnew file mode 100644 index 0000000..3f159ea --- /dev/null +++ b/doc/guide/images/src/delta-syncrepl.dia diff --git a/doc/guide/images/src/delta-syncrepl.svg b/doc/guide/images/src/delta-syncrepl.svg new file mode 100644 index 0000000..4464a95 --- /dev/null +++ b/doc/guide/images/src/delta-syncrepl.svg @@ -0,0 +1,4856 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://creativecommons.org/ns#" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + height="524.40942" + id="svg7893" + inkscape:version="0.46" + sodipodi:docbase="/home/ghenry/Desktop" + sodipodi:docname="delta-syncrepl.svg" + sodipodi:version="0.32" + width="744.09448" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + version="1.0" + inkscape:export-filename="/home/ghenry/Desktop/delta-syncrepl.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <metadata + id="metadata2563"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:title>Firewall2</dc:title> + <dc:description /> + <dc:subject> + <rdf:Bag> + <rdf:li>wall</rdf:li> + <rdf:li>brick</rdf:li> + <rdf:li>computer</rdf:li> + <rdf:li>networksym</rdf:li> + </rdf:Bag> + </dc:subject> + <dc:publisher> + <cc:Agent + rdf:about="http://www.openclipart.org/"> + <dc:title>Open Clip Art Library</dc:title> + </cc:Agent> + </dc:publisher> + <dc:creator> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:creator> + <dc:rights> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:rights> + <dc:date /> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + <cc:license + rdf:resource="http://web.resource.org/cc/PublicDomain" /> + <dc:language>en</dc:language> + </cc:Work> + <cc:License + rdf:about="http://web.resource.org/cc/PublicDomain"> + <cc:permits + rdf:resource="http://web.resource.org/cc/Reproduction" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/Distribution" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/DerivativeWorks" /> + </cc:License> + </rdf:RDF> + </metadata> + <defs + id="defs7895"> + <inkscape:perspective + sodipodi:type="inkscape:persp3d" + inkscape:vp_x="0 : 372.04724 : 1" + inkscape:vp_y="0 : 1000 : 0" + inkscape:vp_z="1052.3622 : 372.04724 : 1" + inkscape:persp3d-origin="526.18109 : 248.03149 : 1" + id="perspective6943" /> + <marker + inkscape:stockid="Arrow1Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lend" + style="overflow:visible"> + <path + id="path17680" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.8,0,0,-0.8,-10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lstart" + style="overflow:visible"> + <path + id="path17677" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.8,0,0,0.8,10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mend" + style="overflow:visible"> + <path + id="path17686" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.4,0,0,-0.4,-4,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mstart" + style="overflow:visible"> + <path + id="path17683" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.4,0,0,0.4,4,0)" /> + </marker> + <linearGradient + id="linearGradient6508"> + <stop + id="stop6509" + offset="0.0000000" + style="stop-color:#ff0000;stop-opacity:1.0000000;" /> + <stop + id="stop6511" + offset="0.64370060" + style="stop-color:#ffb900;stop-opacity:1.0000000;" /> + <stop + id="stop6512" + offset="0.79038113" + style="stop-color:#ffff00;stop-opacity:0.84102565;" /> + <stop + id="stop6510" + offset="1.0000000" + style="stop-color:#ffffff;stop-opacity:0.21568628;" /> + </linearGradient> + <linearGradient + id="linearGradient13376"> + <stop + style="stop-color:#d4d4d4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop13377" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.49803922;" + offset="0.50000000" + id="stop13380" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop13378" /> + </linearGradient> + <linearGradient + id="linearGradient12744"> + <stop + style="stop-color:#839da4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12745" /> + <stop + style="stop-color:#496d77;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12746" /> + </linearGradient> + <linearGradient + id="linearGradient10810"> + <stop + style="stop-color:#0e0000;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop10811" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="0.50000000" + id="stop10814" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop10812" /> + </linearGradient> + <linearGradient + id="linearGradient11442"> + <stop + style="stop-color:#6e6e6e;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop11443" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop11444" /> + </linearGradient> + <linearGradient + id="linearGradient14160"> + <stop + style="stop-color:#4af853;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14161" /> + <stop + style="stop-color:#68b96d;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14162" /> + </linearGradient> + <linearGradient + id="linearGradient14835"> + <stop + style="stop-color:#bed1d0;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14836" /> + <stop + style="stop-color:#52727b;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14837" /> + </linearGradient> + <linearGradient + id="linearGradient29203"> + <stop + style="stop-color:#d3d3d3;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop29205" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop29207" /> + </linearGradient> + <linearGradient + id="linearGradient6658"> + <stop + style="stop-color:#677883;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop6659" /> + <stop + style="stop-color:#677883;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop6660" /> + </linearGradient> + <linearGradient + id="linearGradient41493"> + <stop + style="stop-color:#181818;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop41495" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop41497" /> + </linearGradient> + <linearGradient + id="linearGradient12759"> + <stop + style="stop-color:#b4b4b4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12761" /> + <stop + style="stop-color:#d7d8de;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12763" /> + </linearGradient> + <linearGradient + id="linearGradient21825"> + <stop + style="stop-color:#808080;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop21827" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop21829" /> + </linearGradient> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient25527" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.776429,0,0,0.659114,-120.5524,673.5049)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25525" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-145.458,730.6984)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25403" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-145.2247,712.702)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient25401" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-3.473342,95.2718)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient25353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-149.3489,792.5495)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient26976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.06505,808.8095)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28284" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28286" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28288" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28290" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28274" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28276" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28278" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28280" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28264" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28266" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28268" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28270" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28254" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28256" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28258" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28260" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28244" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28246" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28248" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28250" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28234" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28236" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28238" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28240" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28224" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28226" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28228" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28230" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28214" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28216" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28218" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28220" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28208" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-125.9178,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28210" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28204" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.573,808.7592)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28206" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28200" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-116.9703,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28202" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28196" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.6254,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28198" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28192" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.4824,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28194" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28188" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.1375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28190" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28184" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.77797,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28186" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28180" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.43307,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28182" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28172" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28174" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28176" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28178" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28162" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28164" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28166" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28168" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28152" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28154" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28156" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28158" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28142" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28144" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28146" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28148" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28132" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28134" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28136" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28138" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28122" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28124" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28126" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28128" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28112" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28114" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28116" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28118" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28102" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28104" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28106" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28108" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28096" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.2375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28098" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28092" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-156.8927,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28094" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28088" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.29,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28090" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28084" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-147.9451,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28086" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28080" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-143.8021,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28082" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28076" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.4573,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28078" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28072" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.098,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28074" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28068" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.7531,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28070" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28060" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28062" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28064" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28066" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28050" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28052" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28054" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28056" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28040" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28042" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28044" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28046" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28030" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28032" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28034" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28036" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28020" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28022" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28024" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28026" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28010" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28012" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28014" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28016" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28000" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28002" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28004" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28006" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27990" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27992" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27994" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27996" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27984" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.2616,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27986" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27980" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-192.9168,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27982" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.3141,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27978" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-183.9692,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27968" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-179.8262,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27970" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.4813,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27960" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.122,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27962" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27956" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.7771,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27958" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27928" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27930" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27932" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27934" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27918" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27920" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27922" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27924" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27908" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27910" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27912" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27914" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27898" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27900" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27902" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27904" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27888" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27890" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27892" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27894" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27878" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27880" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27882" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27884" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27868" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27870" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27872" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27874" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27858" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27860" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27862" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27864" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27848" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27850" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27852" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27854" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27838" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27840" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27842" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27844" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27828" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27830" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27832" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27834" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27818" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27820" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27822" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27824" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27808" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27810" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27812" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27814" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27798" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27800" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27802" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27804" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27788" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27790" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27792" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27794" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27778" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27780" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27782" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27784" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27768" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27770" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27772" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27774" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27758" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27760" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27762" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27764" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27748" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27750" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27752" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27754" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27738" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27740" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27742" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27744" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27728" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27730" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27732" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27734" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27718" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27720" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27722" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27724" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27708" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27710" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27712" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27714" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27698" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27700" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27702" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27704" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28432" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-126.1386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28434" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28428" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.7938,817.6604)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28430" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28424" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-117.1911,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28426" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28420" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.8462,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28422" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28416" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.7032,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28418" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28412" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.3583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28414" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28408" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.99876,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28410" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28404" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.65386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28406" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28400" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.4583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28402" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28396" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-157.1135,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28398" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28392" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.5108,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28394" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28388" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-148.1659,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28390" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28384" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-144.0229,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28386" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28380" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.6781,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28382" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28376" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.3188,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28378" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28372" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.9739,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28374" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28368" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.4824,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28370" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28364" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-193.1376,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28366" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28360" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.5349,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28362" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28356" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-184.19,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28358" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28352" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-180.047,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28354" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28348" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.7021,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28350" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28344" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.3428,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28346" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28340" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.9979,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28342" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28438" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.25863,817.7848)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36281" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-149.897,802.9053)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36283" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36285" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36287" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36289" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36291" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36293" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36295" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36297" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36299" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36301" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36303" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36305" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36307" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36309" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36311" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36313" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36315" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36317" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36319" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36321" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36323" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36325" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36327" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36329" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36331" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5348,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36333" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7196,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36335" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.35,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36337" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.274,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36339" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.9043,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36341" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.0892,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36343" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-149.6637,784.9089)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient36345" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-7.912301,167.4787)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36347" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5296,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36349" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7144,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36351" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.3448,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.2688,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36355" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.8991,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36357" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.084,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36359" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-198.4916,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36361" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.046,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36363" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.2306,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36365" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-192.8611,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36367" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-195.6763,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36369" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-87.12747,420.4818)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36371" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36373" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36375" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-91.66274,388.2275)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36377" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36379" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36381" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-153.7879,864.7564)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35867" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-141.9847,635.4266)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35869" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35871" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35873" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35875" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35877" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35879" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35881" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35883" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35885" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35887" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35889" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35891" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35893" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35895" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35897" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35899" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35901" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35903" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35905" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35907" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35909" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35911" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35913" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35915" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35917" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35919" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35921" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35923" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35925" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35927" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35929" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35931" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35933" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35935" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35937" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35939" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35941" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35943" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35945" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35947" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35949" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35951" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35953" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35955" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35957" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35959" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35961" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35963" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35965" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6225,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35967" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.7312,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35969" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2856,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35971" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.4702,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35973" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.1007,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35975" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8073,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35977" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9159,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35979" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4377,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35981" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5465,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35983" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3617,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35985" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.992,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35987" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1769,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35989" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-141.7514,617.4302)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient35991" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(2.672454,0.374188)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35993" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6173,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35995" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.726,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35997" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2804,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35999" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.465,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36001" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.0955,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36003" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8021,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36005" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9107,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36007" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4325,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36009" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5413,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36011" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3565,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36013" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.9868,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36015" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1717,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36017" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.5793,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36019" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.1337,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36021" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.3183,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36023" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-184.9488,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36025" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.764,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36027" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-79.21517,253.0031)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36029" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36031" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36033" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-83.75044,220.7488)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36035" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36037" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36039" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-145.8756,697.2777)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient12151" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.20227,0,0,0.454077,6.691668,-148.3193)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12153" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,1.691668,-145.8193)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient14835" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12155" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,1.924904,-161.8157)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12157" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.350818,114.6621,-134.6472)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12159" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-59.65453)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12161" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-61.33423)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12163" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-63.01391)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12165" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.09869,-64.40064)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + </defs> + <sodipodi:namedview + bordercolor="#666666" + borderopacity="1.0" + id="base" + inkscape:current-layer="layer1" + inkscape:cx="391.40904" + inkscape:cy="253.29159" + inkscape:document-units="px" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:window-height="722" + inkscape:window-width="1014" + inkscape:window-x="0" + inkscape:window-y="25" + inkscape:zoom="1" + pagecolor="#ffffff" + width="1052.3622px" + height="744.09448px" + showgrid="false" /> + <g + id="layer1" + inkscape:groupmode="layer" + inkscape:label="Layer 1"> + <g + id="g12774" + transform="matrix(0.1881701,0,0,0.2844466,82.77219,152.33679)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12776" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12778" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12780" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <flowRoot + xml:space="preserve" + id="flowRoot12890" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(51.007531,-424.27533)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"><flowRegion + id="flowRegion12892"><rect + id="rect12894" + width="156.14285" + height="34" + x="194.28572" + y="475.52304" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara6968">Delta-syncrepl</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot27609" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(-33,210)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"><flowRegion + id="flowRegion27611"><rect + id="rect27613" + width="134.05586" + height="26.345188" + x="96.974648" + y="113.75929" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara27617">Master/Provider</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot3120" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="matrix(1,0,0,1.2037203,-16.30957,-194.07388)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"><flowRegion + id="flowRegion3122"><rect + id="rect3124" + width="317.52289" + height="139.3987" + x="412.14224" + y="279.42432" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara4477">Delta-syncrepl is a changelog-based variant of syncrepl. It works by maintaining a changelog of a selectable depth on the provider. The replication consumer checks the changelog for the changes.</flowPara></flowRoot> <g + id="g7023" + transform="matrix(0.1267968,0,0,0.1710106,204.38313,147.27416)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path7025" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path7027" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path7029" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="253" + y="224.40942" + id="text7033"><tspan + sodipodi:role="line" + x="253" + y="224.40942" + id="tspan7037">cn=accesslog</tspan><tspan + sodipodi:role="line" + x="253" + y="239.40942" + id="tspan3575">database to hold</tspan><tspan + sodipodi:role="line" + x="253" + y="254.40942" + id="tspan4415">changes etc.</tspan><tspan + sodipodi:role="line" + x="253" + y="254.40942" + id="tspan4419" /><tspan + sodipodi:role="line" + x="253" + y="269.40942" + id="tspan4417" /><tspan + sodipodi:role="line" + x="253" + y="284.40942" + id="tspan3577" /><tspan + sodipodi:role="line" + x="253" + y="299.40942" + id="tspan3573" /></text> + <rect + style="fill:#0000ff;fill-rule:evenodd;stroke:#000000;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0;opacity:0" + id="rect3579" + width="297" + height="168" + x="48" + y="128.40942" /> + <rect + style="opacity:0;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0;fill:none" + id="rect4375" + width="305" + height="167" + x="55" + y="127.40942" /> + <rect + style="opacity:0;fill:none;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0" + id="rect4379" + width="293" + height="167" + x="60" + y="123.40942" /> + <rect + style="opacity:0;fill:#000000;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0;fill-opacity:1" + id="rect4381" + width="275" + height="161" + x="76" + y="143.40942" /> + <rect + style="opacity:0;fill:#000000;fill-opacity:1;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0" + id="rect4383" + width="305" + height="172" + x="61" + y="127.40942" /> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="93.694336" + y="286.38306" + id="text4397"><tspan + sodipodi:role="line" + x="93.694336" + y="301.38306" + id="tspan4401">main database</tspan><tspan + sodipodi:role="line" + x="93.694336" + y="316.38306" + id="tspan4403" /><tspan + sodipodi:role="line" + x="93.694336" + y="331.38306" + id="tspan4405" /></text> + <text + xml:space="preserve" + style="font-size:40px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="316" + y="236.40942" + id="text4409"><tspan + sodipodi:role="line" + id="tspan4411" + x="316" + y="236.40942"></tspan><tspan + sodipodi:role="line" + id="tspan4413" /></text> + <rect + style="fill:#9087ff;fill-rule:evenodd;stroke:#000000;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;opacity:1;fill-opacity:0;stroke-miterlimit:4;stroke-dasharray:3,1;stroke-dashoffset:0" + id="rect4421" + width="313" + height="184" + x="64" + y="133.40942" /> + <g + id="g4423" + transform="matrix(0.1267968,0,0,0.1710106,337.38313,350.27416)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path4425" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path4427" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path4429" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="276.03223" + y="437.88306" + id="text4431"><tspan + sodipodi:role="line" + x="276.03223" + y="437.88306" + id="tspan4441"><tspan + style="font-weight:bold" + id="tspan5582">Consumer</tspan> which uses syncrepl and the </tspan><tspan + sodipodi:role="line" + x="276.03223" + y="452.88306" + id="tspan4439">"syncdata=accesslog" setting.</tspan><tspan + sodipodi:role="line" + x="276.03223" + y="467.88306" + id="tspan4469">Switches back to normal syncrepl if gets </tspan><tspan + sodipodi:role="line" + x="276.03223" + y="482.88306" + id="tspan4471">too far out of sync, then once caught up </tspan><tspan + sodipodi:role="line" + x="276.03223" + y="497.88306" + id="tspan4473">goes back to delta.</tspan><tspan + sodipodi:role="line" + x="276.03223" + y="512.88306" + id="tspan4435" /><tspan + sodipodi:role="line" + x="276.03223" + y="527.88306" + id="tspan4437" /></text> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.08729029px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 244.20659,325.76325 L 336.79341,392.05559" + id="path25655" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.48164538px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 168.40377,220.39252 L 208.59623,190.42632" + id="path5584" /> + </g> +</svg> diff --git a/doc/guide/images/src/dual_dc.svg b/doc/guide/images/src/dual_dc.svg new file mode 100755 index 0000000..466bccf --- /dev/null +++ b/doc/guide/images/src/dual_dc.svg @@ -0,0 +1,6810 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://web.resource.org/cc/" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + height="744.09448" + id="svg7893" + inkscape:version="0.45.1" + sodipodi:docbase="/home/ghenry/Desktop" + sodipodi:docname="dual_dc.svg" + sodipodi:version="0.32" + width="1052.3622" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + version="1.0" + inkscape:export-filename="/home/ghenry/Desktop/dual_dc.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <metadata + id="metadata2563"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:title>Firewall2</dc:title> + <dc:description /> + <dc:subject> + <rdf:Bag> + <rdf:li>wall</rdf:li> + <rdf:li>brick</rdf:li> + <rdf:li>computer</rdf:li> + <rdf:li>networksym</rdf:li> + </rdf:Bag> + </dc:subject> + <dc:publisher> + <cc:Agent + rdf:about="http://www.openclipart.org/"> + <dc:title>Open Clip Art Library</dc:title> + </cc:Agent> + </dc:publisher> + <dc:creator> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:creator> + <dc:rights> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:rights> + <dc:date /> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + <cc:license + rdf:resource="http://web.resource.org/cc/PublicDomain" /> + <dc:language>en</dc:language> + </cc:Work> + <cc:License + rdf:about="http://web.resource.org/cc/PublicDomain"> + <cc:permits + rdf:resource="http://web.resource.org/cc/Reproduction" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/Distribution" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/DerivativeWorks" /> + </cc:License> + </rdf:RDF> + </metadata> + <defs + id="defs7895"> + <marker + inkscape:stockid="Arrow1Lend" + orient="auto" + refY="0.0" + refX="0.0" + id="Arrow1Lend" + style="overflow:visible;"> + <path + id="path17680" + d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;" + transform="scale(0.8) rotate(180) translate(12.5,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Lstart" + orient="auto" + refY="0.0" + refX="0.0" + id="Arrow1Lstart" + style="overflow:visible"> + <path + id="path17677" + d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none" + transform="scale(0.8) translate(12.5,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mend" + orient="auto" + refY="0.0" + refX="0.0" + id="Arrow1Mend" + style="overflow:visible;"> + <path + id="path17686" + d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;" + transform="scale(0.4) rotate(180) translate(10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mstart" + orient="auto" + refY="0.0" + refX="0.0" + id="Arrow1Mstart" + style="overflow:visible"> + <path + id="path17683" + d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none" + transform="scale(0.4) translate(10,0)" /> + </marker> + <linearGradient + id="linearGradient6508"> + <stop + id="stop6509" + offset="0.0000000" + style="stop-color:#ff0000;stop-opacity:1.0000000;" /> + <stop + id="stop6511" + offset="0.64370060" + style="stop-color:#ffb900;stop-opacity:1.0000000;" /> + <stop + id="stop6512" + offset="0.79038113" + style="stop-color:#ffff00;stop-opacity:0.84102565;" /> + <stop + id="stop6510" + offset="1.0000000" + style="stop-color:#ffffff;stop-opacity:0.21568628;" /> + </linearGradient> + <linearGradient + id="linearGradient13376"> + <stop + style="stop-color:#d4d4d4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop13377" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.49803922;" + offset="0.50000000" + id="stop13380" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop13378" /> + </linearGradient> + <linearGradient + id="linearGradient12744"> + <stop + style="stop-color:#839da4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12745" /> + <stop + style="stop-color:#496d77;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12746" /> + </linearGradient> + <linearGradient + id="linearGradient10810"> + <stop + style="stop-color:#0e0000;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop10811" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="0.50000000" + id="stop10814" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop10812" /> + </linearGradient> + <linearGradient + id="linearGradient11442"> + <stop + style="stop-color:#6e6e6e;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop11443" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop11444" /> + </linearGradient> + <linearGradient + id="linearGradient14160"> + <stop + style="stop-color:#4af853;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14161" /> + <stop + style="stop-color:#68b96d;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14162" /> + </linearGradient> + <linearGradient + id="linearGradient14835"> + <stop + style="stop-color:#bed1d0;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14836" /> + <stop + style="stop-color:#52727b;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14837" /> + </linearGradient> + <linearGradient + id="linearGradient29203"> + <stop + style="stop-color:#d3d3d3;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop29205" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop29207" /> + </linearGradient> + <linearGradient + id="linearGradient6658"> + <stop + style="stop-color:#677883;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop6659" /> + <stop + style="stop-color:#677883;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop6660" /> + </linearGradient> + <linearGradient + id="linearGradient41493"> + <stop + style="stop-color:#181818;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop41495" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop41497" /> + </linearGradient> + <linearGradient + id="linearGradient12759"> + <stop + style="stop-color:#b4b4b4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12761" /> + <stop + style="stop-color:#d7d8de;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12763" /> + </linearGradient> + <linearGradient + id="linearGradient21825"> + <stop + style="stop-color:#808080;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop21827" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop21829" /> + </linearGradient> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient25527" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.776429,0.000000,0.000000,0.659114,-120.5524,673.5049)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.945030" + id="linearGradient25525" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0.000000,0.000000,0.399114,-145.4580,730.6984)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.945030" + id="linearGradient25403" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0.000000,0.000000,0.399114,-145.2247,712.7020)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient25401" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0.000000,0.000000,0.374188,-3.473342,95.27180)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient25353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0.000000,0.000000,0.370779,-149.3489,792.5495)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient26976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-90.06505,808.8095)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.058310,0.000000,0.000000,0.803858,616.2490,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0.000000,0.000000,0.530755,508.4408,137.6640)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.058310,0.000000,0.000000,0.803858,616.2490,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0.000000,0.000000,0.530755,508.4408,137.6640)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28284" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28286" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28288" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.026341e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28290" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28274" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28276" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28278" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.026156e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28280" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28264" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28266" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28268" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.027076e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28270" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28254" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28256" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28258" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.026932e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28260" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28244" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28246" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28248" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.026947e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28250" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28234" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28236" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28238" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.026928e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28240" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28224" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28226" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28228" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.026495e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28230" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28214" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28216" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28218" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.026890e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28220" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28208" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-125.9178,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28210" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.0884,752.1340)" + fy="113.72600" + fx="97.536598" + cy="113.72600" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28204" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-121.5730,808.7592)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28206" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.0884,752.1340)" + fy="113.72600" + fx="100.67591" + cy="113.72600" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28200" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-116.9703,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28202" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.0884,752.1340)" + fy="113.72600" + fx="104.00187" + cy="113.72600" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28196" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-112.6254,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28198" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.0884,752.1340)" + fy="113.72600" + fx="107.14119" + cy="113.72600" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28192" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-108.4824,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28194" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.0884,752.1340)" + fy="113.72600" + fx="110.13468" + cy="113.72600" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28188" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-104.1375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28190" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.0884,752.1340)" + fy="113.72600" + fx="113.27399" + cy="113.72600" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28184" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-99.77797,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28186" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.0884,752.1340)" + fy="113.72600" + fx="116.42374" + cy="113.72600" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28180" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-95.43307,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28182" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.0884,752.1340)" + fy="113.72600" + fx="119.56305" + cy="113.72600" + cx="119.56305" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28172" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28174" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28176" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.023496e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28178" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28162" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28164" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28166" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.023311e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28168" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28152" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28154" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28156" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.024231e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28158" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28142" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28144" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28146" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.024087e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28148" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28132" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28134" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28136" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.024102e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28138" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28122" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28124" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28126" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.024083e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28128" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28112" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28114" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28116" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.023650e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28118" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28102" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28104" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28106" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.024045e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28108" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28096" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-161.2375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28098" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="71.480988" + cy="113.72600" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28092" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-156.8927,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28094" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="74.620308" + cy="113.72600" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28088" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-152.2900,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28090" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="77.946259" + cy="113.72600" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28084" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-147.9451,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28086" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="81.085587" + cy="113.72600" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28080" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-143.8021,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28082" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="84.079071" + cy="113.72600" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28076" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-139.4573,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28078" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="87.218399" + cy="113.72600" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28072" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-135.0980,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28074" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="90.368126" + cy="113.72600" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28068" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-130.7531,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28070" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="93.507462" + cy="113.72600" + cx="93.507462" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28060" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28062" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28064" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.026556e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28066" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28050" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28052" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28054" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.027091e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28056" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28040" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28042" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28044" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.026139e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28046" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28030" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28032" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28034" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025995e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28036" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28020" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28022" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28024" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.026010e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28026" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28010" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28012" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28014" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025991e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28016" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28000" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28002" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28004" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025558e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28006" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27990" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27992" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27994" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.026529e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27996" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27984" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-197.2616,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27986" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="45.452175" + cy="113.72600" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27980" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-192.9168,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27982" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="48.591496" + cy="113.72600" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-188.3141,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27978" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="51.917450" + cy="113.72600" + cx="51.917450" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-183.9692,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="55.056770" + cy="113.72600" + cx="55.056770" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27968" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-179.8262,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27970" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="58.050255" + cy="113.72600" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-175.4813,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="61.189575" + cy="113.72600" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27960" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-171.1220,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27962" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="64.339317" + cy="113.72600" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27956" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-166.7771,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27958" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.3469,752.1340)" + fy="113.72600" + fx="67.478638" + cy="113.72600" + cx="67.478638" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27928" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27930" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27932" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034243e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27934" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27918" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27920" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27922" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034058e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27924" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27908" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27910" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27912" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034978e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27914" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27898" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27900" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27902" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034834e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27904" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27888" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27890" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27892" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034849e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27894" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27878" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27880" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27882" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034830e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27884" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27868" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27870" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27872" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034397e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27874" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27858" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27860" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27862" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034792e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27864" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27848" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27850" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27852" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.031398e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27854" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27838" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27840" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27842" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.031213e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27844" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27828" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27830" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27832" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.032133e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27834" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27818" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27820" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27822" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.031989e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27824" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27808" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27810" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27812" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.032004e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27814" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27798" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27800" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27802" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.031985e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27804" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27788" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27790" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27792" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.031552e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27794" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27778" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27780" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27782" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.031947e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27784" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27768" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27770" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27772" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034458e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27774" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27758" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27760" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27762" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034993e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27764" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27748" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27750" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27752" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034041e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27754" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27738" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27740" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27742" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.033897e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27744" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27728" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27730" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27732" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.033912e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27734" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27718" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27720" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27722" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.033893e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27724" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27708" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27710" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27712" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.033460e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27714" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27698" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27700" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27702" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.034431e-10)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27704" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.146240" + fx="-75.268890" + cy="84.146240" + cx="-75.268890" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28432" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-126.1386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28434" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.3092,761.0352)" + fy="113.72600" + fx="97.536598" + cy="113.72600" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28428" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-121.7938,817.6604)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28430" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.3092,761.0352)" + fy="113.72600" + fx="100.67591" + cy="113.72600" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28424" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-117.1911,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28426" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.3092,761.0352)" + fy="113.72600" + fx="104.00187" + cy="113.72600" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28420" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-112.8462,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28422" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.3092,761.0352)" + fy="113.72600" + fx="107.14119" + cy="113.72600" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28416" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-108.7032,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28418" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.3092,761.0352)" + fy="113.72600" + fx="110.13468" + cy="113.72600" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28412" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-104.3583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28414" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.3092,761.0352)" + fy="113.72600" + fx="113.27399" + cy="113.72600" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28408" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-99.99876,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28410" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.3092,761.0352)" + fy="113.72600" + fx="116.42374" + cy="113.72600" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28404" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-95.65386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28406" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-286.3092,761.0352)" + fy="113.72600" + fx="119.56305" + cy="113.72600" + cx="119.56305" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28400" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-161.4583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28402" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="71.480988" + cy="113.72600" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28396" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-157.1135,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28398" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="74.620308" + cy="113.72600" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28392" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-152.5108,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28394" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="77.946259" + cy="113.72600" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28388" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-148.1659,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28390" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="81.085587" + cy="113.72600" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28384" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-144.0229,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28386" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="84.079071" + cy="113.72600" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28380" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-139.6781,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28382" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="87.218399" + cy="113.72600" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28376" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-135.3188,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28378" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="90.368126" + cy="113.72600" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28372" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-130.9739,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28374" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="93.507462" + cy="113.72600" + cx="93.507462" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28368" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-197.4824,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28370" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="45.452175" + cy="113.72600" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28364" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-193.1376,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28366" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="48.591496" + cy="113.72600" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28360" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-188.5349,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28362" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="51.917450" + cy="113.72600" + cx="51.917450" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28356" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-184.1900,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28358" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="55.056770" + cy="113.72600" + cx="55.056770" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28352" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-180.0470,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28354" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="58.050255" + cy="113.72600" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28348" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-175.7021,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28350" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="61.189575" + cy="113.72600" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28344" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-171.3428,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28346" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="64.339317" + cy="113.72600" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28340" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-166.9979,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28342" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0.000000,0.000000,0.656868,-285.5677,761.0352)" + fy="113.72600" + fx="67.478638" + cy="113.72600" + cx="67.478638" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28438" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0.000000,0.000000,0.180797,-90.25863,817.7848)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.945030" + id="linearGradient36281" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0.000000,0.000000,0.399114,-149.8970,802.9053)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36283" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36285" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025564e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36287" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36289" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025379e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36291" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36293" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025424e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36295" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36297" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025375e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36299" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36301" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025318e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36303" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36305" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025343e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36307" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36309" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.031109e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36311" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36313" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.030924e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36315" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36317" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.030969e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36319" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36321" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.030920e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36323" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36325" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.030863e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36327" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36329" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.030888e-10)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36331" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-187.5348,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36333" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-185.7196,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36335" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-189.3500,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36337" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-180.2740,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36339" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-183.9043,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36341" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-182.0892,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.945030" + id="linearGradient36343" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0.000000,0.000000,0.399114,-149.6637,784.9089)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient36345" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0.000000,0.000000,0.374188,-7.912301,167.4787)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36347" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-187.5296,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36349" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-185.7144,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36351" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-189.3448,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-180.2688,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36355" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-183.8991,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36357" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-182.0840,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36359" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-198.4916,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36361" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-190.0460,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36363" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-187.2306,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36365" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-192.8611,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36367" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-195.6763,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36369" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.742720,0.000000,0.000000,0.445632,-87.12747,420.4818)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36371" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36373" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.028536e-10)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36375" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0.000000,0.000000,0.475341,-91.66274,388.2275)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36377" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36379" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.027980e-10)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36381" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0.000000,0.000000,0.370779,-153.7879,864.7564)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.945030" + id="linearGradient35867" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0.000000,0.000000,0.399114,-141.9847,635.4266)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35869" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35871" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025486e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35873" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35875" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025301e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35877" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35879" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025346e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35881" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35883" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025297e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35885" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35887" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025240e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35889" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35891" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.025265e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35893" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35895" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.024517e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35897" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35899" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.024373e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35901" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35903" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.024388e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35905" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35907" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.024369e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35909" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35911" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.035110e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35913" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35915" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.024331e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35917" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35919" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.031174e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35921" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35923" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.030989e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35925" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35927" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.031034e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35929" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35931" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.030985e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35933" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35935" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.030928e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35937" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35939" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.030953e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35941" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35943" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.023950e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35945" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35947" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.023806e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35949" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35951" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.023821e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35953" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35955" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.023802e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35957" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35959" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.023764e-10)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35961" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35963" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.023379e-10)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35965" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-179.6225,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35967" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-168.7312,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35969" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-163.2856,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35971" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-161.4702,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35973" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-165.1007,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35975" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-177.8073,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35977" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-166.9159,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35979" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-181.4377,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35981" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-170.5465,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35983" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-172.3617,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35985" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-175.9920,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35987" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-174.1769,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.945030" + id="linearGradient35989" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0.000000,0.000000,0.399114,-141.7514,617.4302)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient35991" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(2.672454,0.374188)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35993" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-179.6173,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35995" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-168.7260,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35997" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-163.2804,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35999" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-161.4650,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36001" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-165.0955,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36003" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-177.8021,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36005" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-166.9107,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36007" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-181.4325,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36009" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-170.5413,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36011" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-172.3565,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36013" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-175.9868,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36015" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-174.1717,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36017" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-190.5793,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36019" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-182.1337,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36021" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-179.3183,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36023" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-184.9488,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36025" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0.000000,0.000000,0.194625,-187.7640,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36027" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.742720,0.000000,0.000000,0.445632,-79.21517,253.0031)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36029" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36031" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.028790e-10)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36033" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0.000000,0.000000,0.475341,-83.75044,220.7488)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36035" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0.000000,0.000000,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36037" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0.000000,0.000000,0.916806,6.735873,-1.028234e-10)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36039" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0.000000,0.000000,0.370779,-145.8756,697.2777)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient12151" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.20227,0,0,0.454077,6.691668,-148.3193)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.945030" + id="linearGradient12153" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,1.691668,-145.8193)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient14835" + x2="8.3977861" + x1="-35.945030" + id="linearGradient12155" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,1.924904,-161.8157)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.945030" + id="linearGradient12157" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.350818,114.6621,-134.6472)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12159" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-59.65453)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12161" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-61.33423)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12163" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-63.01391)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12165" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.09869,-64.40064)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient13376" + id="radialGradient16585" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.20227,0,0,0.454077,6.691668,-148.3193)" + cx="-19.261518" + cy="253.63734" + fx="-19.038713" + fy="254.35735" + r="31.620827" /> + <linearGradient + inkscape:collect="always" + xlink:href="#linearGradient12744" + id="linearGradient16587" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,1.691668,-145.8193)" + x1="-35.945030" + y1="233.36613" + x2="8.3977861" + y2="275.81308" /> + <linearGradient + inkscape:collect="always" + xlink:href="#linearGradient14835" + id="linearGradient16589" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,1.924904,-161.8157)" + x1="-35.945030" + y1="233.36613" + x2="8.3977861" + y2="275.81308" /> + <linearGradient + inkscape:collect="always" + xlink:href="#linearGradient12744" + id="linearGradient16591" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.350818,114.6621,-134.6472)" + x1="-35.945030" + y1="233.36613" + x2="8.3977861" + y2="275.81308" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient16593" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-59.65453)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient16595" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-61.33423)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient16597" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-63.01391)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient16599" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.09869,-64.40064)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient13376" + id="radialGradient3109" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.20227,0,0,0.454077,6.691668,-148.3193)" + cx="-19.261518" + cy="253.63734" + fx="-19.038713" + fy="254.35735" + r="31.620827" /> + <linearGradient + inkscape:collect="always" + xlink:href="#linearGradient12744" + id="linearGradient3111" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,1.691668,-145.8193)" + x1="-35.945030" + y1="233.36613" + x2="8.3977861" + y2="275.81308" /> + <linearGradient + inkscape:collect="always" + xlink:href="#linearGradient14835" + id="linearGradient3113" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,1.924904,-161.8157)" + x1="-35.945030" + y1="233.36613" + x2="8.3977861" + y2="275.81308" /> + <linearGradient + inkscape:collect="always" + xlink:href="#linearGradient12744" + id="linearGradient3115" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.350818,114.6621,-134.6472)" + x1="-35.945030" + y1="233.36613" + x2="8.3977861" + y2="275.81308" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient3117" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-59.65453)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient3119" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-61.33423)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient3121" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-63.01391)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient3123" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.09869,-64.40064)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient13376" + id="radialGradient3239" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.20227,0,0,0.454077,6.691668,-148.3193)" + cx="-19.261518" + cy="253.63734" + fx="-19.038713" + fy="254.35735" + r="31.620827" /> + <linearGradient + inkscape:collect="always" + xlink:href="#linearGradient12744" + id="linearGradient3241" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,1.691668,-145.8193)" + x1="-35.945030" + y1="233.36613" + x2="8.3977861" + y2="275.81308" /> + <linearGradient + inkscape:collect="always" + xlink:href="#linearGradient14835" + id="linearGradient3243" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,1.924904,-161.8157)" + x1="-35.945030" + y1="233.36613" + x2="8.3977861" + y2="275.81308" /> + <linearGradient + inkscape:collect="always" + xlink:href="#linearGradient12744" + id="linearGradient3245" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.350818,114.6621,-134.6472)" + x1="-35.945030" + y1="233.36613" + x2="8.3977861" + y2="275.81308" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient3247" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-59.65453)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient3249" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-61.33423)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient3251" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-63.01391)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + <radialGradient + inkscape:collect="always" + xlink:href="#linearGradient14160" + id="radialGradient3253" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.09869,-64.40064)" + cx="-66.099426" + cy="99.988457" + fx="-66.099426" + fy="99.988457" + r="2.0070677" /> + </defs> + <sodipodi:namedview + bordercolor="#666666" + borderopacity="1.0" + id="base" + inkscape:current-layer="layer1" + inkscape:cx="495.44191" + inkscape:cy="375.2641" + inkscape:document-units="px" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:window-height="953" + inkscape:window-width="1280" + inkscape:window-x="0" + inkscape:window-y="25" + inkscape:zoom="1" + pagecolor="#ffffff" + width="1052.3622px" + height="744.09448px" /> + <g + id="layer1" + inkscape:groupmode="layer" + inkscape:label="Layer 1"> + <g + id="g5278" + transform="matrix(0.1267968,0,0,0.1710106,100.15833,410.75325)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path569" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z " /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path568" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path566" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + </g> + <g + id="g12726" + transform="matrix(1.2500391,0,0,1.184913,99.819149,206.94272)"> + <g + transform="translate(152.9277,120.7469)" + id="g26712"> + <path + style="fill:url(#radialGradient12151);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path12747" + d="M 24.972918,-30.66305 C 24.972918,-22.90055 -16.207082,-20.35055 -53.230207,-20.66305 C -90.878332,-20.66305 -92.370832,-26.65055 -92.370832,-34.41305 C -92.370832,-42.17555 -71.190832,-40.03805 -33.542707,-40.03805 C 4.105418,-40.03805 24.972918,-38.42555 24.972918,-30.66305 z " /> + <path + style="fill:url(#linearGradient12153);fill-opacity:1;stroke:#677883;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="rect8945" + d="M -88.933334,-50.694302 L 23.566666,-50.694302 L 23.566666,-37.18304 L -88.933334,-37.18304 L -88.933334,-50.694302 z " /> + <path + style="fill:url(#linearGradient12155);fill-opacity:1;stroke:#677883;stroke-width:0.49944988;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="rect14210" + d="M -75.933161,-61.840606 L 36.319422,-61.840606 L 23.751782,-51.190703 L -88.500801,-51.190703 L -75.933161,-61.840606 z " /> + <path + style="fill:url(#linearGradient12157);fill-opacity:1;stroke:#677883;stroke-width:0.46877259;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="rect14838" + d="M 23.981782,-50.846435 L 36.765614,-61.588097 L 36.752498,-48.186223 L 24.037025,-37.40884 L 23.981782,-50.846435 z " /> + <rect + y="-40.584919" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient12159);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect14843" + height="0.78125" /> + <rect + y="-42.264622" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient12161);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect14845" + height="0.78125" /> + <rect + y="-43.944294" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient12163);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect14847" + height="0.78125" /> + <rect + y="-45.33102" + x="-86.609116" + width="1.5625" + style="fill:url(#radialGradient12165);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect14849" + height="0.78125" /> + </g> + </g> + <g + id="g12774" + transform="matrix(0.1881701,0,0,0.2844466,210.77219,75.336794)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12776" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z " /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12778" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12780" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + </g> + <g + id="g12782" + transform="matrix(0.1881701,0,0,0.2844466,707.44948,77.500676)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12784" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z " /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12786" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12788" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + </g> + <flowRoot + xml:space="preserve" + id="flowRoot12862" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(-143.44166,-193.94928)"><flowRegion + id="flowRegion12864"><rect + id="rect12866" + width="157.14285" + height="40" + x="194.28572" + y="475.52304" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara23709">Load Balancer</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot12890" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr;text-anchor:start;font-family:Arial" + transform="translate(-12.992469,-434.27533)"><flowRegion + id="flowRegion12892"><rect + id="rect12894" + width="157.14285" + height="40" + x="194.28572" + y="475.52304" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara12898">Data Center A</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot12900" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr;text-anchor:start;font-family:Arial" + transform="translate(486.55966,-436.47728)"><flowRegion + id="flowRegion12902"><rect + id="rect12904" + width="157.14285" + height="40" + x="194.28572" + y="475.52304" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara12908">Data Center B</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot12976" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(667.90714,-192.88096)"><flowRegion + id="flowRegion12978"><rect + id="rect12980" + width="157.14285" + height="40" + x="194.28572" + y="475.52304" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara23707">Load Balancer</flowPara></flowRoot> <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:3,3;stroke-dashoffset:0" + d="M 519.21841,49.109532 L 519.21841,687.52594" + id="path14553" /> + <flowRoot + xml:space="preserve" + id="flowRoot15524" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(-105.05587,-187.88838)"><flowRegion + id="flowRegion15526"><rect + id="rect15528" + width="129.29955" + height="26.263966" + x="137.38075" + y="681.46503" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara15542">Replica Pool</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot15534" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(781.35941,-209.327)"><flowRegion + id="flowRegion15536"><rect + id="rect15538" + width="129.29955" + height="26.263966" + x="137.38075" + y="681.46503" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara15544">Replica Pool</flowPara></flowRoot> <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.71494228px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 254.55844,186.23712 L 254.55844,261.49474" + id="path16515" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.10873353px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 299.05951,113.93024 L 711.09302,176.21781" + id="path16519" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.03299749px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 301.04196,179.66157 L 715.17151,118.56769" + id="path16521" /> + <g + id="g16529" + transform="matrix(1.2344541,0,0,1.166142,100.35599,485.83269)"> + <g + transform="translate(152.9277,120.7469)" + id="g16531"> + <path + style="fill:url(#radialGradient16585);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path16533" + d="M 24.972918,-30.66305 C 24.972918,-22.90055 -16.207082,-20.35055 -53.230207,-20.66305 C -90.878332,-20.66305 -92.370832,-26.65055 -92.370832,-34.41305 C -92.370832,-42.17555 -71.190832,-40.03805 -33.542707,-40.03805 C 4.105418,-40.03805 24.972918,-38.42555 24.972918,-30.66305 z " /> + <path + style="fill:url(#linearGradient16587);fill-opacity:1;stroke:#677883;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path16535" + d="M -88.933334,-50.694302 L 23.566666,-50.694302 L 23.566666,-37.18304 L -88.933334,-37.18304 L -88.933334,-50.694302 z " /> + <path + style="fill:url(#linearGradient16589);fill-opacity:1;stroke:#677883;stroke-width:0.49944988;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path16537" + d="M -75.933161,-61.840606 L 36.319422,-61.840606 L 23.751782,-51.190703 L -88.500801,-51.190703 L -75.933161,-61.840606 z " /> + <path + style="fill:url(#linearGradient16591);fill-opacity:1;stroke:#677883;stroke-width:0.46877259;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path16539" + d="M 23.981782,-50.846435 L 36.765614,-61.588097 L 36.752498,-48.186223 L 24.037025,-37.40884 L 23.981782,-50.846435 z " /> + <rect + y="-40.584919" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient16593);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect16541" + height="0.78125" /> + <rect + y="-42.264622" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient16595);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect16543" + height="0.78125" /> + <rect + y="-43.944294" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient16597);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect16545" + height="0.78125" /> + <rect + y="-45.33102" + x="-86.609116" + width="1.5625" + style="fill:url(#radialGradient16599);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect16547" + height="0.78125" /> + </g> + </g> + <flowRoot + xml:space="preserve" + id="flowRoot16549" + style="font-size:17.99999953px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr;text-anchor:start;font-family:Arial" + transform="matrix(0.7525038,0,0,0.6775389,64.79681,269.22814)"><flowRegion + id="flowRegion16551"><rect + id="rect16553" + width="157.14285" + height="40" + x="194.28572" + y="475.52304" + style="font-size:17.99999953px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara23713">Load Balancer</flowPara></flowRoot> <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.22766685px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 273.86518,195.76282 L 748.4092,262.07055" + id="path21761" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.10209382px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 273.80239,258.50247 L 744.43138,197.3106" + id="path21763" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.76721847px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 757.61441,187.27341 L 757.61441,274.60058" + id="path23705" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend)" + d="M 131.31983,412.76445 L 238.396,364.27713" + id="path23715" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.03078127px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 277.57943,366.85652 L 399.22276,412.20536" + id="path25655" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend)" + d="M 258.59905,410.74414 L 258.59905,356.19591" + id="path25659" /> + <flowRoot + xml:space="preserve" + id="flowRoot27609" + style="font-family:Arial;font-weight:normal;font-style:normal;font-stretch:normal;font-variant:normal;font-size:18px;text-anchor:start;text-align:start;writing-mode:lr;line-height:125%"><flowRegion + id="flowRegion27611"><rect + id="rect27613" + width="105.05586" + height="34.345188" + x="96.974648" + y="113.75929" + style="font-family:Arial;font-weight:normal;font-style:normal;font-stretch:normal;font-variant:normal;font-size:18px;text-anchor:start;text-align:start;writing-mode:lr;line-height:125%" /></flowRegion><flowPara + id="flowPara27617">MirrorMode 1</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot27619" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr;text-anchor:start;font-family:Arial" + transform="translate(750.17468,-1.4171474)"><flowRegion + id="flowRegion27621"><rect + id="rect27623" + width="105.05586" + height="34.345188" + x="96.974648" + y="113.75929" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara27627">MirrorMode 2</flowPara></flowRoot> <path + d="M 103.99577,648.52356 C 103.99577,648.52356 103.75488,628.78956 123.98963,634.70975 C 144.22438,640.62995 140.61103,650.49696 140.85192,650.49696 C 141.09281,650.49696 137.23858,638.37464 152.65553,636.11932 C 166.62714,637.52889 173.13117,640.62995 172.4085,651.06079 C 171.68583,661.49163 164.94091,664.02886 164.94091,664.02886 C 164.94091,664.02886 177.2263,665.43843 173.85384,686.58202 C 168.55426,701.24157 168.55426,699.832 156.26888,701.52349 C 150.72841,698.98626 150.48752,696.73094 150.48752,696.73094 C 150.48752,696.73094 160.60489,707.72561 145.42883,714.77347 C 128.32565,720.12985 126.15764,715.3373 118.93094,712.80007 C 111.94514,707.72561 113.39048,701.52349 113.39048,701.52349 C 113.39048,701.52349 117.7265,711.95432 103.03221,713.92773 C 88.337924,715.90113 82.797457,711.95432 80.147668,695.8852 C 79.424999,683.76287 92.433052,682.63522 92.433052,682.63522 C 92.433052,682.63522 84.483686,682.91713 82.315677,676.71501 C 80.147668,670.51289 78.702329,662.33737 85.206355,651.3427 C 97.25085,638.09272 105.44111,646.83207 103.99577,648.52356 z " + id="path1503" + sodipodi:nodetypes="cccccccccccccccccc" + style="fill:#ffffff;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:0.78178847;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g1556" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(5.9849059e-2,0,0,6.3887019e-2,92.207875,643.07667)"> + <g + id="g770" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(107.0886,1.392441)"> + <path + d="M 299.842,180.38 L 177.215,74.367 L 250.791,71.9936 L 385.285,162.183 C 385.285,162.183 353.639,191.456 299.842,180.38 z " + id="path743" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g761" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 176.424,74.367 L 178.006,238.924 L 300.633,364.715 L 301.424,181.962 L 176.424,74.367 z " + id="path744" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g754" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 302.216,181.171 C 302.216,181.171 328.323,184.335 348.102,180.38 C 375,170.095 386.076,163.766 386.076,163.766 L 386.867,342.563 C 386.867,342.563 371.835,353.639 353.64,360.759 C 323.576,367.088 300.633,364.715 300.633,364.715 L 302.216,181.171 z " + id="path742" + sodipodi:nodetypes="ccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g749" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 315.665,205.696 C 315.665,205.696 378.956,192.247 378.956,193.038 C 378.956,193.829 378.165,218.354 378.165,218.354 C 378.165,218.354 316.456,231.804 315.665,231.804 C 314.874,231.804 314.874,207.278 315.665,205.696 z " + id="path745" + style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-1.58226,0)" /> + <path + d="M 323.576,246.835 L 370.253,237.342 L 370.253,241.298 L 323.576,251.582 L 323.576,246.835 z " + id="path746" + sodipodi:nodetypes="ccccc" + style="fill:#000100;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 360.76,268.987 L 372.627,267.405 L 372.627,279.272 L 360.76,281.646 L 360.76,268.987 z " + id="path747" + sodipodi:nodetypes="ccccc" + style="fill:#00b300;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 365.506,298.259 L 373.418,297.468 L 373.418,306.962 L 365.506,308.544 L 365.506,298.259 z " + id="path748" + sodipodi:nodetypes="ccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g818" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.868723,0,0,0.841809,-27.91207,15.52193)"> + <g + id="g801" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 119.557,425.383 L 119.557,438.102 L 435.832,344.83 L 436.68,329.568 L 119.557,425.383 z " + id="path607" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#b3b3b3;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <g + id="g798" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 166.193,347.374 L 119.557,426.231 L 436.68,329.568 L 345.104,298.194 L 166.193,347.374 z " + id="path606" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#cccccc;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <path + d="M 139.059,335.503 C 139.059,335.503 127.188,354.157 132.275,369.42 C 136.515,388.075 150.082,392.314 153.474,392.314 C 156.866,392.314 377.177,334.884 377.177,334.884 C 377.177,334.884 383.26,322.784 386.652,303.282 C 379.869,279.54 367.15,276.996 352.735,276.996 C 328.993,263.43 353.584,276.996 353.584,276.996 L 139.059,335.503 z " + id="path605" + sodipodi:nodetypes="cccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.708121,0,0,0.825311,71.30738,59.20586)" /> + </g> + </g> + <g + id="g811" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 420.57,16.6844 C 420.57,17.5323 399.371,11.5968 377.325,9.90093 C 367.15,10.7489 66.1379,65.8638 63.5942,65.8638 C 67.8338,65.0159 54.267,65.8638 50.8753,73.4951 C 47.4836,81.1264 47.4836,343.134 47.4836,343.134 C 47.4836,343.134 47.4837,350.766 52.5712,356.701 C 60.2025,360.093 80.5526,360.941 72.9213,360.941 L 420.57,16.6844 z " + id="path602" + sodipodi:nodetypes="cccccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g806" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 71.2332,108.009 L 418.873,40.4261 C 423.961,43.8178 429.049,41.2741 431.593,51.4492 C 434.137,61.6241 430.745,304.978 430.745,304.978 C 430.745,304.978 432.44,312.609 426.505,316.849 C 420.569,321.088 79.6699,416.904 79.6699,416.904 C 79.6699,416.904 69.4946,421.143 63.5593,412.664 C 55.0803,410.121 60.2025,124.37 60.2025,124.37 C 60.2025,124.37 61.0271,110.72 71.2332,108.009 z " + id="path600" + sodipodi:nodetypes="ccccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.995445,0,0,0.910163,2.817975,-20.11005)" /> + <g + id="g795" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 89.0318,98.0844 L 394.284,38.7303 C 394.284,38.7303 401.915,36.1865 407.851,45.5137 C 413.786,54.8408 412.09,59.0804 412.09,59.0804 L 412.09,234.6 C 411.242,243.927 412.938,240.535 407.851,250.711 C 397.675,254.102 105.142,333.807 105.142,333.807 C 105.142,333.807 105.142,335.503 94.9673,333.807 C 84.7922,332.111 81.4005,316.001 81.4005,315.153 C 81.4005,314.305 78.0088,115.891 78.0088,115.891 C 78.0088,115.891 79.7048,101.476 89.0318,98.0844 z " + id="path603" + sodipodi:nodetypes="ccccccccccc" + style="fill:url(#linearGradient614);fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 368.846,266.821 L 398.523,258.342 L 398.523,271.909 C 398.523,271.909 368.846,279.54 368.846,280.388 C 368.846,281.236 368.846,266.821 368.846,266.821 z " + id="path604" + sodipodi:nodetypes="ccccc" + style="fill:#00feb3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g878" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(1.060794,0,0,0.913679,-36.3605,196.9337)"> + <g + id="g875" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 35.6013,306.962 L 454.114,242.088 L 454.114,266.614 L 35.6012,332.279 L 35.6013,306.962 z " + id="path831" + sodipodi:nodetypes="ccccc" + style="fill:#b2b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(3.955698,-6.329117)" /> + <path + d="M 39.557,300.633 C 41.9304,296.677 90.981,199.367 90.981,199.367 L 371.044,173.259 L 458.07,235.759 L 39.557,300.633 z " + id="path832" + sodipodi:nodetypes="ccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g859" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <g + id="g844" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 331.487,184.335 C 331.487,184.335 332.279,193.038 332.279,193.829 C 332.279,194.62 366.298,234.177 366.298,234.177 L 424.051,224.683 L 423.26,218.354 L 422.468,218.354 L 331.487,184.335 z " + id="path841" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 332.279,184.336 L 369.462,180.38 L 424.051,218.354 L 370.253,225.475 L 332.279,184.336 z " + id="path840" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g847" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 297.468,195.411 C 297.468,195.411 297.468,203.323 297.468,204.114 C 297.468,204.905 318.038,241.297 318.829,241.297 C 319.62,241.297 353.639,236.551 353.639,236.551 L 352.057,227.057" + id="path843" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 298.26,195.411 C 299.051,195.411 322.785,193.038 322.785,193.038 L 352.848,227.057 L 321.994,231.804 L 298.26,195.411 z " + id="path842" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g850" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.1899,208.861 L 98.1013,195.411 L 272.943,178.006 L 282.437,189.082 L 90.1899,208.861 z " + id="path833" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 90.1899,209.652 L 89.3988,215.19 L 282.437,194.62 L 282.437,188.291 L 90.1899,209.652 z " + id="path834" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g853" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.981,215.981 L 287.184,194.62 L 309.336,229.43 L 71.9936,261.867 L 90.981,215.981 z " + id="path835" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 71.9937,261.076 L 71.2026,268.987 L 309.336,236.551 C 310.127,236.551 308.544,230.221 308.544,229.43 C 308.544,228.639 71.9937,263.449 71.9937,261.076 z " + id="path836" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g856" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 82.2785,274.525 L 301.424,242.089 L 306.171,250.791 L 79.9051,284.019 L 82.2785,274.525 z " + id="path838" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 79.1139,284.81 L 79.1139,291.93 L 306.171,255.538 L 305.38,250 L 79.1139,284.81 z " + id="path839" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g1647" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(5.9849059e-2,0,0,6.3887019e-2,135.04094,644.20433)"> + <g + id="g1648" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(107.0886,1.392441)"> + <path + d="M 299.842,180.38 L 177.215,74.367 L 250.791,71.9936 L 385.285,162.183 C 385.285,162.183 353.639,191.456 299.842,180.38 z " + id="path1649" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g1650" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 176.424,74.367 L 178.006,238.924 L 300.633,364.715 L 301.424,181.962 L 176.424,74.367 z " + id="path1651" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g1652" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 302.216,181.171 C 302.216,181.171 328.323,184.335 348.102,180.38 C 375,170.095 386.076,163.766 386.076,163.766 L 386.867,342.563 C 386.867,342.563 371.835,353.639 353.64,360.759 C 323.576,367.088 300.633,364.715 300.633,364.715 L 302.216,181.171 z " + id="path1653" + sodipodi:nodetypes="ccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g1654" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 315.665,205.696 C 315.665,205.696 378.956,192.247 378.956,193.038 C 378.956,193.829 378.165,218.354 378.165,218.354 C 378.165,218.354 316.456,231.804 315.665,231.804 C 314.874,231.804 314.874,207.278 315.665,205.696 z " + id="path1655" + style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-1.58226,0)" /> + <path + d="M 323.576,246.835 L 370.253,237.342 L 370.253,241.298 L 323.576,251.582 L 323.576,246.835 z " + id="path1656" + sodipodi:nodetypes="ccccc" + style="fill:#000100;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 360.76,268.987 L 372.627,267.405 L 372.627,279.272 L 360.76,281.646 L 360.76,268.987 z " + id="path1657" + sodipodi:nodetypes="ccccc" + style="fill:#00b300;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 365.506,298.259 L 373.418,297.468 L 373.418,306.962 L 365.506,308.544 L 365.506,298.259 z " + id="path1658" + sodipodi:nodetypes="ccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g1659" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.868723,0,0,0.841809,-27.91207,15.52193)"> + <g + id="g1660" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 119.557,425.383 L 119.557,438.102 L 435.832,344.83 L 436.68,329.568 L 119.557,425.383 z " + id="path1661" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#b3b3b3;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <g + id="g1662" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 166.193,347.374 L 119.557,426.231 L 436.68,329.568 L 345.104,298.194 L 166.193,347.374 z " + id="path1663" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#cccccc;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <path + d="M 139.059,335.503 C 139.059,335.503 127.188,354.157 132.275,369.42 C 136.515,388.075 150.082,392.314 153.474,392.314 C 156.866,392.314 377.177,334.884 377.177,334.884 C 377.177,334.884 383.26,322.784 386.652,303.282 C 379.869,279.54 367.15,276.996 352.735,276.996 C 328.993,263.43 353.584,276.996 353.584,276.996 L 139.059,335.503 z " + id="path1664" + sodipodi:nodetypes="cccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.708121,0,0,0.825311,71.30738,59.20586)" /> + </g> + </g> + <g + id="g1665" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 420.57,16.6844 C 420.57,17.5323 399.371,11.5968 377.325,9.90093 C 367.15,10.7489 66.1379,65.8638 63.5942,65.8638 C 67.8338,65.0159 54.267,65.8638 50.8753,73.4951 C 47.4836,81.1264 47.4836,343.134 47.4836,343.134 C 47.4836,343.134 47.4837,350.766 52.5712,356.701 C 60.2025,360.093 80.5526,360.941 72.9213,360.941 L 420.57,16.6844 z " + id="path1666" + sodipodi:nodetypes="cccccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g1667" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 71.2332,108.009 L 418.873,40.4261 C 423.961,43.8178 429.049,41.2741 431.593,51.4492 C 434.137,61.6241 430.745,304.978 430.745,304.978 C 430.745,304.978 432.44,312.609 426.505,316.849 C 420.569,321.088 79.6699,416.904 79.6699,416.904 C 79.6699,416.904 69.4946,421.143 63.5593,412.664 C 55.0803,410.121 60.2025,124.37 60.2025,124.37 C 60.2025,124.37 61.0271,110.72 71.2332,108.009 z " + id="path1668" + sodipodi:nodetypes="ccccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.995445,0,0,0.910163,2.817975,-20.11005)" /> + <g + id="g1669" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 89.0318,98.0844 L 394.284,38.7303 C 394.284,38.7303 401.915,36.1865 407.851,45.5137 C 413.786,54.8408 412.09,59.0804 412.09,59.0804 L 412.09,234.6 C 411.242,243.927 412.938,240.535 407.851,250.711 C 397.675,254.102 105.142,333.807 105.142,333.807 C 105.142,333.807 105.142,335.503 94.9673,333.807 C 84.7922,332.111 81.4005,316.001 81.4005,315.153 C 81.4005,314.305 78.0088,115.891 78.0088,115.891 C 78.0088,115.891 79.7048,101.476 89.0318,98.0844 z " + id="path1670" + sodipodi:nodetypes="ccccccccccc" + style="fill:url(#linearGradient614);fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 368.846,266.821 L 398.523,258.342 L 398.523,271.909 C 398.523,271.909 368.846,279.54 368.846,280.388 C 368.846,281.236 368.846,266.821 368.846,266.821 z " + id="path1671" + sodipodi:nodetypes="ccccc" + style="fill:#00feb3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g1672" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(1.060794,0,0,0.913679,-36.3605,196.9337)"> + <g + id="g1673" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 35.6013,306.962 L 454.114,242.088 L 454.114,266.614 L 35.6012,332.279 L 35.6013,306.962 z " + id="path1674" + sodipodi:nodetypes="ccccc" + style="fill:#b2b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(3.955698,-6.329117)" /> + <path + d="M 39.557,300.633 C 41.9304,296.677 90.981,199.367 90.981,199.367 L 371.044,173.259 L 458.07,235.759 L 39.557,300.633 z " + id="path1675" + sodipodi:nodetypes="ccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g1676" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <g + id="g1677" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 331.487,184.335 C 331.487,184.335 332.279,193.038 332.279,193.829 C 332.279,194.62 366.298,234.177 366.298,234.177 L 424.051,224.683 L 423.26,218.354 L 422.468,218.354 L 331.487,184.335 z " + id="path1678" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 332.279,184.336 L 369.462,180.38 L 424.051,218.354 L 370.253,225.475 L 332.279,184.336 z " + id="path1679" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g1680" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 297.468,195.411 C 297.468,195.411 297.468,203.323 297.468,204.114 C 297.468,204.905 318.038,241.297 318.829,241.297 C 319.62,241.297 353.639,236.551 353.639,236.551 L 352.057,227.057" + id="path1681" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 298.26,195.411 C 299.051,195.411 322.785,193.038 322.785,193.038 L 352.848,227.057 L 321.994,231.804 L 298.26,195.411 z " + id="path1682" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g1683" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.1899,208.861 L 98.1013,195.411 L 272.943,178.006 L 282.437,189.082 L 90.1899,208.861 z " + id="path1684" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 90.1899,209.652 L 89.3988,215.19 L 282.437,194.62 L 282.437,188.291 L 90.1899,209.652 z " + id="path1685" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g1686" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.981,215.981 L 287.184,194.62 L 309.336,229.43 L 71.9936,261.867 L 90.981,215.981 z " + id="path1687" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 71.9937,261.076 L 71.2026,268.987 L 309.336,236.551 C 310.127,236.551 308.544,230.221 308.544,229.43 C 308.544,228.639 71.9937,263.449 71.9937,261.076 z " + id="path1688" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g1689" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 82.2785,274.525 L 301.424,242.089 L 306.171,250.791 L 79.9051,284.019 L 82.2785,274.525 z " + id="path1690" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 79.1139,284.81 L 79.1139,291.93 L 306.171,255.538 L 305.38,250 L 79.1139,284.81 z " + id="path1691" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g1692" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(5.9849059e-2,0,0,6.3887019e-2,112.49722,673.80536)"> + <g + id="g1693" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(107.0886,1.392441)"> + <path + d="M 299.842,180.38 L 177.215,74.367 L 250.791,71.9936 L 385.285,162.183 C 385.285,162.183 353.639,191.456 299.842,180.38 z " + id="path1694" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g1695" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 176.424,74.367 L 178.006,238.924 L 300.633,364.715 L 301.424,181.962 L 176.424,74.367 z " + id="path1696" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g1697" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 302.216,181.171 C 302.216,181.171 328.323,184.335 348.102,180.38 C 375,170.095 386.076,163.766 386.076,163.766 L 386.867,342.563 C 386.867,342.563 371.835,353.639 353.64,360.759 C 323.576,367.088 300.633,364.715 300.633,364.715 L 302.216,181.171 z " + id="path1698" + sodipodi:nodetypes="ccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g1699" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 315.665,205.696 C 315.665,205.696 378.956,192.247 378.956,193.038 C 378.956,193.829 378.165,218.354 378.165,218.354 C 378.165,218.354 316.456,231.804 315.665,231.804 C 314.874,231.804 314.874,207.278 315.665,205.696 z " + id="path1700" + style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-1.58226,0)" /> + <path + d="M 323.576,246.835 L 370.253,237.342 L 370.253,241.298 L 323.576,251.582 L 323.576,246.835 z " + id="path1701" + sodipodi:nodetypes="ccccc" + style="fill:#000100;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 360.76,268.987 L 372.627,267.405 L 372.627,279.272 L 360.76,281.646 L 360.76,268.987 z " + id="path1702" + sodipodi:nodetypes="ccccc" + style="fill:#00b300;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 365.506,298.259 L 373.418,297.468 L 373.418,306.962 L 365.506,308.544 L 365.506,298.259 z " + id="path1703" + sodipodi:nodetypes="ccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g1704" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.868723,0,0,0.841809,-27.91207,15.52193)"> + <g + id="g1705" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 119.557,425.383 L 119.557,438.102 L 435.832,344.83 L 436.68,329.568 L 119.557,425.383 z " + id="path1706" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#b3b3b3;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <g + id="g1707" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 166.193,347.374 L 119.557,426.231 L 436.68,329.568 L 345.104,298.194 L 166.193,347.374 z " + id="path1708" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#cccccc;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <path + d="M 139.059,335.503 C 139.059,335.503 127.188,354.157 132.275,369.42 C 136.515,388.075 150.082,392.314 153.474,392.314 C 156.866,392.314 377.177,334.884 377.177,334.884 C 377.177,334.884 383.26,322.784 386.652,303.282 C 379.869,279.54 367.15,276.996 352.735,276.996 C 328.993,263.43 353.584,276.996 353.584,276.996 L 139.059,335.503 z " + id="path1709" + sodipodi:nodetypes="cccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.708121,0,0,0.825311,71.30738,59.20586)" /> + </g> + </g> + <g + id="g1710" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 420.57,16.6844 C 420.57,17.5323 399.371,11.5968 377.325,9.90093 C 367.15,10.7489 66.1379,65.8638 63.5942,65.8638 C 67.8338,65.0159 54.267,65.8638 50.8753,73.4951 C 47.4836,81.1264 47.4836,343.134 47.4836,343.134 C 47.4836,343.134 47.4837,350.766 52.5712,356.701 C 60.2025,360.093 80.5526,360.941 72.9213,360.941 L 420.57,16.6844 z " + id="path1711" + sodipodi:nodetypes="cccccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g1712" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 71.2332,108.009 L 418.873,40.4261 C 423.961,43.8178 429.049,41.2741 431.593,51.4492 C 434.137,61.6241 430.745,304.978 430.745,304.978 C 430.745,304.978 432.44,312.609 426.505,316.849 C 420.569,321.088 79.6699,416.904 79.6699,416.904 C 79.6699,416.904 69.4946,421.143 63.5593,412.664 C 55.0803,410.121 60.2025,124.37 60.2025,124.37 C 60.2025,124.37 61.0271,110.72 71.2332,108.009 z " + id="path1713" + sodipodi:nodetypes="ccccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.995445,0,0,0.910163,2.817975,-20.11005)" /> + <g + id="g1714" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 89.0318,98.0844 L 394.284,38.7303 C 394.284,38.7303 401.915,36.1865 407.851,45.5137 C 413.786,54.8408 412.09,59.0804 412.09,59.0804 L 412.09,234.6 C 411.242,243.927 412.938,240.535 407.851,250.711 C 397.675,254.102 105.142,333.807 105.142,333.807 C 105.142,333.807 105.142,335.503 94.9673,333.807 C 84.7922,332.111 81.4005,316.001 81.4005,315.153 C 81.4005,314.305 78.0088,115.891 78.0088,115.891 C 78.0088,115.891 79.7048,101.476 89.0318,98.0844 z " + id="path1715" + sodipodi:nodetypes="ccccccccccc" + style="fill:url(#linearGradient614);fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 368.846,266.821 L 398.523,258.342 L 398.523,271.909 C 398.523,271.909 368.846,279.54 368.846,280.388 C 368.846,281.236 368.846,266.821 368.846,266.821 z " + id="path1716" + sodipodi:nodetypes="ccccc" + style="fill:#00feb3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g1717" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(1.060794,0,0,0.913679,-36.3605,196.9337)"> + <g + id="g1718" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 35.6013,306.962 L 454.114,242.088 L 454.114,266.614 L 35.6012,332.279 L 35.6013,306.962 z " + id="path1719" + sodipodi:nodetypes="ccccc" + style="fill:#b2b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(3.955698,-6.329117)" /> + <path + d="M 39.557,300.633 C 41.9304,296.677 90.981,199.367 90.981,199.367 L 371.044,173.259 L 458.07,235.759 L 39.557,300.633 z " + id="path1720" + sodipodi:nodetypes="ccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g1721" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <g + id="g1722" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 331.487,184.335 C 331.487,184.335 332.279,193.038 332.279,193.829 C 332.279,194.62 366.298,234.177 366.298,234.177 L 424.051,224.683 L 423.26,218.354 L 422.468,218.354 L 331.487,184.335 z " + id="path1723" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 332.279,184.336 L 369.462,180.38 L 424.051,218.354 L 370.253,225.475 L 332.279,184.336 z " + id="path1724" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g1725" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 297.468,195.411 C 297.468,195.411 297.468,203.323 297.468,204.114 C 297.468,204.905 318.038,241.297 318.829,241.297 C 319.62,241.297 353.639,236.551 353.639,236.551 L 352.057,227.057" + id="path1726" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 298.26,195.411 C 299.051,195.411 322.785,193.038 322.785,193.038 L 352.848,227.057 L 321.994,231.804 L 298.26,195.411 z " + id="path1727" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g1728" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.1899,208.861 L 98.1013,195.411 L 272.943,178.006 L 282.437,189.082 L 90.1899,208.861 z " + id="path1729" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 90.1899,209.652 L 89.3988,215.19 L 282.437,194.62 L 282.437,188.291 L 90.1899,209.652 z " + id="path1730" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g1731" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.981,215.981 L 287.184,194.62 L 309.336,229.43 L 71.9936,261.867 L 90.981,215.981 z " + id="path1732" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 71.9937,261.076 L 71.2026,268.987 L 309.336,236.551 C 310.127,236.551 308.544,230.221 308.544,229.43 C 308.544,228.639 71.9937,263.449 71.9937,261.076 z " + id="path1733" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g1734" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 82.2785,274.525 L 301.424,242.089 L 306.171,250.791 L 79.9051,284.019 L 82.2785,274.525 z " + id="path1735" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 79.1139,284.81 L 79.1139,291.93 L 306.171,255.538 L 305.38,250 L 79.1139,284.81 z " + id="path1736" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.89171284px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 182.78346,673.43795 L 255.62274,616.76111" + id="path28400" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.90486449px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 745.21711,622.36338 L 838.70209,667.83568" + id="path28404" /> + <path + d="M 879.79292,636.40173 C 879.79292,636.40173 879.55203,616.66773 899.78678,622.58792 C 920.02153,628.50812 916.40818,638.37513 916.64907,638.37513 C 916.88996,638.37513 913.03573,626.25281 928.45268,623.99749 C 942.42429,625.40706 948.92832,628.50812 948.20565,638.93896 C 947.48298,649.3698 940.73806,651.90703 940.73806,651.90703 C 940.73806,651.90703 953.02345,653.3166 949.65099,674.46019 C 944.35141,689.11974 944.35141,687.71017 932.06603,689.40166 C 926.52556,686.86443 926.28467,684.60911 926.28467,684.60911 C 926.28467,684.60911 936.40204,695.60378 921.22598,702.65164 C 904.1228,708.00802 901.95479,703.21547 894.72809,700.67824 C 887.74229,695.60378 889.18763,689.40166 889.18763,689.40166 C 889.18763,689.40166 893.52365,699.83249 878.82936,701.8059 C 864.13507,703.7793 858.59461,699.83249 855.94482,683.76337 C 855.22215,671.64104 868.2302,670.51339 868.2302,670.51339 C 868.2302,670.51339 860.28083,670.7953 858.11283,664.59318 C 855.94482,658.39106 854.49948,650.21554 861.0035,639.22087 C 873.048,625.97089 881.23826,634.71024 879.79292,636.40173 z " + id="path28406" + sodipodi:nodetypes="cccccccccccccccccc" + style="fill:#ffffff;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:0.78178847;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28408" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(5.9849059e-2,0,0,6.3887019e-2,868.00502,630.95484)"> + <g + id="g28410" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(107.0886,1.392441)"> + <path + d="M 299.842,180.38 L 177.215,74.367 L 250.791,71.9936 L 385.285,162.183 C 385.285,162.183 353.639,191.456 299.842,180.38 z " + id="path28412" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28414" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 176.424,74.367 L 178.006,238.924 L 300.633,364.715 L 301.424,181.962 L 176.424,74.367 z " + id="path28416" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28418" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 302.216,181.171 C 302.216,181.171 328.323,184.335 348.102,180.38 C 375,170.095 386.076,163.766 386.076,163.766 L 386.867,342.563 C 386.867,342.563 371.835,353.639 353.64,360.759 C 323.576,367.088 300.633,364.715 300.633,364.715 L 302.216,181.171 z " + id="path28420" + sodipodi:nodetypes="ccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28422" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 315.665,205.696 C 315.665,205.696 378.956,192.247 378.956,193.038 C 378.956,193.829 378.165,218.354 378.165,218.354 C 378.165,218.354 316.456,231.804 315.665,231.804 C 314.874,231.804 314.874,207.278 315.665,205.696 z " + id="path28424" + style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-1.58226,0)" /> + <path + d="M 323.576,246.835 L 370.253,237.342 L 370.253,241.298 L 323.576,251.582 L 323.576,246.835 z " + id="path28426" + sodipodi:nodetypes="ccccc" + style="fill:#000100;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 360.76,268.987 L 372.627,267.405 L 372.627,279.272 L 360.76,281.646 L 360.76,268.987 z " + id="path28428" + sodipodi:nodetypes="ccccc" + style="fill:#00b300;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 365.506,298.259 L 373.418,297.468 L 373.418,306.962 L 365.506,308.544 L 365.506,298.259 z " + id="path28430" + sodipodi:nodetypes="ccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g28432" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.868723,0,0,0.841809,-27.91207,15.52193)"> + <g + id="g28434" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 119.557,425.383 L 119.557,438.102 L 435.832,344.83 L 436.68,329.568 L 119.557,425.383 z " + id="path28436" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#b3b3b3;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <g + id="g28438" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 166.193,347.374 L 119.557,426.231 L 436.68,329.568 L 345.104,298.194 L 166.193,347.374 z " + id="path28440" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#cccccc;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <path + d="M 139.059,335.503 C 139.059,335.503 127.188,354.157 132.275,369.42 C 136.515,388.075 150.082,392.314 153.474,392.314 C 156.866,392.314 377.177,334.884 377.177,334.884 C 377.177,334.884 383.26,322.784 386.652,303.282 C 379.869,279.54 367.15,276.996 352.735,276.996 C 328.993,263.43 353.584,276.996 353.584,276.996 L 139.059,335.503 z " + id="path28442" + sodipodi:nodetypes="cccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.708121,0,0,0.825311,71.30738,59.20586)" /> + </g> + </g> + <g + id="g28444" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 420.57,16.6844 C 420.57,17.5323 399.371,11.5968 377.325,9.90093 C 367.15,10.7489 66.1379,65.8638 63.5942,65.8638 C 67.8338,65.0159 54.267,65.8638 50.8753,73.4951 C 47.4836,81.1264 47.4836,343.134 47.4836,343.134 C 47.4836,343.134 47.4837,350.766 52.5712,356.701 C 60.2025,360.093 80.5526,360.941 72.9213,360.941 L 420.57,16.6844 z " + id="path28446" + sodipodi:nodetypes="cccccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28448" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 71.2332,108.009 L 418.873,40.4261 C 423.961,43.8178 429.049,41.2741 431.593,51.4492 C 434.137,61.6241 430.745,304.978 430.745,304.978 C 430.745,304.978 432.44,312.609 426.505,316.849 C 420.569,321.088 79.6699,416.904 79.6699,416.904 C 79.6699,416.904 69.4946,421.143 63.5593,412.664 C 55.0803,410.121 60.2025,124.37 60.2025,124.37 C 60.2025,124.37 61.0271,110.72 71.2332,108.009 z " + id="path28450" + sodipodi:nodetypes="ccccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.995445,0,0,0.910163,2.817975,-20.11005)" /> + <g + id="g28452" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 89.0318,98.0844 L 394.284,38.7303 C 394.284,38.7303 401.915,36.1865 407.851,45.5137 C 413.786,54.8408 412.09,59.0804 412.09,59.0804 L 412.09,234.6 C 411.242,243.927 412.938,240.535 407.851,250.711 C 397.675,254.102 105.142,333.807 105.142,333.807 C 105.142,333.807 105.142,335.503 94.9673,333.807 C 84.7922,332.111 81.4005,316.001 81.4005,315.153 C 81.4005,314.305 78.0088,115.891 78.0088,115.891 C 78.0088,115.891 79.7048,101.476 89.0318,98.0844 z " + id="path28454" + sodipodi:nodetypes="ccccccccccc" + style="fill:url(#linearGradient614);fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 368.846,266.821 L 398.523,258.342 L 398.523,271.909 C 398.523,271.909 368.846,279.54 368.846,280.388 C 368.846,281.236 368.846,266.821 368.846,266.821 z " + id="path28456" + sodipodi:nodetypes="ccccc" + style="fill:#00feb3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g28458" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(1.060794,0,0,0.913679,-36.3605,196.9337)"> + <g + id="g28460" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 35.6013,306.962 L 454.114,242.088 L 454.114,266.614 L 35.6012,332.279 L 35.6013,306.962 z " + id="path28462" + sodipodi:nodetypes="ccccc" + style="fill:#b2b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(3.955698,-6.329117)" /> + <path + d="M 39.557,300.633 C 41.9304,296.677 90.981,199.367 90.981,199.367 L 371.044,173.259 L 458.07,235.759 L 39.557,300.633 z " + id="path28464" + sodipodi:nodetypes="ccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28466" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <g + id="g28468" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 331.487,184.335 C 331.487,184.335 332.279,193.038 332.279,193.829 C 332.279,194.62 366.298,234.177 366.298,234.177 L 424.051,224.683 L 423.26,218.354 L 422.468,218.354 L 331.487,184.335 z " + id="path28470" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 332.279,184.336 L 369.462,180.38 L 424.051,218.354 L 370.253,225.475 L 332.279,184.336 z " + id="path28472" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28474" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 297.468,195.411 C 297.468,195.411 297.468,203.323 297.468,204.114 C 297.468,204.905 318.038,241.297 318.829,241.297 C 319.62,241.297 353.639,236.551 353.639,236.551 L 352.057,227.057" + id="path28476" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 298.26,195.411 C 299.051,195.411 322.785,193.038 322.785,193.038 L 352.848,227.057 L 321.994,231.804 L 298.26,195.411 z " + id="path28478" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28480" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.1899,208.861 L 98.1013,195.411 L 272.943,178.006 L 282.437,189.082 L 90.1899,208.861 z " + id="path28482" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 90.1899,209.652 L 89.3988,215.19 L 282.437,194.62 L 282.437,188.291 L 90.1899,209.652 z " + id="path28484" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28486" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.981,215.981 L 287.184,194.62 L 309.336,229.43 L 71.9936,261.867 L 90.981,215.981 z " + id="path28488" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 71.9937,261.076 L 71.2026,268.987 L 309.336,236.551 C 310.127,236.551 308.544,230.221 308.544,229.43 C 308.544,228.639 71.9937,263.449 71.9937,261.076 z " + id="path28490" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28492" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 82.2785,274.525 L 301.424,242.089 L 306.171,250.791 L 79.9051,284.019 L 82.2785,274.525 z " + id="path28494" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 79.1139,284.81 L 79.1139,291.93 L 306.171,255.538 L 305.38,250 L 79.1139,284.81 z " + id="path28496" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g28498" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(5.9849059e-2,0,0,6.3887019e-2,910.83809,632.0825)"> + <g + id="g28500" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(107.0886,1.392441)"> + <path + d="M 299.842,180.38 L 177.215,74.367 L 250.791,71.9936 L 385.285,162.183 C 385.285,162.183 353.639,191.456 299.842,180.38 z " + id="path28502" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28504" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 176.424,74.367 L 178.006,238.924 L 300.633,364.715 L 301.424,181.962 L 176.424,74.367 z " + id="path28506" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28508" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 302.216,181.171 C 302.216,181.171 328.323,184.335 348.102,180.38 C 375,170.095 386.076,163.766 386.076,163.766 L 386.867,342.563 C 386.867,342.563 371.835,353.639 353.64,360.759 C 323.576,367.088 300.633,364.715 300.633,364.715 L 302.216,181.171 z " + id="path28510" + sodipodi:nodetypes="ccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28512" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 315.665,205.696 C 315.665,205.696 378.956,192.247 378.956,193.038 C 378.956,193.829 378.165,218.354 378.165,218.354 C 378.165,218.354 316.456,231.804 315.665,231.804 C 314.874,231.804 314.874,207.278 315.665,205.696 z " + id="path28514" + style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-1.58226,0)" /> + <path + d="M 323.576,246.835 L 370.253,237.342 L 370.253,241.298 L 323.576,251.582 L 323.576,246.835 z " + id="path28516" + sodipodi:nodetypes="ccccc" + style="fill:#000100;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 360.76,268.987 L 372.627,267.405 L 372.627,279.272 L 360.76,281.646 L 360.76,268.987 z " + id="path28518" + sodipodi:nodetypes="ccccc" + style="fill:#00b300;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 365.506,298.259 L 373.418,297.468 L 373.418,306.962 L 365.506,308.544 L 365.506,298.259 z " + id="path28520" + sodipodi:nodetypes="ccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g28522" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.868723,0,0,0.841809,-27.91207,15.52193)"> + <g + id="g28524" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 119.557,425.383 L 119.557,438.102 L 435.832,344.83 L 436.68,329.568 L 119.557,425.383 z " + id="path28526" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#b3b3b3;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <g + id="g28528" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 166.193,347.374 L 119.557,426.231 L 436.68,329.568 L 345.104,298.194 L 166.193,347.374 z " + id="path28530" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#cccccc;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <path + d="M 139.059,335.503 C 139.059,335.503 127.188,354.157 132.275,369.42 C 136.515,388.075 150.082,392.314 153.474,392.314 C 156.866,392.314 377.177,334.884 377.177,334.884 C 377.177,334.884 383.26,322.784 386.652,303.282 C 379.869,279.54 367.15,276.996 352.735,276.996 C 328.993,263.43 353.584,276.996 353.584,276.996 L 139.059,335.503 z " + id="path28532" + sodipodi:nodetypes="cccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.708121,0,0,0.825311,71.30738,59.20586)" /> + </g> + </g> + <g + id="g28534" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 420.57,16.6844 C 420.57,17.5323 399.371,11.5968 377.325,9.90093 C 367.15,10.7489 66.1379,65.8638 63.5942,65.8638 C 67.8338,65.0159 54.267,65.8638 50.8753,73.4951 C 47.4836,81.1264 47.4836,343.134 47.4836,343.134 C 47.4836,343.134 47.4837,350.766 52.5712,356.701 C 60.2025,360.093 80.5526,360.941 72.9213,360.941 L 420.57,16.6844 z " + id="path28536" + sodipodi:nodetypes="cccccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28538" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 71.2332,108.009 L 418.873,40.4261 C 423.961,43.8178 429.049,41.2741 431.593,51.4492 C 434.137,61.6241 430.745,304.978 430.745,304.978 C 430.745,304.978 432.44,312.609 426.505,316.849 C 420.569,321.088 79.6699,416.904 79.6699,416.904 C 79.6699,416.904 69.4946,421.143 63.5593,412.664 C 55.0803,410.121 60.2025,124.37 60.2025,124.37 C 60.2025,124.37 61.0271,110.72 71.2332,108.009 z " + id="path28540" + sodipodi:nodetypes="ccccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.995445,0,0,0.910163,2.817975,-20.11005)" /> + <g + id="g28542" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 89.0318,98.0844 L 394.284,38.7303 C 394.284,38.7303 401.915,36.1865 407.851,45.5137 C 413.786,54.8408 412.09,59.0804 412.09,59.0804 L 412.09,234.6 C 411.242,243.927 412.938,240.535 407.851,250.711 C 397.675,254.102 105.142,333.807 105.142,333.807 C 105.142,333.807 105.142,335.503 94.9673,333.807 C 84.7922,332.111 81.4005,316.001 81.4005,315.153 C 81.4005,314.305 78.0088,115.891 78.0088,115.891 C 78.0088,115.891 79.7048,101.476 89.0318,98.0844 z " + id="path28544" + sodipodi:nodetypes="ccccccccccc" + style="fill:url(#linearGradient614);fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 368.846,266.821 L 398.523,258.342 L 398.523,271.909 C 398.523,271.909 368.846,279.54 368.846,280.388 C 368.846,281.236 368.846,266.821 368.846,266.821 z " + id="path28546" + sodipodi:nodetypes="ccccc" + style="fill:#00feb3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g28548" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(1.060794,0,0,0.913679,-36.3605,196.9337)"> + <g + id="g28550" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 35.6013,306.962 L 454.114,242.088 L 454.114,266.614 L 35.6012,332.279 L 35.6013,306.962 z " + id="path28552" + sodipodi:nodetypes="ccccc" + style="fill:#b2b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(3.955698,-6.329117)" /> + <path + d="M 39.557,300.633 C 41.9304,296.677 90.981,199.367 90.981,199.367 L 371.044,173.259 L 458.07,235.759 L 39.557,300.633 z " + id="path28554" + sodipodi:nodetypes="ccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28556" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <g + id="g28558" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 331.487,184.335 C 331.487,184.335 332.279,193.038 332.279,193.829 C 332.279,194.62 366.298,234.177 366.298,234.177 L 424.051,224.683 L 423.26,218.354 L 422.468,218.354 L 331.487,184.335 z " + id="path28560" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 332.279,184.336 L 369.462,180.38 L 424.051,218.354 L 370.253,225.475 L 332.279,184.336 z " + id="path28562" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28564" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 297.468,195.411 C 297.468,195.411 297.468,203.323 297.468,204.114 C 297.468,204.905 318.038,241.297 318.829,241.297 C 319.62,241.297 353.639,236.551 353.639,236.551 L 352.057,227.057" + id="path28566" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 298.26,195.411 C 299.051,195.411 322.785,193.038 322.785,193.038 L 352.848,227.057 L 321.994,231.804 L 298.26,195.411 z " + id="path28568" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28570" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.1899,208.861 L 98.1013,195.411 L 272.943,178.006 L 282.437,189.082 L 90.1899,208.861 z " + id="path28572" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 90.1899,209.652 L 89.3988,215.19 L 282.437,194.62 L 282.437,188.291 L 90.1899,209.652 z " + id="path28574" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28576" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.981,215.981 L 287.184,194.62 L 309.336,229.43 L 71.9936,261.867 L 90.981,215.981 z " + id="path28578" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 71.9937,261.076 L 71.2026,268.987 L 309.336,236.551 C 310.127,236.551 308.544,230.221 308.544,229.43 C 308.544,228.639 71.9937,263.449 71.9937,261.076 z " + id="path28580" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28582" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 82.2785,274.525 L 301.424,242.089 L 306.171,250.791 L 79.9051,284.019 L 82.2785,274.525 z " + id="path28584" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 79.1139,284.81 L 79.1139,291.93 L 306.171,255.538 L 305.38,250 L 79.1139,284.81 z " + id="path28586" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g28588" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(5.9849059e-2,0,0,6.3887019e-2,888.29437,661.68353)"> + <g + id="g28590" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(107.0886,1.392441)"> + <path + d="M 299.842,180.38 L 177.215,74.367 L 250.791,71.9936 L 385.285,162.183 C 385.285,162.183 353.639,191.456 299.842,180.38 z " + id="path28592" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28594" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 176.424,74.367 L 178.006,238.924 L 300.633,364.715 L 301.424,181.962 L 176.424,74.367 z " + id="path28596" + sodipodi:nodetypes="ccccc" + style="fill:#b3b2b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28598" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 302.216,181.171 C 302.216,181.171 328.323,184.335 348.102,180.38 C 375,170.095 386.076,163.766 386.076,163.766 L 386.867,342.563 C 386.867,342.563 371.835,353.639 353.64,360.759 C 323.576,367.088 300.633,364.715 300.633,364.715 L 302.216,181.171 z " + id="path28600" + sodipodi:nodetypes="ccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:bevel;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28602" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 315.665,205.696 C 315.665,205.696 378.956,192.247 378.956,193.038 C 378.956,193.829 378.165,218.354 378.165,218.354 C 378.165,218.354 316.456,231.804 315.665,231.804 C 314.874,231.804 314.874,207.278 315.665,205.696 z " + id="path28604" + style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-1.58226,0)" /> + <path + d="M 323.576,246.835 L 370.253,237.342 L 370.253,241.298 L 323.576,251.582 L 323.576,246.835 z " + id="path28606" + sodipodi:nodetypes="ccccc" + style="fill:#000100;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 360.76,268.987 L 372.627,267.405 L 372.627,279.272 L 360.76,281.646 L 360.76,268.987 z " + id="path28608" + sodipodi:nodetypes="ccccc" + style="fill:#00b300;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 365.506,298.259 L 373.418,297.468 L 373.418,306.962 L 365.506,308.544 L 365.506,298.259 z " + id="path28610" + sodipodi:nodetypes="ccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g28612" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.868723,0,0,0.841809,-27.91207,15.52193)"> + <g + id="g28614" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 119.557,425.383 L 119.557,438.102 L 435.832,344.83 L 436.68,329.568 L 119.557,425.383 z " + id="path28616" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#b3b3b3;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <g + id="g28618" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 166.193,347.374 L 119.557,426.231 L 436.68,329.568 L 345.104,298.194 L 166.193,347.374 z " + id="path28620" + sodipodi:nodetypes="ccccc" + style="font-size:12px;fill:#cccccc;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="translate(-0.847921,19.50222)" /> + <path + d="M 139.059,335.503 C 139.059,335.503 127.188,354.157 132.275,369.42 C 136.515,388.075 150.082,392.314 153.474,392.314 C 156.866,392.314 377.177,334.884 377.177,334.884 C 377.177,334.884 383.26,322.784 386.652,303.282 C 379.869,279.54 367.15,276.996 352.735,276.996 C 328.993,263.43 353.584,276.996 353.584,276.996 L 139.059,335.503 z " + id="path28622" + sodipodi:nodetypes="cccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.708121,0,0,0.825311,71.30738,59.20586)" /> + </g> + </g> + <g + id="g28624" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 420.57,16.6844 C 420.57,17.5323 399.371,11.5968 377.325,9.90093 C 367.15,10.7489 66.1379,65.8638 63.5942,65.8638 C 67.8338,65.0159 54.267,65.8638 50.8753,73.4951 C 47.4836,81.1264 47.4836,343.134 47.4836,343.134 C 47.4836,343.134 47.4837,350.766 52.5712,356.701 C 60.2025,360.093 80.5526,360.941 72.9213,360.941 L 420.57,16.6844 z " + id="path28626" + sodipodi:nodetypes="cccccccc" + style="fill:#b3b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <g + id="g28628" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 71.2332,108.009 L 418.873,40.4261 C 423.961,43.8178 429.049,41.2741 431.593,51.4492 C 434.137,61.6241 430.745,304.978 430.745,304.978 C 430.745,304.978 432.44,312.609 426.505,316.849 C 420.569,321.088 79.6699,416.904 79.6699,416.904 C 79.6699,416.904 69.4946,421.143 63.5593,412.664 C 55.0803,410.121 60.2025,124.37 60.2025,124.37 C 60.2025,124.37 61.0271,110.72 71.2332,108.009 z " + id="path28630" + sodipodi:nodetypes="ccccccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(0.995445,0,0,0.910163,2.817975,-20.11005)" /> + <g + id="g28632" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 89.0318,98.0844 L 394.284,38.7303 C 394.284,38.7303 401.915,36.1865 407.851,45.5137 C 413.786,54.8408 412.09,59.0804 412.09,59.0804 L 412.09,234.6 C 411.242,243.927 412.938,240.535 407.851,250.711 C 397.675,254.102 105.142,333.807 105.142,333.807 C 105.142,333.807 105.142,335.503 94.9673,333.807 C 84.7922,332.111 81.4005,316.001 81.4005,315.153 C 81.4005,314.305 78.0088,115.891 78.0088,115.891 C 78.0088,115.891 79.7048,101.476 89.0318,98.0844 z " + id="path28634" + sodipodi:nodetypes="ccccccccccc" + style="fill:url(#linearGradient614);fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 368.846,266.821 L 398.523,258.342 L 398.523,271.909 C 398.523,271.909 368.846,279.54 368.846,280.388 C 368.846,281.236 368.846,266.821 368.846,266.821 z " + id="path28636" + sodipodi:nodetypes="ccccc" + style="fill:#00feb3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g28638" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1" + transform="matrix(1.060794,0,0,0.913679,-36.3605,196.9337)"> + <g + id="g28640" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 35.6013,306.962 L 454.114,242.088 L 454.114,266.614 L 35.6012,332.279 L 35.6013,306.962 z " + id="path28642" + sodipodi:nodetypes="ccccc" + style="fill:#b2b3b3;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + transform="translate(3.955698,-6.329117)" /> + <path + d="M 39.557,300.633 C 41.9304,296.677 90.981,199.367 90.981,199.367 L 371.044,173.259 L 458.07,235.759 L 39.557,300.633 z " + id="path28644" + sodipodi:nodetypes="ccccc" + style="fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28646" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <g + id="g28648" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 331.487,184.335 C 331.487,184.335 332.279,193.038 332.279,193.829 C 332.279,194.62 366.298,234.177 366.298,234.177 L 424.051,224.683 L 423.26,218.354 L 422.468,218.354 L 331.487,184.335 z " + id="path28650" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 332.279,184.336 L 369.462,180.38 L 424.051,218.354 L 370.253,225.475 L 332.279,184.336 z " + id="path28652" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28654" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 297.468,195.411 C 297.468,195.411 297.468,203.323 297.468,204.114 C 297.468,204.905 318.038,241.297 318.829,241.297 C 319.62,241.297 353.639,236.551 353.639,236.551 L 352.057,227.057" + id="path28656" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 298.26,195.411 C 299.051,195.411 322.785,193.038 322.785,193.038 L 352.848,227.057 L 321.994,231.804 L 298.26,195.411 z " + id="path28658" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28660" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.1899,208.861 L 98.1013,195.411 L 272.943,178.006 L 282.437,189.082 L 90.1899,208.861 z " + id="path28662" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 90.1899,209.652 L 89.3988,215.19 L 282.437,194.62 L 282.437,188.291 L 90.1899,209.652 z " + id="path28664" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28666" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 90.981,215.981 L 287.184,194.62 L 309.336,229.43 L 71.9936,261.867 L 90.981,215.981 z " + id="path28668" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 71.9937,261.076 L 71.2026,268.987 L 309.336,236.551 C 310.127,236.551 308.544,230.221 308.544,229.43 C 308.544,228.639 71.9937,263.449 71.9937,261.076 z " + id="path28670" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + <g + id="g28672" + style="stroke:#000000;stroke-width:4.29749012;stroke-dasharray:none;stroke-opacity:1"> + <path + d="M 82.2785,274.525 L 301.424,242.089 L 306.171,250.791 L 79.9051,284.019 L 82.2785,274.525 z " + id="path28674" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + <path + d="M 79.1139,284.81 L 79.1139,291.93 L 306.171,255.538 L 305.38,250 L 79.1139,284.81 z " + id="path28676" + sodipodi:nodetypes="ccccc" + style="fill:#e5e6e6;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:4.29749012;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" /> + </g> + </g> + </g> + </g> + <g + id="g3073" + transform="matrix(0.1267968,0,0,0.1710106,229.00249,409.01498)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path3075" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z " /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3077" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3079" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + </g> + <g + id="g3081" + transform="matrix(0.1267968,0,0,0.1710106,376.48475,404.97437)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path3083" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z " /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3085" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3087" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + </g> + <g + id="g3089" + transform="matrix(1.2500391,0,0,1.184913,597.0199,213.65087)"> + <g + transform="translate(152.9277,120.7469)" + id="g3091"> + <path + style="fill:url(#radialGradient3109);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path3093" + d="M 24.972918,-30.66305 C 24.972918,-22.90055 -16.207082,-20.35055 -53.230207,-20.66305 C -90.878332,-20.66305 -92.370832,-26.65055 -92.370832,-34.41305 C -92.370832,-42.17555 -71.190832,-40.03805 -33.542707,-40.03805 C 4.105418,-40.03805 24.972918,-38.42555 24.972918,-30.66305 z " /> + <path + style="fill:url(#linearGradient3111);fill-opacity:1;stroke:#677883;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path3095" + d="M -88.933334,-50.694302 L 23.566666,-50.694302 L 23.566666,-37.18304 L -88.933334,-37.18304 L -88.933334,-50.694302 z " /> + <path + style="fill:url(#linearGradient3113);fill-opacity:1;stroke:#677883;stroke-width:0.49944988;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path3097" + d="M -75.933161,-61.840606 L 36.319422,-61.840606 L 23.751782,-51.190703 L -88.500801,-51.190703 L -75.933161,-61.840606 z " /> + <path + style="fill:url(#linearGradient3115);fill-opacity:1;stroke:#677883;stroke-width:0.46877259;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path3099" + d="M 23.981782,-50.846435 L 36.765614,-61.588097 L 36.752498,-48.186223 L 24.037025,-37.40884 L 23.981782,-50.846435 z " /> + <rect + y="-40.584919" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient3117);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect3101" + height="0.78125" /> + <rect + y="-42.264622" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient3119);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect3103" + height="0.78125" /> + <rect + y="-43.944294" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient3121);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect3105" + height="0.78125" /> + <rect + y="-45.33102" + x="-86.609116" + width="1.5625" + style="fill:url(#radialGradient3123);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect3107" + height="0.78125" /> + </g> + </g> + <g + id="g3125" + transform="matrix(0.1267968,0,0,0.1710106,587.83432,404.25336)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path3127" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z " /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3129" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3131" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + </g> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 618.99582,406.26456 L 726.07199,357.77724" + id="path3133" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.03078127px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 765.25542,360.35663 L 886.89875,405.70547" + id="path3135" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 746.27504,404.24425 L 746.27504,349.69602" + id="path3137" /> + <g + id="g3139" + transform="matrix(0.1267968,0,0,0.1710106,716.67848,402.51509)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path3141" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z " /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3143" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3145" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + </g> + <g + id="g3147" + transform="matrix(0.1267968,0,0,0.1710106,864.16074,398.47448)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path3149" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z " /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3151" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3153" + d="M 495.64613 253.85521 A 234.95641 236.07524 0 1 1 25.733322,253.85521 A 234.95641 236.07524 0 1 1 495.64613 253.85521 z" /> + </g> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.06804883px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 132.72111,484.54548 L 239.79728,539.85635" + id="path3155" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.10092473px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 278.98071,536.91396 L 400.62404,485.18325" + id="path3157" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.06804883px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 260.00033,486.85011 L 260.00033,549.07483" + id="path3159" /> + <g + id="g3205" + transform="matrix(1.2344541,0,0,1.166142,589.26929,486.12951)"> + <g + transform="translate(152.9277,120.7469)" + id="g3207"> + <path + style="fill:url(#radialGradient3239);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path3209" + d="M 24.972918,-30.66305 C 24.972918,-22.90055 -16.207082,-20.35055 -53.230207,-20.66305 C -90.878332,-20.66305 -92.370832,-26.65055 -92.370832,-34.41305 C -92.370832,-42.17555 -71.190832,-40.03805 -33.542707,-40.03805 C 4.105418,-40.03805 24.972918,-38.42555 24.972918,-30.66305 z " /> + <path + style="fill:url(#linearGradient3241);fill-opacity:1;stroke:#677883;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path3211" + d="M -88.933334,-50.694302 L 23.566666,-50.694302 L 23.566666,-37.18304 L -88.933334,-37.18304 L -88.933334,-50.694302 z " /> + <path + style="fill:url(#linearGradient3243);fill-opacity:1;stroke:#677883;stroke-width:0.49944988;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path3213" + d="M -75.933161,-61.840606 L 36.319422,-61.840606 L 23.751782,-51.190703 L -88.500801,-51.190703 L -75.933161,-61.840606 z " /> + <path + style="fill:url(#linearGradient3245);fill-opacity:1;stroke:#677883;stroke-width:0.46877259;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + id="path3215" + d="M 23.981782,-50.846435 L 36.765614,-61.588097 L 36.752498,-48.186223 L 24.037025,-37.40884 L 23.981782,-50.846435 z " /> + <rect + y="-40.584919" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient3247);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect3217" + height="0.78125" /> + <rect + y="-42.264622" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient3249);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect3219" + height="0.78125" /> + <rect + y="-43.944294" + x="-86.589584" + width="1.5625" + style="fill:url(#radialGradient3251);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect3221" + height="0.78125" /> + <rect + y="-45.33102" + x="-86.609116" + width="1.5625" + style="fill:url(#radialGradient3253);fill-opacity:1;stroke:none;stroke-width:0.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1" + rx="0" + id="rect3223" + height="0.78125" /> + </g> + </g> + <flowRoot + xml:space="preserve" + id="flowRoot3225" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="matrix(0.7525038,0,0,0.6775389,553.71011,269.52496)"><flowRegion + id="flowRegion3227"><rect + id="rect3229" + width="157.14285" + height="40" + x="194.28572" + y="475.52304" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara3231">Load Balancer</flowPara></flowRoot> <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.06804883px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 621.63441,484.8423 L 728.71058,540.15317" + id="path3233" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.10092473px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 767.89401,537.21078 L 889.53734,485.48007" + id="path3235" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.06804883px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 748.91363,487.14693 L 748.91363,549.37165" + id="path3237" /> + <flowRoot + xml:space="preserve" + id="flowRoot3255" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(-22.223356,-10.101525)"><flowRegion + id="flowRegion3257"><rect + id="rect3259" + width="151.52289" + height="32.324883" + x="44.446712" + y="364.27713" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara3263">Chaining Overlay</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot3265" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="matrix(1,0,0,1.2037203,31.345186,184.04024)"><flowRegion + id="flowRegion3267"><rect + id="rect3269" + width="208.52287" + height="72.93808" + x="412.14224" + y="279.42432" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara3096">50% of total writes </flowPara><flowPara + id="flowPara3098">(DC A + DC B) are </flowPara><flowPara + id="flowPara3100">always off-site</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot3102" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;font-family:Bitstream Vera Sans" + transform="translate(-8,4)"><flowRegion + id="flowRegion3104"><rect + id="rect3106" + width="70" + height="24" + x="196" + y="688.09448" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;font-family:Bitstream Vera Sans" /></flowRegion><flowPara + id="flowPara3110">Clients</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot3112" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;font-family:Bitstream Vera Sans" + transform="translate(750.19434,-91.642006)"><flowRegion + id="flowRegion3114"><rect + id="rect3116" + width="70" + height="24" + x="196" + y="688.09448" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;font-family:Bitstream Vera Sans" /></flowRegion><flowPara + id="flowPara3118">Clients</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot3120" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="matrix(1,0,0,1.2037203,18.69043,-89.07388)"><flowRegion + id="flowRegion3122"><rect + id="rect3124" + width="208.52287" + height="72.93808" + x="412.14224" + y="279.42432" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara3132">Each LB points to</flowPara><flowPara + id="flowPara3134">the same MirrorMode</flowPara><flowPara + id="flowPara3136">Node at any time.</flowPara></flowRoot> </g> +</svg> diff --git a/doc/guide/images/src/intro_dctree.dia b/doc/guide/images/src/intro_dctree.dia Binary files differnew file mode 100644 index 0000000..556671f --- /dev/null +++ b/doc/guide/images/src/intro_dctree.dia diff --git a/doc/guide/images/src/intro_tree.dia b/doc/guide/images/src/intro_tree.dia Binary files differnew file mode 100644 index 0000000..86a8d1b --- /dev/null +++ b/doc/guide/images/src/intro_tree.dia diff --git a/doc/guide/images/src/ldap-sync-refreshandpersist.svg b/doc/guide/images/src/ldap-sync-refreshandpersist.svg new file mode 100644 index 0000000..d5047ff --- /dev/null +++ b/doc/guide/images/src/ldap-sync-refreshandpersist.svg @@ -0,0 +1,4853 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://creativecommons.org/ns#" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + height="524.40942" + id="svg7893" + inkscape:version="0.46" + sodipodi:docbase="/home/ghenry/Desktop" + sodipodi:docname="ldap-sync-refreshandpersist.svg" + sodipodi:version="0.32" + width="744.09448" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + version="1.0" + inkscape:export-filename="/home/ghenry/Desktop/ldap-sync-refreshandpersist.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <metadata + id="metadata2563"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:title>Firewall2</dc:title> + <dc:description /> + <dc:subject> + <rdf:Bag> + <rdf:li>wall</rdf:li> + <rdf:li>brick</rdf:li> + <rdf:li>computer</rdf:li> + <rdf:li>networksym</rdf:li> + </rdf:Bag> + </dc:subject> + <dc:publisher> + <cc:Agent + rdf:about="http://www.openclipart.org/"> + <dc:title>Open Clip Art Library</dc:title> + </cc:Agent> + </dc:publisher> + <dc:creator> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:creator> + <dc:rights> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:rights> + <dc:date /> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + <cc:license + rdf:resource="http://web.resource.org/cc/PublicDomain" /> + <dc:language>en</dc:language> + </cc:Work> + <cc:License + rdf:about="http://web.resource.org/cc/PublicDomain"> + <cc:permits + rdf:resource="http://web.resource.org/cc/Reproduction" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/Distribution" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/DerivativeWorks" /> + </cc:License> + </rdf:RDF> + </metadata> + <defs + id="defs7895"> + <inkscape:perspective + sodipodi:type="inkscape:persp3d" + inkscape:vp_x="0 : 372.04724 : 1" + inkscape:vp_y="0 : 1000 : 0" + inkscape:vp_z="1052.3622 : 372.04724 : 1" + inkscape:persp3d-origin="526.18109 : 248.03149 : 1" + id="perspective6943" /> + <marker + inkscape:stockid="Arrow1Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lend" + style="overflow:visible"> + <path + id="path17680" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.8,0,0,-0.8,-10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lstart" + style="overflow:visible"> + <path + id="path17677" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.8,0,0,0.8,10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mend" + style="overflow:visible"> + <path + id="path17686" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.4,0,0,-0.4,-4,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mstart" + style="overflow:visible"> + <path + id="path17683" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.4,0,0,0.4,4,0)" /> + </marker> + <linearGradient + id="linearGradient6508"> + <stop + id="stop6509" + offset="0.0000000" + style="stop-color:#ff0000;stop-opacity:1.0000000;" /> + <stop + id="stop6511" + offset="0.64370060" + style="stop-color:#ffb900;stop-opacity:1.0000000;" /> + <stop + id="stop6512" + offset="0.79038113" + style="stop-color:#ffff00;stop-opacity:0.84102565;" /> + <stop + id="stop6510" + offset="1.0000000" + style="stop-color:#ffffff;stop-opacity:0.21568628;" /> + </linearGradient> + <linearGradient + id="linearGradient13376"> + <stop + style="stop-color:#d4d4d4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop13377" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.49803922;" + offset="0.50000000" + id="stop13380" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop13378" /> + </linearGradient> + <linearGradient + id="linearGradient12744"> + <stop + style="stop-color:#839da4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12745" /> + <stop + style="stop-color:#496d77;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12746" /> + </linearGradient> + <linearGradient + id="linearGradient10810"> + <stop + style="stop-color:#0e0000;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop10811" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="0.50000000" + id="stop10814" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop10812" /> + </linearGradient> + <linearGradient + id="linearGradient11442"> + <stop + style="stop-color:#6e6e6e;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop11443" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop11444" /> + </linearGradient> + <linearGradient + id="linearGradient14160"> + <stop + style="stop-color:#4af853;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14161" /> + <stop + style="stop-color:#68b96d;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14162" /> + </linearGradient> + <linearGradient + id="linearGradient14835"> + <stop + style="stop-color:#bed1d0;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14836" /> + <stop + style="stop-color:#52727b;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14837" /> + </linearGradient> + <linearGradient + id="linearGradient29203"> + <stop + style="stop-color:#d3d3d3;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop29205" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop29207" /> + </linearGradient> + <linearGradient + id="linearGradient6658"> + <stop + style="stop-color:#677883;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop6659" /> + <stop + style="stop-color:#677883;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop6660" /> + </linearGradient> + <linearGradient + id="linearGradient41493"> + <stop + style="stop-color:#181818;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop41495" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop41497" /> + </linearGradient> + <linearGradient + id="linearGradient12759"> + <stop + style="stop-color:#b4b4b4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12761" /> + <stop + style="stop-color:#d7d8de;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12763" /> + </linearGradient> + <linearGradient + id="linearGradient21825"> + <stop + style="stop-color:#808080;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop21827" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop21829" /> + </linearGradient> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient25527" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.776429,0,0,0.659114,-120.5524,673.5049)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25525" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-145.458,730.6984)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25403" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-145.2247,712.702)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient25401" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-3.473342,95.2718)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient25353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-149.3489,792.5495)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient26976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.06505,808.8095)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28284" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28286" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28288" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28290" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28274" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28276" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28278" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28280" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28264" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28266" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28268" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28270" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28254" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28256" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28258" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28260" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28244" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28246" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28248" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28250" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28234" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28236" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28238" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28240" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28224" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28226" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28228" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28230" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28214" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28216" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28218" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28220" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28208" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-125.9178,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28210" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28204" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.573,808.7592)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28206" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28200" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-116.9703,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28202" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28196" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.6254,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28198" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28192" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.4824,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28194" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28188" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.1375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28190" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28184" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.77797,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28186" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28180" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.43307,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28182" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28172" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28174" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28176" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28178" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28162" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28164" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28166" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28168" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28152" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28154" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28156" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28158" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28142" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28144" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28146" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28148" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28132" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28134" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28136" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28138" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28122" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28124" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28126" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28128" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28112" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28114" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28116" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28118" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28102" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28104" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28106" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28108" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28096" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.2375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28098" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28092" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-156.8927,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28094" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28088" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.29,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28090" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28084" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-147.9451,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28086" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28080" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-143.8021,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28082" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28076" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.4573,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28078" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28072" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.098,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28074" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28068" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.7531,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28070" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28060" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28062" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28064" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28066" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28050" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28052" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28054" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28056" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28040" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28042" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28044" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28046" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28030" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28032" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28034" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28036" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28020" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28022" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28024" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28026" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28010" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28012" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28014" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28016" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28000" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28002" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28004" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28006" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27990" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27992" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27994" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27996" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27984" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.2616,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27986" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27980" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-192.9168,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27982" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.3141,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27978" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-183.9692,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27968" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-179.8262,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27970" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.4813,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27960" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.122,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27962" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27956" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.7771,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27958" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27928" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27930" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27932" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27934" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27918" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27920" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27922" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27924" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27908" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27910" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27912" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27914" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27898" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27900" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27902" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27904" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27888" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27890" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27892" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27894" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27878" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27880" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27882" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27884" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27868" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27870" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27872" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27874" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27858" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27860" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27862" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27864" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27848" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27850" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27852" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27854" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27838" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27840" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27842" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27844" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27828" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27830" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27832" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27834" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27818" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27820" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27822" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27824" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27808" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27810" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27812" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27814" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27798" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27800" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27802" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27804" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27788" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27790" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27792" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27794" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27778" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27780" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27782" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27784" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27768" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27770" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27772" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27774" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27758" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27760" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27762" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27764" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27748" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27750" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27752" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27754" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27738" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27740" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27742" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27744" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27728" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27730" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27732" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27734" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27718" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27720" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27722" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27724" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27708" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27710" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27712" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27714" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27698" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27700" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27702" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27704" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28432" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-126.1386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28434" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28428" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.7938,817.6604)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28430" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28424" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-117.1911,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28426" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28420" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.8462,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28422" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28416" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.7032,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28418" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28412" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.3583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28414" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28408" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.99876,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28410" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28404" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.65386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28406" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28400" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.4583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28402" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28396" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-157.1135,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28398" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28392" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.5108,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28394" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28388" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-148.1659,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28390" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28384" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-144.0229,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28386" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28380" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.6781,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28382" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28376" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.3188,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28378" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28372" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.9739,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28374" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28368" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.4824,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28370" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28364" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-193.1376,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28366" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28360" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.5349,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28362" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28356" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-184.19,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28358" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28352" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-180.047,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28354" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28348" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.7021,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28350" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28344" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.3428,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28346" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28340" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.9979,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28342" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28438" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.25863,817.7848)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36281" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-149.897,802.9053)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36283" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36285" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36287" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36289" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36291" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36293" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36295" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36297" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36299" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36301" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36303" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36305" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36307" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36309" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36311" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36313" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36315" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36317" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36319" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36321" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36323" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36325" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36327" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36329" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36331" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5348,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36333" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7196,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36335" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.35,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36337" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.274,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36339" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.9043,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36341" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.0892,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36343" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-149.6637,784.9089)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient36345" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-7.912301,167.4787)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36347" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5296,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36349" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7144,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36351" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.3448,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.2688,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36355" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.8991,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36357" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.084,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36359" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-198.4916,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36361" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.046,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36363" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.2306,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36365" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-192.8611,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36367" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-195.6763,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36369" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-87.12747,420.4818)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36371" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36373" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36375" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-91.66274,388.2275)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36377" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36379" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36381" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-153.7879,864.7564)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35867" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-141.9847,635.4266)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35869" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35871" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35873" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35875" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35877" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35879" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35881" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35883" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35885" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35887" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35889" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35891" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35893" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35895" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35897" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35899" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35901" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35903" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35905" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35907" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35909" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35911" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35913" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35915" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35917" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35919" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35921" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35923" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35925" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35927" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35929" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35931" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35933" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35935" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35937" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35939" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35941" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35943" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35945" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35947" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35949" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35951" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35953" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35955" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35957" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35959" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35961" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35963" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35965" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6225,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35967" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.7312,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35969" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2856,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35971" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.4702,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35973" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.1007,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35975" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8073,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35977" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9159,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35979" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4377,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35981" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5465,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35983" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3617,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35985" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.992,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35987" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1769,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35989" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-141.7514,617.4302)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient35991" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(2.672454,0.374188)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35993" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6173,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35995" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.726,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35997" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2804,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35999" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.465,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36001" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.0955,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36003" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8021,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36005" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9107,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36007" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4325,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36009" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5413,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36011" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3565,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36013" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.9868,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36015" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1717,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36017" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.5793,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36019" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.1337,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36021" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.3183,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36023" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-184.9488,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36025" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.764,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36027" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-79.21517,253.0031)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36029" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36031" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36033" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-83.75044,220.7488)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36035" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36037" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36039" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-145.8756,697.2777)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient12151" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.20227,0,0,0.454077,6.691668,-148.3193)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12153" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,1.691668,-145.8193)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient14835" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12155" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,1.924904,-161.8157)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12157" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.350818,114.6621,-134.6472)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12159" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-59.65453)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12161" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-61.33423)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12163" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-63.01391)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12165" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.09869,-64.40064)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <inkscape:perspective + id="perspective3612" + inkscape:persp3d-origin="372.04724 : 350.78739 : 1" + inkscape:vp_z="744.09448 : 526.18109 : 1" + inkscape:vp_y="0 : 1000 : 0" + inkscape:vp_x="0 : 526.18109 : 1" + sodipodi:type="inkscape:persp3d" /> + </defs> + <sodipodi:namedview + bordercolor="#666666" + borderopacity="1.0" + id="base" + inkscape:current-layer="layer1" + inkscape:cx="344.82324" + inkscape:cy="267.55258" + inkscape:document-units="px" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:window-height="768" + inkscape:window-width="1024" + inkscape:window-x="0" + inkscape:window-y="0" + inkscape:zoom="1" + pagecolor="#ffffff" + width="1052.3622px" + height="744.09448px" + showgrid="false" /> + <g + id="layer1" + inkscape:groupmode="layer" + inkscape:label="Layer 1"> + <flowRoot + xml:space="preserve" + id="flowRoot12890" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:center;line-height:125%;writing-mode:lr-tb;text-anchor:middle;font-family:Arial" + transform="translate(-51.99247,-442.27533)"><flowRegion + id="flowRegion12892"><rect + id="rect12894" + width="445.14282" + height="64" + x="194.28572" + y="475.52304" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:center;line-height:125%;writing-mode:lr-tb;text-anchor:middle;font-family:Arial" /></flowRegion><flowPara + id="flowPara3577">LDAP Content Synchronization Operation </flowPara><flowPara + id="flowPara3581">- refreshAndPersist</flowPara></flowRoot> <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.0861342px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + d="M 238,143.49926 L 238,444.31958" + id="path3597" + inkscape:connector-type="polyline" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.08133781px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + d="M 464,147.49407 L 464,443.32477" + id="path3601" + inkscape:connector-type="polyline" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow1Lend)" + d="M 244,149.40942 L 459,176.40942" + id="path3630" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow1Lend)" + d="M 455,184.40942 L 243,237.40942" + id="path3632" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 239.5,343.79723 L 454.5,370.79723" + id="path5496" /> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="19" + y="149.40942" + id="text5502"><tspan + sodipodi:role="line" + x="19" + y="149.40942" + id="tspan5518" + style="font-weight:bold">1.<tspan + style="font-weight:normal" + id="tspan5753"> Same as refreshOnly request,</tspan></tspan><tspan + sodipodi:role="line" + x="19" + y="164.40942" + style="font-weight:normal" + id="tspan5755">but refreshAndPersist mode</tspan><tspan + sodipodi:role="line" + x="19" + y="179.40942" + style="font-weight:normal" + id="tspan5757">set.</tspan><tspan + sodipodi:role="line" + x="19" + y="194.40942" + style="font-weight:bold" + id="tspan5751" /></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="590" + y="113.40942" + id="text5506"><tspan + sodipodi:role="line" + id="tspan5508" + x="590" + y="113.40942">Server</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="92" + y="109.40942" + id="text5510"><tspan + sodipodi:role="line" + id="tspan5512" + x="92" + y="109.40942">Client</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="492" + y="155.40942" + id="text5520"><tspan + sodipodi:role="line" + x="492" + y="155.40942" + style="font-size:12px;font-weight:bold" + id="tspan5528">2a.<tspan + style="font-weight:normal" + id="tspan5789"> Same as refreshOnly mode.</tspan></tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="491.2998" + y="175.21997" + id="text5530"><tspan + sodipodi:role="line" + x="491.2998" + y="175.21997" + style="font-size:12px;font-weight:bold" + id="tspan5569">2b.<tspan + style="font-weight:normal" + id="tspan5805"> This time, send a Sync Info</tspan></tspan><tspan + sodipodi:role="line" + x="491.2998" + y="190.21997" + style="font-size:12px;font-weight:normal" + id="tspan5807">Message to client indicating refresh</tspan><tspan + sodipodi:role="line" + x="491.2998" + y="205.21997" + style="font-size:12px;font-weight:normal" + id="tspan5809">stage is done and then enters the </tspan><tspan + sodipodi:role="line" + x="491.2998" + y="220.21997" + style="font-size:12px;font-weight:normal" + id="tspan5811">persist stage</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="20.009766" + y="220.21997" + id="text5571"><tspan + sodipodi:role="line" + x="20.009766" + y="220.21997" + style="font-size:12px;font-weight:bold" + id="tspan5599">3. <tspan + style="font-weight:normal" + id="tspan5823">After receiving the message, </tspan></tspan><tspan + sodipodi:role="line" + x="20.009766" + y="235.21997" + style="font-size:12px;font-weight:normal" + id="tspan5817">the client will construct a </tspan><tspan + sodipodi:role="line" + x="20.009766" + y="250.21997" + style="font-size:12px;font-weight:normal" + id="tspan5819">synchronized copy as described</tspan><tspan + sodipodi:role="line" + x="20.009766" + y="265.21997" + style="font-size:12px;font-weight:normal" + id="tspan5821">in the refreshOnly mode.</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="490.00977" + y="266.21997" + id="text5603"><tspan + sodipodi:role="line" + x="490.00977" + y="266.21997" + style="font-size:12px;font-weight:bold" + id="tspan5635">4.<tspan + style="font-weight:normal" + id="tspan5629"> Server can now send change </tspan></tspan><tspan + sodipodi:role="line" + x="490.00977" + y="281.21997" + style="font-size:12px;font-weight:normal" + id="tspan5850">notifications based on original Sync</tspan><tspan + sodipodi:role="line" + x="490.00977" + y="296.21997" + style="font-size:12px;font-weight:normal" + id="tspan5852">Search Request</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="487.82422" + y="366.21997" + id="text5637"><tspan + sodipodi:role="line" + x="487.82422" + y="366.21997" + style="font-size:12px;font-weight:bold" + id="tspan5669">6.<tspan + style="font-weight:normal" + id="tspan5917"> Server may terminate Sync Operation.</tspan></tspan><tspan + sodipodi:role="line" + x="487.82422" + y="381.21997" + style="font-size:12px;font-weight:normal" + id="tspan5919">If it doesn't provide a cookie, a full</tspan><tspan + sodipodi:role="line" + x="487.82422" + y="396.21997" + style="font-size:12px;font-weight:normal" + id="tspan5921">refresh is needed by client.</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="19.681641" + y="303.21997" + id="text5675"><tspan + sodipodi:role="line" + x="19.681641" + y="303.21997" + style="font-size:12px;font-weight:bold" + id="tspan5685">5a.<tspan + style="font-weight:normal" + id="tspan5712"> For returned entries the </tspan></tspan><tspan + sodipodi:role="line" + x="19.681641" + y="318.21997" + style="font-size:12px;font-weight:normal" + id="tspan5854">SearchResultEntry will have the </tspan><tspan + sodipodi:role="line" + x="19.681641" + y="333.21997" + style="font-size:12px;font-weight:normal" + id="tspan5858">Sync State Control set to either;</tspan><tspan + sodipodi:role="line" + x="19.681641" + y="348.21997" + style="font-size:12px;font-weight:normal" + id="tspan5714">add, delete or modify</tspan></text> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 459,379.66689 L 247,432.66689" + id="path5691" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 244.5,244.79723 L 459.5,271.79723" + id="path5825" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 452,280.66689 L 240,333.66689" + id="path5831" /> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="18.818359" + y="369.21997" + id="text5869"><tspan + sodipodi:role="line" + x="18.818359" + y="369.21997" + style="font-size:12px;font-weight:bold" + id="tspan5895">5b.<tspan + style="font-weight:normal" + id="tspan5899"> Waits for server to send entries</tspan></tspan><tspan + sodipodi:role="line" + x="18.818359" + y="384.21997" + style="font-size:12px;font-weight:bold" + id="tspan5901" /></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="17.103516" + y="437.88306" + id="text5923"><tspan + sodipodi:role="line" + x="17.103516" + y="437.88306" + style="font-size:12px;font-weight:bold" + id="tspan5925">7.<tspan + style="font-weight:normal" + id="tspan5931"> Client refreshes if disconnects </tspan></tspan><tspan + sodipodi:role="line" + x="17.103516" + y="452.88306" + style="font-size:12px;font-weight:normal" + id="tspan5933">and provides last syncCookie if it</tspan><tspan + sodipodi:role="line" + x="17.103516" + y="467.88306" + style="font-size:12px;font-weight:normal" + id="tspan5937">has one.</tspan><tspan + sodipodi:role="line" + x="17.103516" + y="482.88306" + style="font-size:12px;font-weight:bold" + id="tspan5929" /></text> + </g> +</svg> diff --git a/doc/guide/images/src/ldap-sync-refreshonly.svg b/doc/guide/images/src/ldap-sync-refreshonly.svg new file mode 100644 index 0000000..27f6f40 --- /dev/null +++ b/doc/guide/images/src/ldap-sync-refreshonly.svg @@ -0,0 +1,4814 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://creativecommons.org/ns#" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + height="524.40942" + id="svg7893" + inkscape:version="0.46" + sodipodi:docbase="/home/ghenry/Desktop" + sodipodi:docname="ldap-sync-refreshonly.svg" + sodipodi:version="0.32" + width="744.09448" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + version="1.0" + inkscape:export-filename="/home/ghenry/Desktop/ldap-sync-refreshOnly.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <metadata + id="metadata2563"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:title>Firewall2</dc:title> + <dc:description /> + <dc:subject> + <rdf:Bag> + <rdf:li>wall</rdf:li> + <rdf:li>brick</rdf:li> + <rdf:li>computer</rdf:li> + <rdf:li>networksym</rdf:li> + </rdf:Bag> + </dc:subject> + <dc:publisher> + <cc:Agent + rdf:about="http://www.openclipart.org/"> + <dc:title>Open Clip Art Library</dc:title> + </cc:Agent> + </dc:publisher> + <dc:creator> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:creator> + <dc:rights> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:rights> + <dc:date /> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + <cc:license + rdf:resource="http://web.resource.org/cc/PublicDomain" /> + <dc:language>en</dc:language> + </cc:Work> + <cc:License + rdf:about="http://web.resource.org/cc/PublicDomain"> + <cc:permits + rdf:resource="http://web.resource.org/cc/Reproduction" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/Distribution" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/DerivativeWorks" /> + </cc:License> + </rdf:RDF> + </metadata> + <defs + id="defs7895"> + <inkscape:perspective + sodipodi:type="inkscape:persp3d" + inkscape:vp_x="0 : 372.04724 : 1" + inkscape:vp_y="0 : 1000 : 0" + inkscape:vp_z="1052.3622 : 372.04724 : 1" + inkscape:persp3d-origin="526.18109 : 248.03149 : 1" + id="perspective6943" /> + <marker + inkscape:stockid="Arrow1Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lend" + style="overflow:visible"> + <path + id="path17680" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.8,0,0,-0.8,-10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lstart" + style="overflow:visible"> + <path + id="path17677" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.8,0,0,0.8,10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mend" + style="overflow:visible"> + <path + id="path17686" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.4,0,0,-0.4,-4,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mstart" + style="overflow:visible"> + <path + id="path17683" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.4,0,0,0.4,4,0)" /> + </marker> + <linearGradient + id="linearGradient6508"> + <stop + id="stop6509" + offset="0.0000000" + style="stop-color:#ff0000;stop-opacity:1.0000000;" /> + <stop + id="stop6511" + offset="0.64370060" + style="stop-color:#ffb900;stop-opacity:1.0000000;" /> + <stop + id="stop6512" + offset="0.79038113" + style="stop-color:#ffff00;stop-opacity:0.84102565;" /> + <stop + id="stop6510" + offset="1.0000000" + style="stop-color:#ffffff;stop-opacity:0.21568628;" /> + </linearGradient> + <linearGradient + id="linearGradient13376"> + <stop + style="stop-color:#d4d4d4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop13377" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.49803922;" + offset="0.50000000" + id="stop13380" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop13378" /> + </linearGradient> + <linearGradient + id="linearGradient12744"> + <stop + style="stop-color:#839da4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12745" /> + <stop + style="stop-color:#496d77;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12746" /> + </linearGradient> + <linearGradient + id="linearGradient10810"> + <stop + style="stop-color:#0e0000;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop10811" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="0.50000000" + id="stop10814" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop10812" /> + </linearGradient> + <linearGradient + id="linearGradient11442"> + <stop + style="stop-color:#6e6e6e;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop11443" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop11444" /> + </linearGradient> + <linearGradient + id="linearGradient14160"> + <stop + style="stop-color:#4af853;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14161" /> + <stop + style="stop-color:#68b96d;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14162" /> + </linearGradient> + <linearGradient + id="linearGradient14835"> + <stop + style="stop-color:#bed1d0;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14836" /> + <stop + style="stop-color:#52727b;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14837" /> + </linearGradient> + <linearGradient + id="linearGradient29203"> + <stop + style="stop-color:#d3d3d3;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop29205" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop29207" /> + </linearGradient> + <linearGradient + id="linearGradient6658"> + <stop + style="stop-color:#677883;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop6659" /> + <stop + style="stop-color:#677883;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop6660" /> + </linearGradient> + <linearGradient + id="linearGradient41493"> + <stop + style="stop-color:#181818;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop41495" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop41497" /> + </linearGradient> + <linearGradient + id="linearGradient12759"> + <stop + style="stop-color:#b4b4b4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12761" /> + <stop + style="stop-color:#d7d8de;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12763" /> + </linearGradient> + <linearGradient + id="linearGradient21825"> + <stop + style="stop-color:#808080;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop21827" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop21829" /> + </linearGradient> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient25527" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.776429,0,0,0.659114,-120.5524,673.5049)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25525" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-145.458,730.6984)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25403" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-145.2247,712.702)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient25401" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-3.473342,95.2718)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient25353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-149.3489,792.5495)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient26976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.06505,808.8095)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28284" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28286" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28288" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28290" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28274" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28276" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28278" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28280" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28264" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28266" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28268" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28270" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28254" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28256" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28258" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28260" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28244" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28246" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28248" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28250" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28234" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28236" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28238" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28240" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28224" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28226" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28228" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28230" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28214" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28216" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28218" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28220" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28208" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-125.9178,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28210" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28204" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.573,808.7592)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28206" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28200" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-116.9703,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28202" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28196" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.6254,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28198" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28192" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.4824,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28194" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28188" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.1375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28190" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28184" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.77797,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28186" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28180" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.43307,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28182" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28172" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28174" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28176" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28178" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28162" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28164" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28166" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28168" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28152" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28154" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28156" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28158" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28142" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28144" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28146" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28148" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28132" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28134" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28136" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28138" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28122" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28124" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28126" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28128" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28112" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28114" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28116" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28118" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28102" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28104" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28106" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28108" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28096" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.2375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28098" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28092" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-156.8927,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28094" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28088" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.29,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28090" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28084" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-147.9451,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28086" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28080" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-143.8021,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28082" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28076" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.4573,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28078" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28072" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.098,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28074" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28068" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.7531,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28070" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28060" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28062" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28064" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28066" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28050" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28052" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28054" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28056" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28040" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28042" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28044" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28046" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28030" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28032" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28034" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28036" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28020" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28022" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28024" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28026" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28010" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28012" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28014" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28016" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28000" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28002" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28004" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28006" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27990" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27992" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27994" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27996" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27984" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.2616,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27986" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27980" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-192.9168,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27982" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.3141,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27978" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-183.9692,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27968" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-179.8262,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27970" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.4813,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27960" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.122,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27962" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27956" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.7771,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27958" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27928" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27930" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27932" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27934" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27918" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27920" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27922" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27924" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27908" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27910" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27912" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27914" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27898" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27900" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27902" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27904" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27888" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27890" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27892" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27894" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27878" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27880" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27882" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27884" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27868" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27870" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27872" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27874" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27858" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27860" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27862" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27864" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27848" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27850" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27852" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27854" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27838" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27840" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27842" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27844" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27828" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27830" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27832" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27834" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27818" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27820" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27822" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27824" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27808" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27810" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27812" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27814" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27798" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27800" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27802" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27804" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27788" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27790" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27792" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27794" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27778" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27780" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27782" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27784" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27768" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27770" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27772" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27774" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27758" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27760" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27762" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27764" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27748" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27750" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27752" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27754" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27738" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27740" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27742" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27744" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27728" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27730" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27732" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27734" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27718" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27720" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27722" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27724" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27708" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27710" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27712" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27714" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27698" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27700" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27702" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27704" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28432" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-126.1386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28434" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28428" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.7938,817.6604)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28430" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28424" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-117.1911,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28426" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28420" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.8462,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28422" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28416" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.7032,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28418" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28412" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.3583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28414" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28408" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.99876,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28410" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28404" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.65386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28406" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28400" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.4583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28402" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28396" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-157.1135,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28398" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28392" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.5108,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28394" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28388" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-148.1659,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28390" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28384" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-144.0229,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28386" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28380" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.6781,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28382" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28376" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.3188,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28378" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28372" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.9739,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28374" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28368" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.4824,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28370" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28364" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-193.1376,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28366" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28360" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.5349,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28362" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28356" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-184.19,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28358" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28352" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-180.047,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28354" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28348" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.7021,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28350" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28344" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.3428,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28346" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28340" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.9979,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28342" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28438" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.25863,817.7848)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36281" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-149.897,802.9053)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36283" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36285" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36287" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36289" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36291" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36293" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36295" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36297" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36299" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36301" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36303" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36305" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36307" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36309" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36311" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36313" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36315" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36317" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36319" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36321" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36323" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36325" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36327" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36329" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36331" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5348,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36333" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7196,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36335" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.35,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36337" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.274,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36339" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.9043,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36341" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.0892,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36343" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-149.6637,784.9089)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient36345" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-7.912301,167.4787)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36347" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5296,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36349" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7144,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36351" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.3448,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.2688,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36355" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.8991,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36357" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.084,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36359" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-198.4916,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36361" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.046,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36363" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.2306,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36365" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-192.8611,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36367" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-195.6763,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36369" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-87.12747,420.4818)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36371" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36373" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36375" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-91.66274,388.2275)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36377" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36379" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36381" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-153.7879,864.7564)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35867" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-141.9847,635.4266)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35869" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35871" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35873" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35875" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35877" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35879" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35881" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35883" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35885" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35887" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35889" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35891" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35893" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35895" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35897" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35899" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35901" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35903" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35905" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35907" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35909" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35911" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35913" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35915" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35917" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35919" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35921" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35923" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35925" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35927" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35929" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35931" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35933" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35935" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35937" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35939" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35941" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35943" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35945" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35947" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35949" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35951" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35953" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35955" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35957" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35959" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35961" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35963" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35965" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6225,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35967" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.7312,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35969" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2856,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35971" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.4702,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35973" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.1007,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35975" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8073,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35977" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9159,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35979" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4377,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35981" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5465,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35983" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3617,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35985" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.992,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35987" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1769,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35989" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-141.7514,617.4302)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient35991" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(2.672454,0.374188)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35993" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6173,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35995" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.726,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35997" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2804,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35999" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.465,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36001" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.0955,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36003" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8021,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36005" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9107,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36007" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4325,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36009" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5413,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36011" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3565,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36013" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.9868,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36015" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1717,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36017" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.5793,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36019" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.1337,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36021" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.3183,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36023" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-184.9488,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36025" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.764,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36027" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-79.21517,253.0031)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36029" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36031" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36033" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-83.75044,220.7488)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36035" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36037" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36039" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-145.8756,697.2777)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient12151" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.20227,0,0,0.454077,6.691668,-148.3193)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12153" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,1.691668,-145.8193)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient14835" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12155" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,1.924904,-161.8157)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12157" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.350818,114.6621,-134.6472)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12159" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-59.65453)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12161" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-61.33423)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12163" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-63.01391)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12165" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.09869,-64.40064)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <inkscape:perspective + id="perspective3612" + inkscape:persp3d-origin="372.04724 : 350.78739 : 1" + inkscape:vp_z="744.09448 : 526.18109 : 1" + inkscape:vp_y="0 : 1000 : 0" + inkscape:vp_x="0 : 526.18109 : 1" + sodipodi:type="inkscape:persp3d" /> + </defs> + <sodipodi:namedview + bordercolor="#666666" + borderopacity="1.0" + id="base" + inkscape:current-layer="layer1" + inkscape:cx="344.82324" + inkscape:cy="227.55258" + inkscape:document-units="px" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:window-height="722" + inkscape:window-width="1014" + inkscape:window-x="0" + inkscape:window-y="25" + inkscape:zoom="1" + pagecolor="#ffffff" + width="1052.3622px" + height="744.09448px" + showgrid="false" /> + <g + id="layer1" + inkscape:groupmode="layer" + inkscape:label="Layer 1"> + <flowRoot + xml:space="preserve" + id="flowRoot12890" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:center;line-height:125%;writing-mode:lr-tb;text-anchor:middle;font-family:Arial" + transform="translate(-51.99247,-442.27533)"><flowRegion + id="flowRegion12892"><rect + id="rect12894" + width="445.14282" + height="64" + x="194.28572" + y="475.52304" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:center;line-height:125%;writing-mode:lr-tb;text-anchor:middle;font-family:Arial" /></flowRegion><flowPara + id="flowPara3577">LDAP Content Synchronization Operation </flowPara><flowPara + id="flowPara3581">- refreshOnly </flowPara></flowRoot> <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + d="M 238,143.40942 L 238,398.40942" + id="path3597" + inkscape:connector-type="polyline" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + d="M 464,147.40942 L 464,400.40942" + id="path3601" + inkscape:connector-type="polyline" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow1Lend)" + d="M 244,149.40942 L 459,176.40942" + id="path3630" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow1Lend)" + d="M 455,184.40942 L 243,237.40942" + id="path3632" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 245.5,303.79723 L 460.5,330.79723" + id="path5496" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 453,201.66689 L 241,254.66689" + id="path5498" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 455,218.66689 L 243,271.66689" + id="path5500" /> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="19" + y="149.40942" + id="text5502"><tspan + sodipodi:role="line" + id="tspan5504" + x="19" + y="149.40942"><tspan + style="font-weight:bold" + id="tspan5540">1.</tspan> Initial client copy Sync</tspan><tspan + sodipodi:role="line" + x="19" + y="164.40942" + id="tspan5514">request - search request</tspan><tspan + sodipodi:role="line" + x="19" + y="179.40942" + id="tspan5516">with Sync Request Control</tspan><tspan + sodipodi:role="line" + x="19" + y="194.40942" + id="tspan5518">with mode set to 'resfreshOnly'</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="590" + y="113.40942" + id="text5506"><tspan + sodipodi:role="line" + id="tspan5508" + x="590" + y="113.40942">Server</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="92" + y="109.40942" + id="text5510"><tspan + sodipodi:role="line" + id="tspan5512" + x="92" + y="109.40942">Client</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="501" + y="154.40942" + id="text5520"><tspan + sodipodi:role="line" + id="tspan5522" + x="501" + y="154.40942" + style="font-size:12px"><tspan + style="font-weight:bold" + id="tspan5542">2a.</tspan> Returns content matching search </tspan><tspan + sodipodi:role="line" + x="501" + y="169.40942" + style="font-size:12px" + id="tspan5524">and with each entry provides a Sync</tspan><tspan + sodipodi:role="line" + x="501" + y="184.40942" + style="font-size:12px" + id="tspan5526">State Control which contains the </tspan><tspan + sodipodi:role="line" + x="501" + y="199.40942" + style="font-size:12px" + id="tspan5528">'entryUUID'</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="501.2998" + y="217.21997" + id="text5530"><tspan + sodipodi:role="line" + x="501.2998" + y="217.21997" + style="font-size:12px;font-weight:bold" + id="tspan5538">2b.<tspan + style="font-weight:normal" + id="tspan5561"> Follows with a SearchResultDone </tspan></tspan><tspan + sodipodi:role="line" + x="501.2998" + y="232.21997" + style="font-size:12px;font-weight:normal" + id="tspan5563">with a 'Sync Done Control' which</tspan><tspan + sodipodi:role="line" + x="501.2998" + y="247.21997" + style="font-size:12px;font-weight:normal" + id="tspan5567">provides the syncCookie - this cookie</tspan><tspan + sodipodi:role="line" + x="501.2998" + y="262.21997" + style="font-size:12px;font-weight:normal" + id="tspan5569">represents the session state.</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="16.009766" + y="271.21997" + id="text5571"><tspan + sodipodi:role="line" + x="16.009766" + y="271.21997" + style="font-size:12px;font-weight:bold" + id="tspan5581">3. <tspan + style="font-weight:normal" + id="tspan5597">Polls for updates providing the </tspan></tspan><tspan + sodipodi:role="line" + x="16.009766" + y="286.21997" + style="font-size:12px;font-weight:bold" + id="tspan5599"><tspan + style="font-weight:normal" + id="tspan5601">previously issued syncCookie </tspan></tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="498.00977" + y="330.21997" + id="text5603"><tspan + sodipodi:role="line" + x="498.00977" + y="330.21997" + style="font-size:12px;font-weight:bold" + id="tspan5613">4a.<tspan + style="font-weight:normal" + id="tspan5629"> Use present or delete phase?</tspan></tspan><tspan + sodipodi:role="line" + x="498.00977" + y="345.21997" + style="font-size:12px;font-weight:normal" + id="tspan5631">Both can be used, present brings </tspan><tspan + sodipodi:role="line" + x="498.00977" + y="360.21997" + style="font-size:12px;font-weight:normal" + id="tspan5633">client copy up to a point where delete</tspan><tspan + sodipodi:role="line" + x="498.00977" + y="375.21997" + style="font-size:12px;font-weight:normal" + id="tspan5635">can begin.</tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="498.82422" + y="398.21997" + id="text5637"><tspan + sodipodi:role="line" + x="498.82422" + y="398.21997" + style="font-size:12px;font-weight:bold" + id="tspan5647">4b.<tspan + style="font-weight:normal" + id="tspan5663"> Server uses syncCookie as an </tspan></tspan><tspan + sodipodi:role="line" + x="498.82422" + y="413.21997" + style="font-size:12px;font-weight:normal" + id="tspan5665">indicator of what client got before and</tspan><tspan + sodipodi:role="line" + x="498.82422" + y="428.21997" + style="font-size:12px;font-weight:normal" + id="tspan5667">then sends copies of entries that have</tspan><tspan + sodipodi:role="line" + x="498.82422" + y="443.21997" + style="font-size:12px;font-weight:normal" + id="tspan5669">changed. <tspan + style="font-weight:bold" + id="tspan5671">All<tspan + style="font-weight:normal" + id="tspan5673"> attributes are sent.</tspan></tspan></tspan></text> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="11.681641" + y="422.21997" + id="text5675"><tspan + sodipodi:role="line" + x="11.681641" + y="422.21997" + style="font-size:12px;font-weight:bold" + id="tspan5685">5.<tspan + style="font-weight:normal" + id="tspan5712"> Repeat using syncCookie, i.e.</tspan></tspan><tspan + sodipodi:role="line" + x="11.681641" + y="437.21997" + style="font-size:12px;font-weight:normal" + id="tspan5714">go back to step 3.</tspan></text> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 458,339.66689 L 246,392.66689" + id="path5691" /> + </g> +</svg> diff --git a/doc/guide/images/src/mirrormode.dia b/doc/guide/images/src/mirrormode.dia Binary files differnew file mode 100644 index 0000000..3f159ea --- /dev/null +++ b/doc/guide/images/src/mirrormode.dia diff --git a/doc/guide/images/src/n-way-multi-master.dia b/doc/guide/images/src/n-way-multi-master.dia Binary files differnew file mode 100644 index 0000000..3f159ea --- /dev/null +++ b/doc/guide/images/src/n-way-multi-master.dia diff --git a/doc/guide/images/src/n-way-multi-master.svg b/doc/guide/images/src/n-way-multi-master.svg new file mode 100644 index 0000000..6589678 --- /dev/null +++ b/doc/guide/images/src/n-way-multi-master.svg @@ -0,0 +1,5293 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://creativecommons.org/ns#" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + height="524.40942" + id="svg7893" + inkscape:version="0.46" + sodipodi:docbase="/home/ghenry/Desktop" + sodipodi:docname="n-way-multi-master.svg" + sodipodi:version="0.32" + width="744.09448" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + version="1.0" + inkscape:export-filename="/home/ghenry/Desktop/n-way-multi-master.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <metadata + id="metadata2563"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:title>Firewall2</dc:title> + <dc:description /> + <dc:subject> + <rdf:Bag> + <rdf:li>wall</rdf:li> + <rdf:li>brick</rdf:li> + <rdf:li>computer</rdf:li> + <rdf:li>networksym</rdf:li> + </rdf:Bag> + </dc:subject> + <dc:publisher> + <cc:Agent + rdf:about="http://www.openclipart.org/"> + <dc:title>Open Clip Art Library</dc:title> + </cc:Agent> + </dc:publisher> + <dc:creator> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:creator> + <dc:rights> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:rights> + <dc:date /> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + <cc:license + rdf:resource="http://web.resource.org/cc/PublicDomain" /> + <dc:language>en</dc:language> + </cc:Work> + <cc:License + rdf:about="http://web.resource.org/cc/PublicDomain"> + <cc:permits + rdf:resource="http://web.resource.org/cc/Reproduction" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/Distribution" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/DerivativeWorks" /> + </cc:License> + </rdf:RDF> + </metadata> + <defs + id="defs7895"> + <inkscape:perspective + sodipodi:type="inkscape:persp3d" + inkscape:vp_x="0 : 372.04724 : 1" + inkscape:vp_y="0 : 1000 : 0" + inkscape:vp_z="1052.3622 : 372.04724 : 1" + inkscape:persp3d-origin="526.18109 : 248.03149 : 1" + id="perspective6943" /> + <marker + inkscape:stockid="Arrow1Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lend" + style="overflow:visible"> + <path + id="path17680" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.8,0,0,-0.8,-10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lstart" + style="overflow:visible"> + <path + id="path17677" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.8,0,0,0.8,10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mend" + style="overflow:visible"> + <path + id="path17686" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.4,0,0,-0.4,-4,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mstart" + style="overflow:visible"> + <path + id="path17683" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.4,0,0,0.4,4,0)" /> + </marker> + <linearGradient + id="linearGradient6508"> + <stop + id="stop6509" + offset="0.0000000" + style="stop-color:#ff0000;stop-opacity:1.0000000;" /> + <stop + id="stop6511" + offset="0.64370060" + style="stop-color:#ffb900;stop-opacity:1.0000000;" /> + <stop + id="stop6512" + offset="0.79038113" + style="stop-color:#ffff00;stop-opacity:0.84102565;" /> + <stop + id="stop6510" + offset="1.0000000" + style="stop-color:#ffffff;stop-opacity:0.21568628;" /> + </linearGradient> + <linearGradient + id="linearGradient13376"> + <stop + style="stop-color:#d4d4d4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop13377" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.49803922;" + offset="0.50000000" + id="stop13380" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop13378" /> + </linearGradient> + <linearGradient + id="linearGradient12744"> + <stop + style="stop-color:#839da4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12745" /> + <stop + style="stop-color:#496d77;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12746" /> + </linearGradient> + <linearGradient + id="linearGradient10810"> + <stop + style="stop-color:#0e0000;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop10811" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="0.50000000" + id="stop10814" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop10812" /> + </linearGradient> + <linearGradient + id="linearGradient11442"> + <stop + style="stop-color:#6e6e6e;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop11443" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop11444" /> + </linearGradient> + <linearGradient + id="linearGradient14160"> + <stop + style="stop-color:#4af853;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14161" /> + <stop + style="stop-color:#68b96d;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14162" /> + </linearGradient> + <linearGradient + id="linearGradient14835"> + <stop + style="stop-color:#bed1d0;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14836" /> + <stop + style="stop-color:#52727b;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14837" /> + </linearGradient> + <linearGradient + id="linearGradient29203"> + <stop + style="stop-color:#d3d3d3;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop29205" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop29207" /> + </linearGradient> + <linearGradient + id="linearGradient6658"> + <stop + style="stop-color:#677883;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop6659" /> + <stop + style="stop-color:#677883;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop6660" /> + </linearGradient> + <linearGradient + id="linearGradient41493"> + <stop + style="stop-color:#181818;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop41495" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop41497" /> + </linearGradient> + <linearGradient + id="linearGradient12759"> + <stop + style="stop-color:#b4b4b4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12761" /> + <stop + style="stop-color:#d7d8de;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12763" /> + </linearGradient> + <linearGradient + id="linearGradient21825"> + <stop + style="stop-color:#808080;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop21827" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop21829" /> + </linearGradient> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient25527" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.776429,0,0,0.659114,-120.5524,673.5049)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25525" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-145.458,730.6984)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25403" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-145.2247,712.702)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient25401" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-3.473342,95.2718)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient25353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-149.3489,792.5495)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient26976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.06505,808.8095)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28284" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28286" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28288" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28290" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28274" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28276" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28278" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28280" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28264" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28266" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28268" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28270" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28254" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28256" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28258" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28260" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28244" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28246" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28248" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28250" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28234" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28236" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28238" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28240" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28224" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28226" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28228" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28230" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28214" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28216" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28218" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28220" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28208" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-125.9178,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28210" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28204" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.573,808.7592)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28206" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28200" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-116.9703,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28202" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28196" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.6254,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28198" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28192" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.4824,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28194" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28188" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.1375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28190" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28184" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.77797,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28186" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28180" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.43307,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28182" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28172" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28174" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28176" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28178" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28162" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28164" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28166" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28168" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28152" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28154" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28156" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28158" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28142" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28144" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28146" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28148" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28132" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28134" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28136" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28138" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28122" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28124" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28126" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28128" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28112" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28114" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28116" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28118" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28102" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28104" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28106" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28108" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28096" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.2375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28098" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28092" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-156.8927,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28094" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28088" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.29,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28090" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28084" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-147.9451,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28086" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28080" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-143.8021,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28082" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28076" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.4573,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28078" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28072" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.098,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28074" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28068" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.7531,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28070" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28060" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28062" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28064" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28066" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28050" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28052" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28054" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28056" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28040" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28042" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28044" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28046" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28030" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28032" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28034" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28036" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28020" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28022" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28024" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28026" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28010" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28012" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28014" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28016" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28000" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28002" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28004" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28006" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27990" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27992" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27994" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27996" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27984" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.2616,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27986" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27980" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-192.9168,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27982" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.3141,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27978" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-183.9692,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27968" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-179.8262,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27970" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.4813,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27960" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.122,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27962" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27956" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.7771,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27958" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27928" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27930" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27932" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27934" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27918" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27920" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27922" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27924" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27908" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27910" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27912" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27914" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27898" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27900" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27902" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27904" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27888" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27890" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27892" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27894" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27878" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27880" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27882" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27884" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27868" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27870" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27872" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27874" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27858" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27860" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27862" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27864" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27848" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27850" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27852" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27854" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27838" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27840" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27842" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27844" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27828" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27830" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27832" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27834" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27818" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27820" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27822" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27824" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27808" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27810" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27812" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27814" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27798" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27800" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27802" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27804" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27788" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27790" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27792" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27794" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27778" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27780" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27782" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27784" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27768" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27770" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27772" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27774" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27758" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27760" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27762" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27764" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27748" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27750" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27752" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27754" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27738" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27740" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27742" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27744" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27728" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27730" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27732" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27734" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27718" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27720" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27722" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27724" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27708" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27710" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27712" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27714" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27698" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27700" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27702" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27704" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28432" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-126.1386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28434" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28428" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.7938,817.6604)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28430" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28424" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-117.1911,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28426" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28420" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.8462,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28422" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28416" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.7032,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28418" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28412" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.3583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28414" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28408" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.99876,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28410" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28404" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.65386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28406" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28400" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.4583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28402" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28396" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-157.1135,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28398" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28392" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.5108,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28394" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28388" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-148.1659,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28390" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28384" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-144.0229,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28386" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28380" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.6781,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28382" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28376" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.3188,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28378" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28372" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.9739,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28374" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28368" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.4824,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28370" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28364" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-193.1376,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28366" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28360" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.5349,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28362" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28356" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-184.19,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28358" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28352" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-180.047,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28354" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28348" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.7021,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28350" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28344" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.3428,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28346" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28340" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.9979,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28342" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28438" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.25863,817.7848)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36281" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-149.897,802.9053)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36283" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36285" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36287" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36289" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36291" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36293" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36295" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36297" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36299" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36301" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36303" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36305" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36307" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36309" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36311" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36313" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36315" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36317" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36319" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36321" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36323" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36325" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36327" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36329" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36331" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5348,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36333" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7196,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36335" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.35,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36337" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.274,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36339" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.9043,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36341" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.0892,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36343" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-149.6637,784.9089)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient36345" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-7.912301,167.4787)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36347" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5296,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36349" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7144,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36351" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.3448,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.2688,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36355" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.8991,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36357" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.084,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36359" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-198.4916,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36361" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.046,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36363" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.2306,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36365" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-192.8611,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36367" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-195.6763,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36369" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-87.12747,420.4818)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36371" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36373" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36375" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-91.66274,388.2275)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36377" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36379" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36381" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-153.7879,864.7564)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35867" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-141.9847,635.4266)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35869" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35871" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35873" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35875" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35877" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35879" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35881" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35883" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35885" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35887" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35889" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35891" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35893" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35895" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35897" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35899" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35901" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35903" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35905" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35907" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35909" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35911" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35913" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35915" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35917" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35919" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35921" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35923" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35925" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35927" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35929" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35931" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35933" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35935" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35937" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35939" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35941" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35943" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35945" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35947" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35949" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35951" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35953" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35955" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35957" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35959" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35961" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35963" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35965" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6225,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35967" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.7312,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35969" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2856,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35971" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.4702,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35973" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.1007,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35975" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8073,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35977" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9159,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35979" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4377,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35981" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5465,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35983" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3617,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35985" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.992,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35987" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1769,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35989" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-141.7514,617.4302)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient35991" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(2.672454,0.374188)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35993" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6173,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35995" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.726,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35997" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2804,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35999" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.465,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36001" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.0955,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36003" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8021,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36005" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9107,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36007" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4325,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36009" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5413,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36011" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3565,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36013" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.9868,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36015" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1717,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36017" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.5793,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36019" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.1337,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36021" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.3183,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36023" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-184.9488,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36025" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.764,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36027" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-79.21517,253.0031)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36029" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36031" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36033" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-83.75044,220.7488)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36035" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36037" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36039" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-145.8756,697.2777)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient12151" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.20227,0,0,0.454077,6.691668,-148.3193)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12153" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,1.691668,-145.8193)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient14835" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12155" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,1.924904,-161.8157)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12157" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.350818,114.6621,-134.6472)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12159" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-59.65453)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12161" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-61.33423)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12163" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-63.01391)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12165" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.09869,-64.40064)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + </defs> + <sodipodi:namedview + bordercolor="#666666" + borderopacity="1.0" + id="base" + inkscape:current-layer="layer1" + inkscape:cx="391.40904" + inkscape:cy="255.22111" + inkscape:document-units="px" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:window-height="722" + inkscape:window-width="1014" + inkscape:window-x="3" + inkscape:window-y="67" + inkscape:zoom="1" + pagecolor="#ffffff" + width="1052.3622px" + height="744.09448px" + showgrid="false" /> + <g + id="layer1" + inkscape:groupmode="layer" + inkscape:label="Layer 1"> + <flowRoot + xml:space="preserve" + id="flowRoot12890" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(51.007531,-424.27533)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"><flowRegion + id="flowRegion12892"><rect + id="rect12894" + width="215.14285" + height="33" + x="194.28572" + y="475.52304" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara6968">N-Way Multi-Master</flowPara></flowRoot> <text + xml:space="preserve" + style="font-size:40px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="316" + y="236.40942" + id="text4409"><tspan + sodipodi:role="line" + id="tspan4411" + x="316" + y="236.40942" /><tspan + sodipodi:role="line" + id="tspan4413" /></text> + <rect + style="opacity:0;fill:#0000ff;fill-rule:evenodd;stroke:#000000;stroke-width:0.73218948;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:1.4643789, 0.73218945;stroke-dashoffset:0;stroke-opacity:1" + id="rect3579" + width="178.64662" + height="149.73311" + x="47.800755" + y="127.86576" /> + <rect + style="opacity:0;fill:none;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0" + id="rect4375" + width="183.45866" + height="148.84184" + x="52.01128" + y="126.97449" /> + <rect + style="opacity:0;fill:none;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0" + id="rect4379" + width="176.24062" + height="148.84184" + x="55.018799" + y="123.40941" /> + <rect + style="opacity:0;fill:#000000;fill-opacity:1;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0" + id="rect4381" + width="165.41354" + height="143.49423" + x="64.64286" + y="141.23479" /> + <rect + style="opacity:0;fill:#000000;fill-opacity:1;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0" + id="rect4383" + width="183.45866" + height="153.29819" + x="55.620304" + y="126.97449" /> + <rect + style="fill:#9087ff;fill-opacity:0;fill-rule:evenodd;stroke:#000000;stroke-width:1.17423046;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:3.52269138, 1.17423046;stroke-dashoffset:0;stroke-opacity:1" + id="rect4421" + width="298.58423" + height="265.9512" + x="68.433456" + y="127.24354" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.73100412px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 137.22159,211.39967 L 192.3649,161.08802" + id="path5584" /> + <g + id="g5590" + transform="matrix(0.113185,0,0,0.2535183,188.60055,106.3998)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path5592" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path5594" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path5596" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g5598" + transform="matrix(0.113185,0,0,0.2535183,289.84868,191.17904)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path5600" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path5602" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path5604" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.80629903px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 241.61342,161.08341 L 307.52195,212.29555" + id="path5626" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.64994711px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 244.26545,341.16464 L 294.25338,297.29009" + id="path5628" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.74283248px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 124.07011,296.83672 L 182.92991,345.50928" + id="path5630" /> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="151" + y="425.40942" + id="text12157"><tspan + sodipodi:role="line" + id="tspan12159" + x="151" + y="425.40942">Example of a</tspan><tspan + sodipodi:role="line" + x="151" + y="445.40942" + id="tspan12206">Normal topology</tspan></text> + <g + id="g12190" + transform="matrix(0.113185,0,0,0.2535183,185.77724,274.9451)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12192" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12194" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12196" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g12198" + transform="matrix(0.113185,0,0,0.2535183,87.77724,183.9451)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12200" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12202" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12204" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <rect + style="opacity:0;fill:#0000ff;fill-rule:evenodd;stroke:#000000;stroke-width:0.73218948;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:1.4643789, 0.73218945;stroke-dashoffset:0;stroke-opacity:1" + id="rect12248" + width="178.64662" + height="149.73311" + x="377.28104" + y="127.20171" /> + <rect + style="opacity:0;fill:none;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0" + id="rect12250" + width="183.45866" + height="148.84184" + x="381.49155" + y="126.31043" /> + <rect + style="opacity:0;fill:none;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0" + id="rect12252" + width="176.24062" + height="148.84184" + x="384.49905" + y="122.74535" /> + <rect + style="opacity:0;fill:#000000;fill-opacity:1;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0" + id="rect12254" + width="165.41354" + height="143.49423" + x="394.12314" + y="140.57074" /> + <rect + style="opacity:0;fill:#000000;fill-opacity:1;stroke-width:1;stroke-miterlimit:4;stroke-dasharray:2, 1;stroke-dashoffset:0" + id="rect12256" + width="183.45866" + height="153.29819" + x="385.10059" + y="126.31043" /> + <rect + style="fill:#9087ff;fill-opacity:0;fill-rule:evenodd;stroke:#000000;stroke-width:1.17423046;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:3.52269138, 1.17423046;stroke-dashoffset:0;stroke-opacity:1" + id="rect12258" + width="298.58423" + height="265.9512" + x="397.91373" + y="126.57948" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.38716727px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 444.79535,175.44697 L 472.2382,147.08805" + id="path12260" /> + <g + id="g12262" + transform="matrix(5.632813e-2,0,0,0.1428994,470.36482,116.26221)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12264" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12266" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12268" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g12270" + transform="matrix(5.632813e-2,0,0,0.1428994,520.7524,164.04931)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12272" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12274" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12276" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.42704627px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 496.74743,147.08545 L 529.54775,175.95195" + id="path12278" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.34423643px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 498.06725,248.59096 L 522.94446,223.86041" + id="path12280" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.39343202px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 438.25033,223.60486 L 467.54275,251.03988" + id="path12282" /> + <text + xml:space="preserve" + style="font-size:16px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="507.48026" + y="424.74536" + id="text12284"><tspan + sodipodi:role="line" + x="507.48026" + y="424.74536" + id="tspan12308">Example of a </tspan><tspan + sodipodi:role="line" + x="507.48026" + y="464.74536" + id="tspan2998">ComplexTopology</tspan></text> + <g + id="g12290" + transform="matrix(5.632813e-2,0,0,0.1428994,467.95976,208.26531)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12292" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12294" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12296" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g12298" + transform="matrix(5.632813e-2,0,0,0.1428994,420.18866,159.97179)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12300" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12302" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12304" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g12330" + transform="matrix(5.632813e-2,0,0,0.1428994,467.95454,296.20047)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12332" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12334" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12336" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g12338" + transform="matrix(5.632813e-2,0,0,0.1428994,593.95454,222.20047)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12340" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12342" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12344" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g12346" + transform="matrix(5.632813e-2,0,0,0.1428994,553.95454,299.20047)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12348" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12350" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12352" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g12354" + transform="matrix(5.632813e-2,0,0,0.1428994,637.95454,302.20047)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12356" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12358" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12360" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.34423643px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 570.56139,304.7747 L 595.4386,280.04415" + id="path12362" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.39343202px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 621.35379,282.69191 L 650.64621,310.12693" + id="path12364" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.6021955px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 497.8011,335.40942 L 523.48612,335.40942 L 551.1989,335.40942" + id="path12376" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.6021955px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 584.3011,337.40942 L 609.98612,337.40942 L 637.6989,337.40942" + id="path13444" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.68973196px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 483,266.25429 L 483,289.66343 L 483,307.56455" + id="path13448" /> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="105" + y="253.40942" + id="text14516"><tspan + sodipodi:role="line" + id="tspan14518" + x="105" + y="253.40942">m1</tspan></text> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="206.34375" + y="177.78345" + id="text14520"><tspan + sodipodi:role="line" + x="206.34375" + y="177.78345" + id="tspan14564">m2</tspan></text> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="200.34375" + y="345.78345" + id="text14524"><tspan + sodipodi:role="line" + id="tspan14526" + x="200.34375" + y="345.78345">m4</tspan></text> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="309.34375" + y="263.78345" + id="text14528"><tspan + sodipodi:role="line" + id="tspan14530" + x="309.34375" + y="263.78345">m3</tspan></text> + <text + xml:space="preserve" + style="font-size:9.74170971px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="587.19482" + y="147.00529" + id="text14532" + transform="scale(0.72853,1.3726271)"><tspan + sodipodi:role="line" + id="tspan14534" + x="587.19482" + y="147.00529">m1</tspan></text> + <text + xml:space="preserve" + style="font-size:9.74170971px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="657.88513" + y="116.04277" + id="text14536" + transform="scale(0.72853,1.3726271)"><tspan + sodipodi:role="line" + id="tspan14538" + x="657.88513" + y="116.04277">m2</tspan></text> + <text + xml:space="preserve" + style="font-size:9.74170971px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="729.26178" + y="150.28368" + id="text14540" + transform="scale(0.72853,1.3726271)"><tspan + sodipodi:role="line" + id="tspan14542" + x="729.26178" + y="150.28368">m3</tspan></text> + <text + xml:space="preserve" + style="font-size:9.74170971px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="655.13983" + y="182.339" + id="text14544" + transform="scale(0.72853,1.3726271)"><tspan + sodipodi:role="line" + id="tspan14546" + x="655.13983" + y="182.339">m4</tspan></text> + <text + xml:space="preserve" + style="font-size:9.74170971px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="655.13983" + y="246.44963" + id="text14548" + transform="scale(0.72853,1.3726271)"><tspan + sodipodi:role="line" + id="tspan14550" + x="655.13983" + y="246.44963">m5</tspan></text> + <text + xml:space="preserve" + style="font-size:9.74170971px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="773.18579" + y="249.36375" + id="text14552" + transform="scale(0.72853,1.3726271)"><tspan + sodipodi:role="line" + id="tspan14554" + x="773.18579" + y="249.36375">m6</tspan></text> + <text + xml:space="preserve" + style="font-size:9.74170971px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="829.4635" + y="191.80989" + id="text14556" + transform="scale(0.72853,1.3726271)"><tspan + sodipodi:role="line" + id="tspan14558" + x="829.4635" + y="191.80989">m7</tspan></text> + <text + xml:space="preserve" + style="font-size:9.74170971px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="887.11389" + y="250.09229" + id="text14560" + transform="scale(0.72853,1.3726271)"><tspan + sodipodi:role="line" + id="tspan14562" + x="887.11389" + y="250.09229">m8</tspan></text> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.09121561px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 214,208.45503 L 214,296.36381" + id="path4225" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.01945496px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 141.00973,247.40942 L 289.99027,247.40942" + id="path7153" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.67594701px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 448.33798,195.40942 L 481.20271,195.40942 L 516.66202,195.40942" + id="path8754" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.72011989px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 483,173.76948 L 483,199.42807 L 483,219.04936" + id="path8756" /> + </g> +</svg> diff --git a/doc/guide/images/src/push-based-complete.svg b/doc/guide/images/src/push-based-complete.svg new file mode 100644 index 0000000..9f07974 --- /dev/null +++ b/doc/guide/images/src/push-based-complete.svg @@ -0,0 +1,4754 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://creativecommons.org/ns#" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + height="524.40942" + id="svg7893" + inkscape:version="0.46" + sodipodi:docbase="/home/ghenry/Desktop" + sodipodi:docname="push-based-complete.svg" + sodipodi:version="0.32" + width="744.09448" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + version="1.0" + inkscape:export-filename="/home/ghenry/Desktop/dual_dc.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <metadata + id="metadata2563"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:title>Firewall2</dc:title> + <dc:description /> + <dc:subject> + <rdf:Bag> + <rdf:li>wall</rdf:li> + <rdf:li>brick</rdf:li> + <rdf:li>computer</rdf:li> + <rdf:li>networksym</rdf:li> + </rdf:Bag> + </dc:subject> + <dc:publisher> + <cc:Agent + rdf:about="http://www.openclipart.org/"> + <dc:title>Open Clip Art Library</dc:title> + </cc:Agent> + </dc:publisher> + <dc:creator> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:creator> + <dc:rights> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:rights> + <dc:date /> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + <cc:license + rdf:resource="http://web.resource.org/cc/PublicDomain" /> + <dc:language>en</dc:language> + </cc:Work> + <cc:License + rdf:about="http://web.resource.org/cc/PublicDomain"> + <cc:permits + rdf:resource="http://web.resource.org/cc/Reproduction" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/Distribution" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/DerivativeWorks" /> + </cc:License> + </rdf:RDF> + </metadata> + <defs + id="defs7895"> + <inkscape:perspective + sodipodi:type="inkscape:persp3d" + inkscape:vp_x="0 : 372.04724 : 1" + inkscape:vp_y="0 : 1000 : 0" + inkscape:vp_z="1052.3622 : 372.04724 : 1" + inkscape:persp3d-origin="526.18109 : 248.03149 : 1" + id="perspective6943" /> + <marker + inkscape:stockid="Arrow1Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lend" + style="overflow:visible"> + <path + id="path17680" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.8,0,0,-0.8,-10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lstart" + style="overflow:visible"> + <path + id="path17677" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.8,0,0,0.8,10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mend" + style="overflow:visible"> + <path + id="path17686" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.4,0,0,-0.4,-4,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mstart" + style="overflow:visible"> + <path + id="path17683" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.4,0,0,0.4,4,0)" /> + </marker> + <linearGradient + id="linearGradient6508"> + <stop + id="stop6509" + offset="0.0000000" + style="stop-color:#ff0000;stop-opacity:1.0000000;" /> + <stop + id="stop6511" + offset="0.64370060" + style="stop-color:#ffb900;stop-opacity:1.0000000;" /> + <stop + id="stop6512" + offset="0.79038113" + style="stop-color:#ffff00;stop-opacity:0.84102565;" /> + <stop + id="stop6510" + offset="1.0000000" + style="stop-color:#ffffff;stop-opacity:0.21568628;" /> + </linearGradient> + <linearGradient + id="linearGradient13376"> + <stop + style="stop-color:#d4d4d4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop13377" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.49803922;" + offset="0.50000000" + id="stop13380" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop13378" /> + </linearGradient> + <linearGradient + id="linearGradient12744"> + <stop + style="stop-color:#839da4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12745" /> + <stop + style="stop-color:#496d77;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12746" /> + </linearGradient> + <linearGradient + id="linearGradient10810"> + <stop + style="stop-color:#0e0000;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop10811" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="0.50000000" + id="stop10814" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop10812" /> + </linearGradient> + <linearGradient + id="linearGradient11442"> + <stop + style="stop-color:#6e6e6e;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop11443" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop11444" /> + </linearGradient> + <linearGradient + id="linearGradient14160"> + <stop + style="stop-color:#4af853;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14161" /> + <stop + style="stop-color:#68b96d;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14162" /> + </linearGradient> + <linearGradient + id="linearGradient14835"> + <stop + style="stop-color:#bed1d0;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14836" /> + <stop + style="stop-color:#52727b;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14837" /> + </linearGradient> + <linearGradient + id="linearGradient29203"> + <stop + style="stop-color:#d3d3d3;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop29205" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop29207" /> + </linearGradient> + <linearGradient + id="linearGradient6658"> + <stop + style="stop-color:#677883;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop6659" /> + <stop + style="stop-color:#677883;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop6660" /> + </linearGradient> + <linearGradient + id="linearGradient41493"> + <stop + style="stop-color:#181818;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop41495" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop41497" /> + </linearGradient> + <linearGradient + id="linearGradient12759"> + <stop + style="stop-color:#b4b4b4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12761" /> + <stop + style="stop-color:#d7d8de;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12763" /> + </linearGradient> + <linearGradient + id="linearGradient21825"> + <stop + style="stop-color:#808080;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop21827" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop21829" /> + </linearGradient> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient25527" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.776429,0,0,0.659114,-120.5524,673.5049)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25525" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-145.458,730.6984)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25403" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-145.2247,712.702)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient25401" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-3.473342,95.2718)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient25353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-149.3489,792.5495)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient26976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.06505,808.8095)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28284" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28286" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28288" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28290" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28274" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28276" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28278" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28280" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28264" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28266" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28268" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28270" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28254" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28256" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28258" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28260" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28244" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28246" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28248" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28250" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28234" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28236" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28238" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28240" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28224" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28226" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28228" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28230" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28214" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28216" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28218" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28220" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28208" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-125.9178,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28210" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28204" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.573,808.7592)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28206" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28200" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-116.9703,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28202" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28196" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.6254,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28198" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28192" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.4824,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28194" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28188" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.1375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28190" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28184" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.77797,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28186" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28180" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.43307,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28182" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28172" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28174" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28176" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28178" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28162" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28164" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28166" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28168" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28152" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28154" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28156" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28158" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28142" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28144" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28146" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28148" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28132" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28134" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28136" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28138" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28122" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28124" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28126" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28128" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28112" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28114" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28116" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28118" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28102" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28104" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28106" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28108" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28096" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.2375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28098" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28092" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-156.8927,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28094" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28088" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.29,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28090" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28084" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-147.9451,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28086" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28080" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-143.8021,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28082" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28076" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.4573,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28078" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28072" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.098,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28074" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28068" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.7531,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28070" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28060" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28062" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28064" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28066" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28050" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28052" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28054" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28056" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28040" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28042" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28044" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28046" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28030" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28032" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28034" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28036" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28020" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28022" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28024" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28026" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28010" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28012" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28014" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28016" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28000" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28002" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28004" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28006" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27990" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27992" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27994" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27996" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27984" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.2616,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27986" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27980" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-192.9168,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27982" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.3141,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27978" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-183.9692,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27968" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-179.8262,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27970" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.4813,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27960" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.122,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27962" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27956" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.7771,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27958" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27928" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27930" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27932" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27934" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27918" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27920" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27922" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27924" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27908" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27910" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27912" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27914" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27898" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27900" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27902" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27904" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27888" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27890" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27892" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27894" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27878" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27880" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27882" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27884" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27868" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27870" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27872" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27874" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27858" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27860" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27862" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27864" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27848" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27850" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27852" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27854" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27838" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27840" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27842" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27844" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27828" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27830" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27832" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27834" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27818" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27820" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27822" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27824" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27808" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27810" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27812" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27814" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27798" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27800" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27802" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27804" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27788" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27790" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27792" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27794" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27778" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27780" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27782" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27784" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27768" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27770" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27772" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27774" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27758" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27760" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27762" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27764" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27748" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27750" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27752" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27754" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27738" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27740" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27742" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27744" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27728" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27730" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27732" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27734" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27718" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27720" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27722" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27724" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27708" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27710" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27712" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27714" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27698" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27700" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27702" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27704" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28432" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-126.1386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28434" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28428" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.7938,817.6604)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28430" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28424" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-117.1911,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28426" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28420" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.8462,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28422" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28416" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.7032,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28418" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28412" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.3583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28414" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28408" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.99876,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28410" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28404" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.65386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28406" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28400" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.4583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28402" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28396" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-157.1135,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28398" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28392" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.5108,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28394" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28388" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-148.1659,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28390" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28384" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-144.0229,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28386" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28380" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.6781,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28382" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28376" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.3188,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28378" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28372" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.9739,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28374" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28368" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.4824,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28370" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28364" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-193.1376,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28366" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28360" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.5349,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28362" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28356" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-184.19,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28358" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28352" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-180.047,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28354" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28348" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.7021,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28350" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28344" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.3428,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28346" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28340" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.9979,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28342" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28438" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.25863,817.7848)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36281" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-149.897,802.9053)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36283" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36285" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36287" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36289" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36291" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36293" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36295" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36297" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36299" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36301" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36303" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36305" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36307" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36309" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36311" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36313" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36315" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36317" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36319" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36321" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36323" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36325" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36327" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36329" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36331" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5348,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36333" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7196,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36335" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.35,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36337" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.274,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36339" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.9043,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36341" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.0892,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36343" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-149.6637,784.9089)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient36345" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-7.912301,167.4787)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36347" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5296,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36349" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7144,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36351" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.3448,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.2688,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36355" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.8991,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36357" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.084,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36359" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-198.4916,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36361" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.046,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36363" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.2306,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36365" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-192.8611,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36367" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-195.6763,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36369" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-87.12747,420.4818)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36371" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36373" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36375" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-91.66274,388.2275)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36377" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36379" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36381" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-153.7879,864.7564)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35867" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-141.9847,635.4266)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35869" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35871" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35873" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35875" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35877" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35879" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35881" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35883" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35885" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35887" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35889" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35891" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35893" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35895" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35897" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35899" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35901" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35903" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35905" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35907" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35909" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35911" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35913" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35915" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35917" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35919" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35921" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35923" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35925" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35927" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35929" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35931" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35933" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35935" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35937" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35939" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35941" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35943" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35945" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35947" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35949" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35951" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35953" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35955" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35957" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35959" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35961" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35963" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35965" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6225,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35967" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.7312,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35969" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2856,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35971" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.4702,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35973" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.1007,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35975" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8073,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35977" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9159,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35979" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4377,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35981" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5465,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35983" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3617,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35985" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.992,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35987" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1769,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35989" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-141.7514,617.4302)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient35991" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(2.672454,0.374188)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35993" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6173,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35995" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.726,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35997" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2804,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35999" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.465,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36001" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.0955,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36003" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8021,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36005" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9107,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36007" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4325,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36009" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5413,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36011" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3565,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36013" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.9868,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36015" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1717,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36017" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.5793,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36019" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.1337,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36021" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.3183,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36023" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-184.9488,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36025" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.764,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36027" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-79.21517,253.0031)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36029" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36031" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36033" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-83.75044,220.7488)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36035" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36037" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36039" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-145.8756,697.2777)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient12151" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.20227,0,0,0.454077,6.691668,-148.3193)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12153" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,1.691668,-145.8193)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient14835" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12155" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,1.924904,-161.8157)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12157" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.350818,114.6621,-134.6472)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12159" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-59.65453)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12161" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-61.33423)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12163" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-63.01391)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12165" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.09869,-64.40064)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + </defs> + <sodipodi:namedview + bordercolor="#666666" + borderopacity="1.0" + id="base" + inkscape:current-layer="layer1" + inkscape:cx="495.44191" + inkscape:cy="251.71914" + inkscape:document-units="px" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:window-height="953" + inkscape:window-width="1280" + inkscape:window-x="0" + inkscape:window-y="25" + inkscape:zoom="1" + pagecolor="#ffffff" + width="1052.3622px" + height="744.09448px" + showgrid="false" /> + <g + id="layer1" + inkscape:groupmode="layer" + inkscape:label="Layer 1"> + <g + id="g5278" + transform="matrix(0.1267968,0,0,0.1710106,135.15833,371.75325)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path569" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path568" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path566" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g12774" + transform="matrix(0.1881701,0,0,0.2844466,245.77219,174.33679)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12776" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12778" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12780" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <flowRoot + xml:space="preserve" + id="flowRoot12890" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(12.007531,-421.27533)"><flowRegion + id="flowRegion12892"><rect + id="rect12894" + width="258.14285" + height="67" + x="194.28572" + y="475.52304" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara12898">Push Based Replication</flowPara><flowPara + id="flowPara6968">(replacing slurpd)</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot15524" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(114.94413,-217.88838)"><flowRegion + id="flowRegion15526"><rect + id="rect15528" + width="129.29955" + height="26.263966" + x="137.38075" + y="681.46503" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara15542">Replicas</flowPara></flowRoot> <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 166.31983,373.76445 L 273.396,325.27713" + id="path23715" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.03078127px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 312.57943,327.85652 L 434.22276,373.20536" + id="path25655" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 293.59905,371.74414 L 293.59905,317.19591" + id="path25659" /> + <flowRoot + xml:space="preserve" + id="flowRoot27609" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(90,50)"><flowRegion + id="flowRegion27611"><rect + id="rect27613" + width="134.05586" + height="26.345188" + x="96.974648" + y="113.75929" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara27617">Master/Provider</flowPara></flowRoot> <g + id="g3073" + transform="matrix(0.1267968,0,0,0.1710106,264.00249,370.01498)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path3075" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3077" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3079" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g3081" + transform="matrix(0.1267968,0,0,0.1710106,411.48475,365.97437)"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path3083" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3085" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3087" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <flowRoot + xml:space="preserve" + id="flowRoot3120" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="matrix(1,0,0,1.2037203,-16.30957,-194.07388)"><flowRegion + id="flowRegion3122"><rect + id="rect3124" + width="210.52287" + height="143.55249" + x="412.14224" + y="279.42432" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara3136">Primary directory also contains back-ldap databases that replicate from the Master directory and push out changes to the replicas</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot6975" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + transform="translate(18,-68)"><flowRegion + id="flowRegion6977"><rect + id="rect6979" + width="165" + height="63" + x="469" + y="437.09448" /></flowRegion><flowPara + id="flowPara6981">Replicas are readonly, but referrals can be handled by clients or using the chaining overlay. </flowPara></flowRoot> </g> +</svg> diff --git a/doc/guide/images/src/push-based-standalone.svg b/doc/guide/images/src/push-based-standalone.svg new file mode 100644 index 0000000..84ec2d1 --- /dev/null +++ b/doc/guide/images/src/push-based-standalone.svg @@ -0,0 +1,4844 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://creativecommons.org/ns#" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + height="524.40942" + id="svg7893" + inkscape:version="0.46" + sodipodi:docbase="/home/ghenry/Desktop" + sodipodi:docname="push-based-standalone.svg" + sodipodi:version="0.32" + width="744.09448" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + version="1.0" + inkscape:export-filename="/home/ghenry/Desktop/dual_dc.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <metadata + id="metadata2563"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:title>Firewall2</dc:title> + <dc:description /> + <dc:subject> + <rdf:Bag> + <rdf:li>wall</rdf:li> + <rdf:li>brick</rdf:li> + <rdf:li>computer</rdf:li> + <rdf:li>networksym</rdf:li> + </rdf:Bag> + </dc:subject> + <dc:publisher> + <cc:Agent + rdf:about="http://www.openclipart.org/"> + <dc:title>Open Clip Art Library</dc:title> + </cc:Agent> + </dc:publisher> + <dc:creator> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:creator> + <dc:rights> + <cc:Agent> + <dc:title>HASH(0x89c79d4)</dc:title> + </cc:Agent> + </dc:rights> + <dc:date /> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + <cc:license + rdf:resource="http://web.resource.org/cc/PublicDomain" /> + <dc:language>en</dc:language> + </cc:Work> + <cc:License + rdf:about="http://web.resource.org/cc/PublicDomain"> + <cc:permits + rdf:resource="http://web.resource.org/cc/Reproduction" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/Distribution" /> + <cc:permits + rdf:resource="http://web.resource.org/cc/DerivativeWorks" /> + </cc:License> + </rdf:RDF> + </metadata> + <defs + id="defs7895"> + <inkscape:perspective + sodipodi:type="inkscape:persp3d" + inkscape:vp_x="0 : 372.04724 : 1" + inkscape:vp_y="0 : 1000 : 0" + inkscape:vp_z="1052.3622 : 372.04724 : 1" + inkscape:persp3d-origin="526.18109 : 248.03149 : 1" + id="perspective6943" /> + <marker + inkscape:stockid="Arrow1Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lend" + style="overflow:visible"> + <path + id="path17680" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.8,0,0,-0.8,-10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lstart" + style="overflow:visible"> + <path + id="path17677" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.8,0,0,0.8,10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mend" + style="overflow:visible"> + <path + id="path17686" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.4,0,0,-0.4,-4,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Mstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Mstart" + style="overflow:visible"> + <path + id="path17683" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z" + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.4,0,0,0.4,4,0)" /> + </marker> + <linearGradient + id="linearGradient6508"> + <stop + id="stop6509" + offset="0.0000000" + style="stop-color:#ff0000;stop-opacity:1.0000000;" /> + <stop + id="stop6511" + offset="0.64370060" + style="stop-color:#ffb900;stop-opacity:1.0000000;" /> + <stop + id="stop6512" + offset="0.79038113" + style="stop-color:#ffff00;stop-opacity:0.84102565;" /> + <stop + id="stop6510" + offset="1.0000000" + style="stop-color:#ffffff;stop-opacity:0.21568628;" /> + </linearGradient> + <linearGradient + id="linearGradient13376"> + <stop + style="stop-color:#d4d4d4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop13377" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.49803922;" + offset="0.50000000" + id="stop13380" /> + <stop + style="stop-color:#ffffff;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop13378" /> + </linearGradient> + <linearGradient + id="linearGradient12744"> + <stop + style="stop-color:#839da4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12745" /> + <stop + style="stop-color:#496d77;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12746" /> + </linearGradient> + <linearGradient + id="linearGradient10810"> + <stop + style="stop-color:#0e0000;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop10811" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="0.50000000" + id="stop10814" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop10812" /> + </linearGradient> + <linearGradient + id="linearGradient11442"> + <stop + style="stop-color:#6e6e6e;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop11443" /> + <stop + style="stop-color:#000000;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop11444" /> + </linearGradient> + <linearGradient + id="linearGradient14160"> + <stop + style="stop-color:#4af853;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14161" /> + <stop + style="stop-color:#68b96d;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14162" /> + </linearGradient> + <linearGradient + id="linearGradient14835"> + <stop + style="stop-color:#bed1d0;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop14836" /> + <stop + style="stop-color:#52727b;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop14837" /> + </linearGradient> + <linearGradient + id="linearGradient29203"> + <stop + style="stop-color:#d3d3d3;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop29205" /> + <stop + style="stop-color:#ffffff;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop29207" /> + </linearGradient> + <linearGradient + id="linearGradient6658"> + <stop + style="stop-color:#677883;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop6659" /> + <stop + style="stop-color:#677883;stop-opacity:0.0000000;" + offset="1.0000000" + id="stop6660" /> + </linearGradient> + <linearGradient + id="linearGradient41493"> + <stop + style="stop-color:#181818;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop41495" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop41497" /> + </linearGradient> + <linearGradient + id="linearGradient12759"> + <stop + style="stop-color:#b4b4b4;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop12761" /> + <stop + style="stop-color:#d7d8de;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop12763" /> + </linearGradient> + <linearGradient + id="linearGradient21825"> + <stop + style="stop-color:#808080;stop-opacity:1.0000000;" + offset="0.0000000" + id="stop21827" /> + <stop + style="stop-color:#5e5e5e;stop-opacity:1.0000000;" + offset="1.0000000" + id="stop21829" /> + </linearGradient> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient25527" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.776429,0,0,0.659114,-120.5524,673.5049)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25525" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-145.458,730.6984)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient25403" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-145.2247,712.702)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient25401" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-3.473342,95.2718)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient25353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-149.3489,792.5495)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient26976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.06505,808.8095)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient26964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.05831,0,0,0.803858,616.249,115.0105)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient26966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.838868,0,0,0.530755,508.4408,137.664)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28284" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28286" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28288" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28290" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28274" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28276" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28278" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28280" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28264" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28266" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28268" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28270" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28254" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28256" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28258" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28260" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28244" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28246" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28248" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28250" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28234" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28236" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28238" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28240" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28224" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28226" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28228" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28230" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28214" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28216" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28218" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28220" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28208" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-125.9178,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28210" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28204" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.573,808.7592)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28206" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28200" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-116.9703,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28202" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28196" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.6254,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28198" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28192" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.4824,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28194" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28188" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.1375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28190" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28184" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.77797,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28186" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28180" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.43307,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28182" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.0884,752.134)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28172" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28174" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28176" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28178" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28162" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28164" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28166" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28168" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28152" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28154" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28156" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28158" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28142" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28144" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28146" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28148" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28132" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28134" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28136" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28138" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28122" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28124" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28126" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28128" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28112" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28114" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28116" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28118" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28102" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28104" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28106" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28108" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28096" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.2375,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28098" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28092" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-156.8927,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28094" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28088" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.29,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28090" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28084" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-147.9451,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28086" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28080" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-143.8021,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28082" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28076" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.4573,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28078" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28072" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.098,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28074" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28068" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.7531,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28070" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28060" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28062" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28064" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28066" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28050" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28052" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28054" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28056" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28040" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28042" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28044" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28046" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28030" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28032" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28034" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28036" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28020" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28022" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28024" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28026" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28010" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28012" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28014" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28016" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient28000" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28002" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient28004" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient28006" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27990" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27992" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27994" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27996" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27984" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.2616,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27986" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27980" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-192.9168,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27982" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27976" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.3141,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27978" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27972" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-183.9692,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27974" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27968" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-179.8262,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27970" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27964" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.4813,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27966" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27960" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.122,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27962" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient27956" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.7771,808.7593)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient27958" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.3469,752.134)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27928" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27930" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27932" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27934" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27918" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27920" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27922" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27924" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27908" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27910" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27912" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27914" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27898" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27900" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27902" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27904" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27888" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27890" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27892" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27894" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27878" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27880" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27882" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27884" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27868" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27870" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27872" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27874" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27858" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27860" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27862" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27864" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27848" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27850" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27852" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27854" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27838" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27840" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27842" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27844" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27828" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27830" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27832" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27834" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27818" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27820" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27822" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27824" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27808" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27810" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27812" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27814" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27798" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27800" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27802" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27804" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27788" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27790" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27792" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27794" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27778" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27780" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27782" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27784" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27768" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27770" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27772" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27774" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27758" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27760" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27762" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27764" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27748" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27750" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27752" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27754" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27738" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27740" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27742" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27744" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27728" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27730" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27732" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27734" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27718" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27720" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27722" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27724" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27708" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27710" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27712" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27714" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient27698" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27700" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient27702" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient6658" + r="2.8901422" + id="radialGradient27704" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(1.112677,0.898733)" + fy="84.14624" + fx="-75.26889" + cy="84.14624" + cx="-75.26889" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28432" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-126.1386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28434" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="97.536598" + cy="113.726" + cx="97.536598" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28428" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-121.7938,817.6604)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28430" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="100.67591" + cy="113.726" + cx="100.67591" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28424" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-117.1911,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28426" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="104.00187" + cy="113.726" + cx="104.00187" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28420" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-112.8462,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28422" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="107.14119" + cy="113.726" + cx="107.14119" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28416" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-108.7032,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28418" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="110.13468" + cy="113.726" + cx="110.13468" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28412" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-104.3583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28414" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="113.27399" + cy="113.726" + cx="113.27399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28408" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-99.99876,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28410" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="116.42374" + cy="113.726" + cx="116.42374" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28404" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-95.65386,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28406" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-286.3092,761.0352)" + fy="113.726" + fx="119.56305" + cy="113.726" + cx="119.56305" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28400" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-161.4583,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28402" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="71.480988" + cy="113.726" + cx="71.480988" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28396" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-157.1135,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28398" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="74.620308" + cy="113.726" + cx="74.620308" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28392" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-152.5108,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28394" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="77.946259" + cy="113.726" + cx="77.946259" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28388" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-148.1659,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28390" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="81.085587" + cy="113.726" + cx="81.085587" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28384" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-144.0229,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28386" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="84.079071" + cy="113.726" + cx="84.079071" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28380" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-139.6781,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28382" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="87.218399" + cy="113.726" + cx="87.218399" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28376" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-135.3188,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28378" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="90.368126" + cy="113.726" + cx="90.368126" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28372" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-130.9739,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28374" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="93.507462" + cy="113.726" + cx="93.507462" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28368" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-197.4824,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28370" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="45.452175" + cy="113.726" + cx="45.452175" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28364" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-193.1376,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28366" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="48.591496" + cy="113.726" + cx="48.591496" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28360" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-188.5349,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28362" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="51.91745" + cy="113.726" + cx="51.91745" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28356" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-184.19,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28358" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="55.05677" + cy="113.726" + cx="55.05677" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28352" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-180.047,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28354" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="58.050255" + cy="113.726" + cx="58.050255" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28348" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-175.7021,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28350" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="61.189575" + cy="113.726" + cx="61.189575" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28344" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-171.3428,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28346" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="64.339317" + cy="113.726" + cx="64.339317" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28340" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-166.9979,817.6605)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient6658" + r="0.55242717" + id="radialGradient28342" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.384013,0,0,0.656868,-285.5677,761.0352)" + fy="113.726" + fx="67.478638" + cy="113.726" + cx="67.478638" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient28438" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.380937,0,0,0.180797,-90.25863,817.7848)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36281" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-149.897,802.9053)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36283" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36285" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36287" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36289" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36291" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36293" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36295" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36297" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36299" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36301" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36303" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36305" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36307" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36309" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36311" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36313" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36315" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36317" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36319" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36321" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36323" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36325" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36327" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36329" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36331" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5348,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36333" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7196,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36335" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.35,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36337" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.274,879.6484)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36339" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.9043,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36341" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.0892,879.6483)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient36343" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-149.6637,784.9089)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient36345" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.672454,0,0,0.374188,-7.912301,167.4787)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36347" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.5296,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36349" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-185.7144,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36351" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-189.3448,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36353" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-180.2688,881.7646)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36355" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-183.8991,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36357" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.084,881.7645)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36359" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-198.4916,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36361" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.046,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36363" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.2306,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36365" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-192.8611,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36367" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-195.6763,883.5145)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36369" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-87.12747,420.4818)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36371" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36373" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36375" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-91.66274,388.2275)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36377" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36379" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36381" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-153.7879,864.7564)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12759" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35867" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,-141.9847,635.4266)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35869" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35871" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35873" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35875" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35877" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35879" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35881" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35883" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35885" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35887" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35889" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35891" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35893" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35895" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35897" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35899" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35901" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35903" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35905" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35907" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35909" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35911" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35913" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35915" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35917" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35919" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35921" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35923" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35925" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35927" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35929" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35931" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35933" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35935" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35937" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35939" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35941" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35943" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35945" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35947" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35949" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35951" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35953" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35955" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35957" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35959" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient35961" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient35963" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35965" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6225,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35967" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.7312,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35969" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2856,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35971" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.4702,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35973" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.1007,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35975" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8073,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35977" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9159,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35979" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4377,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35981" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5465,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35983" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3617,712.1697)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35985" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.992,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35987" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1769,712.1696)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient21825" + x2="8.3977861" + x1="-35.94503" + id="linearGradient35989" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,-141.7514,617.4302)" /> + <linearGradient + y2="1977.8738" + y1="1924.0137" + xlink:href="#linearGradient41493" + x2="-35.763195" + x1="-39.828941" + id="linearGradient35991" + gradientUnits="userSpaceOnUse" + gradientTransform="scale(2.672454,0.374188)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35993" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.6173,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35995" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-168.726,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35997" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-163.2804,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient35999" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-161.465,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36001" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-165.0955,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36003" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-177.8021,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36005" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-166.9107,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36007" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-181.4325,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36009" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-170.5413,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36011" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-172.3565,714.2859)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36013" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-175.9868,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36015" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-174.1717,714.2858)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36017" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-190.5793,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36019" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-182.1337,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36021" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-179.3183,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36023" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-184.9488,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36025" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-187.764,716.0358)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36027" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.74272,0,0,0.445632,-79.21517,253.0031)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36029" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36031" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <linearGradient + y2="1085.6781" + y1="1085.6781" + xlink:href="#linearGradient12759" + x2="-116.40664" + x1="-128.30727" + id="linearGradient36033" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.787283,0,0,0.475341,-83.75044,220.7488)" /> + <linearGradient + y2="84.271248" + y1="80.490494" + xlink:href="#linearGradient10810" + x2="-152.33473" + x1="-156.03067" + id="linearGradient36035" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.731264,0,0,1.388554,183.0968,-38.74554)" /> + <linearGradient + y2="80.317116" + y1="83.947449" + xlink:href="#linearGradient11442" + x2="-63.953007" + x1="-64.000694" + id="linearGradient36037" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.372284,0,0,0.916806,6.735873,0)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient36039" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(1.270019,0,0,0.370779,-145.8756,697.2777)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient13376" + r="31.620827" + id="radialGradient12151" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.20227,0,0,0.454077,6.691668,-148.3193)" + fy="254.35735" + fx="-19.038713" + cy="253.63734" + cx="-19.261518" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12153" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.399114,1.691668,-145.8193)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient14835" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12155" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.500039,0,0,0.399114,1.924904,-161.8157)" /> + <linearGradient + y2="275.81308" + y1="233.36613" + xlink:href="#linearGradient12744" + x2="8.3977861" + x1="-35.94503" + id="linearGradient12157" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(2.505549,0,0,0.350818,114.6621,-134.6472)" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12159" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-59.65453)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12161" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-61.33423)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12163" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.07916,-63.01391)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + <radialGradient + xlink:href="#linearGradient14160" + r="2.0070677" + id="radialGradient12165" + gradientUnits="userSpaceOnUse" + gradientTransform="matrix(0.389249,0,0,0.194625,-60.09869,-64.40064)" + fy="99.988457" + fx="-66.099426" + cy="99.988457" + cx="-66.099426" /> + </defs> + <sodipodi:namedview + bordercolor="#666666" + borderopacity="1.0" + id="base" + inkscape:current-layer="layer1" + inkscape:cx="495.44191" + inkscape:cy="251.71914" + inkscape:document-units="px" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:window-height="953" + inkscape:window-width="1280" + inkscape:window-x="0" + inkscape:window-y="25" + inkscape:zoom="1" + pagecolor="#ffffff" + width="1052.3622px" + height="744.09448px" + showgrid="false" /> + <g + id="layer1" + inkscape:groupmode="layer" + inkscape:label="Layer 1"> + <g + id="g5278" + transform="matrix(0.1267968,0,0,0.1710106,135.15833,371.75325)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path569" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path568" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path566" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g12774" + transform="matrix(0.1881701,0,0,0.2844466,82.77219,152.33679)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path12776" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12778" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path12780" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <flowRoot + xml:space="preserve" + id="flowRoot12890" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(12.007531,-421.27533)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"><flowRegion + id="flowRegion12892"><rect + id="rect12894" + width="258.14285" + height="67" + x="194.28572" + y="475.52304" + style="font-size:24px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara12898">Push Based Replication</flowPara><flowPara + id="flowPara6968">(replacing slurpd)</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot15524" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(114.94413,-217.88838)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"><flowRegion + id="flowRegion15526"><rect + id="rect15528" + width="129.29955" + height="26.263966" + x="137.38075" + y="681.46503" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara15542">Replicas</flowPara></flowRoot> <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 166.31983,373.76445 L 273.396,325.27713" + id="path23715" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1.03078127px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 312.57943,327.85652 L 434.22276,373.20536" + id="path25655" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 293.59905,371.74414 L 293.59905,317.19591" + id="path25659" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90" /> + <flowRoot + xml:space="preserve" + id="flowRoot27609" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="translate(-57,29)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"><flowRegion + id="flowRegion27611"><rect + id="rect27613" + width="134.05586" + height="26.345188" + x="96.974648" + y="113.75929" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara27617">Master/Provider</flowPara></flowRoot> <g + id="g3073" + transform="matrix(0.1267968,0,0,0.1710106,264.00249,370.01498)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path3075" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3077" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3079" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <g + id="g3081" + transform="matrix(0.1267968,0,0,0.1710106,411.48475,365.97437)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path3083" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3085" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path3087" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <flowRoot + xml:space="preserve" + id="flowRoot3120" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" + transform="matrix(1,0,0,1.2037203,-16.30957,-194.07388)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"><flowRegion + id="flowRegion3122"><rect + id="rect3124" + width="317.52289" + height="139.3987" + x="412.14224" + y="279.42432" + style="font-size:18px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Arial" /></flowRegion><flowPara + id="flowPara3136">Primary directory is a standard OpenLDAP Master, ldap proxy using Syncrepl pulls in changes from the master and pushes out to replicas. Useful if you don't have access to original master.</flowPara></flowRoot> <flowRoot + xml:space="preserve" + id="flowRoot6975" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + transform="translate(18,-68)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"><flowRegion + id="flowRegion6977"><rect + id="rect6979" + width="165" + height="63" + x="469" + y="437.09448" /></flowRegion><flowPara + id="flowPara6981">Replicas are readonly, but referrals can be handled by clients or using the chaining overlay. </flowPara></flowRoot> <g + id="g7023" + transform="matrix(0.1267968,0,0,0.1710106,261.38313,237.27416)" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90"> + <path + transform="matrix(0,-0.604122,1.608296,0,-165.2214,394.5863)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:3.75" + sodipodi:nodetypes="ccccccc" + id="path7025" + d="M 426.278,378.046 L 79.4376,379.165 C 79.4376,379.165 -4.63207,356.939 -1.27547,255.125 C -13.892,169.635 56.2895,146.476 60.7648,142 C 65.2402,137.525 427.397,137.496 427.397,137.496 L 427.397,137.496 L 426.278,378.046 z" /> + <path + transform="matrix(0,-0.174045,0.823205,0,39.47672,182.772)" + style="font-size:12px;fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:9.76546001" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path7027" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + <path + transform="matrix(0,-0.169729,0.807961,0,43.34661,181.9851)" + style="font-size:12px;fill:#cccccc;fill-opacity:1;fill-rule:evenodd;stroke-width:3.75" + sodipodi:type="arc" + sodipodi:ry="236.07524" + sodipodi:rx="234.95641" + sodipodi:cy="253.85521" + sodipodi:cx="260.68973" + id="path7029" + d="M 495.64613,253.85521 A 234.95641,236.07524 0 1 1 25.733322,253.85521 A 234.95641,236.07524 0 1 1 495.64613,253.85521 z" /> + </g> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.89670002px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow1Lstart);marker-mid:none;marker-end:url(#Arrow1Lend);stroke-opacity:1" + d="M 170.1113,236.57545 L 255.8887,285.24339" + id="path7031" + inkscape:export-filename="/anything/src/openldap/ldap/doc/guide/images/src/push-based-complete.png" + inkscape:export-xdpi="90" + inkscape:export-ydpi="90" /> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="253" + y="224.40942" + id="text7033"><tspan + sodipodi:role="line" + id="tspan7035" + x="253" + y="224.40942">Standalone</tspan><tspan + sodipodi:role="line" + x="253" + y="239.40942" + id="tspan7037">LDAP Proxy</tspan></text> + </g> +</svg> diff --git a/doc/guide/images/src/refint.svg b/doc/guide/images/src/refint.svg new file mode 100644 index 0000000..5a118f7 --- /dev/null +++ b/doc/guide/images/src/refint.svg @@ -0,0 +1,199 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://web.resource.org/cc/" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + width="412.04193" + height="172.80376" + id="svg2" + sodipodi:version="0.32" + inkscape:version="0.45.1" + version="1.0" + sodipodi:docbase="/home/andreas/palestra" + sodipodi:docname="refint.svg" + inkscape:output_extension="org.inkscape.output.svg.inkscape"> + <defs + id="defs4"> + <marker + inkscape:stockid="Arrow2Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow2Lend" + style="overflow:visible"> + <path + id="path8347" + style="font-size:12px;fill-rule:evenodd;stroke-width:0.625;stroke-linejoin:round" + d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.97309,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " + transform="matrix(-1.1,0,0,-1.1,-1.1,0)" /> + </marker> + </defs> + <sodipodi:namedview + id="base" + pagecolor="#ffffff" + bordercolor="#666666" + borderopacity="1.0" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:zoom="1.386" + inkscape:cx="381.27532" + inkscape:cy="98.970161" + inkscape:document-units="px" + inkscape:current-layer="layer1" + showgrid="true" + showguides="false" + inkscape:window-width="1278" + inkscape:window-height="724" + inkscape:window-x="0" + inkscape:window-y="25" /> + <metadata + id="metadata7"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + </cc:Work> + </rdf:RDF> + </metadata> + <g + inkscape:label="Camada 1" + inkscape:groupmode="layer" + id="layer1" + transform="translate(-29.66815,-34.695504)"> + <g + id="g7325" + transform="translate(-297.25829,101.81818)"> + <g + transform="translate(233.76623,-28.71069)" + id="g7289"> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="124.81962" + y="80.50071" + id="text2160"><tspan + sodipodi:role="line" + id="tspan2162" + x="124.81962" + y="80.50071" + style="font-weight:normal">DN: uid=john,ou=people,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="124.81962" + y="95.50071" + id="tspan2164">uid: john</tspan><tspan + sodipodi:role="line" + x="124.81962" + y="110.50071" + id="tspan2166">mail: john@example.com</tspan><tspan + sodipodi:role="line" + x="124.81962" + y="125.50071" + id="tspan2168">(...)</tspan></text> + <rect + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.79348463px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + id="rect2182" + width="298.90784" + height="68.027596" + x="121.10886" + y="65.967438" /> + <rect + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none;stroke-width:0.69669151;stroke-opacity:1" + id="rect3159" + width="298.28311" + height="17.619322" + x="121.06046" + y="66.674454" /> + </g> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="358.58585" + y="51.79002" + id="text7300"><tspan + sodipodi:role="line" + id="tspan7302" + x="358.58585" + y="51.79002" + style="font-weight:normal">DN: uid=john,ou=people,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="358.58585" + y="66.79002" + id="tspan7304">uid: john</tspan><tspan + sodipodi:role="line" + x="358.58585" + y="81.79002" + id="tspan7306">mail: john@example.com</tspan><tspan + sodipodi:role="line" + x="358.58585" + y="96.79002" + id="tspan7308">(...)</tspan></text> + <rect + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.79348463px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + id="rect7310" + width="298.90784" + height="68.027596" + x="354.87509" + y="37.256748" /> + <rect + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none;stroke-width:0.69669151;stroke-opacity:1" + id="rect7312" + width="298.28311" + height="17.619322" + x="354.82669" + y="37.963764" /> + </g> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="116.88309" + y="48.033184" + id="text2170"><tspan + sodipodi:role="line" + id="tspan2172" + x="116.88309" + y="48.033184">DN: cn=tech,ou=group,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="63.033184" + id="tspan2174">cn: tech</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="78.033184" + id="tspan2176" + style="font-weight:normal">member: uid=john,ou=people,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="93.033184" + id="tspan2178">member: uid=mary,ou=people,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="116.88309" + y="108.03318" + id="tspan2180">(...)</tspan></text> + <rect + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.8948347px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + id="rect7321" + width="328.38803" + height="78.748756" + x="112.59964" + y="35.142921" /> + <rect + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none;stroke-width:0.69669151;stroke-opacity:1" + id="rect7323" + width="329.30765" + height="17.619322" + x="112.40244" + y="65.054672" /> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Lend);stroke-opacity:1" + d="M 54.112554,146.87878 C -1.5132611,141.59779 49.816091,72.233662 106.06061,73.285704" + id="path7352" + sodipodi:nodetypes="cc" /> + </g> +</svg> diff --git a/doc/guide/images/src/set-following-references.svg b/doc/guide/images/src/set-following-references.svg new file mode 100644 index 0000000..6b15705 --- /dev/null +++ b/doc/guide/images/src/set-following-references.svg @@ -0,0 +1,272 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://web.resource.org/cc/" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + width="383.93671" + height="174.87033" + id="svg2" + sodipodi:version="0.32" + inkscape:version="0.45.1" + version="1.0" + sodipodi:docbase="/home/andreas/cvs/openldap-guide/images/src" + sodipodi:docname="set-managersecretary.svg" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + inkscape:export-filename="/home/andreas/palestra/managersecretary.png" + inkscape:export-xdpi="187.53" + inkscape:export-ydpi="187.53"> + <defs + id="defs4"> + <marker + inkscape:stockid="Arrow1Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lend" + style="overflow:visible"> + <path + id="path3186" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.8,0,0,-0.8,-10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lstart" + style="overflow:visible"> + <path + id="path3183" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.8,0,0,0.8,10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Send" + orient="auto" + refY="0" + refX="0" + id="Arrow1Send" + style="overflow:visible"> + <path + id="path3198" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.2,0,0,-0.2,-1.2,0)" /> + </marker> + <marker + inkscape:stockid="Arrow2Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow2Lstart" + style="overflow:visible"> + <path + id="path3201" + style="font-size:12px;fill-rule:evenodd;stroke-width:0.625;stroke-linejoin:round" + d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.97309,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " + transform="matrix(1.1,0,0,1.1,1.1,0)" /> + </marker> + <marker + inkscape:stockid="Arrow2Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow2Lend" + style="overflow:visible"> + <path + id="path8347" + style="font-size:12px;fill-rule:evenodd;stroke-width:0.625;stroke-linejoin:round" + d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.97309,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " + transform="matrix(-1.1,0,0,-1.1,-1.1,0)" /> + </marker> + </defs> + <sodipodi:namedview + id="base" + pagecolor="#ffffff" + bordercolor="#666666" + borderopacity="1.0" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:zoom="3.1307244" + inkscape:cx="191.96835" + inkscape:cy="87.435165" + inkscape:document-units="px" + inkscape:current-layer="layer1" + showgrid="true" + showguides="false" + inkscape:window-width="1280" + inkscape:window-height="953" + inkscape:window-x="0" + inkscape:window-y="24" + width="1052.3622px" + height="744.09449px" /> + <metadata + id="metadata7"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + </cc:Work> + </rdf:RDF> + </metadata> + <g + inkscape:label="Camada 1" + inkscape:groupmode="layer" + id="layer1" + transform="translate(-241.56641,-98.789978)"> + <g + id="g3270" + transform="translate(0,-9.9371414e-6)"> + <text + inkscape:export-ydpi="136.2" + inkscape:export-xdpi="136.2" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + id="text2170" + y="112.12766" + x="267.92389" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + xml:space="preserve"><tspan + y="112.12766" + x="267.92389" + id="tspan2172" + sodipodi:role="line">DN: uid=john,ou=people,dc=example,dc=com</tspan><tspan + id="tspan2174" + y="127.12766" + x="267.92389" + sodipodi:role="line">uid: john</tspan><tspan + id="tspan5373" + y="142.12766" + x="267.92389" + sodipodi:role="line">manager: uid=mary,ou=people,dc=example,dc=com</tspan><tspan + id="tspan3411" + y="157.12766" + x="267.92389" + sodipodi:role="line" /></text> + <rect + inkscape:export-ydpi="136.2" + inkscape:export-xdpi="136.2" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + y="99.161621" + x="263.56467" + height="53.761242" + width="331.86697" + id="rect7321" + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.74326539px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" /> + <rect + inkscape:export-ydpi="136.2" + inkscape:export-xdpi="136.2" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + y="130.60817" + x="265.52121" + height="17.286547" + width="327.07599" + id="rect7323" + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none;stroke-width:0.69669151;stroke-opacity:1" /> + </g> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="299.92389" + y="250.12769" + id="text2235" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2"><tspan + sodipodi:role="line" + id="tspan2237" + x="299.92389" + y="250.12769">DN: uid=jane,ou=people,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="299.92389" + y="265.12769" + id="tspan2239">uid: jane</tspan><tspan + sodipodi:role="line" + x="299.92389" + y="280.12769" + id="tspan2241" /><tspan + sodipodi:role="line" + x="299.92389" + y="295.12769" + id="tspan2243" /></text> + <rect + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.60843331px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + id="rect2245" + width="329.70166" + height="36.261875" + x="295.49725" + y="237.09422" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + <g + id="g3279" + transform="translate(0,-1.3751839e-5)"> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="283.92386" + y="181.12766" + id="text2223" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2"><tspan + sodipodi:role="line" + id="tspan2225" + x="283.92386" + y="181.12766">DN: uid=mary,ou=people,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="283.92386" + y="196.12766" + id="tspan2227">uid: mary</tspan><tspan + sodipodi:role="line" + x="283.92386" + y="211.12766" + id="tspan2229">secretary: uid=jane,ou=people,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="283.92386" + y="226.12766" + id="tspan2231" /></text> + <rect + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.74326539px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + id="rect2233" + width="331.86697" + height="53.761246" + x="279.56464" + y="168.16162" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + <rect + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none;stroke-width:0.69669151;stroke-opacity:1" + id="rect2247" + width="327.07599" + height="17.286547" + x="281.52118" + y="197.60815" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + </g> + <path + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Lend);stroke-opacity:1" + d="M 147.97396,105.42967 C 100.43828,122.29717 161.77464,141.46478 161.77464,141.46478" + id="path2275" + transform="translate(112.15223,34.695502)" + sodipodi:nodetypes="cc" /> + <path + sodipodi:nodetypes="cc" + id="path3248" + d="M 276.12619,208.12517 C 228.59051,224.99267 289.92687,244.16028 289.92687,244.16028" + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Lend);stroke-opacity:1" /> + </g> +</svg> diff --git a/doc/guide/images/src/set-memberUid.svg b/doc/guide/images/src/set-memberUid.svg new file mode 100644 index 0000000..52e958b --- /dev/null +++ b/doc/guide/images/src/set-memberUid.svg @@ -0,0 +1,272 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://web.resource.org/cc/" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + width="746.3288" + height="127.80122" + id="svg2" + sodipodi:version="0.32" + inkscape:version="0.45.1" + version="1.0" + sodipodi:docbase="/home/andreas/cvs/openldap-guide/images/src" + sodipodi:docname="set-memberUid.svg" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="70.18" + inkscape:export-ydpi="70.18"> + <defs + id="defs4"> + <marker + inkscape:stockid="Arrow1Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lend" + style="overflow:visible"> + <path + id="path3186" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.8,0,0,-0.8,-10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lstart" + style="overflow:visible"> + <path + id="path3183" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.8,0,0,0.8,10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Send" + orient="auto" + refY="0" + refX="0" + id="Arrow1Send" + style="overflow:visible"> + <path + id="path3198" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.2,0,0,-0.2,-1.2,0)" /> + </marker> + <marker + inkscape:stockid="Arrow2Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow2Lstart" + style="overflow:visible"> + <path + id="path3201" + style="font-size:12px;fill-rule:evenodd;stroke-width:0.625;stroke-linejoin:round" + d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.97309,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " + transform="matrix(1.1,0,0,1.1,1.1,0)" /> + </marker> + <marker + inkscape:stockid="Arrow2Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow2Lend" + style="overflow:visible"> + <path + id="path8347" + style="font-size:12px;fill-rule:evenodd;stroke-width:0.625;stroke-linejoin:round" + d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.97309,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " + transform="matrix(-1.1,0,0,-1.1,-1.1,0)" /> + </marker> + </defs> + <sodipodi:namedview + id="base" + pagecolor="#ffffff" + bordercolor="#666666" + borderopacity="1.0" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:zoom="1.6105502" + inkscape:cx="373.1644" + inkscape:cy="63.900612" + inkscape:document-units="px" + inkscape:current-layer="layer1" + showgrid="true" + showguides="false" + inkscape:window-width="1280" + inkscape:window-height="953" + inkscape:window-x="0" + inkscape:window-y="24" + width="1052.3622px" + height="744.09449px" /> + <metadata + id="metadata7"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + </cc:Work> + </rdf:RDF> + </metadata> + <g + inkscape:label="Camada 1" + inkscape:groupmode="layer" + id="layer1" + transform="translate(-164.76663,-192.97633)"> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="177.73021" + y="206.31401" + id="text2170" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2"><tspan + sodipodi:role="line" + id="tspan2172" + x="177.73021" + y="206.31401">DN: cn=sudoadm,ou=group,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="177.73021" + y="221.31401" + id="tspan2174">cn: sudoadm</tspan><tspan + sodipodi:role="line" + x="177.73021" + y="236.31401" + id="tspan5373">objectClass: posixGroup</tspan><tspan + sodipodi:role="line" + x="177.73021" + y="251.31401" + id="tspan2336">gidNumber: 1000</tspan><tspan + sodipodi:role="line" + x="177.73021" + y="266.31401" + id="tspan3411">memberUid: john</tspan></text> + <rect + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.98517001px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + id="rect7321" + width="316.56842" + height="99.014832" + x="173.49196" + y="193.46892" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + <rect + inkscape:export-ydpi="136.2" + inkscape:export-xdpi="136.2" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + y="255.51881" + x="175.66292" + height="16.666452" + width="107.33646" + id="rect5582" + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none;stroke-width:0.69669151;stroke-opacity:1" /> + <path + style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Lstart);marker-end:url(#Arrow2Lend);stroke-opacity:1" + d="M 288.18971,264.67045 C 388.9562,262.34006 478.83987,220.53502 612.19092,219.08835" + id="path7687" + sodipodi:nodetypes="cc" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001" /> + <g + id="g3381" + transform="translate(86,0)"> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="534.08191" + y="208.5367" + id="text3318" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2"><tspan + sodipodi:role="line" + id="tspan3320" + x="534.08191" + y="208.5367">DN: uid=john,ou=people,dc=example,dc=com</tspan><tspan + sodipodi:role="line" + x="534.08191" + y="223.5367" + id="tspan3322">uid: john</tspan><tspan + sodipodi:role="line" + x="534.08191" + y="238.5367" + id="tspan3324">objectClass: person</tspan><tspan + sodipodi:role="line" + x="534.08191" + y="253.5367" + id="tspan3326">cn: john</tspan><tspan + id="tspan3334" + sodipodi:role="line" + x="534.08191" + y="268.5367">givenName: John</tspan><tspan + sodipodi:role="line" + x="534.08191" + y="283.5367" + id="tspan3330">sn: Smith</tspan></text> + <rect + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.94494522px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + id="rect3336" + width="294.23233" + height="98.00956" + x="530.39062" + y="194.49431" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + <rect + inkscape:export-ydpi="136.2" + inkscape:export-xdpi="136.2" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + y="211.30989" + x="533.61841" + height="16.666452" + width="57.336445" + id="rect2372" + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none;stroke-width:0.69669151;stroke-opacity:1" /> + </g> + <text + xml:space="preserve" + style="font-size:12px;font-style:italic;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="164.28616" + y="318.28146" + id="text3369"><tspan + sodipodi:role="line" + id="tspan3371" + x="164.28616" + y="318.28146">[cn=sudoadm,ou=group,dc=example,dc=com]/memberUid</tspan></text> + <text + xml:space="preserve" + style="font-size:12px;font-style:italic;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="646.18683" + y="318.97287" + id="text3373"><tspan + sodipodi:role="line" + id="tspan3375" + x="646.18683" + y="318.97287">user/uid</tspan></text> + <text + xml:space="preserve" + style="font-size:12px;font-style:italic;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="581.57733" + y="319.33908" + id="text3377"><tspan + sodipodi:role="line" + id="tspan3379" + x="581.57733" + y="319.33908">&</tspan></text> + </g> +</svg> diff --git a/doc/guide/images/src/set-recursivegroup.svg b/doc/guide/images/src/set-recursivegroup.svg new file mode 100644 index 0000000..8f2a65b --- /dev/null +++ b/doc/guide/images/src/set-recursivegroup.svg @@ -0,0 +1,505 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> + +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://creativecommons.org/ns#" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + width="833.63007" + height="212.5425" + id="svg2" + sodipodi:version="0.32" + inkscape:version="0.47pre4 r22446" + version="1.0" + sodipodi:docname="set-recursivegroup.svg" + inkscape:output_extension="org.inkscape.output.svg.inkscape" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="70.18" + inkscape:export-ydpi="70.18"> + <defs + id="defs4"> + <inkscape:perspective + sodipodi:type="inkscape:persp3d" + inkscape:vp_x="0 : 106.27125 : 1" + inkscape:vp_y="0 : 1000 : 0" + inkscape:vp_z="833.63007 : 106.27125 : 1" + inkscape:persp3d-origin="416.81503 : 70.847499 : 1" + id="perspective3053" /> + <marker + inkscape:stockid="Arrow1Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lend" + style="overflow:visible"> + <path + id="path3186" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.8,0,0,-0.8,-10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow1Lstart" + style="overflow:visible"> + <path + id="path3183" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(0.8,0,0,0.8,10,0)" /> + </marker> + <marker + inkscape:stockid="Arrow1Send" + orient="auto" + refY="0" + refX="0" + id="Arrow1Send" + style="overflow:visible"> + <path + id="path3198" + d="M 0,0 L 5,-5 L -12.5,0 L 5,5 L 0,0 z " + style="fill-rule:evenodd;stroke:#000000;stroke-width:1pt;marker-start:none" + transform="matrix(-0.2,0,0,-0.2,-1.2,0)" /> + </marker> + <marker + inkscape:stockid="Arrow2Lstart" + orient="auto" + refY="0" + refX="0" + id="Arrow2Lstart" + style="overflow:visible"> + <path + id="path3201" + style="font-size:12px;fill-rule:evenodd;stroke-width:0.625;stroke-linejoin:round" + d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.97309,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " + transform="matrix(1.1,0,0,1.1,1.1,0)" /> + </marker> + <marker + inkscape:stockid="Arrow2Lend" + orient="auto" + refY="0" + refX="0" + id="Arrow2Lend" + style="overflow:visible"> + <path + id="path8347" + style="font-size:12px;fill-rule:evenodd;stroke-width:0.625;stroke-linejoin:round" + d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.97309,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " + transform="matrix(-1.1,0,0,-1.1,-1.1,0)" /> + </marker> + </defs> + <sodipodi:namedview + id="base" + pagecolor="#ffffff" + bordercolor="#666666" + borderopacity="1.0" + inkscape:pageopacity="0.0" + inkscape:pageshadow="2" + inkscape:zoom="2.9689479" + inkscape:cx="232.40369" + inkscape:cy="118.87263" + inkscape:document-units="px" + inkscape:current-layer="layer1" + showgrid="true" + showguides="false" + inkscape:window-width="1655" + inkscape:window-height="1001" + inkscape:window-x="0" + inkscape:window-y="25" + width="1052.3622px" + height="744.09449px" + inkscape:window-maximized="1" /> + <metadata + id="metadata7"> + <rdf:RDF> + <cc:Work + rdf:about=""> + <dc:format>image/svg+xml</dc:format> + <dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> + </cc:Work> + </rdf:RDF> + </metadata> + <g + inkscape:label="Camada 1" + inkscape:groupmode="layer" + id="layer1" + transform="translate(-39.91817,-73.881854)"> + <g + id="g3462" + transform="translate(30.553822,-0.6080081)" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001"> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="523.97247" + y="89.280624" + id="text3318" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2"><tspan + sodipodi:role="line" + id="tspan3320" + x="523.97247" + y="89.280624">DN: <tspan + style="font-weight:bold" + id="tspan7581">uid=john,ou=people,dc=example,dc=com</tspan></tspan><tspan + sodipodi:role="line" + x="523.97247" + y="104.28062" + id="tspan3322">uid: john</tspan><tspan + sodipodi:role="line" + x="523.97247" + y="119.28062" + id="tspan3324">objectClass: person</tspan><tspan + sodipodi:role="line" + x="523.97247" + y="134.28062" + id="tspan3326">cn: john</tspan><tspan + id="tspan3334" + sodipodi:role="line" + x="523.97247" + y="149.28062">givenName: John</tspan><tspan + sodipodi:role="line" + x="523.97247" + y="164.28062" + id="tspan3330">sn: Smith</tspan></text> + <rect + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.97567958px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + id="rect3336" + width="318.06735" + height="96.658691" + x="520.29657" + y="75.253609" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + </g> + <g + id="g3474" + transform="translate(30.276908,4.0242246)" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001"> + <g + id="g7676"> + <text + xml:space="preserve" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="523.97247" + y="199.28062" + id="text3416" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2"><tspan + sodipodi:role="line" + id="tspan3418" + x="523.97247" + y="199.28062">DN: <tspan + id="tspan7674" + style="font-weight:bold">uid=mary,ou=people,dc=example,dc=com</tspan></tspan><tspan + sodipodi:role="line" + x="523.97247" + y="214.28062" + id="tspan3420">uid: mary</tspan><tspan + sodipodi:role="line" + x="523.97247" + y="229.28062" + id="tspan3422">objectClass: person</tspan><tspan + sodipodi:role="line" + x="523.97247" + y="244.28062" + id="tspan3424">cn: mary</tspan><tspan + id="tspan3426" + sodipodi:role="line" + x="523.97247" + y="259.28062">givenName: Mary</tspan><tspan + sodipodi:role="line" + x="523.97247" + y="274.28062" + id="tspan3432">sn: Smith</tspan></text> + <rect + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.98239046px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" + id="rect3460" + width="322.48019" + height="96.651978" + x="520.29993" + y="185.25696" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + </g> + </g> + <g + id="g7550" + transform="translate(-109.4887,-12.321663)" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001"> + <g + id="g7614" + transform="translate(-103.41823,-0.8839165)"> + <text + inkscape:export-ydpi="136.2" + inkscape:export-xdpi="136.2" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + id="text3350" + y="216.91795" + x="258.37482" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + xml:space="preserve"><tspan + y="216.91795" + x="258.37482" + id="tspan3352" + sodipodi:role="line">DN: cn=accountadm,ou=group,dc=example,dc=com</tspan><tspan + id="tspan3354" + y="231.91795" + x="258.37482" + sodipodi:role="line">cn: accountadm</tspan><tspan + id="tspan3356" + y="246.91795" + x="258.37482" + sodipodi:role="line">objectClass: groupOfNames</tspan><tspan + id="tspan3360" + y="261.91795" + x="258.37482" + sodipodi:role="line">member: <tspan + id="tspan7612" + style="font-weight:bold">uid=mary,ou=people,dc=example,dc=com</tspan></tspan><tspan + id="tspan3362" + y="276.91795" + x="258.37482" + sodipodi:role="line" /></text> + <rect + inkscape:export-ydpi="136.2" + inkscape:export-xdpi="136.2" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + y="203.48654" + x="254.13257" + height="83.046989" + width="371.37915" + id="rect3402" + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.97723264px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" /> + <rect + inkscape:export-ydpi="136.2" + inkscape:export-xdpi="136.2" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + y="249.90959" + x="256.3075" + height="16.297295" + width="351.43427" + id="rect5542" + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none;stroke-width:0.69669151;stroke-opacity:1" /> + </g> + </g> + <g + id="g7662" + transform="translate(-217.44346,0.8839165)" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001"> + <text + inkscape:export-ydpi="136.2" + inkscape:export-xdpi="136.2" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + id="text2170" + y="86.335617" + x="262.09247" + style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;font-family:Bitstream Vera Sans" + xml:space="preserve"><tspan + y="86.335617" + x="262.09247" + id="tspan2172" + sodipodi:role="line">DN: <tspan + style="font-weight:bold" + id="tspan7595">cn=sudoadm,ou=group,dc=example,dc=com</tspan></tspan><tspan + id="tspan2174" + y="101.33562" + x="262.09247" + sodipodi:role="line">cn: sudoadm</tspan><tspan + id="tspan5373" + y="116.33562" + x="262.09247" + sodipodi:role="line">objectClass: groupOfNames</tspan><tspan + id="tspan3295" + y="131.33562" + x="262.09247" + sodipodi:role="line">member: uid=john,ou=people,dc=example,dc=com</tspan><tspan + id="tspan3297" + y="146.33562" + x="262.09247" + sodipodi:role="line">member: cn=accountadm,ou=group,dc=example,dc=com</tspan><tspan + id="tspan3411" + y="161.33562" + x="262.09247" + sodipodi:role="line" /></text> + <rect + inkscape:export-ydpi="136.2" + inkscape:export-xdpi="136.2" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + y="73.485397" + x="257.84909" + height="83.049301" + width="369.61365" + id="rect7321" + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:0.97492063px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" /> + <rect + style="opacity:0.28915663;fill:#aa9ab2;fill-opacity:1;stroke:none" + id="rect5582" + width="360.11356" + height="31.950695" + x="260.02518" + y="120.25619" + inkscape:export-filename="/home/andreas/palestra/allmail.png" + inkscape:export-xdpi="136.2" + inkscape:export-ydpi="136.2" /> + </g> + <text + xml:space="preserve" + style="font-size:12px;font-style:italic;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="364.2525" + y="224.56728" + id="text7528" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001"><tspan + sodipodi:role="line" + id="tspan7530" + x="364.2525" + y="224.56728">yes!</tspan></text> + <path + style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Lend);stroke-opacity:1" + d="M 365.29385,128.78999 C 466.06034,130.87918 457.22118,89.335108 547.38066,84.915525" + id="path7687" + sodipodi:nodetypes="cc" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001" /> + <path + style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Lend);stroke-opacity:1" + d="m 404.35364,144.89531 c 26.30535,21.71639 24.5822,55.81327 -30.22062,56.69719" + id="path7689" + sodipodi:nodetypes="cc" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001" /> + <path + sodipodi:nodetypes="cc" + id="path7691" + d="M 396.23093,243.6739 C 484.62258,241.34352 479.3191,199.79944 547.38066,198.91553" + style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Lend);stroke-opacity:1" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001" /> + <text + id="text9637" + y="232.54912" + x="473.47699" + style="font-size:12px;font-style:italic;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + xml:space="preserve" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001"><tspan + y="232.54912" + x="473.47699" + id="tspan9639" + sodipodi:role="line">more<tspan + id="tspan9641" + style="font-weight:bold" /></tspan><tspan + y="247.54912" + x="473.47699" + sodipodi:role="line" + id="tspan9643"><tspan + style="font-weight:bold" + id="tspan9645">member</tspan>?</tspan></text> + <text + xml:space="preserve" + style="font-size:12px;font-style:italic;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="473.47699" + y="112.54912" + id="text9647" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001"><tspan + sodipodi:role="line" + id="tspan9649" + x="473.47699" + y="112.54912">more<tspan + style="font-weight:bold" + id="tspan9651" /></tspan><tspan + id="tspan9653" + sodipodi:role="line" + x="473.47699" + y="127.54912"><tspan + id="tspan9655" + style="font-weight:bold">member</tspan>?</tspan></text> + <text + id="text10626" + y="173.85262" + x="431.01266" + style="font-size:12px;font-style:italic;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + xml:space="preserve" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001"><tspan + y="173.85262" + x="431.01266" + id="tspan10628" + sodipodi:role="line">more<tspan + id="tspan10630" + style="font-weight:bold" /></tspan><tspan + y="188.85262" + x="431.01266" + sodipodi:role="line" + id="tspan10632"><tspan + style="font-weight:bold" + id="tspan10634">member</tspan>?</tspan></text> + <text + xml:space="preserve" + style="font-size:12px;font-style:italic;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + x="742.7262" + y="130.87918" + id="text10640" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001"><tspan + sodipodi:role="line" + id="tspan10642" + x="742.7262" + y="130.87918">no <tspan + style="font-weight:bold" + id="tspan10648">member</tspan></tspan><tspan + sodipodi:role="line" + x="742.7262" + y="145.87918" + id="tspan10644">here!</tspan></text> + <text + id="text10650" + y="244.87918" + x="742.7262" + style="font-size:12px;font-style:italic;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans" + xml:space="preserve" + inkscape:export-filename="/home/andreas/set-recursivegroup.png" + inkscape:export-xdpi="80.970001" + inkscape:export-ydpi="80.970001"><tspan + y="244.87918" + x="742.7262" + id="tspan10652" + sodipodi:role="line">no <tspan + id="tspan10654" + style="font-weight:bold">member</tspan></tspan><tspan + id="tspan10656" + y="259.87918" + x="742.7262" + sodipodi:role="line">here!</tspan></text> + </g> +</svg> diff --git a/doc/guide/images/src/syncrepl-firewalls.dia b/doc/guide/images/src/syncrepl-firewalls.dia Binary files differnew file mode 100644 index 0000000..3f159ea --- /dev/null +++ b/doc/guide/images/src/syncrepl-firewalls.dia diff --git a/doc/guide/images/src/syncrepl-pull.dia b/doc/guide/images/src/syncrepl-pull.dia Binary files differnew file mode 100644 index 0000000..3f159ea --- /dev/null +++ b/doc/guide/images/src/syncrepl-pull.dia diff --git a/doc/guide/images/src/syncrepl-push.dia b/doc/guide/images/src/syncrepl-push.dia Binary files differnew file mode 100644 index 0000000..3f159ea --- /dev/null +++ b/doc/guide/images/src/syncrepl-push.dia diff --git a/doc/guide/images/src/syncrepl.dia b/doc/guide/images/src/syncrepl.dia Binary files differnew file mode 100644 index 0000000..3f159ea --- /dev/null +++ b/doc/guide/images/src/syncrepl.dia diff --git a/doc/guide/plain.sdf b/doc/guide/plain.sdf new file mode 100644 index 0000000..a35af31 --- /dev/null +++ b/doc/guide/plain.sdf @@ -0,0 +1,20 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +# template for plain documents +!macro HTML_PRE_SECTION +!endmacro +!macro HTML_POST_SECTION +!endmacro + +!macro HTML_HEADER +!endmacro +!macro HTML_FOOTER +{{INLINE:<FONT COLOR="#808080" FACE="Arial,Verdana,Helvetica" SIZE="1">}} +{{INLINE:<B>________________<BR><SMALL>}} +[[c]] Copyright 2011, +{{INLINE:<A HREF="/foundation/">OpenLDAP Foundation</A>}}, +{{EMAIL: info@OpenLDAP.org}} +{{INLINE:</SMALL><BR></B></FONT>}} +!endmacro diff --git a/doc/guide/preamble.sdf b/doc/guide/preamble.sdf new file mode 100644 index 0000000..c3ef407 --- /dev/null +++ b/doc/guide/preamble.sdf @@ -0,0 +1,313 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +# +# Preamble for all OpenLDAP SDF documents +# + +!default VERSION 2.4 + +# +# Paths are relative to the main subdirectories +# + +!define DOC_AUTHOR "The OpenLDAP Project <{{URL:http://www.openldap.org/}}>" +!define DOC_NAME "OpenLDAP Software 2.4" +!define DOC_TYPE "Guide" + +!define DOC_LOGO "../images/LDAPlogo.gif" +!define DOC_LOGO_BASE "../images/" +!define DOC_HTML_LOGO "" + +!define DOC_LOF_TITLE "Figures" +!define DOC_LOF + +!define HTML_URL_HOME "http://www.openldap.org/" +!define HTML_URL_CATALOG "../index.html" + +!macro HTML_HEADER +# !block inline +#<FONT FACE="Arial,Verdana,Helvetica"> +# !endblock + !if DOC_LOGO + !block inline +<A HREF="http://www.OpenLDAP.org/"> + !endblock + !import DOC_LOGO; align="Left"; border="0"; base=$var{'DOC_LOGO_BASE'} + !block inline +</A> + !endblock + !HTML_NAVIGATE + !clear "Left" + !else + !HTML_NAVIGATE + !endif +!endmacro + +!macro HTML_FOOTER + !HTML_PRE_SECTION + !HTML_NAVIGATE +# !block inline; expand +#</FONT> +# !endblock + !block inline; expand +<P> +<FONT COLOR="#808080" FACE="Arial,Verdana,Helvetica" SIZE="1"><B> +________________<BR> +<SMALL>© Copyright 2011, <A HREF="http://www.OpenLDAP.org/foundation/">OpenLDAP Foundation</A>, <A HREF="mailto:info@OpenLDAP.org">info@OpenLDAP.org</A></SMALL></B></FONT> + + !endblock +!endmacro + +!macro HTML_TOPIC_HEADER +# !block inline; expand +#<FONT FACE="Arial,Verdana,Helvetica"> +# !endblock + !define DOC_TOPIC_LOGO $var{'DOC_LOGO'} + !if DOC_TOPIC_LOGO + !default DOC_TOPIC_LOGO_BASE $var{'DOC_LOGO_BASE'} + !block inline +<A HREF="http://www.OpenLDAP.org/"> + !endblock + !import DOC_TOPIC_LOGO; align="Left"; border="0"; base=$var{'DOC_TOPIC_LOGO_BASE'} + !block inline +</A> + !endblock + !HTML_TOPIC_NAVIGATE + !clear "Left" + !else + !HTML_TOPIC_NAVIGATE + !endif +!endmacro + +!macro HTML_TOPIC_FOOTER + !HTML_PRE_SECTION + !HTML_TOPIC_NAVIGATE +# !block inline; expand +#</FONT> +# !endblock + !block inline; expand +<P> +<FONT COLOR="#808080" FACE="Arial,Verdana,Helvetica" SIZE="1"><B> +________________<BR> +<SMALL>© Copyright 2011, <A HREF="http://www.OpenLDAP.org/foundation/">OpenLDAP Foundation</A>, <A HREF="mailto:info@OpenLDAP.org">info@OpenLDAP.org</A></SMALL></B></FONT> + + !endblock +!endmacro + + +# OpenLDAP related organization +!block organisations; data; sort='Name' +Name|Long|Jump +ANSI|American National Standards Institute|http://www.ansi.org/ +BSI|British Standards Institute|http://www.bsi-global.com/ +COSINE|Co-operation and Open Systems Interconnection in Europe +CPAN|Comprehensive Perl Archive Network|http://cpan.org/ +Cyrus|Project Cyrus|http://cyrusimap.web.cmu.edu/ +FSF|Free Software Foundation|http://www.fsf.org/ +GNU|GNU Not Unix Project|http://www.gnu.org/ +IAB|Internet Architecture Board|http://www.iab.org/ +IANA|Internet Assigned Numbers Authority|http://www.iana.org/ +IEEE|Institute of Electrical and Electronics Engineers|http://www.ieee.org +IESG|Internet Engineering Steering Group|http://www.ietf.org/iesg/ +IETF|Internet Engineering Task Force|http://www.ietf.org/ +IRTF|Internet Research Task Force|http://www.irtf.org/ +ISO|International Standards Organisation|http://www.iso.org/ +ISOC|Internet Society|http://www.isoc.org/ +ITU|International Telephone Union|http://www.itu.int/ +OLF|OpenLDAP Foundation|http://www.openldap.org/foundation/ +OLP|OpenLDAP Project|http://www.openldap.org/project/ +OpenSSL|OpenSSL Project|http://www.openssl.org/ +RFC Editor|RFC Editor|http://www.rfc-editor.org/ +Oracle|Oracle Corporation|http://www.oracle.com/ +UM|University of Michigan|http://www.umich.edu/ +UMLDAP|University of Michigan LDAP Team|http://www.umich.edu/~dirsvcs/ldap/ldap.html +!endblock + +!block products; data; sort='Name' +Name|Jump +Cyrus|http://cyrusimap.web.cmu.edu/generalinfo.html +Cyrus SASL|http://asg.web.cmu.edu/sasl/sasl-library.html +Git|http://git-scm.com/ +GNU|http://www.gnu.org/software/ +GnuTLS|http://www.gnu.org/software/gnutls/ +Heimdal|http://www.pdc.kth.se/heimdal/ +JLDAP|http://www.openldap.org/jldap/ +MIT Kerberos|http://web.mit.edu/kerberos/www/ +MozNSS|http://developer.mozilla.org/en/NSS +OpenLDAP|http://www.openldap.org/ +OpenLDAP FAQ|http://www.openldap.org/faq/ +OpenLDAP ITS|http://www.openldap.org/its/ +OpenLDAP Software|http://www.openldap.org/software/ +OpenSSL|http://www.openssl.org/ +Perl|http://www.perl.org/ +SDF|http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html +UMLDAP|http://www.umich.edu/~dirsvcs/ldap/ldap.html +!endblock + +# Internet and X.500 terms +!block terms; data; sort='Term' +Term|Definition +3DES|Triple DES +ABNF|Augmented Backus-Naur Form +ACDF|Access Control Decision Function +ACE|ASCII Compatible Encoding +ASCII|American Standard Code for Information Interchange +ACID|Atomicity, Consistency, Isolation, and Durability +ACI|Access Control Information +ACL|Access Control List +AES|Advance Encryption Standard +ABI|Application Binary Interface +API|Application Program Interface +ASN.1|Abstract Syntax Notation - One +AVA|Attribute Value Assertion +AuthcDN|Authentication DN +AuthcId|Authentication Identity +AuthzDN|Authorization DN +AuthzId|Authorization Identity +BCP|Best Current Practice +BDB|Berkeley DB (Backend) +BER|Basic Encoding Rules +BNF|Backus-Naur Form +C|The C Programming Language +CA|Certificate Authority +CER|Canonical Encoding Rules +CLDAP|Connection-less LDAP +CN|Common Name +CRAM-MD5|SASL MD5 Challenge/Response Authentication Mechanism +CRL|Certificate Revocation List +DAP|Directory Access Protocol +DC|Domain Component +DER|Distinguished Encoding Rules +DES|Data Encryption Standard +DIB|Directory Information Base +DIGEST-MD5|SASL Digest MD5 Authentication Mechanism +DISP|Directory Information Shadowing Protocol +DIT|Directory Information Tree +DNS|Domain Name System +DN|Distinguished Name +DOP|Directory Operational Binding Management Protocol +DSAIT|DSA Information Tree +DSA|Directory System Agent +DSE|DSA-specific Entry +DSP|Directory System Protocol +DS|Draft Standard +DUA|Directory User Agent +EXTERNAL|SASL External Authentication Mechanism +FAQ|Frequently Asked Questions +FTP|File Transfer Protocol +FYI|For Your Information +GSER|Generic String Encoding Rules +GSS-API|Generic Security Service Application Program Interface +GSSAPI|SASL Kerberos V GSS-API Authentication Mechanism +HDB|Hierarchical Database (Backend) +I-D|Internet-Draft +IA5|International Alphabet 5 +IDNA|Internationalized Domain Names in Applications +IDN|Internationalized Domain Name +ID|Identification +ID|Identifier +IDL|Index Data Lookups +IP|Internet Protocol +IPC|Inter-process communication +IPsec|Internet Protocol Security +IPv4|Internet Protocol, version 4 +IPv6|Internet Protocol, version 6 +ITS|Issue Tracking System +JPEG|Joint Photographic Experts Group +Kerberos|Kerberos Authentication Service +LBER|Lightweight BER +LDAP|Lightweight Directory Access Protocol +LDAP Sync|LDAP Content Synchronization +LDAPv3|LDAP, version 3 +LDIF|LDAP Data Interchange Format +LMDB|Lightning Memory-Mapped Database +MD5|Message Digest 5 +MDB|Memory-Mapped Database (Backend) +MIB|Management Information Base +MODDN|Modify DN +MODRDN|Modify RDN +NSSR|Non-specific Subordinate Reference +OID|Object Identifier +OSI|Open Systems Interconnect +OTP|One Time Password +PDU|Protocol Data Unit +PEM|Privacy Enhanced eMail +PEN|Private Enterprise Number +PKCS|Public Key Cryptosystem +PKI|Public Key Infrastructure +PKIX|Public Key Infrastructure (X.509) +PLAIN|SASL Plaintext Password Authentication Mechanism +POSIX|Portable Operating System Interface +PS|Proposed Standard +RDN|Relative Distinguished Name +RFC|Request for Comments +RPC|Remote Procedure Call +RXER|Robust XML Encoding Rules +SASL|Simple Authentication and Security Layer +SDF|Simple Document Format +SDSE|Shadowed DSE +SHA1|Secure Hash Algorithm 1 +SLAPD|Standalone LDAP Daemon +SLURPD|Standalone LDAP Update Replication Daemon +SMTP|Simple Mail Transfer Protocol +SNMP|Simple Network Management Protocol +SQL|Structured Query Language +SRP|Secure Remote Password +SSF|Security Strength Factor +SSL|Secure Socket Layer +STD|Internet Standard +TCP|Transmission Control Protocol +TLS|Transport Layer Security +UCS|Universal Multiple-Octet Coded Character Set +UDP|User Datagram Protocol +UID|User Identifier +Unicode|The Unicode Standard +UNIX|Unix +URI|Uniform Resource Identifier +URL|Uniform Resource Locator +URN|Uniform Resource Name +UTF-8|8-bit UCS/Unicode Transformation Format +UTR|Unicode Technical Report +UUID|Universally Unique Identifier +WWW|World Wide Web +X.500|X.500 Directory Services +X.509|X.509 Public Key and Attribute Certificate Frameworks +XED|XML Enabled Directory +XER|XML Encoding Rules +XML|Extensible Markup Language +syncrepl|LDAP Sync-based Replication +!endblock + +!block references; data; sort=Reference; style=grid +Reference|Status|Document|Jump +UM-GUIDE|O|The SLAPD and SLURPD Administrators Guide|http://www.umich.edu/~dirsvcs/ldap/doc/guides/slapd/guide.pdf +RFC2079|PS|Definition of an X.500 Attribute Type and an Object Class to Hold Uniform Resource Identifers|http://www.rfc-editor.org/rfc/rfc2079.txt +RFC2296|PS|Use of Language Codes in LDAP|http://www.rfc-editor.org/rfc/rfc2296.txt +RFC2307|X|An Approach for Using LDAP as a Network Information Service|http://www.rfc-editor.org/rfc/rfc2307.txt +RFC2589|PS|Lightweight Directory Access Protocol (v3): Extensions for Dynamic Directory Services|http://www.rfc-editor.org/rfc/rfc2589.txt +RFC2798|I|Definition of the inetOrgPerson LDAP Object Class|http://www.rfc-editor.org/rfc/rfc2798.txt +RFC2831|PS|Using Digest Authentication as a SASL Mechanism|http://www.rfc-editor.org/rfc/rfc2831.txt +RFC2849|PS|The LDAP Data Interchange Format|http://www.rfc-editor.org/rfc/rfc2849.txt +RFC3088|X|OpenLDAP Root Service|http://www.rfc-editor.org/rfc/rfc3088.txt +RFC3296|PS|Named Subordinate References in LDAP|http://www.rfc-editor.org/rfc/rfc3296.txt +RFC3384|I|Lightweight Directory Access Protocol (version 3) Replication Requirements|http://www.rfc-editor.org/rfc/rfc3384.txt +RFC3494|I|Lightweight Directory Access Protocol version 2 (LDAPv2) to Historic Status|http://www.rfc-editor.org/rfc/rfc3494.txt +RFC4013|PS|SASLprep: Stringprep Profile for User Names and Passwords|http://www.rfc-editor.org/rfc/rfc4013.txt +RFC4346|PS|The Transport Layer Security (TLS) Protocol, Version 1.1|http://www.rfc-editor.org/rfc/rfc4346.txt +RFC4422|PS|Simple Authentication and Security Layer (SASL)|http://www.rfc-editor.org/rfc/rfc4422.txt +RFC4510|PS|Lightweight Directory Access Protocol (LDAP): Technical Specification Roadmap|http://www.rfc-editor.org/rfc/rfc4510.txt +RFC4511|PS|Lightweight Directory Access Protocol (LDAP): The Protocol|http://www.rfc-editor.org/rfc/rfc4511.txt +RFC4512|PS|Lightweight Directory Access Protocol (LDAP): Directory Information Models|http://www.rfc-editor.org/rfc/rfc4512.txt +RFC4513|PS|Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms|http://www.rfc-editor.org/rfc/rfc4513.txt +RFC4514|PS|Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names|http://www.rfc-editor.org/rfc/rfc4514.txt +RFC4515|PS|Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters|http://www.rfc-editor.org/rfc/rfc4515.txt +RFC4516|PS|Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator|http://www.rfc-editor.org/rfc/rfc4516.txt +RFC4517|PS|Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules|http://www.rfc-editor.org/rfc/rfc4517.txt +RFC4518|PS|Lightweight Directory Access Protocol (LDAP): Internationalized String Preparation|http://www.rfc-editor.org/rfc/rfc4518.txt +RFC4519|PS|Lightweight Directory Access Protocol (LDAP): Schema for User Applications|http://www.rfc-editor.org/rfc/rfc4519.txt +RFC4520|BCP|IANA Considerations for LDAP|http://www.rfc-editor.org/rfc/rfc4520.txt +RFC4533|X|The Lightweight Directory Access Protocol (LDAP) Content Synchronization Operation|http://www.rfc-editor.org/rfc/rfc4533.txt +Chu-LDAPI|ID|Using LDAP Over IPC Mechanisms|http://tools.ietf.org/html/draft-chu-ldap-ldapi-00 +!endblock diff --git a/doc/guide/release/autoconf-install.txt b/doc/guide/release/autoconf-install.txt new file mode 100644 index 0000000..50dbe43 --- /dev/null +++ b/doc/guide/release/autoconf-install.txt @@ -0,0 +1,183 @@ +Basic Installation +================== + + These are generic installation instructions. + + The `configure' shell script attempts to guess correct values for +various system-dependent variables used during compilation. It uses +those values to create a `Makefile' in each directory of the package. +It may also create one or more `.h' files containing system-dependent +definitions. Finally, it creates a shell script `config.status' that +you can run in the future to recreate the current configuration, a file +`config.cache' that saves the results of its tests to speed up +reconfiguring, and a file `config.log' containing compiler output +(useful mainly for debugging `configure'). + + If you need to do unusual things to compile the package, please try +to figure out how `configure' could check whether to do them, and mail +diffs or instructions to the address given in the `README' so they can +be considered for the next release. If at some point `config.cache' +contains results you don't want to keep, you may remove or edit it. + + The file `configure.in' is used to create `configure' by a program +called `autoconf'. You only need `configure.in' if you want to change +it or regenerate `configure' using a newer version of `autoconf'. + +The simplest way to compile this package is: + + 1. `cd' to the directory containing the package's source code and type + `./configure' to configure the package for your system. If you're + using `csh' on an old version of System V, you might need to type + `sh ./configure' instead to prevent `csh' from trying to execute + `configure' itself. + + Running `configure' takes awhile. While running, it prints some + messages telling which features it is checking for. + + 2. Type `make' to compile the package. + + 3. Optionally, type `make check' to run any self-tests that come with + the package. + + 4. Type `make install' to install the programs and any data files and + documentation. + + 5. You can remove the program binaries and object files from the + source code directory by typing `make clean'. To also remove the + files that `configure' created (so you can compile the package for + a different kind of computer), type `make distclean'. There is + also a `make maintainer-clean' target, but that is intended mainly + for the package's developers. If you use it, you may have to get + all sorts of other programs in order to regenerate files that came + with the distribution. + +Compilers and Options +===================== + + Some systems require unusual options for compilation or linking that +the `configure' script does not know about. You can give `configure' +initial values for variables by setting them in the environment. Using +a Bourne-compatible shell, you can do that on the command line like +this: + CC=c89 CFLAGS=-O2 LIBS=-lposix ./configure + +Or on systems that have the `env' program, you can do it like this: + env CPPFLAGS=-I/usr/local/include LDFLAGS=-s ./configure + +Compiling For Multiple Architectures +==================================== + + You can compile the package for more than one kind of computer at the +same time, by placing the object files for each architecture in their +own directory. To do this, you must use a version of `make' that +supports the `VPATH' variable, such as GNU `make'. `cd' to the +directory where you want the object files and executables to go and run +the `configure' script. `configure' automatically checks for the +source code in the directory that `configure' is in and in `..'. + + If you have to use a `make' that does not supports the `VPATH' +variable, you have to compile the package for one architecture at a time +in the source code directory. After you have installed the package for +one architecture, use `make distclean' before reconfiguring for another +architecture. + +Installation Names +================== + + By default, `make install' will install the package's files in +`/usr/local/bin', `/usr/local/man', etc. You can specify an +installation prefix other than `/usr/local' by giving `configure' the +option `--prefix=PATH'. + + You can specify separate installation prefixes for +architecture-specific files and architecture-independent files. If you +give `configure' the option `--exec-prefix=PATH', the package will use +PATH as the prefix for installing programs and libraries. +Documentation and other data files will still use the regular prefix. + + In addition, if you use an unusual directory layout you can give +options like `--bindir=PATH' to specify different values for particular +kinds of files. Run `configure --help' for a list of the directories +you can set and what kinds of files go in them. + + If the package supports it, you can cause programs to be installed +with an extra prefix or suffix on their names by giving `configure' the +option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'. + +Optional Features +================= + + Some packages pay attention to `--enable-FEATURE' options to +`configure', where FEATURE indicates an optional part of the package. +They may also pay attention to `--with-PACKAGE' options, where PACKAGE +is something like `gnu-as' or `x' (for the X Window System). The +`README' should mention any `--enable-' and `--with-' options that the +package recognizes. + + For packages that use the X Window System, `configure' can usually +find the X include and library files automatically, but if it doesn't, +you can use the `configure' options `--x-includes=DIR' and +`--x-libraries=DIR' to specify their locations. + +Specifying the System Type +========================== + + There may be some features `configure' can not figure out +automatically, but needs to determine by the type of host the package +will run on. Usually `configure' can figure that out, but if it prints +a message saying it can not guess the host type, give it the +`--host=TYPE' option. TYPE can either be a short name for the system +type, such as `sun4', or a canonical name with three fields: + CPU-COMPANY-SYSTEM + +See the file `config.sub' for the possible values of each field. If +`config.sub' isn't included in this package, then this package doesn't +need to know the host type. + + If you are building compiler tools for cross-compiling, you can also +use the `--target=TYPE' option to select the type of system they will +produce code for and the `--build=TYPE' option to select the type of +system on which you are compiling the package. + +Sharing Defaults +================ + + If you want to set default values for `configure' scripts to share, +you can create a site shell script called `config.site' that gives +default values for variables like `CC', `cache_file', and `prefix'. +`configure' looks for `PREFIX/share/config.site' if it exists, then +`PREFIX/etc/config.site' if it exists. Or, you can set the +`CONFIG_SITE' environment variable to the location of the site script. +A warning: not all `configure' scripts look for a site script. + +Operation Controls +================== + + `configure' recognizes the following options to control how it +operates. + +`--cache-file=FILE' + Use and save the results of the tests in FILE instead of + `./config.cache'. Set FILE to `/dev/null' to disable caching, for + debugging `configure'. + +`--help' + Print a summary of the options to `configure', and exit. + +`--quiet' +`--silent' +`-q' + Do not print messages saying which checks are being made. To + suppress all normal output, redirect it to `/dev/null' (any error + messages will still be shown). + +`--srcdir=DIR' + Look for the package's source code in directory DIR. Usually + `configure' can determine that directory automatically. + +`--version' + Print the version of Autoconf used to generate the `configure' + script, and exit. + +`configure' also accepts some other, not widely useful, options. + diff --git a/doc/guide/release/autoconf.sdf b/doc/guide/release/autoconf.sdf new file mode 100644 index 0000000..008c288 --- /dev/null +++ b/doc/guide/release/autoconf.sdf @@ -0,0 +1,16 @@ +# $OpenLDAP$ +# +# Generic Autoconf INSTALL +# + +H1: Generic configure Instructions + +#!block inline +#<FONT FACE="Courier"> +#!endblock + +!include "../release/autoconf-install.txt" ; verbatim + +#!block inline +#</FONT> +#!endblock diff --git a/doc/guide/release/copyright-plain.sdf b/doc/guide/release/copyright-plain.sdf new file mode 100644 index 0000000..4058a08 --- /dev/null +++ b/doc/guide/release/copyright-plain.sdf @@ -0,0 +1,10 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +# +# Plain Copyright for Software Distribution +# +!define HTML_TITLE "OpenLDAP Copyright Notices" +!include "../plain.sdf" +!include "copyright.sdf"; plain diff --git a/doc/guide/release/copyright.sdf b/doc/guide/release/copyright.sdf new file mode 100644 index 0000000..618f52e --- /dev/null +++ b/doc/guide/release/copyright.sdf @@ -0,0 +1,89 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +# This file should match ../../../COPYRIGHT (except in formating) + +!if OPT_PP_HTML +!define copyright '[[c]] Copyright' +!else +!define copyright 'Copyright' +!endif + +H1: OpenLDAP Software Copyright Notices + +H2: OpenLDAP Copyright Notice + +!block nofill +[[copyright]] 1998-2012 The OpenLDAP Foundation. +{{All rights reserved.}} +!endblock + +Redistribution and use in source and binary forms, with or without +modification, are permitted {{only as authorized}} by the {{SECT:OpenLDAP +Public License}}. + +A copy of this license is available in file {{F:LICENSE}} in the +top-level directory of the distribution or, alternatively, at +<{{URL:http://www.OpenLDAP.org/license.html}}>. + +OpenLDAP is a registered trademark of the OpenLDAP Foundation. + +Individual files and/or contributed packages may be copyright by +other parties and their use subject to additional restrictions. + +This work is derived from the University of Michigan LDAP v3.3 +distribution. Information concerning this software is available +at <{{URL:http://www.umich.edu/~dirsvcs/ldap/ldap.html}}>. + +This work also contains materials derived from public sources. + +Additional information about OpenLDAP software can be obtained at +<{{URL:http://www.OpenLDAP.org/}}>. + + +H2: Additional Copyright Notices + +!block nofill +Portions [[copyright]] 1998-2012 Kurt D. Zeilenga. +Portions [[copyright]] 1998-2006 Net Boolean Incorporated. +Portions [[copyright]] 2001-2006 IBM Corporation. +{{All rights reserved.}} +!endblock + +Redistribution and use in source and binary forms, with or without +modification, are permitted only as authorized by the {{SECT:OpenLDAP +Public License}}. + + +!block nofill +Portions [[copyright]] 1999-2008 Howard Y.H. Chu. +Portions [[copyright]] 1999-2008 Symas Corporation. +Portions [[copyright]] 1998-2003 Hallvard B. Furuseth. +Portions [[copyright]] 2007-2011 Gavin Henry. +Portions [[copyright]] 2007-2011 Suretec Systems Limited. +{{All rights reserved.}} +!endblock + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that this notice is preserved. +The names of the copyright holders may not be used to endorse or +promote products derived from this software without their specific +prior written permission. This software is provided ``as is'' +without express or implied warranty. + + +H2: University of Michigan Copyright Notice + +!block nofill +Portions [[copyright]] 1992-1996 Regents of the University of Michigan. +{{All rights reserved.}} +!endblock + +Redistribution and use in source and binary forms are permitted +provided that this notice is preserved and that due credit is given +to the University of Michigan at Ann Arbor. The name of the University +may not be used to endorse or promote products derived from this +software without specific prior written permission. This software +is provided ``as is'' without express or implied warranty. + diff --git a/doc/guide/release/install.sdf b/doc/guide/release/install.sdf new file mode 100644 index 0000000..d003687 --- /dev/null +++ b/doc/guide/release/install.sdf @@ -0,0 +1,114 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +P1: Making and Installing the OpenLDAP Distribution + +This file provides brief instructions on how to build and install +OpenLDAP on UNIX (and UNIX-{{like}}) systems. More detailed +information and instructions can be found in +{{The OpenLDAP Administrator's Guide}} +(available from {{URL:http://www.openldap.org/doc/}}). + +It is recommended that you read, or at least skim through, ALL of +the instructions in this file before attempting to build the +software. + +It is also recommended you review +the {{Frequently Asked Questions}} ({{URL:http://www.openldap.org/faq/}}) +pages, in particular the +{{Installation section}} ({{URL:http://www.openldap.org/faq/index.cgi?file=8}}) +and +{{Platform Hints}} ({{URL:http://www.openldap.org/faq/index.cgi?file=9}}) +should be examined. + + +P2: Making and Installing the OpenLDAP Distribution + +^ Unpack the distribution and change directory: + +E: % tar xfz openldap-VERSION.tgz +E: % cd openldap-VERSION + +.(replacing {{EX:VERSION}} with the appropriate version string). If +you are reading this file, you probably have already done this! + + ++ Type: + +E: % ./configure --help + +.to list available configuration options. + +.The {{EX:configure}} script also looks for compiler/linker options +on the command line and in the environment. These include: + +> Variable Description Example +> CC C compiler gcc +> CFLAGS C flags -O -g +> CPPFLAGS cpp flags -I/path/include -D__FOO__=42 +> LDFLAGS ld flags -L/usr/local/lib +> LIBS libraries -llib +> PATH command path /usr/local/bin:/usr/bin:/bin + +!if $var{'OPT_TARGET'} eq 'txt' +.See doc/install/configure for generic configure documentation. +!endif + ++ Configure the build system: + +E: % ./configure [options] [var=value ...] + +.If all goes well, the {{EX:configure}} script will automatically detect +the appropriate settings. If the {{EX:configure}} script fails, you should +read the {{FILE:config.log}} file that it generated to see what it was trying +to do and exactly what failed. You may need to specify additional +options and/or variables besides those listed above to +obtain desired results, depending on your operating system. The +{{Platform Hints}} section of the {{FAQ}} provides help for operating system +related problems. + ++ Build dependencies: + +E: % make depend + ++ Build the system: + +E: % make + +.If all goes well, the system will build as configured. If not, +return to step 3 after reviewing the configuration settings. You +may want to consult the {{Platform Hints}} subsection of the {{FAQ}} +if you have not done so already. + ++ Test the standalone system: + +.This step requires the standalone LDAP server, {{slapd}}(8), +with {{HDB}} and/or {{BDB}} support. + +E: % make test + +.If all goes well, the system has been built as configured. If not, +return to step 2 after reviewing your configuration settings. You +may want to consult the {{Installation}} section of the {{FAQ}} +if you have not done so already. + ++ Install the software. You may need to become the +{{super-user}} (e.g. {{EX:root}}) to do this (depending on where you +are installing things): + +E: % su root -c 'make install' + ++ That's it. Enjoy! + +See the {{OpenLDAP Administrator's Guide}} and the manual pages +for the individual applications for configuration and use information. +You may also want to edit the configuration files used by the +various components. These configuration files are located in +the OpenLDAP configuration directory (normally +{{FILE:/usr/local/etc/openldap}}). + +> ldap.conf client defaults +> slapd.conf Standalone LDAP daemon +> schema/*.schema Schema Definitions + diff --git a/doc/guide/release/license-plain.sdf b/doc/guide/release/license-plain.sdf new file mode 100644 index 0000000..679e99e --- /dev/null +++ b/doc/guide/release/license-plain.sdf @@ -0,0 +1,10 @@ +# $OpenLDAP$ +# Copyright 1999-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +# +# Plain Copyright for Software Distribution +# +!define HTML_TITLE "OpenLDAP Public License" +!include "../plain.sdf" +!include "license.sdf"; plain diff --git a/doc/guide/release/license.sdf b/doc/guide/release/license.sdf new file mode 100644 index 0000000..3575e6c --- /dev/null +++ b/doc/guide/release/license.sdf @@ -0,0 +1,15 @@ +# $OpenLDAP$ +# Copyright 2000-2018 The OpenLDAP Foundation, All Rights Reserved. +# COPYING RESTRICTIONS APPLY, see COPYRIGHT. + +H1: OpenLDAP Public License + +#!block inline +#<FONT FACE="Courier"> +#!endblock + +!include "../../../LICENSE" ; verbatim + +#!block inline +#</FONT> +#!endblock diff --git a/doc/install/configure b/doc/install/configure new file mode 100644 index 0000000..c94362a --- /dev/null +++ b/doc/install/configure @@ -0,0 +1,187 @@ +The following is a verbatim copy of the of Autoconf 2.12 generic +INSTALL document. + + +Basic Installation +================== + + These are generic installation instructions. + + The `configure' shell script attempts to guess correct values for +various system-dependent variables used during compilation. It uses +those values to create a `Makefile' in each directory of the package. +It may also create one or more `.h' files containing system-dependent +definitions. Finally, it creates a shell script `config.status' that +you can run in the future to recreate the current configuration, a file +`config.cache' that saves the results of its tests to speed up +reconfiguring, and a file `config.log' containing compiler output +(useful mainly for debugging `configure'). + + If you need to do unusual things to compile the package, please try +to figure out how `configure' could check whether to do them, and mail +diffs or instructions to the address given in the `README' so they can +be considered for the next release. If at some point `config.cache' +contains results you don't want to keep, you may remove or edit it. + + The file `configure.in' is used to create `configure' by a program +called `autoconf'. You only need `configure.in' if you want to change +it or regenerate `configure' using a newer version of `autoconf'. + +The simplest way to compile this package is: + + 1. `cd' to the directory containing the package's source code and type + `./configure' to configure the package for your system. If you're + using `csh' on an old version of System V, you might need to type + `sh ./configure' instead to prevent `csh' from trying to execute + `configure' itself. + + Running `configure' takes awhile. While running, it prints some + messages telling which features it is checking for. + + 2. Type `make' to compile the package. + + 3. Optionally, type `make check' to run any self-tests that come with + the package. + + 4. Type `make install' to install the programs and any data files and + documentation. + + 5. You can remove the program binaries and object files from the + source code directory by typing `make clean'. To also remove the + files that `configure' created (so you can compile the package for + a different kind of computer), type `make distclean'. There is + also a `make maintainer-clean' target, but that is intended mainly + for the package's developers. If you use it, you may have to get + all sorts of other programs in order to regenerate files that came + with the distribution. + +Compilers and Options +===================== + + Some systems require unusual options for compilation or linking that +the `configure' script does not know about. You can give `configure' +initial values for variables by setting them in the environment. Using +a Bourne-compatible shell, you can do that on the command line like +this: + CC=c89 CFLAGS=-O2 LIBS=-lposix ./configure + +Or on systems that have the `env' program, you can do it like this: + env CPPFLAGS=-I/usr/local/include LDFLAGS=-s ./configure + +Compiling For Multiple Architectures +==================================== + + You can compile the package for more than one kind of computer at the +same time, by placing the object files for each architecture in their +own directory. To do this, you must use a version of `make' that +supports the `VPATH' variable, such as GNU `make'. `cd' to the +directory where you want the object files and executables to go and run +the `configure' script. `configure' automatically checks for the +source code in the directory that `configure' is in and in `..'. + + If you have to use a `make' that does not supports the `VPATH' +variable, you have to compile the package for one architecture at a time +in the source code directory. After you have installed the package for +one architecture, use `make distclean' before reconfiguring for another +architecture. + +Installation Names +================== + + By default, `make install' will install the package's files in +`/usr/local/bin', `/usr/local/man', etc. You can specify an +installation prefix other than `/usr/local' by giving `configure' the +option `--prefix=PATH'. + + You can specify separate installation prefixes for +architecture-specific files and architecture-independent files. If you +give `configure' the option `--exec-prefix=PATH', the package will use +PATH as the prefix for installing programs and libraries. +Documentation and other data files will still use the regular prefix. + + In addition, if you use an unusual directory layout you can give +options like `--bindir=PATH' to specify different values for particular +kinds of files. Run `configure --help' for a list of the directories +you can set and what kinds of files go in them. + + If the package supports it, you can cause programs to be installed +with an extra prefix or suffix on their names by giving `configure' the +option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'. + +Optional Features +================= + + Some packages pay attention to `--enable-FEATURE' options to +`configure', where FEATURE indicates an optional part of the package. +They may also pay attention to `--with-PACKAGE' options, where PACKAGE +is something like `gnu-as' or `x' (for the X Window System). The +`README' should mention any `--enable-' and `--with-' options that the +package recognizes. + + For packages that use the X Window System, `configure' can usually +find the X include and library files automatically, but if it doesn't, +you can use the `configure' options `--x-includes=DIR' and +`--x-libraries=DIR' to specify their locations. + +Specifying the System Type +========================== + + There may be some features `configure' can not figure out +automatically, but needs to determine by the type of host the package +will run on. Usually `configure' can figure that out, but if it prints +a message saying it can not guess the host type, give it the +`--host=TYPE' option. TYPE can either be a short name for the system +type, such as `sun4', or a canonical name with three fields: + CPU-COMPANY-SYSTEM + +See the file `config.sub' for the possible values of each field. If +`config.sub' isn't included in this package, then this package doesn't +need to know the host type. + + If you are building compiler tools for cross-compiling, you can also +use the `--target=TYPE' option to select the type of system they will +produce code for and the `--build=TYPE' option to select the type of +system on which you are compiling the package. + +Sharing Defaults +================ + + If you want to set default values for `configure' scripts to share, +you can create a site shell script called `config.site' that gives +default values for variables like `CC', `cache_file', and `prefix'. +`configure' looks for `PREFIX/share/config.site' if it exists, then +`PREFIX/etc/config.site' if it exists. Or, you can set the +`CONFIG_SITE' environment variable to the location of the site script. +A warning: not all `configure' scripts look for a site script. + +Operation Controls +================== + + `configure' recognizes the following options to control how it +operates. + +`--cache-file=FILE' + Use and save the results of the tests in FILE instead of + `./config.cache'. Set FILE to `/dev/null' to disable caching, for + debugging `configure'. + +`--help' + Print a summary of the options to `configure', and exit. + +`--quiet' +`--silent' +`-q' + Do not print messages saying which checks are being made. To + suppress all normal output, redirect it to `/dev/null' (any error + messages will still be shown). + +`--srcdir=DIR' + Look for the package's source code in directory DIR. Usually + `configure' can determine that directory automatically. + +`--version' + Print the version of Autoconf used to generate the `configure' + script, and exit. + +`configure' also accepts some other, not widely useful, options. + diff --git a/doc/man/Makefile.in b/doc/man/Makefile.in new file mode 100644 index 0000000..3b2ccdc --- /dev/null +++ b/doc/man/Makefile.in @@ -0,0 +1,16 @@ +# man Makefile.in for OpenLDAP +# $OpenLDAP$ +## This work is part of OpenLDAP Software <http://www.openldap.org/>. +## +## Copyright 1998-2018 The OpenLDAP Foundation. +## All rights reserved. +## +## Redistribution and use in source and binary forms, with or without +## modification, are permitted only as authorized by the OpenLDAP +## Public License. +## +## A copy of this license is available in the file LICENSE in the +## top-level directory of the distribution or, alternatively, at +## <http://www.OpenLDAP.org/license.html>. + +SUBDIRS= man1 man3 man5 man8 diff --git a/doc/man/Project b/doc/man/Project new file mode 100644 index 0000000..ed7cd85 --- /dev/null +++ b/doc/man/Project @@ -0,0 +1,5 @@ +.\" Shared Project Acknowledgement Text +.B "OpenLDAP Software" +is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. +.B "OpenLDAP Software" +is derived from the University of Michigan LDAP 3.3 Release. diff --git a/doc/man/man1/Makefile.in b/doc/man/man1/Makefile.in new file mode 100644 index 0000000..2153b37 --- /dev/null +++ b/doc/man/man1/Makefile.in @@ -0,0 +1,16 @@ +# man1 Makefile.in for OpenLDAP +# $OpenLDAP$ +## This work is part of OpenLDAP Software <http://www.openldap.org/>. +## +## Copyright 1998-2018 The OpenLDAP Foundation. +## All rights reserved. +## +## Redistribution and use in source and binary forms, with or without +## modification, are permitted only as authorized by the OpenLDAP +## Public License. +## +## A copy of this license is available in the file LICENSE in the +## top-level directory of the distribution or, alternatively, at +## <http://www.OpenLDAP.org/license.html>. + +MANSECT=1 diff --git a/doc/man/man1/ldapcompare.1 b/doc/man/man1/ldapcompare.1 new file mode 100644 index 0000000..99f68f5 --- /dev/null +++ b/doc/man/man1/ldapcompare.1 @@ -0,0 +1,252 @@ +.TH LDAPCOMPARE 1 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldapcompare \- LDAP compare tool +.SH SYNOPSIS +.B ldapcompare +[\c +.BR \-V [ V ]] +[\c +.BI \-d \ debuglevel\fR] +[\c +.BR \-n ] +[\c +.BR \-v ] +[\c +.BR \-z ] +[\c +.BR \-M [ M ]] +[\c +.BR \-x ] +[\c +.BI \-D \ binddn\fR] +[\c +.BR \-W ] +[\c +.BI \-w \ passwd\fR] +[\c +.BI \-y \ passwdfile\fR] +[\c +.BI \-H \ ldapuri\fR] +[\c +.BI \-h \ ldaphost\fR] +[\c +.BI \-p \ ldapport\fR] +[\c +.BR \-P \ { 2 \||\| 3 }] +[\c +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BI \-o \ opt \fR[= optparam \fR]] +[\c +.BI \-O \ security-properties\fR] +[\c +.BR \-I ] +[\c +.BR \-Q ] +[\c +.BR \-N ] +[\c +.BI \-U \ authcid\fR] +[\c +.BI \-R \ realm\fR] +[\c +.BI \-X \ authzid\fR] +[\c +.BI \-Y \ mech\fR] +[\c +.BR \-Z [ Z ]] +.IR DN +{\c +.BI attr: value +| +.BI attr:: b64value\fR} +.SH DESCRIPTION +.I ldapcompare +is a shell-accessible interface to the +.BR ldap_compare_ext (3) +library call. +.LP +.B ldapcompare +opens a connection to an LDAP server, binds, and performs a compare +using specified parameters. The \fIDN\fP should be a distinguished +name in the directory. \fIAttr\fP should be a known attribute. If +followed by one colon, the assertion \fIvalue\fP should be provided +as a string. If followed by two colons, the base64 encoding of the +value is provided. The result code of the compare is provided as +the exit code and, unless ran with \fB\-z\fP, the program prints +TRUE, FALSE, or UNDEFINED on standard output. +.LP +.SH OPTIONS +.TP +.BR \-V [ V ] +Print version info. +If \fB\-VV\fP is given, only the version information is printed. +.TP +.BI \-d \ debuglevel +Set the LDAP debugging level to \fIdebuglevel\fP. +.B ldapcompare +must be compiled with LDAP_DEBUG defined for this option to have any effect. +.TP +.B \-n +Show what would be done, but don't actually perform the compare. Useful for +debugging in conjunction with \fB\-v\fP. +.TP +.B \-v +Run in verbose mode, with many diagnostics written to standard output. +.TP +.B \-z +Run in quiet mode, no output is written. You must check the return +status. Useful in shell scripts. +.TP +.BR \-M [ M ] +Enable manage DSA IT control. +.B \-MM +makes control critical. +.TP +.B \-x +Use simple authentication instead of SASL. +.TP +.BI \-D \ binddn +Use the Distinguished Name \fIbinddn\fP to bind to the LDAP directory. +For SASL binds, the server is expected to ignore this value. +.TP +.B \-W +Prompt for simple authentication. +This is used instead of specifying the password on the command line. +.TP +.BI \-w \ passwd +Use \fIpasswd\fP as the password for simple authentication. +.TP +.BI \-y \ passwdfile +Use complete contents of \fIpasswdfile\fP as the password for +simple authentication. +Note that \fIcomplete\fP means that any leading or trailing whitespaces, +including newlines, will be considered part of the password and, +unlike other software, they will not be stripped. +As a consequence, passwords stored in files by commands like +.BR echo (1) +will not behave as expected, since +.BR echo (1) +by default appends a trailing newline to the echoed string. +The recommended portable way to store a cleartext password in a file +for use with this option is to use +.BR slappasswd (8) +with \fI{CLEARTEXT}\fP as hash and the option \fB\-n\fP. +.TP +.BI \-H \ ldapuri +Specify URI(s) referring to the ldap server(s); only the protocol/host/port +fields are allowed; a list of URI, separated by whitespace or commas +is expected. +.TP +.BI \-h \ ldaphost +Specify an alternate host on which the ldap server is running. +Deprecated in favor of \fB\-H\fP. +.TP +.BI \-p \ ldapport +Specify an alternate TCP port where the ldap server is listening. +Deprecated in favor of \fB\-H\fP. +.TP +.BR \-P \ { 2 \||\| 3 } +Specify the LDAP protocol version to use. +.TP +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ] +.TP +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ] + +Specify general extensions with \fB\-e\fP and compare extensions with \fB\-E\fP. +\'\fB!\fP\' indicates criticality. + +General extensions: +.nf + [!]assert=<filter> (an RFC 4515 Filter) + !authzid=<authzid> ("dn:<dn>" or "u:<user>") + [!]bauthzid (RFC 3829 authzid control) + [!]chaining[=<resolve>[/<cont>]] + [!]manageDSAit + [!]noop + ppolicy + [!]postread[=<attrs>] (a comma-separated attribute list) + [!]preread[=<attrs>] (a comma-separated attribute list) + [!]relax + sessiontracking + abandon,cancel,ignore (SIGINT sends abandon/cancel, + or ignores response; if critical, doesn't wait for SIGINT. + not really controls) +.fi + +Compare extensions: +.nf + !dontUseCopy +.fi +.TP +.BI \-o \ opt \fR[= optparam \fR] + +Specify general options. + +General options: +.nf + nettimeout=<timeout> (in seconds, or "none" or "max") + ldif-wrap=<width> (in columns, or "no" for no wrapping) +.fi +.TP +.BI \-O \ security-properties +Specify SASL security properties. +.TP +.B \-I +Enable SASL Interactive mode. Always prompt. Default is to prompt +only as needed. +.TP +.B \-Q +Enable SASL Quiet mode. Never prompt. +.TP +.B \-N +Do not use reverse DNS to canonicalize SASL host name. +.TP +.BI \-U \ authcid +Specify the authentication ID for SASL bind. The form of the ID +depends on the actual SASL mechanism used. +.TP +.BI \-R \ realm +Specify the realm of authentication ID for SASL bind. The form of the realm +depends on the actual SASL mechanism used. +.TP +.BI \-X \ authzid +Specify the requested authorization ID for SASL bind. +.I authzid +must be one of the following formats: +.BI dn: "<distinguished name>" +or +.BI u: <username> +.TP +.BI \-Y \ mech +Specify the SASL mechanism to be used for authentication. If it's not +specified, the program will choose the best mechanism the server knows. +.TP +.BR \-Z [ Z ] +Issue StartTLS (Transport Layer Security) extended operation. If you use +\fB\-ZZ\fP, the command will require the operation to be successful. +.SH EXAMPLES +.nf + ldapcompare "uid=babs,dc=example,dc=com" sn:Jensen + ldapcompare "uid=babs,dc=example,dc=com" sn::SmVuc2Vu +.fi +are all equivalent. +.SH LIMITATIONS +Requiring the value be passed on the command line is limiting +and introduces some security concerns. The command should support +a mechanism to specify the location (file name or URL) to read +the value from. +.SH "SEE ALSO" +.BR ldap.conf (5), +.BR ldif (5), +.BR ldap (3), +.BR ldap_compare_ext (3) +.SH AUTHOR +The OpenLDAP Project <http://www.openldap.org/> +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man1/ldapdelete.1 b/doc/man/man1/ldapdelete.1 new file mode 100644 index 0000000..8283707 --- /dev/null +++ b/doc/man/man1/ldapdelete.1 @@ -0,0 +1,263 @@ +.TH LDAPDELETE 1 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldapdelete \- LDAP delete entry tool +.SH SYNOPSIS +.B ldapdelete +[\c +.BR \-V [ V ]] +[\c +.BI \-d \ debuglevel\fR] +[\c +.BR \-n ] +[\c +.BR \-v ] +[\c +.BR \-c ] +[\c +.BI \-f \ file\fR] +[\c +.BR \-r ] +[\c +.BI \-z \ sizelimit\fR] +[\c +.BR \-M [ M ]] +[\c +.BR \-x ] +[\c +.BI \-D \ binddn\fR] +[\c +.BR \-W ] +[\c +.BI \-w \ passwd\fR] +[\c +.BI \-y \ passwdfile\fR] +[\c +.BI \-H \ ldapuri\fR] +[\c +.BI \-h \ ldaphost\fR] +[\c +.BI \-p \ ldapport\fR] +[\c +.BR \-P \ { 2 \||\| 3 }] +[\c +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BI \-o \ opt \fR[= optparam \fR]] +[\c +.BI \-O \ security-properties\fR] +[\c +.BR \-I ] +[\c +.BR \-Q ] +[\c +.BR \-N ] +[\c +.BI \-U \ authcid\fR] +[\c +.BI \-R \ realm\fR] +[\c +.BI \-X \ authzid\fR] +[\c +.BI \-Y \ mech\fR] +[\c +.BR \-Z [ Z ]] +[\c +.IR DN \ [ ... ]] +.SH DESCRIPTION +.I ldapdelete +is a shell-accessible interface to the +.BR ldap_delete_ext (3) +library call. +.LP +.B ldapdelete +opens a connection to an LDAP server, binds, and deletes one or more +entries. If one or more \fIDN\fP arguments are provided, entries with +those Distinguished Names are deleted. Each \fIDN\fP should be provided +using the LDAPv3 string representation as defined in RFC 4514. +If no \fIDN\fP arguments +are provided, a list of DNs is read from standard input (or from +\fIfile\fP if the \fB\-f\fP flag is used). +.SH OPTIONS +.TP +.BR \-V [ V ] +Print version info. +If \fB\-VV\fP is given, only the version information is printed. +.TP +.BI \-d \ debuglevel +Set the LDAP debugging level to \fIdebuglevel\fP. +.B ldapdelete +must be compiled with LDAP_DEBUG defined for this option to have any effect. +.TP +.B \-n +Show what would be done, but don't actually delete entries. Useful for +debugging in conjunction with \fB\-v\fP. +.TP +.B \-v +Use verbose mode, with many diagnostics written to standard output. +.TP +.B \-c +Continuous operation mode. Errors are reported, but +.B ldapdelete +will continue with deletions. The default is to exit after +reporting an error. +.TP +.BI \-f \ file +Read a series of DNs from \fIfile\fP, one per line, performing an +LDAP delete for each. +.TP +.B \-r +Do a recursive delete. If the DN specified isn't a leaf, its +children, and all their children are deleted down the tree. No +verification is done, so if you add this switch, ldapdelete will +happily delete large portions of your tree. Use with care. +.TP +.BI \-z \ sizelimit +Use \fIsizelimit\fP when searching for children DN to delete, +to circumvent any server-side size limit. Only useful in conjunction +with \fB\-r\fP. +.TP +.BR \-M [ M ] +Enable manage DSA IT control. +.B \-MM +makes control critical. +.TP +.B \-x +Use simple authentication instead of SASL. +.TP +.BI \-D \ binddn +Use the Distinguished Name \fIbinddn\fP to bind to the LDAP directory. +For SASL binds, the server is expected to ignore this value. +.TP +.B \-W +Prompt for simple authentication. +This is used instead of specifying the password on the command line. +.TP +.BI \-w \ passwd +Use \fIpasswd\fP as the password for simple authentication. +.TP +.BI \-y \ passwdfile +Use complete contents of \fIpasswdfile\fP as the password for +simple authentication. +.TP +.BI \-H \ ldapuri +Specify URI(s) referring to the ldap server(s); only the protocol/host/port +fields are allowed; a list of URI, separated by whitespace or commas +is expected. +.TP +.BI \-h \ ldaphost +Specify an alternate host on which the ldap server is running. +Deprecated in favor of \fB\-H\fP. +.TP +.BI \-p \ ldapport +Specify an alternate TCP port where the ldap server is listening. +Deprecated in favor of \fB\-H\fP. +.TP +.BR \-P \ { 2 \||\| 3 } +Specify the LDAP protocol version to use. +.TP +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ] +.TP +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ] + +Specify general extensions with \fB\-e\fP and delete extensions with \fB\-E\fP. +\'\fB!\fP\' indicates criticality. + +General extensions: +.nf + [!]assert=<filter> (an RFC 4515 Filter) + !authzid=<authzid> ("dn:<dn>" or "u:<user>") + [!]bauthzid (RFC 3829 authzid control) + [!]chaining[=<resolve>[/<cont>]] + [!]manageDSAit + [!]noop + ppolicy + [!]postread[=<attrs>] (a comma-separated attribute list) + [!]preread[=<attrs>] (a comma-separated attribute list) + [!]relax + sessiontracking + abandon,cancel,ignore (SIGINT sends abandon/cancel, + or ignores response; if critical, doesn't wait for SIGINT. + not really controls) +.fi + +Delete extensions: +.nf + (none) +.fi +.TP +.BI \-o \ opt \fR[= optparam \fR] + +Specify general options. + +General options: +.nf + nettimeout=<timeout> (in seconds, or "none" or "max") + ldif-wrap=<width> (in columns, or "no" for no wrapping) +.fi +.TP +.BI \-O \ security-properties +Specify SASL security properties. +.TP +.B \-I +Enable SASL Interactive mode. Always prompt. Default is to prompt +only as needed. +.TP +.B \-Q +Enable SASL Quiet mode. Never prompt. +.TP +.B \-N +Do not use reverse DNS to canonicalize SASL host name. +.TP +.BI \-U \ authcid +Specify the authentication ID for SASL bind. The form of the identity depends on the +actual SASL mechanism used. +.TP +.BI \-R \ realm +Specify the realm of authentication ID for SASL bind. The form of the realm +depends on the actual SASL mechanism used. +.TP +.BI \-X \ authzid +Specify the requested authorization ID for SASL bind. +.I authzid +must be one of the following formats: +.BI dn: "<distinguished name>" +or +.BI u: <username> +.TP +.BI \-Y \ mech +Specify the SASL mechanism to be used for authentication. If it's not +specified, the program will choose the best mechanism the server knows. +.TP +.BR \-Z [ Z ] +Issue StartTLS (Transport Layer Security) extended operation. If you use +\fB\-ZZ\fP, the command will require the operation to be successful. +.SH EXAMPLE +The following command: +.LP +.nf + ldapdelete "cn=Delete Me,dc=example,dc=com" +.fi +.LP +will attempt to delete the entry named "cn=Delete Me,dc=example,dc=com". +Of course it would probably be necessary to supply authentication +credentials. +.SH DIAGNOSTICS +Exit status is 0 if no errors occur. Errors result in a non-zero exit +status and a diagnostic message being written to standard error. +.SH "SEE ALSO" +.BR ldap.conf (5), +.BR ldapadd (1), +.BR ldapmodify (1), +.BR ldapmodrdn (1), +.BR ldapsearch (1), +.BR ldap (3), +.BR ldap_delete_ext (3) +.SH AUTHOR +The OpenLDAP Project <http://www.openldap.org/> +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man1/ldapexop.1 b/doc/man/man1/ldapexop.1 new file mode 100644 index 0000000..5f5ae7a --- /dev/null +++ b/doc/man/man1/ldapexop.1 @@ -0,0 +1,253 @@ +.\" $OpenLDAP$ +.\" This contribution is derived from OpenLDAP Software. +.\" All of the modifications to OpenLDAP Software represented in this +.\" contribution were developed by Peter Marschall <peter@adpm.de>. +.\" I have not assigned rights and/or interest in this work to any party. +.\" +.\" Copyright 2009 Peter Marschall +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted only as authorized by the OpenLDAP Public License. +.\" +.\" A copy of this license is available in file LICENSE in the +.\" top-level directory of the distribution or, alternatively, at +.\" http://www.OpenLDAP.org/license.html. + +.TH LDAPEXOP 1 + +.SH NAME +ldapexop \- issue LDAP extended operations + +.SH SYNOPSIS +ldapexop +[\c +.BR \-V [ V ]] +[\c +.BI \-d \ debuglevel\fR] +[\c +.BR \-n ] +[\c +.BR \-v ] +[\c +.BI \-f \ file\fR] +[\c +.BR \-x ] +[\c +.BI \-D \ binddn\fR] +[\c +.BR \-W ] +[\c +.BI \-w \ passwd\fR] +[\c +.BI \-y \ passwdfile\fR] +[\c +.BI \-H \ URI\fR] +[\c +.BI \-h \ ldaphost\fR] +[\c +.BI \-p \ ldapport\fR] +[\c +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BI \-o \ opt \fR[= optparam \fR]] +[\c +.BI \-O \ security-properties\fR] +[\c +.BR \-I ] +[\c +.BR \-Q ] +[\c +.BR \-N ] +[\c +.BI \-U \ authcid\fR] +[\c +.BI \-R \ realm\fR] +[\c +.BI \-X \ authzid\fR] +[\c +.BI \-Y \ mech\fR] +[\c +.BR \-Z [ Z ]] +{\c +.I oid +| +.BI oid: data +| +.BI oid:: b64data +| +.B whoami +| +.BI cancel \ cancel-id +| +.BI refresh \ DN \ \fR[\fIttl\fR]} + +.SH DESCRIPTION +ldapexop issues the LDAP extended operation specified by \fBoid\fP +or one of the special keywords \fBwhoami\fP, \fBcancel\fP, or \fBrefresh\fP. + +Additional data for the extended operation can be passed to the server using +\fIdata\fP or base-64 encoded as \fIb64data\fP in the case of \fBoid\fP, +or using the additional parameters in the case of the specially named extended +operations above. + +Please note that ldapexop behaves differently for the same extended operation +when it was given as an OID or as a specialliy named operation: + +Calling ldapexop with the OID of the \fBwhoami\fP (RFC 4532) extended operation +.nf + + ldapexop [<options>] 1.3.6.1.4.1.4203.1.11.3 + +.fi +yields +.nf + + # extended operation response + data:: <base64 encoded response data> + +.fi +while calling it with the keyword \fBwhoami\fP +.nf + + ldapexop [<options>] whoami + +.fi +results in +.nf + + dn:<client's identity> + +.fi + + +.SH OPTIONS +.TP +.BI \-V [ V ] +Print version info. +If\fB\-VV\fP is given, only the version information is printed. +.TP +.BI \-d \ debuglevel +Set the LDAP debugging level to \fIdebuglevel\fP. +.TP +.BI \-n +Show what would be done but don't actually do it. +Useful for debugging in conjunction with \fB\-v\fP. +.TP +.BI \-v +Run in verbose mode, with many diagnostics written to standard output. +.TP +.BI \-f \ file +Read operations from \fIfile\fP. +.TP +.BI \-x +Use simple authentication instead of SASL. +.TP +.BI \-D \ binddn +Use the Distinguished Name \fIbinddn\fP to bind to the LDAP directory. +.TP +.BI \-W +Prompt for simple authentication. +This is used instead of specifying the password on the command line. +.TP +.BI \-w \ passwd +Use \fIpasswd\fP as the password for simple authentication. +.TP +.BI \-y \ passwdfile +Use complete contents of \fIpasswdfile\fP as the password for +simple authentication. +.TP +.BI \-H \ URI +Specify URI(s) referring to the ldap server(s); only the protocol/host/port +fields are allowed; a list of URI, separated by whitespace or commas +is expected. +.TP +.BI \-h \ ldaphost +Specify the host on which the ldap server is running. +Deprecated in favor of \fB\-H\fP. +.TP +.BI \-p \ ldapport +Specify the TCP port where the ldap server is listening. +Deprecated in favor of \fB\-H\fP. +.TP +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ] +Specify general extensions. \'!\' indicates criticality. +.nf + [!]assert=<filter> (an RFC 4515 Filter) + !authzid=<authzid> ("dn:<dn>" or "u:<user>") + [!]bauthzid (RFC 3829 authzid control) + [!]chaining[=<resolve>[/<cont>]] + [!]manageDSAit + [!]noop + ppolicy + [!]postread[=<attrs>] (a comma-separated attribute list) + [!]preread[=<attrs>] (a comma-separated attribute list) + [!]relax + sessiontracking + abandon,cancel,ignore (SIGINT sends abandon/cancel, + or ignores response; if critical, doesn't wait for SIGINT. + not really controls) +.fi +.TP +.BI \-o \ opt \fR[= optparam \fR] + +Specify general options. + +General options: +.nf + nettimeout=<timeout> (in seconds, or "none" or "max") + ldif-wrap=<width> (in columns, or "no" for no wrapping) +.fi +.TP +.BI \-O \ security-properties +Specify SASL security properties. +.TP +.BI \-I +Enable SASL Interactive mode. Always prompt. Default is to prompt +only as needed. +.TP +.BI \-Q +Enable SASL Quiet mode. Never prompt. +.TP +.B \-N +Do not use reverse DNS to canonicalize SASL host name. +.TP +.BI \-U \ authcid +Specify the authentication ID for SASL bind. The form of the ID +depends on the actual SASL mechanism used. +.TP +.BI \-R \ realm +Specify the realm of authentication ID for SASL bind. The form of the realm +depends on the actual SASL mechanism used. +.TP +.BI \-X \ authzid +Specify the requested authorization ID for SASL bind. +.I authzid +must be one of the following formats: +.BI dn: "<distinguished name>" +or +.BI u: <username> +.TP +.BI \-Y \ mech +Specify the SASL mechanism to be used for authentication. +Without this option, the program will choose the best mechanism the server knows. +.TP +.BR \-Z [ Z ] +Issue StartTLS (Transport Layer Security) extended operation. +Giving it twice (\fB\-ZZ\fP) will require the operation to be successful. + +.SH DIAGNOSTICS +Exit status is zero if no errors occur. +Errors result in a non-zero exit status and +a diagnostic message being written to standard error. + +.SH "SEE ALSO" +.BR ldap_extended_operation_s (3) + +.SH AUTHOR +This manual page was written by Peter Marschall +based on \fBldapexop\fP's usage message and a few tests +with \fBldapexop\fP. +Do not expect it to be complete or absolutely correct. + +.SH ACKNOWLEDGEMENTS +.so ../Project + diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1 new file mode 100644 index 0000000..19263eb --- /dev/null +++ b/doc/man/man1/ldapmodify.1 @@ -0,0 +1,405 @@ +.TH LDAPMODIFY 1 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldapmodify, ldapadd \- LDAP modify entry and LDAP add entry tools +.SH SYNOPSIS +.B ldapmodify +[\c +.BR \-V [ V ]] +[\c +.BI \-d \ debuglevel\fR] +[\c +.BR \-n ] +[\c +.BR \-v ] +[\c +.BR \-a ] +[\c +.BR \-c ] +[\c +.BI \-f \ file\fR] +[\c +.BI \-S \ file\fR] +[\c +.BR \-M [ M ]] +[\c +.BR \-x ] +[\c +.BI \-D \ binddn\fR] +[\c +.BR \-W ] +[\c +.BI \-w \ passwd\fR] +[\c +.BI \-y \ passwdfile\fR] +[\c +.BI \-H \ ldapuri\fR] +[\c +.BI \-h \ ldaphost\fR] +[\c +.BI \-p \ ldapport\fR] +[\c +.BR \-P \ { 2 \||\| 3 }] +[\c +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BI \-o \ opt \fR[= optparam \fR]] +[\c +.BI \-O \ security-properties\fR] +[\c +.BR \-I ] +[\c +.BR \-Q ] +[\c +.BR \-N ] +[\c +.BI \-U \ authcid\fR] +[\c +.BI \-R \ realm\fR] +[\c +.BI \-X \ authzid\fR] +[\c +.BI \-Y \ mech\fR] +[\c +.BR \-Z [ Z ]] +.LP +.B ldapadd +[\c +.BR \-V [ V ]] +[\c +.BI \-d \ debuglevel\fR] +[\c +.BR \-n ] +[\c +.BR \-v ] +[\c +.BR \-c ] +[\c +.BI \-f \ file\fR] +[\c +.BI \-S \ file\fR] +[\c +.BR \-M [ M ]] +[\c +.BR \-x ] +[\c +.BI \-D \ binddn\fR] +[\c +.BR \-W ] +[\c +.BI \-w \ passwd\fR] +[\c +.BI \-y \ passwdfile\fR] +[\c +.BI \-H \ ldapuri\fR] +[\c +.BI \-h \ ldaphost\fR] +[\c +.BI \-p \ ldapport\fR] +[\c +.BR \-P \ { 2 \||\| 3 }] +[\c +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BI \-o \ opt \fR[= optparam \fR]] +[\c +.BI \-O \ security-properties\fR] +[\c +.BR \-I ] +[\c +.BR \-Q ] +[\c +.BR \-N ] +[\c +.BI \-U \ authcid\fR] +[\c +.BI \-R \ realm\fR] +[\c +.BI \-X \ authzid\fR] +[\c +.BI \-Y \ mech\fR] +[\c +.BR \-Z [ Z ]] +.SH DESCRIPTION +.B ldapmodify +is a shell-accessible interface to the +.BR ldap_add_ext (3), +.BR ldap_modify_ext (3), +.BR ldap_delete_ext (3) +and +.BR ldap_rename (3). +library calls. +.B ldapadd +is implemented as a hard link to the ldapmodify tool. When invoked as +.B ldapadd +the \fB\-a\fP (add new entry) flag is turned on automatically. +.LP +.B ldapmodify +opens a connection to an LDAP server, binds, and modifies or adds entries. +The entry information is read from standard input or from \fIfile\fP through +the use of the \fB\-f\fP option. +.SH OPTIONS +.TP +.BR \-V [ V ] +Print version info. +If \fB\-VV\fP is given, only the version information is printed. +.TP +.BI \-d \ debuglevel +Set the LDAP debugging level to \fIdebuglevel\fP. +.B ldapmodify +must be compiled with LDAP_DEBUG defined for this option to have any effect. +.TP +.B \-n +Show what would be done, but don't actually modify entries. Useful for +debugging in conjunction with \fB\-v\fP. +.TP +.B \-v +Use verbose mode, with many diagnostics written to standard output. +.TP +.B \-a +Add new entries. The default for +.B ldapmodify +is to modify existing entries. If invoked as +.BR ldapadd , +this flag is always set. +.TP +.B \-c +Continuous operation mode. Errors are reported, but +.B ldapmodify +will continue with modifications. The default is to exit after +reporting an error. +.TP +.BI \-f \ file +Read the entry modification information from \fIfile\fP instead of from +standard input. +.TP +.BI \-S \ file +Add or change records which were skipped due to an error are written to \fIfile\fP +and the error message returned by the server is added as a comment. Most useful in +conjunction with \fB\-c\fP. +.TP +.BR \-M [ M ] +Enable manage DSA IT control. +.B \-MM +makes control critical. +.TP +.B \-x +Use simple authentication instead of SASL. +.TP +.BI \-D \ binddn +Use the Distinguished Name \fIbinddn\fP to bind to the LDAP directory. +For SASL binds, the server is expected to ignore this value. +.TP +.B \-W +Prompt for simple authentication. +This is used instead of specifying the password on the command line. +.TP +.BI \-w \ passwd +Use \fIpasswd\fP as the password for simple authentication. +.TP +.BI \-y \ passwdfile +Use complete contents of \fIpasswdfile\fP as the password for +simple authentication. +.TP +.BI \-H \ ldapuri +Specify URI(s) referring to the ldap server(s); only the protocol/host/port +fields are allowed; a list of URI, separated by whitespace or commas +is expected. +.TP +.BI \-h \ ldaphost +Specify an alternate host on which the ldap server is running. +Deprecated in favor of \fB\-H\fP. +.TP +.BI \-p \ ldapport +Specify an alternate TCP port where the ldap server is listening. +Deprecated in favor of \fB\-H\fP. +.TP +.BR \-P \ { 2 \||\| 3 } +Specify the LDAP protocol version to use. +.TP +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ] +.TP +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ] + +Specify general extensions with \fB\-e\fP and modify extensions with \fB\-E\fP. +\'\fB!\fP\' indicates criticality. + +General extensions: +.nf + [!]assert=<filter> (an RFC 4515 Filter) + !authzid=<authzid> ("dn:<dn>" or "u:<user>") + [!]bauthzid (RFC 3829 authzid control) + [!]chaining[=<resolve>[/<cont>]] + [!]manageDSAit + [!]noop + ppolicy + [!]postread[=<attrs>] (a comma-separated attribute list) + [!]preread[=<attrs>] (a comma-separated attribute list) + [!]relax + sessiontracking + abandon,cancel,ignore (SIGINT sends abandon/cancel, + or ignores response; if critical, doesn't wait for SIGINT. + not really controls) +.fi + +Modify extensions: +.nf + [!]txn[=abort|commit] +.fi +.TP +.BI \-o \ opt \fR[= optparam \fR]] + +Specify general options. + +General options: +.nf + nettimeout=<timeout> (in seconds, or "none" or "max") + ldif-wrap=<width> (in columns, or "no" for no wrapping) +.fi +.TP +.BI \-O \ security-properties +Specify SASL security properties. +.TP +.B \-I +Enable SASL Interactive mode. Always prompt. Default is to prompt +only as needed. +.TP +.B \-Q +Enable SASL Quiet mode. Never prompt. +.TP +.B \-N +Do not use reverse DNS to canonicalize SASL host name. +.TP +.BI \-U \ authcid +Specify the authentication ID for SASL bind. The form of the ID +depends on the actual SASL mechanism used. +.TP +.BI \-R \ realm +Specify the realm of authentication ID for SASL bind. The form of the realm +depends on the actual SASL mechanism used. +.TP +.BI \-X \ authzid +Specify the requested authorization ID for SASL bind. +.I authzid +must be one of the following formats: +.BI dn: "<distinguished name>" +or +.BI u: <username> +.TP +.BI \-Y \ mech +Specify the SASL mechanism to be used for authentication. If it's not +specified, the program will choose the best mechanism the server knows. +.TP +.BR \-Z [ Z ] +Issue StartTLS (Transport Layer Security) extended operation. If you use +.B \-ZZ\c +, the command will require the operation to be successful. +.SH INPUT FORMAT +The contents of \fIfile\fP (or standard input if no \fB\-f\fP flag is given on +the command line) must conform to the format defined in +.BR ldif (5) +(LDIF as defined in RFC 2849). +.SH EXAMPLES +Assuming that the file +.B /tmp/entrymods +exists and has the contents: +.LP +.nf + dn: cn=Modify Me,dc=example,dc=com + changetype: modify + replace: mail + mail: modme@example.com + \- + add: title + title: Grand Poobah + \- + add: jpegPhoto + jpegPhoto:< file:///tmp/modme.jpeg + \- + delete: description + \- +.fi +.LP +the command: +.LP +.nf + ldapmodify \-f /tmp/entrymods +.fi +.LP +will replace the contents of the "Modify Me" entry's +.I mail +attribute with the value "modme@example.com", add a +.I title +of "Grand Poobah", and the contents of the file "/tmp/modme.jpeg" +as a +.IR jpegPhoto , +and completely remove the +.I description +attribute. +.LP +Assuming that the file +.B /tmp/newentry +exists and has the contents: +.LP +.nf + dn: cn=Barbara Jensen,dc=example,dc=com + objectClass: person + cn: Barbara Jensen + cn: Babs Jensen + sn: Jensen + title: the world's most famous mythical manager + mail: bjensen@example.com + uid: bjensen +.fi +.LP +the command: +.LP +.nf + ldapadd \-f /tmp/newentry +.fi +.LP +will add a new entry for Babs Jensen, using the values from the +file +.B /tmp/newentry. +.LP +Assuming that the file +.B /tmp/entrymods +exists and has the contents: +.LP +.nf + dn: cn=Barbara Jensen,dc=example,dc=com + changetype: delete +.fi +.LP +the command: +.LP +.nf + ldapmodify \-f /tmp/entrymods +.fi +.LP +will remove Babs Jensen's entry. +.SH DIAGNOSTICS +Exit status is zero if no errors occur. Errors result in a non-zero +exit status and a diagnostic message being written to standard error. +.SH "SEE ALSO" +.BR ldapadd (1), +.BR ldapdelete (1), +.BR ldapmodrdn (1), +.BR ldapsearch (1), +.BR ldap.conf (5), +.BR ldap (3), +.BR ldap_add_ext (3), +.BR ldap_delete_ext (3), +.BR ldap_modify_ext (3), +.BR ldap_modrdn_ext (3), +.BR ldif (5). +.SH AUTHOR +The OpenLDAP Project <http://www.openldap.org/> +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man1/ldapmodify.1.links b/doc/man/man1/ldapmodify.1.links new file mode 100644 index 0000000..eb4fb76 --- /dev/null +++ b/doc/man/man1/ldapmodify.1.links @@ -0,0 +1 @@ +ldapadd.1 diff --git a/doc/man/man1/ldapmodrdn.1 b/doc/man/man1/ldapmodrdn.1 new file mode 100644 index 0000000..9993f2f --- /dev/null +++ b/doc/man/man1/ldapmodrdn.1 @@ -0,0 +1,279 @@ +.TH LDAPMODRDN 1 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldapmodrdn \- LDAP rename entry tool +.SH SYNOPSIS +.B ldapmodrdn +[\c +.BR \-V [ V ]] +[\c +.BI \-d \ debuglevel\fR] +[\c +.BR \-n ] +[\c +.BR \-v ] +[\c +.BR \-r ] +[\c +.BI \-s \ newsup\fR] +[\c +.BR \-c ] +[\c +.BI \-f \ file\fR] +[\c +.BR \-M [ M ]] +[\c +.BR \-x ] +[\c +.BI \-D \ binddn\fR] +[\c +.BR \-W ] +[\c +.BI \-w \ passwd\fR] +[\c +.BI \-y \ passwdfile\fR] +[\c +.BI \-H \ ldapuri\fR] +[\c +.BI \-h \ ldaphost\fR] +[\c +.BI \-p \ ldapport\fR] +[\c +.BR \-P \ { 2 \||\| 3 }] +[\c +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BI \-o \ opt \fR[= optparam \fR]] +[\c +.BI \-O \ security-properties\fR] +[\c +.BR \-I ] +[\c +.BR \-Q ] +[\c +.BR \-N ] +[\c +.BI \-U \ authcid\fR] +[\c +.BI \-R \ realm\fR] +[\c +.BI \-X \ authzid\fR] +[\c +.BI \-Y \ mech\fR] +[\c +.BR \-Z [ Z ]] +[\c +.I dn rdn\fR] +.SH DESCRIPTION +.B ldapmodrdn +is a shell-accessible interface to the +.BR ldap_rename (3) +library call. +.LP +.B ldapmodrdn +opens a connection to an LDAP server, binds, and modifies the RDN of entries. +The entry information is read from standard input, from \fIfile\fP through +the use of the +.RI \- f +option, or from the command-line pair \fIdn\fP and +\fIrdn\fP. +.SH OPTIONS +.TP +.BR \-V [ V ] +Print version info. +If \fB\-VV\fP is given, only the version information is printed. +.TP +.BI \-d \ debuglevel +Set the LDAP debugging level to \fIdebuglevel\fP. +.B ldapmodrdn +must be compiled with LDAP_DEBUG defined for this option to have any effect. +.TP +.B \-n +Show what would be done, but don't actually change entries. Useful for +debugging in conjunction with \fB\-v\fP. +.TP +.B \-v +Use verbose mode, with many diagnostics written to standard output. +.TP +.B \-r +Remove old RDN values from the entry. Default is to keep old values. +.TP +.BI \-s \ newsup +Specify a new superior entry. (I.e., move the target entry and make it a +child of the new superior.) This option is not supported in LDAPv2. +.TP +.B \-c +Continuous operation mode. Errors are reported, but ldapmodrdn +will continue with modifications. The default is to exit after +reporting an error. +.TP +.BI \-f \ file +Read the entry modification information from \fIfile\fP instead of from +standard input or the command-line. +.TP +.BR \-M [ M ] +Enable manage DSA IT control. +.B \-MM +makes control critical. +.TP +.B \-x +Use simple authentication instead of SASL. +.TP +.BI \-D \ binddn +Use the Distinguished Name \fIbinddn\fP to bind to the LDAP directory. +For SASL binds, the server is expected to ignore this value. +.TP +.B \-W +Prompt for simple authentication. +This is used instead of specifying the password on the command line. +.TP +.BI \-w \ passwd +Use \fIpasswd\fP as the password for simple authentication. +.TP +.BI \-y \ passwdfile +Use complete contents of \fIpasswdfile\fP as the password for +simple authentication. +.TP +.BI \-H \ ldapuri +Specify URI(s) referring to the ldap server(s); only the protocol/host/port +fields are allowed; a list of URI, separated by whitespace or commas +is expected. +.TP +.BI \-h \ ldaphost +Specify an alternate host on which the ldap server is running. +Deprecated in favor of \fB\-H\fP. +.TP +.BI \-p \ ldapport +Specify an alternate TCP port where the ldap server is listening. +Deprecated in favor of \fB\-H\fP. +.TP +.BR \-P \ { 2 \||\| 3 } +Specify the LDAP protocol version to use. +.TP +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ] +.TP +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ] + +Specify general extensions with \fB\-e\fP and modrdn extensions with \fB\-E\fP. +\'\fB!\fP\' indicates criticality. + +General extensions: +.nf + [!]assert=<filter> (an RFC 4515 Filter) + !authzid=<authzid> ("dn:<dn>" or "u:<user>") + [!]bauthzid (RFC 3829 authzid control) + [!]chaining[=<resolve>[/<cont>]] + [!]manageDSAit + [!]noop + ppolicy + [!]postread[=<attrs>] (a comma-separated attribute list) + [!]preread[=<attrs>] (a comma-separated attribute list) + [!]relax + sessiontracking + abandon,cancel,ignore (SIGINT sends abandon/cancel, + or ignores response; if critical, doesn't wait for SIGINT. + not really controls) +.fi + +Modrdn extensions: +.nf + (none) +.fi +.TP +.BI \-o \ opt \fR[= optparam \fR] + +Specify general options. + +General options: +.nf + nettimeout=<timeout> (in seconds, or "none" or "max") + ldif-wrap=<width> (in columns, or "no" for no wrapping) +.fi +.TP +.BI \-O \ security-properties +Specify SASL security properties. +.TP +.B \-I +Enable SASL Interactive mode. Always prompt. Default is to prompt +only as needed. +.TP +.B \-Q +Enable SASL Quiet mode. Never prompt. +.TP +.B \-N +Do not use reverse DNS to canonicalize SASL host name. +.TP +.BI \-U \ authcid +Specify the authentication ID for SASL bind. The form of the ID +depends on the actual SASL mechanism used. +.TP +.BI \-R \ realm +Specify the realm of authentication ID for SASL bind. The form of the realm +depends on the actual SASL mechanism used. +.TP +.BI \-X \ authzid +Specify the requested authorization ID for SASL bind. +.I authzid +must be one of the following formats: +.BI dn: "<distinguished name>" +or +.BI u: <username> +.TP +.BI \-Y \ mech +Specify the SASL mechanism to be used for authentication. If it's not +specified, the program will choose the best mechanism the server knows. +.TP +.BR \-Z [ Z ] +Issue StartTLS (Transport Layer Security) extended operation. If you use +\fB\-ZZ\fP, the command will require the operation to be successful. +.SH INPUT FORMAT +If the command-line arguments \fIdn\fP and \fIrdn\fP are given, \fIrdn\fP +will replace the RDN of the entry specified by the DN, \fIdn\fP. +.LP +Otherwise, the contents of \fIfile\fP (or standard input if +no \fB\-f\fP flag is given) should consist of one or more entries. +.LP +.nf + Distinguished Name (DN) + Relative Distinguished Name (RDN) +.fi +.LP +One or more blank lines may be used to separate each DN/RDN pair. +.SH EXAMPLE +Assuming that the file +.B /tmp/entrymods +exists and has the contents: +.LP +.nf + cn=Modify Me,dc=example,dc=com + cn=The New Me +.fi +.LP +the command: +.LP +.nf + ldapmodrdn \-r \-f /tmp/entrymods +.fi +.LP +will change the RDN of the "Modify Me" entry from "Modify Me" to +"The New Me" and the old cn, "Modify Me" will be removed. +.LP +.SH DIAGNOSTICS +Exit status is 0 if no errors occur. Errors result in a non-zero exit +status and a diagnostic message being written to standard error. +.SH "SEE ALSO" +.BR ldapadd (1), +.BR ldapdelete (1), +.BR ldapmodify (1), +.BR ldapsearch (1), +.BR ldap.conf (5), +.BR ldap (3), +.BR ldap_rename (3) +.SH AUTHOR +The OpenLDAP Project <http://www.openldap.org/> +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man1/ldappasswd.1 b/doc/man/man1/ldappasswd.1 new file mode 100644 index 0000000..57a19a9 --- /dev/null +++ b/doc/man/man1/ldappasswd.1 @@ -0,0 +1,242 @@ +.TH LDAPPASSWD 1 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldappasswd \- change the password of an LDAP entry +.SH SYNOPSIS +.B ldappasswd +[\c +.BR \-V [ V ]] +[\c +.BI \-d \ debuglevel\fR] +[\c +.BR \-n ] +[\c +.BR \-v ] +[\c +.BR \-A ] +[\c +.BI \-a \ oldPasswd\fR] +[\c +.BI \-t \ oldpasswdfile\fR] +[\c +.BR \-S ] +[\c +.BI \-s \ newPasswd\fR] +[\c +.BI \-T \ newpasswdfile\fR] +[\c +.BR \-x ] +[\c +.BI \-D \ binddn\fR] +[\c +.BR \-W ] +[\c +.BI \-w \ passwd\fR] +[\c +.BI \-y \ passwdfile\fR] +[\c +.BI \-H \ ldapuri\fR] +[\c +.BI \-h \ ldaphost\fR] +[\c +.BI \-p \ ldapport\fR] +[\c +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BI \-o \ opt \fR[= optparam \fR]] +[\c +.BI \-O \ security-properties\fR] +[\c +.BR \-I ] +[\c +.BR \-Q ] +[\c +.BR \-N ] +[\c +.BI \-U \ authcid\fR] +[\c +.BI \-R \ realm\fR] +[\c +.BI \-X \ authzid\fR] +[\c +.BI \-Y \ mech\fR] +[\c +.BR \-Z [ Z ]] +[\c +.IR user ] +.SH DESCRIPTION +.B ldappasswd +is a tool to set the password of an LDAP user. +.B ldappasswd +uses the LDAPv3 Password Modify (RFC 3062) extended operation. +.LP +.B ldappasswd +sets the password of associated with the user [or an optionally +specified +.IR user ]. +If the new +password is not specified on the command line and the user +doesn't enable prompting, the server will be asked to generate +a password for the user. +.LP +.B ldappasswd +is neither designed nor intended to be a replacement for +.BR passwd (1) +and should not be installed as such. +.SH OPTIONS +.TP +.BR \-V [ V ] +Print version info. +If \fB\-VV\fP is given, only the version information is printed. +.TP +.BI \-d \ debuglevel +Set the LDAP debugging level to \fIdebuglevel\fP. +.B ldappasswd +must be compiled with LDAP_DEBUG defined for this option to have any effect. +.TP +.B \-n +Do not set password. (Can be useful when used in conjunction with +\fB\-v\fP or \fB\-d\fP) +.TP +.B \-v +Increase the verbosity of output. Can be specified multiple times. +.TP +.BI \-A +Prompt for old password. +This is used instead of specifying the password on the command line. +.TP +.BI \-a \ oldPasswd +Set the old password to \fIoldPasswd\fP. +.TP +.BI \-t \ oldPasswdFile +Set the old password to the contents of \fIoldPasswdFile\fP. +.TP +.BI \-S +Prompt for new password. +This is used instead of specifying the password on the command line. +.TP +.BI \-s \ newPasswd +Set the new password to \fInewPasswd\fP. +.TP +.BI \-T \ newPasswdFile +Set the new password to the contents of \fInewPasswdFile\fP. +.TP +.B \-x +Use simple authentication instead of SASL. +.TP +.BI \-D \ binddn +Use the Distinguished Name \fIbinddn\fP to bind to the LDAP directory. +For SASL binds, the server is expected to ignore this value. +.TP +.BI \-W +Prompt for bind password. +This is used instead of specifying the password on the command line. +.TP +.BI \-w \ passwd +Use \fIpasswd\fP as the password to bind with. +.TP +.BI \-y \ passwdfile +Use complete contents of \fIpasswdfile\fP as the password for +simple authentication. +.TP +.BI \-H \ ldapuri +Specify URI(s) referring to the ldap server(s); only the protocol/host/port +fields are allowed; a list of URI, separated by whitespace or commas +is expected. +.TP +.BI \-h \ ldaphost +Specify an alternate host on which the ldap server is running. +Deprecated in favor of \fB\-H\fP. +.TP +.BI \-p \ ldapport +Specify an alternate TCP port where the ldap server is listening. +Deprecated in favor of \fB\-H\fP. +.TP +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ] +.TP +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ] + +Specify general extensions with \fB\-e\fP and passwd modify extensions with \fB\-E\fP. +\'\fB!\fP\' indicates criticality. + +General extensions: +.nf + [!]assert=<filter> (an RFC 4515 Filter) + !authzid=<authzid> ("dn:<dn>" or "u:<user>") + [!]bauthzid (RFC 3829 authzid control) + [!]chaining[=<resolve>[/<cont>]] + [!]manageDSAit + [!]noop + ppolicy + [!]postread[=<attrs>] (a comma-separated attribute list) + [!]preread[=<attrs>] (a comma-separated attribute list) + [!]relax + sessiontracking + abandon,cancel,ignore (SIGINT sends abandon/cancel, + or ignores response; if critical, doesn't wait for SIGINT. + not really controls) +.fi + +Passwd Modify extensions: +.nf + (none) +.fi +.TP +.BI \-o \ opt \fR[= optparam \fR]] + +Specify general options. + +General options: +.nf + nettimeout=<timeout> (in seconds, or "none" or "max") + ldif-wrap=<width> (in columns, or "no" for no wrapping) +.fi +.TP +.BI \-O \ security-properties +Specify SASL security properties. +.TP +.B \-I +Enable SASL Interactive mode. Always prompt. Default is to prompt +only as needed. +.TP +.B \-Q +Enable SASL Quiet mode. Never prompt. +.TP +.B \-N +Do not use reverse DNS to canonicalize SASL host name. +.TP +.BI \-U \ authcid +Specify the authentication ID for SASL bind. The form of the ID +depends on the actual SASL mechanism used. +.TP +.BI \-R \ realm +Specify the realm of authentication ID for SASL bind. The form of the realm +depends on the actual SASL mechanism used. +.TP +.BI \-X \ authzid +Specify the requested authorization ID for SASL bind. +.I authzid +must be one of the following formats: +.BI dn: "<distinguished name>" +or +.BI u: <username>\fP. +.TP +.BI \-Y \ mech +Specify the SASL mechanism to be used for authentication. If it's not +specified, the program will choose the best mechanism the server knows. +.TP +.BR \-Z [ Z ] +Issue StartTLS (Transport Layer Security) extended operation. If you use +\fB\-ZZ\fP, the command will require the operation to be successful +.SH SEE ALSO +.BR ldap_sasl_bind (3), +.BR ldap_extended_operation (3), +.BR ldap_start_tls_s (3) +.SH AUTHOR +The OpenLDAP Project <http://www.openldap.org/> +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man1/ldapsearch.1 b/doc/man/man1/ldapsearch.1 new file mode 100644 index 0000000..982027f --- /dev/null +++ b/doc/man/man1/ldapsearch.1 @@ -0,0 +1,506 @@ +.TH LDAPSEARCH 1 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldapsearch \- LDAP search tool +.SH SYNOPSIS +.B ldapsearch +[\c +.BR \-V [ V ]] +[\c +.BI \-d \ debuglevel\fR] +[\c +.BR \-n ] +[\c +.BR \-v ] +[\c +.BR \-c ] +[\c +.BR \-u ] +[\c +.BR \-t [ t ]] +[\c +.BI \-T \ path\fR] +[\c +.BI \-F \ prefix\fR] +[\c +.BR \-A ] +[\c +.BR \-L [ L [ L ]]] +[\c +.BI \-S \ attribute\fR] +[\c +.BI \-b \ searchbase\fR] +[\c +.BR \-s \ { base \||\| one \||\| sub \||\| children }] +[\c +.BR \-a \ { never \||\| always \||\| search \||\| find }] +[\c +.BI \-l \ timelimit\fR] +[\c +.BI \-z \ sizelimit\fR] +[\c +.BI \-f \ file\fR] +[\c +.BR \-M [ M ]] +[\c +.BR \-x ] +[\c +.BI \-D \ binddn\fR] +[\c +.BR \-W ] +[\c +.BI \-w \ passwd\fR] +[\c +.BI \-y \ passwdfile\fR] +[\c +.BI \-H \ ldapuri\fR] +[\c +.BI \-h \ ldaphost\fR] +[\c +.BI \-p \ ldapport\fR] +[\c +.BR \-P \ { 2 \||\| 3 }] +[\c +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BI \-o \ opt \fR[= optparam \fR]] +[\c +.BI \-O \ security-properties\fR] +[\c +.BR \-I ] +[\c +.BR \-Q ] +[\c +.BR \-N ] +[\c +.BI \-U \ authcid\fR] +[\c +.BI \-R \ realm\fR] +[\c +.BI \-X \ authzid\fR] +[\c +.BI \-Y \ mech\fR] +[\c +.BR \-Z [ Z ]] +.I filter +[\c +.IR attrs... ] +.SH DESCRIPTION +.I ldapsearch +is a shell-accessible interface to the +.BR ldap_search_ext (3) +library call. +.LP +.B ldapsearch +opens a connection to an LDAP server, binds, and performs a search +using specified parameters. The \fIfilter\fP should conform to +the string representation for search filters as defined in RFC 4515. +If not provided, the default filter, \fB(objectClass=*)\fP, is used. +.LP +If +.B ldapsearch +finds one or more entries, the attributes specified by +\fIattrs\fP are returned. If \fB*\fP is listed, all user attributes are +returned. If \fB+\fP is listed, all operational attributes are returned. +If no \fIattrs\fP are listed, all user attributes are returned. If only +1.1 is listed, no attributes will be returned. +.LP +The search results are displayed using an extended version of LDIF. +Option \fI\-L\fP controls the format of the output. +.SH OPTIONS +.TP +.BR \-V [ V ] +Print version info. +If \fB\-VV\fP is given, exit after providing version info. Otherwise proceed +with the specified search +.TP +.BI \-d \ debuglevel +Set the LDAP debugging level to \fIdebuglevel\fP. +.B ldapsearch +must be compiled with LDAP_DEBUG defined for this option to have any effect. +.TP +.B \-n +Show what would be done, but don't actually perform the search. Useful for +debugging in conjunction with \fB\-v\fP. +.TP +.B \-v +Run in verbose mode, with many diagnostics written to standard output. +.TP +.B \-c +Continuous operation mode. Errors are reported, but ldapsearch will continue +with searches. The default is to exit after reporting an error. Only useful +in conjunction with \fB\-f\fP. +.TP +.B \-u +Include the User Friendly Name form of the Distinguished Name (DN) +in the output. +.TP +.BR \-t [ t ] +A single \fB\-t\fP writes retrieved non-printable values to a set of temporary +files. This is useful for dealing with values containing non-character +data such as jpegPhoto or audio. A second \fB\-t\fP writes all retrieved values to +files. +.TP +.BI \-T \ path +Write temporary files to directory specified by \fIpath\fP (default: +\fB/var/tmp/\fP) +.TP +.BI \-F \ prefix +URL prefix for temporary files. Default is \fBfile://\fIpath\fP where +\fIpath\fP is \fB/var/tmp/\fP or specified with \fB\-T\fP. +.TP +.B \-A +Retrieve attributes only (no values). This is useful when you just want to +see if an attribute is present in an entry and are not interested in the +specific values. +.TP +.B \-L +Search results are display in LDAP Data Interchange Format detailed in +.BR ldif (5). +A single \fB\-L\fP restricts the output to LDIFv1. + A second \fB\-L\fP disables comments. +A third \fB\-L\fP disables printing of the LDIF version. +The default is to use an extended version of LDIF. +.TP +.BI \-S \ attribute +Sort the entries returned based on \fIattribute\fP. The default is not +to sort entries returned. If \fIattribute\fP is a zero-length string (""), +the entries are sorted by the components of their Distinguished Name. See +.BR ldap_sort (3) +for more details. Note that +.B ldapsearch +normally prints out entries as it receives them. The use of the \fB\-S\fP +option defeats this behavior, causing all entries to be retrieved, +then sorted, then printed. +.TP +.BI \-b \ searchbase +Use \fIsearchbase\fP as the starting point for the search instead of +the default. +.TP +.BR \-s \ { base \||\| one \||\| sub \||\| children } +Specify the scope of the search to be one of +.BR base , +.BR one , +.BR sub , +or +.B children +to specify a base object, one-level, subtree, or children search. +The default is +.BR sub . +Note: +.I children +scope requires LDAPv3 subordinate feature extension. +.TP +.BR \-a \ { never \||\| always \||\| search \||\| find } +Specify how aliases dereferencing is done. Should be one of +.BR never , +.BR always , +.BR search , +or +.B find +to specify that aliases are never dereferenced, always dereferenced, +dereferenced when searching, or dereferenced only when locating the +base object for the search. The default is to never dereference aliases. +.TP +.BI \-l \ timelimit +wait at most \fItimelimit\fP seconds for a search to complete. +A timelimit of +.I 0 +(zero) or +.I none +means no limit. +A timelimit of +.I max +means the maximum integer allowable by the protocol. +A server may impose a maximal timelimit which only +the root user may override. +.TP +.BI \-z \ sizelimit +retrieve at most \fIsizelimit\fP entries for a search. +A sizelimit of +.I 0 +(zero) or +.I none +means no limit. +A sizelimit of +.I max +means the maximum integer allowable by the protocol. +A server may impose a maximal sizelimit which only +the root user may override. +.TP +.BI \-f \ file +Read a series of lines from \fIfile\fP, performing one LDAP search for +each line. In this case, the \fIfilter\fP given on the command line +is treated as a pattern where the first and only occurrence of \fB%s\fP +is replaced with a line from \fIfile\fP. Any other occurrence of the +the \fB%\fP character in the pattern will be regarded as an error. +Where it is desired that the search filter include a \fB%\fP character, +the character should be encoded as \fB\\25\fP (see RFC 4515). +If \fIfile\fP is a single +\fB\-\fP character, then the lines are read from standard input. +.B ldapsearch +will exit when the first non-successful search result is returned, +unless \fB\-c\fP is used. +.TP +.BR \-M [ M ] +Enable manage DSA IT control. +.B \-MM +makes control critical. +.TP +.B \-x +Use simple authentication instead of SASL. +.TP +.BI \-D \ binddn +Use the Distinguished Name \fIbinddn\fP to bind to the LDAP directory. +For SASL binds, the server is expected to ignore this value. +.TP +.B \-W +Prompt for simple authentication. +This is used instead of specifying the password on the command line. +.TP +.BI \-w \ passwd +Use \fIpasswd\fP as the password for simple authentication. +.TP +.BI \-y \ passwdfile +Use complete contents of \fIpasswdfile\fP as the password for +simple authentication. +.TP +.BI \-H \ ldapuri +Specify URI(s) referring to the ldap server(s); +a list of URI, separated by whitespace or commas is expected; +only the protocol/host/port fields are allowed. +As an exception, if no host/port is specified, but a DN is, +the DN is used to look up the corresponding host(s) using the +DNS SRV records, according to RFC 2782. The DN must be a non-empty +sequence of AVAs whose attribute type is "dc" (domain component), +and must be escaped according to RFC 2396. +.TP +.BI \-h \ ldaphost +Specify an alternate host on which the ldap server is running. +Deprecated in favor of \fB\-H\fP. +.TP +.BI \-p \ ldapport +Specify an alternate TCP port where the ldap server is listening. +Deprecated in favor of \fB\-H\fP. +.TP +.BR \-P \ { 2 \||\| 3 } +Specify the LDAP protocol version to use. +.TP +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ] +.TP +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ] + +Specify general extensions with \fB\-e\fP and search extensions with \fB\-E\fP. +\'\fB!\fP\' indicates criticality. + +General extensions: +.nf + [!]assert=<filter> (an RFC 4515 Filter) + !authzid=<authzid> ("dn:<dn>" or "u:<user>") + [!]bauthzid (RFC 3829 authzid control) + [!]chaining[=<resolve>[/<cont>]] + [!]manageDSAit + [!]noop + ppolicy + [!]postread[=<attrs>] (a comma-separated attribute list) + [!]preread[=<attrs>] (a comma-separated attribute list) + [!]relax + sessiontracking + abandon,cancel,ignore (SIGINT sends abandon/cancel, + or ignores response; if critical, doesn't wait for SIGINT. + not really controls) +.fi + +Search extensions: +.nf + !dontUseCopy + [!]domainScope (domain scope) + [!]mv=<filter> (matched values filter) + [!]pr=<size>[/prompt|noprompt] (paged results/prompt) + [!]sss=[\-]<attr[:OID]>[/[\-]<attr[:OID]>...] (server side sorting) + [!]subentries[=true|false] (subentries) + [!]sync=ro[/<cookie>] (LDAP Sync refreshOnly) + rp[/<cookie>][/<slimit>] (LDAP Sync refreshAndPersist) + [!]vlv=<before>/<after>(/<offset>/<count>|:<value>) (virtual list view) + [!]deref=derefAttr:attr[,attr[...]][;derefAttr:attr[,attr[...]]] + [!]<oid>[=<value>] +.fi +.TP +.BI \-o \ opt \fR[= optparam \fR] + +Specify general options. + +General options: +.nf + nettimeout=<timeout> (in seconds, or "none" or "max") + ldif-wrap=<width> (in columns, or "no" for no wrapping) +.fi +.TP +.BI \-O \ security-properties +Specify SASL security properties. +.TP +.B \-I +Enable SASL Interactive mode. Always prompt. Default is to prompt +only as needed. +.TP +.B \-Q +Enable SASL Quiet mode. Never prompt. +.TP +.B \-N +Do not use reverse DNS to canonicalize SASL host name. +.TP +.BI \-U \ authcid +Specify the authentication ID for SASL bind. The form of the ID +depends on the actual SASL mechanism used. +.TP +.BI \-R \ realm +Specify the realm of authentication ID for SASL bind. The form of the realm +depends on the actual SASL mechanism used. +.TP +.BI \-X \ authzid +Specify the requested authorization ID for SASL bind. +.I authzid +must be one of the following formats: +.BI dn: "<distinguished name>" +or +.BI u: <username> +.TP +.BI \-Y \ mech +Specify the SASL mechanism to be used for authentication. If it's not +specified, the program will choose the best mechanism the server knows. +.TP +.BR \-Z [ Z ] +Issue StartTLS (Transport Layer Security) extended operation. If you use +\fB\-ZZ\fP, the command will require the operation to be successful. +.SH OUTPUT FORMAT +If one or more entries are found, each entry is written to standard +output in LDAP Data Interchange Format or +.BR ldif (5): +.LP +.nf + version: 1 + + # bjensen, example, net + dn: uid=bjensen,dc=example,dc=net + objectClass: person + objectClass: dcObject + uid: bjensen + cn: Barbara Jensen + sn: Jensen + ... +.fi +.LP +If the \fB\-t\fP option is used, the URI of a temporary file +is used in place of the actual value. If the \fB\-A\fP option +is given, only the "attributename" part is written. +.SH EXAMPLE +The following command: +.LP +.nf + ldapsearch \-LLL "(sn=smith)" cn sn telephoneNumber +.fi +.LP +will perform a subtree search (using the default search base and +other parameters defined in +.BR ldap.conf (5)) +for entries with a surname (sn) of smith. The common name (cn), surname +(sn) and telephoneNumber values will be retrieved and printed to +standard output. +The output might look something like this if two entries are found: +.LP +.nf + dn: uid=jts,dc=example,dc=com + cn: John Smith + cn: John T. Smith + sn: Smith + sn;lang\-en: Smith + sn;lang\-de: Schmidt + telephoneNumber: 1 555 123\-4567 + + dn: uid=sss,dc=example,dc=com + cn: Steve Smith + cn: Steve S. Smith + sn: Smith + sn;lang\-en: Smith + sn;lang\-de: Schmidt + telephoneNumber: 1 555 765\-4321 +.fi +.LP +The command: +.LP +.nf + ldapsearch \-LLL \-u \-t "(uid=xyz)" jpegPhoto audio +.fi +.LP +will perform a subtree search using the default search base for entries +with user id of "xyz". The user friendly form of the entry's DN will be +output after the line that contains the DN itself, and the jpegPhoto +and audio values will be retrieved and written to temporary files. The +output might look like this if one entry with one value for each of the +requested attributes is found: +.LP +.nf + dn: uid=xyz,dc=example,dc=com + ufn: xyz, example, com + audio:< file:///tmp/ldapsearch\-audio\-a19924 + jpegPhoto:< file:///tmp/ldapsearch\-jpegPhoto\-a19924 +.fi +.LP +This command: +.LP +.nf + ldapsearch \-LLL \-s one \-b "c=US" "(o=University*)" o description +.fi +.LP +will perform a one-level search at the c=US level for all entries +whose organization name (o) begins with \fBUniversity\fP. +The organization name and description attribute values will be retrieved +and printed to standard output, resulting in output similar to this: +.LP +.nf + dn: o=University of Alaska Fairbanks,c=US + o: University of Alaska Fairbanks + description: Preparing Alaska for a brave new yesterday + description: leaf node only + + dn: o=University of Colorado at Boulder,c=US + o: University of Colorado at Boulder + description: No personnel information + description: Institution of education and research + + dn: o=University of Colorado at Denver,c=US + o: University of Colorado at Denver + o: UCD + o: CU/Denver + o: CU\-Denver + description: Institute for Higher Learning and Research + + dn: o=University of Florida,c=US + o: University of Florida + o: UFl + description: Warper of young minds + + ... +.fi +.SH DIAGNOSTICS +Exit status is zero if no errors occur. +Errors result in a non-zero exit status and +a diagnostic message being written to standard error. +.SH "SEE ALSO" +.BR ldapadd (1), +.BR ldapdelete (1), +.BR ldapmodify (1), +.BR ldapmodrdn (1), +.BR ldap.conf (5), +.BR ldif (5), +.BR ldap (3), +.BR ldap_search_ext (3), +.BR ldap_sort (3) +.SH AUTHOR +The OpenLDAP Project <http://www.openldap.org/> +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man1/ldapurl.1 b/doc/man/man1/ldapurl.1 new file mode 100644 index 0000000..da27039 --- /dev/null +++ b/doc/man/man1/ldapurl.1 @@ -0,0 +1,168 @@ +.TH LDAPURL 1 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 2008-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldapurl \- LDAP URL formatting tool +.SH SYNOPSIS +.B ldapurl +[\c +.BR \-a \ attrs\fR] +[\c +.BI \-b \ searchbase\fR] +[\c +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BI \-f \ filter\fR] +[\c +.BI \-H \ ldapuri\fR] +[\c +.BI \-h \ ldaphost\fR] +[\c +.BI \-p \ ldapport\fR] +[\c +.BR \-s \ { base \||\| one \||\| sub \||\| children }] +[\c +.BI \-S \ scheme\fR] +.SH DESCRIPTION +.I ldapurl +is a command that allows one to either compose or decompose LDAP URIs. +.LP +When invoked with the \fB\-H\fP option, +.B ldapurl +extracts the components of the \fIldapuri\fP option argument, +unescaping hex-escaped chars as required. +It basically acts as a frontend to the +.BR ldap_url_parse (3) +call. +Otherwise, it builds an LDAP URI based on the components +passed with the appropriate options, performing the inverse operation. +Option \fB\-H\fP is incompatible with options +.BR \-a , +.BR \-b , +.BR \-E , +.BR \-f , +.BR \-H , +.BR \-h , +.BR \-p , +.BR \-S , +and +.BR \-s . +.SH OPTIONS +.TP +.TP +.BI \-a \ attrs +Set a comma-separated list of attribute selectors. +.TP +.BI \-b \ searchbase +Set the \fIsearchbase\fP. +.TP +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ] + +Specify general extensions with \fB\-e\fP +\'\fB!\fP\' indicates criticality. + +General extensions: +.nf + [!]assert=<filter> (an RFC 4515 Filter) + !authzid=<authzid> ("dn:<dn>" or "u:<user>") + [!]bauthzid (RFC 3829 authzid control) + [!]chaining[=<resolve>[/<cont>]] + [!]manageDSAit + [!]noop + ppolicy + [!]postread[=<attrs>] (a comma-separated attribute list) + [!]preread[=<attrs>] (a comma-separated attribute list) + [!]relax + sessiontracking + abandon,cancel,ignore (SIGINT sends abandon/cancel, + or ignores response; if critical, doesn't wait for SIGINT. + not really controls) +.fi + +.TP +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ] +Set URL extensions; incompatible with +.BR \-H . +.TP +.BI \-f \ filter +Set the URL filter. No particular check on conformity with RFC 4515 +LDAP filters is performed, but the value is hex-escaped as required. +.TP +.BI \-H \ ldapuri +Specify URI to be exploded. +.TP +.BI \-h \ ldaphost +Set the host. +.TP +.BI \-p \ ldapport +Set the TCP port. +.TP +.BI \-S \ scheme +Set the URL scheme. Defaults for other fields, like \fIldapport\fP, +may depend on the value of \fIscheme\fP. +.TP +.BR \-s \ { base \||\| one \||\| sub \||\| children } +Specify the scope of the search to be one of +.BR base , +.BR one , +.BR sub , +or +.B children +to specify a base object, one-level, subtree, or children search. +The default is +.BR sub . +Note: +.B children +scope requires LDAPv3 subordinate feature extension. + +.SH OUTPUT FORMAT +If the \fB\-H\fP option is used, the \fIldapuri\fP supplied +is exploded in its components, which are printed to standard output +in an LDIF-like form. +.LP +Otherwise, the URI built using the values passed with the other options +is printed to standard output. +.SH EXAMPLE +The following command: +.LP +.nf + ldapurl \-h ldap.example.com \-b dc=example,dc=com \-s sub \-f "(cn=Some One)" +.fi +.LP +returns +.LP +.nf + ldap://ldap.example.com:389/dc=example,dc=com??sub?(cn=Some%20One) +.fi +.LP +The command: +.LP +.nf + ldapurl \-H ldap://ldap.example.com:389/dc=example,dc=com??sub?(cn=Some%20One) +.fi +.LP +returns +.LP +.nf + scheme: ldap + host: ldap.example.com + port: 389 + dn: dc=example,dc=com + scope: sub + filter: (cn=Some One) +.fi +.LP +.SH DIAGNOSTICS +Exit status is zero if no errors occur. +Errors result in a non-zero exit status and +a diagnostic message being written to standard error. +.SH "SEE ALSO" +.BR ldap (3), +.BR ldap_url_parse (3), +.SH AUTHOR +The OpenLDAP Project <http://www.openldap.org/> +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man1/ldapwhoami.1 b/doc/man/man1/ldapwhoami.1 new file mode 100644 index 0000000..5d35862 --- /dev/null +++ b/doc/man/man1/ldapwhoami.1 @@ -0,0 +1,201 @@ +.TH LDAPWHOAMI 1 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldapwhoami \- LDAP who am i? tool +.SH SYNOPSIS +.B ldapwhoami +[\c +.BR \-V [ V ]] +[\c +.BI \-d \ debuglevel\fR] +[\c +.BR \-n ] +[\c +.BR \-v ] +[\c +.BR \-x ] +[\c +.BI \-D \ binddn\fR] +[\c +.BR \-W ] +[\c +.BI \-w \ passwd\fR] +[\c +.BI \-y \ passwdfile\fR] +[\c +.BI \-H \ ldapuri\fR] +[\c +.BI \-h \ ldaphost\fR] +[\c +.BI \-p \ ldapport\fR] +[\c +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ]] +[\c +.BI \-o \ opt \fR[= optparam \fR]] +[\c +.BI \-O \ security-properties\fR] +[\c +.BR \-I ] +[\c +.BR \-Q ] +[\c +.BR \-N ] +[\c +.BI \-U \ authcid\fR] +[\c +.BI \-R \ realm\fR] +[\c +.BI \-X \ authzid\fR] +[\c +.BI \-Y \ mech\fR] +[\c +.BR \-Z [ Z ]] +.SH DESCRIPTION +.I ldapwhoami +implements the LDAP "Who Am I?" extended operation. +.LP +.B ldapwhoami +opens a connection to an LDAP server, binds, and performs a whoami +operation. +.SH OPTIONS +.TP +.BR \-V [ V ] +Print version info. +If \fB\-VV\fP is given, only the version information is printed. +.TP +.BI \-d \ debuglevel +Set the LDAP debugging level to \fIdebuglevel\fP. +.B ldapwhoami +must be compiled with LDAP_DEBUG defined for this option to have any effect. +.TP +.B \-n +Show what would be done, but don't actually perform the whoami operation. +Useful for +debugging in conjunction with \fB\-v\fP. +.TP +.B \-v +Run in verbose mode, with many diagnostics written to standard output. +.TP +.B \-x +Use simple authentication instead of SASL. +.TP +.BI \-D \ binddn +Use the Distinguished Name \fIbinddn\fP to bind to the LDAP directory. +For SASL binds, the server is expected to ignore this value. +.TP +.B \-W +Prompt for simple authentication. +This is used instead of specifying the password on the command line. +.TP +.BI \-w \ passwd +Use \fIpasswd\fP as the password for simple authentication. +.TP +.BI \-y \ passwdfile +Use complete contents of \fIpasswdfile\fP as the password for +simple authentication. +.TP +.BI \-H \ ldapuri +Specify URI(s) referring to the ldap server(s); only the protocol/host/port +fields are allowed; a list of URI, separated by whitespace or commas +is expected. +.TP +.BI \-h \ ldaphost +Specify an alternate host on which the ldap server is running. +Deprecated in favor of \fB\-H\fP. +.TP +.BI \-p \ ldapport +Specify an alternate TCP port where the ldap server is listening. +Deprecated in favor of \fB\-H\fP. +.TP +.BR \-e \ [ ! ] \fIext\fP [ =\fIextparam\fP ] +.TP +.BR \-E \ [ ! ] \fIext\fP [ =\fIextparam\fP ] + +Specify general extensions with \fB\-e\fP and whoami extensions with \fB\-E\fP. +\'\fB!\fP\' indicates criticality. + +General extensions: +.nf + [!]assert=<filter> (an RFC 4515 Filter) + !authzid=<authzid> ("dn:<dn>" or "u:<user>") + [!]bauthzid (RFC 3829 authzid control) + [!]chaining[=<resolve>[/<cont>]] + [!]manageDSAit + [!]noop + ppolicy + [!]postread[=<attrs>] (a comma-separated attribute list) + [!]preread[=<attrs>] (a comma-separated attribute list) + [!]relax + sessiontracking + abandon,cancel,ignore (SIGINT sends abandon/cancel, + or ignores response; if critical, doesn't wait for SIGINT. + not really controls) +.fi + +WhoAmI extensions: +.nf + (none) +.fi +.TP +.BI \-o \ opt \fR[= optparam \fR] + +Specify general options. + +General options: +.nf + nettimeout=<timeout> (in seconds, or "none" or "max") + ldif-wrap=<width> (in columns, or "no" for no wrapping) +.fi +.TP +.BI \-O \ security-properties +Specify SASL security properties. +.TP +.B \-I +Enable SASL Interactive mode. Always prompt. Default is to prompt +only as needed. +.TP +.B \-Q +Enable SASL Quiet mode. Never prompt. +.TP +.B \-N +Do not use reverse DNS to canonicalize SASL host name. +.TP +.BI \-U \ authcid +Specify the authentication ID for SASL bind. The form of the ID +depends on the actual SASL mechanism used. +.TP +.BI \-R \ realm +Specify the realm of authentication ID for SASL bind. The form of the realm +depends on the actual SASL mechanism used. +.TP +.BI \-X \ authzid +Specify the requested authorization ID for SASL bind. +.I authzid +must be one of the following formats: +.BI dn: "<distinguished name>" +or +.BI u: <username> +.TP +.BI \-Y \ mech +Specify the SASL mechanism to be used for authentication. If it's not +specified, the program will choose the best mechanism the server knows. +.TP +.BR \-Z [ Z ] +Issue StartTLS (Transport Layer Security) extended operation. If you use +\fB\-ZZ\fP, the command will require the operation to be successful. +.SH EXAMPLE +.nf + ldapwhoami \-x \-D "cn=Manager,dc=example,dc=com" \-W +.fi +.SH "SEE ALSO" +.BR ldap.conf (5), +.BR ldap (3), +.BR ldap_extended_operation (3) +.SH AUTHOR +The OpenLDAP Project <http://www.openldap.org/> +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/Deprecated b/doc/man/man3/Deprecated new file mode 100644 index 0000000..3b7f696 --- /dev/null +++ b/doc/man/man3/Deprecated @@ -0,0 +1,7 @@ +Deprecated interfaces generally remain in the library. The macro +LDAP_DEPRECATED can be defined to a non-zero value +(e.g., -DLDAP_DEPRECATED=1) when compiling program designed to use +deprecated interfaces. It is recommended that developers writing new +programs, or updating old programs, avoid use of deprecated interfaces. +Over time, it is expected that documentation (and, eventually, support) for +deprecated interfaces to be eliminated. diff --git a/doc/man/man3/Makefile.in b/doc/man/man3/Makefile.in new file mode 100644 index 0000000..fa58b4b --- /dev/null +++ b/doc/man/man3/Makefile.in @@ -0,0 +1,16 @@ +# man3 Makefile.in for OpenLDAP +# $OpenLDAP$ +## This work is part of OpenLDAP Software <http://www.openldap.org/>. +## +## Copyright 1998-2018 The OpenLDAP Foundation. +## All rights reserved. +## +## Redistribution and use in source and binary forms, with or without +## modification, are permitted only as authorized by the OpenLDAP +## Public License. +## +## A copy of this license is available in the file LICENSE in the +## top-level directory of the distribution or, alternatively, at +## <http://www.OpenLDAP.org/license.html>. + +MANSECT=3 diff --git a/doc/man/man3/lber-decode.3 b/doc/man/man3/lber-decode.3 new file mode 100644 index 0000000..e39cb74 --- /dev/null +++ b/doc/man/man3/lber-decode.3 @@ -0,0 +1,357 @@ +.TH LBER_DECODE 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ber_get_next, ber_skip_tag, ber_peek_tag, ber_scanf, ber_get_int, ber_get_enum, ber_get_stringb, ber_get_stringa, ber_get_stringal, ber_get_stringbv, ber_get_null, ber_get_boolean, ber_get_bitstring, ber_first_element, ber_next_element \- OpenLDAP LBER simplified Basic Encoding Rules library routines for decoding +.SH LIBRARY +OpenLDAP LBER (liblber, \-llber) +.SH SYNOPSIS +.B #include <lber.h> +.LP +.BI "ber_tag_t ber_get_next(Sockbuf *" sb ", ber_len_t *" len ", BerElement *" ber ");" +.LP +.BI "ber_tag_t ber_skip_tag(BerElement *" ber ", ber_len_t *" len ");" +.LP +.BI "ber_tag_t ber_peek_tag(BerElement *" ber ", ber_len_t *" len ");" +.LP +.BI "ber_tag_t ber_scanf(BerElement *" ber ", const char *" fmt ", ...);" +.LP +.BI "ber_tag_t ber_get_int(BerElement *" ber ", ber_int_t *" num ");" +.LP +.BI "ber_tag_t ber_get_enum(BerElement *" ber ", ber_int_t *" num ");" +.LP +.BI "ber_tag_t ber_get_stringb(BerElement *" ber ", char *" buf ", ber_len_t *" len ");" +.LP +.BI "ber_tag_t ber_get_stringa(BerElement *" ber ", char **" buf ");" +.LP +.BI "ber_tag_t ber_get_stringal(BerElement *" ber ", struct berval **" bv ");" +.LP +.BI "ber_tag_t ber_get_stringbv(BerElement *" ber ", struct berval *" bv ", int " alloc ");" +.LP +.BI "ber_tag_t ber_get_null(BerElement *" ber ");" +.LP +.BI "ber_tag_t ber_get_boolean(BerElement *" ber ", ber_int_t *" bool ");" +.LP +.BI "ber_tag_t ber_get_bitstringa(BerElement *" ber ", char **" buf ", ber_len_t *" blen ");" +.LP +.BI "ber_tag_t ber_first_element(BerElement *" ber ", ber_len_t *" len ", char **" cookie ");" +.LP +.BI "ber_tag_t ber_next_element(BerElement *" ber ", ber_len_t *" len ", const char *" cookie ");" +.SH DESCRIPTION +.LP +These routines provide a subroutine interface to a simplified +implementation of the Basic Encoding Rules of ASN.1. The version +of BER these routines support is the one defined for the LDAP +protocol. The encoding rules are the same as BER, except that +only definite form lengths are used, and bitstrings and octet strings +are always encoded in primitive form. This man page +describes the decoding routines in the lber library. See +.BR lber-encode (3) +for details on the corresponding encoding routines. +Consult +.BR lber-types (3) +for information about types, allocators, and deallocators. +.LP +Normally, the only routines that need to be called by an application +are +.BR ber_get_next () +to get the next BER element and +.BR ber_scanf () +to do the actual decoding. In some cases, +.BR ber_peek_tag () +may also need to be called in normal usage. The other routines are +provided for those applications that need more control than +.BR ber_scanf () +provides. In +general, these routines return the tag of the element decoded, or +LBER_ERROR if an error occurred. +.LP +The +.BR ber_get_next () +routine is used to read the next BER element from the given Sockbuf, +\fIsb\fP. It strips off and returns the leading tag, strips off and +returns the length of the entire element in \fIlen\fP, and sets up +\fIber\fP for subsequent calls to +.BR ber_scanf () +et al to decode the element. See +.BR lber-sockbuf (3) +for details of the Sockbuf implementation of the \fIsb\fP parameter. +.LP +The +.BR ber_scanf () +routine is used to decode a BER element in much the same way that +.BR scanf (3) +works. It reads from \fIber\fP, a pointer to a BerElement +such as returned by +.BR ber_get_next (), +interprets the bytes according to the format string \fIfmt\fP, and stores the +results in its additional arguments. The format string contains +conversion specifications which are used to direct the interpretation +of the BER element. The format string can contain the following +characters. +.RS +.LP +.TP 3 +.B a +Octet string. A char ** should be supplied. Memory is allocated, +filled with the contents of the octet string, null-terminated, and +returned in the parameter. The caller should free the returned +string using +.BR ber_memfree (). +.TP +.B A +Octet string. A variant of "\fBa\fP". A char ** should be supplied. +Memory is allocated, filled with the contents of the octet string, +null-terminated, and returned in the parameter, unless a zero-length +string would result; in that case, the arg is set to NULL. +The caller should free the returned string using +.BR ber_memfree (). +.TP +.B s +Octet string. A char * buffer should be supplied, followed by a pointer to a +ber_len_t initialized to the size of the buffer. Upon return, the +null-terminated octet string is put into the buffer, and the +ber_len_t is set to the actual size of the octet string. +.TP +.B O +Octet string. A struct ber_val ** should be supplied, which upon +return points to a dynamically allocated struct berval +containing the octet string and its length. +The caller should free the returned structure using +.BR ber_bvfree (). +.TP +.B o +Octet string. A struct ber_val * should be supplied, which upon +return contains the dynamically allocated +octet string and its length. The caller should free the returned octet +string using +.BR ber_memfree (). +.TP +.B m +Octet string. A struct ber_val * should be supplied, which upon return +contains the octet string and its length. The string resides in memory +assigned to the BerElement, and must not be freed by the caller. +.TP +.B b +Boolean. A pointer to a ber_int_t should be supplied. +.TP +.B e +Enumeration. A pointer to a ber_int_t should be supplied. +.TP +.B i +Integer. A pointer to a ber_int_t should be supplied. +.TP +.B B +Bitstring. A char ** should be supplied which will point to the +dynamically allocated +bits, followed by a ber_len_t *, which will point to the length +(in bits) of the bitstring returned. +.TP +.B n +Null. No parameter is required. The element is simply skipped if +it is recognized. +.TP +.B v +Sequence of octet strings. A char *** should be supplied, which upon +return points to a dynamically allocated null-terminated array of char *'s +containing the octet strings. NULL is returned if the sequence is empty. +The caller should free the returned array and octet strings using +.BR ber_memvfree (). +.TP +.B V +Sequence of octet strings with lengths. +A struct berval *** should be supplied, which upon +return points to a dynamically allocated null-terminated array of +struct berval *'s +containing the octet strings and their lengths. +NULL is returned if the sequence is empty. +The caller should free the returned structures using +.BR ber_bvecfree (). +.TP +.B W +Sequence of octet strings with lengths. +A BerVarray * should be supplied, which upon +return points to a dynamically allocated array of +struct berval's +containing the octet strings and their lengths. The array is terminated +by a struct berval with a NULL bv_val string pointer. +NULL is returned if the sequence is empty. +The caller should free the returned structures using +.BR ber_bvarray_free (). +.TP +.B M +Sequence of octet strings with lengths. This is a generalized form +of the previous three formats. +A void ** (ptr) should be supplied, followed by a ber_len_t * (len) +and a ber_len_t (off). +Upon return (ptr) will point to a dynamically allocated array +whose elements are all of size (*len). A struct berval will be filled +starting at offset (off) in each element. The strings in each struct +berval reside in memory assigned to the BerElement and must not be +freed by the caller. The array is terminated by a struct berval +with a NULL bv_val string pointer. NULL is returned if the sequence +is empty. The number of elements in the array is also stored +in (*len) on return. The caller should free the returned array using +.BR ber_memfree (). +.TP +.B l +Length of the next element. A pointer to a ber_len_t should be supplied. +.TP +.B t +Tag of the next element. A pointer to a ber_tag_t should be supplied. +.TP +.B T +Skip element and return its tag. A pointer to a ber_tag_t should be supplied. +.TP +.B x +Skip element. The next element is skipped. +.TP +.B { +Begin sequence. No parameter is required. The initial sequence tag +and length are skipped. +.TP +.B } +End sequence. No parameter is required and no action is taken. +.TP +.B [ +Begin set. No parameter is required. The initial set tag +and length are skipped. +.TP +.B ] +End set. No parameter is required and no action is taken. +.RE +.LP +The +.BR ber_get_int () +routine tries to interpret the next element as an integer, +returning the result in \fInum\fP. The tag of whatever it finds is returned +on success, LBER_ERROR (\-1) on failure. +.LP +The +.BR ber_get_stringb () +routine is used to read an octet string into a +preallocated buffer. The \fIlen\fP parameter should be initialized to +the size of the buffer, and will contain the length of the octet string +read upon return. The buffer should be big enough to take the octet +string value plus a terminating NULL byte. +.LP +The +.BR ber_get_stringa () +routine is used to dynamically allocate space into +which an octet string is read. +The caller should free the returned string using +.BR ber_memfree(). +.LP +The +.BR ber_get_stringal () +routine is used to dynamically allocate space +into which an octet string and its length are read. It takes a +struct berval **, and returns the result in this parameter. +The caller should free the returned structure using +.BR ber_bvfree(). +.LP +The +.BR ber_get_stringbv () +routine is used to read an octet string and its length into the +provided struct berval *. If the \fIalloc\fP parameter is zero, the string +will reside in memory assigned to the BerElement, and must not be freed +by the caller. If the \fIalloc\fP parameter is non-zero, the string will be +copied into dynamically allocated space which should be returned using +.BR ber_memfree (). +.LP +The +.BR ber_get_null () +routine is used to read a NULL element. It returns +the tag of the element it skips over. +.LP +The +.BR ber_get_boolean () +routine is used to read a boolean value. It is called the same way that +.BR ber_get_int () +is called. +.LP +The +.BR ber_get_enum () +routine is used to read a enumeration value. It is called the same way that +.BR ber_get_int () +is called. +.LP +The +.BR ber_get_bitstringa () +routine is used to read a bitstring value. It +takes a char ** which will hold the dynamically allocated bits, followed by an +ber_len_t *, which will point to the length (in bits) of the bitstring returned. +The caller should free the returned string using +.BR ber_memfree (). +.LP +The +.BR ber_first_element () +routine is used to return the tag and length +of the first element in a set or sequence. It also returns in \fIcookie\fP +a magic cookie parameter that should be passed to subsequent calls to +ber_next_element(), which returns similar information. +.SH EXAMPLES +Assume the variable \fIber\fP contains a lightweight BER encoding of +the following ASN.1 object: +.LP +.nf + AlmostASearchRequest := SEQUENCE { + baseObject DistinguishedName, + scope ENUMERATED { + baseObject (0), + singleLevel (1), + wholeSubtree (2) + }, + derefAliases ENUMERATED { + neverDerefaliases (0), + derefInSearching (1), + derefFindingBaseObj (2), + alwaysDerefAliases (3) + }, + sizelimit INTEGER (0 .. 65535), + timelimit INTEGER (0 .. 65535), + attrsOnly BOOLEAN, + attributes SEQUENCE OF AttributeType + } +.fi +.LP +The element can be decoded using +.BR ber_scanf () +as follows. +.LP +.nf + ber_int_t scope, deref, size, time, attrsonly; + char *dn, **attrs; + ber_tag_t tag; + + tag = ber_scanf( ber, "{aeeiib{v}}", + &dn, &scope, &deref, + &size, &time, &attrsonly, &attrs ); + + if( tag == LBER_ERROR ) { + /* error */ + } else { + /* success */ + } + + ber_memfree( dn ); + ber_memvfree( attrs ); +.fi +.SH ERRORS +If an error occurs during decoding, generally these routines return +LBER_ERROR ((ber_tag_t)\-1). +.LP +.SH NOTES +.LP +The return values for all of these functions are declared in the +.B <lber.h> +header file. Some routines may dynamically allocate memory +which must be freed by the caller using supplied deallocation routines. +.SH SEE ALSO +.BR lber-encode (3), +.BR lber-memory (3), +.BR lber-sockbuf (3), +.BR lber-types (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/lber-decode.3.links b/doc/man/man3/lber-decode.3.links new file mode 100644 index 0000000..3ec9328 --- /dev/null +++ b/doc/man/man3/lber-decode.3.links @@ -0,0 +1,13 @@ +ber_get_next.3 +ber_skip_tag.3 +ber_peek_tag.3 +ber_scanf.3 +ber_get_int.3 +ber_get_stringa.3 +ber_get_stringb.3 +ber_get_null.3 +ber_get_enum.3 +ber_get_boolean.3 +ber_get_bitstring.3 +ber_first_element.3 +ber_next_element.3 diff --git a/doc/man/man3/lber-encode.3 b/doc/man/man3/lber-encode.3 new file mode 100644 index 0000000..002fd66 --- /dev/null +++ b/doc/man/man3/lber-encode.3 @@ -0,0 +1,288 @@ +.TH LBER_ENCODE 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ber_alloc_t, ber_flush, ber_flush2, ber_printf, ber_put_int, ber_put_enum, ber_put_ostring, ber_put_string, ber_put_null, ber_put_boolean, ber_put_bitstring, ber_start_seq, ber_start_set, ber_put_seq, ber_put_set \- OpenLDAP LBER simplified Basic Encoding Rules library routines for encoding +.SH LIBRARY +OpenLDAP LBER (liblber, \-llber) +.SH SYNOPSIS +.B #include <lber.h> +.LP +.BI "BerElement *ber_alloc_t(int " options ");" +.LP +.BI "int ber_flush(Sockbuf *" sb ", BerElement *" ber ", int " freeit ");" +.LP +.BI "int ber_flush2(Sockbuf *" sb ", BerElement *" ber ", int " freeit ");" +.LP +.BI "int ber_printf(BerElement *" ber ", const char *" fmt ", ...);" +.LP +.BI "int ber_put_int(BerElement *" ber ", ber_int_t " num ", ber_tag_t " tag ");" +.LP +.BI "int ber_put_enum(BerElement *" ber ", ber_int_t " num ", ber_tag_t " tag ");" +.LP +.BI "int ber_put_ostring(BerElement *" ber ", const char *" str ", ber_len_t " len ", ber_tag_t " tag ");" +.LP +.BI "int ber_put_string(BerElement *" ber ", const char *" str ", ber_tag_t " tag ");" +.LP +.BI "int ber_put_null(BerElement *" ber ", ber_tag_t " tag ");" +.LP +.BI "int ber_put_boolean(BerElement *" ber ", ber_int_t " bool ", ber_tag_t " tag ");" +.LP +.BI "int ber_put_bitstring(BerElement *" ber ", const char *" str ", ber_len_t " blen ", ber_tag_t " tag ");" +.LP +.BI "int ber_start_seq(BerElement *" ber ", ber_tag_t " tag ");" +.LP +.BI "int ber_start_set(BerElement *" ber ", ber_tag_t " tag ");" +.LP +.BI "int ber_put_seq(BerElement *" ber ");" +.LP +.BI "int ber_put_set(BerElement *" ber ");" +.SH DESCRIPTION +.LP +These routines provide a subroutine interface to a simplified +implementation of the Basic Encoding Rules of ASN.1. The version +of BER these routines support is the one defined for the LDAP +protocol. The encoding rules are the same as BER, except that +only definite form lengths are used, and bitstrings and octet strings +are always encoded in primitive form. This +man page describes the encoding routines in the lber library. See +.BR lber-decode (3) +for details on the corresponding decoding routines. Consult +.BR lber-types (3) +for information about types, allocators, and deallocators. +.LP +Normally, the only routines that need to be called by an application +are +.BR ber_alloc_t () +to allocate a BER element for encoding, +.BR ber_printf () +to do the actual encoding, and +.BR ber_flush2 () +to actually write the element. The other routines are provided for those +applications that need more control than +.BR ber_printf () +provides. In +general, these routines return the length of the element encoded, or +\-1 if an error occurred. +.LP +The +.BR ber_alloc_t () +routine is used to allocate a new BER element. It +should be called with an argument of LBER_USE_DER. +.LP +The +.BR ber_flush2 () +routine is used to actually write the element to a socket +(or file) descriptor, once it has been fully encoded (using +.BR ber_printf () +and friends). See +.BR lber-sockbuf (3) +for more details on the Sockbuf implementation of the \fIsb\fP parameter. +If the \fIfreeit\fP parameter is non-zero, the supplied \fIber\fP will +be freed. +If \fILBER_FLUSH_FREE_ON_SUCCESS\fP is used, the \fIber\fP is only freed +when successfully flushed, otherwise it is left intact; +if \fILBER_FLUSH_FREE_ON_ERROR\fP is used, the \fIber\fP is only freed +when an error occurs, otherwise it is left intact; +if \fILBER_FLUSH_FREE_ALWAYS\fP is used, the \fIber\fP is freed anyway. +This function differs from the original +.BR ber_flush (3) +function, whose behavior corresponds to that indicated +for \fILBER_FLUSH_FREE_ON_SUCCESS\fP. +Note that in the future, the behavior of +.BR ber_flush (3) +with \fIfreeit\fP non-zero might change into that of +.BR ber_flush2 (3) +with \fIfreeit\fP set to \fILBER_FLUSH_FREE_ALWAYS\fP. +.LP +The +.BR ber_printf () +routine is used to encode a BER element in much the same way that +.BR sprintf (3) +works. One important difference, though, is +that some state information is kept with the \fIber\fP parameter so +that multiple calls can be made to +.BR ber_printf () +to append things to the end of the BER element. +.BR Ber_printf () +writes to \fIber\fP, a pointer to a BerElement such as returned by +.BR ber_alloc_t (). +It interprets and +formats its arguments according to the format string \fIfmt\fP. +The format string can contain the following characters: +.RS +.LP +.TP 3 +.B b +Boolean. An ber_int_t parameter should be supplied. A boolean element +is output. +.TP +.B e +Enumeration. An ber_int_t parameter should be supplied. An +enumeration element is output. +.TP +.B i +Integer. An ber_int_t parameter should be supplied. An integer element +is output. +.TP +.B B +Bitstring. A char * pointer to the start of the bitstring is supplied, +followed by the number of bits in the bitstring. A bitstring element +is output. +.TP +.B n +Null. No parameter is required. A null element is output. +.TP +.B o +Octet string. A char * is supplied, followed by the length of the +string pointed to. An octet string element is output. +.TP +.B O +Octet string. A struct berval * is supplied. +An octet string element is output. +.TP +.B s +Octet string. A null-terminated string is supplied. An octet string +element is output, not including the trailing NULL octet. +.TP +.B t +Tag. A ber_tag_t specifying the tag to give the next element +is provided. This works across calls. +.TP +.B v +Several octet strings. A null-terminated array of char *'s is +supplied. Note that a construct like '{v}' is required to get +an actual SEQUENCE OF octet strings. +.TP +.B V +Several octet strings. A null-terminated array of struct berval *'s +is supplied. Note that a construct like '{V}' is required to get +an actual SEQUENCE OF octet strings. +.TP +.B W +Several octet strings. An array of struct berval's is supplied. The +array is terminated by a struct berval with a NULL bv_val. +Note that a construct like '{W}' is required to get +an actual SEQUENCE OF octet strings. +.TP +.B { +Begin sequence. No parameter is required. +.TP +.B } +End sequence. No parameter is required. +.TP +.B [ +Begin set. No parameter is required. +.TP +.B ] +End set. No parameter is required. +.RE +.LP +The +.BR ber_put_int () +routine writes the integer element \fInum\fP to the BER element \fIber\fP. +.LP +The +.BR ber_put_enum () +routine writes the enumeration element \fInum\fP to the BER element \fIber\fP. +.LP +The +.BR ber_put_boolean () +routine writes the boolean value given by \fIbool\fP to the BER element. +.LP +The +.BR ber_put_bitstring () +routine writes \fIblen\fP bits starting +at \fIstr\fP as a bitstring value to the given BER element. Note +that \fIblen\fP is the length \fIin bits\fP of the bitstring. +.LP +The +.BR ber_put_ostring () +routine writes \fIlen\fP bytes starting at +\fIstr\fP to the BER element as an octet string. +.LP +The +.BR ber_put_string () +routine writes the null-terminated string (minus +the terminating '\0') to the BER element as an octet string. +.LP +The +.BR ber_put_null () +routine writes a NULL element to the BER element. +.LP +The +.BR ber_start_seq () +routine is used to start a sequence in the BER element. The +.BR ber_start_set () +routine works similarly. +The end of the sequence or set is marked by the nearest matching call to +.BR ber_put_seq () +or +.BR ber_put_set (), +respectively. +.SH EXAMPLES +Assuming the following variable declarations, and that the variables +have been assigned appropriately, an lber encoding of +the following ASN.1 object: +.LP +.nf + AlmostASearchRequest := SEQUENCE { + baseObject DistinguishedName, + scope ENUMERATED { + baseObject (0), + singleLevel (1), + wholeSubtree (2) + }, + derefAliases ENUMERATED { + neverDerefaliases (0), + derefInSearching (1), + derefFindingBaseObj (2), + alwaysDerefAliases (3) + }, + sizelimit INTEGER (0 .. 65535), + timelimit INTEGER (0 .. 65535), + attrsOnly BOOLEAN, + attributes SEQUENCE OF AttributeType + } +.fi +.LP +can be achieved like so: +.LP +.nf + int rc; + ber_int_t scope, ali, size, time, attrsonly; + char *dn, **attrs; + BerElement *ber; + + /* ... fill in values ... */ + + ber = ber_alloc_t( LBER_USE_DER ); + + if ( ber == NULL ) { + /* error */ + } + + rc = ber_printf( ber, "{siiiib{v}}", dn, scope, ali, + size, time, attrsonly, attrs ); + + if( rc == \-1 ) { + /* error */ + } else { + /* success */ + } +.fi +.SH ERRORS +If an error occurs during encoding, generally these routines return \-1. +.LP +.SH NOTES +.LP +The return values for all of these functions are declared in the +<lber.h> header file. +.SH SEE ALSO +.BR lber-decode (3), +.BR lber-memory (3), +.BR lber-sockbuf (3), +.BR lber-types (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/lber-encode.3.links b/doc/man/man3/lber-encode.3.links new file mode 100644 index 0000000..54cd0e9 --- /dev/null +++ b/doc/man/man3/lber-encode.3.links @@ -0,0 +1,11 @@ +ber_alloc_t.3 +ber_flush.3 +ber_printf.3 +ber_put_int.3 +ber_put_ostring.3 +ber_put_string.3 +ber_put_null.3 +ber_put_enum.3 +ber_start_set.3 +ber_put_seq.3 +ber_put_set.3 diff --git a/doc/man/man3/lber-memory.3 b/doc/man/man3/lber-memory.3 new file mode 100644 index 0000000..2766aee --- /dev/null +++ b/doc/man/man3/lber-memory.3 @@ -0,0 +1,49 @@ +.TH LBER_MEMORY 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ber_memalloc, ber_memcalloc, ber_memrealloc, ber_memfree, ber_memvfree \- OpenLDAP LBER memory allocators +.SH LIBRARY +OpenLDAP LBER (liblber, \-llber) +.SH SYNOPSIS +.B #include <lber.h> +.LP +.BI "void *ber_memalloc(ber_len_t " bytes ");" +.LP +.BI "void *ber_memcalloc(ber_len_t " nelems ", ber_len_t " bytes ");" +.LP +.BI "void *ber_memrealloc(void *" ptr ", ber_len_t " bytes ");" +.LP +.BI "void ber_memfree(void *" ptr ");" +.LP +.BI "void ber_memvfree(void **" vec ");" +.SH DESCRIPTION +.LP +These routines are used to allocate/deallocate memory used/returned +by the Lightweight BER library as required by +.BR lber-encode (3) +and +.BR lber-decode (3). +.BR ber_memalloc (), +.BR ber_memcalloc (), +.BR ber_memrealloc (), +and +.BR ber_memfree () +are used exactly like the standard +.BR malloc (3), +.BR calloc (3), +.BR realloc (3), +and +.BR free (3) +routines, respectively. The +.BR ber_memvfree () +routine is used to free a dynamically allocated array of pointers to +arbitrary dynamically allocated objects. +.SH SEE ALSO +.BR lber-decode (3), +.BR lber-encode (3), +.BR lber-types (3) +.LP +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/lber-sockbuf.3 b/doc/man/man3/lber-sockbuf.3 new file mode 100644 index 0000000..9b03fdf --- /dev/null +++ b/doc/man/man3/lber-sockbuf.3 @@ -0,0 +1,199 @@ +.TH LBER_SOCKBUF 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ber_sockbuf_alloc, ber_sockbuf_free, ber_sockbuf_ctrl, ber_sockbuf_add_io, ber_sockbuf_remove_io, Sockbuf_IO \- OpenLDAP LBER I/O infrastructure +.SH LIBRARY +OpenLDAP LBER (liblber, \-llber) +.SH SYNOPSIS +.B #include <lber.h> +.LP +.B Sockbuf *ber_sockbuf_alloc( void ); +.LP +.BI "void ber_sockbuf_free(Sockbuf *" sb ");" +.LP +.BI "int ber_sockbuf_ctrl(Sockbuf *" sb ", int " opt ", void *" arg ");" +.LP +.BI "int ber_sockbuf_add_io(Sockbuf *" sb ", Sockbuf_IO *" sbio ", int " layer ", void *" arg ");" +.LP +.BI "int ber_sockbuf_remove_io(Sockbuf *" sb ", Sockbuf_IO *" sbio ", int " layer ");" +.LP +.nf +.B typedef struct sockbuf_io_desc { +.BI "int " sbiod_level ";" +.BI "Sockbuf *" sbiod_sb ";" +.BI "Sockbuf_IO *" sbiod_io ";" +.BI "void *" sbiod_pvt ";" +.BI "struct sockbuf_io_desc *" sbiod_next ";" +.B } Sockbuf_IO_Desc; +.LP +.B typedef struct sockbuf_io { +.BI "int (*" sbi_setup ")(Sockbuf_IO_Desc *" sbiod ", void *" arg ");" +.BI "int (*" sbi_remove ")(Sockbuf_IO_Desc *" sbiod ");" +.BI "int (*" sbi_ctrl ")(Sockbuf_IO_Desc *" sbiod ", int " opt ", void *" arg ");" +.BI "ber_slen_t (*" sbi_read ")(Sockbuf_IO_Desc *" sbiod ", void *" buf ", ber_len_t " len ");" +.BI "ber_slen_t (*" sbi_write ")(Sockbuf_IO_Desc *" sbiod ", void *" buf ", ber_len_t " len ");" +.BI "int (*" sbi_close ")(Sockbuf_IO_Desc *" sbiod ");" +.B } Sockbuf_IO; + +.SH DESCRIPTION +.LP +These routines are used to manage the low level I/O operations performed +by the Lightweight BER library. They are called implicitly by the other +libraries and usually do not need to be called directly from applications. +The I/O framework is modularized and new transport layers can be supported +by appropriately defining a +.B Sockbuf_IO +structure and installing it onto an existing +.BR Sockbuf . +.B Sockbuf +structures are allocated and freed by +.BR ber_sockbuf_alloc () +and +.BR ber_sockbuf_free (), +respectively. The +.BR ber_sockbuf_ctrl () +function is used to get and set options related to a +.B Sockbuf +or to a specific I/O layer of the +.BR Sockbuf . +The +.BR ber_sockbuf_add_io () +and +.BR ber_sockbuf_remove_io () +functions are used to add and remove specific I/O layers on a +.BR Sockbuf . + +Options for +.BR ber_sockbuf_ctrl () +include: +.TP +.B LBER_SB_OPT_HAS_IO +Takes a +.B Sockbuf_IO * +argument and returns 1 if the given handler is installed +on the +.BR Sockbuf , +otherwise returns 0. +.TP +.B LBER_SB_OPT_GET_FD +Retrieves the file descriptor associated to the +.BR Sockbuf ; +.B arg +must be a +.BR "ber_socket_t *" . +The return value will be 1 if a valid descriptor was present, \-1 otherwise. +.TP +.B LBER_SB_OPT_SET_FD +Sets the file descriptor of the +.B Sockbuf +to the descriptor pointed to by +.BR arg ; +.B arg +must be a +.BR "ber_socket_t *" . +The return value will always be 1. +.TP +.B LBER_SB_OPT_SET_NONBLOCK +Toggles the non-blocking state of the file descriptor associated to +the +.BR Sockbuf . +.B arg +should be NULL to disable and non-NULL to enable the non-blocking state. +The return value will be 1 for success, \-1 otherwise. +.TP +.B LBER_SB_OPT_DRAIN +Flush (read and discard) all available input on the +.BR Sockbuf . +The return value will be 1. +.TP +.B LBER_SB_OPT_NEEDS_READ +Returns non-zero if input is waiting to be read. +.TP +.B LBER_SB_OPT_NEEDS_WRITE +Returns non-zero if the +.B Sockbuf +is ready to be written. +.TP +.B LBER_SB_OPT_GET_MAX_INCOMING +Returns the maximum allowed size of an incoming message; +.B arg +must be a +.BR "ber_len_t *" . +The return value will be 1. +.TP +.B LBER_SB_OPT_SET_MAX_INCOMING +Sets the maximum allowed size of an incoming message; +.B arg +must be a +.BR "ber_len_t *" . +The return value will be 1. + +.LP +Options not in this list will be passed down to each +.B Sockbuf_IO +handler in turn until one of them processes it. If the option is not handled +.BR ber_sockbuf_ctrl () +will return 0. + +.LP +Multiple +.B Sockbuf_IO +handlers can be stacked in multiple layers to provide various functionality. +Currently defined layers include +.TP +.B LBER_SBIOD_LEVEL_PROVIDER +the lowest layer, talking directly to a network +.TP +.B LBER_SBIOD_LEVEL_TRANSPORT +an intermediate layer +.TP +.B LBER_SBIOD_LEVEL_APPLICATION +a higher layer +.LP +Currently defined +.B Sockbuf_IO +handlers in liblber include +.TP +.B ber_sockbuf_io_tcp +The default stream-oriented provider +.TP +.B ber_sockbuf_io_fd +A stream-oriented provider for local IPC sockets +.TP +.B ber_sockbuf_io_dgram +A datagram-oriented provider. This handler is only present if the liblber +library was built with LDAP_CONNECTIONLESS defined. +.TP +.B ber_sockbuf_io_readahead +A buffering layer, usually used with a datagram provider to hide the +datagram semantics from upper layers. +.TP +.B ber_sockbuf_io_debug +A generic handler that outputs hex dumps of all traffic. This handler +may be inserted multiple times at arbitrary layers to show the flow +of data between other handlers. +.LP +Additional handlers may be present in libldap if support for them was +enabled: +.TP +.B ldap_pvt_sockbuf_io_sasl +An application layer handler for SASL encoding/decoding. +.TP +.B sb_tls_sbio +A transport layer handler for SSL/TLS encoding/decoding. Note that this +handler is private to the library and is not exposed in the API. +.LP +The provided handlers are all instantiated implicitly by libldap, and +applications generally will not need to directly manipulate them. + +.SH SEE ALSO +.BR lber-decode (3), +.BR lber-encode (3), +.BR lber-types (3), +.BR ldap_get_option (3) + +.LP +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/lber-types.3 b/doc/man/man3/lber-types.3 new file mode 100644 index 0000000..e39b2c8 --- /dev/null +++ b/doc/man/man3/lber-types.3 @@ -0,0 +1,188 @@ +.TH LBER_TYPES 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ber_int_t, ber_uint_t, ber_len_t, ber_slen_t, ber_tag_t, struct berval, BerValue, BerVarray, BerElement, ber_bvfree, ber_bvecfree, ber_bvecadd, ber_bvarray_free, ber_bvarray_add, ber_bvdup, ber_dupbv, ber_bvstr, ber_bvstrdup, ber_str2bv, ber_alloc_t, ber_init, ber_init2, ber_free \- OpenLDAP LBER types and allocation functions +.SH LIBRARY +OpenLDAP LBER (liblber, \-llber) +.SH SYNOPSIS +.B #include <lber.h> +.LP +.nf +.ft B +typedef impl_tag_t ber_tag_t; +typedef impl_int_t ber_int_t; +typedef impl_uint_t ber_uint_t; +typedef impl_len_t ber_len_t; +typedef impl_slen_t ber_slen_t; + +typedef struct berval { + ber_len_t bv_len; + char *bv_val; +} BerValue, *BerVarray; + +typedef struct berelement BerElement; +.ft +.fi +.LP +.BI "void ber_bvfree(struct berval *" bv ");" +.LP +.BI "void ber_bvecfree(struct berval **" bvec ");" +.LP +.BI "void ber_bvecadd(struct berval ***" bvec ", struct berval *" bv ");" +.LP +.BI "void ber_bvarray_free(struct berval *" bvarray ");" +.LP +.BI "void ber_bvarray_add(BerVarray *" bvarray ", BerValue *" bv ");" +.LP +.BI "struct berval *ber_bvdup(const struct berval *" bv ");" +.LP +.BI "struct berval *ber_dupbv(const struct berval *" dst ", struct berval *" src ");" +.LP +.BI "struct berval *ber_bvstr(const char *" str ");" +.LP +.BI "struct berval *ber_bvstrdup(const char *" str ");" +.LP +.BI "struct berval *ber_str2bv(const char *" str ", ber_len_t " len ", int " dup ", struct berval *" bv ");" +.LP +.BI "BerElement *ber_alloc_t(int " options ");" +.LP +.BI "BerElement *ber_init(struct berval *" bv ");" +.LP +.BI "void ber_init2(BerElement *" ber ", struct berval *" bv ", int " options ");" +.LP +.BI "void ber_free(BerElement *" ber ", int " freebuf ");" +.SH DESCRIPTION +.LP +The following are the basic types and structures defined for use +with the Lightweight BER library. +.LP +.B ber_int_t +is a signed integer of at least 32 bits. It is commonly equivalent to +.BR int . +.B ber_uint_t +is the unsigned variant of +.BR ber_int_t . +.LP +.B ber_len_t +is an unsigned integer of at least 32 bits used to represent a length. +It is commonly equivalent to a +.BR size_t . +.B ber_slen_t +is the signed variant to +.BR ber_len_t . +.LP +.B ber_tag_t +is an unsigned integer of at least 32 bits used to represent a +BER tag. It is commonly equivalent to a +.BR unsigned\ long . +.LP +The actual definitions of the integral impl_TYPE_t types are platform +specific. +.LP +.BR BerValue , +commonly used as +.BR struct\ berval , +is used to hold an arbitrary sequence of octets. +.B bv_val +points to +.B bv_len +octets. +.B bv_val +is not necessarily terminated by a NULL (zero) octet. +.BR ber_bvfree () +frees a BerValue, pointed to by \fIbv\fP, returned from this API. If \fIbv\fP +is NULL, the routine does nothing. +.LP +.BR ber_bvecfree () +frees an array of BerValues (and the array), pointed to by \fIbvec\fP, +returned from this API. If \fIbvec\fP is NULL, the routine does nothing. +.BR ber_bvecadd () +appends the \fIbv\fP pointer to the \fIbvec\fP array. Space for the array +is allocated as needed. The end of the array is marked by a NULL pointer. +.LP +.BR ber_bvarray_free () +frees an array of BerValues (and the array), pointed to by \fIbvarray\fP, +returned from this API. If \fIbvarray\fP is NULL, the routine does nothing. +.BR ber_bvarray_add () +appends the contents of the BerValue pointed to by \fIbv\fP to the +\fIbvarray\fP array. Space for the new element is allocated as needed. +The end of the array is marked by a BerValue with a NULL bv_val field. +.LP +.BR ber_bvdup () +returns a copy of a BerValue. The routine returns NULL upon error +(e.g. out of memory). The caller should use +.BR ber_bvfree () +to deallocate the resulting BerValue. +.BR ber_dupbv () +copies a BerValue from \fIsrc\fP to \fIdst\fP. If \fIdst\fP is NULL a +new BerValue will be allocated to hold the copy. The routine returns NULL +upon error, otherwise it returns a pointer to the copy. If \fIdst\fP is +NULL the caller should use +.BR ber_bvfree () +to deallocate the resulting BerValue, otherwise +.BR ber_memfree () +should be used to deallocate the \fIdst->bv_val\fP. (The +.BR ber_bvdup () +function is internally implemented as ber_dupbv(NULL, bv). +.BR ber_bvdup () +is provided only for compatibility with an expired draft of the LDAP C API; +.BR ber_dupbv () +is the preferred interface.) +.LP +.BR ber_bvstr () +returns a BerValue containing the string pointed to by \fIstr\fP. +.BR ber_bvstrdup () +returns a BerValue containing a copy of the string pointed to by \fIstr\fP. +.BR ber_str2bv () +returns a BerValue containing the string pointed to by \fIstr\fP, whose +length may be optionally specified in \fIlen\fP. If \fIdup\fP is non-zero, +the BerValue will contain a copy of \fIstr\fP. If \fIlen\fP is zero, the +number of bytes to copy will be determined by +.BR strlen (3), +otherwise \fIlen\fP bytes will be copied. If \fIbv\fP is non-NULL, the result +will be stored in the given BerValue, otherwise a new BerValue will be +allocated to store the result. NOTE: Both +.BR ber_bvstr () +and +.BR ber_bvstrdup () +are implemented as macros using +.BR ber_str2bv () +in this version of the library. +.LP +.B BerElement +is an opaque structure used to maintain state information used in +encoding and decoding. +.BR ber_alloc_t () +is used to create an empty BerElement structure. If +.B LBER_USE_DER +is specified for the +.I options +parameter then data lengths for data written to the BerElement will be +encoded in the minimal number of octets required, otherwise they will +always be written as four byte values. +.BR ber_init () +creates a BerElement structure that is initialized with a copy of the +data in its +.I bv +parameter. +.BR ber_init2 () +initializes an existing BerElement +.I ber +using the data in the +.I bv +parameter. The data is referenced directly, not copied. The +.I options +parameter is the same as for +.BR ber_alloc_t (). +.BR ber_free () +frees a BerElement pointed to by \fIber\fP. If \fIber\fP is NULL, the routine +does nothing. If \fIfreebuf\fP is zero, the internal buffer is not freed. +.SH SEE ALSO +.BR lber-encode (3), +.BR lber-decode (3), +.BR lber-memory (3) +.LP +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/lber-types.3.links b/doc/man/man3/lber-types.3.links new file mode 100644 index 0000000..89f90fb --- /dev/null +++ b/doc/man/man3/lber-types.3.links @@ -0,0 +1,11 @@ +ber_bvarray_add.3 +ber_bvarray_free.3 +ber_bvdup.3 +ber_bvecadd.3 +ber_bvecfree.3 +ber_bvfree.3 +ber_bvstr.3 +ber_bvstrdup.3 +ber_dupbv.3 +ber_free.3 +ber_str2bv.3 diff --git a/doc/man/man3/ldap.3 b/doc/man/man3/ldap.3 new file mode 100644 index 0000000..9ede63e --- /dev/null +++ b/doc/man/man3/ldap.3 @@ -0,0 +1,278 @@ +.TH LDAP 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap \- OpenLDAP Lightweight Directory Access Protocol API +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.ft +.fi +.SH DESCRIPTION +.LP +The Lightweight Directory Access Protocol (LDAP) (RFC 4510) provides +access to X.500 directory services. These services may be stand\-alone +or part of a distributed directory service. This client API supports +LDAP over TCP (RFC 4511), LDAP over TLS/SSL, and LDAP over IPC (UNIX +domain sockets). This API supports SASL (RFC 4513) and Start TLS +(RFC 4513) as well as a number of protocol extensions. This API is +loosely based upon IETF/LDAPEXT C LDAP API draft specification, a (orphaned) +work in progress. +.LP +The OpenLDAP Software package includes a stand\-alone server in +.BR slapd (8), +various LDAP clients, and an LDAP client library used to provide +programmatic access to the LDAP protocol. This man page gives an +overview of the LDAP library routines. +.LP +Both synchronous and asynchronous APIs are provided. Also included are +various routines to parse the results returned from these routines. +These routines are found in the \-lldap library. +.LP +The basic interaction is as follows. A session handle is +created using +.BR ldap_initialize (3) +and set the protocol version to 3 by calling +.BR ldap_set_option (3). +The underlying session is established first operation is +issued. This would generally be a Start TLS or Bind operation, +or a Search operation to read attributes of the Root DSE. +A Start TLS operation is performed by calling +.BR ldap_start_tls_s (3). +A LDAP bind operation is performed by calling +.BR ldap_sasl_bind (3) +or one of its friends. +A Search operation is performed by calling ldap_search_ext_s(3) +or one of its friends. + +Subsequently, additional operations are performed +by calling one of the synchronous or asynchronous routines (e.g., +.BR ldap_compare_ext_s (3) +or +.BR ldap_compare_ext (3) +followed by +.BR ldap_result (3)). +Results returned from these routines are interpreted by calling the +LDAP parsing routines such as +.BR ldap_parse_result (3). +The LDAP association and underlying connection is terminated by calling +.BR ldap_unbind_ext (3). +Errors can be interpreted by calling +.BR ldap_err2string (3). +.SH LDAP versions +This library supports version 3 of the Lightweight Directory Access +Protocol (LDAPv3) as defined in RFC 4510. It also supports a variant +of version 2 of LDAP as defined by U-Mich LDAP and, to some degree, +RFC 1777. Version 2 (all variants) are considered obsolete. +Version 3 should be used instead. +.LP +For backwards compatibility reasons, the library defaults to version 2. +Hence, all new applications (and all actively maintained applications) +should use +.BR ldap_set_option (3) +to select version 3. The library manual pages assume version 3 +has been selected. +.SH INPUT and OUTPUT PARAMETERS +All character string input/output is expected to be/is UTF-8 +encoded Unicode (version 3.2). +.LP +Distinguished names (DN) (and relative distinguished names (RDN) to +be passed to the LDAP routines should conform to RFC 4514 UTF-8 +string representation. +.LP +Search filters to be passed to the search routines are to be +constructed by hand and should conform to RFC 4515 UTF-8 +string representation. +.LP +LDAP URLs to be passed to routines are expected to conform +to RFC 4516 format. The +.BR ldap_url (3) +routines can be used to work with LDAP URLs. +.LP +LDAP controls to be passed to routines can be manipulated using the +.BR ldap_controls (3) +routines. +.SH DISPLAYING RESULTS +Results obtained from the search routines can be output by hand, +by calling +.BR ldap_first_entry (3) +and +.BR ldap_next_entry (3) +to step through +the entries returned, +.BR ldap_first_attribute (3) +and +.BR ldap_next_attribute (3) +to step through an entry's attributes, and +.BR ldap_get_values (3) +to retrieve a given attribute's values. Attribute values +may or may not be displayable. +.SH UTILITY ROUTINES +Also provided are various utility routines. The +.BR ldap_sort (3) +routines are used to sort the entries and values returned via +the ldap search routines. +.SH DEPRECATED INTERFACES +A number of interfaces are now considered deprecated. For instance, +ldap_add(3) is deprecated in favor of ldap_add_ext(3). +.so Deprecated +.SH BER LIBRARY +Also included in the distribution is a set of lightweight Basic +Encoding Rules routines. These routines are used by the LDAP library +routines to encode and decode LDAP protocol elements using the +(slightly simplified) Basic Encoding Rules defined by LDAP. They are +not normally used directly by an LDAP application program except +in the handling of controls and extended operations. The +routines provide a printf and scanf\-like interface, as well as +lower\-level access. These routines are discussed in +.BR lber\-decode (3), +.BR lber\-encode (3), +.BR lber\-memory (3), +and +.BR lber\-types (3). +.SH INDEX +.TP 20 +.SM ldap_initialize(3) +initialize the LDAP library without opening a connection to a server +.TP +.SM ldap_result(3) +wait for the result from an asynchronous operation +.TP +.SM ldap_abandon_ext(3) +abandon (abort) an asynchronous operation +.TP +.SM ldap_add_ext(3) +asynchronously add an entry +.TP +.SM ldap_add_ext_s(3) +synchronously add an entry +.TP +.SM ldap_sasl_bind(3) +asynchronously bind to the directory +.TP +.SM ldap_sasl_bind_s(3) +synchronously bind to the directory +.TP +.SM ldap_unbind_ext(3) +synchronously unbind from the LDAP server and close the connection +.TP +.SM ldap_unbind(3) and ldap_unbind_s(3) are +equivalent to +.BR ldap_unbind_ext (3) +.TP +.SM ldap_memfree(3) +dispose of memory allocated by LDAP routines. +.TP +.SM ldap_compare_ext(3) +asynchronously compare to a directory entry +.TP +.SM ldap_compare_ext_s(3) +synchronously compare to a directory entry +.TP +.SM ldap_delete_ext(3) +asynchronously delete an entry +.TP +.SM ldap_delete_ext_s(3) +synchronously delete an entry +.TP +.SM ld_errno(3) +LDAP error indication +.TP +.SM ldap_errlist(3) +list of LDAP errors and their meanings +.TP +.SM ldap_err2string(3) +convert LDAP error indication to a string +.TP +.SM ldap_extended_operation(3) +asynchronously perform an arbitrary extended operation +.TP +.SM ldap_extended_operation_s(3) +synchronously perform an arbitrary extended operation +.TP +.SM ldap_first_attribute(3) +return first attribute name in an entry +.TP +.SM ldap_next_attribute(3) +return next attribute name in an entry +.TP +.SM ldap_first_entry(3) +return first entry in a chain of search results +.TP +.SM ldap_next_entry(3) +return next entry in a chain of search results +.TP +.SM ldap_count_entries(3) +return number of entries in a search result +.TP +.SM ldap_get_dn(3) +extract the DN from an entry +.TP +.SM ldap_get_values_len(3) +return an attribute's values with lengths +.TP +.SM ldap_value_free_len(3) +free memory allocated by ldap_get_values_len(3) +.TP +.SM ldap_count_values_len(3) +return number of values +.TP +.SM ldap_modify_ext(3) +asynchronously modify an entry +.TP +.SM ldap_modify_ext_s(3) +synchronously modify an entry +.TP +.SM ldap_mods_free(3) +free array of pointers to mod structures used by ldap_modify_ext(3) +.TP +.SM ldap_rename(3) +asynchronously rename an entry +.TP +.SM ldap_rename_s(3) +synchronously rename an entry +.TP +.SM ldap_msgfree(3) +free results allocated by ldap_result(3) +.TP +.SM ldap_msgtype(3) +return the message type of a message from ldap_result(3) +.TP +.SM ldap_msgid(3) +return the message id of a message from ldap_result(3) +.TP +.SM ldap_search_ext(3) +asynchronously search the directory +.TP +.SM ldap_search_ext_s(3) +synchronously search the directory +.TP +.SM ldap_is_ldap_url(3) +check a URL string to see if it is an LDAP URL +.TP +.SM ldap_url_parse(3) +break up an LDAP URL string into its components +.TP +.SM ldap_sort_entries(3) +sort a list of search results +.TP +.SM ldap_sort_values(3) +sort a list of attribute values +.TP +.SM ldap_sort_strcasecmp(3) +case insensitive string comparison +.SH SEE ALSO +.BR ldap.conf (5), +.BR slapd (8), +.BR draft-ietf-ldapext-ldap-c-api-xx.txt \ <http://www.ietf.org> +.SH ACKNOWLEDGEMENTS +.so ../Project +.LP +These API manual pages are loosely based upon descriptions provided +in the IETF/LDAPEXT C LDAP API Internet Draft, a (orphaned) work +in progress. + diff --git a/doc/man/man3/ldap_abandon.3 b/doc/man/man3/ldap_abandon.3 new file mode 100644 index 0000000..af6d36e --- /dev/null +++ b/doc/man/man3/ldap_abandon.3 @@ -0,0 +1,69 @@ +.TH LDAP_ABANDON 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_abandon_ext \- Abandon an LDAP operation in progress +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.B +#include <ldap.h> +.LP +.ft B +int ldap_abandon_ext( +.RS +.ft B +LDAP *\fIld\fB, +Bint \fImsgid\fB, +LDAPControl **\fIsctrls\fB, +LDAPControl **\fIcctrls\fB ); +.RE +.fi +.SH DESCRIPTION +The +.B ldap_abandon_ext() +routine is used to send a LDAP Abandon request for an +operation in progress. The \fImsgid\fP passed should be the +message id of an outstanding LDAP operation, such as returned by +.BR ldap_search_ext (3). +.LP +.BR ldap_abandon_ext () +checks to see if the result of the operation has already come in. If it +has, it deletes it from the queue of pending messages. If not, +it sends an LDAP abandon request to the LDAP server. +.LP +The caller can expect that the result of an abandoned operation +will not be returned from a future call to +.BR ldap_result (3). +.LP +.B ldap_abandon_ext() +allows server and client controls to be passed in via the +.I sctrls +and +.I cctrls +parameters, respectively. +.LP +.B ldap_abandon_ext() +returns a code indicating success or, in the case of failure, the +nature of the failure. See +.BR ldap_error (3) +for details. +.SH DEPRECATED INTERFACES +The +.B ldap_abandon() +routine is deprecated in favor of the +.B ldap_abandon_ext() +routine. +.LP +.so Deprecated + +.SH SEE ALSO +.BR ldap (3), +.BR ldap_error (3), +.BR ldap_result (3), +.BR ldap_search_ext (3) +.SH ACKNOWLEDGEMENTS +.so ../Project + diff --git a/doc/man/man3/ldap_abandon.3.links b/doc/man/man3/ldap_abandon.3.links new file mode 100644 index 0000000..3b7bc3f --- /dev/null +++ b/doc/man/man3/ldap_abandon.3.links @@ -0,0 +1 @@ +ldap_abandon_ext.3 diff --git a/doc/man/man3/ldap_add.3 b/doc/man/man3/ldap_add.3 new file mode 100644 index 0000000..ff26577 --- /dev/null +++ b/doc/man/man3/ldap_add.3 @@ -0,0 +1,81 @@ +.TH LDAP_ADD 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_add_ext, ldap_add_ext_s \- Perform an LDAP add operation +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.ft B +#include <ldap.h> +.LP +.ft B +.nf +int ldap_add_ext( +.RS +.ft B +LDAP *\fIld, +const char *\fIdn\fB, +LDAPMod **\fIattrs\fB, +LDAPControl **\fIsctrls\fB, +LDAPControl **\fIcctrls\fB, +int *\fImsgidp\fB ); +.RE +.LP +.ft B +.nf +int ldap_add_ext_s( +.RS +LDAP *\fIld\fB, +const char *\fIdn\fB, +LDAPMod **\fIattrs\fB, +LDAPControl *\fIsctrls\fB, +LDAPControl *\fIcctrls\fB ); +.RE +.fi +.SH DESCRIPTION +The +.B ldap_add_ext_s() +routine is used to perform an LDAP add operation. +It takes \fIdn\fP, the DN of the entry to add, and \fIattrs\fP, a +null-terminated array of the entry's attributes. The LDAPMod structure +is used to represent attributes, with the \fImod_type\fP and +\fImod_values\fP fields being used as described under +.BR ldap_modify_ext (3), +and the \fIldap_op\fP field being used only if you need to specify +the LDAP_MOD_BVALUES option. Otherwise, it should be set to zero. +.LP +Note that all entries except that +specified by the last component in the given DN must already exist. +.B ldap_add_ext_s() +returns an code indicating success or, in the case of failure, +indicating the nature of failure of the operation. See +.BR ldap_error (3) +for more details. +.LP +The +.B ldap_add_ext() +routine works just like +.BR ldap_add_ext_s() , +but it is asynchronous. It returns the message id of the request it +initiated. The result of this operation can be obtained by calling +.BR ldap_result (3). +.SH DEPRECATED INTERFACES +The +.BR ldap_add () +and +.BR ldap_add_s () +routines are deprecated in favor of the +.BR ldap_add_ext () +and +.BR ldap_add_ext_s () +routines, respectively. +.LP +.so Deprecated +.SH SEE ALSO +.BR ldap (3), +.BR ldap_error (3), +.BR ldap_modify (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_add.3.links b/doc/man/man3/ldap_add.3.links new file mode 100644 index 0000000..8114ef1 --- /dev/null +++ b/doc/man/man3/ldap_add.3.links @@ -0,0 +1,3 @@ +ldap_add_s.3 +ldap_add_ext.3 +ldap_add_ext_s.3 diff --git a/doc/man/man3/ldap_bind.3 b/doc/man/man3/ldap_bind.3 new file mode 100644 index 0000000..05ca1cf --- /dev/null +++ b/doc/man/man3/ldap_bind.3 @@ -0,0 +1,334 @@ +.TH LDAP_BIND 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_bind, ldap_bind_s, ldap_simple_bind, ldap_simple_bind_s, ldap_sasl_bind, ldap_sasl_bind_s, ldap_sasl_interactive_bind_s, ldap_parse_sasl_bind_result, ldap_unbind, ldap_unbind_s, ldap_unbind_ext, ldap_unbind_ext_s, ldap_set_rebind_proc \- LDAP bind routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.B #include <ldap.h> +.LP +.BI "int ldap_bind(LDAP *" ld ", const char *" who ", const char *" cred "," +.RS +.BI "int " method ");" +.RE +.LP +.BI "int ldap_bind_s(LDAP *" ld ", const char *" who ", const char *" cred "," +.RS +.BI "int " method ");" +.RE +.LP +.BI "int ldap_simple_bind(LDAP *" ld ", const char *" who ", const char *" passwd ");" +.LP +.BI "int ldap_simple_bind_s(LDAP *" ld ", const char *" who ", const char *" passwd ");" +.LP +.BI "int ldap_sasl_bind(LDAP *" ld ", const char *" dn ", const char *" mechanism "," +.RS +.BI "struct berval *" cred ", LDAPControl *" sctrls "[]," +.BI "LDAPControl *" cctrls "[], int *" msgidp ");" +.RE +.LP +.BI "int ldap_sasl_bind_s(LDAP *" ld ", const char *" dn ", const char *" mechanism "," +.RS +.BI "struct berval *" cred ", LDAPControl *" sctrls "[]," +.BI "LDAPControl *" cctrls "[], struct berval **" servercredp ");" +.RE +.LP +.BI "int ldap_parse_sasl_bind_result(LDAP *" ld ", LDAPMessage *" res "," +.RS +.BI "struct berval **" servercredp ", int " freeit ");" +.RE +.LP +.BI "int ldap_sasl_interactive_bind_s(LDAP *" ld ", const char *" dn "," +.RS +.BI "const char *" mechs "," +.BI "LDAPControl *" sctrls "[], LDAPControl *" cctrls "[]," +.BI "unsigned " flags ", LDAP_SASL_INTERACT_PROC *" interact "," +.BI "void *" defaults ");" +.RE +.LP +.BI "int ldap_sasl_interactive_bind(LDAP *" ld ", const char *" dn "," +.RS +.BI "const char *" mechs "," +.BI "LDAPControl *" sctrls "[], LDAPControl *" cctrls "[]," +.BI "unsigned " flags ", LDAP_SASL_INTERACT_PROC *" interact "," +.BI "void *" defaults ", LDAPMessage *" result "," +.BI "const char **" rmechp ", int *" msgidp ");" +.RE +.LP +.BI "int (LDAP_SASL_INTERACT_PROC)(LDAP *" ld ", unsigned " flags ", void *" defaults ", void *" sasl_interact ");" +.LP +.BI "int ldap_unbind(LDAP *" ld ");" +.LP +.BI "int ldap_unbind_s(LDAP *" ld ");" +.LP +.BI "int ldap_unbind_ext(LDAP *" ld ", LDAPControl *" sctrls "[]," +.RS +.BI "LDAPControl *" cctrls "[]);" +.RE +.LP +.BI "int ldap_unbind_ext_s(LDAP *" ld ", LDAPControl *" sctrls "[]," +.RS +.BI "LDAPControl *" cctrls "[]);" +.RE +.LP +.BI "int ldap_set_rebind_proc (LDAP *" ld ", LDAP_REBIND_PROC *" ldap_proc ", void *" params ");" +.LP +.BI "int (LDAP_REBIND_PROC)(LDAP *" ld ", LDAP_CONST char *" url ", ber_tag_t " request ", ber_int_t " msgid ", void *" params ");" +.SH DESCRIPTION +.LP +These routines provide various interfaces to the LDAP bind operation. +After an association with an LDAP server is made using +.BR ldap_init (3), +an LDAP bind operation should be performed before other operations are +attempted over the connection. An LDAP bind is required when using +Version 2 of the LDAP protocol; it is optional for Version 3 but is +usually needed due to security considerations. +.LP +There are three types of bind calls, ones providing simple authentication, +ones providing SASL authentication, and general routines capable of doing +either simple or SASL authentication. +.LP +.B SASL +(Simple Authentication and Security Layer) +can negotiate one of many different kinds of authentication. +Both synchronous and asynchronous versions of each variant of the bind +call are provided. All routines +take \fIld\fP as their first parameter, as returned from +.BR ldap_init (3). +.SH SIMPLE AUTHENTICATION +The simplest form of the bind call is +.BR ldap_simple_bind_s() . +It takes the DN to bind as in \fIwho\fP, and the userPassword associated +with the entry in \fIpasswd\fP. It returns an LDAP error indication +(see +.BR ldap_error (3)). +The +.B ldap_simple_bind() +call is asynchronous, +taking the same parameters but only initiating the bind operation and +returning the message id of the request it sent. The result of the +operation can be obtained by a subsequent call to +.BR ldap_result (3). +The +.B ldap_sasl_bind_s() +and asynchronous +.B ldap_sasl_bind() +functions can also be used to make a simple bind by using +LDAP_SASL_SIMPLE as the SASL mechanism. +.SH GENERAL AUTHENTICATION +The +.B ldap_bind() +and +.B ldap_bind_s() +routines can be used when the +authentication method to use needs to be selected at runtime. They +both take an extra \fImethod\fP parameter selecting the authentication +method to use. It should be set to LDAP_AUTH_SIMPLE +to select simple authentication. +.B ldap_bind() +returns the message id of the request it initiates. +.B ldap_bind_s() +returns an LDAP error indication. +.SH SASL AUTHENTICATION +For SASL binds the server always ignores any provided DN, so the +.I dn +parameter should always be NULL. +.BR ldap_sasl_bind_s () +sends a single SASL bind request with the given SASL +.I mechanism +and credentials in the +.I cred +parameter. The format of the credentials depends on the particular +SASL mechanism in use. For mechanisms that provide mutual authentication +the server's credentials will be returned in the +.I servercredp +parameter. +The routine returns an LDAP error indication (see +.BR ldap_error (3)). +The +.BR ldap_sasl_bind () +call is asynchronous, taking the same parameters but only sending the +request and returning the message id of the request it sent. The result of +the operation can be obtained by a subsequent +call to +.BR ldap_result (3). +The result must be additionally parsed by +.BR ldap_parse_sasl_bind_result () +to obtain any server credentials sent from the server. +.LP +Many SASL mechanisms require multiple message exchanges to perform a +complete authentication. Applications should generally use +.BR ldap_sasl_interactive_bind_s () +rather than calling the basic +.BR ldap_sasl_bind () +functions directly. The +.I mechs +parameter should contain a space-separated list of candidate mechanisms +to use. If this parameter is NULL or empty the library will query +the supportedSASLMechanisms attribute from the server's rootDSE +for the list of SASL mechanisms the server supports. The +.I flags +parameter controls the interaction used to retrieve any necessary +SASL authentication parameters and should be one of: +.TP +LDAP_SASL_AUTOMATIC +use defaults if available, prompt otherwise +.TP +LDAP_SASL_INTERACTIVE +always prompt +.TP +LDAP_SASL_QUIET +never prompt +.LP +The +.I interact +function uses the provided +.I defaults +to handle requests from the SASL library for particular authentication +parameters. There is no defined format for the +.I defaults +information; +it is up to the caller to use whatever format is appropriate for the +supplied +.I interact +function. +The +.I sasl_interact +parameter comes from the underlying SASL library. When used with Cyrus SASL +this is an array of +.B sasl_interact_t +structures. The Cyrus SASL library will prompt for a variety of inputs, +including: +.TP +SASL_CB_GETREALM +the realm for the authentication attempt +.TP +SASL_CB_AUTHNAME +the username to authenticate +.TP +SASL_CB_PASS +the password for the provided username +.TP +SASL_CB_USER +the username to use for proxy authorization +.TP +SASL_CB_NOECHOPROMPT +generic prompt for input with input echoing disabled +.TP +SASL_CB_ECHOPROMPT +generic prompt for input with input echoing enabled +.TP +SASL_CB_LIST_END +indicates the end of the array of prompts +.LP +See the Cyrus SASL documentation for more details. +.LP +Applications which need to manage connections asynchronously may use +.BR ldap_sasl_interactive_bind () +instead of the synchronous version. +A valid mechs parameter must be supplied, otherwise the library will +be forced to query the server for a list of supported mechanisms, +and this query will be performed synchronously. +The other parameters are the same as +for the synchronous function, with three additional parameters. +The actual SASL mechanism that was used, and the message ID for use +with +.BR ldap_result () +will be returned in rmechp and msgidp, respectively. +The value in rmechp must not be modified by the caller and must be +passed back on each subsequent call. The message obtained from +.BR ldap_result () +must be passed in the result parameter. +This parameter must be NULL when initiating a new Bind. The caller +must free the result message after each call using +.BR ldap_msgfree (). +The +.BR ldap_sasl_interactive_bind () +function returns an LDAP result code. If the code is +LDAP_SASL_BIND_IN_PROGRESS then the Bind is not complete yet, and +this function must be called again with the next result from the server. +.SH REBINDING +.LP +The +.B ldap_set_rebind_proc +function() sets the process to use for binding when an operation returns a +referral. This function is used when an application needs to bind to another server +in order to follow a referral or search continuation reference. +.LP +The function takes \fIld\fP, the \fIrebind\fP function, and the \fIparams\fP, +the arbitrary data like state information which the client might need to properly rebind. +The LDAP_OPT_REFERRALS option in the \fIld\fP must be set to ON for the libraries +to use the rebind function. Use the +.BR ldap_set_option +function to set the value. +.LP +The rebind function parameters are as follows: +.LP +The \fIld\fP parameter must be used by the application when binding to the +referred server if the application wants the libraries to follow the referral. +.LP +The \fIurl\fP parameter points to the URL referral string received from the LDAP server. +The LDAP application can use the +.BR ldap_url_parse (3) +function to parse the string into its components. +.LP +The \fIrequest\fP parameter specifies the type of request that generated the referral. +.LP +The \fImsgid\fP parameter specifies the message ID of the request generating the referral. +.LP +The \fIparams\fP parameter is the same value as passed originally to the +.BR ldap_set_rebind_proc () +function. +.LP +The LDAP libraries set all the parameters when they call the rebind function. The application +should not attempt to free either the ld or the url structures in the rebind function. +.LP +The application must supply to the rebind function the required authentication information such as, +user name, password, and certificates. The rebind function must use a synchronous bind method. +.SH UNBINDING +The +.B ldap_unbind() +call is used to unbind from the directory, +terminate the current association, and free the resources contained +in the \fIld\fP structure. Once it is called, the connection to +the LDAP server is closed, and the \fIld\fP structure is invalid. +The +.B ldap_unbind_s() +call is just another name for +.BR ldap_unbind() ; +both of these calls are synchronous in nature. +.LP +The +.B ldap_unbind_ext() +and +.B ldap_unbind_ext_s() +allows the operations to specify controls. +.SH ERRORS +Asynchronous routines will return \-1 in case of error, setting the +\fIld_errno\fP parameter of the \fIld\fP structure. Synchronous +routines return whatever \fIld_errno\fP is set to. See +.BR ldap_error (3) +for more information. +.SH NOTES +If an anonymous bind is sufficient for the application, the rebind process +need not be provided. The LDAP libraries with the LDAP_OPT_REFERRALS option +set to ON (default value) will automatically follow referrals using an anonymous bind. +.LP +If the application needs stronger authentication than an anonymous bind, +you need to provide a rebind process for that authentication method. +The bind method must be synchronous. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_error (3), +.BR ldap_open (3), +.BR ldap_set_option (3), +.BR ldap_url_parse (3) +.B RFC 4422 +(http://www.rfc-editor.org), +.B Cyrus SASL +(http://asg.web.cmu.edu/sasl/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_bind.3.links b/doc/man/man3/ldap_bind.3.links new file mode 100644 index 0000000..ffaedd5 --- /dev/null +++ b/doc/man/man3/ldap_bind.3.links @@ -0,0 +1,10 @@ +ldap_bind_s.3 +ldap_simple_bind.3 +ldap_simple_bind_s.3 +ldap_sasl_bind.3 +ldap_sasl_bind_s.3 +ldap_unbind.3 +ldap_unbind_ext.3 +ldap_unbind_s.3 +ldap_unbind_ext_s.3 +ldap_set_rebind_proc.3 diff --git a/doc/man/man3/ldap_compare.3 b/doc/man/man3/ldap_compare.3 new file mode 100644 index 0000000..f0018ee --- /dev/null +++ b/doc/man/man3/ldap_compare.3 @@ -0,0 +1,79 @@ +.TH LDAP_COMPARE 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_compare, ldap_compare_s, ldap_compare_ext, ldap_compare_ext_s \- Perform an LDAP compare operation. +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_compare_ext( +.RS +.ft B +LDAP *\fIld\fB, +char *\fIdn\fB, +char *\fIattr\fB, +const struct berval *\fIbvalue\fB, +LDAPControl **\fIserverctrls\fB, +LDAPControl **\fIclientctrls\fB, +int *\fImsgidp\fB ); +.RE +.LP +.ft B +int ldap_compare_ext_s( +.RS +.ft B +LDAP *\fIld\fB, +char *\fIdn\fB, +char *\fIattr\fB, +const struct berval *\fIbvalue\fB, +LDAPControl **\fIserverctrls\fB, +LDAPControl **\fIclientctrls\fB ); +.RE +.SH DESCRIPTION +The +.B ldap_compare_ext_s() +routine is used to perform an LDAP compare operation synchronously. +It takes \fIdn\fP, the DN of the entry upon which to perform the +compare, and \fIattr\fP and \fIvalue\fP, the attribute description and +value to compare to those found in the entry. It returns a code, which +will be LDAP_COMPARE_TRUE if the entry contains the attribute value and +LDAP_COMPARE_FALSE if it does not. Otherwise, an error code is +returned that indicates the nature of the problem. See +.BR ldap (3) +for details. +.LP +The +.B ldap_compare_ext() +routine is used to perform an LDAP compare operation +asynchronously. It takes the same parameters as +.BR ldap_compare_ext_s() , +but provides the message id of the request it initiated in the +integer pointed to \fImsgidp\fP. The result of +the compare can be obtained by a subsequent call to +.BR ldap_result (3). +.LP +Both routines allow server and client controls to be specified to +extend the compare request. +.SH DEPRECATED INTERFACES +The routines +.BR ldap_compare () +and +.BR ldap_compare_s () +are deprecated in favor of +.BR ldap_compare_ext () +and +.BR ldap_compare_ext_s (), +respectively. +.LP +.so Deprecated +.SH SEE ALSO +.BR ldap (3), +.BR ldap_error (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_compare.3.links b/doc/man/man3/ldap_compare.3.links new file mode 100644 index 0000000..66821cc --- /dev/null +++ b/doc/man/man3/ldap_compare.3.links @@ -0,0 +1,3 @@ +ldap_compare_s.3 +ldap_compare_ext.3 +ldap_compare_ext_s.3 diff --git a/doc/man/man3/ldap_controls.3 b/doc/man/man3/ldap_controls.3 new file mode 100644 index 0000000..239cc09 --- /dev/null +++ b/doc/man/man3/ldap_controls.3 @@ -0,0 +1,84 @@ +.TH LDAP_CONTROLS 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_control_create, ldap_control_find, ldap_control_dup, +ldap_controls_dup, ldap_control_free, ldap_controls_free +\- LDAP control manipulation routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.B #include <ldap.h> +.LP +.BI "int ldap_control_create(const char *" oid ", int " iscritical ", struct berval *" value ", int " dupval ", LDAPControl **" ctrlp ");" +.LP +.BI "LDAPControl *ldap_control_find( const char *" oid ", LDAPControl **" ctrls ", LDAPControl ***" nextctrlp ");" +.LP +.BI "LDAPControl *ldap_control_dup(LDAPControl *" ctrl ");" +.LP +.BI "LDAPControl **ldap_controls_dup(LDAPControl **" ctrls ");" +.LP +.BI "void ldap_control_free(LDAPControl *" ctrl ");" +.LP +.BI "void ldap_controls_free(LDAPControl **" ctrls ");" +.SH DESCRIPTION +These routines are used to manipulate structures used for LDAP controls. + +.BR ldap_control_create () +creates a control with the specified +.I OID +using the contents of the +.I value +parameter for the control value, if any. The content of +.I value +is duplicated if +.I dupval +is non-zero. The +.I iscritical +parameter must be non-zero for a critical control. The created control +is returned in the +.I ctrlp +parameter. The routine returns +.B LDAP_SUCCESS +on success or some other error code on failure. +The content of +.IR value , +for supported control types, can be prepared using helpers provided +by this implementation of libldap, usually in the form +.BR "ldap_create_<control name>_control_value" (). +Otherwise, it can be BER-encoded using the functionalities of liblber. + +.BR ldap_control_find () +searches the NULL-terminated +.I ctrls +array for a control whose OID matches the +.I oid +parameter. The routine returns a pointer to the control if found, +NULL otherwise. +If the parameter +.I nextctrlp +is not NULL, on return it will point to the next control +in the array, and can be passed to the +.BR ldap_control_find () +routine for subsequent calls, to find further occurrences of the same +control type. +The use of this function is discouraged; the recommended way of handling +controls in responses consists in going through the array of controls, +dealing with each of them in the returned order, since it could matter. + +.BR ldap_control_dup () +duplicates an individual control structure, and +.BR ldap_controls_dup () +duplicates a NULL-terminated array of controls. + +.BR ldap_control_free () +frees an individual control structure, and +.BR ldap_controls_free () +frees a NULL-terminated array of controls. + +.SH SEE ALSO +.BR ldap (3), +.BR ldap_error (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_controls.3.links b/doc/man/man3/ldap_controls.3.links new file mode 100644 index 0000000..6c5248f --- /dev/null +++ b/doc/man/man3/ldap_controls.3.links @@ -0,0 +1,6 @@ +ldap_control_create.3 +ldap_control_find.3 +ldap_control_dup.3 +ldap_controls_dup.3 +ldap_control_free.3 +ldap_controls_free.3 diff --git a/doc/man/man3/ldap_delete.3 b/doc/man/man3/ldap_delete.3 new file mode 100644 index 0000000..4a97b71 --- /dev/null +++ b/doc/man/man3/ldap_delete.3 @@ -0,0 +1,89 @@ +.TH LDAP_DELETE 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_delete, ldap_delete_s, ldap_delete_ext, ldap_delete_ext_s \- Perform an LDAP delete operation. +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_delete_s(ld, dn) +.ft +LDAP *ld; +char *dn; +.LP +.ft B +int ldap_delete(ld, dn) +.ft +LDAP *ld; +char *dn; +.LP +.ft B +int ldap_delete_ext(ld, dn, serverctrls, clientctrls, msgidp) +.ft +LDAP *ld; +char *dn; +LDAPControl **serverctrls, **clientctrls; +int *msgidp; +.LP +.ft B +int ldap_delete_ext_s(ld, dn, serverctrls, clientctrls) +.ft +LDAP *ld; +char *dn; +LDAPControl **serverctrls, **clientctrls; +.SH DESCRIPTION +The +.B ldap_delete_s() +routine is used to perform an LDAP delete operation +synchronously. It takes \fIdn\fP, the DN of the entry to be deleted. +It returns an LDAP error code, indicating the success or failure of the +operation. +.LP +The +.B ldap_delete() +routine is used to perform an LDAP delete operation +asynchronously. It takes the same parameters as +.BR ldap_delete_s(), +but returns the message id of the request it initiated. The result of +the delete can be obtained by a subsequent call to +.BR ldap_result (3). +.LP +The +.B ldap_delete_ext() +routine allows server and client controls to be +specified to extend the delete request. This routine is asynchronous like +ldap_delete(), but its return value is an LDAP error code. It stores the +message id of the request in the integer pointed to by msgidp. +.LP +The +.B ldap_delete_ext_s() +routine is the synchronous version of +.BR ldap_delete_ext(). +It also returns an LDAP error code indicating success +or failure of the operation. +.SH ERRORS +.B ldap_delete_s() +returns an LDAP error code which can be interpreted +by calling one of +.BR ldap_perror (3) +and friends. +.B ldap_delete() +returns \-1 if something went wrong initiating the request. It returns the +non-negative message id of the request if things went ok. +.LP +.B ldap_delete_ext() +and +.B ldap_delete_ext_s() +return some Non-zero value if +something went wrong initiating the request, else return 0. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_error (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_delete.3.links b/doc/man/man3/ldap_delete.3.links new file mode 100644 index 0000000..d4eac2f --- /dev/null +++ b/doc/man/man3/ldap_delete.3.links @@ -0,0 +1,3 @@ +ldap_delete_s.3 +ldap_delete_ext.3 +ldap_delete_ext_s.3 diff --git a/doc/man/man3/ldap_dup.3 b/doc/man/man3/ldap_dup.3 new file mode 100644 index 0000000..de8fabd --- /dev/null +++ b/doc/man/man3/ldap_dup.3 @@ -0,0 +1,126 @@ +.TH LDAP_OPEN 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_dup, ldap_destroy, \- Duplicate and destroy LDAP session handles +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +LDAP *ldap_dup( +.RS +.ft B +LDAP *\fIold\fB ); +.RE +.LP +.ft B +int ldap_destroy( +.RS +.ft B +LDAP *\fIold\fB ); +.RE +.SH DESCRIPTION +.LP +.B ldap_dup() +duplicates an existing LDAP +.RB ( "LDAP *" ) +session handle. +The new session handle may be used concurrently with the +original session handle. +In a threaded environment, different threads may execute concurrent +requests on the same connection/session without fear of contamination. +Each session handle manages its own private error results. +.LP +.B ldap_destroy() +destroys an existing session handle. +.LP +The +.B ldap_dup() +and +.B ldap_destroy() +functions are used in conjunction with a "thread safe" version +of +.B libldap +.RB ( libldap_r ) +to enable operation thread safe API calls, so that a single session +may be simultaneously used across multiple threads with consistent +error handling. +.LP +When a session is created through the use of one of the session creation +functions including +.BR ldap_open (3), +.BR ldap_init (3), +.BR ldap_initialize (3) +or +.BR ldap_init_fd (3) +an +.B "LDAP *" +session handle is returned to the application. +The session handle may be shared amongst threads, however the +error codes are unique to a session handle. +Multiple threads performing different operations using the same +session handle will result in inconsistent error codes and +return values. +.LP +To prevent this confusion, +.B ldap_dup() +is used duplicate an existing session handle so that multiple threads +can share the session, and maintain consistent error information +and results. +.LP +The message queues for a session are shared between sibling session handles. +Results of operations on a sibling session handles are accessible +to all the sibling session handles. +Applications desiring results associated with a specific operation +should provide the appropriate msgid to +.BR ldap_result() . +Applications should avoid calling +.B ldap_result() +with +.B LDAP_RES_ANY +as that may "steal" and return results in the calling thread +that another operation in a different thread, using a +different session handle, may require to complete. +.LP +When +.B ldap_unbind() +is called on a session handle with siblings, all the +siblings become invalid. +.LP +Siblings must be destroyed using +.BR ldap_destroy() . +Session handle resources associated with the original +.RB ( "LDAP *" ) +will be freed when the last session handle is destroyed or when +.B ldap_unbind() +is called, if no other session handles currently exist. +.SH ERRORS +If an error occurs, +.B ldap_dup() +will return NULL and +.I errno +should be set appropriately. +.B ldap_destroy() +will directly return the LDAP code associated to the error (or +.I LDAP_SUCCESS +in case of success); +.I errno +should be set as well whenever appropriate. +.SH SEE ALSO +.BR ldap_open (3), +.BR ldap_init (3), +.BR ldap_initialize (3), +.BR ldap_init_fd (3), +.BR errno (3) +.SH ACKNOWLEDGEMENTS +This work is based on the previously proposed +.B LDAP C API Concurrency Extensions +draft +.BR ( draft-zeilenga-ldap-c-api-concurrency-00.txt ) +effort. +.so ../Project diff --git a/doc/man/man3/ldap_dup.3.links b/doc/man/man3/ldap_dup.3.links new file mode 100644 index 0000000..1d77f93 --- /dev/null +++ b/doc/man/man3/ldap_dup.3.links @@ -0,0 +1 @@ +ldap_destroy.3 diff --git a/doc/man/man3/ldap_error.3 b/doc/man/man3/ldap_error.3 new file mode 100644 index 0000000..508129a --- /dev/null +++ b/doc/man/man3/ldap_error.3 @@ -0,0 +1,224 @@ +.TH LDAP_ERROR 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_perror, ld_errno, ldap_result2error, ldap_errlist, ldap_err2string \- LDAP protocol error handling routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +char *ldap_err2string( int \fIerr\fB ); +.SH DESCRIPTION +The +.B ldap_err2string() +routine provides short description of the various codes returned by +routines in this library. The returned string is a pointer to a +static area that should not be modified. + +These codes are either negative, +indicating an API error code; positive, indicating an LDAP resultCode +other than \'success' (0), or - zero, indicating both successful use +of the API and the LDAP resultCode \'success' (0). + +The code associated with an LDAP session is accessible using +.BR ldap_get_option (3) +and +.BR ldap_set_option (3) +with the +.B LDAP_OPT_RESULT_CODE +option (previously called +.BR LDAP_OPT_ERROR_NUMBER ). + +.SH PROTOCOL RESULT CODES + +This section provides a partial list of protocol codes recognized +by the library. As LDAP is extensible, additional values may be +returned. A complete listing of \fIregistered\fP LDAP result codes +can be obtained from the \fIInternet Assigned Numbers Authority\fP +<http://www.iana.org>. + +.LP +.TP 20 +.SM LDAP_SUCCESS +The request was successful. +.TP +.SM LDAP_OPERATIONS_ERROR +An operations error occurred. +.TP +.SM LDAP_PROTOCOL_ERROR +A protocol violation was detected. +.TP +.SM LDAP_TIMELIMIT_EXCEEDED +An LDAP time limit was exceeded. +.TP +.SM LDAP_SIZELIMIT_EXCEEDED +An LDAP size limit was exceeded. +.TP +.SM LDAP_COMPARE_FALSE +A compare operation returned false. +.TP +.SM LDAP_COMPARE_TRUE +A compare operation returned true. +.TP +.SM LDAP_STRONG_AUTH_NOT_SUPPORTED +The LDAP server does not support strong authentication. +.TP +.SM LDAP_STRONG_AUTH_REQUIRED +Strong authentication is required for the operation. +.TP +.SM LDAP_PARTIAL_RESULTS +Partial results only returned. +.TP +.SM LDAP_NO_SUCH_ATTRIBUTE +The attribute type specified does not exist in the entry. +.TP +.SM LDAP_UNDEFINED_TYPE +The attribute type specified is invalid. +.TP +.SM LDAP_INAPPROPRIATE_MATCHING +Filter type not supported for the specified attribute. +.TP +.SM LDAP_CONSTRAINT_VIOLATION +An attribute value specified violates some constraint (e.g., a postalAddress +has too many lines, or a line that is too long). +.TP +.SM LDAP_TYPE_OR_VALUE_EXISTS +An attribute type or attribute value specified already exists in the entry. +.TP +.SM LDAP_INVALID_SYNTAX +An invalid attribute value was specified. +.TP +.SM LDAP_NO_SUCH_OBJECT +The specified object does not exist in The Directory. +.TP +.SM LDAP_ALIAS_PROBLEM +An alias in The Directory points to a nonexistent entry. +.TP +.SM LDAP_INVALID_DN_SYNTAX +A syntactically invalid DN was specified. +.TP +.SM LDAP_IS_LEAF +The object specified is a leaf. +.TP +.SM LDAP_ALIAS_DEREF_PROBLEM +A problem was encountered when dereferencing an alias. +.TP +.SM LDAP_INAPPROPRIATE_AUTH +Inappropriate authentication was specified (e.g., LDAP_AUTH_SIMPLE was +specified and the entry does not have a userPassword attribute). +.TP +.SM LDAP_INVALID_CREDENTIALS +Invalid credentials were presented (e.g., the wrong password). +.TP +.SM LDAP_INSUFFICIENT_ACCESS +The user has insufficient access to perform the operation. +.TP +.SM LDAP_BUSY +The DSA is busy. +.TP +.SM LDAP_UNAVAILABLE +The DSA is unavailable. +.TP +.SM LDAP_UNWILLING_TO_PERFORM +The DSA is unwilling to perform the operation. +.TP +.SM LDAP_LOOP_DETECT +A loop was detected. +.TP +.SM LDAP_NAMING_VIOLATION +A naming violation occurred. +.TP +.SM LDAP_OBJECT_CLASS_VIOLATION +An object class violation occurred (e.g., a "must" attribute was missing +from the entry). +.TP +.SM LDAP_NOT_ALLOWED_ON_NONLEAF +The operation is not allowed on a nonleaf object. +.TP +.SM LDAP_NOT_ALLOWED_ON_RDN +The operation is not allowed on an RDN. +.TP +.SM LDAP_ALREADY_EXISTS +The entry already exists. +.TP +.SM LDAP_NO_OBJECT_CLASS_MODS +Object class modifications are not allowed. +.TP +.SM LDAP_OTHER +An unknown error occurred. + +.SH API ERROR CODES + +This section provides a complete list of API error codes recognized +by the library. Note that LDAP_SUCCESS indicates success of an +API call in addition to representing the return of the LDAP +\'success' resultCode. + + +.LP +.TP 20 +.SM LDAP_SERVER_DOWN +The LDAP library can't contact the LDAP server. +.TP +.SM LDAP_LOCAL_ERROR +Some local error occurred. This is usually a failed dynamic memory allocation. +.TP +.SM LDAP_ENCODING_ERROR +An error was encountered encoding parameters to send to the LDAP server. +.TP +.SM LDAP_DECODING_ERROR +An error was encountered decoding a result from the LDAP server. +.TP +.SM LDAP_TIMEOUT +A timelimit was exceeded while waiting for a result. +.TP +.SM LDAP_AUTH_UNKNOWN +The authentication method specified to ldap_bind() is not known. +.TP +.SM LDAP_FILTER_ERROR +An invalid filter was supplied to ldap_search() (e.g., unbalanced +parentheses). +.TP +.SM LDAP_PARAM_ERROR +An ldap routine was called with a bad parameter. +.TP +.SM LDAP_NO_MEMORY +An memory allocation (e.g., malloc(3) or other dynamic memory +allocator) call failed in an ldap library routine. +.TP +.SM LDAP_USER_CANCELED +Indicates the user cancelled the operation. +.TP +.SM LDAP_CONNECT_ERROR +Indicates a connection problem. +.TP +.SM LDAP_NOT_SUPPORTED +Indicates the routine was called in a manner not supported by the library. +.TP +.SM LDAP_CONTROL_NOT_FOUND +Indicates the control provided is unknown to the client library. +.TP +.SM LDAP_NO_RESULTS_RETURNED +Indicates no results returned. +.TP +.SM LDAP_MORE_RESULTS_TO_RETURN +Indicates more results could be returned. +.TP +.SM LDAP_CLIENT_LOOP +Indicates the library has detected a loop in its processing. +.TP +.SM LDAP_REFERRAL_LIMIT_EXCEEDED +Indicates the referral limit has been exceeded. + +.SH DEPRECATED +.so Deprecated + +.SH SEE ALSO +.BR ldap (3), +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_error.3.links b/doc/man/man3/ldap_error.3.links new file mode 100644 index 0000000..841370d --- /dev/null +++ b/doc/man/man3/ldap_error.3.links @@ -0,0 +1,5 @@ +ldap_perror.3 +ld_errno.3 +ldap_result2error.3 +ldap_errlist.3 +ldap_err2string.3 diff --git a/doc/man/man3/ldap_extended_operation.3 b/doc/man/man3/ldap_extended_operation.3 new file mode 100644 index 0000000..cebe3d9 --- /dev/null +++ b/doc/man/man3/ldap_extended_operation.3 @@ -0,0 +1,75 @@ +.TH LDAP_EXTENDED_OPERATION 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_extended_operation, ldap_extended_operation_s \- Extends the LDAP operations to the LDAP server. +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_extended_operation( +.RS +.ft B +LDAP *\fIld\fB, +const char *\fIrequestoid\fB, +const struct berval *\fIrequestdata\fB, +LDAPControl **\fIsctrls\fB, +LDAPControl **\fIcctrls\fB, +int *\fImsgidp\fB ); +.RE +.LP +.ft B +int ldap_extended_operation_s( +.RS +.ft B +LDAP *\fIld\fB, +const char *\fIrequestoid\fB, +const struct berval *\fIrequestdata\fB, +LDAPControl **\fIsctrls\fB, +LDAPControl **\fIcctrls\fB, +char **\fIretoidp\fB, +struct berval **\fIretdatap\fB ); +.RE +.SH DESCRIPTION +The +.B ldap_extended_operation_s() +routine is used to synchronously perform an LDAP extended operation. +It takes \fIrequestoid\fP, which points to a dotted-decimal OID string +identifying the extended operation to perform. \fIrequestdata\fP is the +data required for the request, \fIsctrls\fP is an array of LDAPControl +structures to use with this extended operation, \fIcctrls\fP is an array +of LDAPControl structures that list the client controls to use with +this extended operation. +.LP +The output parameter \fIretoidp\fP points to a dotted-decimal OID +string returned by the LDAP server. The memory used by the string +should be freed with the +.BR ldap_memfree (3) +function. +The output parameter \fIretdatap\fP points to a pointer to a berval +structure that contains the returned data. If no data is returned +by the server, the pointer is set this to NULL. The memory used by +this structure should be freed with the +.BR ber_bvfree (3) +function. +.LP +The +.B ldap_extended_operation() +works just like +.BR ldap_extended_operation_s() , +but the operation is asynchronous. It provides the message id of +the request it initiated in the integer pointed to be \fImsgidp\fP. +The result of this operation can be obtained by calling +.BR ldap_result(3). +.SH SEE ALSO +.BR ber_bvfree (3), +.BR ldap_memfree (3), +.BR ldap_parse_extended_result (3), +.BR ldap_result (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_extended_operation.3.links b/doc/man/man3/ldap_extended_operation.3.links new file mode 100644 index 0000000..1c5dc67 --- /dev/null +++ b/doc/man/man3/ldap_extended_operation.3.links @@ -0,0 +1,2 @@ +ldap_extended_operation_s.3 + diff --git a/doc/man/man3/ldap_first_attribute.3 b/doc/man/man3/ldap_first_attribute.3 new file mode 100644 index 0000000..63ac3e5 --- /dev/null +++ b/doc/man/man3/ldap_first_attribute.3 @@ -0,0 +1,73 @@ +.TH LDAP_FIRST_ATTRIBUTE 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_first_attribute, ldap_next_attribute \- step through LDAP entry attributes +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +char *ldap_first_attribute( + LDAP *ld, LDAPMessage *entry, BerElement **berptr ) +.LP +.ft B +char *ldap_next_attribute( + LDAP *ld, LDAPMessage *entry, BerElement *ber ) +.SH DESCRIPTION +The +.B ldap_first_attribute() +and +.B ldap_next_attribute() +routines are used +to step through the attributes in an LDAP entry. +.B ldap_first_attribute() +takes an \fIentry\fP as returned by +.BR ldap_first_entry (3) +or +.BR ldap_next_entry (3) +and returns a pointer to character string +containing the first attribute description in the entry. +.B ldap_next_attribute() +returns the next attribute description in the entry. +.LP +It also returns, in \fIberptr\fP, a pointer to a BerElement it has +allocated to keep track of its current position. This pointer should +be passed to subsequent calls to +.B ldap_next_attribute() +and is used +to effectively step through the entry's attributes. The caller is +solely responsible for freeing the BerElement pointed to by \fIberptr\fP +when it is no longer needed by calling +.BR ber_free (3). +When calling +.BR ber_free (3) +in this instance, be sure the second argument is 0. +.LP +The attribute names returned are suitable for inclusion in a call +to +.BR ldap_get_values (3) +to retrieve the attribute's values. +.SH ERRORS +If an error occurs, NULL is returned and the ld_errno field in the +\fIld\fP parameter is set to indicate the error. See +.BR ldap_error (3) +for a description of possible error codes. +.SH NOTES +The +.B ldap_first_attribute() +and +.B ldap_next_attribute() +return dynamically allocated memory that must be freed by the caller via +.BR ldap_memfree (3). +.SH SEE ALSO +.BR ldap (3), +.BR ldap_first_entry (3), +.BR ldap_get_values (3), +.BR ldap_error (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_first_attribute.3.links b/doc/man/man3/ldap_first_attribute.3.links new file mode 100644 index 0000000..739fe3a --- /dev/null +++ b/doc/man/man3/ldap_first_attribute.3.links @@ -0,0 +1 @@ +ldap_next_attribute.3 diff --git a/doc/man/man3/ldap_first_entry.3 b/doc/man/man3/ldap_first_entry.3 new file mode 100644 index 0000000..4895750 --- /dev/null +++ b/doc/man/man3/ldap_first_entry.3 @@ -0,0 +1,80 @@ +.TH LDAP_FIRST_ENTRY 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_first_entry, ldap_next_entry, ldap_count_entries \- LDAP result entry parsing and counting routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_count_entries( LDAP *ld, LDAPMessage *result ) +.LP +.ft B +LDAPMessage *ldap_first_entry( LDAP *ld, LDAPMessage *result ) +.LP +.ft B +LDAPMessage *ldap_next_entry( LDAP *ld, LDAPMessage *entry ) +.SH DESCRIPTION +.LP +These routines are used to parse results received from +.BR ldap_result (3) +or the synchronous LDAP search operation routines +.BR ldap_search_s (3) +and +.BR ldap_search_st (3). +.LP +The +.B ldap_first_entry() +routine is used to retrieve the first entry in a chain +of search results. It takes the \fIresult\fP as returned by a call to +.BR ldap_result (3) +or +.BR ldap_search_s (3) +or +.BR ldap_search_st (3) +and returns a pointer to the first entry in the result. +.LP +This pointer should be supplied on a subsequent call to +.B ldap_next_entry() +to get the next entry, the result of which should be +supplied to the next call to +.BR ldap_next_entry() , +etc. +.B ldap_next_entry() +will return NULL when there are no more entries. The entries returned +from these calls are used in calls to the routines described in +.BR ldap_get_dn (3), +.BR ldap_first_attribute (3), +.BR ldap_get_values (3), +etc. +.LP +A count of the number of entries in the search result can be obtained +by calling +.BR ldap_count_entries() . +.SH ERRORS +If an error occurs in +.B ldap_first_entry() +or +.BR ldap_next_entry() , +NULL is returned and the ld_errno field in the \fIld\fP parameter +is set to indicate the error. If an error occurs in +.BR ldap_count_entries() , +-1 is returned, and +.B ld_errno +is set appropriately. See +.BR ldap_error (3) +for a description of possible error codes. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_result (3), +.BR ldap_search (3), +.BR ldap_first_attribute (3), +.BR ldap_get_values (3), +.BR ldap_get_dn (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_first_entry.3.links b/doc/man/man3/ldap_first_entry.3.links new file mode 100644 index 0000000..781590b --- /dev/null +++ b/doc/man/man3/ldap_first_entry.3.links @@ -0,0 +1,2 @@ +ldap_next_entry.3 +ldap_count_entries.3 diff --git a/doc/man/man3/ldap_first_message.3 b/doc/man/man3/ldap_first_message.3 new file mode 100644 index 0000000..ae77ff6 --- /dev/null +++ b/doc/man/man3/ldap_first_message.3 @@ -0,0 +1,82 @@ +.TH LDAP_FIRST_MESSAGE 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_first_message, ldap_next_message, ldap_count_messages \- Stepping through messages in a result chain +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_count_messages( LDAP *ld, LDAPMessage *result ) +.LP +.ft B +LDAPMessage *ldap_first_message( LDAP *ld, LDAPMessage *result ) +.LP +.ft B +LDAPMessage *ldap_next_message( LDAP *ld, LDAPMessage *message ) +.SH DESCRIPTION +.LP +These routines are used to step through the messages in a result chain +received from +.BR ldap_result (3) . +For search operations, the result chain can contain referral, entry +and result messages. The +.BR ldap_msgtype (3) +function can be used to distinguish between the different message types. +.LP +The +.B ldap_first_message() +routine is used to retrieve the first message in a result chain. +It takes the \fIresult\fP as returned by a call to +.BR ldap_result (3) , +.BR ldap_search_s (3) +or +.BR ldap_search_st (3) +and returns a pointer to the first message in the result chain. +.LP +This pointer should be supplied on a subsequent call to +.B ldap_next_message() +to get the next message, the result of which should be +supplied to the next call to +.BR ldap_next_message() , +etc. +.B ldap_next_message() +will return NULL when there are no more messages. +.LP +These functions are useful when using routines like +.BR ldap_parse_result (3) +that only operate on the first result in the chain. +.LP +A count of the number of messages in the result chain can be obtained +by calling +.BR ldap_count_messages() . +It can also be used to count the number of remaining messages in a chain +if called with a message, entry or reference returned by +.B ldap_first_message() , +.B ldap_next_message() , +.BR ldap_first_entry (3) , +.BR ldap_next_entry (3) , +.BR ldap_first_reference (3) , +.BR ldap_next_reference (3) . +.SH ERRORS +If an error occurs in +.B ldap_first_message() +or +.BR ldap_next_message() , +NULL is returned. If an error occurs in +.BR ldap_count_messages() , +-1 is returned. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_search (3), +.BR ldap_result (3), +.BR ldap_parse_result (3), +.BR ldap_first_entry (3), +.BR ldap_first_reference (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_first_message.3.links b/doc/man/man3/ldap_first_message.3.links new file mode 100644 index 0000000..420c04f --- /dev/null +++ b/doc/man/man3/ldap_first_message.3.links @@ -0,0 +1,2 @@ +ldap_next_message.3 +ldap_count_messages.3 diff --git a/doc/man/man3/ldap_first_reference.3 b/doc/man/man3/ldap_first_reference.3 new file mode 100644 index 0000000..4965515 --- /dev/null +++ b/doc/man/man3/ldap_first_reference.3 @@ -0,0 +1,71 @@ +.TH LDAP_FIRST_REFERENCE 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_first_reference, ldap_next_reference, ldap_count_references \- Stepping through continuation references in a result chain +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_count_references( LDAP *ld, LDAPMessage *result ) +.LP +.ft B +LDAPMessage *ldap_first_reference( LDAP *ld, LDAPMessage *result ) +.LP +.ft B +LDAPMessage *ldap_next_reference( LDAP *ld, LDAPMessage *reference ) +.SH DESCRIPTION +.LP +These routines are used to step through the continuation references in a +result chain received from +.BR ldap_result (3) +or the synchronous LDAP search operation routines. +.LP +The +.B ldap_first_reference() +routine is used to retrieve the first reference message in a +result chain. It takes the \fIresult\fP as returned by a call to +.BR ldap_result (3) , +.BR ldap_search_s (3) +or +.BR ldap_search_st (3) +and returns a pointer to the first reference message in the +result chain. +.LP +This pointer should be supplied on a subsequent call to +.B ldap_next_reference() +to get the next reference message, the result of which should be +supplied to the next call to +.BR ldap_next_reference() , +etc. +.B ldap_next_reference() +will return NULL when there are no more reference messages. +The reference messages returned from these calls are used by +.BR ldap_parse_reference (3) +to extract referrals and controls. +.LP +A count of the number of reference messages in the search result can be +obtained by calling +.BR ldap_count_references() . +It can also be used to count the number of reference messages remaining +in a result chain. +.SH ERRORS +If an error occurs in +.B ldap_first_reference() +or +.BR ldap_next_reference() , +NULL is returned. If an error occurs in +.BR ldap_count_references() , +-1 is returned. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_result (3), +.BR ldap_search (3), +.BR ldap_parse_reference (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_first_reference.3.links b/doc/man/man3/ldap_first_reference.3.links new file mode 100644 index 0000000..a747bbb --- /dev/null +++ b/doc/man/man3/ldap_first_reference.3.links @@ -0,0 +1,2 @@ +ldap_next_reference.3 +ldap_count_references.3 diff --git a/doc/man/man3/ldap_get_dn.3 b/doc/man/man3/ldap_get_dn.3 new file mode 100644 index 0000000..0b39a43 --- /dev/null +++ b/doc/man/man3/ldap_get_dn.3 @@ -0,0 +1,246 @@ +.TH LDAP_GET_DN 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_get_dn, ldap_explode_dn, ldap_explode_rdn, ldap_dn2ufn \- LDAP DN handling routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +char *ldap_get_dn( LDAP *ld, LDAPMessage *entry ) +.LP +.ft B +int ldap_str2dn( const char *str, LDAPDN *dn, unsigned flags ) +.LP +.ft B +void ldap_dnfree( LDAPDN dn ) +.LP +.ft B +int ldap_dn2str( LDAPDN dn, char **str, unsigned flags ) +.LP +.ft B +char **ldap_explode_dn( const char *dn, int notypes ) +.LP +.ft B +char **ldap_explode_rdn( const char *rdn, int notypes ) +.LP +.ft B +char *ldap_dn2ufn( const char * dn ) +.LP +.ft B +char *ldap_dn2dcedn( const char * dn ) +.LP +.ft B +char *ldap_dcedn2dn( const char * dn ) +.LP +.ft B +char *ldap_dn2ad_canonical( const char * dn ) +.SH DESCRIPTION +These routines allow LDAP entry names (Distinguished Names, or DNs) +to be obtained, parsed, converted to a user-friendly form, and tested. +A DN has the form described in +RFC 4414 "Lightweight Directory Access Protocol (LDAP): +String Representation of Distinguished Names". +.LP +The +.B ldap_get_dn() +routine takes an \fIentry\fP as returned by +.BR ldap_first_entry (3) +or +.BR ldap_next_entry (3) +and returns a copy of +the entry's DN. Space for the DN will be obtained dynamically +and should be freed by the caller using +.BR ldap_memfree (3). +.LP +.B ldap_str2dn() +parses a string representation of a distinguished name contained in +.B str +into its components, +which are stored in +.B dn +as +.B ldap_ava +structures, arranged in +.B LDAPAVA, +.B LDAPRDN, +and +.B LDAPDN +terms. Space for +.B dn +will be obtained dynamically and should be freed by the caller using +.BR ldap_dnfree (3). +The +.B LDAPDN +is defined as: +.nf +.ft B + +typedef struct ldap_ava { + struct berval la_attr; + struct berval la_value; + unsigned la_flags; +} LDAPAVA; + +typedef LDAPAVA** LDAPRDN; +typedef LDAPRDN* LDAPDN; + +.ft +.fi +The attribute types and the attribute values are not normalized. +The +.B la_flags +can be either +.B LDAP_AVA_STRING +or +.B LDAP_AVA_BINARY, +the latter meaning that the value is BER/DER encoded and thus must +be represented as, quoting from RFC 4514, " ... an +octothorpe character ('#' ASCII 35) followed by the hexadecimal +representation of each of the bytes of the BER encoding of the X.500 +AttributeValue." +The +.B flags +parameter to +.B ldap_str2dn() +can be +.LP +.nf + LDAP_DN_FORMAT_LDAPV3 + LDAP_DN_FORMAT_LDAPV2 + LDAP_DN_FORMAT_DCE + +.fi +which defines what DN syntax is expected (according to RFC 4514, +RFC 1779 and DCE, respectively). +The format can be \fIOR\fPed to the flags +.LP +.nf + LDAP_DN_P_NO_SPACES + LDAP_DN_P_NO_SPACE_AFTER_RDN + ... + LDAP_DN_PEDANTIC + +.fi +The latter is a shortcut for all the previous limitations. +.LP +.B LDAP_DN_P_NO_SPACES +does not allow extra spaces in the dn; the default is to silently +eliminate spaces around AVA separators ('='), RDN component separators +('+' for LDAPv3/LDAPv2 or ',' for DCE) and RDN separators +(',' LDAPv3/LDAPv2 or '/' for DCE). +.LP +.B LDAP_DN_P_NO_SPACE_AFTER_RDN +does not allow a single space after RDN separators. +.LP +.B ldap_dn2str() +performs the inverse operation, yielding in +.B str +a string representation of +.B dn. +It allows the same values for +.B flags +as +.B ldap_str2dn(), +plus +.LP +.nf + LDAP_DN_FORMAT_UFN + LDAP_DN_FORMAT_AD_CANONICAL + +.fi +for user-friendly naming (RFC 1781) and AD canonical. +.LP +The following routines are viewed as deprecated in favor of +.B ldap_str2dn() +and +.BR ldap_dn2str(). +They are provided to support legacy applications. +.LP +The +.B ldap_explode_dn() +routine takes a DN as returned by +.B ldap_get_dn() +and breaks it up into its component parts. Each part is known as a +Relative Distinguished Name, or RDN. +.B ldap_explode_dn() +returns a +NULL-terminated array, each component of which contains an RDN from the +DN. The \fInotypes\fP parameter is used to request that only the RDN +values be returned, not their types. For example, the DN "cn=Bob, +c=US" would return as either { "cn=Bob", "c=US", NULL } or { "Bob", +"US", NULL }, depending on whether notypes was 0 or 1, respectively. +Assertion values in RDN strings may included escaped characters. +The result can be freed by calling +.BR ldap_value_free (3). +.LP +Similarly, the +.B ldap_explode_rdn() +routine takes an RDN as returned by +.B ldap_explode_dn(dn,0) +and breaks it up into its "type=value" component parts (or just "value", +if the \fInotypes\fP parameter is set). Note the value is not +unescaped. The result can be freed by calling +.BR ldap_value_free (3). +.LP +.B ldap_dn2ufn() +is used to turn a DN as returned by +.BR ldap_get_dn (3) +into a more user-friendly form, stripping off all type names. See +"Using the Directory to Achieve User Friendly Naming" (RFC 1781) +for more details on the UFN format. Due to the ambiguous nature +of the format, it is generally only used for display purposes. +The space for the UFN returned is obtained dynamically and the user +is responsible for freeing it via a call to +.BR ldap_memfree (3). +.LP +.B ldap_dn2dcedn() +is used to turn a DN as returned by +.BR ldap_get_dn (3) +into a DCE-style DN, e.g. a string with most-significant to least +significant rdns separated by slashes ('/'); rdn components +are separated by commas (','). +Only printable chars (e.g. LDAPv2 printable string) are allowed, +at least in this implementation. +.B ldap_dcedn2dn() +performs the opposite operation. +.B ldap_dn2ad_canonical() +turns a DN into a AD canonical name, which is basically a DCE dn +with attribute types omitted. +The trailing domain, if present, is turned in a DNS-like domain. +The space for the returned value is obtained dynamically and the user +is responsible for freeing it via a call to +.BR ldap_memfree (3). +.SH ERRORS +If an error occurs in +.BR ldap_get_dn() , +NULL is returned and the +.B ld_errno +field in the \fIld\fP parameter is set to indicate the error. See +.BR ldap_error (3) +for a description of possible error codes. +.BR ldap_explode_dn() , +.BR ldap_explode_rdn() , +.B ldap_dn2ufn(), +.B ldap_dn2dcedn(), +.B ldap_dcedn2dn(), +and +.B ldap_dn2ad_canonical() +will return NULL with +.BR errno (3) +set appropriately in case of trouble. +.SH NOTES +These routines dynamically allocate memory that the caller must free. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_error (3), +.BR ldap_first_entry (3), +.BR ldap_memfree (3), +.BR ldap_value_free (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_get_dn.3.links b/doc/man/man3/ldap_get_dn.3.links new file mode 100644 index 0000000..4c71aa5 --- /dev/null +++ b/doc/man/man3/ldap_get_dn.3.links @@ -0,0 +1,9 @@ +ldap_explode_dn.3 +ldap_explode_rdn.3 +ldap_dn2ufn.3 +ldap_str2dn.3 +ldap_dnfree.3 +ldap_dn2str.3 +ldap_dn2dcedn.3 +ldap_dcedn2dn.3 +ldap_dn2ad_canonical.3 diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3 new file mode 100644 index 0000000..af5ede1 --- /dev/null +++ b/doc/man/man3/ldap_get_option.3 @@ -0,0 +1,810 @@ +.TH LDAP_GET_OPTION 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_get_option, ldap_set_option \- LDAP option handling routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.B #include <ldap.h> +.LP +.BI "int ldap_get_option(LDAP *" ld ", int " option ", void *" outvalue ");" +.LP +.BI "int ldap_set_option(LDAP *" ld ", int " option ", const void *" invalue ");" +.SH DESCRIPTION +.LP +These routines provide access to options stored either in a LDAP handle +or as global options, where applicable. +They make use of a neutral interface, where the type of the value +either retrieved by +.BR ldap_get_option (3) +or set by +.BR ldap_set_option (3) +is cast to +.BR "void *" . +The actual type is determined based on the value of the +.B option +argument. +Global options are set/retrieved by passing a NULL LDAP handle. LDAP handles +inherit their default settings from the global options in effect at the time +the handle is created. +.TP +.B LDAP_OPT_API_FEATURE_INFO +Fills-in a +.BR "LDAPAPIFeatureInfo" ; +.BR outvalue +must be a +.BR "LDAPAPIFeatureInfo *" , +pointing to an already allocated struct. +The +.B ldapaif_info_version +field of the struct must be initialized to +.B LDAP_FEATURE_INFO_VERSION +before making the call. The +.B ldapaif_name +field must be set to the name of a feature to query. +This is a read-only option. +.TP +.B LDAP_OPT_API_INFO +Fills-in a +.BR "LDAPAPIInfo" ; +.BR outvalue +must be a +.BR "LDAPAPIInfo *" , +pointing to an already allocated struct. The +.B ldapai_info_version +field of the struct must be initialized to +.B LDAP_API_INFO_VERSION +before making the call. +If the version passed in does not match the current library +version, the expected version number will be stored in the +struct and the call will fail. +The caller is responsible for freeing the elements of the +.B ldapai_extensions +array and the array itself using +.BR ldap_memfree (3). +The caller must also free the +.BR ldapi_vendor_name . +This is a read-only option. +.TP +.B LDAP_OPT_CLIENT_CONTROLS +Sets/gets the client-side controls to be used for all operations. +This is now deprecated as modern LDAP C API provides replacements +for all main operations which accepts client-side controls as +explicit arguments; see for example +.BR ldap_search_ext (3), +.BR ldap_add_ext (3), +.BR ldap_modify_ext (3) +and so on. +.BR outvalue +must be +.BR "LDAPControl ***" , +and the caller is responsible of freeing the returned controls, if any, +by calling +.BR ldap_controls_free (3), +while +.BR invalue +must be +.BR "LDAPControl *const *" ; +the library duplicates the controls passed via +.BR invalue . +.TP +.B LDAP_OPT_CONNECT_ASYNC +Sets/gets the status of the asynchronous connect flag. +.BR invalue +should either be +.BR LDAP_OPT_OFF +or +.BR LDAP_OPT_ON ; +.BR outvalue +must be +.BR "int *" . +When set, the library will call +.BR connect (2) +and return, without waiting for response. +This leaves the handle in a connecting state. +Subsequent calls to library routines will poll for completion +of the connect before performing further operations. +As a consequence, library calls that need to establish a connection +with a DSA do not block even for the network timeout +(option +.BR LDAP_OPT_NETWORK_TIMEOUT ). +This option is OpenLDAP specific. +.TP +.B LDAP_OPT_CONNECT_CB +This option allows to set a connect callback. +.B invalue +must be a +.BR "const struct ldap_conncb *" . +Callbacks are executed in last in-first served order. +Handle-specific callbacks are executed first, followed by global ones. +Right before freeing the callback structure, the +.B lc_del +callback handler is passed a +.B NULL +.BR Sockbuf . +Calling +.BR ldap_get_option (3) +for this option removes the callback whose pointer matches +.BR outvalue . +This option is OpenLDAP specific. +.TP +.B LDAP_OPT_DEBUG_LEVEL +Sets/gets the debug level of the client library. +.BR invalue +must be a +.BR "const int *" ; +.BR outvalue +must be a +.BR "int *" . +Valid debug levels are +.BR LDAP_DEBUG_ANY , +.BR LDAP_DEBUG_ARGS , +.BR LDAP_DEBUG_BER , +.BR LDAP_DEBUG_CONNS , +.BR LDAP_DEBUG_NONE , +.BR LDAP_DEBUG_PACKETS , +.BR LDAP_DEBUG_PARSE , +and +.BR LDAP_DEBUG_TRACE . +This option is OpenLDAP specific. +.TP +.B LDAP_OPT_DEFBASE +Sets/gets a string containing the DN to be used as default base +for search operations. +.BR outvalue +must be a +.BR "char **" , +and the caller is responsible of freeing the returned string by calling +.BR ldap_memfree (3), +while +.BR invalue +must be a +.BR "const char *" ; +the library duplicates the corresponding string. +This option is OpenLDAP specific. +.TP +.B LDAP_OPT_DEREF +Sets/gets the value that defines when alias dereferencing must occur. +.BR invalue +must be +.BR "const int *" ; +.BR outvalue +must be +.BR "int *" . +They cannot be NULL. +The value of +.BR *invalue +should be one of +.BR LDAP_DEREF_NEVER +(the default), +.BR LDAP_DEREF_SEARCHING , +.BR LDAP_DEREF_FINDING , +or +.BR LDAP_DEREF_ALWAYS . +Note that this has ever been the only means to determine alias dereferencing +within search operations. +.TP +.B LDAP_OPT_DESC +Returns the file descriptor associated to the socket buffer +of the LDAP handle passed in as +.BR ld ; +.BR outvalue +must be a +.BR "int *" . +This is a read-only, handle-specific option. +.TP +.B LDAP_OPT_DIAGNOSTIC_MESSAGE +Sets/gets a string containing the error string associated to the LDAP handle. +This option was formerly known as +.BR LDAP_OPT_ERROR_STRING . +.BR outvalue +must be a +.BR "char **" , +and the caller is responsible of freeing the returned string by calling +.BR ldap_memfree (3), +while +.BR invalue +must be a +.BR "char *" ; +the library duplicates the corresponding string. +.TP +.B LDAP_OPT_HOST_NAME +Sets/gets a space-separated list of hosts to be contacted by the library +when trying to establish a connection. +This is now deprecated in favor of +.BR LDAP_OPT_URI . +.BR outvalue +must be a +.BR "char **" , +and the caller is responsible of freeing the resulting string by calling +.BR ldap_memfree (3), +while +.BR invalue +must be a +.BR "const char *" ; +the library duplicates the corresponding string. +.TP +.B LDAP_OPT_MATCHED_DN +Sets/gets a string containing the matched DN associated to the LDAP handle. +.BR outvalue +must be a +.BR "char **" , +and the caller is responsible of freeing the returned string by calling +.BR ldap_memfree (3), +while +.BR invalue +must be a +.BR "const char *" ; +the library duplicates the corresponding string. +.TP +.B LDAP_OPT_NETWORK_TIMEOUT +Sets/gets the network timeout value after which +.BR poll (2)/ select (2) +following a +.BR connect (2) +returns in case of no activity. +.B outvalue +must be a +.BR "struct timeval **" +(the caller has to free +.BR *outvalue ) , +and +.B invalue +must be a +.BR "const struct timeval *" . +They cannot be NULL. Using a struct with seconds set to \-1 results +in an infinite timeout, which is the default. +This option is OpenLDAP specific. +.TP +.B LDAP_OPT_PROTOCOL_VERSION +Sets/gets the protocol version. +.BR outvalue +and +.BR invalue +must be +.BR "int *" . +.TP +.B LDAP_OPT_REFERRAL_URLS +Sets/gets an array containing the referral URIs associated to the LDAP handle. +.BR outvalue +must be a +.BR "char ***" , +and the caller is responsible of freeing the returned string by calling +.BR ldap_memvfree (3), +while +.BR invalue +must be a NULL-terminated +.BR "char *const *" ; +the library duplicates the corresponding string. +This option is OpenLDAP specific. +.TP +.B LDAP_OPT_REFERRALS +Determines whether the library should implicitly chase referrals or not. +.BR invalue +must be +.BR "const int *" ; +its value should either be +.BR LDAP_OPT_OFF +or +.BR LDAP_OPT_ON . +.BR outvalue +must be +.BR "int *" . +.\".TP +.\".B LDAP_OPT_REFHOPLIMIT +.\"This option is OpenLDAP specific. +.\"It is not currently implemented. +.TP +.B LDAP_OPT_RESTART +Determines whether the library should implicitly restart connections (FIXME). +.BR invalue +must be +.BR "const int *" ; +its value should either be +.BR LDAP_OPT_OFF +or +.BR LDAP_OPT_ON . +.BR outvalue +must be +.BR "int *" . +.TP +.B LDAP_OPT_RESULT_CODE +Sets/gets the LDAP result code associated to the handle. +This option was formerly known as +.BR LDAP_OPT_ERROR_NUMBER . +.BR invalue +must be a +.BR "const int *" . +.BR outvalue +must be a +.BR "int *" . +.TP +.B LDAP_OPT_SERVER_CONTROLS +Sets/gets the server-side controls to be used for all operations. +This is now deprecated as modern LDAP C API provides replacements +for all main operations which accepts server-side controls as +explicit arguments; see for example +.BR ldap_search_ext (3), +.BR ldap_add_ext (3), +.BR ldap_modify_ext (3) +and so on. +.BR outvalue +must be +.BR "LDAPControl ***" , +and the caller is responsible of freeing the returned controls, if any, +by calling +.BR ldap_controls_free (3), +while +.BR invalue +must be +.BR "LDAPControl *const *" ; +the library duplicates the controls passed via +.BR invalue . +.TP +.B LDAP_OPT_SESSION_REFCNT +Returns the reference count associated with the LDAP handle passed in as +.BR ld ; +.BR outvalue +must be a +.BR "int *" . +This is a read-only, handle-specific option. +This option is OpenLDAP specific. +.TP +.B LDAP_OPT_SIZELIMIT +Sets/gets the value that defines the maximum number of entries +to be returned by a search operation. +.BR invalue +must be +.BR "const int *" , +while +.BR outvalue +must be +.BR "int *" ; +They cannot be NULL. +.TP +.B LDAP_OPT_SOCKBUF +Returns a pointer to the socket buffer of the LDAP handle passed in as +.BR ld ; +.BR outvalue +must be a +.BR "Sockbuf **" . +This is a read-only, handle-specific option. +This option is OpenLDAP specific. +.TP +.B LDAP_OPT_TIMELIMIT +Sets/gets the value that defines the time limit after which +a search operation should be terminated by the server. +.BR invalue +must be +.BR "const int *" , +while +.BR outvalue +must be +.BR "int *" , +and they cannot be NULL. +.TP +.B LDAP_OPT_TIMEOUT +Sets/gets a timeout value for the synchronous API calls. +.B outvalue +must be a +.BR "struct timeval **" +(the caller has to free +.BR *outvalue ) , +and +.B invalue +must be a +.BR "struct timeval *" , +and they cannot be NULL. Using a struct with seconds set to \-1 results +in an infinite timeout, which is the default. +This option is OpenLDAP specific. +.TP +.B LDAP_OPT_URI +Sets/gets a comma- or space-separated list of URIs to be contacted by the library +when trying to establish a connection. +.BR outvalue +must be a +.BR "char **" , +and the caller is responsible of freeing the resulting string by calling +.BR ldap_memfree (3), +while +.BR invalue +must be a +.BR "const char *" ; +the library parses the string into a list of +.BR LDAPURLDesc +structures, so the invocation of +.BR ldap_set_option (3) +may fail if URL parsing fails. +URIs may only contain the +.BR schema , +the +.BR host , +and the +.BR port +fields. +This option is OpenLDAP specific. +.SH SASL OPTIONS +The SASL options are OpenLDAP specific. +.TP +.B LDAP_OPT_X_SASL_AUTHCID +Gets the SASL authentication identity; +.BR outvalue +must be a +.BR "char **" , +its content needs to be freed by the caller using +.BR ldap_memfree (3). +.TP +.B LDAP_OPT_X_SASL_AUTHZID +Gets the SASL authorization identity; +.BR outvalue +must be a +.BR "char **" , +its content needs to be freed by the caller using +.BR ldap_memfree (3). +.TP +.B LDAP_OPT_X_SASL_MAXBUFSIZE +Gets/sets SASL maximum buffer size; +.BR invalue +must be +.BR "const ber_len_t *" , +while +.BR outvalue +must be +.BR "ber_len_t *" . +See also +.BR LDAP_OPT_X_SASL_SECPROPS . +.TP +.B LDAP_OPT_X_SASL_MECH +Gets the SASL mechanism; +.BR outvalue +must be a +.BR "char **" , +its content needs to be freed by the caller using +.BR ldap_memfree (3). +.TP +.B LDAP_OPT_X_SASL_MECHLIST +Gets the list of the available mechanisms, +in form of a NULL-terminated array of strings; +.BR outvalue +must be +.BR "char ***" . +The caller must not free or otherwise muck with it. +.TP +.B LDAP_OPT_X_SASL_NOCANON +Sets/gets the NOCANON flag. +When unset, the hostname is canonicalized. +.BR invalue +must be +.BR "const int *" ; +its value should either be +.BR LDAP_OPT_OFF +or +.BR LDAP_OPT_ON . +.BR outvalue +must be +.BR "int *" . +.TP +.B LDAP_OPT_X_SASL_REALM +Gets the SASL realm; +.BR outvalue +must be a +.BR "char **" , +its content needs to be freed by the caller using +.BR ldap_memfree (3). +.TP +.B LDAP_OPT_X_SASL_SECPROPS +Sets the SASL secprops; +.BR invalue +must be a +.BR "char *" , +containing a comma-separated list of properties. +Legal values are: +.BR none , +.BR nodict , +.BR noplain , +.BR noactive , +.BR passcred , +.BR forwardsec , +.BR noanonymous , +.BR minssf=<minssf> , +.BR maxssf=<maxssf> , +.BR maxbufsize=<maxbufsize> . +.TP +.B LDAP_OPT_X_SASL_SSF +Gets the SASL SSF; +.BR outvalue +must be a +.BR "ber_len_t *" . +.TP +.B LDAP_OPT_X_SASL_SSF_EXTERNAL +Sets the SASL SSF value related to an authentication +performed using an EXTERNAL mechanism; +.BR invalue +must be a +.BR "const ber_len_t *" . +.TP +.B LDAP_OPT_X_SASL_SSF_MAX +Gets/sets SASL maximum SSF; +.BR invalue +must be +.BR "const ber_len_t *" , +while +.BR outvalue +must be +.BR "ber_len_t *" . +See also +.BR LDAP_OPT_X_SASL_SECPROPS . +.TP +.B LDAP_OPT_X_SASL_SSF_MIN +Gets/sets SASL minimum SSF; +.BR invalue +must be +.BR "const ber_len_t *" , +while +.BR outvalue +must be +.BR "ber_len_t *" . +See also +.BR LDAP_OPT_X_SASL_SECPROPS . +.TP +.B LDAP_OPT_X_SASL_USERNAME +Gets the SASL username; +.BR outvalue +must be a +.BR "char **" . +Its content needs to be freed by the caller using +.BR ldap_memfree (3). +.SH TCP OPTIONS +The TCP options are OpenLDAP specific. +Mainly intended for use with Linux, they may not be portable. +.TP +.B LDAP_OPT_X_KEEPALIVE_IDLE +Sets/gets the number of seconds a connection needs to remain idle +before TCP starts sending keepalive probes. +.BR invalue +must be +.BR "const int *" ; +.BR outvalue +must be +.BR "int *" . +.TP +.B LDAP_OPT_X_KEEPALIVE_PROBES +Sets/gets the maximum number of keepalive probes TCP should send +before dropping the connection. +.BR invalue +must be +.BR "const int *" ; +.BR outvalue +must be +.BR "int *" . +.TP +.B LDAP_OPT_X_KEEPALIVE_INTERVAL +Sets/gets the interval in seconds between individual keepalive probes. +.BR invalue +must be +.BR "const int *" ; +.BR outvalue +must be +.BR "int *" . +.SH TLS OPTIONS +The TLS options are OpenLDAP specific. +.\".TP +.\".B LDAP_OPT_X_TLS +.\"Sets/gets the TLS mode. +.TP +.B LDAP_OPT_X_TLS_CACERTDIR +Sets/gets the path of the directory containing CA certificates. +.BR invalue +must be +.BR "const char *" ; +.BR outvalue +must be +.BR "char **" , +and its contents need to be freed by the caller using +.BR ldap_memfree (3). +.TP +.B LDAP_OPT_X_TLS_CACERTFILE +Sets/gets the full-path of the CA certificate file. +.BR invalue +must be +.BR "const char *" ; +.BR outvalue +must be +.BR "char **" , +and its contents need to be freed by the caller using +.BR ldap_memfree (3). +.TP +.B LDAP_OPT_X_TLS_CERTFILE +Sets/gets the full-path of the certificate file. +.BR invalue +must be +.BR "const char *" ; +.BR outvalue +must be +.BR "char **" , +and its contents need to be freed by the caller using +.BR ldap_memfree (3). +.TP +.B LDAP_OPT_X_TLS_CIPHER_SUITE +Sets/gets the allowed cipher suite. +.BR invalue +must be +.BR "const char *" ; +.BR outvalue +must be +.BR "char **" , +and its contents need to be freed by the caller using +.BR ldap_memfree (3). +.TP +.B LDAP_OPT_X_TLS_CONNECT_ARG +Sets/gets the connection callback argument. +.BR invalue +must be +.BR "const void *" ; +.BR outvalue +must be +.BR "void **" . +.TP +.B LDAP_OPT_X_TLS_CONNECT_CB +Sets/gets the connection callback handle. +.BR invalue +must be +.BR "const LDAP_TLS_CONNECT_CB *" ; +.BR outvalue +must be +.BR "LDAP_TLS_CONNECT_CB **" . +.TP +.B LDAP_OPT_X_TLS_CRLCHECK +Sets/gets the CRL evaluation strategy, one of +.BR LDAP_OPT_X_TLS_CRL_NONE , +.BR LDAP_OPT_X_TLS_CRL_PEER , +or +.BR LDAP_OPT_X_TLS_CRL_ALL . +.BR invalue +must be +.BR "const int *" ; +.BR outvalue +must be +.BR "int *" . +Requires OpenSSL. +.TP +.B LDAP_OPT_X_TLS_CRLFILE +Sets/gets the full-path of the CRL file. +.BR invalue +must be +.BR "const char *" ; +.BR outvalue +must be +.BR "char **" , +and its contents need to be freed by the caller using +.BR ldap_memfree (3). +This option is only valid for GnuTLS. +.TP +.B LDAP_OPT_X_TLS_CTX +Sets/gets the TLS library context. New TLS sessions will inherit their +default settings from this library context. +.BR invalue +must be +.BR "const void *" ; +.BR outvalue +must be +.BR "void **" . +When using the OpenSSL library this is an SSL_CTX*. When using other +crypto libraries this is a pointer to an OpenLDAP private structure. +Applications generally should not use this option or attempt to +manipulate this structure. +.TP +.B LDAP_OPT_X_TLS_DHFILE +Gets/sets the full-path of the file containing the parameters +for Diffie-Hellman ephemeral key exchange. +.BR invalue +must be +.BR "const char *" ; +.BR outvalue +must be +.BR "char **" , +and its contents need to be freed by the caller using +.BR ldap_memfree (3). +Ignored by GnuTLS and Mozilla NSS. +.TP +.B LDAP_OPT_X_TLS_KEYFILE +Sets/gets the full-path of the certificate key file. +.BR invalue +must be +.BR "const char *" ; +.BR outvalue +must be +.BR "char **" , +and its contents need to be freed by the caller using +.BR ldap_memfree (3). +.TP +.B LDAP_OPT_X_TLS_NEWCTX +Instructs the library to create a new TLS library context. +.BR invalue +must be +.BR "const int *" . +A non-zero value pointed to by +.BR invalue +tells the library to create a context for a server. +.TP +.B LDAP_OPT_X_TLS_PROTOCOL_MIN +Sets/gets the minimum protocol version. +.BR invalue +must be +.BR "const int *" ; +.BR outvalue +must be +.BR "int *" . +.TP +.B LDAP_OPT_X_TLS_RANDOM_FILE +Sets/gets the random file when +.B /dev/random +and +.B /dev/urandom +are not available. +.BR invalue +must be +.BR "const char *" ; +.BR outvalue +must be +.BR "char **" , +and its contents need to be freed by the caller using +.BR ldap_memfree (3). +Ignored by GnuTLS older than version 2.2. Ignored by Mozilla NSS. +.TP +.B LDAP_OPT_X_TLS_REQUIRE_CERT +Sets/gets the peer certificate checking strategy, +one of +.BR LDAP_OPT_X_TLS_NEVER , +.BR LDAP_OPT_X_TLS_HARD , +.BR LDAP_OPT_X_TLS_DEMAND , +.BR LDAP_OPT_X_TLS_ALLOW , +.BR LDAP_OPT_X_TLS_TRY . +.TP +.B LDAP_OPT_X_TLS_SSL_CTX +Gets the TLS session context associated with this handle. +.BR outvalue +must be +.BR "void **" . +When using the OpenSSL library this is an SSL*. When using other +crypto libraries this is a pointer to an OpenLDAP private structure. +Applications generally should not use this option. +.SH ERRORS +On success, the functions return +.BR LDAP_OPT_SUCCESS , +while they may return +.B LDAP_OPT_ERROR +to indicate a generic option handling error. +Occasionally, more specific errors can be returned, like +.B LDAP_NO_MEMORY +to indicate a failure in memory allocation. +.SH NOTES +The LDAP libraries with the +.B LDAP_OPT_REFERRALS +option set to +.B LDAP_OPT_ON +(default value) automatically follow referrals using an anonymous bind. +Application developers are encouraged to either implement consistent +referral chasing features, or explicitly disable referral chasing +by setting that option to +.BR LDAP_OPT_OFF . +.P +The protocol version used by the library defaults to LDAPv2 (now historic), +which corresponds to the +.B LDAP_VERSION2 +macro. +Application developers are encouraged to explicitly set +.B LDAP_OPT_PROTOCOL_VERSION +to LDAPv3, using the +.B LDAP_VERSION3 +macro, or to allow users to select the protocol version. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_error (3), +.B RFC 4422 +(http://www.rfc-editor.org), +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_get_option.3.links b/doc/man/man3/ldap_get_option.3.links new file mode 100644 index 0000000..9105ef0 --- /dev/null +++ b/doc/man/man3/ldap_get_option.3.links @@ -0,0 +1 @@ +ldap_set_option.3 diff --git a/doc/man/man3/ldap_get_values.3 b/doc/man/man3/ldap_get_values.3 new file mode 100644 index 0000000..30d5f5c --- /dev/null +++ b/doc/man/man3/ldap_get_values.3 @@ -0,0 +1,102 @@ +.TH LDAP_GET_VALUES 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_get_values, ldap_get_values_len, ldap_count_values \- LDAP attribute value handling routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> + +.LP +.ft B +char **ldap_get_values(ld, entry, attr) +.ft +LDAP *ld; +LDAPMessage *entry; +char *attr; +.LP +.ft B +struct berval **ldap_get_values_len(ld, entry, attr) +.ft +LDAP *ld; +LDAPMessage *entry; +char *attr; +.LP +.ft B +int ldap_count_values(vals) +.ft +char **vals; +.LP +.ft B +int ldap_count_values_len(vals) +.ft +struct berval **vals; +.LP +.ft B +void ldap_value_free(vals) +.ft +char **vals; +.LP +.ft B +void ldap_value_free_len(vals) +.ft +struct berval **vals; +.SH DESCRIPTION +These routines are used to retrieve and manipulate attribute values +from an LDAP entry as returned by +.BR ldap_first_entry (3) +or +.BR ldap_next_entry (3). +.B ldap_get_values() +takes the \fIentry\fP and the attribute \fIattr\fP +whose values are desired and returns a NULL-terminated array of the +attribute's values. \fIattr\fP may be an attribute type as returned +from +.BR ldap_first_attribute (3) +or +.BR ldap_next_attribute (3), +or if the attribute type is known it can simply be given. +.LP +The number of values in the array can be counted by calling +.BR ldap_count_values() . +The array of values returned can be freed by calling +.BR ldap_value_free() . +.LP +If the attribute values are binary in nature, and thus not suitable +to be returned as an array of char *'s, the +.B ldap_get_values_len() +routine can be used instead. It takes the same parameters as +.BR ldap_get_values() , +but returns a NULL-terminated array of pointers +to berval structures, each containing the length of and a pointer +to a value. +.LP +The number of values in the array can be counted by calling +.BR ldap_count_values_len() . +The array of values returned can be freed by calling +.BR ldap_value_free_len() . +.SH ERRORS +If an error occurs in +.B ldap_get_values() +or +.BR ldap_get_values_len() , +NULL is returned and the +.B ld_errno +field in the \fIld\fP parameter is set to +indicate the error. See +.BR ldap_error (3) +for a description of possible error codes. +.SH NOTES +These routines dynamically allocate memory which the caller must free +using the supplied routines. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_first_entry (3), +.BR ldap_first_attribute (3), +.BR ldap_error (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_get_values.3.links b/doc/man/man3/ldap_get_values.3.links new file mode 100644 index 0000000..ac2b454 --- /dev/null +++ b/doc/man/man3/ldap_get_values.3.links @@ -0,0 +1,5 @@ +ldap_get_values_len.3 +ldap_value_free.3 +ldap_value_free_len.3 +ldap_count_values.3 +ldap_count_values_len.3 diff --git a/doc/man/man3/ldap_memory.3 b/doc/man/man3/ldap_memory.3 new file mode 100644 index 0000000..2c31119 --- /dev/null +++ b/doc/man/man3/ldap_memory.3 @@ -0,0 +1,50 @@ +.TH LDAP_MEMORY 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_memfree, ldap_memvfree, ldap_memalloc, ldap_memcalloc, ldap_memrealloc, ldap_strdup \- LDAP memory allocation routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.B #include <ldap.h> +.LP +.BI "void ldap_memfree(void *" p ");" +.LP +.BI "void ldap_memvfree(void **" v ");" +.LP +.BI "void *ldap_memalloc(ber_len_t " s ");" +.LP +.BI "void *ldap_memcalloc(ber_len_t " n ", ber_len_t " s ");" +.LP +.BI "void *ldap_memrealloc(void *" p ", ber_len_t " s ");" +.LP +.BI "char *ldap_strdup(LDAP_CONST char *" p ");" +.SH DESCRIPTION +These routines are used to allocate/deallocate memory used/returned +by the LDAP library. +.BR ldap_memalloc (), +.BR ldap_memcalloc (), +.BR ldap_memrealloc (), +and +.BR ldap_memfree () +are used exactly like the standard +.BR malloc (3), +.BR calloc (3), +.BR realloc (3), +and +.BR free (3) +routines, respectively. +The +.BR ldap_memvfree () +routine is used to free a dynamically allocated array of pointers to +arbitrary dynamically allocated objects. +The +.BR ldap_strdup () +routine is used exactly like the standard +.BR strdup (3) +routine. +.SH SEE ALSO +.BR ldap (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_memory.3.links b/doc/man/man3/ldap_memory.3.links new file mode 100644 index 0000000..9351ff1 --- /dev/null +++ b/doc/man/man3/ldap_memory.3.links @@ -0,0 +1,6 @@ +ldap_memfree.3 +ldap_memvfree.3 +ldap_memalloc.3 +ldap_memcalloc.3 +ldap_memrealloc.3 +ldap_strdup.3 diff --git a/doc/man/man3/ldap_modify.3 b/doc/man/man3/ldap_modify.3 new file mode 100644 index 0000000..7bd2f77 --- /dev/null +++ b/doc/man/man3/ldap_modify.3 @@ -0,0 +1,137 @@ +.TH LDAP_MODIFY 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_modify_ext, ldap_modify_ext_s \- Perform an LDAP modify operation +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_modify_ext( +.RS +.ft B +LDAP *\fIld\fB, +char *\fIdn\fB, +LDAPMod *\fImods[]\fB, +LDAPControl **\fIsctrls\fB, +LDAPControl **\fIcctrls\fB, +int *\fImsgidp\fB ); +.RE +.LP +.nf +.ft B +int ldap_modify_ext_s( +.RS +.ft B +LDAP *\fIld\fB, +char *\fIdn\fB, +LDAPMod *\fImods[]\fB, +LDAPControl **\fIsctrls\fB, +LDAPControl **\fIcctrls\fB ); +.RE +.LP +.nf +.ft B +void ldap_mods_free( +.RS +.ft B +LDAPMod **\fImods\fB, +int \fIfreemods\fB ); +.RE +.SH DESCRIPTION +The routine +.B ldap_modify_ext_s() +is used to perform an LDAP modify operation. +\fIdn\fP is the DN of the entry to modify, and \fImods\fP is a +null-terminated array of modifications to make to the entry. Each element +of the \fImods\fP array is a pointer to an LDAPMod structure, which is +defined below. +.LP +.nf + typedef struct ldapmod { + int mod_op; + char *mod_type; + union { + char **modv_strvals; + struct berval **modv_bvals; + } mod_vals; + struct ldapmod *mod_next; + } LDAPMod; + #define mod_values mod_vals.modv_strvals + #define mod_bvalues mod_vals.modv_bvals +.ft +.fi +.LP +The \fImod_op\fP field is used to specify the type of modification to +perform and should be one of LDAP_MOD_ADD, LDAP_MOD_DELETE, or +LDAP_MOD_REPLACE. The \fImod_type\fP and \fImod_values\fP fields +specify the attribute type to modify and a null-terminated array of +values to add, delete, or replace respectively. The \fImod_next\fP +field is used only by the LDAP server and may be ignored by the +client. +.LP +If you need to specify a non-string value (e.g., to add a +photo or audio attribute value), you should set \fImod_op\fP to the +logical OR of the operation as above (e.g., LDAP_MOD_REPLACE) +and the constant LDAP_MOD_BVALUES. In this case, \fImod_bvalues\fP +should be used instead of \fImod_values\fP, and it should point to +a null-terminated array of struct bervals, as defined in <lber.h>. +.LP +For LDAP_MOD_ADD modifications, the given values are added to the +entry, creating the attribute if necessary. For LDAP_MOD_DELETE +modifications, the given values are deleted from the entry, removing +the attribute if no values remain. If the entire attribute is to be deleted, +the \fImod_values\fP field should be set to NULL. For LDAP_MOD_REPLACE +modifications, the attribute will have the listed values after the +modification, having been created if necessary. All modifications are +performed in the order in which they are listed. +.LP +.B ldap_mods_free() +can be used to free each element of a NULL-terminated +array of mod structures. If \fIfreemods\fP is non-zero, the +\fImods\fP pointer itself is freed as well. +.LP +.B ldap_modify_ext_s() +returns a code indicating success or, in the case of failure, +indicating the nature of the failure. See +.BR ldap_error (3) +for details +.LP +The +.B ldap_modify_ext() +operation works the same way as +.BR ldap_modify_ext_s() , +except that it is asynchronous. The integer that \fImsgidp\fP points +to is set to the message id of the modify request. The result of +the operation can be obtained by calling +.BR ldap_result (3). +.LP +Both +.B ldap_modify_ext() +and +.B ldap_modify_ext_s() +allows server and client controls to be passed in +via the sctrls and cctrls parameters, respectively. +.SH DEPRECATED INTERFACES +The +.B ldap_modify() +and +.B ldap_modify_s() +routines are deprecated in favor of the +.B ldap_modify_ext() +and +.B ldap_modify_ext_s() +routines, respectively. +.LP +.so Deprecated +.SH SEE ALSO +.BR ldap (3), +.BR ldap_error (3), +.SH ACKNOWLEDGEMENTS +.so ../Project + diff --git a/doc/man/man3/ldap_modify.3.links b/doc/man/man3/ldap_modify.3.links new file mode 100644 index 0000000..81c6f2a --- /dev/null +++ b/doc/man/man3/ldap_modify.3.links @@ -0,0 +1,4 @@ +ldap_modify_s.3 +ldap_modify_ext.3 +ldap_modify_ext_s.3 +ldap_mods_free.3 diff --git a/doc/man/man3/ldap_modrdn.3 b/doc/man/man3/ldap_modrdn.3 new file mode 100644 index 0000000..1f9d4f2 --- /dev/null +++ b/doc/man/man3/ldap_modrdn.3 @@ -0,0 +1,81 @@ +.TH LDAP_MODRDN 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_modrdn, ldap_modrdn_s, ldap_modrdn2, ldap_modrdn2_s \- Perform an LDAP modify RDN operation +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_modrdn(ld, dn, newrdn) +.ft +LDAP \(**ld; +char \(**dn, \(**newrdn; +.LP +.ft B +.LP +.ft B +int ldap_modrdn_s(ld, dn, newrdn) +.ft +LDAP \(**ld; +char \(**dn, \(**newrdn; +.LP +.ft B +int ldap_modrdn2(ld, dn, newrdn, deleteoldrdn) +.ft +LDAP \(**ld; +char \(**dn, \(**newrdn; +int deleteoldrdn; +.LP +.ft B +int ldap_modrdn2_s(ld, dn, newrdn, deleteoldrdn) +.ft +LDAP \(**ld; +char \(**dn, \(**newrdn; +int deleteoldrdn; +.SH DESCRIPTION +The +.B ldap_modrdn() +and +.B ldap_modrdn_s() +routines perform an LDAP modify +RDN operation. They both take \fIdn\fP, the DN of the entry whose +RDN is to be changed, and \fInewrdn\fP, the new RDN to give the entry. +The old RDN of the entry is never kept as an attribute of the entry. +.B ldap_modrdn() +is asynchronous, returning the message id of the operation +it initiates. +.B ldap_modrdn_s() +is synchronous, returning the LDAP error +code indicating the success or failure of the operation. Use of +these routines is deprecated. Use the versions described below +instead. +.LP +The +.B ldap_modrdn2() +and +.B ldap_modrdn2_s() +routines also perform an LDAP +modify RDN operation, taking the same parameters as above. In addition, +they both take the \fIdeleteoldrdn\fP parameter which is used as a boolean +value to indicate whether the old RDN values should be deleted from +the entry or not. +.SH ERRORS +The synchronous (_s) versions of these routines return an LDAP error +code, either LDAP_SUCCESS or an error if there was trouble. +The asynchronous versions return \-1 in case +of trouble, setting the +.B ld_errno +field of \fIld\fP. See +.BR ldap_error (3) +for more details. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_error (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_modrdn.3.links b/doc/man/man3/ldap_modrdn.3.links new file mode 100644 index 0000000..86063e2 --- /dev/null +++ b/doc/man/man3/ldap_modrdn.3.links @@ -0,0 +1,3 @@ +ldap_modrdn_s.3 +ldap_modrdn2.3 +ldap_modrdn2_s.3 diff --git a/doc/man/man3/ldap_open.3 b/doc/man/man3/ldap_open.3 new file mode 100644 index 0000000..443ec92 --- /dev/null +++ b/doc/man/man3/ldap_open.3 @@ -0,0 +1,225 @@ +.TH LDAP_OPEN 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_init, ldap_initialize, ldap_open \- Initialize the LDAP library and open a connection to an LDAP server +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +LDAP *ldap_open(host, port) +.ft +char *host; +int port; +.LP +.ft B +LDAP *ldap_init(host, port) +.ft +char *host; +int port; +.LP +.ft B +int ldap_initialize(ldp, uri) +.ft +LDAP **ldp; +char *uri; +.LP +.ft B +int ldap_set_urllist_proc(ld, proc, params) +.ft +LDAP *ld; +LDAP_URLLIST_PROC *proc; +void *params; +.LP +.ft B +int (LDAP_URLLIST_PROC)(ld, urllist, url, params); +.ft +LDAP *ld; +LDAPURLDesc **urllist; +LDAPURLDesc **url; +void *params; +.LP +.ft B +#include <ldap_pvt.h> +.LP +.ft B +int ldap_init_fd(fd, proto, uri, ldp) +.ft +ber_socket_t fd; +int proto; +char *uri; +LDAP **ldp; +.SH DESCRIPTION +.LP +.B ldap_open() +opens a connection to an LDAP server and allocates an LDAP +structure which is used to identify +the connection and to maintain per-connection information. +.B ldap_init() +allocates an LDAP structure but does not open an initial connection. +.B ldap_initialize() +allocates an LDAP structure but does not open an initial connection. +.B ldap_init_fd() +allocates an LDAP structure using an existing connection on the +provided socket. +One +of these routines must be called before any operations are attempted. +.LP +.B ldap_open() +takes \fIhost\fP, the hostname on which the LDAP server is +running, and \fIport\fP, the port number to which to connect. If the default +IANA-assigned port of 389 is desired, LDAP_PORT should be specified for +\fIport\fP. The \fIhost\fP parameter may contain a blank-separated list +of hosts to try to connect to, and each host may optionally by of the form +\fIhost:port\fP. If present, the \fI:port\fP overrides the \fIport\fP +parameter to +.BR ldap_open() . +Upon successfully making a connection to an +LDAP server, +.B ldap_open() +returns a pointer to an opaque LDAP structure, which should be passed +to subsequent calls to +.BR ldap_bind() , +.BR ldap_search() , +etc. Certain fields in the LDAP structure can be set to indicate size limit, +time limit, and how aliases are handled during operations; read and write access +to those fields must occur by calling +.BR ldap_get_option (3) +and +.BR ldap_set_option (3) +respectively, whenever possible. +.LP +.B +ldap_init() +acts just like +.BR ldap_open() , +but does not open a connection +to the LDAP server. The actual connection open will occur when the +first operation is attempted. +.LP +.B ldap_initialize() +acts like +.BR ldap_init() , +but it returns an integer indicating either success or the failure reason, +and it allows to specify details for the connection in the schema portion +of the URI. +The +.I uri +parameter may be a comma- or whitespace-separated list of URIs +containing only the +.IR schema , +the +.IR host , +and the +.I port +fields. +Apart from +.BR ldap , +other (non-standard) recognized values of the +.I schema +field are +.B ldaps +(LDAP over TLS), +.B ldapi +(LDAP over IPC), +and +.B cldap +(connectionless LDAP). +If other fields are present, the behavior is undefined. +.LP +At this time, +.B ldap_open() +and +.B ldap_init() +are deprecated in favor of +.BR ldap_initialize() , +essentially because the latter allows to specify a schema in the URI +and it explicitly returns an error code. +.LP +.B ldap_init_fd() +allows an LDAP structure to be initialized using an already-opened +connection. The +.I proto +parameter should be one of LDAP_PROTO_TCP, LDAP_PROTO_UDP, +or LDAP_PROTO_IPC +for a connection using TCP, UDP, or IPC, respectively. The value +LDAP_PROTO_EXT +may also be specified if user-supplied sockbuf handlers are going to +be used. Note that support for UDP is not implemented unless libldap +was built with LDAP_CONNECTIONLESS defined. +The +.I uri +parameter may optionally be provided for informational purposes. +.LP +.B ldap_set_urllist_proc() +allows to set a function +.I proc +of type +.I LDAP_URLLIST_PROC +that is called when a successful connection can be established. +This function receives the list of URIs parsed from the +.I uri +string originally passed to +.BR ldap_initialize() , +and the one that successfully connected. +The function may manipulate the URI list; the typical use consists +in moving the successful URI to the head of the list, +so that subsequent attempts to connect to one of the URIs using the same LDAP handle +will try it first. +If +.I ld +is null, +.I proc +is set as a global parameter that is inherited by all handlers +within the process that are created after the call to +.BR ldap_set_urllist_proc() . +By default, no +.I LDAP_URLLIST_PROC +is set. +In a multithreaded environment, +.B ldap_set_urllist_proc() +must be called before any concurrent operation using the LDAP handle is started. + +Note: the first call into the LDAP library also initializes the global +options for the library. As such the first call should be single-threaded +or otherwise protected to insure that only one call is active. It is +recommended that +.BR ldap_get_option () +or +.BR ldap_set_option () +be used in the program's main thread before any additional threads are created. +See +.BR ldap_get_option (3). + +.SH ERRORS +If an error occurs, +.B ldap_open() +and +.B ldap_init() +will return NULL and +.I errno +should be set appropriately. +.B ldap_initialize() +and +.B ldap_init_fd() +will directly return the LDAP code associated to the error (or +.I LDAP_SUCCESS +in case of success); +.I errno +should be set as well whenever appropriate. +.B ldap_set_urllist_proc() +returns LDAP_OPT_ERROR on error, and LDAP_OPT_SUCCESS on success. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_bind (3), +.BR ldap_get_option (3), +.BR ldap_set_option (3), +.BR lber-sockbuf (3), +.BR errno (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_open.3.links b/doc/man/man3/ldap_open.3.links new file mode 100644 index 0000000..aa34ab7 --- /dev/null +++ b/doc/man/man3/ldap_open.3.links @@ -0,0 +1,4 @@ +ldap_init.3 +ldap_initialize.3 +ldap_set_urllist_proc.3 +ldap_init_fd.3 diff --git a/doc/man/man3/ldap_parse_reference.3 b/doc/man/man3/ldap_parse_reference.3 new file mode 100644 index 0000000..53d63fb --- /dev/null +++ b/doc/man/man3/ldap_parse_reference.3 @@ -0,0 +1,61 @@ +.TH LDAP_PARSE_REFERENCE 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_parse_reference \- Extract referrals and controls from a reference message +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_parse_reference( LDAP *ld, LDAPMessage *reference, + char ***referralsp, LDAPControl ***serverctrlsp, + int freeit ) +.SH DESCRIPTION +.LP +The +.B ldap_parse_reference() +routine is used to extract referrals and controls from a reference message. +The \fIreference\fP parameter is a reference message as returned by a +call to +.BR ldap_first_reference (3) , +.BR ldap_next_reference (3) , +.BR ldap_first_message (3) , +.BR ldap_next_message (3) , +or +.BR ldap_result (3) . +.LP +The \fIreferralsp\fP parameter will be filled in with an allocated array of +character strings. The strings are copies of the referrals contained in +the parsed message. The array should be freed by calling +.BR ldap_value_free (3) . +If \fIreferralsp\fP is NULL, no referrals are returned. +If no referrals were returned, \fI*referralsp\fP is set to NULL. +.LP +The \fIserverctrlsp\fP parameter will be filled in with an allocated array of +controls copied from the parsed message. The array should be freed by calling +.BR ldap_controls_free (3). +If \fIserverctrlsp\fP is NULL, no controls are returned. +If no controls were returned, \fI*serverctrlsp\fP is set to NULL. +.LP +The \fIfreeit\fP parameter determines whether the parsed message is +freed or not after the extraction. Any non-zero value will make it +free the message. The +.BR ldap_msgfree (3) +routine can also be used to free the message later. +.SH ERRORS +Upon success LDAP_SUCCESS is returned. Otherwise the values of the +\fIreferralsp\fP and \fIserverctrlsp\fP parameters are undefined. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_first_reference (3), +.BR ldap_first_message (3), +.BR ldap_result (3), +.BR ldap_get_values (3), +.BR ldap_controls_free (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_parse_result.3 b/doc/man/man3/ldap_parse_result.3 new file mode 100644 index 0000000..2fefa9e --- /dev/null +++ b/doc/man/man3/ldap_parse_result.3 @@ -0,0 +1,107 @@ +.TH LDAP_PARSE_RESULT 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_parse_result \- Parsing results +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_parse_result( LDAP *ld, LDAPMessage *result, + int *errcodep, char **matcheddnp, char **errmsgp, + char ***referralsp, LDAPControl ***serverctrlsp, + int freeit ) +.LP +.ft B +int ldap_parse_sasl_bind_result( LDAP *ld, LDAPMessage *result, + struct berval **servercredp, int freeit ) +.LP +.ft B +int ldap_parse_extended_result( LDAP *ld, LDAPMessage *result, + char **retoidp, struct berval **retdatap, int freeit ) +.SH DESCRIPTION +.LP +These routines are used to extract information from a result message. +They will operate on the first result message in a chain of search +results (skipping past other message types). They take the \fIresult\fP +as returned by a call to +.BR ldap_result (3), +.BR ldap_search_s (3) +or +.BR ldap_search_st (3). +In addition to +.BR ldap_parse_result() , +the routines +.B ldap_parse_sasl_bind_result() +and +.B ldap_parse_extended_result() +are used to get all the result information from SASL bind and extended +operations. +.LP +The \fIerrcodep\fP parameter will be filled in with the result code from +the result message. +.LP +The server might supply a matched DN string in the message indicating +how much of a name in a request was recognized. The \fImatcheddnp\fP +parameter will be filled in with this string if supplied, else it will +be NULL. If a string is returned, it should be freed using +.BR ldap_memfree (3). +.LP +The \fIerrmsgp\fP parameter will be filled in with the error message +field from the parsed message. This string should be freed using +.BR ldap_memfree (3). +.LP +The \fIreferralsp\fP parameter will be filled in with an allocated array of +referral strings from the parsed message. This array should be freed using +.BR ldap_memvfree (3). +If no referrals were returned, \fI*referralsp\fP is set to NULL. +.LP +The \fIserverctrlsp\fP parameter will be filled in with an allocated array of +controls copied from the parsed message. The array should be freed using +.BR ldap_controls_free (3). +If no controls were returned, \fI*serverctrlsp\fP is set to NULL. +.LP +The \fIfreeit\fP parameter determines whether the parsed message is +freed or not after the extraction. Any non-zero value will make it +free the message. The +.BR ldap_msgfree (3) +routine can also be used to free the message later. +.LP +For SASL bind results, the \fIservercredp\fP parameter will be filled in +with an allocated berval structure containing the credentials from the +server if present. The structure should be freed using +.BR ber_bvfree (3). +.LP +For extended results, the \fIretoidp\fP parameter will be filled in +with the dotted-OID text representation of the name of the extended +operation response. The string should be freed using +.BR ldap_memfree (3). +If no OID was returned, \fI*retoidp\fP is set to NULL. +.LP +For extended results, the \fIretdatap\fP parameter will be filled in +with a pointer to a berval structure containing the data from the +extended operation response. The structure should be freed using +.BR ber_bvfree (3). +If no data were returned, \fI*retdatap\fP is set to NULL. +.LP +For all the above result parameters, NULL values can be used in calls +in order to ignore certain fields. +.SH ERRORS +Upon success LDAP_SUCCESS is returned. Otherwise the values of the +result parameters are undefined. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_result (3), +.BR ldap_search (3), +.BR ldap_memfree (3), +.BR ldap_memvfree (3), +.BR ldap_get_values (3), +.BR ldap_controls_free (3), +.BR lber-types (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_parse_result.3.links b/doc/man/man3/ldap_parse_result.3.links new file mode 100644 index 0000000..9c322c3 --- /dev/null +++ b/doc/man/man3/ldap_parse_result.3.links @@ -0,0 +1,2 @@ +ldap_parse_sasl_bind_result.3 +ldap_parse_extended_result.3 diff --git a/doc/man/man3/ldap_parse_sort_control.3 b/doc/man/man3/ldap_parse_sort_control.3 new file mode 100644 index 0000000..054de77 --- /dev/null +++ b/doc/man/man3/ldap_parse_sort_control.3 @@ -0,0 +1,40 @@ +.TH LDAP_PARSE_SORT-CONTROL 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_parse_sort_control \- Decode the information returned from a search operation that used a server-side sort control +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_parse_sort_control(ld, ctrls, returnCode, attribute) +.ft +LDAP *ld; +LDAPControl **ctrls; +unsigned long *returnCode; +char **attribute; +.SH DESCRIPTION +This function is used to parse the results returned in a search operation +that uses a server-side sort control. +.LP +It takes a null terminated array of LDAPControl structures usually obtained +by a call to the +.BR ldap_parse_result +function. A returncode which points to the sort control result code,and an array +of LDAPControl structures that list the client controls to use with the search. +The function also takes an out parameter \fIattribute\fP and if the sort operation +fails, the server may return a string that indicates the first attribute in the +sortKey list that caused the failure. If this parameter is NULL, no string is +returned. If a string is returned, the memory should be freed by calling the +ldap_memfree function. +.SH NOTES +.SH SEE ALSO +.BR ldap_result (3), +.BR ldap_controls_free (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_parse_vlv_control.3 b/doc/man/man3/ldap_parse_vlv_control.3 new file mode 100644 index 0000000..9a6df72 --- /dev/null +++ b/doc/man/man3/ldap_parse_vlv_control.3 @@ -0,0 +1,49 @@ +.TH LDAP_PARSE_VLV_CONTROL 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_parse_vlv_control \- Decode the information returned from a search operation that used a VLV (virtual list view) control +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_parse_vlv_control( ld, ctrlp, target_posp, list_countp, contextp, errcodep ) +.ft +LDAP *ld; +LDAPControl **ctrlp; +unsigned long *target_posp, *list_countp; +struct berval **contextp; +int *errcodep; +.SH DESCRIPTION +The +.B ldap_parse_vlv_control +is used to decode the information returned from a search operation that used a +VLV (virtual list view)control. It takes a null terminated array of LDAPControl +structures, usually obtained by a call to the +.BR ldap_parse_result function, +a \fItarget_pos\fP which points to the list index of the target entry. If +this parameter is NULL, the target position is not returned. The index returned +is an approximation of the position of the target entry. It is +not guaranteed to be exact. The parameter \fIlist_countp\fP points to +the server's estimate of the size of the list. If this parameter is NULL, the +size is not returned. \fIcontextp\fP is a pointer to the address of a berval +structure that contains a server-generated context identifier if server returns +one. If server does not return a context identifier, the server returns a NULL +in this parameter. If this parameter is set to NULL, the context identifier is +not returned. You should use this returned context in the next call to +create a VLV control. When the berval structure is no longer needed, you should +free the memory by calling the \fIber_bvfree function.e\fP +\fIerrcodep\fP is an output parameter, which points to the result code returned +by the server. If this parameter is NULL, the result code is not returned. +.LP +See +ldap.h for a list of possible return codes. +.SH SEE ALSO +.BR ldap_search (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_rename.3 b/doc/man/man3/ldap_rename.3 new file mode 100644 index 0000000..348982a --- /dev/null +++ b/doc/man/man3/ldap_rename.3 @@ -0,0 +1,66 @@ +.TH LDAP_RENAME 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_rename, ldap_rename_s \- Renames the specified entry. +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_rename( ld, dn, newrdn, newparent, deleteoldrdn, sctrls[], cctrls[], msgidp ); +.ft +LDAP *ld; +const char *dn, *newrdn, *newparent; +int deleteoldrdn; +LDAPControl *sctrls[], *cctrls[]; +int *msgidp); +.LP +.ft B +int ldap_rename_s( ld, dn, newrdn, newparent, deleteoldrdn, sctrls[], cctrls[] ); +.ft +LDAP *ld; +const char *dn, *newrdn, *newparent; +int deleteoldrdn; +LDAPControl *sctrls[], *cctrls[]; +.SH DESCRIPTION +These routines are used to perform a LDAP rename operation. +The function changes the leaf component of an entry's distinguished +name and optionally moves the entry to a new parent container. The +.B ldap_rename_s +performs a rename operation synchronously. +The method takes \fIdn\fP, which points to the distinguished name of +the entry whose attribute is being compared, \fInewparent\fP,the distinguished +name of the entry's new parent. If this parameter is NULL, only the RDN is changed. +The root DN is specified by passing a zero length string, "". +\fIdeleteoldrdn\fP specifies whether the old RDN should be retained or deleted. +Zero indicates that the old RDN should be retained. If you choose this option, +the attribute will contain both names (the old and the new). +Non-zero indicates that the old RDN should be deleted. +\fIserverctrls\fP points to an array of LDAPControl structures that list the +client controls to use with this extended operation. Use NULL to specify +no client controls. \fIclientctrls\fP points to an array of LDAPControl +structures that list the client controls to use with the search. +.LP +.B ldap_rename +works just like +.B ldap_rename_s, +but the operation is asynchronous. It returns the message id of the request +it initiated. The result of this operation can be obtained by calling +.BR ldap_result(3). +.SH ERRORS +.B ldap_rename() +returns \-1 in case of error initiating the request, and +will set the \fIld_errno\fP field in the \fIld\fP parameter to +indicate the error. +.BR ldap_rename_s() +returns the LDAP error code resulting from the rename operation. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_modify (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_rename.3.links b/doc/man/man3/ldap_rename.3.links new file mode 100644 index 0000000..3281906 --- /dev/null +++ b/doc/man/man3/ldap_rename.3.links @@ -0,0 +1 @@ +ldap_rename_s.3 diff --git a/doc/man/man3/ldap_result.3 b/doc/man/man3/ldap_result.3 new file mode 100644 index 0000000..ce6e5f5 --- /dev/null +++ b/doc/man/man3/ldap_result.3 @@ -0,0 +1,136 @@ +.TH LDAP_RESULT 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_result \- Wait for the result of an LDAP operation +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_result( LDAP *ld, int msgid, int all, + struct timeval *timeout, LDAPMessage **result ); + +int ldap_msgfree( LDAPMessage *msg ); + +int ldap_msgtype( LDAPMessage *msg ); + +int ldap_msgid( LDAPMessage *msg ); +.ft +.SH DESCRIPTION +The +.B ldap_result() +routine is used to wait for and return the result of +an operation previously initiated by one of the LDAP asynchronous +operation routines (e.g., +.BR ldap_search_ext (3), +.BR ldap_modify_ext (3), +etc.). Those routines all return \-1 in case of error, and an +invocation identifier upon successful initiation of the operation. The +invocation identifier is picked by the library and is guaranteed to be +unique across the LDAP session. It can be used to request the result +of a specific operation from +.B ldap_result() +through the \fImsgid\fP parameter. +.LP +The +.B ldap_result() +routine will block or not, depending upon the setting +of the \fItimeout\fP parameter. +If timeout is not a NULL pointer, it specifies a maximum +interval to wait for the selection to complete. If timeout +is a NULL pointer, the LDAP_OPT_TIMEOUT value set by +.BR ldap_set_option (3) +is used. With the default setting, +the select blocks indefinitely. To +effect a poll, the timeout argument should be a non-NULL +pointer, pointing to a zero-valued timeval structure. +To obtain the behavior of the default setting, bypassing any value set by +.BR ldap_set_option (3), +set to -1 the \fItv_sec\fP field of the \fItimeout\fP parameter. +See +.BR select (2) +for further details. +.LP +If the result of a specific operation is required, \fImsgid\fP should +be set to the invocation identifier returned when the operation was +initiated, otherwise LDAP_RES_ANY or LDAP_RES_UNSOLICITED should be +supplied to wait for any or unsolicited response. +.LP +The \fIall\fP parameter, if non-zero, causes +.B ldap_result() +to return all responses with msgid, otherwise only the +next response is returned. This is commonly used to obtain all +the responses of a search operation. +.LP +A search response is made up of zero or +more search entries, zero or more search references, and zero or +more extended partial responses followed by a search result. If +\fIall\fP is set to 0, search entries will be returned one at a +time as they come in, via separate calls to +.BR ldap_result() . +If it's set to 1, the search +response will only be returned in its entirety, i.e., after all entries, +all references, all extended partial responses, and the final search +result have been received. +.SH RETURN VALUE +Upon success, the type of the result received is returned and the +\fIresult\fP parameter will contain the result of the operation; +otherwise, the \fIresult\fP parameter is undefined. This +result should be passed to the LDAP parsing routines, +.BR ldap_first_message (3) +and friends, for interpretation. +.LP +The possible result types returned are: +.LP +.nf + LDAP_RES_BIND (0x61) + LDAP_RES_SEARCH_ENTRY (0x64) + LDAP_RES_SEARCH_REFERENCE (0x73) + LDAP_RES_SEARCH_RESULT (0x65) + LDAP_RES_MODIFY (0x67) + LDAP_RES_ADD (0x69) + LDAP_RES_DELETE (0x6b) + LDAP_RES_MODDN (0x6d) + LDAP_RES_COMPARE (0x6f) + LDAP_RES_EXTENDED (0x78) + LDAP_RES_INTERMEDIATE (0x79) +.fi +.LP +The +.B ldap_msgfree() +routine is used to free the memory allocated for +result(s) by +.B ldap_result() +or +.BR ldap_search_ext_s (3) +and friends. +It takes a pointer to the result or result chain to be freed and returns +the type of the last message in the chain. +If the parameter is NULL, the function does nothing and returns zero. +.LP +The +.B ldap_msgtype() +routine returns the type of a message. +.LP +The +.B ldap_msgid() +routine returns the message id of a message. +.SH ERRORS +.B ldap_result() +returns \-1 if something bad happens, and zero if the +timeout specified was exceeded. +.B ldap_msgtype() +and +.B ldap_msgid() +return \-1 on error. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_first_message (3), +.BR select (2) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_result.3.links b/doc/man/man3/ldap_result.3.links new file mode 100644 index 0000000..1394c6c --- /dev/null +++ b/doc/man/man3/ldap_result.3.links @@ -0,0 +1,3 @@ +ldap_msgfree.3 +ldap_msgtype.3 +ldap_msgid.3 diff --git a/doc/man/man3/ldap_schema.3 b/doc/man/man3/ldap_schema.3 new file mode 100644 index 0000000..66a258c --- /dev/null +++ b/doc/man/man3/ldap_schema.3 @@ -0,0 +1,320 @@ +.TH LDAP_SCHEMA 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 2000-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_str2syntax, ldap_syntax2str, ldap_syntax2name, ldap_syntax_free, ldap_str2matchingrule, ldap_matchingrule2str, ldap_matchingrule2name, ldap_matchingrule_free, ldap_str2attributetype, ldap_attributetype2str, ldap_attributetype2name, ldap_attributetype_free, ldap_str2objectclass, ldap_objectclass2str, ldap_objectclass2name, ldap_objectclass_free, ldap_scherr2str \- Schema definition handling routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +#include <ldap_schema.h> +.LP +.ft B +LDAPSyntax * ldap_str2syntax(s, code, errp, flags) +.ft +const char * s; +int * code; +const char ** errp; +const int flags; +.LP +.ft B +char * ldap_syntax2str(syn) +.ft +const LDAPSyntax * syn; +.LP +.ft B +const char * ldap_syntax2name(syn) +.ft +LDAPSyntax * syn; +.LP +.ft B +ldap_syntax_free(syn) +.ft +LDAPSyntax * syn; +.LP +.ft B +LDAPMatchingRule * ldap_str2matchingrule(s, code, errp, flags) +.ft +const char * s; +int * code; +const char ** errp; +const int flags; +.LP +.ft B +char * ldap_matchingrule2str(mr); +.ft +const LDAPMatchingRule * mr; +.LP +.ft B +const char * ldap_matchingrule2name(mr) +.ft +LDAPMatchingRule * mr; +.LP +.ft B +ldap_matchingrule_free(mr) +.ft +LDAPMatchingRule * mr; +.LP +.ft B +LDAPAttributeType * ldap_str2attributetype(s, code, errp, flags) +.ft +const char * s; +int * code; +const char ** errp; +const int flags; +.LP +.ft B +char * ldap_attributetype2str(at) +.ft +const LDAPAttributeType * at; +.LP +.ft B +const char * ldap_attributetype2name(at) +.ft +LDAPAttributeType * at; +.LP +.ft B +ldap_attributetype_free(at) +.ft +LDAPAttributeType * at; +.LP +.ft B +LDAPObjectClass * ldap_str2objectclass(s, code, errp, flags) +.ft +const char * s; +int * code; +const char ** errp; +const int flags; +.LP +.ft B +char * ldap_objectclass2str(oc) +.ft +const LDAPObjectClass * oc; +.LP +.ft B +const char * ldap_objectclass2name(oc) +.ft +LDAPObjectClass * oc; +.LP +.ft B +ldap_objectclass_free(oc) +.ft +LDAPObjectClass * oc; +.LP +.ft B +char * ldap_scherr2str(code) +.ft +int code; +.SH DESCRIPTION +These routines are used to parse schema definitions in the syntax +defined in RFC 4512 into structs and handle these structs. These +routines handle four kinds of definitions: syntaxes, matching rules, +attribute types and object classes. For each definition kind, four +routines are provided. +.LP +.B ldap_str2xxx() +takes a definition in RFC 4512 format in argument +.IR s +as a NUL-terminated string and returns, if possible, a pointer to a +newly allocated struct of the appropriate kind. The caller is +responsible for freeing the struct by calling +.B ldap_xxx_free() +when not needed any longer. The routine returns NULL if some problem +happened. In this case, the integer pointed at by argument +.IR code +will receive an error code (see below the description of +.B ldap_scherr2str() +for an explanation of the values) and a pointer to a NUL-terminated +string will be placed where requested by argument +.IR errp +, indicating where in argument +.IR s +the error happened, so it must not be freed by the caller. Argument +.IR flags +is a bit mask of parsing options controlling the relaxation of the +syntax recognized. The following values are defined: +.TP +.B LDAP_SCHEMA_ALLOW_NONE +strict parsing according to RFC 4512. +.TP +.B LDAP_SCHEMA_ALLOW_NO_OID +permit definitions that do not contain an initial OID. +.TP +.B LDAP_SCHEMA_ALLOW_QUOTED +permit quotes around some items that should not have them. +.TP +.B LDAP_SCHEMA_ALLOW_DESCR +permit a +.B descr +instead of a numeric OID in places where the syntax expect the latter. +.TP +.B LDAP_SCHEMA_ALLOW_DESCR_PREFIX +permit that the initial numeric OID contains a prefix in +.B descr +format. +.TP +.B LDAP_SCHEMA_ALLOW_ALL +be very liberal, include all options. +.LP +The structures returned are as follows: +.sp +.RS +.nf +.ne 7 +.ta 8n 16n 32n +typedef struct ldap_schema_extension_item { + char *lsei_name; /* Extension name */ + char **lsei_values; /* Extension values */ +} LDAPSchemaExtensionItem; + +typedef struct ldap_syntax { + char *syn_oid; /* OID */ + char **syn_names; /* Names */ + char *syn_desc; /* Description */ + LDAPSchemaExtensionItem **syn_extensions; /* Extension */ +} LDAPSyntax; + +typedef struct ldap_matchingrule { + char *mr_oid; /* OID */ + char **mr_names; /* Names */ + char *mr_desc; /* Description */ + int mr_obsolete; /* Is obsolete? */ + char *mr_syntax_oid; /* Syntax of asserted values */ + LDAPSchemaExtensionItem **mr_extensions; /* Extensions */ +} LDAPMatchingRule; + +typedef struct ldap_attributetype { + char *at_oid; /* OID */ + char **at_names; /* Names */ + char *at_desc; /* Description */ + int at_obsolete; /* Is obsolete? */ + char *at_sup_oid; /* OID of superior type */ + char *at_equality_oid; /* OID of equality matching rule */ + char *at_ordering_oid; /* OID of ordering matching rule */ + char *at_substr_oid; /* OID of substrings matching rule */ + char *at_syntax_oid; /* OID of syntax of values */ + int at_syntax_len; /* Suggested minimum maximum length */ + int at_single_value; /* Is single-valued? */ + int at_collective; /* Is collective? */ + int at_no_user_mod; /* Are changes forbidden through LDAP? */ + int at_usage; /* Usage, see below */ + LDAPSchemaExtensionItem **at_extensions; /* Extensions */ +} LDAPAttributeType; + +typedef struct ldap_objectclass { + char *oc_oid; /* OID */ + char **oc_names; /* Names */ + char *oc_desc; /* Description */ + int oc_obsolete; /* Is obsolete? */ + char **oc_sup_oids; /* OIDs of superior classes */ + int oc_kind; /* Kind, see below */ + char **oc_at_oids_must; /* OIDs of required attribute types */ + char **oc_at_oids_may; /* OIDs of optional attribute types */ + LDAPSchemaExtensionItem **oc_extensions; /* Extensions */ +} LDAPObjectClass; +.ta +.fi +.RE +.PP +Some integer fields (those described with a question mark) have a +truth value, for these fields the possible values are: +.TP +.B LDAP_SCHEMA_NO +The answer to the question is no. +.TP +.B LDAP_SCHEMA_YES +The answer to the question is yes. +.LP +For attribute types, the following usages are possible: +.TP +.B LDAP_SCHEMA_USER_APPLICATIONS +the attribute type is non-operational. +.TP +.B LDAP_SCHEMA_DIRECTORY_OPERATION +the attribute type is operational and is pertinent to the directory +itself, i.e. it has the same value on all servers that master the +entry containing this attribute type. +.TP +.B LDAP_SCHEMA_DISTRIBUTED_OPERATION +the attribute type is operational and is pertinent to replication, +shadowing or other distributed directory aspect. TBC. +.TP +.B LDAP_SCHEMA_DSA_OPERATION +the attribute type is operational and is pertinent to the directory +server itself, i.e. it may have different values for the same entry +when retrieved from different servers that master the entry. +.LP +Object classes can be of three kinds: +.TP +.B LDAP_SCHEMA_ABSTRACT +the object class is abstract, i.e. there cannot be entries of this +class alone. +.TP +.B LDAP_SCHEMA_STRUCTURAL +the object class is structural, i.e. it describes the main role of the +entry. On some servers, once the entry is created the set of +structural object classes assigned cannot be changed: none of those +present can be removed and none other can be added. +.TP +.B LDAP_SCHEMA_AUXILIARY +the object class is auxiliary, i.e. it is intended to go with other, +structural, object classes. These can be added or removed at any time +if attribute types are added or removed at the same time as needed by +the set of object classes resulting from the operation. +.LP +Routines +.B ldap_xxx2name() +return a canonical name for the definition. +.LP +Routines +.B ldap_xxx2str() +return a string representation in the format described by RFC 4512 of +the struct passed in the argument. The string is a newly allocated +string that must be freed by the caller. These routines may return +NULL if no memory can be allocated for the string. +.LP +.B ldap_scherr2str() +returns a NUL-terminated string with a text description of the error +found. This is a pointer to a static area, so it must not be freed by +the caller. The argument +.IR code +comes from one of the parsing routines and can adopt the following +values: +.TP +.B LDAP_SCHERR_OUTOFMEM +Out of memory. +.TP +.B LDAP_SCHERR_UNEXPTOKEN +Unexpected token. +.TP +.B LDAP_SCHERR_NOLEFTPAREN +Missing opening parenthesis. +.TP +.B LDAP_SCHERR_NORIGHTPAREN +Missing closing parenthesis. +.TP +.B LDAP_SCHERR_NODIGIT +Expecting digit. +.TP +.B LDAP_SCHERR_BADNAME +Expecting a name. +.TP +.B LDAP_SCHERR_BADDESC +Bad description. +.TP +.B LDAP_SCHERR_BADSUP +Bad superiors. +.TP +.B LDAP_SCHERR_DUPOPT +Duplicate option. +.TP +.B LDAP_SCHERR_EMPTY +Unexpected end of data. + +.SH SEE ALSO +.BR ldap (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_schema.3.links b/doc/man/man3/ldap_schema.3.links new file mode 100644 index 0000000..05e1675 --- /dev/null +++ b/doc/man/man3/ldap_schema.3.links @@ -0,0 +1,17 @@ +ldap_str2syntax.3 +ldap_syntax2str.3 +ldap_syntax2name.3 +ldap_syntax_free.3 +ldap_str2matchingrule.3 +ldap_matchingrule2str.3 +ldap_matchingrule2name.3 +ldap_matchingrule_free.3 +ldap_str2attributetype.3 +ldap_attributetype2str.3 +ldap_attributetype2name.3 +ldap_attributetype_free.3 +ldap_str2objectclass.3 +ldap_objectclass2str.3 +ldap_objectclass2name.3 +ldap_objectclass_free.3 +ldap_scherr2str.3 diff --git a/doc/man/man3/ldap_search.3 b/doc/man/man3/ldap_search.3 new file mode 100644 index 0000000..315e9c4 --- /dev/null +++ b/doc/man/man3/ldap_search.3 @@ -0,0 +1,144 @@ +.TH LDAP_SEARCH 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_search, ldap_search_s, ldap_search_st, ldap_search_ext, ldap_search_ext_s \- Perform an LDAP search operation +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <sys/types.h> +#include <ldap.h> +.LP +.ft B +int ldap_search_ext( +.RS +LDAP *\fIld\fB, +char *\fIbase\fB, +int \fIscope\fB, +char *\fIfilter\fB, +char *\fIattrs\fB[], +int \fIattrsonly\fB, +LDAPControl **\fIserverctrls\fB, +LDAPControl **\fIclientctrls\fB, +struct timeval *\fItimeout\fB, +int \fIsizelimit\fB, +int *\fImsgidp\fB ); +.RE +.LP +.ft B +int ldap_search_ext_s( +.RS +LDAP *\fIld\fB, +char *\fIbase\fB, +int \fIscope\fB, +char *\fIfilter\fB, +char *\fIattrs\fB[], +int \fIattrsonly\fB, +LDAPControl **\fIserverctrls\fB, +LDAPControl **\fIclientctrls\fB, +struct timeval *\fItimeout\fB, +int \fIsizelimit\fB, +LDAPMessage **\fIres\fB ); +.RE +.SH DESCRIPTION +These routines are used to perform LDAP search operations. +The +.B ldap_search_ext_s() +routine +does the search synchronously (i.e., not +returning until the operation completes), providing a pointer +to the resulting LDAP messages at the location pointed to by +the \fIres\fP parameter. +.LP +The +.B ldap_search_ext() +routine is the asynchronous version, initiating the search and returning +the message id of the operation it initiated in the integer +pointed to by the \fImsgidp\fP parameter. +.LP +The \fIbase\fP parameter is the DN of the entry at which to start the search. +.LP +The \fIscope\fP parameter is the scope of the search and should be one +of LDAP_SCOPE_BASE, to search the object itself, LDAP_SCOPE_ONELEVEL, +to search the object's immediate children, LDAP_SCOPE_SUBTREE, to +search the object and all its descendants, or LDAP_SCOPE_CHILDREN, +to search all of the descendants. Note that the latter requires +the server support the LDAP Subordinates Search Scope extension. +.LP +The \fIfilter\fP is a string representation of the filter to +apply in the search. The string should conform to the format +specified in RFC 4515 as extended by RFC 4526. For instance, +"(cn=Jane Doe)". Note that use of the extension requires the +server to support the LDAP Absolute True/False Filter extension. +NULL may be specified to indicate the library should send the +filter (objectClass=*). +.LP +The \fIattrs\fP parameter is a null-terminated array of attribute +descriptions to return from matching entries. +If NULL is specified, the return of all user attributes is requested. +The description "*" (LDAP_ALL_USER_ATTRIBUTES) may be used to request +all user attributes to be returned. +The description "+"(LDAP_ALL_OPERATIONAL_ATTRIBUTES) may be used to +request all operational attributes to be returned. Note that this +requires the server to support the LDAP All Operational Attribute +extension. +To request no attributes, the description "1.1" (LDAP_NO_ATTRS) +should be listed by itself. +.LP +The \fIattrsonly\fP parameter should be set to a non-zero value +if only attribute descriptions are wanted. It should be set to zero (0) +if both attributes descriptions and attribute values are wanted. +.LP +The \fIserverctrls\fP and \fIclientctrls\fP parameters may be used +to specify server and client controls, respectively. +.LP +The +.B ldap_search_ext_s() +routine is the synchronous version of +.BR ldap_search_ext(). +.LP +It also returns a code indicating success or, in the +case of failure, indicating the nature of the failure +of the operation. See +.BR ldap_error (3) +for details. +.SH NOTES +Note that both read +and list functionality are subsumed by these routines, +by using a filter like "(objectclass=*)" and a scope of LDAP_SCOPE_BASE (to +emulate read) or LDAP_SCOPE_ONELEVEL (to emulate list). +.LP +These routines may dynamically allocate memory. The caller is +responsible for freeing such memory using supplied deallocation +routines. Return values are contained in <ldap.h>. +.LP +Note that \fIres\fR parameter of +.B ldap_search_ext_s() +and +.B ldap_search_s() +should be freed with +.B ldap_msgfree() +regardless of return value of these functions. +.SH DEPRECATED INTERFACES +The +.B ldap_search() +routine is deprecated in favor of the +.B ldap_search_ext() +routine. The +.B ldap_search_s() +and +.B ldap_search_st() +routines are deprecated in favor of the +.B ldap_search_ext_s() +routine. +.LP +.so Deprecated +.SH SEE ALSO +.BR ldap (3), +.BR ldap_result (3), +.BR ldap_error (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_search.3.links b/doc/man/man3/ldap_search.3.links new file mode 100644 index 0000000..d85bf81 --- /dev/null +++ b/doc/man/man3/ldap_search.3.links @@ -0,0 +1,4 @@ +ldap_search_s.3 +ldap_search_st.3 +ldap_search_ext.3 +ldap_search_ext_s.3 diff --git a/doc/man/man3/ldap_sort.3 b/doc/man/man3/ldap_sort.3 new file mode 100644 index 0000000..0319bce --- /dev/null +++ b/doc/man/man3/ldap_sort.3 @@ -0,0 +1,21 @@ +.TH LDAP_SORT 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_sort_entries, ldap_sort_values, ldap_sort_strcasecmp \- LDAP sorting routines (deprecated) +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH DESCRIPTION +The +.BR ldap_sort_entries (), +.BR ldap_sort_values (), +and +.BR ldap_sort_strcasecmp () +are deprecated. +.LP +.so Deprecated +.SH SEE ALSO +.BR ldap (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_sort.3.links b/doc/man/man3/ldap_sort.3.links new file mode 100644 index 0000000..7a4be53 --- /dev/null +++ b/doc/man/man3/ldap_sort.3.links @@ -0,0 +1,3 @@ +ldap_sort_entries.3 +ldap_sort_values.3 +ldap_sort_strcasecmp.3 diff --git a/doc/man/man3/ldap_sync.3 b/doc/man/man3/ldap_sync.3 new file mode 100644 index 0000000..4103db4 --- /dev/null +++ b/doc/man/man3/ldap_sync.3 @@ -0,0 +1,326 @@ +.TH LDAP_SYNC 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 2006-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_sync_init, ldap_sync_init_refresh_only, ldap_sync_init_refresh_and_persist, ldap_sync_poll \- LDAP sync routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.B #include <ldap.h> +.LP +.BI "int ldap_sync_init(ldap_sync_t *" ls ", int " mode ");" +.LP +.BI "int ldap_sync_init_refresh_only(ldap_sync_t *" ls ");" +.LP +.BI "int ldap_sync_init_refresh_and_persist(ldap_sync_t *" ls ");" +.LP +.BI "int ldap_sync_poll(ldap_sync_t *" ls ");" +.LP +.BI "ldap_sync_t * ldap_sync_initialize(ldap_sync_t *" ls ");" +.LP +.BI "void ldap_sync_destroy(ldap_sync_t *" ls ", int " freeit ");" +.LP +.BI "typedef int (*" ldap_sync_search_entry_f ")(ldap_sync_t *" ls "," +.RS +.BI "LDAPMessage *" msg ", struct berval *" entryUUID "," +.BI "ldap_sync_refresh_t " phase ");" +.RE +.LP +.BI "typedef int (*" ldap_sync_search_reference_f ")(ldap_sync_t *" ls "," +.RS +.BI "LDAPMessage *" msg ");" +.RE +.LP +.BI "typedef int (*" ldap_sync_intermediate_f ")(ldap_sync_t *" ls "," +.RS +.BI "LDAPMessage *" msg ", BerVarray " syncUUIDs "," +.BI "ldap_sync_refresh_t " phase ");" +.RE +.LP +.BI "typedef int (*" ldap_sync_search_result_f ")(ldap_sync_t *" ls "," +.RS +.BI "LDAPMessage *" msg ", int " refreshDeletes ");" +.RE +.SH DESCRIPTION +.LP +These routines provide an interface to the LDAP Content Synchronization +operation (RFC 4533). +They require an +.BR ldap_sync_t +structure to be set up with parameters required for various phases +of the operation; this includes setting some handlers for special events. +All handlers take a pointer to the \fBldap_sync_t\fP structure as the first +argument, and a pointer to the \fBLDAPMessage\fP structure as received +from the server by the client library, plus, occasionally, other specific +arguments. + +The members of the \fBldap_sync_t\fP structure are: +.TP +.BI "char *" ls_base +The search base; by default, the +.B BASE +option in +.BR ldap.conf (5). +.TP +.BI "int " ls_scope +The search scope (one of +.BR LDAP_SCOPE_BASE , +.BR LDAP_SCOPE_ONELEVEL , +.BR LDAP_SCOPE_SUBORDINATE +or +.BR LDAP_SCOPE_SUBTREE ; +see +.B ldap.h +for details). +.TP +.BI "char *" ls_filter +The filter (RFC 4515); by default, +.BR (objectClass=*) . +.TP +.BI "char **" ls_attrs +The requested attributes; by default +.BR NULL , +indicating all user attributes. +.TP +.BI "int " ls_timelimit +The requested time limit (in seconds); by default +.BR 0 , +to indicate no limit. +.TP +.BI "int " ls_sizelimit +The requested size limit (in entries); by default +.BR 0 , +to indicate no limit. +.TP +.BI "int " ls_timeout +The desired timeout during polling with +.BR ldap_sync_poll (3). +A value of +.BR \-1 +means that polling is blocking, so +.BR ldap_sync_poll (3) +will not return until a message is received; a value of +.BR 0 +means that polling returns immediately, no matter if any response +is available or not; a positive value represents the timeout the +.BR ldap_sync_poll (3) +function will wait for response before returning, unless a message +is received; in that case, +.BR ldap_sync_poll (3) +returns as soon as the message is available. +.TP +.BI "ldap_sync_search_entry_f " ls_search_entry +A function that is called whenever an entry is returned. +The +.BR msg +argument is the +.BR LDAPMessage +that contains the searchResultEntry; it can be parsed using the regular +client API routines, like +.BR ldap_get_dn (3), +.BR ldap_first_attribute (3), +and so on. +The +.BR entryUUID +argument contains the entryUUID of the entry. +The +.BR phase +argument indicates the type of operation: one of +.BR LDAP_SYNC_CAPI_PRESENT , +.BR LDAP_SYNC_CAPI_ADD , +.BR LDAP_SYNC_CAPI_MODIFY , +.BR LDAP_SYNC_CAPI_DELETE ; +in case of +.BR LDAP_SYNC_CAPI_PRESENT +or +.BR LDAP_SYNC_CAPI_DELETE , +only the DN is contained in the +.IR LDAPMessage ; +in case of +.BR LDAP_SYNC_CAPI_MODIFY , +the whole entry is contained in the +.IR LDAPMessage , +and the application is responsible of determining the differences +between the new view of the entry provided by the caller and the data +already known. +.TP +.BI "ldap_sync_search_reference_f " ls_search_reference +A function that is called whenever a search reference is returned. +The +.BR msg +argument is the +.BR LDAPMessage +that contains the searchResultReference; it can be parsed using +the regular client API routines, like +.BR ldap_parse_reference (3). +.TP +.BI "ldap_sync_intermediate_f " ls_intermediate +A function that is called whenever something relevant occurs during +the refresh phase of the search, which is marked by +an \fIintermediateResponse\fP message type. +The +.BR msg +argument is the +.BR LDAPMessage +that contains the intermediate response; it can be parsed using +the regular client API routines, like +.BR ldap_parse_intermediate (3). +The +.BR syncUUIDs +argument contains an array of UUIDs of the entries that depends +on the value of the +.BR phase +argument. +In case of +.BR LDAP_SYNC_CAPI_PRESENTS , +the "present" phase is being entered; +this means that the following sequence of results will consist +in entries in "present" sync state. +In case of +.BR LDAP_SYNC_CAPI_DELETES , +the "deletes" phase is being entered; +this means that the following sequence of results will consist +in entries in "delete" sync state. +In case of +.BR LDAP_SYNC_CAPI_PRESENTS_IDSET , +the message contains a set of UUIDs of entries that are present; +it replaces a "presents" phase. +In case of +.BR LDAP_SYNC_CAPI_DELETES_IDSET , +the message contains a set of UUIDs of entries that have been deleted; +it replaces a "deletes" phase. +In case of +.BR LDAP_SYNC_CAPI_DONE, +a "presents" phase with "refreshDone" set to "TRUE" has been returned +to indicate that the refresh phase of refreshAndPersist is over, and +the client should start polling. +Except for the +.BR LDAP_SYNC_CAPI_PRESENTS_IDSET +and +.BR LDAP_SYNC_CAPI_DELETES_IDSET +cases, +.BR syncUUIDs +is NULL. +.BR +.TP +.BI "ldap_sync_search_result_f " ls_search_result +A function that is called whenever a searchResultDone is returned. +In refreshAndPersist this can only occur when the server decides +that the search must be interrupted. +The +.BR msg +argument is the +.BR LDAPMessage +that contains the response; it can be parsed using +the regular client API routines, like +.BR ldap_parse_result (3). +The +.BR refreshDeletes +argument is not relevant in this case; it should always be \-1. +.TP +.BI "void *" ls_private +A pointer to private data. The client may register here +a pointer to data the handlers above may need. +.TP +.BI "LDAP *" ls_ld +A pointer to a LDAP structure that is used to connect to the server. +It is the responsibility of the client to initialize the structure +and to provide appropriate authentication and security in place. + +.SH "GENERAL USE" +A +.B ldap_sync_t +structure is initialized by calling +.BR ldap_sync_initialize(3). +This simply clears out the contents of an already existing +.B ldap_sync_t +structure, and sets appropriate values for some members. +After that, the caller is responsible for setting up the +connection (member +.BR ls_ld ), +eventually setting up transport security (TLS), +for binding and any other initialization. +The caller must also fill all the documented search-related fields +of the +.B ldap_sync_t +structure. + +At the end of a session, the structure can be cleaned up by calling +.BR ldap_sync_destroy (3), +which takes care of freeing all data assuming it was allocated by +.BR ldap_mem* (3) +routines. +Otherwise, the caller should take care of destroying and zeroing out +the documented search-related fields, and call +.BR ldap_sync_destroy (3) +to free undocumented members set by the API. + +.SH "REFRESH ONLY" +The +.BR refreshOnly +functionality is obtained by periodically calling +.BR ldap_sync_init (3) +with mode set to +.BR LDAP_SYNC_REFRESH_ONLY , +or, which is equivalent, by directly calling +.BR ldap_sync_init_refresh_only (3). +The state of the search, and the consistency of the search parameters, +is preserved across calls by passing the +.B ldap_sync_t +structure as left by the previous call. + +.SH "REFRESH AND PERSIST" +The +.BR refreshAndPersist +functionality is obtained by calling +.BR ldap_sync_init (3) +with mode set to +.BR LDAP_SYNC_REFRESH_AND_PERSIST , +or, which is equivalent, by directly calling +.BR ldap_sync_init_refresh_and_persist (3) +and, after a successful return, by repeatedly polling with +.BR ldap_sync_poll (3) +according to the desired pattern. + +A client may insert a call to +.BR ldap_sync_poll (3) +into an external loop to check if any modification was returned; +in this case, it might be appropriate to set +.BR ls_timeout +to 0, or to set it to a finite, small value. +Otherwise, if the client's main purpose consists in waiting for +responses, a timeout of \-1 is most suitable, so that the function +only returns after some data has been received and handled. + +.SH ERRORS +All routines return any LDAP error resulting from a lower-level error +in the API calls they are based on, or LDAP_SUCCESS in case of success. +.BR ldap_sync_poll (3) +may return +.BR LDAP_SYNC_REFRESH_REQUIRED +if a full refresh is requested by the server. +In this case, it is appropriate to call +.BR ldap_sync_init (3) +again, passing the same +.B ldap_sync_t +structure as resulted from any previous call. +.SH NOTES +.SH SEE ALSO +.BR ldap (3), +.BR ldap_search_ext (3), +.BR ldap_result (3) ; +.B RFC 4533 +(http://www.rfc-editor.org), +.SH AUTHOR +Designed and implemented by Pierangelo Masarati, based on RFC 4533 +and loosely inspired by syncrepl code in +.BR slapd (8). +.SH ACKNOWLEDGEMENTS +Initially developed by +.BR "SysNet s.n.c." +.B OpenLDAP +is developed and maintained by The OpenLDAP Project (http://www.openldap.org/). +.B OpenLDAP +is derived from University of Michigan LDAP 3.3 Release. diff --git a/doc/man/man3/ldap_tls.3 b/doc/man/man3/ldap_tls.3 new file mode 100644 index 0000000..2090ed8 --- /dev/null +++ b/doc/man/man3/ldap_tls.3 @@ -0,0 +1,41 @@ +.TH LDAP_TLS 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_start_tls, ldap_start_tls_s, ldap_tls_inplace, ldap_install_tls \- LDAP TLS initialization routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.B #include <ldap.h> +.LP +.BI "int ldap_start_tls(LDAP *" ld ");" +.LP +.BI "int ldap_start_tls_s(LDAP *" ld ", LDAPControl **" serverctrls ", LDAPControl **" clientctrls ");" +.LP +.BI "int ldap_tls_inplace(LDAP *" ld ");" +.LP +.BI "int ldap_install_tls(LDAP *" ld ");" +.SH DESCRIPTION +These routines are used to initiate TLS processing on an LDAP session. +.BR ldap_start_tls_s () +sends a StartTLS request to a server, waits for the reply, and then installs +TLS handlers on the session if the request succeeded. The routine returns +.B LDAP_SUCCESS +if everything succeeded, otherwise it returns an LDAP error code. +.BR ldap_start_tls () +sends a StartTLS request to a server and does nothing else. It returns +.B LDAP_SUCCESS +if the request was sent successfully. +.BR ldap_tls_inplace () +returns 1 if TLS handlers have been installed on the specified session, 0 +otherwise. +.BR ldap_install_tls () +installs the TLS handlers on the given session. It returns +.B LDAP_LOCAL_ERROR +if TLS is already installed. +.SH SEE ALSO +.BR ldap (3), +.BR ldap_error (3) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man3/ldap_tls.3.links b/doc/man/man3/ldap_tls.3.links new file mode 100644 index 0000000..d03e2bf --- /dev/null +++ b/doc/man/man3/ldap_tls.3.links @@ -0,0 +1,4 @@ +ldap_start_tls.3 +ldap_start_tls_s.3 +ldap_tls_inplace.3 +ldap_install_tls.3 diff --git a/doc/man/man3/ldap_url.3 b/doc/man/man3/ldap_url.3 new file mode 100644 index 0000000..83fa1cf --- /dev/null +++ b/doc/man/man3/ldap_url.3 @@ -0,0 +1,83 @@ +.TH LDAP_URL 3 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap_is_ldap_url, ldap_url_parse, ldap_free_urldesc \- LDAP Uniform Resource Locator routines +.SH LIBRARY +OpenLDAP LDAP (libldap, \-lldap) +.SH SYNOPSIS +.nf +.ft B +#include <ldap.h> +.LP +.ft B +int ldap_is_ldap_url( const char *url ) +.LP +.ft B +int ldap_url_parse( const char *url, LDAPURLDesc **ludpp ) +.LP +typedef struct ldap_url_desc { + char * lud_scheme; /* URI scheme */ + char * lud_host; /* LDAP host to contact */ + int lud_port; /* port on host */ + char * lud_dn; /* base for search */ + char ** lud_attrs; /* list of attributes */ + int lud_scope; /* a LDAP_SCOPE_... value */ + char * lud_filter; /* LDAP search filter */ + char ** lud_exts; /* LDAP extensions */ + int lud_crit_exts; /* true if any extension is critical */ + /* may contain additional fields for internal use */ +} LDAPURLDesc; +.LP +.ft B +void ldap_free_urldesc( LDAPURLDesc *ludp ); +.SH DESCRIPTION +These routines support the use of LDAP URLs (Uniform Resource Locators) +as detailed in RFC 4516. LDAP URLs look like this: +.nf + + \fBldap://\fP\fIhostport\fP\fB/\fP\fIdn\fP[\fB?\fP\fIattrs\fP[\fB?\fP\fIscope\fP[\fB?\fP\fIfilter\fP[\fB?\fP\fIexts\fP]]]] + +where: + \fIhostport\fP is a host name with an optional ":portnumber" + \fIdn\fP is the search base + \fIattrs\fP is a comma separated list of attributes to request + \fIscope\fP is one of these three strings: + base one sub (default=base) + \fIfilter\fP is filter + \fIexts\fP are recognized set of LDAP and/or API extensions. + +Example: + ldap://ldap.example.net/dc=example,dc=net?cn,sn?sub?(cn=*) + +.fi +.LP +URLs that are wrapped in angle-brackets and/or preceded by "URL:" are also +tolerated. Alternative LDAP schemes such as ldaps:// and ldapi:// may be +parsed using the below routines as well. +.LP +.B ldap_is_ldap_url() +returns a non-zero value if \fIurl\fP looks like an LDAP URL (as +opposed to some other kind of URL). It can be used as a quick check +for an LDAP URL; the +.B ldap_url_parse() +routine should be used if a more thorough check is needed. +.LP +.B ldap_url_parse() +breaks down an LDAP URL passed in \fIurl\fP into its component pieces. +If successful, zero is returned, an LDAP URL description is +allocated, filled in, and \fIludpp\fP is set to point to it. If an +error occurs, a non-zero URL error code is returned. +.LP +.B ldap_free_urldesc() +should be called to free an LDAP URL description that was obtained from +a call to +.B ldap_url_parse(). +.SH SEE ALSO +.nf +.BR ldap (3) +.BR "RFC 4516" " <http://www.rfc-editor.org/rfc/rfc4516.txt>" +.SH ACKNOWLEDGEMENTS +.fi +.so ../Project diff --git a/doc/man/man3/ldap_url.3.links b/doc/man/man3/ldap_url.3.links new file mode 100644 index 0000000..90fe023 --- /dev/null +++ b/doc/man/man3/ldap_url.3.links @@ -0,0 +1,3 @@ +ldap_is_ldap_url.3 +ldap_url_parse.3 +ldap_free_urldesc.3 diff --git a/doc/man/man5/Makefile.in b/doc/man/man5/Makefile.in new file mode 100644 index 0000000..5acb8fc --- /dev/null +++ b/doc/man/man5/Makefile.in @@ -0,0 +1,16 @@ +# man5 Makefile.in for OpenLDAP +# $OpenLDAP$ +## This work is part of OpenLDAP Software <http://www.openldap.org/>. +## +## Copyright 1998-2018 The OpenLDAP Foundation. +## All rights reserved. +## +## Redistribution and use in source and binary forms, with or without +## modification, are permitted only as authorized by the OpenLDAP +## Public License. +## +## A copy of this license is available in the file LICENSE in the +## top-level directory of the distribution or, alternatively, at +## <http://www.OpenLDAP.org/license.html>. + +MANSECT=5 diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 new file mode 100644 index 0000000..8c67bc0 --- /dev/null +++ b/doc/man/man5/ldap.conf.5 @@ -0,0 +1,516 @@ +.TH LDAP.CONF 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldap.conf, .ldaprc \- LDAP configuration file/environment variables +.SH SYNOPSIS +ETCDIR/ldap.conf, ldaprc, .ldaprc, $LDAP<option-name> +.SH DESCRIPTION +If the environment variable \fBLDAPNOINIT\fP is defined, all +defaulting is disabled. +.LP +The +.I ldap.conf +configuration file is used to set system-wide defaults to be applied when +running +.I ldap +clients. +.LP +Users may create an optional configuration file, +.I ldaprc +or +.IR .ldaprc , +in their home directory which will be used to override the system-wide +defaults file. +The file +.I ldaprc +in the current working directory is also used. +.LP +.LP +Additional configuration files can be specified using +the \fBLDAPCONF\fP and \fBLDAPRC\fP environment variables. +\fBLDAPCONF\fP may be set to the path of a configuration file. This +path can be absolute or relative to the current working directory. +The \fBLDAPRC\fP, if defined, should be the basename of a file +in the current working directory or in the user's home directory. +.LP +Environmental variables may also be used to augment the file based defaults. +The name of the variable is the option name with an added prefix of \fBLDAP\fP. +For example, to define \fBBASE\fP via the environment, set the variable +\fBLDAPBASE\fP to the desired value. +.LP +Some options are user-only. Such options are ignored if present +in the +.I ldap.conf +(or file specified by +.BR LDAPCONF ). +.LP +Thus the following files and variables are read, in order: +.nf + variable $LDAPNOINIT, and if that is not set: + system file ETCDIR/ldap.conf, + user files $HOME/ldaprc, $HOME/.ldaprc, ./ldaprc, + system file $LDAPCONF, + user files $HOME/$LDAPRC, $HOME/.$LDAPRC, ./$LDAPRC, + variables $LDAP<uppercase option name>. +.fi +Settings late in the list override earlier ones. +.SH SYNTAX +The configuration options are case-insensitive; +their value, on a case by case basis, may be case-sensitive. +.LP +Blank lines are ignored. +.br +Lines beginning with a hash mark (`#') are comments, and ignored. +.LP +Valid lines are made of an option's name (a sequence of non-blanks, +conventionally written in uppercase, although not required), +followed by a value. +The value starts with the first non-blank character after +the option's name, and terminates at the end of the line, +or at the last sequence of blanks before the end of the line. +The tokenization of the value, if any, is delegated to the handler(s) +for that option, if any. Quoting values that contain blanks +may be incorrect, as the quotes would become part of the value. +For example, + +.nf + # Wrong - erroneous quotes: + URI "ldap:// ldaps://" + + # Right - space-separated list of URIs, without quotes: + URI ldap:// ldaps:// + + # Right - DN syntax needs quoting for Example, Inc: + BASE ou=IT staff,o="Example, Inc",c=US + # or: + BASE ou=IT staff,o=Example\\2C Inc,c=US + + # Wrong - comment on same line as option: + DEREF never # Never follow aliases +.fi +.LP +A line cannot be longer than LINE_MAX, which should be more than 2000 bytes +on all platforms. +There is no mechanism to split a long line on multiple lines, either for +beautification or to overcome the above limit. +.SH OPTIONS +The different configuration options are: +.TP +.B URI <ldap[si]://[name[:port]] ...> +Specifies the URI(s) of an LDAP server(s) to which the +.I LDAP +library should connect. The URI scheme may be any of +.BR ldap , +.B ldaps +or +.BR ldapi , +which refer to LDAP over TCP, LDAP over SSL (TLS) and LDAP +over IPC (UNIX domain sockets), respectively. +Each server's name can be specified as a +domain-style name or an IP address literal. Optionally, the +server's name can followed by a ':' and the port number the LDAP +server is listening on. If no port number is provided, the default +port for the scheme is used (389 for ldap://, 636 for ldaps://). +For LDAP over IPC, +.B name +is the name of the socket, and no +.B port +is required, nor allowed; note that directory separators must be +URL-encoded, like any other characters that are special to URLs; +so the socket + + /usr/local/var/ldapi + +must be specified as + + ldapi://%2Fusr%2Flocal%2Fvar%2Fldapi + +A space separated list of URIs may be provided. +.TP +.B BASE <base> +Specifies the default base DN to use when performing ldap operations. +The base must be specified as a Distinguished Name in LDAP format. +.TP +.B BINDDN <dn> +Specifies the default bind DN to use when performing ldap operations. +The bind DN must be specified as a Distinguished Name in LDAP format. +.B This is a user-only option. +.TP +.B DEREF <when> +Specifies how alias dereferencing is done when performing a search. The +.B <when> +can be specified as one of the following keywords: +.RS +.TP +.B never +Aliases are never dereferenced. This is the default. +.TP +.B searching +Aliases are dereferenced in subordinates of the base object, but +not in locating the base object of the search. +.TP +.B finding +Aliases are only dereferenced when locating the base object of the search. +.TP +.B always +Aliases are dereferenced both in searching and in locating the base object +of the search. +.RE +.TP +.TP +.B HOST <name[:port] ...> +Specifies the name(s) of an LDAP server(s) to which the +.I LDAP +library should connect. Each server's name can be specified as a +domain-style name or an IP address and optionally followed by a ':' and +the port number the ldap server is listening on. A space separated +list of hosts may be provided. +.B HOST +is deprecated in favor of +.BR URI . +.TP +.B NETWORK_TIMEOUT <integer> +Specifies the timeout (in seconds) after which the poll(2)/select(2) +following a connect(2) returns in case of no activity. +.TP +.B PORT <port> +Specifies the default port used when connecting to LDAP servers(s). +The port may be specified as a number. +.B PORT +is deprecated in favor of +.BR URI. +.TP +.B REFERRALS <on/true/yes/off/false/no> +Specifies if the client should automatically follow referrals returned +by LDAP servers. +The default is on. +Note that the command line tools +.BR ldapsearch (1) +&co always override this option. +.\" This should only be allowed via ldap_set_option(3) +.\".TP +.\".B RESTART <on/true/yes/off/false/no> +.\"Determines whether the library should implicitly restart connections (FIXME). +.TP +.B SIZELIMIT <integer> +Specifies a size limit (number of entries) to use when performing searches. +The number should be a non-negative integer. \fISIZELIMIT\fP of zero (0) +specifies a request for unlimited search size. Please note that the server +may still apply any server-side limit on the amount of entries that can be +returned by a search operation. +.TP +.B TIMELIMIT <integer> +Specifies a time limit (in seconds) to use when performing searches. +The number should be a non-negative integer. \fITIMELIMIT\fP of zero (0) +specifies unlimited search time to be used. Please note that the server +may still apply any server-side limit on the duration of a search operation. +.B VERSION {2|3} +Specifies what version of the LDAP protocol should be used. +.TP +.B TIMEOUT <integer> +Specifies a timeout (in seconds) after which calls to synchronous LDAP +APIs will abort if no response is received. Also used for any +.BR ldap_result (3) +calls where a NULL timeout parameter is supplied. +.SH SASL OPTIONS +If OpenLDAP is built with Simple Authentication and Security Layer support, +there are more options you can specify. +.TP +.B SASL_MECH <mechanism> +Specifies the SASL mechanism to use. +.TP +.B SASL_REALM <realm> +Specifies the SASL realm. +.TP +.B SASL_AUTHCID <authcid> +Specifies the authentication identity. +.B This is a user-only option. +.TP +.B SASL_AUTHZID <authcid> +Specifies the proxy authorization identity. +.B This is a user-only option. +.TP +.B SASL_SECPROPS <properties> +Specifies Cyrus SASL security properties. The +.B <properties> +can be specified as a comma-separated list of the following: +.RS +.TP +.B none +(without any other properties) causes the properties +defaults ("noanonymous,noplain") to be cleared. +.TP +.B noplain +disables mechanisms susceptible to simple passive attacks. +.TP +.B noactive +disables mechanisms susceptible to active attacks. +.TP +.B nodict +disables mechanisms susceptible to passive dictionary attacks. +.TP +.B noanonymous +disables mechanisms which support anonymous login. +.TP +.B forwardsec +requires forward secrecy between sessions. +.TP +.B passcred +requires mechanisms which pass client credentials (and allows +mechanisms which can pass credentials to do so). +.TP +.B minssf=<factor> +specifies the minimum acceptable +.I security strength factor +as an integer approximating the effective key length used for +encryption. 0 (zero) implies no protection, 1 implies integrity +protection only, 56 allows DES or other weak ciphers, 112 +allows triple DES and other strong ciphers, 128 allows RC4, +Blowfish and other modern strong ciphers. The default is 0. +.TP +.B maxssf=<factor> +specifies the maximum acceptable +.I security strength factor +as an integer (see +.B minssf +description). The default is +.BR INT_MAX . +.TP +.B maxbufsize=<factor> +specifies the maximum security layer receive buffer +size allowed. 0 disables security layers. The default is 65536. +.RE +.TP +.B SASL_NOCANON <on/true/yes/off/false/no> +Do not perform reverse DNS lookups to canonicalize SASL host names. The default is off. +.SH GSSAPI OPTIONS +If OpenLDAP is built with Generic Security Services Application Programming Interface support, +there are more options you can specify. +.TP +.B GSSAPI_SIGN <on/true/yes/off/false/no> +Specifies if GSSAPI signing (GSS_C_INTEG_FLAG) should be used. +The default is off. +.TP +.B GSSAPI_ENCRYPT <on/true/yes/off/false/no> +Specifies if GSSAPI encryption (GSS_C_INTEG_FLAG and GSS_C_CONF_FLAG) +should be used. The default is off. +.TP +.B GSSAPI_ALLOW_REMOTE_PRINCIPAL <on/true/yes/off/false/no> +Specifies if GSSAPI based authentication should try to form the +target principal name out of the ldapServiceName or dnsHostName +attribute of the targets RootDSE entry. The default is off. +.SH TLS OPTIONS +If OpenLDAP is built with Transport Layer Security support, there +are more options you can specify. These options are used when an +.B ldaps:// URI +is selected (by default or otherwise) or when the application +negotiates TLS by issuing the LDAP StartTLS operation. +.TP +.B TLS_CACERT <filename> +Specifies the file that contains certificates for all of the Certificate +Authorities the client will recognize. +.TP +.B TLS_CACERTDIR <path> +Specifies the path of a directory that contains Certificate Authority +certificates in separate individual files. The +.B TLS_CACERT +is always used before +.B TLS_CACERTDIR. +This parameter is ignored with GnuTLS. + +When using Mozilla NSS, <path> may contain a Mozilla NSS cert/key +database. If <path> contains a Mozilla NSS cert/key database and +CA cert files, OpenLDAP will use the cert/key database and will +ignore the CA cert files. +.TP +.B TLS_CERT <filename> +Specifies the file that contains the client certificate. +.B This is a user-only option. + +When using Mozilla NSS, if using a cert/key database (specified with +TLS_CACERTDIR), TLS_CERT specifies the name of the certificate to use: +.nf + TLS_CERT Certificate for Sam Carter +.fi +If using a token other than the internal built in token, specify the +token name first, followed by a colon: +.nf + TLS_CERT my hardware device:Certificate for Sam Carter +.fi +Use certutil \-L to list the certificates by name: +.nf + certutil \-d /path/to/certdbdir \-L +.fi +.TP +.B TLS_KEY <filename> +Specifies the file that contains the private key that matches the certificate +stored in the +.B TLS_CERT +file. Currently, the private key must not be protected with a password, so +it is of critical importance that the key file is protected carefully. +.B This is a user-only option. + +When using Mozilla NSS, TLS_KEY specifies the name of a file that contains +the password for the key for the certificate specified with TLS_CERT. The +modutil command can be used to turn off password protection for the cert/key +database. For example, if TLS_CACERTDIR specifies /home/scarter/.moznss as +the location of the cert/key database, use modutil to change the password +to the empty string: +.nf + modutil \-dbdir ~/.moznss \-changepw 'NSS Certificate DB' +.fi +You must have the old password, if any. Ignore the WARNING about the running +browser. Press 'Enter' for the new password. + +.TP +.B TLS_CIPHER_SUITE <cipher-suite-spec> +Specifies acceptable cipher suite and preference order. +<cipher-suite-spec> should be a cipher specification for +the TLS library in use (OpenSSL, GnuTLS, or Mozilla NSS). +Example: +.RS +.RS +.TP +.I OpenSSL: +TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv2 +.TP +.I GnuTLS: +TLS_CIPHER_SUITE SECURE256:!AES-128-CBC +.RE + +To check what ciphers a given spec selects in OpenSSL, use: + +.nf + openssl ciphers \-v <cipher-suite-spec> +.fi + +With GnuTLS the available specs can be found in the manual page of +.BR gnutls\-cli (1) +(see the description of the +option +.BR \-\-priority ). + +In older versions of GnuTLS, where gnutls\-cli does not support the option +\-\-priority, you can obtain the \(em more limited \(em list of ciphers by calling: + +.nf + gnutls\-cli \-l +.fi + +When using Mozilla NSS, the OpenSSL cipher suite specifications are used and +translated into the format used internally by Mozilla NSS. There isn't an easy +way to list the cipher suites from the command line. The authoritative list +is in the source code for Mozilla NSS in the file sslinfo.c in the structure +.nf + static const SSLCipherSuiteInfo suiteInfo[] +.fi +.RE +.TP +.B TLS_PROTOCOL_MIN <major>[.<minor>] +Specifies minimum SSL/TLS protocol version that will be negotiated. +If the server doesn't support at least that version, +the SSL handshake will fail. +To require TLS 1.x or higher, set this option to 3.(x+1), +e.g., + +.nf + TLS_PROTOCOL_MIN 3.2 +.fi + +would require TLS 1.1. +Specifying a minimum that is higher than that supported by the +OpenLDAP implementation will result in it requiring the +highest level that it does support. +This parameter is ignored with GnuTLS. +.TP +.B TLS_RANDFILE <filename> +Specifies the file to obtain random bits from when /dev/[u]random is +not available. Generally set to the name of the EGD/PRNGD socket. +The environment variable RANDFILE can also be used to specify the filename. +This parameter is ignored with GnuTLS and Mozilla NSS. +.TP +.B TLS_REQCERT <level> +Specifies what checks to perform on server certificates in a TLS session, +if any. The +.B <level> +can be specified as one of the following keywords: +.RS +.TP +.B never +The client will not request or check any server certificate. +.TP +.B allow +The server certificate is requested. If no certificate is provided, +the session proceeds normally. If a bad certificate is provided, it will +be ignored and the session proceeds normally. +.TP +.B try +The server certificate is requested. If no certificate is provided, +the session proceeds normally. If a bad certificate is provided, +the session is immediately terminated. +.TP +.B demand | hard +These keywords are equivalent. The server certificate is requested. If no +certificate is provided, or a bad certificate is provided, the session +is immediately terminated. This is the default setting. +.RE +.TP +.B TLS_CRLCHECK <level> +Specifies if the Certificate Revocation List (CRL) of the CA should be +used to verify if the server certificates have not been revoked. This +requires +.B TLS_CACERTDIR +parameter to be set. This parameter is ignored with GnuTLS and Mozilla NSS. +.B <level> +can be specified as one of the following keywords: +.RS +.TP +.B none +No CRL checks are performed +.TP +.B peer +Check the CRL of the peer certificate +.TP +.B all +Check the CRL for a whole certificate chain +.RE +.TP +.B TLS_CRLFILE <filename> +Specifies the file containing a Certificate Revocation List to be used +to verify if the server certificates have not been revoked. This +parameter is only supported with GnuTLS and Mozilla NSS. +.SH "ENVIRONMENT VARIABLES" +.TP +LDAPNOINIT +disable all defaulting +.TP +LDAPCONF +path of a configuration file +.TP +LDAPRC +basename of ldaprc file in $HOME or $CWD +.TP +LDAP<option-name> +Set <option-name> as from ldap.conf +.SH FILES +.TP +.I ETCDIR/ldap.conf +system-wide ldap configuration file +.TP +.I $HOME/ldaprc, $HOME/.ldaprc +user ldap configuration file +.TP +.I $CWD/ldaprc +local ldap configuration file +.SH "SEE ALSO" +.BR ldap (3), +.BR ldap_set_option (3), +.BR ldap_result (3), +.BR openssl (1), +.BR sasl (3) +.SH AUTHOR +Kurt Zeilenga, The OpenLDAP Project +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man5/ldif.5 b/doc/man/man5/ldif.5 new file mode 100644 index 0000000..7952e88 --- /dev/null +++ b/doc/man/man5/ldif.5 @@ -0,0 +1,277 @@ +.TH LDIF 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +ldif \- LDAP Data Interchange Format +.SH DESCRIPTION +The LDAP Data Interchange Format (LDIF) is used to represent LDAP +entries and change records in text form. LDAP tools, such as +.BR ldapadd (1) +and +.BR ldapsearch (1), +read and write LDIF entry +records. +.BR ldapmodify (1) +reads LDIF change records. +.LP +This manual page provides a basic description of LDIF. A +formal specification of LDIF is published in RFC 2849. +.SH ENTRY RECORDS +.LP +LDIF entry records are used to represent directory entries. The basic +form of an entry record is: +.LP +.nf +.ft tt + dn: <distinguished name> + <attrdesc>: <attrvalue> + <attrdesc>: <attrvalue> + <attrdesc>:: <base64-encoded-value> + <attrdesc>:< <URL> + ... +.ft +.fi +.LP +The value may be specified as UTF-8 text or as base64 encoded data, +or a URI may be provided to the location of the attribute value. +.LP +A line may be continued by starting the next line with a single space +or tab, e.g., +.LP +.nf +.ft tt + dn: cn=Barbara J Jensen,dc=exam + ple,dc=com +.ft +.fi +.LP +Lines beginning with a sharp sign ('#') are ignored. +.LP +Multiple attribute values are specified on separate lines, e.g., +.LP +.nf +.ft tt + cn: Barbara J Jensen + cn: Babs Jensen +.ft +.fi +.LP +If an value contains a non-printing character, or begins +with a space or a colon ':', the <attrtype> is followed by a +double colon and the value is encoded in base 64 notation. e.g., +the value " begins with a space" would be encoded like this: +.LP +.nf +.ft tt + cn:: IGJlZ2lucyB3aXRoIGEgc3BhY2U= +.ft +.fi +.LP +If the attribute value is located in a file, the <attrtype> is +followed by a ':<' and a file: URI. e.g., the value contained +in the file /tmp/value would be listed like this: +.LP +.nf +.ft tt + cn:< file:///tmp/value +.ft +.fi +Other URI schemes (ftp,http) may be supported as well. +.LP +Multiple entries within the same LDIF file are separated by blank +lines. +.SH ENTRY RECORD EXAMPLE +Here is an example of an LDIF file containing three entries. +.LP +.nf +.ft tt + dn: cn=Barbara J Jensen,dc=example,dc=com + cn: Barbara J Jensen + cn: Babs Jensen + objectclass: person + description:< file:///tmp/babs + sn: Jensen + + dn: cn=Bjorn J Jensen,dc=example,dc=com + cn: Bjorn J Jensen + cn: Bjorn Jensen + objectclass: person + sn: Jensen + + dn: cn=Jennifer J Jensen,dc=example,dc=com + cn: Jennifer J Jensen + cn: Jennifer Jensen + objectclass: person + sn: Jensen + jpegPhoto:: /9j/4AAQSkZJRgABAAAAAQABAAD/2wBDABALD + A4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQ + ERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVG + ... +.ft +.fi +.LP +Note that the description in Barbara Jensen's entry is +read from file:///tmp/babs and the jpegPhoto in Jennifer +Jensen's entry is encoded using base 64. +.SH CHANGE RECORDS +LDIF change records are used to represent directory change requests. +Each change record starts with line indicating the distinguished +name of the entry being changed: +.LP +.nf + dn: <distinguishedname> +.fi +.LP +.nf + changetype: <[modify|add|delete|modrdn]> +.fi +.LP +Finally, the change information itself is given, the format of which +depends on what kind of change was specified above. For a \fIchangetype\fP +of \fImodify\fP, the format is one or more of the following: +.LP +.nf + add: <attributetype> + <attrdesc>: <value1> + <attrdesc>: <value2> + ... + \- +.fi +.LP +Or, for a replace modification: +.LP +.nf + replace: <attributetype> + <attrdesc>: <value1> + <attrdesc>: <value2> + ... + \- +.fi +.LP +If no \fIattributetype\fP lines are given to replace, +the entire attribute is to be deleted (if present). +.LP +Or, for a delete modification: +.LP +.nf + delete: <attributetype> + <attrdesc>: <value1> + <attrdesc>: <value2> + ... + \- +.fi +.LP +If no \fIattributetype\fP lines are given to delete, +the entire attribute is to be deleted. +.LP +For a \fIchangetype\fP of \fIadd\fP, the format is: +.LP +.nf + <attrdesc1>: <value1> + <attrdesc1>: <value2> + ... + <attrdescN>: <value1> + <attrdescN>: <value2> +.fi +.LP +For a \fIchangetype\fP of \fImodrdn\fP or \fImoddn\fP, +the format is: +.LP +.nf + newrdn: <newrdn> + deleteoldrdn: 0 | 1 + newsuperior: <DN> +.fi +.LP +where a value of 1 for deleteoldrdn means to delete the values +forming the old rdn from the entry, and a value of 0 means to +leave the values as non-distinguished attributes in the entry. +The newsuperior line is optional and, if present, specifies the +new superior to move the entry to. +.LP +For a \fIchangetype\fP of \fIdelete\fP, no additional information +is needed in the record. +.LP +Note that attribute values may be presented using base64 or in +files as described for entry records. Lines in change records +may be continued in the manner described for entry records as +well. +.SH CHANGE RECORD EXAMPLE +The following sample LDIF file contains a change record +of each type of change. +.LP +.nf + dn: cn=Babs Jensen,dc=example,dc=com + changetype: add + objectclass: person + objectclass: extensibleObject + cn: babs + cn: babs jensen + sn: jensen + + dn: cn=Babs Jensen,dc=example,dc=com + changetype: modify + add: givenName + givenName: Barbara + givenName: babs + \- + replace: description + description: the fabulous babs + \- + delete: sn + sn: jensen + \- + + dn: cn=Babs Jensen,dc=example,dc=com + changetype: modrdn + newrdn: cn=Barbara J Jensen + deleteoldrdn: 0 + newsuperior: ou=People,dc=example,dc=com + + dn: cn=Barbara J Jensen,ou=People,dc=example,dc=com + changetype: delete +.fi + +.SH INCLUDE STATEMENT +The LDIF parser has been extended to support an +.B include +statement for referencing other LDIF files. The +.B include +statement must be separated from other records by a blank line. +The referenced file is specified using a file: URI and all of its +contents are incorporated as if they were part of the original +LDIF file. As above, other URI schemes may be supported. For example: +.LP +.nf + dn: dc=example,dc=com + objectclass: domain + dc: example + + include: file:///tmp/example.com.ldif + + dn: dc=example,dc=org + objectclass: domain + dc: example +.fi +This feature is not part of the LDIF specification in RFC 2849 but +is expected to appear in a future revision of this spec. It is supported +by the +.BR ldapadd (1), +.BR ldapmodify (1), +and +.BR slapadd (8) +commands. + +.SH SEE ALSO +.BR ldap (3), +.BR ldapsearch (1), +.BR ldapadd (1), +.BR ldapmodify (1), +.BR slapadd (8), +.BR slapcat (8), +.BR slapd\-ldif (5). +.LP +"LDAP Data Interchange Format," Good, G., RFC 2849. +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man5/slapd-bdb.5 b/doc/man/man5/slapd-bdb.5 new file mode 100644 index 0000000..ea83c8f --- /dev/null +++ b/doc/man/man5/slapd-bdb.5 @@ -0,0 +1,286 @@ +.TH SLAPD-BDB 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-bdb, slapd\-hdb \- Berkeley DB backends to slapd +.SH SYNOPSIS +.B ETCDIR/slapd.conf +.SH DESCRIPTION +The \fBbdb\fP backend to +.BR slapd (8) +uses the Oracle Berkeley DB (BDB) package to store data. +It makes extensive use of indexing and caching to speed data access. +.LP +Note that BDB is deprecated and support will be dropped in future +OpenLDAP releases. Installations should use the \fBmdb\fP +backend instead. +.LP +\fBhdb\fP is a variant of +the \fBbdb\fP backend that uses a hierarchical database layout which +supports subtree renames. It is both more space-efficient and more +execution-efficient than the \fBbdb\fP backend. It is otherwise identical +to the \fBbdb\fP behavior, and all the same configuration options apply. +.LP +It is noted that these options are intended to complement +Berkeley DB configuration options set in the environment's +.B DB_CONFIG +file. See Berkeley DB documentation for details on +.B DB_CONFIG +configuration options. +Where there is overlap, settings in +.B DB_CONFIG +take precedence. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the \fBbdb\fP and \fBhdb\fP backend database. +That is, they must follow a "database bdb" or "database hdb" line and +come before any subsequent "backend" or "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page. +.TP +.BI cachesize \ <integer> +Specify the size in entries of the in-memory entry cache maintained +by the \fBbdb\fP or \fBhdb\fP backend database instance. +The default is 1000 entries. +.TP +.BI cachefree \ <integer> +Specify the number of entries to free from the entry cache when the +cache reaches the \fBcachesize\fP limit. +The default is 1 entry. +.TP +.BI checkpoint \ <kbyte>\ <min> +Specify the frequency for checkpointing the database transaction log. +A checkpoint operation flushes the database buffers to disk and writes +a checkpoint record in the log. +The checkpoint will occur if either \fI<kbyte>\fP data has been written or +\fI<min>\fP minutes have passed since the last checkpoint. +Both arguments default to zero, in which case they are ignored. When +the \fI<min>\fP argument is non-zero, an internal task will run every +\fI<min>\fP minutes to perform the checkpoint. +See the Berkeley DB reference guide for more details. +.TP +.B checksum +Enable checksum validation of DB pages whenever they are read from disk. +This setting can only be configured before any database files are created. +.TP +.BI cryptfile \ <file> +Specify the pathname of a file containing an encryption key to use for +encrypting the database. Encryption is performed using Berkeley DB's +implementation of AES. Note that encryption can only be configured before +any database files are created, and changing the key can only be done +after destroying the current database and recreating it. Encryption is +not enabled by default, and some distributions of Berkeley DB do not +support encryption. +.TP +.BI cryptkey \ <key> +Specify an encryption key to use for encrypting the database. This option +may be used when a separate +.I cryptfile +is not desired. Only one of +.B cryptkey +or +.B cryptfile +may be configured. +.TP +.BI dbconfig \ <Berkeley-DB-setting> +Specify a configuration directive to be placed in the +.B DB_CONFIG +file of the database directory. The +.B dbconfig +directive is just a convenience +to allow all necessary configuration to be set in the +.B slapd.conf +file. +The options set using this directive will only be written to the +.B DB_CONFIG +file if no such file existed at server startup time, otherwise +they are completely ignored. This allows one +to set initial values without overwriting/destroying a +.B DB_CONFIG +file that was already customized through other means. +This directive may be specified multiple times, as needed. +For example: +.RS +.nf + dbconfig set_cachesize 0 1048576 0 + dbconfig set_lg_bsize 2097152 +.fi +.RE +.TP +.B dbnosync +Specify that on-disk database contents should not be immediately +synchronized with in memory changes. +Enabling this option may improve performance at the expense of data +security. +See the Berkeley DB reference guide for more details. +.TP +\fBdbpagesize \fR \fI<dbfile> <size>\fR +Specify the page size to use for a particular database file, in units +of 1024 bytes. The default for the +.B id2entry +file is 16, the default for all other files depends on the size of the +underlying filesystem's block size (typically 4 or 8). +The maximum that BerkeleyDB supports is 64. This +setting usually should not need to be changed, but if BerkeleyDB's +"db_stat \-d" shows a large amount of overflow pages in use in a file, +setting a larger size may increase performance at the expense of +data integrity. This setting only takes effect when a database is +being newly created. See the Berkeley DB reference guide for more details. +.TP +.BI directory \ <directory> +Specify the directory where the BDB files containing this database and +associated indexes live. +A separate directory must be specified for each database. +The default is +.BR LOCALSTATEDIR/openldap\-data . +.TP +.B dirtyread +Allow reads of modified but not yet committed data. +Usually transactions are isolated to prevent other operations from +accessing uncommitted data. +This option may improve performance, but may also return inconsistent +results if the data comes from a transaction that is later aborted. +In this case, the modified data is discarded and a subsequent search +will return a different result. +.TP +.BI dncachesize \ <integer> +Specify the maximum number of DNs in the in-memory DN cache. +Ideally this cache should be +large enough to contain the DNs of every entry in the database. If +set to a smaller value than the \fBcachesize\fP it will be silently +increased to equal the \fBcachesize\fP. The default value is 0 which +means unlimited, i.e. the DN cache will grow without bound. + +It should be noted that the \fBDN cache\fP is allowed to temporarily +grow beyond the configured size. It does this if many entries are +locked when it tries to do a purge, because that means they're +legitimately in use. Also, the \fBDN cache\fP never purges entries +that have cached children, so depending on the shape of the DIT, it +could have lots of cached DNs over the defined limit. +.TP +.BI idlcachesize \ <integer> +Specify the size of the in-memory index cache, in index slots. The +default is zero. A larger value will speed up frequent searches of +indexed entries. An \fBhdb\fP database needs a large \fBidlcachesize\fP +for good search performance, typically three times the +.B cachesize +(entry cache size) +or larger. +.TP +\fBindex \fR{\fI<attrlist>\fR|\fBdefault\fR} [\fBpres\fR,\fBeq\fR,\fBapprox\fR,\fBsub\fR,\fI<special>\fR] +Specify the indexes to maintain for the given attribute (or +list of attributes). +Some attributes only support a subset of indexes. +If only an \fI<attr>\fP is given, the indices specified for \fBdefault\fR +are maintained. +Note that setting a default does not imply that all attributes will be +indexed. Also, for best performance, an +.B eq +index should always be configured for the +.B objectClass +attribute. + +A number of special index parameters may be specified. +The index type +.B sub +can be decomposed into +.BR subinitial , +.BR subany ,\ and +.B subfinal +indices. +The special type +.B nolang +may be specified to disallow use of this index by language subtypes. +The special type +.B nosubtypes +may be specified to disallow use of this index by named subtypes. +Note: changing \fBindex\fP settings in +.BR slapd.conf (5) +requires rebuilding indices, see +.BR slapindex (8); +changing \fBindex\fP settings +dynamically by LDAPModifying "cn=config" automatically causes rebuilding +of the indices online in a background task. +.TP +.B linearindex +Tell +.B slapindex +to index one attribute at a time. By default, all indexed +attributes in an entry are processed at the same time. With this option, +each indexed attribute is processed individually, using multiple passes +through the entire database. This option improves +.B slapindex +performance +when the database size exceeds the \fBdbcache\fP size. When the \fBdbcache\fP is +large enough, this option is not needed and will decrease performance. +Also by default, +.B slapadd +performs full indexing and so a separate +.B slapindex +run is not needed. With this option, +.B slapadd +does no indexing and +.B slapindex +must be used. +.TP +.BR lockdetect \ { oldest | youngest | fewest | random | default } +Specify which transaction to abort when a deadlock is detected. +The default is +.BR random . +.TP +.BI mode \ <integer> +Specify the file protection mode that newly created database +index files should have. +The default is 0600. +.TP +.BI searchstack \ <depth> +Specify the depth of the stack used for search filter evaluation. +Search filters are evaluated on a stack to accommodate nested AND / OR +clauses. An individual stack is assigned to each server thread. +The depth of the stack determines how complex a filter can be +evaluated without requiring any additional memory allocation. Filters that +are nested deeper than the search stack depth will cause a separate +stack to be allocated for that particular search operation. These +allocations can have a major negative impact on server performance, +but specifying too much stack will also consume a great deal of memory. +Each search stack uses 512K bytes per level. The default stack depth +is 16, thus 8MB per thread is used. +.TP +.BI shm_key \ <integer> +Specify a key for a shared memory BDB environment. By default the +BDB environment uses memory mapped files. If a non-zero value is +specified, it will be used as the key to identify a shared memory +region that will house the environment. +.SH ACCESS CONTROL +The +.B bdb +and +.B hdb +backends honor access control semantics as indicated in +.BR slapd.access (5). +.SH FILES +.TP +.B ETCDIR/slapd.conf +default +.B slapd +configuration file +.TP +.B DB_CONFIG +Berkeley DB configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd\-mdb (5), +.BR slapd (8), +.BR slapadd (8), +.BR slapcat (8), +.BR slapindex (8), +Berkeley DB documentation. +.SH ACKNOWLEDGEMENTS +.so ../Project +Originally begun by Kurt Zeilenga. Caching mechanisms originally designed +by Jong-Hyuk Choi. Completion and subsequent work, as well as +back-hdb, by Howard Chu. diff --git a/doc/man/man5/slapd-bdb.5.links b/doc/man/man5/slapd-bdb.5.links new file mode 100644 index 0000000..3bc8c40 --- /dev/null +++ b/doc/man/man5/slapd-bdb.5.links @@ -0,0 +1 @@ +slapd-hdb.5 diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 new file mode 100644 index 0000000..9c72e82 --- /dev/null +++ b/doc/man/man5/slapd-config.5 @@ -0,0 +1,2127 @@ +.TH SLAPD-CONFIG 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-config \- configuration backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.d +.SH DESCRIPTION +The +.B config +backend manages all of the configuration information for the +.BR slapd (8) +daemon. This configuration information is also used by the SLAPD tools +.BR slapacl (8), +.BR slapadd (8), +.BR slapauth (8), +.BR slapcat (8), +.BR slapdn (8), +.BR slapindex (8), +and +.BR slaptest (8). +.LP +The +.B config +backend is backward compatible with the older +.BR slapd.conf (5) +file but provides the ability to change the configuration dynamically +at runtime. If slapd is run with only a +.B slapd.conf +file dynamic changes will be allowed but they will not persist across +a server restart. Dynamic changes are only saved when slapd is running +from a +.B slapd.d +configuration directory. +.LP + +Unlike other backends, there can only be one instance of the +.B config +backend, and most of its structure is predefined. The root of the +database is hardcoded to +.B "cn=config" +and this root entry contains +global settings for slapd. Multiple child entries underneath the +root entry are used to carry various other settings: +.RS +.TP +.B cn=Module +dynamically loaded modules +.TP +.B cn=Schema +schema definitions +.TP +.B olcBackend=xxx +backend-specific settings +.TP +.B olcDatabase=xxx +database-specific settings +.RE + +The +.B cn=Module +entries will only appear in configurations where slapd +was built with support for dynamically loaded modules. There can be +multiple entries, one for each configured module path. Within each +entry there will be values recorded for each module loaded on a +given path. These entries have no children. + +The +.B cn=Schema +entry contains all of the hardcoded schema elements. +The children of this entry contain all user-defined schema elements. +In schema that were loaded from include files, the child entry will +be named after the include file from which the schema was loaded. +Typically the first child in this subtree will be +.BR cn=core,cn=schema,cn=config . + +.B olcBackend +entries are for storing settings specific to a single +backend type (and thus global to all database instances of that type). +At present there are no backends that implement settings of this +nature, so usually there will not be any olcBackend entries. + +.B olcDatabase +entries store settings specific to a single database +instance. These entries may have +.B olcOverlay +child entries corresponding +to any overlays configured on the database. The olcDatabase and +olcOverlay entries may also have miscellaneous child entries for +other settings as needed. There are two special database entries +that are predefined \- one is an entry for the config database itself, +and the other is for the "frontend" database. Settings in the +frontend database are inherited by the other databases, unless +they are explicitly overridden in a specific database. +.LP +The specific configuration options available are discussed below in the +Global Configuration Options, General Backend Options, and General Database +Options. Options are set by defining LDAP attributes with specific values. +In general the names of the LDAP attributes are the same as the corresponding +.B slapd.conf +keyword, with an "olc" prefix added on. + +The parser for many of these attributes is the same as used for parsing +the slapd.conf keywords. As such, slapd.conf keywords that allow multiple +items to be specified on one line, separated by whitespace, will allow +multiple items to be specified in one attribute value. However, when +reading the attribute via LDAP, the items will be returned as individual +attribute values. + +Backend-specific options are discussed in the +.B slapd\-<backend>(5) +manual pages. Refer to the "OpenLDAP Administrator's Guide" for more +details on configuring slapd. +.SH GLOBAL CONFIGURATION OPTIONS +Options described in this section apply to the server as a whole. +Arguments that should be replaced by +actual text are shown in brackets <>. + +These options may only be specified in the +.B cn=config +entry. This entry must have an objectClass of +.BR olcGlobal . + +.TP +.B olcAllows: <features> +Specify a set of features to allow (default none). +.B bind_v2 +allows acceptance of LDAPv2 bind requests. Note that +.BR slapd (8) +does not truly implement LDAPv2 (RFC 1777), now Historic (RFC 3494). +.B bind_anon_cred +allows anonymous bind when credentials are not empty (e.g. +when DN is empty). +.B bind_anon_dn +allows unauthenticated (anonymous) bind when DN is not empty. +.B update_anon +allows unauthenticated (anonymous) update operations to be processed +(subject to access controls and other administrative limits). +.B proxy_authz_anon +allows unauthenticated (anonymous) proxy authorization control to be processed +(subject to access controls, authorization and other administrative limits). +.TP +.B olcArgsFile: <filename> +The (absolute) name of a file that will hold the +.B slapd +server's command line (program name and options). +.TP +.B olcAttributeOptions: <option-name>... +Define tagging attribute options or option tag/range prefixes. +Options must not end with `\-', prefixes must end with `\-'. +The `lang\-' prefix is predefined. +If you use the +.B olcAttributeOptions +directive, `lang\-' will no longer be defined and you must specify it +explicitly if you want it defined. + +An attribute description with a tagging option is a subtype of that +attribute description without the option. +Except for that, options defined this way have no special semantics. +Prefixes defined this way work like the `lang\-' options: +They define a prefix for tagging options starting with the prefix. +That is, if you define the prefix `x\-foo\-', you can use the option +`x\-foo\-bar'. +Furthermore, in a search or compare, a prefix or range name (with +a trailing `\-') matches all options starting with that name, as well +as the option with the range name sans the trailing `\-'. +That is, `x\-foo\-bar\-' matches `x\-foo\-bar' and `x\-foo\-bar\-baz'. + +RFC 4520 reserves options beginning with `x\-' for private experiments. +Other options should be registered with IANA, see RFC 4520 section 3.5. +OpenLDAP also has the `binary' option built in, but this is a transfer +option, not a tagging option. +.TP +.B olcAuthIDRewrite: <rewrite\-rule> +Used by the authentication framework to convert simple user names +to an LDAP DN used for authorization purposes. +Its purpose is analogous to that of +.BR olcAuthzRegexp +(see below). +The +.B rewrite\-rule +is a set of rules analogous to those described in +.BR slapo\-rwm (5) +for data rewriting (after stripping the \fIrwm\-\fP prefix). +.B olcAuthIDRewrite +and +.B olcAuthzRegexp +should not be intermixed. +.TP +.B olcAuthzPolicy: <policy> +Used to specify which rules to use for Proxy Authorization. Proxy +authorization allows a client to authenticate to the server using one +user's credentials, but specify a different identity to use for authorization +and access control purposes. It essentially allows user A to login as user +B, using user A's password. +The +.B none +flag disables proxy authorization. This is the default setting. +The +.B from +flag will use rules in the +.I authzFrom +attribute of the authorization DN. +The +.B to +flag will use rules in the +.I authzTo +attribute of the authentication DN. +The +.B any +flag, an alias for the deprecated value of +.BR both , +will allow any of the above, whatever succeeds first (checked in +.BR to , +.B from +sequence. +The +.B all +flag requires both authorizations to succeed. +.LP +.RS +The rules are mechanisms to specify which identities are allowed +to perform proxy authorization. +The +.I authzFrom +attribute in an entry specifies which other users +are allowed to proxy login to this entry. The +.I authzTo +attribute in +an entry specifies which other users this user can authorize as. Use of +.I authzTo +rules can be easily +abused if users are allowed to write arbitrary values to this attribute. +In general the +.I authzTo +attribute must be protected with ACLs such that +only privileged users can modify it. +The value of +.I authzFrom +and +.I authzTo +describes an +.B identity +or a set of identities; it can take five forms: +.RS +.TP +.B ldap:///<base>??[<scope>]?<filter> +.RE +.RS +.B dn[.<dnstyle>]:<pattern> +.RE +.RS +.B u[<mech>[<realm>]]:<pattern> +.RE +.RS +.B group[/objectClass[/attributeType]]:<pattern> +.RE +.RS +.B <pattern> +.RE +.RS + +.B <dnstyle>:={exact|onelevel|children|subtree|regex} + +.RE +The first form is a valid LDAP +.B URI +where the +.IR <host>:<port> , +the +.I <attrs> +and the +.I <extensions> +portions must be absent, so that the search occurs locally on either +.I authzFrom +or +.IR authzTo . +The second form is a +.BR DN , +with the optional style modifiers +.IR exact , +.IR onelevel , +.IR children , +and +.I subtree +for exact, onelevel, children and subtree matches, which cause +.I <pattern> +to be normalized according to the DN normalization rules, or the special +.I regex +style, which causes the +.I <pattern> +to be treated as a POSIX (''extended'') regular expression, as +discussed in +.BR regex (7) +and/or +.BR re_format (7). +A pattern of +.I * +means any non-anonymous DN. +The third form is a SASL +.BR id , +with the optional fields +.I <mech> +and +.I <realm> +that allow to specify a SASL +.BR mechanism , +and eventually a SASL +.BR realm , +for those mechanisms that support one. +The need to allow the specification of a mechanism is still debated, +and users are strongly discouraged to rely on this possibility. +The fourth form is a group specification, consisting of the keyword +.BR group , +optionally followed by the specification of the group +.B objectClass +and member +.BR attributeType . +The group with DN +.B <pattern> +is searched with base scope, and in case of match, the values of the +member +.B attributeType +are searched for the asserted DN. +For backwards compatibility, if no identity type is provided, i.e. only +.B <pattern> +is present, an +.I exact DN +is assumed; as a consequence, +.B <pattern> +is subjected to DN normalization. +Since the interpretation of +.I authzFrom +and +.I authzTo +can impact security, users are strongly encouraged +to explicitly set the type of identity specification that is being used. +A subset of these rules can be used as third arg in the +.B olcAuthzRegexp +statement (see below); significantly, the +.I URI +and the +.I dn.exact:<dn> +forms. +.RE +.TP +.B olcAuthzRegexp: <match> <replace> +Used by the authentication framework to convert simple user names, +such as provided by SASL subsystem, to an LDAP DN used for +authorization purposes. Note that the resultant DN need not refer +to an existing entry to be considered valid. When an authorization +request is received from the SASL subsystem, the SASL +.BR USERNAME , +.BR REALM , +and +.B MECHANISM +are taken, when available, and combined into a name of the form +.RS +.RS +.TP +.B UID=<username>[[,CN=<realm>],CN=<mechanism>],CN=auth + +.RE +This name is then compared against the +.B match +POSIX (''extended'') regular expression, and if the match is successful, +the name is replaced with the +.B replace +string. If there are wildcard strings in the +.B match +regular expression that are enclosed in parenthesis, e.g. +.RS +.TP +.B UID=([^,]*),CN=.* + +.RE +then the portion of the name that matched the wildcard will be stored +in the numbered placeholder variable $1. If there are other wildcard strings +in parenthesis, the matching strings will be in $2, $3, etc. up to $9. The +placeholders can then be used in the +.B replace +string, e.g. +.RS +.TP +.B UID=$1,OU=Accounts,DC=example,DC=com + +.RE +The replaced name can be either a DN, i.e. a string prefixed by "dn:", +or an LDAP URI. +If the latter, the server will use the URI to search its own database(s) +and, if the search returns exactly one entry, the name is +replaced by the DN of that entry. The LDAP URI must have no +hostport, attrs, or extensions components, but the filter is mandatory, +e.g. +.RS +.TP +.B ldap:///OU=Accounts,DC=example,DC=com??one?(UID=$1) + +.RE +The protocol portion of the URI must be strictly +.BR ldap . +Note that this search is subject to access controls. Specifically, +the authentication identity must have "auth" access in the subject. + +Multiple +.B olcAuthzRegexp +values can be specified to allow for multiple matching +and replacement patterns. The matching patterns are checked in the order they +appear in the attribute, stopping at the first successful match. + +.\".B Caution: +.\"Because the plus sign + is a character recognized by the regular expression engine, +.\"and it will appear in names that include a REALM, be careful to escape the +.\"plus sign with a backslash \\+ to remove the character's special meaning. +.RE +.TP +.B olcConcurrency: <integer> +Specify a desired level of concurrency. Provided to the underlying +thread system as a hint. The default is not to provide any hint. This setting +is only meaningful on some platforms where there is not a one to one +correspondence between user threads and kernel threads. +.TP +.B olcConnMaxPending: <integer> +Specify the maximum number of pending requests for an anonymous session. +If requests are submitted faster than the server can process them, they +will be queued up to this limit. If the limit is exceeded, the session +is closed. The default is 100. +.TP +.B olcConnMaxPendingAuth: <integer> +Specify the maximum number of pending requests for an authenticated session. +The default is 1000. +.TP +.B olcDisallows: <features> +Specify a set of features to disallow (default none). +.B bind_anon +disables acceptance of anonymous bind requests. Note that this setting +does not prohibit anonymous directory access (See "require authc"). +.B bind_simple +disables simple (bind) authentication. +.B tls_2_anon +disables forcing session to anonymous status (see also +.BR tls_authc ) +upon StartTLS operation receipt. +.B tls_authc +disallows the StartTLS operation if authenticated (see also +.BR tls_2_anon ). +.TP +.B olcGentleHUP: { TRUE | FALSE } +A SIGHUP signal will only cause a 'gentle' shutdown-attempt: +.B Slapd +will stop listening for new connections, but will not close the +connections to the current clients. Future write operations return +unwilling-to-perform, though. Slapd terminates when all clients +have closed their connections (if they ever do), or \- as before \- +if it receives a SIGTERM signal. This can be useful if you wish to +terminate the server and start a new +.B slapd +server +.B with another database, +without disrupting the currently active clients. +The default is FALSE. You may wish to use +.B olcIdleTimeout +along with this option. +.TP +.B olcIdleTimeout: <integer> +Specify the number of seconds to wait before forcibly closing +an idle client connection. A setting of 0 disables this +feature. The default is 0. You may also want to set the +.B olcWriteTimeout +option. +.TP +.B olcIndexIntLen: <integer> +Specify the key length for ordered integer indices. The most significant +bytes of the binary integer will be used for index keys. The default +value is 4, which provides exact indexing for 31 bit values. +A floating point representation is used to index too large values. +.TP +.B olcIndexSubstrIfMaxlen: <integer> +Specify the maximum length for subinitial and subfinal indices. Only +this many characters of an attribute value will be processed by the +indexing functions; any excess characters are ignored. The default is 4. +.TP +.B olcIndexSubstrIfMinlen: <integer> +Specify the minimum length for subinitial and subfinal indices. An +attribute value must have at least this many characters in order to be +processed by the indexing functions. The default is 2. +.TP +.B olcIndexSubstrAnyLen: <integer> +Specify the length used for subany indices. An attribute value must have +at least this many characters in order to be processed. Attribute values +longer than this length will be processed in segments of this length. The +default is 4. The subany index will also be used in subinitial and +subfinal index lookups when the filter string is longer than the +.I olcIndexSubstrIfMaxlen +value. +.TP +.B olcIndexSubstrAnyStep: <integer> +Specify the steps used in subany index lookups. This value sets the offset +for the segments of a filter string that are processed for a subany index +lookup. The default is 2. For example, with the default values, a search +using this filter "cn=*abcdefgh*" would generate index lookups for +"abcd", "cdef", and "efgh". + +.LP +Note: Indexing support depends on the particular backend in use. Also, +changing these settings will generally require deleting any indices that +depend on these parameters and recreating them with +.BR slapindex (8). + +.TP +.B olcListenerThreads: <integer> +Specify the number of threads to use for the connection manager. +The default is 1 and this is typically adequate for up to 16 CPU cores. +The value should be set to a power of 2. +.TP +.B olcLocalSSF: <SSF> +Specifies the Security Strength Factor (SSF) to be given local LDAP sessions, +such as those to the ldapi:// listener. For a description of SSF values, +see +.BR olcSaslSecProps 's +.B minssf +option description. The default is 71. +.TP +.B olcLogFile: <filename> +Specify a file for recording debug log messages. By default these messages +only go to stderr and are not recorded anywhere else. Specifying a logfile +copies messages to both stderr and the logfile. +.TP +.B olcLogLevel: <integer> [...] +Specify the level at which debugging statements and operation +statistics should be syslogged (currently logged to the +.BR syslogd (8) +LOG_LOCAL4 facility). +They must be considered subsystems rather than increasingly verbose +log levels. +Some messages with higher priority are logged regardless +of the configured loglevel as soon as any logging is configured. +Log levels are additive, and available levels are: +.RS +.RS +.PD 0 +.TP +.B 1 +.B (0x1 trace) +trace function calls +.TP +.B 2 +.B (0x2 packets) +debug packet handling +.TP +.B 4 +.B (0x4 args) +heavy trace debugging (function args) +.TP +.B 8 +.B (0x8 conns) +connection management +.TP +.B 16 +.B (0x10 BER) +print out packets sent and received +.TP +.B 32 +.B (0x20 filter) +search filter processing +.TP +.B 64 +.B (0x40 config) +configuration file processing +.TP +.B 128 +.B (0x80 ACL) +access control list processing +.TP +.B 256 +.B (0x100 stats) +stats log connections/operations/results +.TP +.B 512 +.B (0x200 stats2) +stats log entries sent +.TP +.B 1024 +.B (0x400 shell) +print communication with shell backends +.TP +.B 2048 +.B (0x800 parse) +entry parsing +\".TP +\".B 4096 +\".B (0x1000 cache) +\"caching (unused) +\".TP +\".B 8192 +\".B (0x2000 index) +\"data indexing (unused) +.TP +.B 16384 +.B (0x4000 sync) +LDAPSync replication +.TP +.B 32768 +.B (0x8000 none) +only messages that get logged whatever log level is set +.PD +.RE +The desired log level can be input as a single integer that combines +the (ORed) desired levels, both in decimal or in hexadecimal notation, +as a list of integers (that are ORed internally), +or as a list of the names that are shown between parenthesis, such that +.LP +.nf + olcLogLevel: 129 + olcLogLevel: 0x81 + olcLogLevel: 128 1 + olcLogLevel: 0x80 0x1 + olcLogLevel: acl trace +.fi +.LP +are equivalent. +The keyword +.B any +can be used as a shortcut to enable logging at all levels (equivalent to \-1). +The keyword +.BR none , +or the equivalent integer representation, causes those messages +that are logged regardless of the configured olcLogLevel to be logged. +In fact, if no olcLogLevel (or a 0 level) is defined, no logging occurs, +so at least the +.B none +level is required to have high priority messages logged. +.RE +.TP +.B olcPasswordCryptSaltFormat: <format> +Specify the format of the salt passed to +.BR crypt (3) +when generating {CRYPT} passwords (see +.BR olcPasswordHash ) +during processing of LDAP Password Modify Extended Operations (RFC 3062). + +This string needs to be in +.BR sprintf (3) +format and may include one (and only one) %s conversion. +This conversion will be substituted with a string of random +characters from [A\-Za\-z0\-9./]. For example, "%.2s" +provides a two character salt and "$1$%.8s" tells some +versions of crypt(3) to use an MD5 algorithm and provides +8 random characters of salt. The default is "%s", which +provides 31 characters of salt. +.TP +.B olcPidFile: <filename> +The (absolute) name of a file that will hold the +.B slapd +server's process ID (see +.BR getpid (2)). +.TP +.B olcPluginLogFile: <filename> +The ( absolute ) name of a file that will contain log +messages from +.B SLAPI +plugins. See +.BR slapd.plugin (5) +for details. +.TP +.B olcReferral: <url> +Specify the referral to pass back when +.BR slapd (8) +cannot find a local database to handle a request. +If multiple values are specified, each url is provided. +.TP +.B olcReverseLookup: TRUE | FALSE +Enable/disable client name unverified reverse lookup (default is +.BR FALSE +if compiled with \-\-enable\-rlookups). +.TP +.B olcRootDSE: <file> +Specify the name of an LDIF(5) file containing user defined attributes +for the root DSE. These attributes are returned in addition to the +attributes normally produced by slapd. + +The root DSE is an entry with information about the server and its +capabilities, in operational attributes. +It has the empty DN, and can be read with e.g.: +.ti +4 +ldapsearch \-x \-b "" \-s base "+" +.br +See RFC 4512 section 5.1 for details. +.TP +.B olcSaslAuxprops: <plugin> [...] +Specify which auxprop plugins to use for authentication lookups. The +default is empty, which just uses slapd's internal support. Usually +no other auxprop plugins are needed. +.TP +.B olcSaslHost: <fqdn> +Used to specify the fully qualified domain name used for SASL processing. +.TP +.B olcSaslRealm: <realm> +Specify SASL realm. Default is empty. +.TP +.B olcSaslSecProps: <properties> +Used to specify Cyrus SASL security properties. +The +.B none +flag (without any other properties) causes the flag properties +default, "noanonymous,noplain", to be cleared. +The +.B noplain +flag disables mechanisms susceptible to simple passive attacks. +The +.B noactive +flag disables mechanisms susceptible to active attacks. +The +.B nodict +flag disables mechanisms susceptible to passive dictionary attacks. +The +.B noanonymous +flag disables mechanisms which support anonymous login. +The +.B forwardsec +flag require forward secrecy between sessions. +The +.B passcred +require mechanisms which pass client credentials (and allow +mechanisms which can pass credentials to do so). +The +.B minssf=<factor> +property specifies the minimum acceptable +.I security strength factor +as an integer approximate to effective key length used for +encryption. 0 (zero) implies no protection, 1 implies integrity +protection only, 56 allows DES or other weak ciphers, 112 +allows triple DES and other strong ciphers, 128 allows RC4, +Blowfish and other modern strong ciphers. The default is 0. +The +.B maxssf=<factor> +property specifies the maximum acceptable +.I security strength factor +as an integer (see minssf description). The default is INT_MAX. +The +.B maxbufsize=<size> +property specifies the maximum security layer receive buffer +size allowed. 0 disables security layers. The default is 65536. +.TP +.B olcServerID: <integer> [<URL>] +Specify an integer ID from 0 to 4095 for this server (limited +to 3 hexadecimal digits). The ID may also be specified as a +hexadecimal ID by prefixing the value with "0x". +Non-zero IDs are +required when using multimaster replication and each master must have a +unique non-zero ID. Note that this requirement also applies to separate masters +contributing to a glued set of databases. +If the URL is provided, this directive may be specified +multiple times, providing a complete list of participating servers +and their IDs. The fully qualified hostname of each server should be +used in the supplied URLs. The IDs are used in the "replica id" field +of all CSNs generated by the specified server. The default value is zero, which +is only valid for single master replication. +Example: +.LP +.nf + olcServerID: 1 ldap://ldap1.example.com + olcServerID: 2 ldap://ldap2.example.com +.fi +.TP +.B olcSockbufMaxIncoming: <integer> +Specify the maximum incoming LDAP PDU size for anonymous sessions. +The default is 262143. +.TP +.B olcSockbufMaxIncomingAuth: <integer> +Specify the maximum incoming LDAP PDU size for authenticated sessions. +The default is 4194303. +.TP +.B olcTCPBuffer [listener=<URL>] [{read|write}=]<size> +Specify the size of the TCP buffer. +A global value for both read and write TCP buffers related to any listener +is defined, unless the listener is explicitly specified, +or either the read or write qualifiers are used. +See +.BR tcp (7) +for details. +Note that some OS-es implement automatic TCP buffer tuning. +.TP +.B olcThreads: <integer> +Specify the maximum size of the primary thread pool. +The default is 16; the minimum value is 2. +.TP +.B olcToolThreads: <integer> +Specify the maximum number of threads to use in tool mode. +This should not be greater than the number of CPUs in the system. +The default is 1. +.TP +.B olcWriteTimeout: <integer> +Specify the number of seconds to wait before forcibly closing +a connection with an outstanding write. This allows recovery from +various network hang conditions. A setting of 0 disables this +feature. The default is 0. +.SH TLS OPTIONS +If +.B slapd +is built with support for Transport Layer Security, there are more options +you can specify. +.TP +.B olcTLSCipherSuite: <cipher-suite-spec> +Permits configuring what ciphers will be accepted and the preference order. +<cipher-suite-spec> should be a cipher specification for +the TLS library in use (OpenSSL, GnuTLS, or Mozilla NSS). +Example: +.RS +.RS +.TP +.I OpenSSL: +olcTLSCipherSuite: HIGH:MEDIUM:+SSLv2 +.TP +.I GnuTLS: +olcTLSCiphersuite: SECURE256:!AES-128-CBC +.RE + +To check what ciphers a given spec selects in OpenSSL, use: + +.nf + openssl ciphers \-v <cipher-suite-spec> +.fi + +With GnuTLS the available specs can be found in the manual page of +.BR gnutls\-cli (1) +(see the description of the +option +.BR \-\-priority ). + +In older versions of GnuTLS, where gnutls\-cli does not support the option +\-\-priority, you can obtain the \(em more limited \(em list of ciphers by calling: + +.nf + gnutls\-cli \-l +.fi + +When using Mozilla NSS, the OpenSSL cipher suite specifications are used and +translated into the format used internally by Mozilla NSS. There isn't an easy +way to list the cipher suites from the command line. The authoritative list +is in the source code for Mozilla NSS in the file sslinfo.c in the structure +.nf + static const SSLCipherSuiteInfo suiteInfo[] +.fi +.RE +.TP +.B olcTLSCACertificateFile: <filename> +Specifies the file that contains certificates for all of the Certificate +Authorities that +.B slapd +will recognize. +.TP +.B olcTLSCACertificatePath: <path> +Specifies the path of a directory that contains Certificate Authority +certificates in separate individual files. Usually only one of this +or the olcTLSCACertificateFile is defined. If both are specified, both +locations will be used. This directive is not supported +when using GnuTLS. + +When using Mozilla NSS, <path> may contain a Mozilla NSS cert/key +database. If <path> contains a Mozilla NSS cert/key database and +CA cert files, OpenLDAP will use the cert/key database and will +ignore the CA cert files. +.TP +.B olcTLSCertificateFile: <filename> +Specifies the file that contains the +.B slapd +server certificate. + +When using Mozilla NSS, if using a cert/key database (specified with +olcTLSCACertificatePath), olcTLSCertificateFile specifies +the name of the certificate to use: +.nf + olcTLSCertificateFile: Server-Cert +.fi +If using a token other than the internal built in token, specify the +token name first, followed by a colon: +.nf + olcTLSCertificateFile: my hardware device:Server-Cert +.fi +Use certutil \-L to list the certificates by name: +.nf + certutil \-d /path/to/certdbdir \-L +.fi +.TP +.B olcTLSCertificateKeyFile: <filename> +Specifies the file that contains the +.B slapd +server private key that matches the certificate stored in the +.B olcTLSCertificateFile +file. If the private key is protected with a password, the password must +be manually typed in when slapd starts. Usually the private key is not +protected with a password, to allow slapd to start without manual +intervention, so +it is of critical importance that the file is protected carefully. + +When using Mozilla NSS, olcTLSCertificateKeyFile specifies the name of +a file that contains the password for the key for the certificate specified with +olcTLSCertificateFile. The modutil command can be used to turn off password +protection for the cert/key database. For example, if olcTLSCACertificatePath +specifes /etc/openldap/certdb as the location of the cert/key database, use +modutil to change the password to the empty string: +.nf + modutil \-dbdir /etc/openldap/certdb \-changepw 'NSS Certificate DB' +.fi +You must have the old password, if any. Ignore the WARNING about the running +browser. Press 'Enter' for the new password. + +.TP +.B olcTLSDHParamFile: <filename> +This directive specifies the file that contains parameters for Diffie-Hellman +ephemeral key exchange. This is required in order to use a DSA certificate on +the server, or an RSA certificate missing the "key encipherment" key usage. +Note that setting this option may also enable +Anonymous Diffie-Hellman key exchanges in certain non-default cipher suites. +Anonymous key exchanges should generally be avoided since they provide no +actual client or server authentication and provide no protection against +man-in-the-middle attacks. +You should append "!ADH" to your cipher suites to ensure that these suites +are not used. +When using Mozilla NSS these parameters are always generated randomly +so this directive is ignored. +.TP +.B olcTLSProtocolMin: <major>[.<minor>] +Specifies minimum SSL/TLS protocol version that will be negotiated. +If the server doesn't support at least that version, +the SSL handshake will fail. +To require TLS 1.x or higher, set this option to 3.(x+1), +e.g., + +.nf + olcTLSProtocolMin: 3.2 +.fi + +would require TLS 1.1. +Specifying a minimum that is higher than that supported by the +OpenLDAP implementation will result in it requiring the +highest level that it does support. +This directive is ignored with GnuTLS. +.TP +.B olcTLSRandFile: <filename> +Specifies the file to obtain random bits from when /dev/[u]random +is not available. Generally set to the name of the EGD/PRNGD socket. +The environment variable RANDFILE can also be used to specify the filename. +This directive is ignored with GnuTLS and Mozilla NSS. +.TP +.B olcTLSVerifyClient: <level> +Specifies what checks to perform on client certificates in an +incoming TLS session, if any. +The +.B <level> +can be specified as one of the following keywords: +.RS +.TP +.B never +This is the default. +.B slapd +will not ask the client for a certificate. +.TP +.B allow +The client certificate is requested. If no certificate is provided, +the session proceeds normally. If a bad certificate is provided, +it will be ignored and the session proceeds normally. +.TP +.B try +The client certificate is requested. If no certificate is provided, +the session proceeds normally. If a bad certificate is provided, +the session is immediately terminated. +.TP +.B demand | hard | true +These keywords are all equivalent, for compatibility reasons. +The client certificate is requested. If no certificate is provided, +or a bad certificate is provided, the session is immediately terminated. + +Note that a valid client certificate is required in order to use the +SASL EXTERNAL authentication mechanism with a TLS session. As such, +a non-default +.B olcTLSVerifyClient +setting must be chosen to enable SASL EXTERNAL authentication. +.RE +.TP +.B olcTLSCRLCheck: <level> +Specifies if the Certificate Revocation List (CRL) of the CA should be +used to verify if the client certificates have not been revoked. This +requires +.B olcTLSCACertificatePath +parameter to be set. This parameter is ignored with GnuTLS and Mozilla NSS. +.B <level> +can be specified as one of the following keywords: +.RS +.TP +.B none +No CRL checks are performed +.TP +.B peer +Check the CRL of the peer certificate +.TP +.B all +Check the CRL for a whole certificate chain +.RE +.TP +.B olcTLSCRLFile: <filename> +Specifies a file containing a Certificate Revocation List to be used +for verifying that certificates have not been revoked. This parameter +is only valid when using GnuTLS or Mozilla NSS. +.SH DYNAMIC MODULE OPTIONS +If +.B slapd +is compiled with \-\-enable\-modules then the module-related entries will +be available. These entries are named +.B cn=module{x},cn=config +and +must have the olcModuleList objectClass. One entry should be created +per +.B olcModulePath. +Normally the config engine generates the "{x}" index in the RDN +automatically, so it can be omitted when initially loading these entries. +.TP +.B olcModuleLoad: <filename> +Specify the name of a dynamically loadable module to load. The filename +may be an absolute path name or a simple filename. Non-absolute names +are searched for in the directories specified by the +.B olcModulePath +option. +.TP +.B olcModulePath: <pathspec> +Specify a list of directories to search for loadable modules. Typically +the path is colon-separated but this depends on the operating system. +The default is MODULEDIR, which is where the standard OpenLDAP install +will place its modules. +.SH SCHEMA OPTIONS +Schema definitions are created as entries in the +.B cn=schema,cn=config +subtree. These entries must have the olcSchemaConfig objectClass. +As noted above, the actual +.B cn=schema,cn=config +entry is predefined and any values specified for it are ignored. + +.HP +.hy 0 +.B olcAttributetypes: "(\ <oid>\ + [NAME\ <name>]\ + [DESC\ <description>]\ + [OBSOLETE]\ + [SUP\ <oid>]\ + [EQUALITY\ <oid>]\ + [ORDERING\ <oid>]\ + [SUBSTR\ <oid>]\ + [SYNTAX\ <oidlen>]\ + [SINGLE\-VALUE]\ + [COLLECTIVE]\ + [NO\-USER\-MODIFICATION]\ + [USAGE\ <attributeUsage>]\ )" +.RS +Specify an attribute type using the LDAPv3 syntax defined in RFC 4512. +The slapd parser extends the RFC 4512 definition by allowing string +forms as well as numeric OIDs to be used for the attribute OID and +attribute syntax OID. +(See the +.B olcObjectIdentifier +description.) +.RE + +.HP +.hy 0 +.B olcDitContentRules: "(\ <oid>\ + [NAME\ <name>]\ + [DESC\ <description>]\ + [OBSOLETE]\ + [AUX\ <oids>]\ + [MUST\ <oids>]\ + [MAY\ <oids>]\ + [NOT\ <oids>]\ )" +.RS +Specify an DIT Content Rule using the LDAPv3 syntax defined in RFC 4512. +The slapd parser extends the RFC 4512 definition by allowing string +forms as well as numeric OIDs to be used for the attribute OID and +attribute syntax OID. +(See the +.B olcObjectIdentifier +description.) +.RE + +.HP +.hy 0 +.B olcObjectClasses: "(\ <oid>\ + [NAME\ <name>]\ + [DESC\ <description>]\ + [OBSOLETE]\ + [SUP\ <oids>]\ + [{ ABSTRACT | STRUCTURAL | AUXILIARY }]\ + [MUST\ <oids>] [MAY\ <oids>] )" +.RS +Specify an objectclass using the LDAPv3 syntax defined in RFC 4512. +The slapd parser extends the RFC 4512 definition by allowing string +forms as well as numeric OIDs to be used for the object class OID. +(See the +.B +olcObjectIdentifier +description.) Object classes are "STRUCTURAL" by default. +.RE +.TP +.B olcObjectIdentifier: <name> "{ <oid> | <name>[:<suffix>] }" +Define a string name that equates to the given OID. The string can be used +in place of the numeric OID in objectclass and attribute definitions. The +name can also be used with a suffix of the form ":xx" in which case the +value "oid.xx" will be used. + +.SH GENERAL BACKEND OPTIONS +Options in these entries only apply to the configuration of a single +type of backend. All backends may support this class of options, but +currently none do. +The entry must be named +.B olcBackend=<databasetype>,cn=config +and must have the olcBackendConfig objectClass. +<databasetype> +should be one of +.BR bdb , +.BR config , +.BR dnssrv , +.BR hdb , +.BR ldap , +.BR ldif , +.BR mdb , +.BR meta , +.BR monitor , +.BR ndb , +.BR null , +.BR passwd , +.BR perl , +.BR relay , +.BR shell , +or +.BR sql . +At present, no backend implements any options of this type, so this +entry should not be used. + +.SH DATABASE OPTIONS +Database options are set in entries named +.B olcDatabase={x}<databasetype>,cn=config +and must have the olcDatabaseConfig objectClass. Normally the config +engine generates the "{x}" index in the RDN automatically, so it +can be omitted when initially loading these entries. + +The special frontend database is always numbered "{\-1}" and the config +database is always numbered "{0}". + +.SH GLOBAL DATABASE OPTIONS +Options in this section may be set in the special "frontend" database +and inherited in all the other databases. These options may be altered +by further settings in each specific database. The frontend entry must +be named +.B olcDatabase=frontend,cn=config +and must have the olcFrontendConfig objectClass. +.TP +.B olcAccess: to <what> "[ by <who> <access> <control> ]+" +Grant access (specified by <access>) to a set of entries and/or +attributes (specified by <what>) by one or more requestors (specified +by <who>). +If no access controls are present, the default policy +allows anyone and everyone to read anything but restricts +updates to rootdn. (e.g., "olcAccess: to * by * read"). +See +.BR slapd.access (5) +and the "OpenLDAP Administrator's Guide" for details. + +Access controls set in the frontend are appended to any access +controls set on the specific databases. +The rootdn of a database can always read and write EVERYTHING +in that database. + +Extra special care must be taken with the access controls on the +config database. Unlike other databases, the default policy for the +config database is to only allow access to the rootdn. Regular users +should not have read access, and write access should be granted very +carefully to privileged administrators. + +.TP +.B olcDefaultSearchBase: <dn> +Specify a default search base to use when client submits a +non-base search request with an empty base DN. +Base scoped search requests with an empty base DN are not affected. +This setting is only allowed in the frontend entry. +.TP +.B olcExtraAttrs: <attr> +Lists what attributes need to be added to search requests. +Local storage backends return the entire entry to the frontend. +The frontend takes care of only returning the requested attributes +that are allowed by ACLs. +However, features like access checking and so may need specific +attributes that are not automatically returned by remote storage +backends, like proxy backends and so on. +.B <attr> +is an attribute that is needed for internal purposes +and thus always needs to be collected, even when not explicitly +requested by clients. +This attribute is multi-valued. +.TP +.B olcPasswordHash: <hash> [<hash>...] +This option configures one or more hashes to be used in generation of user +passwords stored in the userPassword attribute during processing of +LDAP Password Modify Extended Operations (RFC 3062). +The <hash> must be one of +.BR {SSHA} , +.BR {SHA} , +.BR {SMD5} , +.BR {MD5} , +.BR {CRYPT} , +and +.BR {CLEARTEXT} . +The default is +.BR {SSHA} . + +.B {SHA} +and +.B {SSHA} +use the SHA-1 algorithm (FIPS 160-1), the latter with a seed. + +.B {MD5} +and +.B {SMD5} +use the MD5 algorithm (RFC 1321), the latter with a seed. + +.B {CRYPT} +uses the +.BR crypt (3). + +.B {CLEARTEXT} +indicates that the new password should be +added to userPassword as clear text. + +Note that this option does not alter the normal user applications +handling of userPassword during LDAP Add, Modify, or other LDAP operations. +This setting is only allowed in the frontend entry. +.TP +.B olcReadOnly: TRUE | FALSE +This option puts the database into "read-only" mode. Any attempts to +modify the database will return an "unwilling to perform" error. By +default, olcReadOnly is FALSE. Note that when this option is set +TRUE on the frontend, it cannot be reset without restarting the +server, since further writes to the config database will be rejected. +.TP +.B olcRequires: <conditions> +Specify a set of conditions to require (default none). +The directive may be specified globally and/or per-database; +databases inherit global conditions, so per-database specifications +are additive. +.B bind +requires bind operation prior to directory operations. +.B LDAPv3 +requires session to be using LDAP version 3. +.B authc +requires authentication prior to directory operations. +.B SASL +requires SASL authentication prior to directory operations. +.B strong +requires strong authentication prior to directory operations. +The strong keyword allows protected "simple" authentication +as well as SASL authentication. +.B none +may be used to require no conditions (useful to clear out globally +set conditions within a particular database); it must occur first +in the list of conditions. +.TP +.B olcRestrict: <oplist> +Specify a list of operations that are restricted. +Restrictions on a specific database override any frontend setting. +Operations can be any of +.BR add , +.BR bind , +.BR compare , +.BR delete , +.BR extended[=<OID>] , +.BR modify , +.BR rename , +.BR search , +or the special pseudo-operations +.B read +and +.BR write , +which respectively summarize read and write operations. +The use of +.I restrict write +is equivalent to +.I olcReadOnly: TRUE +(see above). +The +.B extended +keyword allows one to indicate the OID of the specific operation +to be restricted. +.TP +.B olcSchemaDN: <dn> +Specify the distinguished name for the subschema subentry that +controls the entries on this server. The default is "cn=Subschema". +.TP +.B olcSecurity: <factors> +Specify a set of security strength factors (separated by white space) +to require (see +.BR olcSaslSecprops 's +.B minssf +option for a description of security strength factors). +The directive may be specified globally and/or per-database. +.B ssf=<n> +specifies the overall security strength factor. +.B transport=<n> +specifies the transport security strength factor. +.B tls=<n> +specifies the TLS security strength factor. +.B sasl=<n> +specifies the SASL security strength factor. +.B update_ssf=<n> +specifies the overall security strength factor to require for +directory updates. +.B update_transport=<n> +specifies the transport security strength factor to require for +directory updates. +.B update_tls=<n> +specifies the TLS security strength factor to require for +directory updates. +.B update_sasl=<n> +specifies the SASL security strength factor to require for +directory updates. +.B simple_bind=<n> +specifies the security strength factor required for +.I simple +username/password authentication. +Note that the +.B transport +factor is measure of security provided by the underlying transport, +e.g. ldapi:// (and eventually IPSEC). It is not normally used. +.TP +.B olcSizeLimit: {<integer>|unlimited} +.TP +.B olcSizeLimit: size[.{soft|hard|unchecked}]=<integer> [...] +Specify the maximum number of entries to return from a search operation. +The default size limit is 500. +Use +.B unlimited +to specify no limits. +The second format allows a fine grain setting of the size limits. +Extra args can be added in the same value or as additional values. +See +.BR olcLimits +for an explanation of the different flags. +.TP +.B olcSortVals: <attr> [...] +Specify a list of multi-valued attributes whose values will always +be maintained in sorted order. Using this option will allow Modify, +Compare, and filter evaluations on these attributes to be performed +more efficiently. The resulting sort order depends on the +attributes' syntax and matching rules and may not correspond to +lexical order or any other recognizable order. +This setting is only allowed in the frontend entry. +.TP +.B olcTimeLimit: {<integer>|unlimited} +.TP +.B olcTimeLimit: time[.{soft|hard}]=<integer> [...] +Specify the maximum number of seconds (in real time) +.B slapd +will spend answering a search request. The default time limit is 3600. +Use +.B unlimited +to specify no limits. +The second format allows a fine grain setting of the time limits. +Extra args can be added in the same value or as additional values. +See +.BR olcLimits +for an explanation of the different flags. + +.SH GENERAL DATABASE OPTIONS +Options in this section only apply to the specific database for +which they are defined. They are supported by every +type of backend. All of the Global Database Options may also be +used here. +.TP +.B olcAddContentAcl: TRUE | FALSE +Controls whether Add operations will perform ACL checks on +the content of the entry being added. This check is off +by default. See the +.BR slapd.access (5) +manual page for more details on ACL requirements for +Add operations. +.TP +.B olcHidden: TRUE | FALSE +Controls whether the database will be used to answer +queries. A database that is hidden will never be +selected to answer any queries, and any suffix configured +on the database will be ignored in checks for conflicts +with other databases. By default, olcHidden is FALSE. +.TP +.B olcLastMod: TRUE | FALSE +Controls whether +.B slapd +will automatically maintain the +modifiersName, modifyTimestamp, creatorsName, and +createTimestamp attributes for entries. It also controls +the entryCSN and entryUUID attributes, which are needed +by the syncrepl provider. By default, olcLastMod is TRUE. +.TP +.B olcLimits: <selector> <limit> [<limit> [...]] +Specify time and size limits based on the operation's initiator or +base DN. +The argument +.B <selector> +can be any of +.RS +.RS +.TP +anonymous | users | [<dnspec>=]<pattern> | group[/oc[/at]]=<pattern> + +.RE +with +.RS +.TP +<dnspec> ::= dn[.<type>][.<style>] +.TP +<type> ::= self | this +.TP +<style> ::= exact | base | onelevel | subtree | children | regex | anonymous + +.RE +DN type +.B self +is the default and means the bound user, while +.B this +means the base DN of the operation. +The term +.B anonymous +matches all unauthenticated clients. +The term +.B users +matches all authenticated clients; +otherwise an +.B exact +dn pattern is assumed unless otherwise specified by qualifying +the (optional) key string +.B dn +with +.B exact +or +.B base +(which are synonyms), to require an exact match; with +.BR onelevel , +to require exactly one level of depth match; with +.BR subtree , +to allow any level of depth match, including the exact match; with +.BR children , +to allow any level of depth match, not including the exact match; +.BR regex +explicitly requires the (default) match based on POSIX (''extended'') +regular expression pattern. +Finally, +.B anonymous +matches unbound operations; the +.B pattern +field is ignored. +The same behavior is obtained by using the +.B anonymous +form of the +.B <selector> +clause. +The term +.BR group , +with the optional objectClass +.B oc +and attributeType +.B at +fields, followed by +.BR pattern , +sets the limits for any DN listed in the values of the +.B at +attribute (default +.BR member ) +of the +.B oc +group objectClass (default +.BR groupOfNames ) +whose DN exactly matches +.BR pattern . + +The currently supported limits are +.B size +and +.BR time . + +The syntax for time limits is +.BR time[.{soft|hard}]=<integer> , +where +.I integer +is the number of seconds slapd will spend answering a search request. +If no time limit is explicitly requested by the client, the +.BR soft +limit is used; if the requested time limit exceeds the +.BR hard +.\"limit, an +.\".I "Administrative limit exceeded" +.\"error is returned. +limit, the value of the limit is used instead. +If the +.BR hard +limit is set to the keyword +.IR soft , +the soft limit is used in either case; if it is set to the keyword +.IR unlimited , +no hard limit is enforced. +Explicit requests for time limits smaller or equal to the +.BR hard +limit are honored. +If no limit specifier is set, the value is assigned to the +.BR soft +limit, and the +.BR hard +limit is set to +.IR soft , +to preserve the original behavior. + +The syntax for size limits is +.BR size[.{soft|hard|unchecked}]=<integer> , +where +.I integer +is the maximum number of entries slapd will return answering a search +request. +If no size limit is explicitly requested by the client, the +.BR soft +limit is used; if the requested size limit exceeds the +.BR hard +.\"limit, an +.\".I "Administrative limit exceeded" +.\"error is returned. +limit, the value of the limit is used instead. +If the +.BR hard +limit is set to the keyword +.IR soft , +the soft limit is used in either case; if it is set to the keyword +.IR unlimited , +no hard limit is enforced. +Explicit requests for size limits smaller or equal to the +.BR hard +limit are honored. +The +.BR unchecked +specifier sets a limit on the number of candidates a search request is allowed +to examine. +The rationale behind it is that searches for non-properly indexed +attributes may result in large sets of candidates, which must be +examined by +.BR slapd (8) +to determine whether they match the search filter or not. +The +.B unchecked +limit provides a means to drop such operations before they are even +started. +If the selected candidates exceed the +.BR unchecked +limit, the search will abort with +.IR "Unwilling to perform" . +If it is set to the keyword +.IR unlimited , +no limit is applied (the default). +If it is set to +.IR disable , +the search is not even performed; this can be used to disallow searches +for a specific set of users. +If no limit specifier is set, the value is assigned to the +.BR soft +limit, and the +.BR hard +limit is set to +.IR soft , +to preserve the original behavior. + +In case of no match, the global limits are used. +The default values are the same as for +.B olcSizeLimit +and +.BR olcTimeLimit ; +no limit is set on +.BR unchecked . + +If +.B pagedResults +control is requested, the +.B hard +size limit is used by default, because the request of a specific page size +is considered an explicit request for a limitation on the number +of entries to be returned. +However, the size limit applies to the total count of entries returned within +the search, and not to a single page. +Additional size limits may be enforced; the syntax is +.BR size.pr={<integer>|noEstimate|unlimited} , +where +.I integer +is the max page size if no explicit limit is set; the keyword +.I noEstimate +inhibits the server from returning an estimate of the total number +of entries that might be returned +(note: the current implementation does not return any estimate). +The keyword +.I unlimited +indicates that no limit is applied to the pagedResults control page size. +The syntax +.B size.prtotal={<integer>|unlimited|disabled} +allows one to set a limit on the total number of entries that the pagedResults +control will return. +By default it is set to the +.B hard +limit. +When set, +.I integer +is the max number of entries that the whole search with pagedResults control +can return. +Use +.I unlimited +to allow unlimited number of entries to be returned, e.g. to allow +the use of the pagedResults control as a means to circumvent size +limitations on regular searches; the keyword +.I disabled +disables the control, i.e. no paged results can be returned. +Note that the total number of entries returned when the pagedResults control +is requested cannot exceed the +.B hard +size limit of regular searches unless extended by the +.B prtotal +switch. +.RE +.TP +.B olcMaxDerefDepth: <depth> +Specifies the maximum number of aliases to dereference when trying to +resolve an entry, used to avoid infinite alias loops. The default is 15. +.TP +.B olcMirrorMode: TRUE | FALSE +This option puts a replica database into "mirror" mode. Update +operations will be accepted from any user, not just the updatedn. The +database must already be configured as syncrepl consumer +before this keyword may be set. This mode also requires a +.B olcServerID +(see above) to be configured. +By default, this setting is FALSE. +.TP +.B olcPlugin: <plugin_type> <lib_path> <init_function> [<arguments>] +Configure a SLAPI plugin. See the +.BR slapd.plugin (5) +manpage for more details. +.TP +.B olcRootDN: <dn> +Specify the distinguished name that is not subject to access control +or administrative limit restrictions for operations on this database. +This DN may or may not be associated with an entry. An empty root +DN (the default) specifies no root access is to be granted. It is +recommended that the rootdn only be specified when needed (such as +when initially populating a database). If the rootdn is within +a namingContext (suffix) of the database, a simple bind password +may also be provided using the +.B olcRootPW +directive. Note that the rootdn is always needed when using syncrepl. +The +.B olcRootDN +of the +.B cn=config +database defaults to +.B cn=config +itself. +.TP +.B olcRootPW: <password> +Specify a password (or hash of the password) for the rootdn. The +password can only be set if the rootdn is within the namingContext +(suffix) of the database. +This option accepts all RFC 2307 userPassword formats known to +the server (see +.B olcPasswordHash +description) as well as cleartext. +.BR slappasswd (8) +may be used to generate a hash of a password. Cleartext +and \fB{CRYPT}\fP passwords are not recommended. If empty +(the default), authentication of the root DN is by other means +(e.g. SASL). Use of SASL is encouraged. +.TP +.B olcSubordinate: [TRUE | FALSE | advertise] +Specify that the current backend database is a subordinate of another +backend database. A subordinate database may have only one suffix. This +option may be used to glue multiple databases into a single namingContext. +If the suffix of the current database is within the namingContext of a +superior database, searches against the superior database will be +propagated to the subordinate as well. All of the databases +associated with a single namingContext should have identical rootdns. +Behavior of other LDAP operations is unaffected by this setting. In +particular, it is not possible to use moddn to move an entry from +one subordinate to another subordinate within the namingContext. + +If the optional \fBadvertise\fP flag is supplied, the naming context of +this database is advertised in the root DSE. The default is to hide this +database context, so that only the superior context is visible. + +If the slap tools +.BR slapcat (8), +.BR slapadd (8), +or +.BR slapindex (8) +are used on the superior database, any glued subordinates that support +these tools are opened as well. + +Databases that are glued together should usually be configured with the +same indices (assuming they support indexing), even for attributes that +only exist in some of these databases. In general, all of the glued +databases should be configured as similarly as possible, since the intent +is to provide the appearance of a single directory. + +Note that the subordinate functionality is implemented internally +by the \fIglue\fP overlay and as such its behavior will interact with other +overlays in use. By default, the glue overlay is automatically configured as +the last overlay on the superior database. Its position on the database +can be explicitly configured by setting an \fBoverlay glue\fP directive +at the desired position. This explicit configuration is necessary e.g. +when using the \fIsyncprov\fP overlay, which needs to follow \fIglue\fP +in order to work over all of the glued databases. E.g. +.RS +.nf + dn: olcDatabase={1}mdb,cn=config + olcSuffix: dc=example,dc=com + ... + + dn: olcOverlay={0}glue,olcDatabase={1}mdb,cn=config + ... + + dn: olcOverlay={1}syncprov,olcDatabase={1}mdb,cn=config + ... +.fi +.RE +See the Overlays section below for more details. +.TP +.B olcSuffix: <dn suffix> +Specify the DN suffix of queries that will be passed to this +backend database. Multiple suffix lines can be given and at least one is +required for each database definition. + +If the suffix of one database is "inside" that of another, the database +with the inner suffix must come first in the configuration file. +You may also want to glue such databases together with the +.B olcSubordinate +attribute. +.TP +.B olcSyncUseSubentry: TRUE | FALSE +Store the syncrepl contextCSN in a subentry instead of the context entry +of the database. The subentry's RDN will be "cn=ldapsync". The default is +FALSE, meaning the contextCSN is stored in the context entry. +.HP +.hy 0 +.B olcSyncrepl: rid=<replica ID> +.B provider=ldap[s]://<hostname>[:port] +.B searchbase=<base DN> +.B [type=refreshOnly|refreshAndPersist] +.B [interval=dd:hh:mm:ss] +.B [retry=[<retry interval> <# of retries>]+] +.B [filter=<filter str>] +.B [scope=sub|one|base|subord] +.B [attrs=<attr list>] +.B [exattrs=<attr list>] +.B [attrsonly] +.B [sizelimit=<limit>] +.B [timelimit=<limit>] +.B [schemachecking=on|off] +.B [network\-timeout=<seconds>] +.B [timeout=<seconds>] +.B [bindmethod=simple|sasl] +.B [binddn=<dn>] +.B [saslmech=<mech>] +.B [authcid=<identity>] +.B [authzid=<identity>] +.B [credentials=<passwd>] +.B [realm=<realm>] +.B [secprops=<properties>] +.B [keepalive=<idle>:<probes>:<interval>] +.B [starttls=yes|critical] +.B [tls_cert=<file>] +.B [tls_key=<file>] +.B [tls_cacert=<file>] +.B [tls_cacertdir=<path>] +.B [tls_reqcert=never|allow|try|demand] +.B [tls_cipher_suite=<ciphers>] +.B [tls_crlcheck=none|peer|all] +.B [tls_protocol_min=<major>[.<minor>]] +.B [suffixmassage=<real DN>] +.B [logbase=<base DN>] +.B [logfilter=<filter str>] +.B [syncdata=default|accesslog|changelog] +.RS +Specify the current database as a replica which is kept up-to-date with the +master content by establishing the current +.BR slapd (8) +as a replication consumer site running a +.B syncrepl +replication engine. +The replica content is kept synchronized to the master content using +the LDAP Content Synchronization protocol. Refer to the +"OpenLDAP Administrator's Guide" for detailed information on +setting up a replicated +.B slapd +directory service using the +.B syncrepl +replication engine. + +.B rid +identifies the current +.B syncrepl +directive within the replication consumer site. +It is a non-negative integer having no more than three decimal digits. + +.B provider +specifies the replication provider site containing the master content +as an LDAP URI. If <port> is not given, the standard LDAP port number +(389 or 636) is used. + +The content of the +.B syncrepl +replica is defined using a search +specification as its result set. The consumer +.B slapd +will send search requests to the provider +.B slapd +according to the search specification. The search specification includes +.B searchbase, scope, filter, attrs, attrsonly, sizelimit, +and +.B timelimit +parameters as in the normal search specification. The +.B exattrs +option may also be used to specify attributes that should be omitted +from incoming entries. +The \fBscope\fP defaults to \fBsub\fP, the \fBfilter\fP defaults to +\fB(objectclass=*)\fP, and there is no default \fBsearchbase\fP. The +\fBattrs\fP list defaults to \fB"*,+"\fP to return all user and operational +attributes, and \fBattrsonly\fP and \fBexattrs\fP are unset by default. +The \fBsizelimit\fP and \fBtimelimit\fP only +accept "unlimited" and positive integers, and both default to "unlimited". +Note, however, that any provider-side limits for the replication identity +will be enforced by the provider regardless of the limits requested +by the LDAP Content Synchronization operation, much like for any other +search operation. + +The LDAP Content Synchronization protocol has two operation types. +In the +.B refreshOnly +operation, the next synchronization search operation +is periodically rescheduled at an interval time (specified by +.B interval +parameter; 1 day by default) +after each synchronization operation finishes. +In the +.B refreshAndPersist +operation, a synchronization search remains persistent in the provider slapd. +Further updates to the master replica will generate +.B searchResultEntry +to the consumer slapd as the search responses to the persistent +synchronization search. If the initial search fails due to an error, the +next synchronization search operation is periodically rescheduled at an +interval time (specified by +.B interval +parameter; 1 day by default) + +If an error occurs during replication, the consumer will attempt to +reconnect according to the +.B retry +parameter which is a list of the <retry interval> and <# of retries> pairs. +For example, retry="60 10 300 3" lets the consumer retry every 60 seconds +for the first 10 times and then retry every 300 seconds for the next 3 +times before stop retrying. The `+' in <# of retries> means indefinite +number of retries until success. + +The schema checking can be enforced at the LDAP Sync +consumer site by turning on the +.B schemachecking +parameter. The default is off. + +The +.B network\-timeout +parameter sets how long the consumer will wait to establish a +network connection to the provider. Once a connection is +established, the +.B timeout +parameter determines how long the consumer will wait for the initial +Bind request to complete. The defaults for these parameters come +from +.BR ldap.conf (5). + +A +.B bindmethod +of +.B simple +requires the options +.B binddn +and +.B credentials +and should only be used when adequate security services +(e.g. TLS or IPSEC) are in place. +A +.B bindmethod +of +.B sasl +requires the option +.B saslmech. +Depending on the mechanism, an authentication identity and/or +credentials can be specified using +.B authcid +and +.B credentials. +The +.B authzid +parameter may be used to specify an authorization identity. +Specific security properties (as with the +.B sasl\-secprops +keyword above) for a SASL bind can be set with the +.B secprops +option. A non default SASL realm can be set with the +.B realm +option. +The provider, other than allow authentication of the syncrepl identity, +should grant that identity appropriate access privileges to the data +that is being replicated (\fBaccess\fP directive), and appropriate time +and size limits (\fBlimits\fP directive). + +The +.B keepalive +parameter sets the values of \fIidle\fP, \fIprobes\fP, and \fIinterval\fP +used to check whether a socket is alive; +.I idle +is the number of seconds a connection needs to remain idle before TCP +starts sending keepalive probes; +.I probes +is the maximum number of keepalive probes TCP should send before dropping +the connection; +.I interval +is interval in seconds between individual keepalive probes. +Only some systems support the customization of these values; +the +.B keepalive +parameter is ignored otherwise, and system-wide settings are used. + +The +.B starttls +parameter specifies use of the StartTLS extended operation +to establish a TLS session before Binding to the provider. If the +.B critical +argument is supplied, the session will be aborted if the StartTLS request +fails. Otherwise the syncrepl session continues without TLS. The +tls_reqcert setting defaults to "demand" and the other TLS settings +default to the same as the main slapd TLS settings. + +The +.B suffixmassage +parameter allows the consumer to pull entries from a remote directory +whose DN suffix differs from the local directory. The portion of the +remote entries' DNs that matches the \fIsearchbase\fP will be replaced +with the suffixmassage DN. + +Rather than replicating whole entries, the consumer can query logs of +data modifications. This mode of operation is referred to as \fIdelta +syncrepl\fP. In addition to the above parameters, the +.B logbase +and +.B logfilter +parameters must be set appropriately for the log that will be used. The +.B syncdata +parameter must be set to either "accesslog" if the log conforms to the +.BR slapo\-accesslog (5) +log format, or "changelog" if the log conforms +to the obsolete \fIchangelog\fP format. If the +.B syncdata +parameter is omitted or set to "default" then the log parameters are +ignored. +.RE +.TP +.B olcUpdateDN: <dn> +This option is only applicable in a slave +database. +It specifies the DN permitted to update (subject to access controls) +the replica. It is only needed in certain push-mode +replication scenarios. Generally, this DN +.I should not +be the same as the +.B rootdn +used at the master. +.TP +.B olcUpdateRef: <url> +Specify the referral to pass back when +.BR slapd (8) +is asked to modify a replicated local database. +If multiple values are specified, each url is provided. + +.SH DATABASE-SPECIFIC OPTIONS +Each database may allow specific configuration options; they are +documented separately in the backends' manual pages. See the +.BR slapd.backends (5) +manual page for an overview of available backends. +.SH OVERLAYS +An overlay is a piece of +code that intercepts database operations in order to extend or change +them. Overlays are pushed onto +a stack over the database, and so they will execute in the reverse +of the order in which they were configured and the database itself +will receive control last of all. + +Overlays must be configured as child entries of a specific database. The +entry's RDN must be of the form +.B olcOverlay={x}<overlaytype> +and the entry must have the olcOverlayConfig objectClass. Normally the +config engine generates the "{x}" index in the RDN automatically, so +it can be omitted when initially loading these entries. + +See the +.BR slapd.overlays (5) +manual page for an overview of available overlays. +.SH EXAMPLES +.LP +Here is a short example of a configuration in LDIF suitable for use with +.BR slapadd (8) +: +.LP +.RS +.nf +dn: cn=config +objectClass: olcGlobal +cn: config +olcPidFile: LOCALSTATEDIR/run/slapd.pid +olcAttributeOptions: x\-hidden lang\- + +dn: cn=schema,cn=config +objectClass: olcSchemaConfig +cn: schema + +include: file://SYSCONFDIR/schema/core.ldif + +dn: olcDatabase=frontend,cn=config +objectClass: olcDatabaseConfig +objectClass: olcFrontendConfig +olcDatabase: frontend +# Subtypes of "name" (e.g. "cn" and "ou") with the +# option ";x\-hidden" can be searched for/compared, +# but are not shown. See \fBslapd.access\fP(5). +olcAccess: to attrs=name;x\-hidden by * =cs +# Protect passwords. See \fBslapd.access\fP(5). +olcAccess: to attrs=userPassword by * auth +# Read access to other attributes and entries. +olcAccess: to * by * read + +# set a rootpw for the config database so we can bind. +# deny access to everyone else. +dn: olcDatabase=config,cn=config +objectClass: olcDatabaseConfig +olcDatabase: config +olcRootPW: {SSHA}XKYnrjvGT3wZFQrDD5040US592LxsdLy +olcAccess: to * by * none + +dn: olcDatabase=bdb,cn=config +objectClass: olcDatabaseConfig +objectClass: olcBdbConfig +olcDatabase: bdb +olcSuffix: "dc=our\-domain,dc=com" +# The database directory MUST exist prior to +# running slapd AND should only be accessible +# by the slapd/tools. Mode 0700 recommended. +olcDbDirectory: LOCALSTATEDIR/openldap\-data +# Indices to maintain +olcDbIndex: objectClass eq +olcDbIndex: cn,sn,mail pres,eq,approx,sub + +# We serve small clients that do not handle referrals, +# so handle remote lookups on their behalf. +dn: olcDatabase=ldap,cn=config +objectClass: olcDatabaseConfig +objectClass: olcLdapConfig +olcDatabase: ldap +olcSuffix: "" +olcDbUri: ldap://ldap.some\-server.com/ +.fi +.RE +.LP +Assuming the above data was saved in a file named "config.ldif" and the +ETCDIR/slapd.d directory has been created, this command will initialize +the configuration: +.RS +.nf +slapadd \-F ETCDIR/slapd.d \-n 0 \-l config.ldif +.fi +.RE + +.LP +"OpenLDAP Administrator's Guide" contains a longer annotated +example of a slapd configuration. + +Alternatively, an existing slapd.conf file can be converted to the new +format using slapd or any of the slap tools: +.RS +.nf +slaptest \-f ETCDIR/slapd.conf \-F ETCDIR/slapd.d +.fi +.RE + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.TP +ETCDIR/slapd.d +default slapd configuration directory +.SH SEE ALSO +.BR ldap (3), +.BR ldif (5), +.BR gnutls\-cli (1), +.BR slapd.access (5), +.BR slapd.backends (5), +.BR slapd.conf (5), +.BR slapd.overlays (5), +.BR slapd.plugin (5), +.BR slapd (8), +.BR slapacl (8), +.BR slapadd (8), +.BR slapauth (8), +.BR slapcat (8), +.BR slapdn (8), +.BR slapindex (8), +.BR slappasswd (8), +.BR slaptest (8). +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man5/slapd-dnssrv.5 b/doc/man/man5/slapd-dnssrv.5 new file mode 100644 index 0000000..2c32228 --- /dev/null +++ b/doc/man/man5/slapd-dnssrv.5 @@ -0,0 +1,49 @@ +.TH SLAPD-DNSSRV 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-dnssrv \- DNS SRV referral backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The DNSSRV backend to +.BR slapd (8) +serves up referrals based upon SRV resource records held in +the Domain Name System. +.LP +This backend is experimental. +.SH CONFIGURATION +The DNSSRV backend has no backend nor database specific options. +It is configured simply by "database dnssrv" followed a suffix +directive, e.g. suffix "". +.SH ACCESS CONTROL +The +.B dnssrv +backend does not honor all ACL semantics as described in +.BR slapd.access (5). +In fact, this backend only implements the +.B search +operation when the +.B manageDSAit +control (RFC 3296) is used, otherwise for every operation a referral, +whenever appropriate, or an error is returned. +Currently, there is no means to condition the returning of the referral +by means of ACLs; no access control is implemented, except for +.B read (=r) +access to the returned entries, which is actually provided by the frontend. +Note, however, that the information returned by this backend is collected +through the DNS, so it is public by definition. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.br +.SH SEE ALSO +\fB"OpenLDAP Root Service - An experimental LDAP referral +service"\fR [RFC 3088], +.br +\fB"OpenLDAP LDAP Root Service"\fR <http://www.openldap.org/faq/?file=393)>, +.br +.BR slapd.conf (5), +.BR slapd (8) diff --git a/doc/man/man5/slapd-ldap.5 b/doc/man/man5/slapd-ldap.5 new file mode 100644 index 0000000..1c50954 --- /dev/null +++ b/doc/man/man5/slapd-ldap.5 @@ -0,0 +1,784 @@ +.TH SLAPD-LDAP 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-ldap \- LDAP backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The LDAP backend to +.BR slapd (8) +is not an actual database; instead it acts as a proxy to forward incoming +requests to another LDAP server. While processing requests it will also +chase referrals, so that referrals are fully processed instead of being +returned to the slapd client. + +Sessions that explicitly Bind to the back-ldap database always create their +own private connection to the remote LDAP server. Anonymous sessions will +share a single anonymous connection to the remote server. For sessions bound +through other mechanisms, all sessions with the same DN will share the +same connection. This connection pooling strategy can enhance the proxy's +efficiency by reducing the overhead of repeatedly making/breaking multiple +connections. + +The ldap database can also act as an information service, i.e. the identity +of locally authenticated clients is asserted to the remote server, possibly +in some modified form. +For this purpose, the proxy binds to the remote server with some +administrative identity, and, if required, authorizes the asserted identity. +See the +.IR idassert\- * +rules below. +The administrative identity of the proxy, on the remote server, must be +allowed to authorize by means of appropriate +.B authzTo +rules; see +.BR slapd.conf (5) +for details. + +The proxy instance of +.BR slapd (8) +must contain schema information for the attributes and objectClasses +used in filters, request DNs and request-related data in general. +It should also contain schema information for the data returned +by the proxied server. +It is the responsibility of the proxy administrator to keep the schema +of the proxy lined up with that of the proxied server. + +.LP +Note: When looping back to the same instance of +.BR slapd (8), +each connection requires a new thread; as a consequence, +.BR slapd (8) +must be compiled with thread support, and the \fBthreads\fP parameter +may need some tuning; in those cases, one may consider using +.BR slapd\-relay (5) +instead, which performs the relayed operation +internally and thus reuses the same connection. + +.SH CONFIGURATION +These +.B slapd.conf +options apply to the LDAP backend database. +That is, they must follow a "database ldap" line and come before any +subsequent "backend" or "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page. + +.LP +Note: In early versions of back-ldap it was recommended to always set +.LP +.RS +.nf +lastmod off +.fi +.RE +.LP +for +.B ldap +and +.B meta +databases. +This was required because operational attributes related to entry creation +and modification should not be proxied, as they could be mistakenly written +to the target server(s), generating an error. +The current implementation automatically sets lastmod to \fBoff\fP, +so its use is redundant and should be omitted. + +.TP +.B uri <ldapurl> +LDAP server to use. Multiple URIs can be set in a single +.B ldapurl +argument, resulting in the underlying library automatically +calling the first server of the list that responds, e.g. + +\fBuri "ldap://host/ ldap://backup\-host/"\fP + +The URI list is space- or comma-separated. +Whenever the server that responds is not the first one in the list, +the list is rearranged and the responsive server is moved to the head, +so that it will be first contacted the next time a connection +needs to be created. +.HP +.hy 0 +.B acl\-bind +.B bindmethod=simple|sasl [binddn=<simple DN>] [credentials=<simple password>] +.B [saslmech=<SASL mech>] [secprops=<properties>] [realm=<realm>] +.B [authcId=<authentication ID>] [authzId=<authorization ID>] +.B [starttls=no|yes|critical] +.B [tls_cert=<file>] +.B [tls_key=<file>] +.B [tls_cacert=<file>] +.B [tls_cacertdir=<path>] +.B [tls_reqcert=never|allow|try|demand] +.B [tls_cipher_suite=<ciphers>] +.B [tls_protocol_min=<major>[.<minor>]] +.B [tls_crlcheck=none|peer|all] +.RS +Allows one to define the parameters of the authentication method that is +internally used by the proxy to collect info related to access control, +and whenever an operation occurs with the identity of the rootdn +of the LDAP proxy database. +The identity defined by this directive, according to the properties +associated to the authentication method, is supposed to have read access +on the target server to attributes used on the proxy for ACL checking. + +There is no risk of giving away such values; they are only used to +check permissions. +The default is to use +.BR simple +bind, with empty \fIbinddn\fP and \fIcredentials\fP, +which means that the related operations will be performed anonymously. +If not set, and if \fBidassert\-bind\fP is defined, this latter identity +is used instead. See \fBidassert\-bind\fP for details. + +The connection between the proxy database and the remote server +associated to this identity is cached regardless of the lifespan +of the client-proxy connection that first established it. + +.B This identity is not implicitly used by the proxy +.B when the client connects anonymously. +The +.B idassert\-bind +feature, instead, in some cases can be crafted to implement that behavior, +which is \fIintrinsically unsafe and should be used with extreme care\fP. +This directive obsoletes +.BR acl\-authcDN , +and +.BR acl\-passwd . + +The TLS settings default to the same as the main slapd TLS settings, +except for +.B tls_reqcert +which defaults to "demand". +.RE + +.TP +.B cancel {ABANDON|ignore|exop[\-discover]} +Defines how to handle operation cancellation. +By default, +.B abandon +is invoked, so the operation is abandoned immediately. +If set to +.BR ignore , +no action is taken and any further response is ignored; this may result +in further response messages to be queued for that connection, so it is +recommended that long lasting connections are timed out either by +.I idle\-timeout +or +.IR conn\-ttl , +so that resources eventually get released. +If set to +.BR exop , +a +.I cancel +operation (RFC 3909) is issued, resulting in the cancellation +of the current operation; the +.I cancel +operation waits for remote server response, so its use +may not be recommended. +If set to +.BR exop\-discover , +support of the +.I cancel +extended operation is detected by reading the remote server's root DSE. + +.TP +.B chase\-referrals {YES|no} +enable/disable automatic referral chasing, which is delegated to the +underlying libldap, with rebinding eventually performed if the +\fBrebind\-as\-user\fP directive is used. The default is to chase referrals. + +.TP +.B conn\-ttl <time> +This directive causes a cached connection to be dropped and recreated +after a given ttl, regardless of being idle or not. + +.TP +.B idassert\-authzFrom <authz-regexp> +if defined, selects what +.I local +identities are authorized to exploit the identity assertion feature. +The string +.B <authz-regexp> +follows the rules defined for the +.I authzFrom +attribute. +See +.BR slapd.conf (5), +section related to +.BR authz\-policy , +for details on the syntax of this field. + +.HP +.hy 0 +.B idassert\-bind +.B bindmethod=none|simple|sasl [binddn=<simple DN>] [credentials=<simple password>] +.B [saslmech=<SASL mech>] [secprops=<properties>] [realm=<realm>] +.B [authcId=<authentication ID>] [authzId=<authorization ID>] +.B [authz={native|proxyauthz}] [mode=<mode>] [flags=<flags>] +.B [starttls=no|yes|critical] +.B [tls_cert=<file>] +.B [tls_key=<file>] +.B [tls_cacert=<file>] +.B [tls_cacertdir=<path>] +.B [tls_reqcert=never|allow|try|demand] +.B [tls_cipher_suite=<ciphers>] +.B [tls_protocol_min=<version>] +.B [tls_crlcheck=none|peer|all] +.RS +Allows one to define the parameters of the authentication method that is +internally used by the proxy to authorize connections that are +authenticated by other databases. +Direct binds are always proxied without any idassert handling. + +The identity defined by this directive, according to the properties +associated to the authentication method, is supposed to have auth access +on the target server to attributes used on the proxy for authentication +and authorization, and to be allowed to authorize the users. +This requires to have +.B proxyAuthz +privileges on a wide set of DNs, e.g. +.BR authzTo=dn.subtree:"" , +and the remote server to have +.B authz\-policy +set to +.B to +or +.BR both . +See +.BR slapd.conf (5) +for details on these statements and for remarks and drawbacks about +their usage. +The supported bindmethods are + +\fBnone|simple|sasl\fP + +where +.B none +is the default, i.e. no \fIidentity assertion\fP is performed. + +The authz parameter is used to instruct the SASL bind to exploit +.B native +SASL authorization, if available; since connections are cached, +this should only be used when authorizing with a fixed identity +(e.g. by means of the +.B authzDN +or +.B authzID +parameters). +Otherwise, the default +.B proxyauthz +is used, i.e. the proxyAuthz control (Proxied Authorization, RFC 4370) +is added to all operations. + +The supported modes are: + +\fB<mode> := {legacy|anonymous|none|self}\fP + +If +.B <mode> +is not present, and +.B authzId +is given, the proxy always authorizes that identity. +.B <authorization ID> +can be + +\fBu:<user>\fP + +\fB[dn:]<DN>\fP + +The former is supposed to be expanded by the remote server according +to the authz rules; see +.BR slapd.conf (5) +for details. +In the latter case, whether or not the +.B dn: +prefix is present, the string must pass DN validation and normalization. + +The default mode is +.BR legacy , +which implies that the proxy will either perform a simple bind as the +.I authcDN +or a SASL bind as the +.I authcID +and assert the client's identity when it is not anonymous. +The other modes imply that the proxy will always either perform a simple bind +as the +.IR authcDN +or a SASL bind as the +.IR authcID , +unless restricted by +.BR idassert\-authzFrom +rules (see below), in which case the operation will fail; +eventually, it will assert some other identity according to +.BR <mode> . +Other identity assertion modes are +.BR anonymous +and +.BR self , +which respectively mean that the +.I empty +or the +.IR client 's +identity +will be asserted; +.BR none , +which means that no proxyAuthz control will be used, so the +.I authcDN +or the +.I authcID +identity will be asserted. +For all modes that require the use of the +.I proxyAuthz +control, on the remote server the proxy identity must have appropriate +.I authzTo +permissions, or the asserted identities must have appropriate +.I authzFrom +permissions. Note, however, that the ID assertion feature is mostly +useful when the asserted identities do not exist on the remote server. + +Flags can be + +\fBoverride,[non\-]prescriptive,proxy\-authz\-[non\-]critical\fP + +When the +.B override +flag is used, identity assertion takes place even when the database +is authorizing for the identity of the client, i.e. after binding +with the provided identity, and thus authenticating it, the proxy +performs the identity assertion using the configured identity and +authentication method. + +When the +.B prescriptive +flag is used (the default), operations fail with +\fIinappropriateAuthentication\fP +for those identities whose assertion is not allowed by the +.B idassert\-authzFrom +patterns. +If the +.B non\-prescriptive +flag is used, operations are performed anonymously for those identities +whose assertion is not allowed by the +.B idassert\-authzFrom +patterns. + +When the +.B proxy\-authz\-non\-critical +flag is used (the default), the proxyAuthz control is not marked as critical, +in violation of RFC 4370. Use of +.B proxy\-authz\-critical +is recommended. + +The TLS settings default to the same as the main slapd TLS settings, +except for +.B tls_reqcert +which defaults to "demand". + +The identity associated to this directive is also used for privileged +operations whenever \fBidassert\-bind\fP is defined and \fBacl\-bind\fP +is not. See \fBacl\-bind\fP for details. + +This directive obsoletes +.BR idassert\-authcDN , +.BR idassert\-passwd , +.BR idassert\-mode , +and +.BR idassert\-method . +.RE + +.TP +.B idassert-passthru <authz-regexp> +if defined, selects what +.I local +identities bypass the identity assertion feature. +Those identities need to be known by the remote host. +The string +.B <authz-regexp> +follows the rules defined for the +.I authzFrom +attribute. +See +.BR slapd.conf (5), +section related to +.BR authz\-policy , +for details on the syntax of this field. + + +.TP +.B idle\-timeout <time> +This directive causes a cached connection to be dropped an recreated +after it has been idle for the specified time. + +.TP +.B keepalive <idle>:<probes>:<interval> +The +.B keepalive +parameter sets the values of \fIidle\fP, \fIprobes\fP, and \fIinterval\fP +used to check whether a socket is alive; +.I idle +is the number of seconds a connection needs to remain idle before TCP +starts sending keepalive probes; +.I probes +is the maximum number of keepalive probes TCP should send before dropping +the connection; +.I interval +is interval in seconds between individual keepalive probes. +Only some systems support the customization of these values; +the +.B keepalive +parameter is ignored otherwise, and system-wide settings are used. + +.TP +.B network\-timeout <time> +Sets the network timeout value after which +.BR poll (2)/ select (2) +following a +.BR connect (2) +returns in case of no activity. +The value is in seconds, and it can be specified as for +.BR idle\-timeout . + +.TP +.B norefs <NO|yes> +If +.BR yes , +do not return search reference responses. +By default, they are returned unless request is LDAPv2. + +.TP +.B omit-unknown-schema <NO|yes> +If +.BR yes , +do not return objectClasses or attributes that are not known to the local server. +The default is to return all schema elements. + +.TP +.B noundeffilter <NO|yes> +If +.BR yes , +return success instead of searching if a filter is undefined or contains +undefined portions. +By default, the search is propagated after replacing undefined portions +with +.BR (!(objectClass=*)) , +which corresponds to the empty result set. + +.TP +.B onerr {CONTINUE|stop} +This directive allows one to select the behavior in case an error is returned +by the remote server during a search. +The default, \fBcontinue\fP, consists in returning success. +If the value is set to \fBstop\fP, the error is returned to the client. + +.TP +.B protocol\-version {0,2,3} +This directive indicates what protocol version must be used to contact +the remote server. +If set to 0 (the default), the proxy uses the same protocol version +used by the client, otherwise the requested protocol is used. +The proxy returns \fIunwillingToPerform\fP if an operation that is +incompatible with the requested protocol is attempted. + +.TP +.B proxy\-whoami {NO|yes} +Turns on proxying of the WhoAmI extended operation. If this option is +given, back-ldap will replace slapd's original WhoAmI routine with its +own. On slapd sessions that were authenticated by back-ldap, the WhoAmI +request will be forwarded to the remote LDAP server. Other sessions will +be handled by the local slapd, as before. This option is mainly useful +in conjunction with Proxy Authorization. + +.TP +.B quarantine <interval>,<num>[;<interval>,<num>[...]] +Turns on quarantine of URIs that returned +.IR LDAP_UNAVAILABLE , +so that an attempt to reconnect only occurs at given intervals instead +of any time a client requests an operation. +The pattern is: retry only after at least +.I interval +seconds elapsed since last attempt, for exactly +.I num +times; then use the next pattern. +If +.I num +for the last pattern is "\fB+\fP", it retries forever; otherwise, +no more retries occur. +The process can be restarted by resetting the \fIolcDbQuarantine\fP +attribute of the database entry in the configuration backend. + +.TP +.B rebind\-as\-user {NO|yes} +If this option is given, the client's bind credentials are remembered +for rebinds, when trying to re-establish a broken connection, +or when chasing a referral, if +.B chase\-referrals +is set to +.IR yes . + +.TP +.B session\-tracking\-request {NO|yes} +Adds session tracking control for all requests. +The client's IP and hostname, and the identity associated to each request, +if known, are sent to the remote server for informational purposes. +This directive is incompatible with setting \fIprotocol\-version\fP to 2. + +.TP +.B single\-conn {NO|yes} +Discards current cached connection when the client rebinds. + +.TP +.B t\-f\-support {NO|yes|discover} +enable if the remote server supports absolute filters +(see \fIRFC 4526\fP for details). +If set to +.BR discover , +support is detected by reading the remote server's root DSE. + +.TP +.B timeout [<op>=]<val> [...] +This directive allows one to set per-operation timeouts. +Operations can be + +\fB<op> ::= bind, add, delete, modrdn, modify, compare, search\fP + +The overall duration of the \fBsearch\fP operation is controlled either +by the \fBtimelimit\fP parameter or by server-side enforced +time limits (see \fBtimelimit\fP and \fBlimits\fP in +.BR slapd.conf (5) +for details). +This \fBtimeout\fP parameter controls how long the target can be +irresponsive before the operation is aborted. +Timeout is meaningless for the remaining operations, +\fBunbind\fP and \fBabandon\fP, which do not imply any response, +while it is not yet implemented in currently supported \fBextended\fP +operations. +If no operation is specified, the timeout \fBval\fP affects all +supported operations. + +Note: if the timelimit is exceeded, the operation is cancelled +(according to the \fBcancel\fP directive); +the protocol does not provide any means to rollback operations, +so the client will not be notified about the result of the operation, +which may eventually succeeded or not. +In case the timeout is exceeded during a bind operation, the connection +is destroyed, according to RFC4511. + +Note: in some cases, this backend may issue binds prior +to other operations (e.g. to bind anonymously or with some prescribed +identity according to the \fBidassert\-bind\fP directive). +In this case, the timeout of the operation that resulted in the bind +is used. + +.HP +.hy 0 +.B tls {[try\-]start|[try\-]propagate|ldaps} +.B [tls_cert=<file>] +.B [tls_key=<file>] +.B [tls_cacert=<file>] +.B [tls_cacertdir=<path>] +.B [tls_reqcert=never|allow|try|demand] +.B [tls_cipher_suite=<ciphers>] +.B [tls_crlcheck=none|peer|all] +.RS +Specify the use of TLS when a regular connection is initialized. The +StartTLS extended operation will be used unless the URI directive protocol +scheme is \fBldaps://\fP. In that case this keyword may only be +set to "ldaps" and the StartTLS operation will not be used. +\fBpropagate\fP issues the StartTLS operation only if the original +connection did. +The \fBtry\-\fP prefix instructs the proxy to continue operations +if the StartTLS operation failed; its use is \fBnot\fP recommended. + +The TLS settings default to the same as the main slapd TLS settings, +except for +.B tls_reqcert +which defaults to "demand". +.RE + +.TP +.B use\-temporary\-conn {NO|yes} +when set to +.BR yes , +create a temporary connection whenever competing with other threads +for a shared one; otherwise, wait until the shared connection is available. + +.SH BACKWARD COMPATIBILITY +The LDAP backend has been heavily reworked between releases 2.2 and 2.3, +and subsequently between 2.3 and 2.4. +As a side-effect, some of the traditional directives have been +deprecated and should be no longer used, as they might disappear +in future releases. + +.TP +.B acl\-authcDN "<administrative DN for access control purposes>" +Formerly known as the +.BR binddn , +it is the DN that is used to query the target server for acl checking; +it is supposed to have read access on the target server to attributes used +on the proxy for acl checking. +There is no risk of giving away such values; they are only used to +check permissions. + +.B The acl\-authcDN identity is by no means implicitly used by the proxy +.B when the client connects anonymously. +The +.B idassert\-* +feature can be used (at own risk) for that purpose instead. + +This directive is obsoleted by the +.B binddn +arg of +.B acl\-bind +when \fIbindmethod\fP=\fBsimple\fP, and will be dismissed in the future. + +.TP +.B acl\-passwd <password> +Formerly known as the +.BR bindpw , +it is the password used with the above +.B acl\-authcDN +directive. +This directive is obsoleted by the +.B credentials +arg of +.B acl\-bind +when \fIbindmethod\fP=\fBsimple\fP, and will be dismissed in the future. + +.TP +.B idassert\-authcDN "<administrative DN for proxyAuthz purposes>" +DN which is used to propagate the client's identity to the target +by means of the proxyAuthz control when the client does not +belong to the DIT fragment that is being proxied by back-ldap. +This directive is obsoleted by the +.B binddn +arg of +.BR idassert\-bind +when \fIbindmethod\fP=\fBsimple\fP, and will be dismissed in the future. + +.TP +.B idassert\-passwd <password> +Password used with the +.B idassert\-authcDN +above. +This directive is obsoleted by the +.B crendentials +arg of +.B idassert\-bind +when \fIbindmethod\fP=\fBsimple\fP, and will be dismissed in the future. + +.TP +.B idassert\-mode <mode> [<flags>] +defines what type of +.I identity assertion +is used. +This directive is obsoleted by the +.B mode +arg of +.BR idassert\-bind , +and will be dismissed in the future. + +.TP +.B idassert\-method <method> [<saslargs>] +This directive is obsoleted by the +.B bindmethod +arg of +.BR idassert\-bind , +and will be dismissed in the future. + +.TP +.B port <port> +this directive is no longer supported. Use the +.B uri +directive as described above. + +.TP +.B server <hostname[:port]> +this directive is no longer supported. Use the +.B uri +directive as described above. + +.TP +.B suffixmassage, map, rewrite* +These directives are no longer supported by back-ldap; their +functionality is now delegated to the +.B rwm +overlay. Essentially, add a statement + +.B overlay rwm + +first, and prefix all rewrite/map statements with +.B rwm\- +to obtain the original behavior. +See +.BR slapo\-rwm (5) +for details. +.\" However, to ease update from existing configurations, back-ldap still +.\" recognizes them and automatically instantiates the +.\" .B rwm +.\" overlay if available and not instantiated yet. +.\" This behavior may change in the future. + +.SH ACCESS CONTROL +The +.B ldap +backend does not honor all ACL semantics as described in +.BR slapd.access (5). +In general, access checking is delegated to the remote server(s). +Only +.B read (=r) +access to the +.B entry +pseudo-attribute and to the other attribute values of the entries +returned by the +.B search +operation is honored, which is performed by the frontend. + +.SH OVERLAYS +The LDAP backend provides basic proxying functionalities to many overlays. +The +.B chain +overlay, described in +.BR slapo\-chain (5), +and the +.B translucent +overlay, described in +.BR slapo\-translucent (5), +deserve a special mention. + +Conversely, there are many overlays that are best used in conjunction +with the LDAP backend. +The +.B proxycache +overlay allows caching of LDAP search requests (queries) +in a local database. +See +.BR slapo\-pcache (5) +for details. +The +.B rwm +overlay provides DN rewrite and attribute/objectClass mapping +capabilities to the underlying database. +See +.BR slapo\-rwm (5) +for details. + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd\-meta (5), +.BR slapo\-chain (5), +.BR slapo\-pcache (5), +.BR slapo\-rwm (5), +.BR slapo\-translucent (5), +.BR slapd (8), +.BR ldap (3). +.SH AUTHOR +Howard Chu, with enhancements by Pierangelo Masarati diff --git a/doc/man/man5/slapd-ldif.5 b/doc/man/man5/slapd-ldif.5 new file mode 100644 index 0000000..8a74b90 --- /dev/null +++ b/doc/man/man5/slapd-ldif.5 @@ -0,0 +1,54 @@ +.TH SLAPD-LDIF 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-ldif \- LDIF backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The LDIF backend to +.BR slapd (8) +is a basic storage backend that stores entries in text files in LDIF format, +and exploits the filesystem to create the tree structure of the database. +It is intended as a cheap, low performance easy to use backend, and it is +exploited by higher-level internal structures to provide a permanent +storage. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the LDIF backend database. +That is, they must follow a "database ldif" line and come before +any subsequent "backend" or "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page. +.TP +.B directory <dir> +Specify the directory where the database tree starts. The directory +must exist and grant appropriate permissions (rwx) to the identity slapd +is running with. +.SH ACCESS CONTROL +The +.B LDIF +backend does not honor any of the access control semantics described in +.BR slapd.access (5). +Only +.B read (=r) +access to the +.B entry +pseudo-attribute and to the other attribute values of the entries +returned by the +.B search +operation is honored, which is performed by the frontend. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd (8), +.BR ldif (5). +.SH AUTHOR +Eric Stokes diff --git a/doc/man/man5/slapd-mdb.5 b/doc/man/man5/slapd-mdb.5 new file mode 100644 index 0000000..002ecf9 --- /dev/null +++ b/doc/man/man5/slapd-mdb.5 @@ -0,0 +1,208 @@ +.TH SLAPD-MDB 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2011-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-mdb \- Memory-Mapped DB backend to slapd +.SH SYNOPSIS +.B ETCDIR/slapd.conf +.SH DESCRIPTION +The \fBmdb\fP backend to +.BR slapd (8) +uses OpenLDAP's Lightning Memory-Mapped DB (LMDB) library to store data. +It relies completely on the underlying operating system for memory +management and does no caching of its own. It is the recommended +primary database backend. +.LP +The \fBmdb\fP backend is similar to the \fBhdb\fP backend in that +it uses a hierarchical database layout which +supports subtree renames. It is both more space-efficient and more +execution-efficient than the \fBbdb\fP backend, while being overall +much simpler to manage. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the \fBmdb\fP backend database. +That is, they must follow a "database mdb" line and +come before any subsequent "backend" or "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page. +.TP +.BI checkpoint \ <kbyte>\ <min> +Specify the frequency for flushing the database disk buffers. +This setting is only needed if the \fBdbnosync\fP option is used. +The checkpoint will occur if either \fI<kbyte>\fP data has been written or +\fI<min>\fP minutes have passed since the last checkpoint. +Both arguments default to zero, in which case they are ignored. When +the \fI<min>\fP argument is non-zero, an internal task will run every +\fI<min>\fP minutes to perform the checkpoint. +Note: currently the \fI<kbyte>\fP setting is unimplemented. +.TP +.B dbnosync +Specify that on-disk database contents should not be immediately +synchronized with in memory changes. +Enabling this option may improve performance at the expense of data +security. In particular, if the operating system crashes before changes are +flushed, some number of transactions may be lost. +By default, a full data flush/sync is performed when each +transaction is committed. +.TP +.BI directory \ <directory> +Specify the directory where the LMDB files containing this database and +associated indexes live. +A separate directory must be specified for each database. +The default is +.BR LOCALSTATEDIR/openldap\-data . +.TP +\fBenvflags \fR{\fBnosync\fR,\fBnometasync\fR,\fBwritemap\fR,\fBmapasync\fR,\fBnordahead\fR} +Specify flags for finer-grained control of the LMDB library's operation. +.RS +.TP +.B nosync +This is exactly the same as the +.I dbnosync +directive. +.RE +.RS +.TP +.B nometasync +Flush the data on a commit, but skip the sync of the meta page. This mode is +slightly faster than doing a full sync, but can potentially lose the last +committed transaction if the operating system crashes. If both +.I nometasync +and +.I nosync +are set, the +.I nosync +flag takes precedence. +.RE +.RS +.TP +.B writemap +Use a writable memory map instead of just read-only. This speeds up write operations +but makes the database vulnerable to corruption in case any bugs in slapd +cause stray writes into the mmap region. +.RE +.RS +.TP +.B mapasync +When using a writable memory map and performing flushes on each commit, use an +asynchronous flush instead of a synchronous flush (the default). This option +has no effect if +.I writemap +has not been set. It also has no effect if +.I nosync +is set. +.RE +.RS +.TP +.B nordahead +Turn off file readahead. Usually the OS performs readahead on every read +request. This usually boosts read performance but can be harmful to +random access read performance if the system's memory is full and the DB +is larger than RAM. This option is not implemented on Windows. +.RE + +.TP +\fBindex \fR{\fI<attrlist>\fR|\fBdefault\fR} [\fBpres\fR,\fBeq\fR,\fBapprox\fR,\fBsub\fR,\fI<special>\fR] +Specify the indexes to maintain for the given attribute (or +list of attributes). +Some attributes only support a subset of indexes. +If only an \fI<attr>\fP is given, the indices specified for \fBdefault\fR +are maintained. +Note that setting a default does not imply that all attributes will be +indexed. Also, for best performance, an +.B eq +index should always be configured for the +.B objectClass +attribute. + +A number of special index parameters may be specified. +The index type +.B sub +can be decomposed into +.BR subinitial , +.BR subany ,\ and +.B subfinal +indices. +The special type +.B nolang +may be specified to disallow use of this index by language subtypes. +The special type +.B nosubtypes +may be specified to disallow use of this index by named subtypes. +Note: changing \fBindex\fP settings in +.BR slapd.conf (5) +requires rebuilding indices, see +.BR slapindex (8); +changing \fBindex\fP settings +dynamically by LDAPModifying "cn=config" automatically causes rebuilding +of the indices online in a background task. +.TP +.BI maxreaders \ <integer> +Specify the maximum number of threads that may have concurrent read access +to the database. Tools such as slapcat count as a single thread, +in addition to threads in any active slapd processes. The +default is 126. +.TP +.BI maxsize \ <bytes> +Specify the maximum size of the database in bytes. A memory map of this +size is allocated at startup time and the database will not be allowed +to grow beyond this size. The default is 10485760 bytes. This setting +may be changed upward if the configured limit needs to be increased. + +Note: It is important to set this to as large a value as possible, +(relative to anticipated growth of the actual data over time) since +growing the size later may not be practical when the system is under +heavy load. +.TP +.BI mode \ <integer> +Specify the file protection mode that newly created database +files should have. +The default is 0600. +.TP +.BI rtxnsize \ <entries> +Specify the maximum number of entries to process in a single read +transaction when executing a large search. Long-lived read transactions +prevent old database pages from being reused in write transactions, and +so can cause significant growth of the database file when there is +heavy write traffic. This setting causes the read transaction in +large searches to be released and reacquired after the given number +of entries has been read, to give writers the opportunity to +reclaim old database pages. The default is 10000. +.TP +.BI searchstack \ <depth> +Specify the depth of the stack used for search filter evaluation. +Search filters are evaluated on a stack to accommodate nested AND / OR +clauses. An individual stack is assigned to each server thread. +The depth of the stack determines how complex a filter can be +evaluated without requiring any additional memory allocation. Filters that +are nested deeper than the search stack depth will cause a separate +stack to be allocated for that particular search operation. These +allocations can have a major negative impact on server performance, +but specifying too much stack will also consume a great deal of memory. +Each search stack uses 512K bytes per level. The default stack depth +is 16, thus 8MB per thread is used. +.SH ACCESS CONTROL +The +.B mdb +backend honors access control semantics as indicated in +.BR slapd.access (5). +.SH FILES +.TP +.B ETCDIR/slapd.conf +default +.B slapd +configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd (8), +.BR slapadd (8), +.BR slapcat (8), +.BR slapindex (8), +OpenLDAP LMDB documentation. +.SH ACKNOWLEDGEMENTS +.so ../Project +Written by Howard Chu. diff --git a/doc/man/man5/slapd-meta.5 b/doc/man/man5/slapd-meta.5 new file mode 100644 index 0000000..4e00635 --- /dev/null +++ b/doc/man/man5/slapd-meta.5 @@ -0,0 +1,1323 @@ +.TH SLAPD-META 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation, All Rights Reserved. +.\" Copying restrictions apply. See the COPYRIGHT file. +.\" Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it> +.\" $OpenLDAP$ +.\" +.\" Portions of this document should probably be moved to slapd-ldap(5) +.\" and maybe manual pages for librewrite. +.\" +.SH NAME +slapd\-meta \- metadirectory backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.B meta +backend to +.BR slapd (8) +performs basic LDAP proxying with respect to a set of remote LDAP +servers, called "targets". +The information contained in these servers can be presented as +belonging to a single Directory Information Tree (DIT). +.LP +A basic knowledge of the functionality of the +.BR slapd\-ldap (5) +backend is recommended. +This backend has been designed as an enhancement of the ldap backend. +The two backends share many features (actually they also share +portions of code). +While the +.B ldap +backend is intended to proxy operations directed to a single server, the +.B meta +backend is mainly intended for proxying of multiple servers and possibly +naming context masquerading. +These features, although useful in many scenarios, may result in +excessive overhead for some applications, so its use should be +carefully considered. +In the examples section, some typical scenarios will be discussed. + +The proxy instance of +.BR slapd (8) +must contain schema information for the attributes and objectClasses +used in filters, request DN and request-related data in general. +It should also contain schema information for the data returned +by the proxied server. +It is the responsibility of the proxy administrator to keep the schema +of the proxy lined up with that of the proxied server. + +.LP +Note: When looping back to the same instance of \fBslapd\fP(8), +each connection requires a new thread; as a consequence, \fBslapd\fP(8) +must be compiled with thread support, and the \fBthreads\fP parameter +may need some tuning; in those cases, unless the multiple target feature +is required, one may consider using \fBslapd\-relay\fP(5) instead, +which performs the relayed operation internally and thus reuses +the same connection. + +.SH EXAMPLES +There are examples in various places in this document, as well as in the +slapd/back\-meta/data/ directory in the OpenLDAP source tree. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the META backend database. +That is, they must follow a "database meta" line and come before any +subsequent "backend" or "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page. +.LP +Note: In early versions of back-ldap and back-meta it was recommended to always set +.LP +.RS +.nf +lastmod off +.fi +.RE +.LP +for +.B ldap +and +.B meta +databases. +This was required because operational attributes related to entry creation +and modification should not be proxied, as they could be mistakenly written +to the target server(s), generating an error. +The current implementation automatically sets lastmod to \fBoff\fP, +so its use is redundant and should be omitted. + +.SH SPECIAL CONFIGURATION DIRECTIVES +Target configuration starts with the "uri" directive. +All the configuration directives that are not specific to targets +should be defined first for clarity, including those that are common +to all backends. +They are: + +.TP +.B conn\-ttl <time> +This directive causes a cached connection to be dropped an recreated +after a given ttl, regardless of being idle or not. + +.TP +.B default\-target none +This directive forces the backend to reject all those operations +that must resolve to a single target in case none or multiple +targets are selected. +They include: add, delete, modify, modrdn; compare is not included, as +well as bind since, as they don't alter entries, in case of multiple +matches an attempt is made to perform the operation on any candidate +target, with the constraint that at most one must succeed. +This directive can also be used when processing targets to mark a +specific target as default. + +.TP +.B dncache\-ttl {DISABLED|forever|<ttl>} +This directive sets the time-to-live of the DN cache. +This caches the target that holds a given DN to speed up target +selection in case multiple targets would result from an uncached +search; forever means cache never expires; disabled means no DN +caching; otherwise a valid ( > 0 ) ttl is required, in the format +illustrated for the +.B idle\-timeout +directive. + +.TP +.B onerr {CONTINUE|report|stop} +This directive allows one to select the behavior in case an error is returned +by one target during a search. +The default, \fBcontinue\fP, consists in continuing the operation, +trying to return as much data as possible. +If the value is set to \fBstop\fP, the search is terminated as soon +as an error is returned by one target, and the error is immediately +propagated to the client. +If the value is set to \fBreport\fP, the search is continuated to the end +but, in case at least one target returned an error code, the first +non-success error code is returned. + +.TP +.B norefs <NO|yes> +If +.BR yes , +do not return search reference responses. +By default, they are returned unless request is LDAPv2. +If set before any target specification, it affects all targets, unless +overridden by any per-target directive. + +.TP +.B noundeffilter <NO|yes> +If +.BR yes , +return success instead of searching if a filter is undefined or contains +undefined portions. +By default, the search is propagated after replacing undefined portions +with +.BR (!(objectClass=*)) , +which corresponds to the empty result set. +If set before any target specification, it affects all targets, unless +overridden by any per-target directive. + +.TP +.B protocol\-version {0,2,3} +This directive indicates what protocol version must be used to contact +the remote server. +If set to 0 (the default), the proxy uses the same protocol version +used by the client, otherwise the requested protocol is used. +The proxy returns \fIunwillingToPerform\fP if an operation that is +incompatible with the requested protocol is attempted. +If set before any target specification, it affects all targets, unless +overridden by any per-target directive. + +.TP +.B pseudoroot\-bind\-defer {YES|no} +This directive, when set to +.BR yes , +causes the authentication to the remote servers with the pseudo-root +identity (the identity defined in each +.B idassert-bind +directive) to be deferred until actually needed by subsequent operations. +Otherwise, all binds as the rootdn are propagated to the targets. + +.TP +.B quarantine <interval>,<num>[;<interval>,<num>[...]] +Turns on quarantine of URIs that returned +.IR LDAP_UNAVAILABLE , +so that an attempt to reconnect only occurs at given intervals instead +of any time a client requests an operation. +The pattern is: retry only after at least +.I interval +seconds elapsed since last attempt, for exactly +.I num +times; then use the next pattern. +If +.I num +for the last pattern is "\fB+\fP", it retries forever; otherwise, +no more retries occur. +This directive must appear before any target specification; +it affects all targets with the same pattern. + +.TP +.B rebind\-as\-user {NO|yes} +If this option is given, the client's bind credentials are remembered +for rebinds, when trying to re-establish a broken connection, +or when chasing a referral, if +.B chase\-referrals +is set to +.IR yes . + +.TP +.B session\-tracking\-request {NO|yes} +Adds session tracking control for all requests. +The client's IP and hostname, and the identity associated to each request, +if known, are sent to the remote server for informational purposes. +This directive is incompatible with setting \fIprotocol\-version\fP to 2. +If set before any target specification, it affects all targets, unless +overridden by any per-target directive. + +.TP +.B single\-conn {NO|yes} +Discards current cached connection when the client rebinds. + +.TP +.B use\-temporary\-conn {NO|yes} +when set to +.BR yes , +create a temporary connection whenever competing with other threads +for a shared one; otherwise, wait until the shared connection is available. + +.SH TARGET SPECIFICATION +Target specification starts with a "uri" directive: + +.TP +.B uri <protocol>://[<host>]/<naming context> [...] +The <protocol> part can be anything +.BR ldap_initialize (3) +accepts ({ldap|ldaps|ldapi} and variants); the <host> may be +omitted, defaulting to whatever is set in +.BR ldap.conf (5). +The <naming context> part is \fImandatory\fP for the first URI, +but it \fImust be omitted\fP for subsequent ones, if any. +The naming context part must be within the naming context defined for the backend, +e.g.: +.LP +.RS +.nf +suffix "\fBdc=foo,dc=com\fP" +uri "ldap://x.foo.com/dc=x,\fBdc=foo,dc=com\fP" +.fi + +.RE +.RS +The <naming context> part doesn't need to be unique across the targets; +it may also match one of the values of the "suffix" directive. +Multiple URIs may be defined in a single URI statement. +The additional URIs must be separate arguments and must not have any +<naming context> part. This causes the underlying library +to contact the first server of the list that responds. +For example, if \fIl1.foo.com\fP and \fIl2.foo.com\fP are shadows +of the same server, the directive +.LP +.nf +suffix "\fBdc=foo,dc=com\fP" +uri "ldap://l1.foo.com/\fBdc=foo,dc=com\fP" "ldap://l2.foo.com/" +.fi + +.RE +.RS +causes \fIl2.foo.com\fP to be contacted whenever \fIl1.foo.com\fP +does not respond. +In that case, the URI list is internally rearranged, by moving unavailable +URIs to the end, so that further connection attempts occur with respect to +the last URI that succeeded. +.RE + +.TP +.B acl\-authcDN "<administrative DN for access control purposes>" +DN which is used to query the target server for acl checking, +as in the LDAP backend; it is supposed to have read access +on the target server to attributes used on the proxy for acl checking. +There is no risk of giving away such values; they are only used to +check permissions. +.B The acl\-authcDN identity is by no means implicitly used by the proxy +.B when the client connects anonymously. + +.TP +.B acl\-passwd <password> +Password used with the +.B +acl\-authcDN +above. + +.TP +.B bind\-timeout <microseconds> +This directive defines the timeout, in microseconds, used when polling +for response after an asynchronous bind connection. The initial call +to ldap_result(3) is performed with a trade-off timeout of 100000 us; +if that results in a timeout exceeded, subsequent calls use the value +provided with +.BR bind\-timeout . +The default value is used also for subsequent calls if +.B bind\-timeout +is not specified. +If set before any target specification, it affects all targets, unless +overridden by any per-target directive. + +.TP +.B chase\-referrals {YES|no} +enable/disable automatic referral chasing, which is delegated to the +underlying libldap, with rebinding eventually performed if the +\fBrebind\-as\-user\fP directive is used. The default is to chase referrals. +If set before any target specification, it affects all targets, unless +overridden by any per-target directive. + +.TP +.B client\-pr {accept-unsolicited|DISABLE|<size>} +This feature allows one to use RFC 2696 Paged Results control when performing +search operations with a specific target, +irrespective of the client's request. +When set to a numeric value, Paged Results control is always +used with \fIsize\fP as the page size. +When set to \fIaccept-unsolicited\fP, unsolicited Paged Results +control responses are accepted and honored +for compatibility with broken remote DSAs. +The client is not exposed to paged results handling +between +.BR slapd\-meta (5) +and the remote servers. +By default (disabled), Paged Results control is not used +and responses are not accepted. +If set before any target specification, it affects all targets, unless +overridden by any per-target directive. + +.TP +.B default\-target [<target>] +The "default\-target" directive can also be used during target specification. +With no arguments it marks the current target as the default. +The optional number marks target <target> as the default one, starting +from 1. +Target <target> must be defined. + +.TP +.B filter <pattern> +This directive allows specifying a +.BR regex (5) +pattern to indicate what search filter terms are actually served by a target. + +In a search request, if the search filter matches the \fIpattern\fP +the target is considered while fulfilling the request; otherwise +the target is ignored. There may be multiple occurrences of +the +.B filter +directive for each target. + +.TP +.B idassert\-authzFrom <authz-regexp> +if defined, selects what +.I local +identities are authorized to exploit the identity assertion feature. +The string +.B <authz-regexp> +follows the rules defined for the +.I authzFrom +attribute. +See +.BR slapd.conf (5), +section related to +.BR authz\-policy , +for details on the syntax of this field. + +.HP +.hy 0 +.B idassert\-bind +.B bindmethod=none|simple|sasl [binddn=<simple DN>] [credentials=<simple password>] +.B [saslmech=<SASL mech>] [secprops=<properties>] [realm=<realm>] +.B [authcId=<authentication ID>] [authzId=<authorization ID>] +.B [authz={native|proxyauthz}] [mode=<mode>] [flags=<flags>] +.B [starttls=no|yes|critical] +.B [tls_cert=<file>] +.B [tls_key=<file>] +.B [tls_cacert=<file>] +.B [tls_cacertdir=<path>] +.B [tls_reqcert=never|allow|try|demand] +.B [tls_cipher_suite=<ciphers>] +.B [tls_protocol_min=<major>[.<minor>]] +.B [tls_crlcheck=none|peer|all] +.RS +Allows one to define the parameters of the authentication method that is +internally used by the proxy to authorize connections that are +authenticated by other databases. +The identity defined by this directive, according to the properties +associated to the authentication method, is supposed to have auth access +on the target server to attributes used on the proxy for authentication +and authorization, and to be allowed to authorize the users. +This requires to have +.B proxyAuthz +privileges on a wide set of DNs, e.g. +.BR authzTo=dn.subtree:"" , +and the remote server to have +.B authz\-policy +set to +.B to +or +.BR both . +See +.BR slapd.conf (5) +for details on these statements and for remarks and drawbacks about +their usage. +The supported bindmethods are + +\fBnone|simple|sasl\fP + +where +.B none +is the default, i.e. no \fIidentity assertion\fP is performed. + +The authz parameter is used to instruct the SASL bind to exploit +.B native +SASL authorization, if available; since connections are cached, +this should only be used when authorizing with a fixed identity +(e.g. by means of the +.B authzDN +or +.B authzID +parameters). +Otherwise, the default +.B proxyauthz +is used, i.e. the proxyAuthz control (Proxied Authorization, RFC 4370) +is added to all operations. + +The supported modes are: + +\fB<mode> := {legacy|anonymous|none|self}\fP + +If +.B <mode> +is not present, and +.B authzId +is given, the proxy always authorizes that identity. +.B <authorization ID> +can be + +\fBu:<user>\fP + +\fB[dn:]<DN>\fP + +The former is supposed to be expanded by the remote server according +to the authz rules; see +.BR slapd.conf (5) +for details. +In the latter case, whether or not the +.B dn: +prefix is present, the string must pass DN validation and normalization. + +The default mode is +.BR legacy , +which implies that the proxy will either perform a simple bind as the +.I authcDN +or a SASL bind as the +.I authcID +and assert the client's identity when it is not anonymous. +Direct binds are always proxied. +The other modes imply that the proxy will always either perform a simple bind +as the +.IR authcDN +or a SASL bind as the +.IR authcID , +unless restricted by +.BR idassert\-authzFrom +rules (see below), in which case the operation will fail; +eventually, it will assert some other identity according to +.BR <mode> . +Other identity assertion modes are +.BR anonymous +and +.BR self , +which respectively mean that the +.I empty +or the +.IR client 's +identity +will be asserted; +.BR none , +which means that no proxyAuthz control will be used, so the +.I authcDN +or the +.I authcID +identity will be asserted. +For all modes that require the use of the +.I proxyAuthz +control, on the remote server the proxy identity must have appropriate +.I authzTo +permissions, or the asserted identities must have appropriate +.I authzFrom +permissions. Note, however, that the ID assertion feature is mostly +useful when the asserted identities do not exist on the remote server. + +Flags can be + +\fBoverride,[non\-]prescriptive,proxy\-authz\-[non\-]critical\fP + +When the +.B override +flag is used, identity assertion takes place even when the database +is authorizing for the identity of the client, i.e. after binding +with the provided identity, and thus authenticating it, the proxy +performs the identity assertion using the configured identity and +authentication method. + +When the +.B prescriptive +flag is used (the default), operations fail with +\fIinappropriateAuthentication\fP +for those identities whose assertion is not allowed by the +.B idassert\-authzFrom +patterns. +If the +.B non\-prescriptive +flag is used, operations are performed anonymously for those identities +whose assertion is not allowed by the +.B idassert\-authzFrom +patterns. + +When the +.B proxy\-authz\-non\-critical +flag is used (the default), the proxyAuthz control is not marked as critical, +in violation of RFC 4370. Use of +.B proxy\-authz\-critical +is recommended. + +The TLS settings default to the same as the main slapd TLS settings, +except for +.B tls_reqcert +which defaults to "demand". + +The identity associated to this directive is also used for privileged +operations whenever \fBidassert\-bind\fP is defined and \fBacl\-bind\fP +is not. See \fBacl\-bind\fP for details. +.RE + +.TP +.B idle\-timeout <time> +This directive causes a cached connection to be dropped an recreated +after it has been idle for the specified time. +The value can be specified as + +[<d>d][<h>h][<m>m][<s>[s]] + +where <d>, <h>, <m> and <s> are respectively treated as days, hours, +minutes and seconds. +If set before any target specification, it affects all targets, unless +overridden by any per-target directive. + +.TP +.B keepalive <idle>:<probes>:<interval> +The +.B keepalive +parameter sets the values of \fIidle\fP, \fIprobes\fP, and \fIinterval\fP +used to check whether a socket is alive; +.I idle +is the number of seconds a connection needs to remain idle before TCP +starts sending keepalive probes; +.I probes +is the maximum number of keepalive probes TCP should send before dropping +the connection; +.I interval +is interval in seconds between individual keepalive probes. +Only some systems support the customization of these values; +the +.B keepalive +parameter is ignored otherwise, and system-wide settings are used. + +.TP +.B map "{attribute|objectclass} [<local name>|*] {<foreign name>|*}" +This maps object classes and attributes as in the LDAP backend. +See +.BR slapd\-ldap (5). + +.TP +.B network\-timeout <time> +Sets the network timeout value after which +.BR poll (2)/ select (2) +following a +.BR connect (2) +returns in case of no activity. +The value is in seconds, and it can be specified as for +.BR idle\-timeout . +If set before any target specification, it affects all targets, unless +overridden by any per-target directive. + +.TP +.B nretries {forever|never|<nretries>} +This directive defines how many times a bind should be retried +in case of temporary failure in contacting a target. If defined +before any target specification, it applies to all targets (by default, +.BR 3 +times); +the global value can be overridden by redefinitions inside each target +specification. + +.TP +.B rewrite* ... +The rewrite options are described in the "REWRITING" section. + +.TP +.B subtree\-{exclude|include} "<rule>" +This directive allows one to indicate what subtrees are actually served +by a target. +The syntax of the supported rules is + +\fB<rule>: [dn[.<style>]:]<pattern>\fP + +\fB<style>: subtree|children|regex\fP + +When \fB<style>\fP is either \fBsubtree\fP or \fBchildren\fP +the \fB<pattern>\fP is a DN that must be within the naming context +served by the target. +When \fB<style>\fP is \fBregex\fP the \fB<pattern>\fP is a +.BR regex (5) +pattern. +If the \fBdn.<style>:\fP prefix is omitted, \fBdn.subtree:\fP +is implicitly assumed for backward compatibility. + +In the +.B subtree\-exclude +form if the \fIrequest DN\fP matches at least one rule, +the target is not considered while fulfilling the request; +otherwise, the target is considered based on the value of the \fIrequest DN\fP. +When the request is a search, also the \fIscope\fP is considered. + +In the +.B subtree\-include +form if the \fIrequest DN\fP matches at least one rule, +the target is considered while fulfilling the request; +otherwise the target is ignored. + +.LP +.RS +.nf + | match | exclude | + +---------+---------+-------------------+ + | T | T | not candidate | + | F | T | continue checking | + +---------+---------+-------------------+ + | T | F | candidate | + | F | F | not candidate | + +---------+---------+-------------------+ +.fi + +.RE +.RS +There may be multiple occurrences of the +.B subtree\-exclude +or +.B subtree\-include +directive for each of the targets, but they are mutually exclusive. +.RE + +.TP +.B suffixmassage "<virtual naming context>" "<real naming context>" +All the directives starting with "rewrite" refer to the rewrite engine +that has been added to slapd. +The "suffixmassage" directive was introduced in the LDAP backend to +allow suffix massaging while proxying. +It has been obsoleted by the rewriting tools. +However, both for backward compatibility and for ease of configuration +when simple suffix massage is required, it has been preserved. +It wraps the basic rewriting instructions that perform suffix +massaging. See the "REWRITING" section for a detailed list +of the rewrite rules it implies. + +.TP +.B t\-f\-support {NO|yes|discover} +enable if the remote server supports absolute filters +(see \fIRFC 4526\fP for details). +If set to +.BR discover , +support is detected by reading the remote server's root DSE. +If set before any target specification, it affects all targets, unless +overridden by any per-target directive. + +.TP +.B timeout [<op>=]<val> [...] +This directive allows one to set per-operation timeouts. +Operations can be + +\fB<op> ::= bind, add, delete, modrdn, modify, compare, search\fP + +The overall duration of the \fBsearch\fP operation is controlled either +by the \fBtimelimit\fP parameter or by server-side enforced +time limits (see \fBtimelimit\fP and \fBlimits\fP in +.BR slapd.conf (5) +for details). +This \fBtimeout\fP parameter controls how long the target can be +irresponsive before the operation is aborted. +Timeout is meaningless for the remaining operations, +\fBunbind\fP and \fBabandon\fP, which do not imply any response, +while it is not yet implemented in currently supported \fBextended\fP +operations. +If no operation is specified, the timeout \fBval\fP affects all +supported operations. +If specified before any target definition, it affects all targets +unless overridden by per-target directives. + +Note: if the timeout is exceeded, the operation is cancelled +(according to the \fBcancel\fP directive); +the protocol does not provide any means to rollback operations, +so the client will not be notified about the result of the operation, +which may eventually succeeded or not. +In case the timeout is exceeded during a bind operation, the connection +is destroyed, according to RFC4511. + +.TP +.B tls {[try\-]start|[try\-]propagate} +execute the StartTLS extended operation when the connection is initialized; +only works if the URI directive protocol scheme is not \fBldaps://\fP. +\fBpropagate\fP issues the StartTLS operation only if the original +connection did. +The \fBtry\-\fP prefix instructs the proxy to continue operations +if the StartTLS operation failed; its use is highly deprecated. +If set before any target specification, it affects all targets, unless +overridden by any per-target directive. + +.SH SCENARIOS +A powerful (and in some sense dangerous) rewrite engine has been added +to both the LDAP and Meta backends. +While the former can gain limited beneficial effects from rewriting +stuff, the latter can become an amazingly powerful tool. +.LP +Consider a couple of scenarios first. +.LP +1) Two directory servers share two levels of naming context; +say "dc=a,dc=foo,dc=com" and "dc=b,dc=foo,dc=com". +Then, an unambiguous Meta database can be configured as: +.LP +.RS +.nf +database meta +suffix "\fBdc=foo,dc=com\fP" +uri "ldap://a.foo.com/dc=a,\fBdc=foo,dc=com\fP" +uri "ldap://b.foo.com/dc=b,\fBdc=foo,dc=com\fP" +.fi +.RE +.LP +Operations directed to a specific target can be easily resolved +because there are no ambiguities. +The only operation that may resolve to multiple targets is a search +with base "dc=foo,dc=com" and scope at least "one", which results in +spawning two searches to the targets. +.LP +2a) Two directory servers don't share any portion of naming context, +but they'd present as a single DIT +[Caveat: uniqueness of (massaged) entries among the two servers is +assumed; integrity checks risk to incur in excessive overhead and have +not been implemented]. +Say we have "dc=bar,dc=org" and "o=Foo,c=US", +and we'd like them to appear as branches of "dc=foo,dc=com", say +"dc=a,dc=foo,dc=com" and "dc=b,dc=foo,dc=com". +Then we need to configure our Meta backend as: +.LP +.RS +.nf +database meta +suffix "dc=foo,dc=com" + +uri "ldap://a.bar.com/\fBdc=a,dc=foo,dc=com\fP" +suffixmassage "\fBdc=a,dc=foo,dc=com\fP" "dc=bar,dc=org" + +uri "ldap://b.foo.com/\fBdc=b,dc=foo,dc=com\fP" +suffixmassage "\fBdc=b,dc=foo,dc=com\fP" "o=Foo,c=US" +.fi +.RE +.LP +Again, operations can be resolved without ambiguity, although +some rewriting is required. +Notice that the virtual naming context of each target is a branch of +the database's naming context; it is rewritten back and forth when +operations are performed towards the target servers. +What "back and forth" means will be clarified later. +.LP +When a search with base "dc=foo,dc=com" is attempted, if the +scope is "base" it fails with "no such object"; in fact, the +common root of the two targets (prior to massaging) does not +exist. +If the scope is "one", both targets are contacted with the base +replaced by each target's base; the scope is derated to "base". +In general, a scope "one" search is honored, and the scope is derated, +only when the incoming base is at most one level lower of a target's +naming context (prior to massaging). +.LP +Finally, if the scope is "sub" the incoming base is replaced +by each target's unmassaged naming context, and the scope +is not altered. +.LP +2b) Consider the above reported scenario with the two servers +sharing the same naming context: +.LP +.RS +.nf +database meta +suffix "\fBdc=foo,dc=com\fP" + +uri "ldap://a.bar.com/\fBdc=foo,dc=com\fP" +suffixmassage "\fBdc=foo,dc=com\fP" "dc=bar,dc=org" + +uri "ldap://b.foo.com/\fBdc=foo,dc=com\fP" +suffixmassage "\fBdc=foo,dc=com\fP" "o=Foo,c=US" +.fi +.RE +.LP +All the previous considerations hold, except that now there is +no way to unambiguously resolve a DN. +In this case, all the operations that require an unambiguous target +selection will fail unless the DN is already cached or a default +target has been set. +Practical configurations may result as a combination of all the +above scenarios. +.SH ACLs +Note on ACLs: at present you may add whatever ACL rule you desire +to the Meta (and LDAP) backends. +However, the meaning of an ACL on a proxy may require some +considerations. +Two philosophies may be considered: +.LP +a) the remote server dictates the permissions; the proxy simply passes +back what it gets from the remote server. +.LP +b) the remote server unveils "everything"; the proxy is responsible +for protecting data from unauthorized access. +.LP +Of course the latter sounds unreasonable, but it is not. +It is possible to imagine scenarios in which a remote host discloses +data that can be considered "public" inside an intranet, and a proxy +that connects it to the internet may impose additional constraints. +To this purpose, the proxy should be able to comply with all the ACL +matching criteria that the server supports. +This has been achieved with regard to all the criteria supported by +slapd except a special subtle case (please file an ITS if you can +find other exceptions: <http://www.openldap.org/its/>). +The rule +.LP +.RS +.nf +access to dn="<dn>" attrs=<attr> + by dnattr=<dnattr> read + by * none +.fi +.RE +.LP +cannot be matched iff the attribute that is being requested, <attr>, +is NOT <dnattr>, and the attribute that determines membership, +<dnattr>, has not been requested (e.g. in a search) +.LP +In fact this ACL is resolved by slapd using the portion of entry it +retrieved from the remote server without requiring any further +intervention of the backend, so, if the <dnattr> attribute has not +been fetched, the match cannot be assessed because the attribute is +not present, not because no value matches the requirement! +.LP +Note on ACLs and attribute mapping: ACLs are applied to the mapped +attributes; for instance, if the attribute locally known as "foo" is +mapped to "bar" on a remote server, then local ACLs apply to attribute +"foo" and are totally unaware of its remote name. +The remote server will check permissions for "bar", and the local +server will possibly enforce additional restrictions to "foo". +.\" +.\" If this section is moved, also update the reference in +.\" libraries/librewrite/RATIONALE. +.\" +.SH REWRITING +A string is rewritten according to a set of rules, called a `rewrite +context'. +The rules are based on POSIX (''extended'') regular expressions (regex) +with substring matching; basic variable substitution and map resolution +of substrings is allowed by specific mechanisms detailed in the following. +The behavior of pattern matching/substitution can be altered by a set +of flags. +.LP +The underlying concept is to build a lightweight rewrite module +for the slapd server (initially dedicated to the LDAP backend). +.SH Passes +An incoming string is matched against a set of rules. +Rules are made of a regex match pattern, a substitution pattern +and a set of actions, described by a set of flags. +In case of match a string rewriting is performed according to the +substitution pattern that allows one to refer to substrings matched in the +incoming string. +The actions, if any, are finally performed. +The substitution pattern allows map resolution of substrings. +A map is a generic object that maps a substitution pattern to a value. +The flags are divided in "Pattern matching Flags" and "Action Flags"; +the former alter the regex match pattern behavior while the latter +alter the action that is taken after substitution. +.SH "Pattern Matching Flags" +.TP +.B `C' +honors case in matching (default is case insensitive) +.TP +.B `R' +use POSIX ''basic'' regular expressions (default is ''extended'') +.TP +.B `M{n}' +allow no more than +.B n +recursive passes for a specific rule; does not alter the max total count +of passes, so it can only enforce a stricter limit for a specific rule. +.SH "Action Flags" +.TP +.B `:' +apply the rule once only (default is recursive) +.TP +.B `@' +stop applying rules in case of match; the current rule is still applied +recursively; combine with `:' to apply the current rule only once +and then stop. +.TP +.B `#' +stop current operation if the rule matches, and issue an `unwilling to +perform' error. +.TP +.B `G{n}' +jump +.B n +rules back and forth (watch for loops!). +Note that `G{1}' is implicit in every rule. +.TP +.B `I' +ignores errors in rule; this means, in case of error, e.g. issued by a +map, the error is treated as a missed match. +The `unwilling to perform' is not overridden. +.TP +.B `U{n}' +uses +.B +n +as return code if the rule matches; the flag does not alter the recursive +behavior of the rule, so, to have it performed only once, it must be used +in combination with `:', e.g. +.B `:U{16}' +returns the value `16' after exactly one execution of the rule, if the +pattern matches. +As a consequence, its behavior is equivalent to `@', with the return +code set to +.BR n ; +or, in other words, `@' is equivalent to `U{0}'. +By convention, the freely available codes are above 16 included; +the others are reserved. +.LP +The ordering of the flags can be significant. +For instance: `IG{2}' means ignore errors and jump two lines ahead +both in case of match and in case of error, while `G{2}I' means ignore +errors, but jump two lines ahead only in case of match. +.LP +More flags (mainly Action Flags) will be added as needed. +.SH "Pattern matching:" +See +.BR regex (7) +and/or +.BR re_format (7). +.SH "Substitution Pattern Syntax:" +Everything starting with `%' requires substitution; +.LP +the only obvious exception is `%%', which is left as is; +.LP +the basic substitution is `%d', where `d' is a digit; +0 means the whole string, while 1-9 is a submatch; +.LP +a `%' followed by a `{' invokes an advanced substitution. +The pattern is: +.LP +.RS +`%' `{' [ <op> ] <name> `(' <substitution> `)' `}' +.RE +.LP +where <name> must be a legal name for the map, i.e. +.LP +.RS +.nf +<name> ::= [a-z][a-z0-9]* (case insensitive) +<op> ::= `>' `|' `&' `&&' `*' `**' `$' +.fi +.RE +.LP +and <substitution> must be a legal substitution +pattern, with no limits on the nesting level. +.LP +The operators are: +.TP +.B > +sub context invocation; <name> must be a legal, already defined +rewrite context name +.TP +.B | +external command invocation; <name> must refer to a legal, already +defined command name (NOT IMPL.) +.TP +.B & +variable assignment; <name> defines a variable in the running +operation structure which can be dereferenced later; operator +.B & +assigns a variable in the rewrite context scope; operator +.B && +assigns a variable that scopes the entire session, e.g. its value +can be dereferenced later by other rewrite contexts +.TP +.B * +variable dereferencing; <name> must refer to a variable that is +defined and assigned for the running operation; operator +.B * +dereferences a variable scoping the rewrite context; operator +.B ** +dereferences a variable scoping the whole session, e.g. the value +is passed across rewrite contexts +.TP +.B $ +parameter dereferencing; <name> must refer to an existing parameter; +the idea is to make some run-time parameters set by the system +available to the rewrite engine, as the client host name, the bind DN +if any, constant parameters initialized at config time, and so on; +no parameter is currently set by either +.B back\-ldap +or +.BR back\-meta , +but constant parameters can be defined in the configuration file +by using the +.B rewriteParam +directive. +.LP +Substitution escaping has been delegated to the `%' symbol, +which is used instead of `\e' in string substitution patterns +because `\e' is already escaped by slapd's low level parsing routines; +as a consequence, regex escaping requires two `\e' symbols, +e.g. `\fB.*\e.foo\e.bar\fP' must be written as `\fB.*\e\e.foo\e\e.bar\fP'. +.\" +.\" The symbol can be altered at will by redefining the related macro in +.\" "rewrite-int.h". +.\" +.SH "Rewrite context:" +A rewrite context is a set of rules which are applied in sequence. +The basic idea is to have an application initialize a rewrite +engine (think of Apache's mod_rewrite ...) with a set of rewrite +contexts; when string rewriting is required, one invokes the +appropriate rewrite context with the input string and obtains the +newly rewritten one if no errors occur. +.LP +Each basic server operation is associated to a rewrite context; +they are divided in two main groups: client \-> server and +server \-> client rewriting. +.LP +client \-> server: +.LP +.RS +.nf +(default) if defined and no specific context + is available +bindDN bind +searchBase search +searchFilter search +searchFilterAttrDN search +compareDN compare +compareAttrDN compare AVA +addDN add +addAttrDN add AVA +modifyDN modify +modifyAttrDN modify AVA +modrDN modrdn +newSuperiorDN modrdn +deleteDN delete +exopPasswdDN password modify extended operation DN if proxy +.fi +.RE +.LP +server \-> client: +.LP +.RS +.nf +searchResult search (only if defined; no default; + acts on DN and DN-syntax attributes + of search results) +searchAttrDN search AVA +matchedDN all ops (only if applicable) +.fi +.RE +.LP +.SH "Basic configuration syntax" +.TP +.B rewriteEngine { on | off } +If `on', the requested rewriting is performed; if `off', no +rewriting takes place (an easy way to stop rewriting without +altering too much the configuration file). +.TP +.B rewriteContext <context name> "[ alias <aliased context name> ]" +<Context name> is the name that identifies the context, i.e. the name +used by the application to refer to the set of rules it contains. +It is used also to reference sub contexts in string rewriting. +A context may alias another one. +In this case the alias context contains no rule, and any reference to +it will result in accessing the aliased one. +.TP +.B rewriteRule "<regex match pattern>" "<substitution pattern>" "[ <flags> ]" +Determines how a string can be rewritten if a pattern is matched. +Examples are reported below. +.SH "Additional configuration syntax:" +.TP +.B rewriteMap "<map type>" "<map name>" "[ <map attrs> ]" +Allows one to define a map that transforms substring rewriting into +something else. +The map is referenced inside the substitution pattern of a rule. +.TP +.B rewriteParam <param name> <param value> +Sets a value with global scope, that can be dereferenced by the +command `%{$paramName}'. +.TP +.B rewriteMaxPasses <number of passes> [<number of passes per rule>] +Sets the maximum number of total rewriting passes that can be +performed in a single rewrite operation (to avoid loops). +A safe default is set to 100; note that reaching this limit is still +treated as a success; recursive invocation of rules is simply +interrupted. +The count applies to the rewriting operation as a whole, not +to any single rule; an optional per-rule limit can be set. +This limit is overridden by setting specific per-rule limits +with the `M{n}' flag. +.SH "Configuration examples:" +.nf +# set to `off' to disable rewriting +rewriteEngine on + +# the rules the "suffixmassage" directive implies +rewriteEngine on +# all dataflow from client to server referring to DNs +rewriteContext default +rewriteRule "(.*)<virtualnamingcontext>$" "%1<realnamingcontext>" ":" +# empty filter rule +rewriteContext searchFilter +# all dataflow from server to client +rewriteContext searchResult +rewriteRule "(.*)<realnamingcontext>$" "%1<virtualnamingcontext>" ":" +rewriteContext searchAttrDN alias searchResult +rewriteContext matchedDN alias searchResult + +# Everything defined here goes into the `default' context. +# This rule changes the naming context of anything sent +# to `dc=home,dc=net' to `dc=OpenLDAP, dc=org' + +rewriteRule "(.*)dc=home,[ ]?dc=net" + "%1dc=OpenLDAP, dc=org" ":" + +# since a pretty/normalized DN does not include spaces +# after rdn separators, e.g. `,', this rule suffices: + +rewriteRule "(.*)dc=home,dc=net" + "%1dc=OpenLDAP,dc=org" ":" + +# Start a new context (ends input of the previous one). +# This rule adds blanks between DN parts if not present. +rewriteContext addBlanks +rewriteRule "(.*),([^ ].*)" "%1, %2" + +# This one eats blanks +rewriteContext eatBlanks +rewriteRule "(.*),[ ](.*)" "%1,%2" + +# Here control goes back to the default rewrite +# context; rules are appended to the existing ones. +# anything that gets here is piped into rule `addBlanks' +rewriteContext default +rewriteRule ".*" "%{>addBlanks(%0)}" ":" + +.\" # Anything with `uid=username' is looked up in +.\" # /etc/passwd for gecos (I know it's nearly useless, +.\" # but it is there just as a guideline to implementing +.\" # custom maps). +.\" # Note the `I' flag that leaves `uid=username' in place +.\" # if `username' does not have a valid account, and the +.\" # `:' that forces the rule to be processed exactly once. +.\" rewriteContext uid2Gecos +.\" rewriteRule "(.*)uid=([a-z0-9]+),(.+)" +.\" "%1cn=%2{xpasswd},%3" "I:" +.\" +.\" # Finally, in a bind, if one uses a `uid=username' DN, +.\" # it is rewritten in `cn=name surname' if possible. +.\" rewriteContext bindDN +.\" rewriteRule ".*" "%{>addBlanks(%{>uid2Gecos(%0)})}" ":" +.\" +# Rewrite the search base according to `default' rules. +rewriteContext searchBase alias default + +# Search results with OpenLDAP DN are rewritten back with +# `dc=home,dc=net' naming context, with spaces eaten. +rewriteContext searchResult +rewriteRule "(.*[^ ]?)[ ]?dc=OpenLDAP,[ ]?dc=org" + "%{>eatBlanks(%1)}dc=home,dc=net" ":" + +# Bind with email instead of full DN: we first need +# an ldap map that turns attributes into a DN (the +# argument used when invoking the map is appended to +# the URI and acts as the filter portion) +rewriteMap ldap attr2dn "ldap://host/dc=my,dc=org?dn?sub" + +# Then we need to detect DN made up of a single email, +# e.g. `mail=someone@example.com'; note that the rule +# in case of match stops rewriting; in case of error, +# it is ignored. In case we are mapping virtual +# to real naming contexts, we also need to rewrite +# regular DNs, because the definition of a bindDn +# rewrite context overrides the default definition. +rewriteContext bindDN +rewriteRule "^mail=[^,]+@[^,]+$" "%{attr2dn(%0)}" ":@I" + +# This is a rather sophisticated example. It massages a +# search filter in case who performs the search has +# administrative privileges. First we need to keep +# track of the bind DN of the incoming request, which is +# stored in a variable called `binddn' with session scope, +# and left in place to allow regular binding: +rewriteContext bindDN +rewriteRule ".+" "%{&&binddn(%0)}%0" ":" + +# A search filter containing `uid=' is rewritten only +# if an appropriate DN is bound. +# To do this, in the first rule the bound DN is +# dereferenced, while the filter is decomposed in a +# prefix, in the value of the `uid=<arg>' AVA, and +# in a suffix. A tag `<>' is appended to the DN. +# If the DN refers to an entry in the `ou=admin' subtree, +# the filter is rewritten OR-ing the `uid=<arg>' with +# `cn=<arg>'; otherwise it is left as is. This could be +# useful, for instance, to allow apache's auth_ldap-1.4 +# module to authenticate users with both `uid' and +# `cn', but only if the request comes from a possible +# `cn=Web auth,ou=admin,dc=home,dc=net' user. +rewriteContext searchFilter +rewriteRule "(.*\e\e()uid=([a-z0-9_]+)(\e\e).*)" + "%{**binddn}<>%{&prefix(%1)}%{&arg(%2)}%{&suffix(%3)}" + ":I" +rewriteRule "[^,]+,ou=admin,dc=home,dc=net" + "%{*prefix}|(uid=%{*arg})(cn=%{*arg})%{*suffix}" ":@I" +rewriteRule ".*<>" "%{*prefix}uid=%{*arg}%{*suffix}" ":" + +# This example shows how to strip unwanted DN-valued +# attribute values from a search result; the first rule +# matches DN values below "ou=People,dc=example,dc=com"; +# in case of match the rewriting exits successfully. +# The second rule matches everything else and causes +# the value to be rejected. +rewriteContext searchResult +rewriteRule ".*,ou=People,dc=example,dc=com" "%0" ":@" +rewriteRule ".*" "" "#" +.fi +.SH "LDAP Proxy resolution (a possible evolution of slapd\-ldap(5)):" +In case the rewritten DN is an LDAP URI, the operation is initiated +towards the host[:port] indicated in the uri, if it does not refer +to the local server. +E.g.: +.LP +.nf + rewriteRule '^cn=root,.*' '%0' 'G{3}' + rewriteRule '^cn=[a-l].*' 'ldap://ldap1.my.org/%0' ':@' + rewriteRule '^cn=[m-z].*' 'ldap://ldap2.my.org/%0' ':@' + rewriteRule '.*' 'ldap://ldap3.my.org/%0' ':@' +.fi +.LP +(Rule 1 is simply there to illustrate the `G{n}' action; it could have +been written: +.LP +.nf + rewriteRule '^cn=root,.*' 'ldap://ldap3.my.org/%0' ':@' +.fi +.LP +with the advantage of saving one rewrite pass ...) + +.SH ACCESS CONTROL +The +.B meta +backend does not honor all ACL semantics as described in +.BR slapd.access (5). +In general, access checking is delegated to the remote server(s). +Only +.B read (=r) +access to the +.B entry +pseudo-attribute and to the other attribute values of the entries +returned by the +.B search +operation is honored, which is performed by the frontend. + +.SH PROXY CACHE OVERLAY +The proxy cache overlay +allows caching of LDAP search requests (queries) in a local database. +See +.BR slapo\-pcache (5) +for details. + +.SH DEPRECATED STATEMENTS +The following statements have been deprecated and should no longer be used. + +.TP +.B pseudorootdn "<substitute DN in case of rootdn bind>" +Use +.B idassert\-bind +instead. + +.TP +.B pseudorootpw "<substitute password in case of rootdn bind>" +Use +.B idassert\-bind +instead. + + + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-ldap (5), +.BR slapo\-pcache (5), +.BR slapd (8), +.BR regex (7), +.BR re_format (7). +.SH AUTHOR +Pierangelo Masarati, based on back-ldap by Howard Chu diff --git a/doc/man/man5/slapd-monitor.5 b/doc/man/man5/slapd-monitor.5 new file mode 100644 index 0000000..0d7d012 --- /dev/null +++ b/doc/man/man5/slapd-monitor.5 @@ -0,0 +1,126 @@ +.TH SLAPD-MONITOR 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-monitor \- Monitor backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.B monitor +backend to +.BR slapd (8) +is not an actual database; if enabled, it is automatically generated +and dynamically maintained by +.B slapd +with information about the running status of the daemon. +.LP +To inspect all monitor information, issue a subtree search with base +cn=Monitor, requesting that attributes "+" and "*" are returned. +The monitor backend produces mostly operational attributes, and LDAP +only returns operational attributes that are explicitly requested. +Requesting attribute "+" is an extension which requests all operational +attributes. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the +.B monitor +backend database. +That is, they must follow a "database monitor" line and come before any +subsequent "backend" or "database" lines. +.LP +As opposed to most databases, the +.B monitor +database can be instantiated only once, i.e. only one occurrence +of "database monitor" can occur in the +.BR slapd.conf (5) +file. +Moreover, the suffix of the database cannot be explicitly set by means +of the +.B suffix +directive. +The suffix is automatically set +to "\fIcn=Monitor\fP". +.LP +The +.B monitor +database honors the +.B rootdn +and the +.B rootpw +directives, and the usual ACL directives, e.g. the +.B access +directive. +.\".LP +.\"The following directives can be used: +.\".TP +.\".BI l \ <locality> +.\"The additional argument \fI<locality>\fP, +.\"a string, is added to the "\fIcn=Monitor\fP" entry as value of the +.\".B l +.\"attribute (Note: this may be subjected to changes). +.LP +Other database options are described in the +.BR slapd.conf (5) +manual page. +.SH USAGE +The usage is: +.TP +1) enable the \fBmonitor\fP backend at configure: +.LP +.RS +.nf +configure \-\-enable\-monitor +.fi +.RE +.TP +2) activate the \fBmonitor\fP database in the \fBslapd.conf\fP(5) file: +.LP +.RS +.nf +database monitor +.fi +.RE +.TP +3) add ACLs as detailed in \fBslapd.access\fP(5) to control access to the database, e.g.: +.LP +.RS +.nf +access to dn.subtree="cn=Monitor" + by dn.exact="uid=Admin,dc=my,dc=org" write + by users read + by * none +.fi +.RE +.TP +4) ensure that the \fBcore.schema\fP file is loaded. +The +.B monitor +backend relies on some standard track attributeTypes +that must be already defined when the backend is started. +.SH ACCESS CONTROL +The +.B monitor +backend honors access control semantics as indicated in +.BR slapd.access (5), +including the +.B disclose +access privilege, on all currently implemented operations. +.SH KNOWN LIMITATIONS +The +.B monitor +backend does not honor size/time limits in search operations. +.SH FILES +.TP +.B ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd.access (5), +.BR slapd (8), +.BR ldap (3). +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man5/slapd-ndb.5 b/doc/man/man5/slapd-ndb.5 new file mode 100644 index 0000000..40e0bcb --- /dev/null +++ b/doc/man/man5/slapd-ndb.5 @@ -0,0 +1,126 @@ +.TH SLAPD-NDB 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2008-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-ndb \- MySQL NDB backend to slapd +.SH SYNOPSIS +.B ETCDIR/slapd.conf +.SH DESCRIPTION +The \fBndb\fP backend to +.BR slapd (8) +uses the MySQL Cluster package to store data, through its NDB API. +It provides fault tolerance with extreme scalability, along with +a degree of SQL compatibility. +.LP +This backend is designed to store LDAP information using tables that +are also visible from SQL. It uses a higher level SQL API for creating +these tables, while using the low level NDB API for storing and +retrieving the data within these tables. The NDB Cluster engine +allows data to be partitioned across multiple data nodes, and this +backend allows multiple slapd instances to operate against a given +database concurrently. +.LP +The general approach is to use distinct tables for each LDAP object class. +Entries comprised of multiple object classes will have their data +spread across multiple tables. The data tables use a 64 bit entryID +as their primary key. The DIT hierarchy is maintained in a separate +table, which maps DNs to entryIDs. +.LP +This backend is experimental. While intended to be a general-purpose +backend, it is currently missing a number of common LDAP features. +See the \fBTODO\fP file in the source directory for details. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the \fBndb\fP backend database. +That is, they must follow a "database ndb" line and +come before any subsequent "backend" or "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page. + +.SH DATA SOURCE CONFIGURATION + +.TP +.B dbhost <hostname> +The name or IP address of the host running the MySQL server. The default +is "localhost". On Unix systems, the connection to a local server is made +using a Unix Domain socket, whose path is specified using the +.B dbsocket +directive. +.TP +.B dbuser <username> +The MySQL login ID to use when connecting to the MySQL server. The chosen +user must have sufficient privileges to manipulate the SQL tables in the +target database. +.TP +.B dbpasswd <password> +The password for the \fBdbuser\fP. +.TP +.B dbname <database name> +The name of the MySQL database to use. +.TP +.B dbport <port> +The port number to use for the TCP connection to the MySQL server. +.TP +.B dbsocket <path> +The socket to be used for connecting to a local MySQL server. +.TP +.B dbflag <integer> +Client flags for the MySQL session. See the MySQL documentation for details. +.TP +.B dbconnect <connectstring> +The name or IP address of the host running the cluster manager. The default +is "localhost". +.TP +.B dbconnections <integer> +The number of cluster connections to establish. Using up to 4 may improve +performance under heavier load. The default is 1. + +.SH SCHEMA CONFIGURATION +.TP +.B attrlen <attribute> <length> +Specify the column length to use for a particular attribute. LDAP attributes are +stored in individual columns of the SQL tables. The maximum column lengths for +each column must be specified when creating these tables. If a length constraint +was specified in the attribute's LDAP schema definition, that value will be used +by default. If the schema didn't specify a constraint, the default is 128 bytes. +Currently the maximum is 1024. +.TP +.B index <attr[,attr...]> +Specify a list of attributes for which indexing should be maintained. +Currently there is no support for substring indexing; a single index structure +provides presence, equality, and inequality indexing for the specified attributes. +.TP +.B attrset <set> <attrs> +Specify a list of attributes to be treated as an attribute set. This directive +creates a table named \fIset\fP which will contain all of the listed attributes. +Ordinarily an attribute resides in a table named by an object class that uses +the attribute. However, attributes are only allowed to appear in a single table. +For attributes that are derived from an inherited object class definition, +the attribute will only be stored in the superior class's table. +Attribute sets should be defined for any attributes that are used in multiple +unrelated object classes, i.e., classes that are not connected by a simple +inheritance chain. +.SH ACCESS CONTROL +The +.B ndb +backend honors most access control semantics as indicated in +.BR slapd.access (5). +.SH FILES +.TP +.B ETCDIR/slapd.conf +default +.B slapd +configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd (8), +.BR slapadd (8), +.BR slapcat (8), +.BR slapindex (8), +MySQL Cluster documentation. +.SH AUTHOR +Howard Chu, with assistance from Johan Andersson et al @ MySQL. diff --git a/doc/man/man5/slapd-null.5 b/doc/man/man5/slapd-null.5 new file mode 100644 index 0000000..c8f6701 --- /dev/null +++ b/doc/man/man5/slapd-null.5 @@ -0,0 +1,72 @@ +.TH SLAPD-NULL 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2002-2018 The OpenLDAP Foundation. All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-null \- Null backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The Null backend to +.BR slapd (8) +is surely the most useful part of +.BR slapd : +.br +- Searches return success but no entries. +.br +- Compares return compareFalse. +.br +- Updates return success (unless readonly is on) but do nothing. +.br +- Binds other than as the rootdn fail unless the database option "bind +on" is given. +.br +- The +.BR slapadd (8) +and +.BR slapcat (8) +tools are equally exciting. +.br +Inspired by the /dev/null device. +.SH CONFIGURATION +This +.B slapd.conf +option applies to the NULL backend database. +That is, it must follow a "database null" line and come before +any subsequent "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page. +.TP +.B bind <on/off> +Allow binds as any DN in this backend's suffix, with any password. +The default is "off". +.TP +.B dosearch <on/off> +If enabled, a single entry will be returned on all search requests. +The entry's DN will be the same as the database suffix. +The default is "off". +.SH EXAMPLE +Here is a possible slapd.conf extract using the Null backend: +.LP +.RS +.nf +database null +suffix "cn=Nothing" +bind on +.fi +.RE +.SH ACCESS CONTROL +The +.B null +backend does not honor any of the access control semantics described in +.BR slapd.access (5). +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd (8), +.BR slapadd (8), +.BR slapcat (8). diff --git a/doc/man/man5/slapd-passwd.5 b/doc/man/man5/slapd-passwd.5 new file mode 100644 index 0000000..3d2b701 --- /dev/null +++ b/doc/man/man5/slapd-passwd.5 @@ -0,0 +1,56 @@ +.TH SLAPD-PASSWD 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-passwd \- /etc/passwd backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The PASSWD backend to +.BR slapd (8) +serves up the user account information listed in the system +.BR passwd (5) +file. This backend is provided for demonstration purposes only. +The DN of each entry is "uid=<username>,<suffix>". +Note that non-base searches scan the entire passwd file, and +are best suited for hosts with small passwd files. +.SH CONFIGURATION +This +.B slapd.conf +option applies to the PASSWD backend database. +That is, it must follow a "database passwd" line and come before any +subsequent "backend" or "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page. +.TP +.B file <filename> +Specifies an alternate passwd file to use. +The default is +.BR /etc/passwd . +.SH ACCESS CONTROL +The +.B passwd +backend does not honor any of the access control semantics described in +.BR slapd.access (5). +Only +.B read (=r) +access to the +.B entry +pseudo-attribute and to the other attribute values of the entries +returned by the +.B search +operation is honored, which is performed by the frontend. + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.TP +/etc/passwd +user account information +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd (8), +.BR passwd (5). diff --git a/doc/man/man5/slapd-perl.5 b/doc/man/man5/slapd-perl.5 new file mode 100644 index 0000000..f0fddd5 --- /dev/null +++ b/doc/man/man5/slapd-perl.5 @@ -0,0 +1,199 @@ +.TH SLAPD-PERL 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.SH NAME +slapd\-perl \- Perl backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The Perl backend to +.BR slapd (8) +works by embedding a +.BR perl (1) +interpreter into +.BR slapd (8). +Any perl database section of the configuration file +.BR slapd.conf (5) +must then specify what Perl module to use. +.B Slapd +then creates a new Perl object that handles all the requests for that +particular instance of the backend. +.LP +You will need to create a method for each one of the +following actions: +.LP +.nf + * new # creates a new object, + * search # performs the ldap search, + * compare # does a compare, + * modify # modifies an entry, + * add # adds an entry to backend, + * modrdn # modifies an entry's rdn, + * delete # deletes an ldap entry, + * config # module-specific config directives, + * init # called after backend is initialized. +.fi +.LP +Unless otherwise specified, the methods return the result code +which will be returned to the client. Unimplemented actions +can just return unwillingToPerform (53). +.TP +.B new +This method is called when the configuration file encounters a +.B perlmod +line. +The module in that line is then effectively `use'd into the perl +interpreter, then the \fBnew\fR method is called to create a new +object. +Note that multiple instances of that object may be instantiated, as +with any perl object. +.\" .LP +The +.B new +method receives the class name as argument. +.TP +.B search +This method is called when a search request comes from a client. +It arguments are as follows: +.nf + * object reference + * base DN + * scope + * alias dereferencing policy + * size limit + * time limit + * filter string + * attributes only flag (1 for yes) + * list of attributes to return (may be empty) +.fi +.LP +Return value: (resultcode, ldif-entry, ldif-entry, ...) +.TP +.B compare +This method is called when a compare request comes from a client. +Its arguments are as follows. +.nf + * object reference + * dn + * attribute assertion string +.fi +.LP +.TP +.B modify +This method is called when a modify request comes from a client. +Its arguments are as follows. +.nf + * object reference + * dn + * a list formatted as follows + ({ "ADD" | "DELETE" | "REPLACE" }, + attributetype, value...)... +.fi +.LP +.TP +.B add +This method is called when a add request comes from a client. +Its arguments are as follows. +.nf + * object reference + * entry in string format +.fi +.LP +.TP +.B modrdn +This method is called when a modrdn request comes from a client. +Its arguments are as follows. +.nf + * object reference + * dn + * new rdn + * delete old dn flag (1 means yes) +.fi +.LP +.TP +.B delete +This method is called when a delete request comes from a client. +Its arguments are as follows. +.nf + * object reference + * dn +.fi +.LP +.TP +.B config +This method is called once for each perlModuleConfig line in the +.BR slapd.conf (5) +configuration file. +Its arguments are as follows. +.nf + * object reference + * array of arguments on line +.fi +.LP +Return value: nonzero if this is not a valid option. +.TP +.B init +This method is called after backend is initialized. +Its argument is as follows. +.nf + * object reference +.fi +.LP +Return value: nonzero if initialization failed. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the PERL backend database. +That is, they must follow a "database perl" line and come before any +subsequent "backend" or "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page. +.TP +.B perlModulePath /path/to/libs +Add the path to the @INC variable. +.TP +.B perlModule ModName +`Use' the module name ModName from ModName.pm +.TP +.B filterSearchResults +Search results are candidates that need to be filtered (with the +filter in the search request), rather than search results to be +returned directly to the client. +.TP +.B perlModuleConfig <arguments> +Invoke the module's config method with the given arguments. +.SH EXAMPLE +There is an example Perl module `SampleLDAP' in the slapd/back\-perl/ +directory in the OpenLDAP source tree. +.SH ACCESS CONTROL +The +.B perl +backend does not honor any of the access control semantics described in +.BR slapd.access (5); +all access control is delegated to the underlying PERL scripting. +Only +.B read (=r) +access to the +.B entry +pseudo-attribute and to the other attribute values of the entries +returned by the +.B search +operation is honored, which is performed by the frontend. +.SH WARNING +The interface of this backend to the perl module MAY change. +Any suggestions would greatly be appreciated. + +Note: in previous versions, any unrecognized lines in the slapd.conf +file were passed to the perl module's config method. This behavior is +deprecated (but still allowed for backward compatibility), and the +perlModuleConfig directive should instead be used to invoke the +module's config method. This compatibility feature will be removed at +some future date. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd (8), +.BR perl (1). diff --git a/doc/man/man5/slapd-relay.5 b/doc/man/man5/slapd-relay.5 new file mode 100644 index 0000000..e0532eb --- /dev/null +++ b/doc/man/man5/slapd-relay.5 @@ -0,0 +1,207 @@ +.TH SLAPD-RELAY 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-relay \- relay backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The primary purpose of this +.BR slapd (8) +backend is to map a naming context defined in a database +running in the same +.BR slapd (8) +instance into a virtual naming context, with attributeType +and objectClass manipulation, if required. +It requires the +.BR slapo\-rwm (5) +overlay. +.LP +This backend and the above mentioned overlay are experimental. +.SH CONFIGURATION +The following +.B slapd.conf +directives apply to the relay backend database. +That is, they must follow a "database relay" line and come before any +subsequent "backend" or "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page; only the +.B suffix +directive is allowed by the +.I relay +backend. +.TP +.B relay <real naming context> +The naming context of the database that is presented +under a virtual naming context. +The presence of this directive implies that one specific database, +i.e. the one serving the +.BR "real naming context" , +will be presented under a virtual naming context. + +.SH MASSAGING +The +.B relay +database does not automatically rewrite the naming context +of requests and responses. +For this purpose, the +.BR slapo\-rwm (5) +overlay must be explicitly instantiated, and configured +as appropriate. +Usually, the +.B rwm\-suffixmassage +directive suffices if only naming context rewriting is required. + +.SH ACCESS RULES +One important issue is that access rules are based on the identity +that issued the operation. +After massaging from the virtual to the real naming context, the +frontend sees the operation as performed by the identity in the +real naming context. +Moreover, since +.B back\-relay +bypasses the real database frontend operations by short-circuiting +operations through the internal backend API, the original database +access rules do not apply but in selected cases, i.e. when the +backend itself applies access control. +As a consequence, the instances of the relay database must provide +own access rules that are consistent with those of the original +database, possibly adding further specific restrictions. +So, access rules in the +.B relay +database must refer to identities in the real naming context. +Examples are reported in the EXAMPLES section. + +.SH SCENARIOS +.LP +If no +.B relay +directive is given, the +.I relay +database does not refer to any specific database, but the most +appropriate one is looked-up after rewriting the request DN +for the operation that is being handled. +.LP +This allows one to write carefully crafted rewrite rules that +cause some of the requests to be directed to one database, and +some to another; e.g., authentication can be mapped to one +database, and searches to another, or different target databases +can be selected based on the DN of the request, and so. +.LP +Another possibility is to map the same operation to different +databases based on details of the virtual naming context, +e.g. groups on one database and persons on another. +.LP +.SH EXAMPLES +To implement a plain virtual naming context mapping +that refers to a single database, use +.LP +.nf + database relay + suffix "dc=virtual,dc=naming,dc=context" + relay "dc=real,dc=naming,dc=context" + overlay rwm + rwm\-suffixmassage "dc=real,dc=naming,dc=context" +.fi +.LP +To implement a plain virtual naming context mapping +that looks up the real naming context for each operation, use +.LP +.nf + database relay + suffix "dc=virtual,dc=naming,dc=context" + overlay rwm + rwm\-suffixmassage "dc=real,dc=naming,dc=context" +.fi +.LP +This is useful, for instance, to relay different databases that +share the terminal portion of the naming context (the one that +is rewritten). +.LP +To implement the old-fashioned suffixalias, e.g. mapping +the virtual to the real naming context, but not the results +back from the real to the virtual naming context, use +.LP +.nf + database relay + suffix "dc=virtual,dc=naming,dc=context" + relay "dc=real,dc=naming,dc=context" + overlay rwm + rwm\-rewriteEngine on + rwm\-rewriteContext default + rwm\-rewriteRule "dc=virtual,dc=naming,dc=context" + "dc=real,dc=naming,dc=context" ":@" + rwm\-rewriteContext searchFilter + rwm\-rewriteContext searchEntryDN + rwm\-rewriteContext searchAttrDN + rwm\-rewriteContext matchedDN +.fi +.LP +Note that the +.BR slapo\-rwm (5) +overlay is instantiated, but the rewrite rules are written explicitly, +rather than automatically as with the +.B rwm\-suffixmassage +statement, to map all the virtual to real naming context data flow, +but none of the real to virtual. +.LP +Access rules: +.LP +.nf + database bdb + suffix "dc=example,dc=com" + # skip... + access to dn.subtree="dc=example,dc=com" + by dn.exact="cn=Supervisor,dc=example,dc=com" write + by * read + + database relay + suffix "o=Example,c=US" + relay "dc=example,dc=com" + overlay rwm + rwm\-suffixmassage "dc=example,dc=com" + # skip ... + access to dn.subtree="o=Example,c=US" + by dn.exact="cn=Supervisor,dc=example,dc=com" write + by dn.exact="cn=Relay Supervisor,dc=example,dc=com" write + by * read +.fi +.LP +Note that, in both databases, the identities (the +.B <who> +clause) are in the +.BR "real naming context" , +i.e. +.BR "`dc=example,dc=com'" , +while the targets (the +.B <what> +clause) are in the +.B real +and in the +.BR "virtual naming context" , +respectively. +.SH ACCESS CONTROL +The +.B relay +backend does not honor any of the access control semantics described in +.BR slapd.access (5); +all access control is delegated to the relayed database(s). +Only +.B read (=r) +access to the +.B entry +pseudo-attribute and to the other attribute values of the entries +returned by the +.B search +operation is honored, which is performed by the frontend. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapo\-rwm (5), +.BR slapd (8). diff --git a/doc/man/man5/slapd-shell.5 b/doc/man/man5/slapd-shell.5 new file mode 100644 index 0000000..d8e3fe9 --- /dev/null +++ b/doc/man/man5/slapd-shell.5 @@ -0,0 +1,237 @@ +.TH SLAPD-SHELL 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-shell \- Shell backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The Shell backend to +.BR slapd (8) +executes external programs to implement operations, and is designed to +make it easy to tie an existing database to the +.B slapd +front-end. +.LP +This backend is primarily intended to be used in prototypes. +.SH WARNING +The +.B abandon +shell command has been removed since OpenLDAP 2.1. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the SHELL backend database. +That is, they must follow a "database shell" line and come before any +subsequent "backend" or "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page. +.LP +These options specify the pathname and arguments of the program to +execute in response to the given LDAP operation. +Each option is followed by the input lines that the program receives: +.TP +.B add <pathname> <argument>... +.nf +ADD +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +<entry in LDIF format> +.fi +.TP +.B bind <pathname> <argument>... +.nf +BIND +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +dn: <DN> +method: <method number> +credlen: <length of <credentials>> +cred: <credentials> +.fi +.TP +.B compare <pathname> <argument>... +.nf +COMPARE +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +dn: <DN> +<attribute>: <value> +.fi +.TP +.B delete <pathname> <argument>... +.nf +DELETE +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +dn: <DN> +.fi +.TP +.B modify <pathname> <argument>... +.nf +MODIFY +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +dn: <DN> +<repeat { + <"add"/"delete"/"replace">: <attribute> + <repeat { <attribute>: <value> }> + \- +}> +.fi +.TP +.B modrdn <pathname> <argument>... +.nf +MODRDN +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +dn: <DN> +newrdn: <new RDN> +deleteoldrdn: <0 or 1> +<if new superior is specified: "newSuperior: <DN>"> +.fi +.TP +.B search <pathname> <argument>... +.nf +SEARCH +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +base: <base DN> +scope: <0-2, see ldap.h> +deref: <0-3, see ldap.h> +sizelimit: <size limit> +timelimit: <time limit> +filter: <filter> +attrsonly: <0 or 1> +attrs: <"all" or space-separated attribute list> +.fi +.TP +.B unbind <pathname> <argument>... +.nf +UNBIND +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +dn: <bound DN> +.fi +.LP +Note that you need only supply configuration lines for those commands you +want the backend to handle. +Operations for which a command is not supplied will be refused with an +"unwilling to perform" error. +.LP +The \fBsearch\fP command should output the entries in LDIF format, +each entry followed by a blank line, and after these the RESULT below. +.LP +All commands except \fBunbind\fP should then output: +.RS +.nf +RESULT +code: <integer> +matched: <matched DN> +info: <text> +.fi +.RE +where only the RESULT line is mandatory. +Lines starting with `#' or `DEBUG:' are ignored. +.SH ACCESS CONTROL +The +.B shell +backend does not honor all ACL semantics as described in +.BR slapd.access (5). +In general, access to objects is checked by using a dummy object +that contains only the DN, so access rules that rely on the contents +of the object are not honored. +In detail: +.LP +The +.B add +operation does not require +.B write (=w) +access to the +.B children +pseudo-attribute of the parent entry. +.LP +The +.B bind +operation requires +.B auth (=x) +access to the +.B entry +pseudo-attribute of the entry whose identity is being assessed; +.B auth (=x) +access to the credentials is not checked, but rather delegated +to the underlying shell script. +.LP +The +.B compare +operation requires +.B read (=r) +access (FIXME: wouldn't +.B compare (=c) +be a more appropriate choice?) +to the +.B entry +pseudo-attribute +of the object whose value is being asserted; +.B compare (=c) +access to the attribute whose value is being asserted is not checked. +.LP +The +.B delete +operation does not require +.B write (=w) +access to the +.B children +pseudo-attribute of the parent entry. +.LP +The +.B modify +operation requires +.B write (=w) +access to the +.B entry +pseudo-attribute; +.B write (=w) +access to the specific attributes that are modified is not checked. +.LP +The +.B modrdn +operation does not require +.B write (=w) +access to the +.B children +pseudo-attribute of the parent entry, nor to that of the new parent, +if different; +.B write (=w) +access to the distinguished values of the naming attributes +is not checked. +.LP +The +.B search +operation does not require +.B search (=s) +access to the +.B entry +pseudo_attribute of the searchBase; +.B search (=s) +access to the attributes and values used in the filter is not checked. + +.SH EXAMPLE +There is an example search script in the slapd/back\-shell/ directory +in the OpenLDAP source tree. +.SH LIMITATIONS +The shell backend does not support threaded environments. +When using the shell backend, +.BR slapd (8) +should be built +.IR \-\-without\-threads . +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd (8), +.BR sh (1). diff --git a/doc/man/man5/slapd-sock.5 b/doc/man/man5/slapd-sock.5 new file mode 100644 index 0000000..b453b14 --- /dev/null +++ b/doc/man/man5/slapd-sock.5 @@ -0,0 +1,329 @@ +.TH SLAPD-SOCK 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2007-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd\-sock \- Socket backend/overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The Socket backend to +.BR slapd (8) +uses an external program to handle queries, similarly to +.BR slapd\-shell (5). +However, in this case the external program listens on a Unix domain socket. +This makes it possible to have a pool of processes, which persist between +requests. This allows multithreaded operation and a higher level of +efficiency. The external program must have been started independently; +.BR slapd (8) +itself will not start it. + +This module may also be used as an overlay on top of some other database. +Use as an overlay allows external actions to be triggered in response to +operations on the main database. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the SOCK backend database. +That is, they must follow a "database sock" line and come before any +subsequent "backend" or "database" lines. +Other database options are described in the +.BR slapd.conf (5) +manual page. + +Alternatively, to use this module as an overlay, these directives must +follow an "overlay sock" line within an existing database definition. +.TP +.B extensions [ binddn | peername | ssf | connid ]* +Enables the sending of additional meta-attributes with each request. +.nf +binddn: <bound DN> +peername: IP=<address>:<port> +ssf: <SSF value> +connid: <connection ID> +.fi +.TP +.B socketpath <pathname> +Gives the path to a Unix domain socket to which the commands will +be sent and from which replies are received. + +When used as an overlay, these additional directives are defined: +.TP +.B sockops [ bind | unbind | search | compare | modify | modrdn | add | delete | extended ]* +Specify which request types to send to the external program. The default is +empty (no requests are sent). +.TP +.B sockresps [ result | search ]* +Specify which response types to send to the external program. "result" +sends just the results of an operation. "search" sends all entries that +the database returned for a search request. The default is empty +(no responses are sent). +.TP +.B sockdnpat <regexp> +Specify DN patterns for which the overlay will act. Only operations on +DNs matching the specified regular expression will be processed. The default +is empty (all DNs are processed). + +.SH PROTOCOL +The protocol is essentially the same as +.BR slapd\-shell (5) +with the addition of a newline to terminate the command parameters. The +following commands are sent: +.RS +.nf +ADD +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +<entry in LDIF format> +<blank line> +.fi +.RE +.PP +.RS +.nf +BIND +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +dn: <DN> +method: <method number> +credlen: <length of <credentials>> +cred: <credentials> +<blank line> +.fi +.RE +.PP +.RS +.nf +COMPARE +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +dn: <DN> +<attribute>: <value> +<blank line> +.fi +.RE +.PP +.RS +.nf +DELETE +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +dn: <DN> +<blank line> +.fi +.RE +.PP +.RS +.nf +EXTENDED +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +oid: <OID> +value: <base64-value> +<blank line> +.fi +.RE +.PP +.RS +.nf +MODIFY +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +dn: <DN> +<repeat { + <"add"/"delete"/"replace">: <attribute> + <repeat { <attribute>: <value> }> + \- +}> +<blank line> +.fi +.RE +.PP +.RS +.nf +MODRDN +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +dn: <DN> +newrdn: <new RDN> +deleteoldrdn: <0 or 1> +<if new superior is specified: "newSuperior: <DN>"> +<blank line> +.fi +.RE +.PP +.RS +.nf +SEARCH +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +base: <base DN> +scope: <0-2, see ldap.h> +deref: <0-3, see ldap.h> +sizelimit: <size limit> +timelimit: <time limit> +filter: <filter> +attrsonly: <0 or 1> +attrs: <"all" or space-separated attribute list> +<blank line> +.fi +.RE +.PP +.RS +.nf +UNBIND +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +<blank line> +.fi +.RE +.LP +The commands - except \fBunbind\fP - should output: +.RS +.nf +RESULT +code: <integer> +matched: <matched DN> +info: <text> +.fi +.RE +where only RESULT is mandatory, and then close the socket. +The \fBsearch\fP RESULT should be preceded by the entries in LDIF +format, each entry followed by a blank line. +Lines starting with `#' or `DEBUG:' are ignored. + +When used as an overlay, the external program should return a +CONTINUE response if request processing should continue normally, or +a regular RESULT response if the external program wishes to bypass the +underlying database. + +If the overlay is configured to send response messages to the external +program, they will appear as an extended RESULT message or as an +ENTRY message, defined below. The RESULT message is similar to +the one above, but also includes the msgid and any configured +extensions: +.RS +.nf +RESULT +msgid: <message id> +code: <integer> +matched: <matched DN> +info: <text> +<blank line> +.fi +.RE + +Typically both the msgid and the connid will be needed to match +a result message to a request. The ENTRY message has the form +.RS +.nf +ENTRY +msgid: <message id> +<entry in LDIF format> +<blank line> +.fi +.RE + +.SH KNOWN LIMITATIONS +The +.B sock +backend does not process extended operation results from an external program. + +.SH ACCESS CONTROL +The +.B sock +backend does not honor all ACL semantics as described in +.BR slapd.access (5). +In general, access to objects is checked by using a dummy object +that contains only the DN, so access rules that rely on the contents +of the object are not honored. +In detail: +.LP +The +.B add +operation does not require +.B write (=w) +access to the +.B children +pseudo-attribute of the parent entry. +.LP +The +.B bind +operation requires +.B auth (=x) +access to the +.B entry +pseudo-attribute of the entry whose identity is being assessed; +.B auth (=x) +access to the credentials is not checked, but rather delegated +to the underlying program. +.LP +The +.B compare +operation requires +.B compare (=c) +access to the +.B entry +pseudo-attribute +of the object whose value is being asserted; +.B compare (=c) +access to the attribute whose value is being asserted is not checked. +.LP +The +.B delete +operation does not require +.B write (=w) +access to the +.B children +pseudo-attribute of the parent entry. +.LP +The +.B modify +operation requires +.B write (=w) +access to the +.B entry +pseudo-attribute; +.B write (=w) +access to the specific attributes that are modified is not checked. +.LP +The +.B modrdn +operation does not require +.B write (=w) +access to the +.B children +pseudo-attribute of the parent entry, nor to that of the new parent, +if different; +.B write (=w) +access to the distinguished values of the naming attributes +is not checked. +.LP +The +.B search +operation does not require +.B search (=s) +access to the +.B entry +pseudo_attribute of the searchBase; +.B search (=s) +access to the attributes and values used in the filter is not checked. +.LP +The +.B extended +operation does not require any access special rights. +The external program has to implement any sort of access control. + +.SH EXAMPLE +There is an example script in the slapd/back\-sock/ directory +in the OpenLDAP source tree. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd (8). +.SH AUTHOR +Brian Candler, with enhancements by Howard Chu diff --git a/doc/man/man5/slapd-sock.5.links b/doc/man/man5/slapd-sock.5.links new file mode 100644 index 0000000..b5f4e45 --- /dev/null +++ b/doc/man/man5/slapd-sock.5.links @@ -0,0 +1 @@ +slapo-sock.5 diff --git a/doc/man/man5/slapd-sql.5 b/doc/man/man5/slapd-sql.5 new file mode 100644 index 0000000..8492553 --- /dev/null +++ b/doc/man/man5/slapd-sql.5 @@ -0,0 +1,699 @@ +.TH SLAPD-SQL 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" $OpenLDAP$ +.SH NAME +slapd\-sql \- SQL backend to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The primary purpose of this +.BR slapd (8) +backend is to PRESENT information stored in some RDBMS as an LDAP subtree +without any programming (some SQL and maybe stored procedures can't be +considered programming, anyway ;). +.LP +That is, for example, when you (some ISP) have account information you +use in an RDBMS, and want to use modern solutions that expect such +information in LDAP (to authenticate users, make email lookups etc.). +Or you want to synchronize or distribute information between different +sites/applications that use RDBMSes and/or LDAP. +Or whatever else... +.LP +It is NOT designed as a general-purpose backend that uses RDBMS instead +of BerkeleyDB (as the standard BDB backend does), though it can be +used as such with several limitations. +You can take a look at +.B http://www.openldap.org/faq/index.cgi?file=378 +(OpenLDAP FAQ\-O\-Matic/General LDAP FAQ/Directories vs. conventional +databases) to find out more on this point. +.LP +The idea (detailed below) is to use some meta-information to translate +LDAP queries to SQL queries, leaving relational schema untouched, so +that old applications can continue using it without any +modifications. +This allows SQL and LDAP applications to inter-operate without +replication, and exchange data as needed. +.LP +The SQL backend is designed to be tunable to virtually any relational +schema without having to change source (through that meta-information +mentioned). +Also, it uses ODBC to connect to RDBMSes, and is highly configurable +for SQL dialects RDBMSes may use, so it may be used for integration +and distribution of data on different RDBMSes, OSes, hosts etc., in +other words, in highly heterogeneous environment. +.LP +This backend is \fIexperimental\fP. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the SQL backend database, which means that +they must follow a "database sql" line and come before any +subsequent "backend" or "database" lines. +Other database options not specific to this backend are described +in the +.BR slapd.conf (5) +manual page. +.SH DATA SOURCE CONFIGURATION + +.TP +.B dbname <datasource name> +The name of the ODBC datasource to use. +.LP +.B dbhost <hostname> +.br +.B dbpasswd <password> +.br +.B dbuser <username> +.RS +The three above options are generally unneeded, because this information +is taken from the datasource specified by the +.B dbname +directive. +They allow to override datasource settings. +Also, several RDBMS' drivers tend to require explicit passing of user/password, +even if those are given in datasource (Note: +.B dbhost +is currently ignored). +.RE +.SH SCOPING CONFIGURATION +These options specify SQL query templates for scoping searches. + +.TP +.B subtree_cond <SQL expression> +Specifies a where-clause template used to form a subtree search condition +(dn="(.+,)?<dn>$"). +It may differ from one SQL dialect to another (see samples). +By default, it is constructed based on the knowledge about +how to normalize DN values (e.g. +\fB"<upper_func>(ldap_entries.dn) LIKE CONCAT('%',?)"\fP); +see \fBupper_func\fP, \fBupper_needs_cast\fP, \fBconcat_pattern\fP +and \fBstrcast_func\fP in "HELPER CONFIGURATION" for details. + +.TP +.B children_cond <SQL expression> +Specifies a where-clause template used to form a children search condition +(dn=".+,<dn>$"). +It may differ from one SQL dialect to another (see samples). +By default, it is constructed based on the knowledge about +how to normalize DN values (e.g. +\fB"<upper_func>(ldap_entries.dn) LIKE CONCAT('%,',?)"\fP); +see \fBupper_func\fP, \fBupper_needs_cast\fP, \fBconcat_pattern\fP +and \fBstrcast_func\fP in "HELPER CONFIGURATION" for details. + +.TP +.B use_subtree_shortcut { YES | no } +Do not use the subtree condition when the searchBase is the database +suffix, and the scope is subtree; rather collect all entries. + +.RE +.SH STATEMENT CONFIGURATION +These options specify SQL query templates for loading schema mapping +meta-information, adding and deleting entries to ldap_entries, etc. +All these and subtree_cond should have the given default values. +For the current value it is recommended to look at the sources, +or in the log output when slapd starts with "\-d 5" or greater. +Note that the parameter number and order must not be changed. + +.TP +.B oc_query <SQL expression> +The query that is used to collect the objectClass mapping data +from table \fIldap_oc_mappings\fP; see "METAINFORMATION USED" for details. +The default is +\fB"SELECT id, name, keytbl, keycol, create_proc, delete_proc, expect_return +FROM ldap_oc_mappings"\fP. + +.TP +.B at_query <SQL expression> +The query that is used to collect the attributeType mapping data +from table \fIldap_attr_mappings\fP; see "METAINFORMATION USED" for details. +The default is +\fB"SELECT name, sel_expr, from_tbls, join_where, add_proc, delete_proc, +param_order, expect_return FROM ldap_attr_mappings WHERE oc_map_id=?"\fP. + +.TP +.B id_query <SQL expression> +The query that is used to map a DN to an entry +in table \fIldap_entries\fP; see "METAINFORMATION USED" for details. +The default is +\fB"SELECT id,keyval,oc_map_id,dn FROM ldap_entries WHERE <DN match expr>"\fP, +where \fB<DN match expr>\fP is constructed based on the knowledge about +how to normalize DN values (e.g. \fB"dn=?"\fP if no means to uppercase +strings are available; typically, \fB"<upper_func>(dn)=?"\fP is used); +see \fBupper_func\fP, \fBupper_needs_cast\fP, \fBconcat_pattern\fP +and \fBstrcast_func\fP in "HELPER CONFIGURATION" for details. + +.TP +.B insentry_stmt <SQL expression> +The statement that is used to insert a new entry +in table \fIldap_entries\fP; see "METAINFORMATION USED" for details. +The default is +\fB"INSERT INTO ldap_entries (dn, oc_map_id, parent, keyval) VALUES +(?, ?, ?, ?)"\fP. + +.TP +.B delentry_stmt <SQL expression> +The statement that is used to delete an existing entry +from table \fIldap_entries\fP; see "METAINFORMATION USED" for details. +The default is +\fB"DELETE FROM ldap_entries WHERE id=?"\fP. + +.TP +.B delobjclasses_stmt <SQL expression> +The statement that is used to delete an existing entry's ID +from table \fIldap_objclasses\fP; see "METAINFORMATION USED" for details. +The default is +\fB"DELETE FROM ldap_entry_objclasses WHERE entry_id=?"\fP. + +.RE +.SH HELPER CONFIGURATION +These statements are used to modify the default behavior of the backend +according to issues of the dialect of the RDBMS. +The first options essentially refer to string and DN normalization +when building filters. +LDAP normalization is more than upper- (or lower-)casing everything; +however, as a reasonable trade-off, for case-sensitive RDBMSes the backend +can be instructed to uppercase strings and DNs by providing +the \fBupper_func\fP directive. +Some RDBMSes, to use functions on arbitrary data types, e.g. string +constants, requires a cast, which is triggered +by the \fBupper_needs_cast\fP directive. +If required, a string cast function can be provided as well, +by using the \fBstrcast_func\fP directive. +Finally, a custom string concatenation pattern may be required; +it is provided by the \fBconcat_pattern\fP directive. + +.TP +.B upper_func <SQL function name> +Specifies the name of a function that converts a given value to uppercase. +This is used for case insensitive matching when the RDBMS is case sensitive. +It may differ from one SQL dialect to another (e.g. \fBUCASE\fP, \fBUPPER\fP +or whatever; see samples). By default, none is used, i.e. strings are not +uppercased, so matches may be case sensitive. + +.TP +.B upper_needs_cast { NO | yes } +Set this directive to +.B yes +if +.B upper_func +needs an explicit cast when applied to literal strings. +A cast in the form +.B CAST (<arg> AS VARCHAR(<max DN length>)) +is used, where +.B <max DN length> +is builtin in back-sql; see macro +.B BACKSQL_MAX_DN_LEN +(currently 255; note that slapd's builtin limit, in macro +.BR SLAP_LDAPDN_MAXLEN , +is set to 8192). +This is \fIexperimental\fP and may change in future releases. + +.TP +.B strcast_func <SQL function name> +Specifies the name of a function that converts a given value to a string +for appropriate ordering. This is used in "SELECT DISTINCT" statements +for strongly typed RDBMSes with little implicit casting (like PostgreSQL), +when a literal string is specified. +This is \fIexperimental\fP and may change in future releases. + +.TP +.B concat_pattern <pattern> +This statement defines the +.B pattern +that is used to concatenate strings. The +.B pattern +MUST contain two question marks, '?', that will be replaced +by the two strings that must be concatenated. The default value is +.BR "CONCAT(?,?)"; +a form that is known to be highly portable (IBM db2, PostgreSQL) is +.BR "?||?", +but an explicit cast may be required when operating on literal strings: +.BR "CAST(?||? AS VARCHAR(<length>))". +On some RDBMSes (IBM db2, MSSQL) the form +.B "?+?" +is known to work as well. +Carefully check the documentation of your RDBMS or stay with the examples +for supported ones. +This is \fIexperimental\fP and may change in future releases. + +.TP +.B aliasing_keyword <string> +Define the aliasing keyword. Some RDBMSes use the word "\fIAS\fP" +(the default), others don't use any. + +.TP +.B aliasing_quote <string> +Define the quoting char of the aliasing keyword. Some RDBMSes +don't require any (the default), others may require single +or double quotes. + +.TP +.B has_ldapinfo_dn_ru { NO | yes } +Explicitly inform the backend whether the dn_ru column +(DN in reverse uppercased form) is present in table \fIldap_entries\fP. +Overrides automatic check (this is required, for instance, +by PostgreSQL/unixODBC). +This is \fIexperimental\fP and may change in future releases. + +.TP +.B fail_if_no_mapping { NO | yes } +When set to +.B yes +it forces \fIattribute\fP write operations to fail if no appropriate +mapping between LDAP attributes and SQL data is available. +The default behavior is to ignore those changes that cannot be mapped. +It has no impact on objectClass mapping, i.e. if the +.I structuralObjectClass +of an entry cannot be mapped to SQL by looking up its name +in ldap_oc_mappings, an +.I add +operation will fail regardless of the +.B fail_if_no_mapping +switch; see section "METAINFORMATION USED" for details. +This is \fIexperimental\fP and may change in future releases. + +.TP +.B allow_orphans { NO | yes } +When set to +.B yes +orphaned entries (i.e. without the parent entry in the database) +can be added. This option should be used with care, possibly +in conjunction with some special rule on the RDBMS side that +dynamically creates the missing parent. + +.TP +.B baseObject [ <filename> ] +Instructs the database to create and manage an in-memory baseObject +entry instead of looking for one in the RDBMS. +If the (optional) +.B <filename> +argument is given, the entry is read from that file in +.BR LDIF (5) +format; otherwise, an entry with objectClass \fBextensibleObject\fP +is created based on the contents of the RDN of the \fIbaseObject\fP. +This is particularly useful when \fIldap_entries\fP +information is stored in a view rather than in a table, and +.B union +is not supported for views, so that the view can only specify +one rule to compute the entry structure for one objectClass. +This topic is discussed further in section "METAINFORMATION USED". +This is \fIexperimental\fP and may change in future releases. + +.TP +.B create_needs_select { NO | yes } +Instructs the database whether or not entry creation +in table \fIldap_entries\fP needs a subsequent select to collect +the automatically assigned ID, instead of being returned +by a stored procedure. + +.LP +.B fetch_attrs <attrlist> +.br +.B fetch_all_attrs { NO | yes } +.RS +The first statement allows one to provide a list of attributes that +must always be fetched in addition to those requested by any specific +operation, because they are required for the proper usage of the +backend. For instance, all attributes used in ACLs should be listed +here. The second statement is a shortcut to require all attributes +to be always loaded. Note that the dynamically generated attributes, +e.g. \fIhasSubordinates\fP, \fIentryDN\fP and other implementation +dependent attributes are \fBNOT\fP generated at this point, for +consistency with the rest of slapd. This may change in the future. +.RE + +.TP +.B check_schema { YES | no } +Instructs the database to check schema adherence of entries after +modifications, and structural objectClass chain when entries are built. +By default it is set to +.BR yes . + +.TP +.B sqllayer <name> [...] +Loads the layer \fB<name>\fP onto a stack of helpers that are used +to map DNs from LDAP to SQL representation and vice-versa. +Subsequent args are passed to the layer configuration routine. +This is \fIhighly experimental\fP and should be used with extreme care. +The API of the layers is not frozen yet, so it is unpublished. + +.TP +.B autocommit { NO | yes } +Activates autocommit; by default, it is off. + +.SH METAINFORMATION USED +.LP +Almost everything mentioned later is illustrated in examples located +in the +.B servers/slapd/back\-sql/rdbms_depend/ +directory in the OpenLDAP source tree, and contains scripts for +generating sample database for Oracle, MS SQL Server, mySQL and more +(including PostgreSQL and IBM db2). +.LP +The first thing that one must arrange is what set of LDAP +object classes can present your RDBMS information. +.LP +The easiest way is to create an objectClass for each entity you had in +ER-diagram when designing your relational schema. +Any relational schema, no matter how normalized it is, was designed +after some model of your application's domain (for instance, accounts, +services etc. in ISP), and is used in terms of its entities, not just +tables of normalized schema. +It means that for every attribute of every such instance there is an +effective SQL query that loads its values. +.LP +Also you might want your object classes to conform to some of the standard +schemas like inetOrgPerson etc. +.LP +Nevertheless, when you think it out, we must define a way to translate +LDAP operation requests to (a series of) SQL queries. +Let us deal with the SEARCH operation. +.LP +Example: +Let's suppose that we store information about persons working in our +organization in two tables: +.LP +.nf + PERSONS PHONES + ---------- ------------- + id integer id integer + first_name varchar pers_id integer references persons(id) + last_name varchar phone + middle_name varchar + ... +.fi +.LP +(PHONES contains telephone numbers associated with persons). +A person can have several numbers, then PHONES contains several +records with corresponding pers_id, or no numbers (and no records in +PHONES with such pers_id). +An LDAP objectclass to present such information could look like this: +.LP +.nf + person + ------- + MUST cn + MAY telephoneNumber $ firstName $ lastName + ... +.fi +.LP +To fetch all values for cn attribute given person ID, we construct the +query: +.LP +.nf + SELECT CONCAT(persons.first_name,' ',persons.last_name) + AS cn FROM persons WHERE persons.id=? +.fi +.LP +for telephoneNumber we can use: +.LP +.nf + SELECT phones.phone AS telephoneNumber FROM persons,phones + WHERE persons.id=phones.pers_id AND persons.id=? +.fi +.LP +If we wanted to service LDAP requests with filters like +(telephoneNumber=123*), we would construct something like: +.LP +.nf + SELECT ... FROM persons,phones + WHERE persons.id=phones.pers_id + AND persons.id=? + AND phones.phone like '%1%2%3%' +.fi +.LP +(note how the telephoneNumber match is expanded in multiple wildcards +to account for interspersed ininfluential chars like spaces, dashes +and so; this occurs by design because telephoneNumber is defined after +a specially recognized syntax). +So, if we had information about what tables contain values for each +attribute, how to join these tables and arrange these values, we could +try to automatically generate such statements, and translate search +filters to SQL WHERE clauses. +.LP +To store such information, we add three more tables to our schema +and fill it with data (see samples): +.LP +.nf + ldap_oc_mappings (some columns are not listed for clarity) + --------------- + id=1 + name="person" + keytbl="persons" + keycol="id" +.fi +.LP +This table defines a mapping between objectclass (its name held in the +"name" column), and a table that holds the primary key for corresponding +entities. +For instance, in our example, the person entity, which we are trying +to present as "person" objectclass, resides in two tables (persons and +phones), and is identified by the persons.id column (that we will call +the primary key for this entity). +Keytbl and keycol thus contain "persons" (name of the table), and "id" +(name of the column). +.LP +.nf + ldap_attr_mappings (some columns are not listed for clarity) + ----------- + id=1 + oc_map_id=1 + name="cn" + sel_expr="CONCAT(persons.first_name,' ',persons.last_name)" + from_tbls="persons" + join_where=NULL + ************ + id=<n> + oc_map_id=1 + name="telephoneNumber" + sel_expr="phones.phone" + from_tbls="persons,phones" + join_where="phones.pers_id=persons.id" +.fi +.LP +This table defines mappings between LDAP attributes and SQL queries +that load their values. +Note that, unlike LDAP schema, these are not +.B attribute types +- the attribute "cn" for "person" objectclass can +have its values in different tables than "cn" for some other objectclass, +so attribute mappings depend on objectclass mappings (unlike attribute +types in LDAP schema, which are indifferent to objectclasses). +Thus, we have oc_map_id column with link to oc_mappings table. +.LP +Now we cut the SQL query that loads values for a given attribute into 3 parts. +First goes into sel_expr column - this is the expression we had +between SELECT and FROM keywords, which defines WHAT to load. +Next is table list - text between FROM and WHERE keywords. +It may contain aliases for convenience (see examples). +The last is part of the where clause, which (if it exists at all) expresses the +condition for joining the table containing values with the table +containing the primary key (foreign key equality and such). +If values are in the same table as the primary key, then this column is +left NULL (as for cn attribute above). +.LP +Having this information in parts, we are able to not only construct +queries that load attribute values by id of entry (for this we could +store SQL query as a whole), but to construct queries that load id's +of objects that correspond to a given search filter (or at least part of +it). +See below for examples. +.LP +.nf + ldap_entries + ------------ + id=1 + dn=<dn you choose> + oc_map_id=... + parent=<parent record id> + keyval=<value of primary key> +.fi +.LP +This table defines mappings between DNs of entries in your LDAP tree, +and values of primary keys for corresponding relational data. +It has recursive structure (parent column references id column of the +same table), which allows you to add any tree structure(s) to your +flat relational data. +Having id of objectclass mapping, we can determine table and column +for primary key, and keyval stores value of it, thus defining the exact +tuple corresponding to the LDAP entry with this DN. +.LP +Note that such design (see exact SQL table creation query) implies one +important constraint - the key must be an integer. +But all that I know about well-designed schemas makes me think that it's +not very narrow ;) If anyone needs support for different types for +keys - he may want to write a patch, and submit it to OpenLDAP ITS, +then I'll include it. +.LP +Also, several users complained that they don't really need very +structured trees, and they don't want to update one more table every +time they add or delete an instance in the relational schema. +Those people can use a view instead of a real table for ldap_entries, something +like this (by Robin Elfrink): +.LP +.nf + CREATE VIEW ldap_entries (id, dn, oc_map_id, parent, keyval) + AS + SELECT 0, UPPER('o=MyCompany,c=NL'), + 3, 0, 'baseObject' FROM unixusers WHERE userid='root' + UNION + SELECT (1000000000+userid), + UPPER(CONCAT(CONCAT('cn=',gecos),',o=MyCompany,c=NL')), + 1, 0, userid FROM unixusers + UNION + SELECT (2000000000+groupnummer), + UPPER(CONCAT(CONCAT('cn=',groupnaam),',o=MyCompany,c=NL')), + 2, 0, groupnummer FROM groups; +.fi + +.LP +If your RDBMS does not support +.B unions +in views, only one objectClass can be mapped in +.BR ldap_entries , +and the baseObject cannot be created; in this case, see the +.B baseObject +directive for a possible workaround. + +.LP +.SH TYPICAL SQL BACKEND OPERATION +Having meta-information loaded, the SQL backend uses these tables to +determine a set of primary keys of candidates (depending on search +scope and filter). +It tries to do it for each objectclass registered in ldap_objclasses. +.LP +Example: +for our query with filter (telephoneNumber=123*) we would get the following +query generated (which loads candidate IDs) +.LP +.nf + SELECT ldap_entries.id,persons.id, 'person' AS objectClass, + ldap_entries.dn AS dn + FROM ldap_entries,persons,phones + WHERE persons.id=ldap_entries.keyval + AND ldap_entries.objclass=? + AND ldap_entries.parent=? + AND phones.pers_id=persons.id + AND (phones.phone LIKE '%1%2%3%') +.fi +.LP +(for ONELEVEL search) +or "... AND dn=?" (for BASE search) +or "... AND dn LIKE '%?'" (for SUBTREE) +.LP +Then, for each candidate, we load the requested attributes using +per-attribute queries like +.LP +.nf + SELECT phones.phone AS telephoneNumber + FROM persons,phones + WHERE persons.id=? AND phones.pers_id=persons.id +.fi +.LP +Then, we use test_filter() from the frontend API to test the entry for a full +LDAP search filter match (since we cannot effectively make sense of +SYNTAX of corresponding LDAP schema attribute, we translate the filter +into the most relaxed SQL condition to filter candidates), and send it to +the user. +.LP +ADD, DELETE, MODIFY and MODRDN operations are also performed on per-attribute +meta-information (add_proc etc.). +In those fields one can specify an SQL statement or stored procedure +call which can add, or delete given values of a given attribute, using +the given entry keyval (see examples -- mostly PostgreSQL, ORACLE and MSSQL +- since as of this writing there are no stored procs in MySQL). +.LP +We just add more columns to ldap_oc_mappings and ldap_attr_mappings, holding +statements to execute (like create_proc, add_proc, del_proc etc.), and +flags governing the order of parameters passed to those statements. +Please see samples to find out what are the parameters passed, and other +information on this matter - they are self-explanatory for those familiar +with the concepts expressed above. +.LP +.SH COMMON TECHNIQUES +First of all, let's recall that among other major differences to the +complete LDAP data model, the above illustrated concept does not directly +support such features as multiple objectclasses per entry, and referrals. +Fortunately, they are easy to adopt in this scheme. +The SQL backend requires that one more table is added to the schema: +ldap_entry_objectclasses(entry_id,oc_name). +.LP +That table contains any number of objectclass names that corresponding +entries will possess, in addition to that mentioned in mapping. +The SQL backend automatically adds attribute mapping for the "objectclass" +attribute to each objectclass mapping that loads values from this table. +So, you may, for instance, have a mapping for inetOrgPerson, and use it +for queries for "person" objectclass... +.LP +Referrals used to be implemented in a loose manner by adding an extra +table that allowed any entry to host a "ref" attribute, along with +a "referral" extra objectClass in table ldap_entry_objclasses. +In the current implementation, referrals are treated like any other +user-defined schema, since "referral" is a structural objectclass. +The suggested practice is to define a "referral" entry in ldap_oc_mappings, +holding a naming attribute, e.g. "ou" or "cn", a "ref" attribute, +containing the url; in case multiple referrals per entry are needed, +a separate table for urls can be created, where urls are mapped +to the respective entries. +The use of the naming attribute usually requires to add +an "extensibleObject" value to ldap_entry_objclasses. + +.LP +.SH CAVEATS +As previously stated, this backend should not be considered +a replacement of other data storage backends, but rather a gateway +to existing RDBMS storages that need to be published in LDAP form. +.LP +The \fBhasSubordintes\fP operational attribute is honored by back-sql +in search results and in compare operations; it is partially honored +also in filtering. Owing to design limitations, a (brain-dead?) filter +of the form +\fB(!(hasSubordinates=TRUE))\fP +will give no results instead of returning all the leaf entries, because +it actually expands into \fB... AND NOT (1=1)\fP. +If you need to find all the leaf entries, please use +\fB(hasSubordinates=FALSE)\fP +instead. +.LP +A directoryString value of the form "__First___Last_" +(where underscores mean spaces, ASCII 0x20 char) corresponds +to its prettified counterpart "First_Last"; this is not currently +honored by back-sql if non-prettified data is written via RDBMS; +when non-prettified data is written through back-sql, the prettified +values are actually used instead. + +.LP +.SH BUGS +When the +.B ldap_entry_objclasses +table is empty, filters on the +.B objectClass +attribute erroneously result in no candidates. +A workaround consists in adding at least one row to that table, +no matter if valid or not. + +.LP +.SH PROXY CACHE OVERLAY +The proxy cache overlay +allows caching of LDAP search requests (queries) in a local database. +See +.BR slapo\-pcache (5) +for details. +.SH EXAMPLES +There are example SQL modules in the slapd/back\-sql/rdbms_depend/ +directory in the OpenLDAP source tree. +.SH ACCESS CONTROL +The +.B sql +backend honors access control semantics as indicated in +.BR slapd.access (5) +(including the +.B disclose +access privilege when enabled at compile time). +.SH FILES + +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd (8). diff --git a/doc/man/man5/slapd.access.5 b/doc/man/man5/slapd.access.5 new file mode 100644 index 0000000..f183daf --- /dev/null +++ b/doc/man/man5/slapd.access.5 @@ -0,0 +1,1183 @@ +.TH SLAPD.ACCESS 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd.access \- access configuration for slapd, the stand-alone LDAP daemon +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.BR slapd.conf (5) +file contains configuration information for the +.BR slapd (8) +daemon. This configuration file is also used by the SLAPD tools +.BR slapacl (8), +.BR slapadd (8), +.BR slapauth (8), +.BR slapcat (8), +.BR slapdn (8), +.BR slapindex (8), +and +.BR slaptest (8). +.LP +The +.B slapd.conf +file consists of a series of global configuration options that apply to +.B slapd +as a whole (including all backends), followed by zero or more database +backend definitions that contain information specific to a backend +instance. +.LP +The general format of +.B slapd.conf +is as follows: +.LP +.nf + # comment - these options apply to every database + <global configuration options> + # first database definition & configuration options + database <backend 1 type> + <configuration options specific to backend 1> + # subsequent database definitions & configuration options + ... +.fi +.LP +Both the global configuration and each backend-specific section can +contain access information. Backend-specific access control +directives are used for those entries that belong to the backend, +according to their naming context. In case no access control +directives are defined for a backend or those which are defined are +not applicable, the directives from the global configuration section +are then used. +.LP +If no access controls are present, the default policy +allows anyone and everyone to read anything but restricts +updates to rootdn. (e.g., "access to * by * read"). +.LP +When dealing with an access list, because the global access list is +effectively appended to each per-database list, if the resulting +list is non-empty then the access list will end with an implicit +.B access to * by * none +directive. If there are no access directives applicable to a backend, +then a default read is used. +.LP +.B Be warned: the rootdn can always read and write EVERYTHING! +.LP +For entries not held in any backend (such as a root DSE), the +global directives are used. +.LP +Arguments that should be replaced by actual text are shown in +brackets <>. +.SH THE ACCESS DIRECTIVE +The structure of the access control directives is +.TP +.B access to <what> "[ by <who> [ <access> ] [ <control> ] ]+" +Grant access (specified by +.BR <access> ) +to a set of entries and/or attributes (specified by +.BR <what> ) +by one or more requestors (specified by +.BR <who> ). + +.LP +Lists of access directives are evaluated in the order they appear +in \fIslapd.conf\fP. +When a +.B <what> +clause matches the datum whose access is being evaluated, its +.B <who> +clause list is checked. +When a +.B <who> +clause matches the accessor's properties, its +.B <access> +and +.B <control> +clauses are evaluated. +Access control checking stops at the first match of the +.B <what> +and +.B <who> +clause, unless otherwise dictated by the +.B <control> +clause. +Each +.B <who> +clause list is implicitly terminated by a +.LP +.nf + by * none stop +.fi +.LP +clause that results in stopping the access control with no access +privileges granted. +Each +.B <what> +clause list is implicitly terminated by a +.LP +.nf + access to * + by * none +.fi +.LP +clause that results in granting no access privileges to an otherwise +unspecified datum. +.SH THE <WHAT> FIELD +The field +.BR <what> +specifies the entity the access control directive applies to. +It can have the forms +.LP +.nf + dn[.<dnstyle>]=<dnpattern> + filter=<ldapfilter> + attrs=<attrlist>[ val[/matchingRule][.<attrstyle>]=<attrval>] +.fi +.LP +with +.LP +.nf + <dnstyle>={{exact|base(object)}|regex + |one(level)|sub(tree)|children} + <attrlist>={<attr>|[{!|@}]<objectClass>}[,<attrlist>] + <attrstyle>={{exact|base(object)}|regex + |one(level)|sub(tree)|children} +.fi +.LP +The statement +.B dn=<dnpattern> +selects the entries based on their naming context. +The +.B <dnpattern> +is a string representation of the entry's DN. +The wildcard +.B * +stands for all the entries, and it is implied if no +.B dn +form is given. +.LP +The +.B <dnstyle> +is optional; however, it is recommended to specify it to avoid ambiguities. +.B Base +(synonym of +.BR baseObject ), +the default, +or +.B exact +(an alias of +.BR base ) +indicates the entry whose DN is equal to the +.BR <dnpattern> ; +.B one +(synonym of +.BR onelevel ) +indicates all the entries immediately below the +.BR <dnpattern> , +.B sub +(synonym of +.BR subtree ) +indicates all entries in the subtree at the +.BR <dnpattern> , +.B children +indicates all the entries below (subordinate to) the +.BR <dnpattern> . +.LP +If the +.B <dnstyle> +qualifier is +.BR regex , +then +.B <dnpattern> +is a POSIX (''extended'') regular expression pattern, +as detailed in +.BR regex (7) +and/or +.BR re_format (7), +matching a normalized string representation of the entry's DN. +The regex form of the pattern does not (yet) support UTF-8. +.LP +The statement +.B filter=<ldapfilter> +selects the entries based on a valid LDAP filter as described in RFC 4515. +A filter of +.B (objectClass=*) +is implied if no +.B filter +form is given. +.LP +The statement +.B attrs=<attrlist> +selects the attributes the access control rule applies to. +It is a comma-separated list of attribute types, plus the special names +.BR entry , +indicating access to the entry itself, and +.BR children , +indicating access to the entry's children. ObjectClass names may also +be specified in this list, which will affect all the attributes that +are required and/or allowed by that objectClass. +Actually, names in +.B <attrlist> +that are prefixed by +.B @ +are directly treated as objectClass names. A name prefixed by +.B ! +is also treated as an objectClass, but in this case the access rule +affects the attributes that are not required nor allowed +by that objectClass. +If no +.B attrs +form is given, +.B attrs=@extensibleObject +is implied, i.e. all attributes are addressed. +.LP +Using the form +.B attrs=<attr> val[/matchingRule][.<attrstyle>]=<attrval> +specifies access to a particular value of a single attribute. +In this case, only a single attribute type may be given. The +.B <attrstyle> +.B exact +(the default) uses the attribute's equality matching rule to compare the +value, unless a different (and compatible) matching rule is specified. If the +.B <attrstyle> +is +.BR regex , +the provided value is used as a POSIX (''extended'') regular +expression pattern. If the attribute has DN syntax, the +.B <attrstyle> +can be any of +.BR base , +.BR onelevel , +.B subtree +or +.BR children , +resulting in base, onelevel, subtree or children match, respectively. +.LP +The dn, filter, and attrs statements are additive; they can be used in sequence +to select entities the access rule applies to based on naming context, +value and attribute type simultaneously. +Submatches resulting from +.B regex +matching can be dereferenced in the +.B <who> +field using the syntax +.IR ${v<n>} , +where +.I <n> +is the submatch number. +The default syntax, +.IR $<n> , +is actually an alias for +.IR ${d<n>} , +that corresponds to dereferencing submatches from the +.B dnpattern +portion of the +.B <what> +field. +.SH THE <WHO> FIELD +The field +.B <who> +indicates whom the access rules apply to. +Multiple +.B <who> +statements can appear in an access control statement, indicating the +different access privileges to the same resource that apply to different +accessee. +It can have the forms +.LP +.nf + * + anonymous + users + self[.<selfstyle>] + + dn[.<dnstyle>[,<modifier>]]=<DN> + dnattr=<attrname> + + realanonymous + realusers + realself[.<selfstyle>] + + realdn[.<dnstyle>[,<modifier>]]=<DN> + realdnattr=<attrname> + + group[/<objectclass>[/<attrname>]] + [.<groupstyle>]=<group> + peername[.<peernamestyle>]=<peername> + sockname[.<style>]=<sockname> + domain[.<domainstyle>[,<modifier>]]=<domain> + sockurl[.<style>]=<sockurl> + set[.<setstyle>]=<pattern> + + ssf=<n> + transport_ssf=<n> + tls_ssf=<n> + sasl_ssf=<n> + + dynacl/<name>[/<options>][.<dynstyle>][=<pattern>] +.fi +.LP +with +.LP +.nf + <style>={exact|regex|expand} + <selfstyle>={level{<n>}} + <dnstyle>={{exact|base(object)}|regex + |one(level)|sub(tree)|children|level{<n>}} + <groupstyle>={exact|expand} + <peernamestyle>={<style>|ip|ipv6|path} + <domainstyle>={exact|regex|sub(tree)} + <setstyle>={exact|expand} + <modifier>={expand} + <name>=aci <pattern>=<attrname>] +.fi +.LP +They may be specified in combination. +.LP +.nf +.fi +.LP +The wildcard +.B * +refers to everybody. +.LP +The keywords prefixed by +.B real +act as their counterparts without prefix; the checking respectively occurs +with the \fIauthentication\fP DN and the \fIauthorization\fP DN. +.LP +The keyword +.B anonymous +means access is granted to unauthenticated clients; it is mostly used +to limit access to authentication resources (e.g. the +.B userPassword +attribute) to unauthenticated clients for authentication purposes. +.LP +The keyword +.B users +means access is granted to authenticated clients. +.LP +The keyword +.B self +means access to an entry is allowed to the entry itself (e.g. the entry +being accessed and the requesting entry must be the same). +It allows the +.B level{<n>} +style, where \fI<n>\fP indicates what ancestor of the DN +is to be used in matches. +A positive value indicates that the <n>-th ancestor of the user's DN +is to be considered; a negative value indicates that the <n>-th ancestor +of the target is to be considered. +For example, a "\fIby self.level{1} ...\fP" clause would match +when the object "\fIdc=example,dc=com\fP" is accessed +by "\fIcn=User,dc=example,dc=com\fP". +A "\fIby self.level{-1} ...\fP" clause would match when the same user +accesses the object "\fIou=Address Book,cn=User,dc=example,dc=com\fP". +.LP +The statement +.B dn=<DN> +means that access is granted to the matching DN. +The optional style qualifier +.B dnstyle +allows the same choices of the dn form of the +.B <what> +field. In addition, the +.B regex +style can exploit substring substitution of submatches in the +.B <what> +dn.regex clause by using the form +.BR $<digit> , +with +.B digit +ranging from 0 to 9 (where 0 matches the entire string), +or the form +.BR ${<digit>+} , +for submatches higher than 9. +Substring substitution from attribute value can +be done in +using the form +.BR ${v<digit>+} . +Since the dollar character is used to indicate a substring replacement, +the dollar character that is used to indicate match up to the end of +the string must be escaped by a second dollar character, e.g. +.LP +.nf + access to dn.regex="^(.+,)?uid=([^,]+),dc=[^,]+,dc=com$" + by dn.regex="^uid=$2,dc=[^,]+,dc=com$$" write +.fi +.LP +The style qualifier +allows an optional +.BR modifier . +At present, the only type allowed is +.BR expand , +which causes substring substitution of submatches to take place +even if +.B dnstyle +is not +.BR regex . +Note that the +.B regex +dnstyle in the above example may be of use only if the +.B <by> +clause needs to be a regex; otherwise, if the +value of the second (from the right) +.B dc= +portion of the DN in the above example were fixed, the form +.LP +.nf + access to dn.regex="^(.+,)?uid=([^,]+),dc=example,dc=com$" + by dn.exact,expand="uid=$2,dc=example,dc=com" write +.fi +.LP +could be used; if it had to match the value in the +.B <what> +clause, the form +.LP +.nf + access to dn.regex="^(.+,)?uid=([^,]+),dc=([^,]+),dc=com$" + by dn.exact,expand="uid=$2,dc=$3,dc=com" write +.fi +.LP +could be used. +.LP +Forms of the +.B <what> +clause other than regex may provide submatches as well. +The +.BR base(object) , +the +.BR sub(tree) , +the +.BR one(level) , +and the +.BR children +forms provide +.B $0 +as the match of the entire string. +The +.BR sub(tree) , +the +.BR one(level) , +and the +.BR children +forms also provide +.B $1 +as the match of the rightmost part of the DN as defined in the +.B <what> +clause. +This may be useful, for instance, to provide access to all the +ancestors of a user by defining +.LP +.nf + access to dn.subtree="dc=com" + by dn.subtree,expand="$1" read +.fi +.LP +which means that only access to entries that appear in the DN of the +.B <by> +clause is allowed. +.LP +The +.BR level{<n>} +form is an extension and a generalization of the +.BR onelevel +form, which matches all DNs whose <n>-th ancestor is the pattern. +So, \fIlevel{1}\fP is equivalent to \fIonelevel\fP, +and \fIlevel{0}\fP is equivalent to \fIbase\fP. +.LP +It is perfectly useless to give any access privileges to a DN +that exactly matches the +.B rootdn +of the database the ACLs apply to, because it implicitly +possesses write privileges for the entire tree of that database. +Actually, access control is bypassed for the +.BR rootdn , +to solve the intrinsic chicken-and-egg problem. +.LP +The statement +.B dnattr=<attrname> +means that access is granted to requests whose DN is listed in the +entry being accessed under the +.B <attrname> +attribute. +.LP +The statement +.B group=<group> +means that access is granted to requests whose DN is listed +in the group entry whose DN is given by +.BR <group> . +The optional parameters +.B <objectclass> +and +.B <attrname> +define the objectClass and the member attributeType of the group entry. +The defaults are +.B groupOfNames +and +.BR member , +respectively. +The optional style qualifier +.B <style> +can be +.BR expand , +which means that +.B <group> +will be expanded as a replacement string (but not as a regular expression) +according to +.BR regex (7) +and/or +.BR re_format (7), +and +.BR exact , +which means that exact match will be used. +If the style of the DN portion of the +.B <what> +clause is regex, the submatches are made available according to +.BR regex (7) +and/or +.BR re_format (7); +other styles provide limited submatches as discussed above about +the DN form of the +.B <by> +clause. +.LP +For static groups, the specified attributeType must have +.B DistinguishedName +or +.B NameAndOptionalUID +syntax. For dynamic groups the attributeType must +be a subtype of the +.B labeledURI +attributeType. Only LDAP URIs of the form +.B ldap:///<base>??<scope>?<filter> +will be evaluated in a dynamic group, by searching the local server only. +.LP +The statements +.BR peername=<peername> , +.BR sockname=<sockname> , +.BR domain=<domain> , +and +.BR sockurl=<sockurl> +mean that the contacting host IP (in the form +.BR "IP=<ip>:<port>" +for IPv4, or +.BR "IP=[<ipv6>]:<port>" +for IPv6) +or the contacting host named pipe file name (in the form +.B "PATH=<path>" +if connecting through a named pipe) for +.BR peername , +the named pipe file name for +.BR sockname , +the contacting host name for +.BR domain , +and the contacting URL for +.BR sockurl +are compared against +.B pattern +to determine access. +The same +.B style +rules for pattern match described for the +.B group +case apply, plus the +.B regex +style, which implies submatch +.B expand +and regex match of the corresponding connection parameters. +The +.B exact +style of the +.BR <peername> +clause (the default) implies a case-exact match on the client's +.BR IP , +including the +.B "IP=" +prefix and the trailing +.BR ":<port>" , +or the client's +.BR path , +including the +.B "PATH=" +prefix if connecting through a named pipe. +The special +.B ip +style interprets the pattern as +.BR <peername>=<ip>[%<mask>][{<n>}] , +where +.B <ip> +and +.B <mask> +are dotted digit representations of the IP and the mask, while +.BR <n> , +delimited by curly brackets, is an optional port. +The same applies to IPv6 addresses when the special +.B ipv6 +style is used. +When checking access privileges, the IP portion of the +.BR peername +is extracted, eliminating the +.B "IP=" +prefix and the +.B ":<port>" +part, and it is compared against the +.B <ip> +portion of the pattern after masking with +.BR <mask> : +\fI((peername & <mask>) == <ip>)\fP. +As an example, +.B peername.ip=127.0.0.1 +and +.B peername.ipv6=::1 +allow connections only from localhost, +.B peername.ip=192.168.1.0%255.255.255.0 +allows connections from any IP in the 192.168.1 class C domain, and +.B peername.ip=192.168.1.16%255.255.255.240{9009} +allows connections from any IP in the 192.168.1.[16-31] range +of the same domain, only if port 9009 is used. +The special +.B path +style eliminates the +.B "PATH=" +prefix from the +.B peername +when connecting through a named pipe, and performs an exact match +on the given pattern. +The +.BR <domain> +clause also allows the +.B subtree +style, which succeeds when a fully qualified name exactly matches the +.BR domain +pattern, or its trailing part, after a +.BR dot , +exactly matches the +.BR domain +pattern. +The +.B expand +style is allowed, implying an +.B exact +match with submatch expansion; the use of +.B expand +as a style modifier is considered more appropriate. +As an example, +.B domain.subtree=example.com +will match www.example.com, but will not match www.anotherexample.com. +The +.B domain +of the contacting host is determined by performing a DNS reverse lookup. +As this lookup can easily be spoofed, use of the +.B domain +statement is strongly discouraged. By default, reverse lookups are disabled. +The optional +.B domainstyle +qualifier of the +.B <domain> +clause allows a +.B modifier +option; the only value currently supported is +.BR expand , +which causes substring substitution of submatches to take place even if +the +.B domainstyle +is not +.BR regex , +much like the analogous usage in +.B <dn> +clause. +.LP +The statement +.B set=<pattern> +is undocumented yet. +.LP +The statement +.B dynacl/<name>[/<options>][.<dynstyle>][=<pattern>] +means that access checking is delegated to the admin-defined method +indicated by +.BR <name> , +which can be registered at run-time by means of the +.B moduleload +statement. +The fields +.BR <options> , +.B <dynstyle> +and +.B <pattern> +are optional, and are directly passed to the registered parsing routine. +Dynacl is experimental; it must be enabled at compile time. +.LP +The statement +.B dynacl/aci[=<attrname>] +means that the access control is determined by the values in the +.B attrname +of the entry itself. +The optional +.B <attrname> +indicates what attributeType holds the ACI information in the entry. +By default, the +.B OpenLDAPaci +operational attribute is used. +ACIs are experimental; they must be enabled at compile time. +.LP +The statements +.BR ssf=<n> , +.BR transport_ssf=<n> , +.BR tls_ssf=<n> , +and +.BR sasl_ssf=<n> +set the minimum required Security Strength Factor (ssf) needed +to grant access. The value should be positive integer. +.SH THE <ACCESS> FIELD +The optional field +.B <access> ::= [[real]self]{<level>|<priv>} +determines the access level or the specific access privileges the +.B who +field will have. +Its component are defined as +.LP +.nf + <level> ::= none|disclose|auth|compare|search|read|{write|add|delete}|manage + <priv> ::= {=|+|\-}{0|d|x|c|s|r|{w|a|z}|m}+ +.fi +.LP +The modifier +.B self +allows special operations like having a certain access level or privilege +only in case the operation involves the name of the user that's requesting +the access. +It implies the user that requests access is authorized. +The modifier +.B realself +refers to the authenticated DN as opposed to the authorized DN of the +.B self +modifier. +An example is the +.B selfwrite +access to the member attribute of a group, which allows one to add/delete +its own DN from the member list of a group, while being not allowed +to affect other members. +.LP +The +.B level +access model relies on an incremental interpretation of the access +privileges. +The possible levels are +.BR none , +.BR disclose , +.BR auth , +.BR compare , +.BR search , +.BR read , +.BR write , +and +.BR manage . +Each access level implies all the preceding ones, thus +.B manage +grants all access including administrative access. +The +.BR write +access is actually the combination of +.BR add +and +.BR delete , +which respectively restrict the write privilege to add or delete +the specified +.BR <what> . + +.LP +The +.B none +access level disallows all access including disclosure on error. +.LP +The +.B disclose +access level allows disclosure of information on error. +.LP +The +.B auth +access level means that one is allowed access to an attribute to perform +authentication/authorization operations (e.g. +.BR bind ) +with no other access. +This is useful to grant unauthenticated clients the least possible +access level to critical resources, like passwords. +.LP +The +.B priv +access model relies on the explicit setting of access privileges +for each clause. +The +.B = +sign resets previously defined accesses; as a consequence, the final +access privileges will be only those defined by the clause. +The +.B + +and +.B \- +signs add/remove access privileges to the existing ones. +The privileges are +.B m +for manage, +.B w +for write, +.B a +for add, +.B z +for delete, +.B r +for read, +.B s +for search, +.B c +for compare, +.B x +for authentication, and +.B d +for disclose. +More than one of the above privileges can be added in one statement. +.B 0 +indicates no privileges and is used only by itself (e.g., +0). +Note that +.B +az +is equivalent to +.BR +w . +.LP +If no access is given, it defaults to +.BR +0 . +.SH THE <CONTROL> FIELD +The optional field +.B <control> +controls the flow of access rule application. +It can have the forms +.LP +.nf + stop + continue + break +.fi +.LP +where +.BR stop , +the default, means access checking stops in case of match. +The other two forms are used to keep on processing access clauses. +In detail, the +.B continue +form allows for other +.B <who> +clauses in the same +.B <access> +clause to be considered, so that they may result in incrementally altering +the privileges, while the +.B break +form allows for other +.B <access> +clauses that match the same target to be processed. +Consider the (silly) example +.LP +.nf + access to dn.subtree="dc=example,dc=com" attrs=cn + by * =cs break + + access to dn.subtree="ou=People,dc=example,dc=com" + by * +r +.fi +.LP +which allows search and compare privileges to everybody under +the "dc=example,dc=com" tree, with the second rule allowing +also read in the "ou=People" subtree, +or the (even more silly) example +.LP +.nf + access to dn.subtree="dc=example,dc=com" attrs=cn + by * =cs continue + by users +r +.fi +.LP +which grants everybody search and compare privileges, and adds read +privileges to authenticated clients. +.LP +One useful application is to easily grant write privileges to an +.B updatedn +that is different from the +.BR rootdn . +In this case, since the +.B updatedn +needs write access to (almost) all data, one can use +.LP +.nf + access to * + by dn.exact="cn=The Update DN,dc=example,dc=com" write + by * break +.fi +.LP +as the first access rule. +As a consequence, unless the operation is performed with the +.B updatedn +identity, control is passed straight to the subsequent rules. + +.SH OPERATION REQUIREMENTS +Operations require different privileges on different portions of entries. +The following summary applies to primary database backends such as +the BDB and HDB backends. Requirements for other backends may +(and often do) differ. + +.LP +The +.B add +operation requires +.B add (=a) +privileges on the pseudo-attribute +.B entry +of the entry being added, and +.B add (=a) +privileges on the pseudo-attribute +.B children +of the entry's parent. +When adding the suffix entry of a database, +.B add +access to +.B children +of the empty DN ("") is required. Also if +Add content ACL checking has been configured on +the database (see the +.BR slapd.conf (5) +or +.BR slapd\-config (5) +manual page), +.B add (=a) +will be required on all of the attributes being added. + +.LP +The +.B bind +operation, when credentials are stored in the directory, requires +.B auth (=x) +privileges on the attribute the credentials are stored in (usually +.BR userPassword ). + +.LP +The +.B compare +operation requires +.B compare (=c) +privileges on the attribute that is being compared. + +.LP +The +.B delete +operation requires +.B delete (=z) +privileges on the pseudo-attribute +.B entry +of the entry being deleted, and +.B delete (=d) +privileges on the +.B children +pseudo-attribute of the entry's parent. + +.LP +The +.B modify +operation requires +.B write (=w) +privileges on the attributes being modified. +In detail, +.B add (=a) +is required to add new values, +.B delete (=z) +is required to delete existing values, +and both +.B delete +and +.BR "add (=az)" , +or +.BR "write (=w)" , +are required to replace existing values. + +.LP +The +.B modrdn +operation requires +.B write (=w) +privileges on the pseudo-attribute +.B entry +of the entry whose relative DN is being modified, +.B delete (=z) +privileges on the pseudo-attribute +.B children +of the old entry's parents, +.B add (=a) +privileges on the pseudo-attribute +.B children +of the new entry's parents, and +.B add (=a) +privileges on the attributes that are present in the new relative DN. +.B Delete (=z) +privileges are also required on the attributes that are present +in the old relative DN if +.B deleteoldrdn +is set to 1. + +.LP +The +.B search +operation, requires +.B search (=s) +privileges on the +.B entry +pseudo-attribute of the searchBase +(NOTE: this was introduced with OpenLDAP 2.4). +Then, for each entry, it requires +.B search (=s) +privileges on the attributes that are defined in the filter. +The resulting entries are finally tested for +.B read (=r) +privileges on the pseudo-attribute +.B entry +(for read access to the entry itself) +and for +.B read (=r) +access on each value of each attribute that is requested. +Also, for each +.B referral +object used in generating continuation references, the operation requires +.B read (=r) +access on the pseudo-attribute +.B entry +(for read access to the referral object itself), +as well as +.B read (=r) +access to the attribute holding the referral information +(generally the +.B ref +attribute). + +.LP +Some internal operations and some +.B controls +require specific access privileges. +The +.B authzID +mapping and the +.B proxyAuthz +control require +.B auth (=x) +privileges on all the attributes that are present in the search filter +of the URI regexp maps (the right-hand side of the +.B authz-regexp +directives). +.B Auth (=x) +privileges are also required on the +.B authzTo +attribute of the authorizing identity and/or on the +.B authzFrom +attribute of the authorized identity. +In general, when an internal lookup is performed for authentication +or authorization purposes, search-specific privileges (see the access +requirements for the search operation illustrated above) are relaxed to +.BR auth . + +.LP +Access control to search entries is checked by the frontend, +so it is fully honored by all backends; for all other operations +and for the discovery phase of the search operation, +full ACL semantics is only supported by the primary backends, i.e. +.BR back\-bdb (5), +and +.BR back\-hdb (5). + +Some other backend, like +.BR back\-sql (5), +may fully support them; others may only support a portion of the +described semantics, or even differ in some aspects. +The relevant details are described in the backend-specific man pages. + +.SH CAVEATS +It is strongly recommended to explicitly use the most appropriate +.B <dnstyle> +in +.B <what> +and +.B <who> +clauses, to avoid possible incorrect specifications of the access rules +as well as for performance (avoid unnecessary regex matching when an exact +match suffices) reasons. +.LP +An administrator might create a rule of the form: +.LP +.nf + access to dn.regex="dc=example,dc=com" + by ... +.fi +.LP +expecting it to match all entries in the subtree "dc=example,dc=com". +However, this rule actually matches any DN which contains anywhere +the substring "dc=example,dc=com". That is, the rule matches both +"uid=joe,dc=example,dc=com" and "dc=example,dc=com,uid=joe". +.LP +To match the desired subtree, the rule would be more precisely +written: +.LP +.nf + access to dn.regex="^(.+,)?dc=example,dc=com$" + by ... +.fi +.LP +For performance reasons, it would be better to use the subtree style. +.LP +.nf + access to dn.subtree="dc=example,dc=com" + by ... +.fi +.LP +When writing submatch rules, it may be convenient to avoid unnecessary +.B regex +.B <dnstyle> +use; for instance, to allow access to the subtree of the user +that matches the +.B <what> +clause, one could use +.LP +.nf + access to dn.regex="^(.+,)?uid=([^,]+),dc=example,dc=com$" + by dn.regex="^uid=$2,dc=example,dc=com$$" write + by ... +.fi +.LP +However, since all that is required in the +.B <by> +clause is substring expansion, a more efficient solution is +.LP +.nf + access to dn.regex="^(.+,)?uid=([^,]+),dc=example,dc=com$" + by dn.exact,expand="uid=$2,dc=example,dc=com" write + by ... +.fi +.LP +In fact, while a +.B <dnstyle> +of +.B regex +implies substring expansion, +.BR exact , +as well as all the other DN specific +.B <dnstyle> +values, does not, so it must be explicitly requested. +.LP +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd (8), +.BR slapd\-* (5), +.BR slapacl (8), +.BR regex (7), +.BR re_format (7) +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man5/slapd.backends.5 b/doc/man/man5/slapd.backends.5 new file mode 100644 index 0000000..e2f6d67 --- /dev/null +++ b/doc/man/man5/slapd.backends.5 @@ -0,0 +1,159 @@ +.TH SLAPD.BACKENDS 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2006-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd.backends \- backends for slapd, the stand-alone LDAP daemon +.SH DESCRIPTION +The +.BR slapd (8) +daemon can use a variety of different backends for serving LDAP requests. +Backends may be compiled statically into slapd, or when module support +is enabled, they may be dynamically loaded. Multiple instances of a +backend can be configured, to serve separate databases from the same +slapd server. + + +Configuration options for each backend are documented separately in the +corresponding +.BR slapd\-<backend> (5) +manual pages. +.TP +.B bdb +This was the recommended primary backend through OpenLDAP 2.3, but it has +since been superseded by the +.BR hdb +backend. It takes care to configure it properly. +It uses the transactional database interface of the Oracle Berkeley +DB (BDB) package to store data. +.TP +.B config +This backend is used to manage the configuration of slapd at run-time. +Unlike other backends, only a single instance of the +.B config +backend may be defined. It also instantiates itself automatically, +so it is always present even if not explicitly defined in the +.BR slapd.conf (5) +file. +.TP +.B dnssrv +This backend is experimental. +It serves up referrals based upon SRV resource records held in the +Domain Name System. +.TP +.B hdb +This is the recommended primary backend for a normal slapd database. +.B hdb +is a variant of the +.B bdb +backend that uses a hierarchical database +layout. +This layout stores entry DNs more efficiently than the +.B bdb +backend, +using less space and requiring less work to create, delete, and rename +entries. It is also one of the few backends to support subtree renames. +.TP +.B ldap +This backend acts as a proxy to forward incoming requests to another +LDAP server. +.TP +.B ldif +This database uses the filesystem to build the tree structure +of the database, using plain ascii files to store data. +Its usage should be limited to very simple databases, where performance +is not a requirement. This backend also supports subtree renames. +.TP +.B mdb +This will soon be the recommended primary backend, superseding +.BR hdb . +This backend uses OpenLDAP's own MDB transactional database +library. It is extremely compact and extremely efficient, delivering +much higher performance than the Berkeley DB backends while using +significantly less memory. Also, unlike Berkeley DB, MDB is crash proof, +and requires no special tuning or maintenance. +This backend also supports subtree renames. +.TP +.B meta +This backend performs basic LDAP proxying with respect to a set of +remote LDAP servers. It is an enhancement of the +.B ldap +backend. +.TP +.B monitor +This backend provides information about the running status of the slapd +daemon. Only a single instance of the +.B monitor +backend may be defined. +.TP +.B ndb +This backend is experimental. +It uses the transactional database interface of the MySQL Cluster Engine +(NDB) to store data. Note that Oracle, which now owns MySQL, has withdrawn +support for NDB and this backend is unlikely to be developed any further. +.TP +.B null +Operations in this backend succeed but do nothing. +.TP +.B passwd +This backend is provided for demonstration purposes only. +It serves up user account information from the system +.BR passwd (5) +file. +.TP +.B perl +This backend embeds a +.BR perl (1) +interpreter into slapd. +It runs Perl subroutines to implement LDAP operations. +.TP +.B relay +This backend is experimental. +It redirects LDAP operations to another database +in the same server, based on the naming context of the request. +Its use requires the +.B rwm +overlay (see +.BR slapo\-rwm (5) +for details) to rewrite the naming context of the request. +It is primarily intended to implement virtual views on databases +that actually store data. +.TP +.B shell +This backend executes external programs to implement LDAP operations. +It is primarily intended to be used in prototypes. +.TP +.B sql +This backend is experimental. +It services LDAP requests from an SQL database. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.TP +ETCDIR/slapd.d +default slapd configuration directory +.SH SEE ALSO +.BR ldap (3), +.BR slapd\-bdb (5), +.BR slapd\-config (5), +.BR slapd\-dnssrv (5), +.BR slapd\-hdb (5), +.BR slapd\-ldap (5), +.BR slapd\-ldif (5), +.BR slapd\-mdb (5), +.BR slapd\-meta (5), +.BR slapd\-monitor (5), +.BR slapd\-ndb (5), +.BR slapd\-null (5), +.BR slapd\-passwd (5), +.BR slapd\-perl (5), +.BR slapd\-relay (5), +.BR slapd\-shell (5), +.BR slapd\-sql (5), +.BR slapd.conf (5), +.BR slapd.overlays (5), +.BR slapd (8). +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 new file mode 100644 index 0000000..f504adc --- /dev/null +++ b/doc/man/man5/slapd.conf.5 @@ -0,0 +1,2073 @@ +.TH SLAPD.CONF 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd.conf \- configuration file for slapd, the stand-alone LDAP daemon +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The file +.B ETCDIR/slapd.conf +contains configuration information for the +.BR slapd (8) +daemon. This configuration file is also used by the SLAPD tools +.BR slapacl (8), +.BR slapadd (8), +.BR slapauth (8), +.BR slapcat (8), +.BR slapdn (8), +.BR slapindex (8), +and +.BR slaptest (8). +.LP +The +.B slapd.conf +file consists of a series of global configuration options that apply to +.B slapd +as a whole (including all backends), followed by zero or more database +backend definitions that contain information specific to a backend +instance. +The configuration options are case-insensitive; +their value, on a case by case basis, may be case-sensitive. +.LP +The general format of +.B slapd.conf +is as follows: +.LP +.nf + # comment - these options apply to every database + <global configuration options> + # first database definition & configuration options + database <backend 1 type> + <configuration options specific to backend 1> + # subsequent database definitions & configuration options + ... +.fi +.LP +As many backend-specific sections as desired may be included. Global +options can be overridden in a backend (for options that appear more +than once, the last appearance in the +.B slapd.conf +file is used). +.LP +If a line begins with white space, it is considered a continuation +of the previous line. No physical line should be over 2000 bytes +long. +.LP +Blank lines and comment lines beginning with +a `#' character are ignored. Note: continuation lines are unwrapped +before comment processing is applied. +.LP +Arguments on configuration lines are separated by white space. If an +argument contains white space, the argument should be enclosed in +double quotes. If an argument contains a double quote (`"') or a +backslash character (`\\'), the character should be preceded by a +backslash character. +.LP +The specific configuration options available are discussed below in the +Global Configuration Options, General Backend Options, and General Database +Options. Backend-specific options are discussed in the +.B slapd\-<backend>(5) +manual pages. Refer to the "OpenLDAP Administrator's Guide" for more +details on the slapd configuration file. +.SH GLOBAL CONFIGURATION OPTIONS +Options described in this section apply to all backends, unless specifically +overridden in a backend definition. Arguments that should be replaced by +actual text are shown in brackets <>. +.TP +.B access to <what> "[ by <who> <access> <control> ]+" +Grant access (specified by <access>) to a set of entries and/or +attributes (specified by <what>) by one or more requestors (specified +by <who>). +If no access controls are present, the default policy +allows anyone and everyone to read anything but restricts +updates to rootdn. (e.g., "access to * by * read"). +The rootdn can always read and write EVERYTHING! +See +.BR slapd.access (5) +and the "OpenLDAP's Administrator's Guide" for details. +.TP +.B allow <features> +Specify a set of features (separated by white space) to +allow (default none). +.B bind_v2 +allows acceptance of LDAPv2 bind requests. Note that +.BR slapd (8) +does not truly implement LDAPv2 (RFC 1777), now Historic (RFC 3494). +.B bind_anon_cred +allows anonymous bind when credentials are not empty (e.g. +when DN is empty). +.B bind_anon_dn +allows unauthenticated (anonymous) bind when DN is not empty. +.B update_anon +allows unauthenticated (anonymous) update operations to be processed +(subject to access controls and other administrative limits). +.B proxy_authz_anon +allows unauthenticated (anonymous) proxy authorization control to be processed +(subject to access controls, authorization and other administrative limits). +.TP +.B argsfile <filename> +The (absolute) name of a file that will hold the +.B slapd +server's command line (program name and options). +.TP +.B attributeoptions [option-name]... +Define tagging attribute options or option tag/range prefixes. +Options must not end with `\-', prefixes must end with `\-'. +The `lang\-' prefix is predefined. +If you use the +.B attributeoptions +directive, `lang\-' will no longer be defined and you must specify it +explicitly if you want it defined. + +An attribute description with a tagging option is a subtype of that +attribute description without the option. +Except for that, options defined this way have no special semantics. +Prefixes defined this way work like the `lang\-' options: +They define a prefix for tagging options starting with the prefix. +That is, if you define the prefix `x\-foo\-', you can use the option +`x\-foo\-bar'. +Furthermore, in a search or compare, a prefix or range name (with +a trailing `\-') matches all options starting with that name, as well +as the option with the range name sans the trailing `\-'. +That is, `x\-foo\-bar\-' matches `x\-foo\-bar' and `x\-foo\-bar\-baz'. + +RFC 4520 reserves options beginning with `x\-' for private experiments. +Other options should be registered with IANA, see RFC 4520 section 3.5. +OpenLDAP also has the `binary' option built in, but this is a transfer +option, not a tagging option. +.HP +.hy 0 +.B attributetype "(\ <oid>\ + [NAME\ <name>]\ + [DESC\ <description>]\ + [OBSOLETE]\ + [SUP\ <oid>]\ + [EQUALITY\ <oid>]\ + [ORDERING\ <oid>]\ + [SUBSTR\ <oid>]\ + [SYNTAX\ <oidlen>]\ + [SINGLE\-VALUE]\ + [COLLECTIVE]\ + [NO\-USER\-MODIFICATION]\ + [USAGE\ <attributeUsage>]\ )" +.RS +Specify an attribute type using the LDAPv3 syntax defined in RFC 4512. +The slapd parser extends the RFC 4512 definition by allowing string +forms as well as numeric OIDs to be used for the attribute OID and +attribute syntax OID. +(See the +.B objectidentifier +description.) +.RE +.TP +.B authid\-rewrite<cmd> <args> +Used by the authentication framework to convert simple user names +to an LDAP DN used for authorization purposes. +Its purpose is analogous to that of +.BR authz-regexp +(see below). +The prefix \fIauthid\-\fP is followed by a set of rules analogous +to those described in +.BR slapo\-rwm (5) +for data rewriting (replace the \fIrwm\-\fP prefix with \fIauthid\-\fP). +.B authid\-rewrite<cmd> +and +.B authz\-regexp +rules should not be intermixed. +.TP +.B authz\-policy <policy> +Used to specify which rules to use for Proxy Authorization. Proxy +authorization allows a client to authenticate to the server using one +user's credentials, but specify a different identity to use for authorization +and access control purposes. It essentially allows user A to login as user +B, using user A's password. +The +.B none +flag disables proxy authorization. This is the default setting. +The +.B from +flag will use rules in the +.I authzFrom +attribute of the authorization DN. +The +.B to +flag will use rules in the +.I authzTo +attribute of the authentication DN. +The +.B any +flag, an alias for the deprecated value of +.BR both , +will allow any of the above, whatever succeeds first (checked in +.BR to , +.B from +sequence. +The +.B all +flag requires both authorizations to succeed. +.LP +.RS +The rules are mechanisms to specify which identities are allowed +to perform proxy authorization. +The +.I authzFrom +attribute in an entry specifies which other users +are allowed to proxy login to this entry. The +.I authzTo +attribute in +an entry specifies which other users this user can authorize as. Use of +.I authzTo +rules can be easily +abused if users are allowed to write arbitrary values to this attribute. +In general the +.I authzTo +attribute must be protected with ACLs such that +only privileged users can modify it. +The value of +.I authzFrom +and +.I authzTo +describes an +.B identity +or a set of identities; it can take five forms: +.RS +.TP +.B ldap:///<base>??[<scope>]?<filter> +.RE +.RS +.B dn[.<dnstyle>]:<pattern> +.RE +.RS +.B u[.<mech>[/<realm>]]:<pattern> +.RE +.RS +.B group[/objectClass[/attributeType]]:<pattern> +.RE +.RS +.B <pattern> +.RE +.RS + +.B <dnstyle>:={exact|onelevel|children|subtree|regex} + +.RE +The first form is a valid LDAP +.B URI +where the +.IR <host>:<port> , +the +.I <attrs> +and the +.I <extensions> +portions must be absent, so that the search occurs locally on either +.I authzFrom +or +.IR authzTo . +The second form is a +.BR DN , +with the optional style modifiers +.IR exact , +.IR onelevel , +.IR children , +and +.I subtree +for exact, onelevel, children and subtree matches, which cause +.I <pattern> +to be normalized according to the DN normalization rules, or the special +.I regex +style, which causes the +.I <pattern> +to be treated as a POSIX (''extended'') regular expression, as +discussed in +.BR regex (7) +and/or +.BR re_format (7). +A pattern of +.I * +means any non-anonymous DN. +The third form is a SASL +.BR id , +with the optional fields +.I <mech> +and +.I <realm> +that allow to specify a SASL +.BR mechanism , +and eventually a SASL +.BR realm , +for those mechanisms that support one. +The need to allow the specification of a mechanism is still debated, +and users are strongly discouraged to rely on this possibility. +The fourth form is a group specification, consisting of the keyword +.BR group , +optionally followed by the specification of the group +.B objectClass +and member +.BR attributeType . +The group with DN +.B <pattern> +is searched with base scope, and in case of match, the values of the +member +.B attributeType +are searched for the asserted DN. +For backwards compatibility, if no identity type is provided, i.e. only +.B <pattern> +is present, an +.I exact DN +is assumed; as a consequence, +.B <pattern> +is subjected to DN normalization. +Since the interpretation of +.I authzFrom +and +.I authzTo +can impact security, users are strongly encouraged +to explicitly set the type of identity specification that is being used. +A subset of these rules can be used as third arg in the +.B authz\-regexp +statement (see below); significantly, the +.IR URI , +provided it results in exactly one entry, +and the +.I dn.exact:<dn> +forms. +.RE +.TP +.B authz\-regexp <match> <replace> +Used by the authentication framework to convert simple user names, +such as provided by SASL subsystem, or extracted from certificates +in case of cert-based SASL EXTERNAL, or provided within the RFC 4370 +"proxied authorization" control, to an LDAP DN used for +authorization purposes. Note that the resulting DN need not refer +to an existing entry to be considered valid. When an authorization +request is received from the SASL subsystem, the SASL +.BR USERNAME , +.BR REALM , +and +.B MECHANISM +are taken, when available, and combined into a name of the form +.RS +.RS +.TP +.B UID=<username>[[,CN=<realm>],CN=<mechanism>],CN=auth + +.RE +This name is then compared against the +.B match +POSIX (''extended'') regular expression, and if the match is successful, +the name is replaced with the +.B replace +string. If there are wildcard strings in the +.B match +regular expression that are enclosed in parenthesis, e.g. +.RS +.TP +.B UID=([^,]*),CN=.* + +.RE +then the portion of the name that matched the wildcard will be stored +in the numbered placeholder variable $1. If there are other wildcard strings +in parenthesis, the matching strings will be in $2, $3, etc. up to $9. The +placeholders can then be used in the +.B replace +string, e.g. +.RS +.TP +.B UID=$1,OU=Accounts,DC=example,DC=com + +.RE +The replaced name can be either a DN, i.e. a string prefixed by "dn:", +or an LDAP URI. +If the latter, the server will use the URI to search its own database(s) +and, if the search returns exactly one entry, the name is +replaced by the DN of that entry. The LDAP URI must have no +hostport, attrs, or extensions components, but the filter is mandatory, +e.g. +.RS +.TP +.B ldap:///OU=Accounts,DC=example,DC=com??one?(UID=$1) + +.RE +The protocol portion of the URI must be strictly +.BR ldap . +Note that this search is subject to access controls. Specifically, +the authentication identity must have "auth" access in the subject. + +Multiple +.B authz\-regexp +options can be given in the configuration file to allow for multiple matching +and replacement patterns. The matching patterns are checked in the order they +appear in the file, stopping at the first successful match. + +.\".B Caution: +.\"Because the plus sign + is a character recognized by the regular expression engine, +.\"and it will appear in names that include a REALM, be careful to escape the +.\"plus sign with a backslash \\+ to remove the character's special meaning. +.RE +.TP +.B concurrency <integer> +Specify a desired level of concurrency. Provided to the underlying +thread system as a hint. The default is not to provide any hint. +.TP +.B conn_max_pending <integer> +Specify the maximum number of pending requests for an anonymous session. +If requests are submitted faster than the server can process them, they +will be queued up to this limit. If the limit is exceeded, the session +is closed. The default is 100. +.TP +.B conn_max_pending_auth <integer> +Specify the maximum number of pending requests for an authenticated session. +The default is 1000. +.TP +.B defaultsearchbase <dn> +Specify a default search base to use when client submits a +non-base search request with an empty base DN. +Base scoped search requests with an empty base DN are not affected. +.TP +.B disallow <features> +Specify a set of features (separated by white space) to +disallow (default none). +.B bind_anon +disables acceptance of anonymous bind requests. Note that this setting +does not prohibit anonymous directory access (See "require authc"). +.B bind_simple +disables simple (bind) authentication. +.B tls_2_anon +disables forcing session to anonymous status (see also +.BR tls_authc ) +upon StartTLS operation receipt. +.B tls_authc +disallows the StartTLS operation if authenticated (see also +.BR tls_2_anon ). +.B proxy_authz_non_critical +disables acceptance of the proxied authorization control (RFC4370) +when criticality is FALSE. +.B dontusecopy_non_critical +disables acceptance of the dontUseCopy control (a work in progress) +when criticality is FALSE. +.HP +.hy 0 +.B ditcontentrule "(\ <oid>\ + [NAME\ <name>]\ + [DESC\ <description>]\ + [OBSOLETE]\ + [AUX\ <oids>]\ + [MUST\ <oids>]\ + [MAY\ <oids>]\ + [NOT\ <oids>]\ )" +.RS +Specify an DIT Content Rule using the LDAPv3 syntax defined in RFC 4512. +The slapd parser extends the RFC 4512 definition by allowing string +forms as well as numeric OIDs to be used for the attribute OID and +attribute syntax OID. +(See the +.B objectidentifier +description.) +.RE +.TP +.B gentlehup { on | off } +A SIGHUP signal will only cause a 'gentle' shutdown-attempt: +.B Slapd +will stop listening for new connections, but will not close the +connections to the current clients. Future write operations return +unwilling-to-perform, though. Slapd terminates when all clients +have closed their connections (if they ever do), or - as before - +if it receives a SIGTERM signal. This can be useful if you wish to +terminate the server and start a new +.B slapd +server +.B with another database, +without disrupting the currently active clients. +The default is off. You may wish to use +.B idletimeout +along with this option. +.TP +.B idletimeout <integer> +Specify the number of seconds to wait before forcibly closing +an idle client connection. A idletimeout of 0 disables this +feature. The default is 0. You may also want to set the +.B writetimeout +option. +.TP +.B include <filename> +Read additional configuration information from the given file before +continuing with the next line of the current file. +.TP +.B index_intlen <integer> +Specify the key length for ordered integer indices. The most significant +bytes of the binary integer will be used for index keys. The default +value is 4, which provides exact indexing for 31 bit values. +A floating point representation is used to index too large values. +.TP +.B index_substr_if_minlen <integer> +Specify the minimum length for subinitial and subfinal indices. An +attribute value must have at least this many characters in order to be +processed by the indexing functions. The default is 2. +.TP +.B index_substr_if_maxlen <integer> +Specify the maximum length for subinitial and subfinal indices. Only +this many characters of an attribute value will be processed by the +indexing functions; any excess characters are ignored. The default is 4. +.TP +.B index_substr_any_len <integer> +Specify the length used for subany indices. An attribute value must have +at least this many characters in order to be processed. Attribute values +longer than this length will be processed in segments of this length. The +default is 4. The subany index will also be used in subinitial and +subfinal index lookups when the filter string is longer than the +.I index_substr_if_maxlen +value. +.TP +.B index_substr_any_step <integer> +Specify the steps used in subany index lookups. This value sets the offset +for the segments of a filter string that are processed for a subany index +lookup. The default is 2. For example, with the default values, a search +using this filter "cn=*abcdefgh*" would generate index lookups for +"abcd", "cdef", and "efgh". + +.LP +Note: Indexing support depends on the particular backend in use. Also, +changing these settings will generally require deleting any indices that +depend on these parameters and recreating them with +.BR slapindex (8). + +.HP +.hy 0 +.B ldapsyntax "(\ <oid>\ + [DESC\ <description>]\ + [X\-SUBST <substitute-syntax>]\ )" +.RS +Specify an LDAP syntax using the LDAPv3 syntax defined in RFC 4512. +The slapd parser extends the RFC 4512 definition by allowing string +forms as well as numeric OIDs to be used for the syntax OID. +(See the +.B objectidentifier +description.) +The slapd parser also honors the +.B X\-SUBST +extension (an OpenLDAP-specific extension), which allows one to use the +.B ldapsyntax +statement to define a non-implemented syntax along with another syntax, +the extension value +.IR substitute-syntax , +as its temporary replacement. +The +.I substitute-syntax +must be defined. +This allows one to define attribute types that make use of non-implemented syntaxes +using the correct syntax OID. +Unless +.B X\-SUBST +is used, this configuration statement would result in an error, +since no handlers would be associated to the resulting syntax structure. +.RE + +.TP +.B listener-threads <integer> +Specify the number of threads to use for the connection manager. +The default is 1 and this is typically adequate for up to 16 CPU cores. +The value should be set to a power of 2. +.TP +.B localSSF <SSF> +Specifies the Security Strength Factor (SSF) to be given local LDAP sessions, +such as those to the ldapi:// listener. For a description of SSF values, +see +.BR sasl-secprops 's +.B minssf +option description. The default is 71. +.TP +.B logfile <filename> +Specify a file for recording debug log messages. By default these messages +only go to stderr and are not recorded anywhere else. Specifying a logfile +copies messages to both stderr and the logfile. +.TP +.B loglevel <integer> [...] +Specify the level at which debugging statements and operation +statistics should be syslogged (currently logged to the +.BR syslogd (8) +LOG_LOCAL4 facility). +They must be considered subsystems rather than increasingly verbose +log levels. +Some messages with higher priority are logged regardless +of the configured loglevel as soon as any logging is configured. +Log levels are additive, and available levels are: +.RS +.RS +.PD 0 +.TP +.B 1 +.B (0x1 trace) +trace function calls +.TP +.B 2 +.B (0x2 packets) +debug packet handling +.TP +.B 4 +.B (0x4 args) +heavy trace debugging (function args) +.TP +.B 8 +.B (0x8 conns) +connection management +.TP +.B 16 +.B (0x10 BER) +print out packets sent and received +.TP +.B 32 +.B (0x20 filter) +search filter processing +.TP +.B 64 +.B (0x40 config) +configuration file processing +.TP +.B 128 +.B (0x80 ACL) +access control list processing +.TP +.B 256 +.B (0x100 stats) +connections, LDAP operations, results (recommended) +.TP +.B 512 +.B (0x200 stats2) +stats log entries sent +.TP +.B 1024 +.B (0x400 shell) +print communication with shell backends +.TP +.B 2048 +.B (0x800 parse) +entry parsing +\".TP +\".B 4096 +\".B (0x1000 cache) +\"caching (unused) +\".TP +\".B 8192 +\".B (0x2000 index) +\"data indexing (unused) +.TP +.B 16384 +.B (0x4000 sync) +LDAPSync replication +.TP +.B 32768 +.B (0x8000 none) +only messages that get logged whatever log level is set +.PD +.RE +The desired log level can be input as a single integer that combines +the (ORed) desired levels, both in decimal or in hexadecimal notation, +as a list of integers (that are ORed internally), +or as a list of the names that are shown between parentheses, such that +.LP +.nf + loglevel 129 + loglevel 0x81 + loglevel 128 1 + loglevel 0x80 0x1 + loglevel acl trace +.fi +.LP +are equivalent. +The keyword +.B any +can be used as a shortcut to enable logging at all levels (equivalent to \-1). +The keyword +.BR none , +or the equivalent integer representation, causes those messages +that are logged regardless of the configured loglevel to be logged. +In fact, if loglevel is set to 0, no logging occurs, +so at least the +.B none +level is required to have high priority messages logged. + +The loglevel defaults to \fBstats\fP. +This level should usually also be included when using other loglevels, to +help analyze the logs. +.RE +.TP +.B moduleload <filename> +Specify the name of a dynamically loadable module to load. The filename +may be an absolute path name or a simple filename. Non-absolute names +are searched for in the directories specified by the +.B modulepath +option. This option and the +.B modulepath +option are only usable if slapd was compiled with \-\-enable\-modules. +.TP +.B modulepath <pathspec> +Specify a list of directories to search for loadable modules. Typically +the path is colon-separated but this depends on the operating system. +The default is MODULEDIR, which is where the standard OpenLDAP install +will place its modules. +.HP +.hy 0 +.B objectclass "(\ <oid>\ + [NAME\ <name>]\ + [DESC\ <description>]\ + [OBSOLETE]\ + [SUP\ <oids>]\ + [{ ABSTRACT | STRUCTURAL | AUXILIARY }]\ + [MUST\ <oids>] [MAY\ <oids>] )" +.RS +Specify an objectclass using the LDAPv3 syntax defined in RFC 4512. +The slapd parser extends the RFC 4512 definition by allowing string +forms as well as numeric OIDs to be used for the object class OID. +(See the +.B +objectidentifier +description.) Object classes are "STRUCTURAL" by default. +.RE +.TP +.B objectidentifier <name> "{ <oid> | <name>[:<suffix>] }" +Define a string name that equates to the given OID. The string can be used +in place of the numeric OID in objectclass and attribute definitions. The +name can also be used with a suffix of the form ":xx" in which case the +value "oid.xx" will be used. +.TP +.B password\-hash <hash> [<hash>...] +This option configures one or more hashes to be used in generation of user +passwords stored in the userPassword attribute during processing of +LDAP Password Modify Extended Operations (RFC 3062). +The <hash> must be one of +.BR {SSHA} , +.BR {SHA} , +.BR {SMD5} , +.BR {MD5} , +.BR {CRYPT} , +and +.BR {CLEARTEXT} . +The default is +.BR {SSHA} . + +.B {SHA} +and +.B {SSHA} +use the SHA-1 algorithm (FIPS 160-1), the latter with a seed. + +.B {MD5} +and +.B {SMD5} +use the MD5 algorithm (RFC 1321), the latter with a seed. + +.B {CRYPT} +uses the +.BR crypt (3). + +.B {CLEARTEXT} +indicates that the new password should be +added to userPassword as clear text. + +Note that this option does not alter the normal user applications +handling of userPassword during LDAP Add, Modify, or other LDAP operations. +.TP +.B password\-crypt\-salt\-format <format> +Specify the format of the salt passed to +.BR crypt (3) +when generating {CRYPT} passwords (see +.BR password\-hash ) +during processing of LDAP Password Modify Extended Operations (RFC 3062). + +This string needs to be in +.BR sprintf (3) +format and may include one (and only one) %s conversion. +This conversion will be substituted with a string of random +characters from [A\-Za\-z0\-9./]. For example, "%.2s" +provides a two character salt and "$1$%.8s" tells some +versions of crypt(3) to use an MD5 algorithm and provides +8 random characters of salt. The default is "%s", which +provides 31 characters of salt. +.TP +.B pidfile <filename> +The (absolute) name of a file that will hold the +.B slapd +server's process ID (see +.BR getpid (2)). +.TP +.B referral <url> +Specify the referral to pass back when +.BR slapd (8) +cannot find a local database to handle a request. +If specified multiple times, each url is provided. +.TP +.B require <conditions> +Specify a set of conditions (separated by white space) to +require (default none). +The directive may be specified globally and/or per-database; +databases inherit global conditions, so per-database specifications +are additive. +.B bind +requires bind operation prior to directory operations. +.B LDAPv3 +requires session to be using LDAP version 3. +.B authc +requires authentication prior to directory operations. +.B SASL +requires SASL authentication prior to directory operations. +.B strong +requires strong authentication prior to directory operations. +The strong keyword allows protected "simple" authentication +as well as SASL authentication. +.B none +may be used to require no conditions (useful to clear out globally +set conditions within a particular database); it must occur first +in the list of conditions. +.TP +.B reverse\-lookup on | off +Enable/disable client name unverified reverse lookup (default is +.BR off +if compiled with \-\-enable\-rlookups). +.TP +.B rootDSE <file> +Specify the name of an LDIF(5) file containing user defined attributes +for the root DSE. These attributes are returned in addition to the +attributes normally produced by slapd. + +The root DSE is an entry with information about the server and its +capabilities, in operational attributes. +It has the empty DN, and can be read with e.g.: +.ti +4 +ldapsearch \-x \-b "" \-s base "+" +.br +See RFC 4512 section 5.1 for details. +.TP +.B sasl\-auxprops <plugin> [...] +Specify which auxprop plugins to use for authentication lookups. The +default is empty, which just uses slapd's internal support. Usually +no other auxprop plugins are needed. +.TP +.B sasl\-host <fqdn> +Used to specify the fully qualified domain name used for SASL processing. +.TP +.B sasl\-realm <realm> +Specify SASL realm. Default is empty. +.TP +.B sasl\-secprops <properties> +Used to specify Cyrus SASL security properties. +The +.B none +flag (without any other properties) causes the flag properties +default, "noanonymous,noplain", to be cleared. +The +.B noplain +flag disables mechanisms susceptible to simple passive attacks. +The +.B noactive +flag disables mechanisms susceptible to active attacks. +The +.B nodict +flag disables mechanisms susceptible to passive dictionary attacks. +The +.B noanonymous +flag disables mechanisms which support anonymous login. +The +.B forwardsec +flag require forward secrecy between sessions. +The +.B passcred +require mechanisms which pass client credentials (and allow +mechanisms which can pass credentials to do so). +The +.B minssf=<factor> +property specifies the minimum acceptable +.I security strength factor +as an integer approximate to effective key length used for +encryption. 0 (zero) implies no protection, 1 implies integrity +protection only, 56 allows DES or other weak ciphers, 112 +allows triple DES and other strong ciphers, 128 allows RC4, +Blowfish and other modern strong ciphers. The default is 0. +The +.B maxssf=<factor> +property specifies the maximum acceptable +.I security strength factor +as an integer (see minssf description). The default is INT_MAX. +The +.B maxbufsize=<size> +property specifies the maximum security layer receive buffer +size allowed. 0 disables security layers. The default is 65536. +.TP +.B schemadn <dn> +Specify the distinguished name for the subschema subentry that +controls the entries on this server. The default is "cn=Subschema". +.TP +.B security <factors> +Specify a set of security strength factors (separated by white space) +to require (see +.BR sasl\-secprops 's +.B minssf +option for a description of security strength factors). +The directive may be specified globally and/or per-database. +.B ssf=<n> +specifies the overall security strength factor. +.B transport=<n> +specifies the transport security strength factor. +.B tls=<n> +specifies the TLS security strength factor. +.B sasl=<n> +specifies the SASL security strength factor. +.B update_ssf=<n> +specifies the overall security strength factor to require for +directory updates. +.B update_transport=<n> +specifies the transport security strength factor to require for +directory updates. +.B update_tls=<n> +specifies the TLS security strength factor to require for +directory updates. +.B update_sasl=<n> +specifies the SASL security strength factor to require for +directory updates. +.B simple_bind=<n> +specifies the security strength factor required for +.I simple +username/password authentication. +Note that the +.B transport +factor is measure of security provided by the underlying transport, +e.g. ldapi:// (and eventually IPSEC). It is not normally used. +.TP +.B serverID <integer> [<URL>] +Specify an integer ID from 0 to 4095 for this server (limited +to 3 hexadecimal digits). The ID may also be specified as a +hexadecimal ID by prefixing the value with "0x". +Non-zero IDs are +required when using multimaster replication and each master must have a +unique non-zero ID. Note that this requirement also applies to separate masters +contributing to a glued set of databases. +If the URL is provided, this directive may be specified +multiple times, providing a complete list of participating servers +and their IDs. The fully qualified hostname of each server should be +used in the supplied URLs. The IDs are used in the "replica id" field +of all CSNs generated by the specified server. The default value is zero, which +is only valid for single master replication. +Example: +.LP +.nf + serverID 1 +.fi +.TP +.B sizelimit {<integer>|unlimited} +.TP +.B sizelimit size[.{soft|hard|unchecked}]=<integer> [...] +Specify the maximum number of entries to return from a search operation. +The default size limit is 500. +Use +.B unlimited +to specify no limits. +The second format allows a fine grain setting of the size limits. +Extra args can be added on the same line. +See +.BR limits +for an explanation of the different flags. +.TP +.B sockbuf_max_incoming <integer> +Specify the maximum incoming LDAP PDU size for anonymous sessions. +The default is 262143. +.TP +.B sockbuf_max_incoming_auth <integer> +Specify the maximum incoming LDAP PDU size for authenticated sessions. +The default is 4194303. +.TP +.B sortvals <attr> [...] +Specify a list of multi-valued attributes whose values will always +be maintained in sorted order. Using this option will allow Modify, +Compare, and filter evaluations on these attributes to be performed +more efficiently. The resulting sort order depends on the +attributes' syntax and matching rules and may not correspond to +lexical order or any other recognizable order. +.TP +.B tcp-buffer [listener=<URL>] [{read|write}=]<size> +Specify the size of the TCP buffer. +A global value for both read and write TCP buffers related to any listener +is defined, unless the listener is explicitly specified, +or either the read or write qualifiers are used. +See +.BR tcp (7) +for details. +Note that some OS-es implement automatic TCP buffer tuning. +.TP +.B threads <integer> +Specify the maximum size of the primary thread pool. +The default is 16; the minimum value is 2. +.TP +.B timelimit {<integer>|unlimited} +.TP +.B timelimit time[.{soft|hard}]=<integer> [...] +Specify the maximum number of seconds (in real time) +.B slapd +will spend answering a search request. The default time limit is 3600. +Use +.B unlimited +to specify no limits. +The second format allows a fine grain setting of the time limits. +Extra args can be added on the same line. +See +.BR limits +for an explanation of the different flags. +.TP +.B tool\-threads <integer> +Specify the maximum number of threads to use in tool mode. +This should not be greater than the number of CPUs in the system. +The default is 1. +.\"ucdata-path is obsolete / ignored... +.\".TP +.\".B ucdata-path <path> +.\"Specify the path to the directory containing the Unicode character +.\"tables. The default path is DATADIR/ucdata. +.TP +.B writetimeout <integer> +Specify the number of seconds to wait before forcibly closing +a connection with an outstanding write. This allows recovery from +various network hang conditions. A writetimeout of 0 disables this +feature. The default is 0. +.SH TLS OPTIONS +If +.B slapd +is built with support for Transport Layer Security, there are more options +you can specify. +.TP +.B TLSCipherSuite <cipher-suite-spec> +Permits configuring what ciphers will be accepted and the preference order. +<cipher-suite-spec> should be a cipher specification for the TLS library +in use (OpenSSL, GnuTLS, or Mozilla NSS). +Example: +.RS +.RS +.TP +.I OpenSSL: +TLSCipherSuite HIGH:MEDIUM:+SSLv2 +.TP +.I GnuTLS: +TLSCiphersuite SECURE256:!AES-128-CBC +.RE + +To check what ciphers a given spec selects in OpenSSL, use: + +.nf + openssl ciphers \-v <cipher-suite-spec> +.fi + +With GnuTLS the available specs can be found in the manual page of +.BR gnutls\-cli (1) +(see the description of the +option +.BR \-\-priority ). + +In older versions of GnuTLS, where gnutls\-cli does not support the option +\-\-priority, you can obtain the \(em more limited \(em list of ciphers by calling: + +.nf + gnutls\-cli \-l +.fi + +When using Mozilla NSS, the OpenSSL cipher suite specifications are used and +translated into the format used internally by Mozilla NSS. There isn't an easy +way to list the cipher suites from the command line. The authoritative list +is in the source code for Mozilla NSS in the file sslinfo.c in the structure +.nf + static const SSLCipherSuiteInfo suiteInfo[] +.fi +.RE +.TP +.B TLSCACertificateFile <filename> +Specifies the file that contains certificates for all of the Certificate +Authorities that +.B slapd +will recognize. The certificate for +the CA that signed the server certificate must be included among +these certificates. If the signing CA was not a top-level (root) CA, +certificates for the entire sequence of CA's from the signing CA to +the top-level CA should be present. Multiple certificates are simply +appended to the file; the order is not significant. +.TP +.B TLSCACertificatePath <path> +Specifies the path of a directory that contains Certificate Authority +certificates in separate individual files. Usually only one of this +or the TLSCACertificateFile is used. This directive is not supported +when using GnuTLS. + +When using Mozilla NSS, <path> may contain a Mozilla NSS cert/key +database. If <path> contains a Mozilla NSS cert/key database and +CA cert files, OpenLDAP will use the cert/key database and will +ignore the CA cert files. +.TP +.B TLSCertificateFile <filename> +Specifies the file that contains the +.B slapd +server certificate. + +When using Mozilla NSS, if using a cert/key database (specified with +TLSCACertificatePath), TLSCertificateFile specifies +the name of the certificate to use: +.nf + TLSCertificateFile Server-Cert +.fi +If using a token other than the internal built in token, specify the +token name first, followed by a colon: +.nf + TLSCertificateFile my hardware device:Server-Cert +.fi +Use certutil \-L to list the certificates by name: +.nf + certutil \-d /path/to/certdbdir \-L +.fi +.TP +.B TLSCertificateKeyFile <filename> +Specifies the file that contains the +.B slapd +server private key that matches the certificate stored in the +.B TLSCertificateFile +file. Currently, the private key must not be protected with a password, so +it is of critical importance that it is protected carefully. + +When using Mozilla NSS, TLSCertificateKeyFile specifies the name of +a file that contains the password for the key for the certificate specified with +TLSCertificateFile. The modutil command can be used to turn off password +protection for the cert/key database. For example, if TLSCACertificatePath +specifes /etc/openldap/certdb as the location of the cert/key database, use +modutil to change the password to the empty string: +.nf + modutil \-dbdir /etc/openldap/certdb \-changepw 'NSS Certificate DB' +.fi +You must have the old password, if any. Ignore the WARNING about the running +browser. Press 'Enter' for the new password. +.TP +.B TLSDHParamFile <filename> +This directive specifies the file that contains parameters for Diffie-Hellman +ephemeral key exchange. This is required in order to use a DSA certificate on +the server, or an RSA certificate missing the "key encipherment" key usage. +Note that setting this option may also enable +Anonymous Diffie-Hellman key exchanges in certain non-default cipher suites. +Anonymous key exchanges should generally be avoided since they provide no +actual client or server authentication and provide no protection against +man-in-the-middle attacks. +You should append "!ADH" to your cipher suites to ensure that these suites +are not used. +When using Mozilla NSS these parameters are always generated randomly +so this directive is ignored. +.TP +.B TLSProtocolMin <major>[.<minor>] +Specifies minimum SSL/TLS protocol version that will be negotiated. +If the server doesn't support at least that version, +the SSL handshake will fail. +To require TLS 1.x or higher, set this option to 3.(x+1), +e.g., + +.nf + TLSProtocolMin 3.2 +.fi + +would require TLS 1.1. +Specifying a minimum that is higher than that supported by the +OpenLDAP implementation will result in it requiring the +highest level that it does support. +This directive is ignored with GnuTLS. +.TP +.B TLSRandFile <filename> +Specifies the file to obtain random bits from when /dev/[u]random +is not available. Generally set to the name of the EGD/PRNGD socket. +The environment variable RANDFILE can also be used to specify the filename. +This directive is ignored with GnuTLS and Mozilla NSS. +.TP +.B TLSVerifyClient <level> +Specifies what checks to perform on client certificates in an +incoming TLS session, if any. +The +.B <level> +can be specified as one of the following keywords: +.RS +.TP +.B never +This is the default. +.B slapd +will not ask the client for a certificate. +.TP +.B allow +The client certificate is requested. If no certificate is provided, +the session proceeds normally. If a bad certificate is provided, +it will be ignored and the session proceeds normally. +.TP +.B try +The client certificate is requested. If no certificate is provided, +the session proceeds normally. If a bad certificate is provided, +the session is immediately terminated. +.TP +.B demand | hard | true +These keywords are all equivalent, for compatibility reasons. +The client certificate is requested. If no certificate is provided, +or a bad certificate is provided, the session is immediately terminated. + +Note that a valid client certificate is required in order to use the +SASL EXTERNAL authentication mechanism with a TLS session. As such, +a non-default +.B TLSVerifyClient +setting must be chosen to enable SASL EXTERNAL authentication. +.RE +.TP +.B TLSCRLCheck <level> +Specifies if the Certificate Revocation List (CRL) of the CA should be +used to verify if the client certificates have not been revoked. This +requires +.B TLSCACertificatePath +parameter to be set. This directive is ignored with GnuTLS and Mozilla NSS. +.B <level> +can be specified as one of the following keywords: +.RS +.TP +.B none +No CRL checks are performed +.TP +.B peer +Check the CRL of the peer certificate +.TP +.B all +Check the CRL for a whole certificate chain +.RE +.TP +.B TLSCRLFile <filename> +Specifies a file containing a Certificate Revocation List to be used +for verifying that certificates have not been revoked. This directive is +only valid when using GnuTLS and Mozilla NSS. +.SH GENERAL BACKEND OPTIONS +Options in this section only apply to the configuration file section +for the specified backend. They are supported by every +type of backend. +.TP +.B backend <databasetype> +Mark the beginning of a backend definition. <databasetype> +should be one of +.BR bdb , +.BR config , +.BR dnssrv , +.BR hdb , +.BR ldap , +.BR ldif , +.BR mdb , +.BR meta , +.BR monitor , +.BR null , +.BR passwd , +.BR perl , +.BR relay , +.BR shell , +or +.BR sql , +depending on which backend will serve the database. + +.SH GENERAL DATABASE OPTIONS +Options in this section only apply to the configuration file section +for the database in which they are defined. They are supported by every +type of backend. Note that the +.B database +and at least one +.B suffix +option are mandatory for each database. +.TP +.B database <databasetype> +Mark the beginning of a new database instance definition. <databasetype> +should be one of +.BR bdb , +.BR config , +.BR dnssrv , +.BR hdb , +.BR ldap , +.BR ldif , +.BR mdb , +.BR meta , +.BR monitor , +.BR null , +.BR passwd , +.BR perl , +.BR relay , +.BR shell , +or +.BR sql , +depending on which backend will serve the database. + +LDAP operations, even subtree searches, normally access only one +database. +That can be changed by gluing databases together with the +.B subordinate +keyword. +Access controls and some overlays can also involve multiple databases. +.TP +.B add_content_acl on | off +Controls whether Add operations will perform ACL checks on +the content of the entry being added. This check is off +by default. See the +.BR slapd.access (5) +manual page for more details on ACL requirements for +Add operations. +.TP +.B extra_attrs <attrlist> +Lists what attributes need to be added to search requests. +Local storage backends return the entire entry to the frontend. +The frontend takes care of only returning the requested attributes +that are allowed by ACLs. +However, features like access checking and so may need specific +attributes that are not automatically returned by remote storage +backends, like proxy backends and so on. +.B <attrlist> +is a list of attributes that are needed for internal purposes +and thus always need to be collected, even when not explicitly +requested by clients. +.TP +.B hidden on | off +Controls whether the database will be used to answer +queries. A database that is hidden will never be +selected to answer any queries, and any suffix configured +on the database will be ignored in checks for conflicts +with other databases. By default, hidden is off. +.TP +.B lastmod on | off +Controls whether +.B slapd +will automatically maintain the +modifiersName, modifyTimestamp, creatorsName, and +createTimestamp attributes for entries. It also controls +the entryCSN and entryUUID attributes, which are needed +by the syncrepl provider. By default, lastmod is on. +.TP +.B limits <selector> <limit> [<limit> [...]] +Specify time and size limits based on the operation's initiator or +base DN. +The argument +.B <selector> +can be any of +.RS +.RS +.TP +anonymous | users | [<dnspec>=]<pattern> | group[/oc[/at]]=<pattern> + +.RE +with +.RS +.TP +<dnspec> ::= dn[.<type>][.<style>] +.TP +<type> ::= self | this +.TP +<style> ::= exact | base | onelevel | subtree | children | regex | anonymous + +.RE +DN type +.B self +is the default and means the bound user, while +.B this +means the base DN of the operation. +The term +.B anonymous +matches all unauthenticated clients. +The term +.B users +matches all authenticated clients; +otherwise an +.B exact +dn pattern is assumed unless otherwise specified by qualifying +the (optional) key string +.B dn +with +.B exact +or +.B base +(which are synonyms), to require an exact match; with +.BR onelevel , +to require exactly one level of depth match; with +.BR subtree , +to allow any level of depth match, including the exact match; with +.BR children , +to allow any level of depth match, not including the exact match; +.BR regex +explicitly requires the (default) match based on POSIX (''extended'') +regular expression pattern. +Finally, +.B anonymous +matches unbound operations; the +.B pattern +field is ignored. +The same behavior is obtained by using the +.B anonymous +form of the +.B <selector> +clause. +The term +.BR group , +with the optional objectClass +.B oc +and attributeType +.B at +fields, followed by +.BR pattern , +sets the limits for any DN listed in the values of the +.B at +attribute (default +.BR member ) +of the +.B oc +group objectClass (default +.BR groupOfNames ) +whose DN exactly matches +.BR pattern . + +The currently supported limits are +.B size +and +.BR time . + +The syntax for time limits is +.BR time[.{soft|hard}]=<integer> , +where +.I integer +is the number of seconds slapd will spend answering a search request. +If no time limit is explicitly requested by the client, the +.BR soft +limit is used; if the requested time limit exceeds the +.BR hard +.\"limit, an +.\".I "Administrative limit exceeded" +.\"error is returned. +limit, the value of the limit is used instead. +If the +.BR hard +limit is set to the keyword +.IR soft , +the soft limit is used in either case; if it is set to the keyword +.IR unlimited , +no hard limit is enforced. +Explicit requests for time limits smaller or equal to the +.BR hard +limit are honored. +If no limit specifier is set, the value is assigned to the +.BR soft +limit, and the +.BR hard +limit is set to +.IR soft , +to preserve the original behavior. + +The syntax for size limits is +.BR size[.{soft|hard|unchecked}]=<integer> , +where +.I integer +is the maximum number of entries slapd will return answering a search +request. +If no size limit is explicitly requested by the client, the +.BR soft +limit is used; if the requested size limit exceeds the +.BR hard +.\"limit, an +.\".I "Administrative limit exceeded" +.\"error is returned. +limit, the value of the limit is used instead. +If the +.BR hard +limit is set to the keyword +.IR soft , +the soft limit is used in either case; if it is set to the keyword +.IR unlimited , +no hard limit is enforced. +Explicit requests for size limits smaller or equal to the +.BR hard +limit are honored. +The +.BR unchecked +specifier sets a limit on the number of candidates a search request is allowed +to examine. +The rationale behind it is that searches for non-properly indexed +attributes may result in large sets of candidates, which must be +examined by +.BR slapd (8) +to determine whether they match the search filter or not. +The +.B unchecked +limit provides a means to drop such operations before they are even +started. +If the selected candidates exceed the +.BR unchecked +limit, the search will abort with +.IR "Unwilling to perform" . +If it is set to the keyword +.IR unlimited , +no limit is applied (the default). +If it is set to +.IR disabled , +the search is not even performed; this can be used to disallow searches +for a specific set of users. +If no limit specifier is set, the value is assigned to the +.BR soft +limit, and the +.BR hard +limit is set to +.IR soft , +to preserve the original behavior. + +In case of no match, the global limits are used. +The default values are the same as for +.B sizelimit +and +.BR timelimit ; +no limit is set on +.BR unchecked . + +If +.B pagedResults +control is requested, the +.B hard +size limit is used by default, because the request of a specific page size +is considered an explicit request for a limitation on the number +of entries to be returned. +However, the size limit applies to the total count of entries returned within +the search, and not to a single page. +Additional size limits may be enforced; the syntax is +.BR size.pr={<integer>|noEstimate|unlimited} , +where +.I integer +is the max page size if no explicit limit is set; the keyword +.I noEstimate +inhibits the server from returning an estimate of the total number +of entries that might be returned +(note: the current implementation does not return any estimate). +The keyword +.I unlimited +indicates that no limit is applied to the pagedResults control page size. +The syntax +.B size.prtotal={<integer>|unlimited|disabled} +allows one to set a limit on the total number of entries that the pagedResults +control will return. +By default it is set to the +.B hard +limit. +When set, +.I integer +is the max number of entries that the whole search with pagedResults control +can return. +Use +.I unlimited +to allow unlimited number of entries to be returned, e.g. to allow +the use of the pagedResults control as a means to circumvent size +limitations on regular searches; the keyword +.I disabled +disables the control, i.e. no paged results can be returned. +Note that the total number of entries returned when the pagedResults control +is requested cannot exceed the +.B hard +size limit of regular searches unless extended by the +.B prtotal +switch. + +The \fBlimits\fP statement is typically used to let an unlimited +number of entries be returned by searches performed +with the identity used by the consumer for synchronization purposes +by means of the RFC 4533 LDAP Content Synchronization protocol +(see \fBsyncrepl\fP for details). +.RE +.TP +.B maxderefdepth <depth> +Specifies the maximum number of aliases to dereference when trying to +resolve an entry, used to avoid infinite alias loops. The default is 15. +.TP +.B mirrormode on | off +This option puts a replica database into "mirror" mode. Update +operations will be accepted from any user, not just the updatedn. The +database must already be configured as a syncrepl consumer +before this keyword may be set. This mode also requires a +.B serverID +(see above) to be configured. +By default, mirrormode is off. +.TP +.B monitoring on | off +This option enables database-specific monitoring in the entry related +to the current database in the "cn=Databases,cn=Monitor" subtree +of the monitor database, if the monitor database is enabled. +Currently, only the BDB and the HDB databases provide database-specific +monitoring. +The default depends on the backend type. +.TP +.B overlay <overlay-name> +Add the specified overlay to this database. An overlay is a piece of +code that intercepts database operations in order to extend or change +them. Overlays are pushed onto +a stack over the database, and so they will execute in the reverse +of the order in which they were configured and the database itself +will receive control last of all. See the +.BR slapd.overlays (5) +manual page for an overview of the available overlays. +Note that all of the database's +regular settings should be configured before any overlay settings. +.TP +.B readonly on | off +This option puts the database into "read-only" mode. Any attempts to +modify the database will return an "unwilling to perform" error. By +default, readonly is off. +.TP +.B restrict <oplist> +Specify a whitespace separated list of operations that are restricted. +If defined inside a database specification, restrictions apply only +to that database, otherwise they are global. +Operations can be any of +.BR add , +.BR bind , +.BR compare , +.BR delete , +.BR extended[=<OID>] , +.BR modify , +.BR rename , +.BR search , +or the special pseudo-operations +.B read +and +.BR write , +which respectively summarize read and write operations. +The use of +.I restrict write +is equivalent to +.I readonly on +(see above). +The +.B extended +keyword allows one to indicate the OID of the specific operation +to be restricted. +.TP +.B rootdn <dn> +Specify the distinguished name that is not subject to access control +or administrative limit restrictions for operations on this database. +This DN may or may not be associated with an entry. An empty root +DN (the default) specifies no root access is to be granted. It is +recommended that the rootdn only be specified when needed (such as +when initially populating a database). If the rootdn is within +a namingContext (suffix) of the database, a simple bind password +may also be provided using the +.B rootpw +directive. Many optional features, including syncrepl, require the +rootdn to be defined for the database. +.TP +.B rootpw <password> +Specify a password (or hash of the password) for the rootdn. The +password can only be set if the rootdn is within the namingContext +(suffix) of the database. +This option accepts all RFC 2307 userPassword formats known to +the server (see +.B password\-hash +description) as well as cleartext. +.BR slappasswd (8) +may be used to generate a hash of a password. Cleartext +and \fB{CRYPT}\fP passwords are not recommended. If empty +(the default), authentication of the root DN is by other means +(e.g. SASL). Use of SASL is encouraged. +.TP +.B suffix <dn suffix> +Specify the DN suffix of queries that will be passed to this +backend database. Multiple suffix lines can be given and at least one is +required for each database definition. + +If the suffix of one database is "inside" that of another, the database +with the inner suffix must come first in the configuration file. +You may also want to glue such databases together with the +.B subordinate +keyword. +.TP +.B subordinate [advertise] +Specify that the current backend database is a subordinate of another +backend database. A subordinate database may have only one suffix. This +option may be used to glue multiple databases into a single namingContext. +If the suffix of the current database is within the namingContext of a +superior database, searches against the superior database will be +propagated to the subordinate as well. All of the databases +associated with a single namingContext should have identical rootdns. +Behavior of other LDAP operations is unaffected by this setting. In +particular, it is not possible to use moddn to move an entry from +one subordinate to another subordinate within the namingContext. + +If the optional \fBadvertise\fP flag is supplied, the naming context of +this database is advertised in the root DSE. The default is to hide this +database context, so that only the superior context is visible. + +If the slap tools +.BR slapcat (8), +.BR slapadd (8), +or +.BR slapindex (8) +are used on the superior database, any glued subordinates that support +these tools are opened as well. + +Databases that are glued together should usually be configured with the +same indices (assuming they support indexing), even for attributes that +only exist in some of these databases. In general, all of the glued +databases should be configured as similarly as possible, since the intent +is to provide the appearance of a single directory. + +Note that the \fIsubordinate\fP functionality is implemented internally +by the \fIglue\fP overlay and as such its behavior will interact with other +overlays in use. By default, the glue overlay is automatically configured as +the last overlay on the superior backend. Its position on the backend +can be explicitly configured by setting an \fBoverlay glue\fP directive +at the desired position. This explicit configuration is necessary e.g. +when using the \fIsyncprov\fP overlay, which needs to follow \fIglue\fP +in order to work over all of the glued databases. E.g. +.RS +.nf + database bdb + suffix dc=example,dc=com + ... + overlay glue + overlay syncprov +.fi +.RE +.TP +.B sync_use_subentry +Store the syncrepl contextCSN in a subentry instead of the context entry +of the database. The subentry's RDN will be "cn=ldapsync". By default +the contextCSN is stored in the context entry. +.HP +.hy 0 +.B syncrepl rid=<replica ID> +.B provider=ldap[s]://<hostname>[:port] +.B searchbase=<base DN> +.B [type=refreshOnly|refreshAndPersist] +.B [interval=dd:hh:mm:ss] +.B [retry=[<retry interval> <# of retries>]+] +.B [filter=<filter str>] +.B [scope=sub|one|base|subord] +.B [attrs=<attr list>] +.B [exattrs=<attr list>] +.B [attrsonly] +.B [sizelimit=<limit>] +.B [timelimit=<limit>] +.B [schemachecking=on|off] +.B [network\-timeout=<seconds>] +.B [timeout=<seconds>] +.B [bindmethod=simple|sasl] +.B [binddn=<dn>] +.B [saslmech=<mech>] +.B [authcid=<identity>] +.B [authzid=<identity>] +.B [credentials=<passwd>] +.B [realm=<realm>] +.B [secprops=<properties>] +.B [keepalive=<idle>:<probes>:<interval>] +.B [starttls=yes|critical] +.B [tls_cert=<file>] +.B [tls_key=<file>] +.B [tls_cacert=<file>] +.B [tls_cacertdir=<path>] +.B [tls_reqcert=never|allow|try|demand] +.B [tls_cipher_suite=<ciphers>] +.B [tls_crlcheck=none|peer|all] +.B [tls_protocol_min=<major>[.<minor>]] +.B [suffixmassage=<real DN>] +.B [logbase=<base DN>] +.B [logfilter=<filter str>] +.B [syncdata=default|accesslog|changelog] +.RS +Specify the current database as a replica which is kept up-to-date with the +master content by establishing the current +.BR slapd (8) +as a replication consumer site running a +.B syncrepl +replication engine. +The replica content is kept synchronized to the master content using +the LDAP Content Synchronization protocol. Refer to the +"OpenLDAP Administrator's Guide" for detailed information on +setting up a replicated +.B slapd +directory service using the +.B syncrepl +replication engine. + +.B rid +identifies the current +.B syncrepl +directive within the replication consumer site. +It is a non-negative integer not greater than 999 (limited +to three decimal digits). + +.B provider +specifies the replication provider site containing the master content +as an LDAP URI. If <port> is not given, the standard LDAP port number +(389 or 636) is used. + +The content of the +.B syncrepl +replica is defined using a search +specification as its result set. The consumer +.B slapd +will send search requests to the provider +.B slapd +according to the search specification. The search specification includes +.BR searchbase ", " scope ", " filter ", " attrs ", " attrsonly ", " sizelimit ", " +and +.B timelimit +parameters as in the normal search specification. +The \fBscope\fP defaults to \fBsub\fP, the \fBfilter\fP defaults to +\fB(objectclass=*)\fP, while there is no default \fBsearchbase\fP. The +\fBattrs\fP list defaults to \fB"*,+"\fP to return all user and operational +attributes, and \fBattrsonly\fP is unset by default. +The \fBsizelimit\fP and \fBtimelimit\fP only +accept "unlimited" and positive integers, and both default to "unlimited". +The \fBsizelimit\fP and \fBtimelimit\fP parameters define +a consumer requested limitation on the number of entries that can be returned +by the LDAP Content Synchronization operation; as such, it is intended +to implement partial replication based on the size of the replicated database +and on the time required by the synchronization. +Note, however, that any provider-side limits for the replication identity +will be enforced by the provider regardless of the limits requested +by the LDAP Content Synchronization operation, much like for any other +search operation. +.B exattrs +option may also be used to specify attributes that should be omitted +from incoming entries. +The \fBscope\fP defaults to \fBsub\fP, the \fBfilter\fP defaults to +\fB(objectclass=*)\fP, and there is no default \fBsearchbase\fP. The +\fBattrs\fP list defaults to \fB"*,+"\fP to return all user and operational +attributes, and \fBattrsonly\fP and \fBexattrs\fP are unset by default. +The \fBsizelimit\fP and \fBtimelimit\fP only +accept "unlimited" and positive integers, and both default to "unlimited". +Note, however, that any provider-side limits for the replication identity +will be enforced by the provider regardless of the limits requested +by the LDAP Content Synchronization operation, much like for any other +search operation. + +The LDAP Content Synchronization protocol has two operation types. +In the +.B refreshOnly +operation, the next synchronization search operation +is periodically rescheduled at an interval time (specified by +.B interval +parameter; 1 day by default) +after each synchronization operation finishes. +In the +.B refreshAndPersist +operation, a synchronization search remains persistent in the provider slapd. +Further updates to the master replica will generate +.B searchResultEntry +to the consumer slapd as the search responses to the persistent +synchronization search. If the initial search fails due to an error, the +next synchronization search operation is periodically rescheduled at an +interval time (specified by +.B interval +parameter; 1 day by default) + +If an error occurs during replication, the consumer will attempt to +reconnect according to the +.B retry +parameter which is a list of the <retry interval> and <# of retries> pairs. +For example, retry="60 10 300 3" lets the consumer retry every 60 seconds +for the first 10 times and then retry every 300 seconds for the next 3 +times before stop retrying. The `+' in <# of retries> means indefinite +number of retries until success. +If no +.B retry +was specified, by default syncrepl retries every hour forever. + +The schema checking can be enforced at the LDAP Sync +consumer site by turning on the +.B schemachecking +parameter. The default is \fBoff\fP. +Schema checking \fBon\fP means that replicated entries must have +a structural objectClass, must obey to objectClass requirements +in terms of required/allowed attributes, and that naming attributes +and distinguished values must be present. +As a consequence, schema checking should be \fBoff\fP when partial +replication is used. + +The +.B network\-timeout +parameter sets how long the consumer will wait to establish a +network connection to the provider. Once a connection is +established, the +.B timeout +parameter determines how long the consumer will wait for the initial +Bind request to complete. The defaults for these parameters come +from +.BR ldap.conf (5). + +A +.B bindmethod +of +.B simple +requires the options +.B binddn +and +.B credentials +and should only be used when adequate security services +(e.g. TLS or IPSEC) are in place. +.B REMEMBER: simple bind credentials must be in cleartext! +A +.B bindmethod +of +.B sasl +requires the option +.B saslmech. +Depending on the mechanism, an authentication identity and/or +credentials can be specified using +.B authcid +and +.B credentials. +The +.B authzid +parameter may be used to specify an authorization identity. +Specific security properties (as with the +.B sasl\-secprops +keyword above) for a SASL bind can be set with the +.B secprops +option. A non default SASL realm can be set with the +.B realm +option. +The identity used for synchronization by the consumer should be allowed +to receive an unlimited number of entries in response to a search request. +The provider, other than allow authentication of the syncrepl identity, +should grant that identity appropriate access privileges to the data +that is being replicated (\fBaccess\fP directive), and appropriate time +and size limits. +This can be accomplished by either allowing unlimited \fBsizelimit\fP +and \fBtimelimit\fP, or by setting an appropriate \fBlimits\fP statement +in the consumer's configuration (see \fBsizelimit\fP and \fBlimits\fP +for details). + +The +.B keepalive +parameter sets the values of \fIidle\fP, \fIprobes\fP, and \fIinterval\fP +used to check whether a socket is alive; +.I idle +is the number of seconds a connection needs to remain idle before TCP +starts sending keepalive probes; +.I probes +is the maximum number of keepalive probes TCP should send before dropping +the connection; +.I interval +is interval in seconds between individual keepalive probes. +Only some systems support the customization of these values; +the +.B keepalive +parameter is ignored otherwise, and system-wide settings are used. + +The +.B starttls +parameter specifies use of the StartTLS extended operation +to establish a TLS session before Binding to the provider. If the +.B critical +argument is supplied, the session will be aborted if the StartTLS request +fails. Otherwise the syncrepl session continues without TLS. The +tls_reqcert setting defaults to "demand" and the other TLS settings +default to the same as the main slapd TLS settings. + +The +.B suffixmassage +parameter allows the consumer to pull entries from a remote directory +whose DN suffix differs from the local directory. The portion of the +remote entries' DNs that matches the \fIsearchbase\fP will be replaced +with the suffixmassage DN. + +Rather than replicating whole entries, the consumer can query logs of +data modifications. This mode of operation is referred to as \fIdelta +syncrepl\fP. In addition to the above parameters, the +.B logbase +and +.B logfilter +parameters must be set appropriately for the log that will be used. The +.B syncdata +parameter must be set to either "accesslog" if the log conforms to the +.BR slapo\-accesslog (5) +log format, or "changelog" if the log conforms +to the obsolete \fIchangelog\fP format. If the +.B syncdata +parameter is omitted or set to "default" then the log parameters are +ignored. +.RE +.TP +.B updatedn <dn> +This option is only applicable in a slave +database. +It specifies the DN permitted to update (subject to access controls) +the replica. It is only needed in certain push-mode +replication scenarios. Generally, this DN +.I should not +be the same as the +.B rootdn +used at the master. +.TP +.B updateref <url> +Specify the referral to pass back when +.BR slapd (8) +is asked to modify a replicated local database. +If specified multiple times, each url is provided. + +.SH DATABASE-SPECIFIC OPTIONS +Each database may allow specific configuration options; they are +documented separately in the backends' manual pages. See the +.BR slapd.backends (5) +manual page for an overview of available backends. +.SH EXAMPLES +.LP +Here is a short example of a configuration file: +.LP +.RS +.nf +include SYSCONFDIR/schema/core.schema +pidfile LOCALSTATEDIR/run/slapd.pid + +# Subtypes of "name" (e.g. "cn" and "ou") with the +# option ";x\-hidden" can be searched for/compared, +# but are not shown. See \fBslapd.access\fP(5). +attributeoptions x\-hidden lang\- +access to attrs=name;x\-hidden by * =cs + +# Protect passwords. See \fBslapd.access\fP(5). +access to attrs=userPassword by * auth +# Read access to other attributes and entries. +access to * by * read + +database bdb +suffix "dc=our\-domain,dc=com" +# The database directory MUST exist prior to +# running slapd AND should only be accessible +# by the slapd/tools. Mode 0700 recommended. +directory LOCALSTATEDIR/openldap\-data +# Indices to maintain +index objectClass eq +index cn,sn,mail pres,eq,approx,sub + +# We serve small clients that do not handle referrals, +# so handle remote lookups on their behalf. +database ldap +suffix "" +uri ldap://ldap.some\-server.com/ +lastmod off +.fi +.RE +.LP +"OpenLDAP Administrator's Guide" contains a longer annotated +example of a configuration file. +The original ETCDIR/slapd.conf is another example. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR ldap (3), +.BR gnutls\-cli (1), +.BR slapd\-config (5), +.BR slapd.access (5), +.BR slapd.backends (5), +.BR slapd.overlays (5), +.BR slapd.plugin (5), +.BR slapd (8), +.BR slapacl (8), +.BR slapadd (8), +.BR slapauth (8), +.BR slapcat (8), +.BR slapdn (8), +.BR slapindex (8), +.BR slappasswd (8), +.BR slaptest (8). +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man5/slapd.overlays.5 b/doc/man/man5/slapd.overlays.5 new file mode 100644 index 0000000..ea751d1 --- /dev/null +++ b/doc/man/man5/slapd.overlays.5 @@ -0,0 +1,174 @@ +.TH SLAPD.OVERLAYS 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2006-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd.overlays \- overlays for slapd, the stand-alone LDAP daemon +.SH DESCRIPTION +The +.BR slapd (8) +daemon can use a variety of different overlays to alter or extend +the normal behavior of a database backend. +Overlays may be compiled statically into slapd, or when module support +is enabled, they may be dynamically loaded. Most of the overlays +are only allowed to be configured on individual databases, but some +may also be configured globally. + +Configuration options for each overlay are documented separately in the +corresponding +.BR slapo\-<overlay> (5) +manual pages. +.TP +.B accesslog +Access Logging. +This overlay can record accesses to a given backend database on another +database. +.TP +.B auditlog +Audit Logging. +This overlay records changes on a given backend database to an LDIF log +file. +By default it is not built. +.TP +.B chain +Chaining. +This overlay allows automatic referral chasing when a referral would +have been returned, either when configured by the server or when +requested by the client. +.TP +.B collect +Collective Attributes. +This overlay implements RFC 3671 collective attributes; these +attributes share common values over all the members of the collection +as inherited from an ancestor entry. +.TP +.B constraint +Constraint. +This overlay enforces a regular expression constraint on all values +of specified attributes. It is used to enforce a more rigorous +syntax when the underlying attribute syntax is too general. +.TP +.B dds +Dynamic Directory Services. +This overlay supports dynamic objects, which have a limited life after +which they expire and are automatically deleted. +.TP +.B dyngroup +Dynamic Group. +This is a demo overlay which extends the Compare operation to detect +members of a dynamic group. +It has no effect on any other operations. +.TP +.B dynlist +Dynamic List. +This overlay allows expansion of dynamic groups and more. +.TP +.B memberof +MemberOf. +This overlay maintains automatic reverse group membership values, +typically stored in an attribute called memberOf. +.TP +.B pbind +Proxybind. +This overlay forwards simple bind requests on a local database to a +remote LDAP server. +.TP +.B pcache +Proxycache. +This overlay allows caching of LDAP search requests in a local database. +It is most often used with the +.BR slapd\-ldap (5) +or +.BR slapd\-meta (5) +backends. +.TP +.B ppolicy +Password Policy. +This overlay provides a variety of password control mechanisms, +e.g. password aging, password reuse and duplication control, mandatory +password resets, etc. +.TP +.B refint +Referential Integrity. +This overlay can be used with a backend database such as +.BR slapd\-bdb (5) +to maintain the cohesiveness of a schema which utilizes reference +attributes. +.TP +.B retcode +Return Code. +This overlay is useful to test the behavior of clients when +server-generated erroneous and/or unusual responses occur. +.TP +.B rwm +Rewrite/remap. +This overlay is experimental. +It performs basic DN/data rewrite and +objectClass/attributeType mapping. +.TP +.B sssvlv +Server Side Sorting and Virtual List Views. +This overlay implements the RFC2891 server-side sorting control and +virtual list view controls, and replaces the RFC2696 paged-results +implementation to ensure it works with the sorting technique. +.TP +.B syncprov +Syncrepl Provider. +This overlay implements the provider-side support for +.B syncrepl +replication, including persistent search functionality. +.TP +.B translucent +Translucent Proxy. +This overlay can be used with a backend database such as +.BR slapd\-bdb (5) +to create a "translucent proxy". +Content of entries retrieved from a remote LDAP server can be partially +overridden by the database. +.TP +.B unique +Attribute Uniqueness. +This overlay can be used with a backend database such as +.BR slapd\-bdb (5) +to enforce the uniqueness of some or all attributes within a subtree. +.TP +.B valsort +Value Sorting. +This overlay can be used to enforce a specific order for the values +of an attribute when it is returned in a search. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.TP +ETCDIR/slapd.d +default slapd configuration directory +.SH SEE ALSO +.BR ldap (3), +.BR slapo\-accesslog (5), +.BR slapo\-auditlog (5), +.BR slapo\-chain (5), +.BR slapo\-collect (5), +.BR slapo\-constraint (5), +.BR slapo\-dds (5), +.BR slapo\-dyngroup (5), +.BR slapo\-dynlist (5), +.BR slapo\-memberof (5), +.BR slapo\-pbind (5), +.BR slapo\-pcache (5), +.BR slapo\-ppolicy (5), +.BR slapo\-refint (5), +.BR slapo\-retcode (5), +.BR slapo\-rwm (5), +.BR slapo\-sssvlv (5), +.BR slapo\-syncprov (5), +.BR slapo\-translucent (5), +.BR slapo\-unique (5). +.BR slapo\-valsort (5). +.BR slapd\-config (5), +.BR slapd.conf (5), +.BR slapd.backends (5), +.BR slapd (8). +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man5/slapd.plugin.5 b/doc/man/man5/slapd.plugin.5 new file mode 100644 index 0000000..5a8a285 --- /dev/null +++ b/doc/man/man5/slapd.plugin.5 @@ -0,0 +1,123 @@ +.TH SLAPD.PLUGIN 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2002-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.SH NAME +slapd.plugin \- plugin configuration for slapd, the stand-alone LDAP daemon +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.BR slapd.conf (5) +file contains configuration information for the +.BR slapd (8) +daemon. This configuration file is also used by the SLAPD tools +.BR slapadd (8), +.BR slapcat (8), +and +.BR slapindex (8). +.LP +The +.B slapd.conf +file consists of a series of global configuration options that apply to +.B slapd +as a whole (including all backends), followed by zero or more database +backend definitions that contain information specific to a backend +instance. +.LP +The general format of +.B slapd.conf +is as follows: +.LP +.nf + # comment - these options apply to every database + <global configuration options> + # first database definition & configuration options + database <backend 1 type> + <configuration options specific to backend 1> + # subsequent database definitions & configuration options + ... +.fi +.LP +If slapd is compiled with \fI\-\-enable\-slapi\fP, support for plugins +according to \fINetscape's Directory Server Plug-Ins\fP. +Version 4 of the API is currently implemented, with some extensions +from version 5. +.LP +Both global and database specific data may contain plugin information. +Plugins associated with a specific database are called before global +plugins. +This manpage details the +.BR slapd (8) +configuration statements that affect the loading of SLAPI \fIplugins\fP. +.LP +Arguments that should be replaced by actual text are shown in brackets <>. +.LP +The structure of the plugin directives is +.TP +.B plugin "<type> <lib_path> <init_function> [<arguments>]" +Load a plugin of the specified type for the current database. +.LP +The +.BR <type> +can be one of +.BR preoperation , +that is executed before processing the operation for the specified +database, +.BR postoperation , +that is executed after the operation for the specified database +has been processed, +.BR extendedop , +that is used when executing an extended operation, or +.BR object . +The latter is used for miscellaneous types such as ACL, computed +attribute and search filter rewriter plugins. +.LP +The +.BR <libpath> +argument specifies the path to the plugin loadable object; if a relative +path is given, the object is looked for according to the underlying +dynamic loading package (libtool's ltdl is used). +.LP +The +.BR <init_function> +argument specifies what symbol must be called when the plugin is first +loaded. +This function should register the functions provided by the plugin +for the desired operations. It should be noted that it is this +init function, not the plugin type specified as the first argument, +that determines when and for what operations the plugin will be invoked. +The optional +.BR <arguments> +list is passed to the init function. +.TP +.B pluginlog <file> +Specify an alternative path for the plugin log file (default is +LOCALSTATEDIR/errors). +.TP +.B modulepath <pathspec> +This statement sets the module load path for dynamically loadable +backends, as described in +.BR slapd.conf (5); +however, since both the dynamically loadable backends +and the SLAPI plugins use the same underlying library (libtool's ltdl) +its value also affects the plugin search path. +In general the search path is made of colon-separated paths; usually +the user-defined path is searched first; then the value of the +\fILTDL_LIBRARY_PATH\fP environment variable, if defined, is used; +finally, the system-specific dynamic load path is attempted (e.g. on +Linux the value of the environment variable \fILD_LIBRARY_PATH\fP). +Please carefully read the documentation of ltdl because its behavior +is very platform dependent. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.TP +LOCALSTATEDIR/errors +default plugin log file +.SH SEE ALSO +.BR slapd (8), +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man5/slapo-accesslog.5 b/doc/man/man5/slapo-accesslog.5 new file mode 100644 index 0000000..a6efcda --- /dev/null +++ b/doc/man/man5/slapo-accesslog.5 @@ -0,0 +1,491 @@ +.TH SLAPO-ACCESSLOG 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2005-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-accesslog \- Access Logging overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The Access Logging overlay can be used to record all accesses to a given +backend database on another database. This allows all of the activity on +a given database to be reviewed using arbitrary LDAP queries, instead of +just logging to local flat text files. Configuration options are available +for selecting a subset of operation types to log, and to automatically +prune older log records from the logging database. Log records are stored +with audit schema (see below) to assure their readability whether viewed +as LDIF or in raw form. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the Access Logging overlay. +They should appear after the +.B overlay +directive. +.TP +.B logdb <suffix> +Specify the suffix of a database to be used for storing the log records. +The specified database must be defined elsewhere in the configuration. +The access controls +on the log database should prevent general access. The suffix entry +of the log database will be created automatically by this overlay. The log +entries will be generated as the immediate children of the suffix entry. +.TP +.B logops <operations> +Specify which types of operations to log. The valid operation types are +abandon, add, bind, compare, delete, extended, modify, modrdn, search, +and unbind. Aliases for common sets of operations are also available: +.RS +.TP +.B writes +add, delete, modify, modrdn +.TP +.B reads +compare, search +.TP +.B session +abandon, bind, unbind +.TP +.B all +all operations +.RE +.TP +.B logbase <operations> <baseDN> +Specify a set of operations that will only be logged if they occur under +a specific subtree of the database. The operation types are as above for +the +.B logops +setting, and delimited by a '|' character. +.TP +.B logold <filter> +Specify a filter for matching against Deleted and Modified entries. If +the entry matches the filter, the old contents of the entry will be +logged along with the current request. +.TP +.B logoldattr <attr> ... +Specify a list of attributes whose old contents are always logged in +Modify and ModRDN requests. Usually only the contents of attributes that were +actually modified will be logged; by default no old attributes are logged +for ModRDN requests. +.TP +.B logpurge <age> <interval> +Specify the maximum age for log entries to be retained in the database, +and how often to scan the database for old entries. Both the +.B age +and +.B interval +are specified as a time span in days, hours, minutes, and seconds. The +time format is [ddd+]hh:mm[:ss] i.e., the days and seconds components are +optional but hours and minutes are required. Except for days, which can +be up to 5 digits, each numeric field must be exactly two digits. For example +.RS +.RS +.PD 0 +.TP +logpurge 2+00:00 1+00:00 +.RE +.PD +would specify that the log database should be scanned every day for old +entries, and entries older than two days should be deleted. When using a +log database that supports ordered indexing on generalizedTime attributes, +specifying an eq index on the +.B reqStart +attribute will greatly benefit the performance of the purge operation. +.RE +.TP +.B logsuccess TRUE | FALSE +If set to TRUE then log records will only be generated for successful +requests, i.e., requests that produce a result code of 0 (LDAP_SUCCESS). +If FALSE, log records are generated for all requests whether they +succeed or not. The default is FALSE. + +.SH EXAMPLES +.LP +.nf + database bdb + suffix dc=example,dc=com + \... + overlay accesslog + logdb cn=log + logops writes reads + logbase search|compare ou=testing,dc=example,dc=com + logold (objectclass=person) + + database bdb + suffix cn=log + \... + index reqStart eq + access to * + by dn.base="cn=admin,dc=example,dc=com" read +.fi + +.SH SCHEMA +The +.B accesslog +overlay utilizes the "audit" schema described herein. +This schema is specifically designed for +.B accesslog +auditing and is not intended to be used otherwise. It is also +noted that the schema described here is +.I a work in +.IR progress , +and hence subject to change without notice. +The schema is loaded automatically by the overlay. + +The schema includes a number of object classes and associated +attribute types as described below. + +There is +a basic +.B auditObject +class from which two additional classes, +.B auditReadObject +and +.B auditWriteObject +are derived. Object classes for each type of LDAP operation are further +derived from these classes. This object class hierarchy is designed to +allow flexible yet efficient searches of the log based on either a specific +operation type's class, or on more general classifications. The definition +of the +.B auditObject +class is as follows: +.LP +.RS 4 +( 1.3.6.1.4.1.4203.666.11.5.2.1 + NAME 'auditObject' + DESC 'OpenLDAP request auditing' + SUP top STRUCTURAL + MUST ( reqStart $ reqType $ reqSession ) + MAY ( reqDN $ reqAuthzID $ reqControls $ reqRespControls $ + reqEnd $ reqResult $ reqMessage $ reqReferral ) ) +.RE +.P +Note that all of the OIDs used in the logging schema currently reside +under the OpenLDAP Experimental branch. It is anticipated that they +will migrate to a Standard branch in the future. + +An overview of the attributes follows: +.B reqStart +and +.B reqEnd +provide the start and end time of the operation, respectively. They use +generalizedTime syntax. The +.B reqStart +attribute is also used as the RDN for each log entry. + +The +.B reqType +attribute is a simple string containing the type of operation +being logged, e.g. +.BR add , +.BR delete , +.BR search , +etc. For extended operations, the type also includes the OID of the +extended operation, e.g. +.B extended(1.1.1.1) + +The +.B reqSession +attribute is an implementation-specific identifier that is common to +all the operations associated with the same LDAP session. Currently this +is slapd's internal connection ID, stored in decimal. + +The +.B reqDN +attribute is the distinguishedName of the target of the operation. E.g., for +a Bind request, this is the Bind DN. For an Add request, this is the DN +of the entry being added. For a Search request, this is the base DN of +the search. + +The +.B reqAuthzID +attribute is the distinguishedName of the user that performed the operation. +This will usually be the same name as was established at the start of a +session by a Bind request (if any) but may be altered in various +circumstances. + +The +.B reqControls +and +.B reqRespControls +attributes carry any controls sent by the client on the request and returned +by the server in the response, respectively. The attribute values are just +uninterpreted octet strings. + +The +.B reqResult +attribute is the numeric LDAP result code of the operation, indicating +either success or a particular LDAP error code. An error code may be +accompanied by a text error message which will be recorded in the +.B reqMessage +attribute. + +The +.B reqReferral +attribute carries any referrals that were returned with the result of the +request. + +Operation-specific classes are defined with additional attributes to carry +all of the relevant parameters associated with the operation: + +.LP +.RS 4 +( 1.3.6.1.4.1.4203.666.11.5.2.4 + NAME 'auditAbandon' + DESC 'Abandon operation' + SUP auditObject STRUCTURAL + MUST reqId ) +.RE +.P +For the +.B Abandon +operation the +.B reqId +attribute contains the message ID of the request that was abandoned. + +.LP +.RS 4 +( 1.3.6.1.4.1.4203.666.11.5.2.5 + NAME 'auditAdd' + DESC 'Add operation' + SUP auditWriteObject STRUCTURAL + MUST reqMod ) +.RE +.P +The +.B Add +class inherits from the +.B auditWriteObject +class. The Add and Modify classes are very similar. The +.B reqMod +attribute carries all of the attributes of the original entry being added. +(Or in the case of a Modify operation, all of the modifications being +performed.) The values are formatted as +.RS +.PD 0 +.TP +attribute:<+|\-|=|#> [ value] +.RE +.RE +.PD +Where '+' indicates an Add of a value, '\-' for Delete, '=' for Replace, +and '#' for Increment. In an Add operation, all of the reqMod values will +have the '+' designator. +.P +.LP +.RS 4 +( 1.3.6.1.4.1.4203.666.11.5.2.6 + NAME 'auditBind' + DESC 'Bind operation' + SUP auditObject STRUCTURAL + MUST ( reqVersion $ reqMethod ) ) +.RE +.P +The +.B Bind +class includes the +.B reqVersion +attribute which contains the LDAP protocol version specified in the Bind +as well as the +.B reqMethod +attribute which contains the Bind Method used in the Bind. This will be +the string +.B SIMPLE +for LDAP Simple Binds or +.B SASL(<mech>) +for SASL Binds. +Note that unless configured as a global overlay, only Simple Binds using +DNs that reside in the current database will be logged. + +.LP +.RS 4 +( 1.3.6.1.4.1.4203.666.11.5.2.7 + NAME 'auditCompare' + DESC 'Compare operation' + SUP auditObject STRUCTURAL + MUST reqAssertion ) +.RE +.P +For the +.B Compare +operation the +.B reqAssertion +attribute carries the Attribute Value Assertion used in the compare request. + +.LP +.RS 4 +( 1.3.6.1.4.1.4203.666.11.5.2.8 + NAME 'auditDelete' + DESC 'Delete operation' + SUP auditWriteObject STRUCTURAL + MAY reqOld ) +.RE +.P +The +.B Delete +operation needs no further parameters. However, the +.B reqOld +attribute may optionally be used to record the contents of the entry prior +to its deletion. The values are formatted as +.RS +.PD 0 +.TP +attribute: value +.RE +.PD +The +.B reqOld +attribute is only populated if the entry being deleted matches the +configured +.B logold +filter. + +.LP +.RS 4 +( 1.3.6.1.4.1.4203.666.11.5.2.9 + NAME 'auditModify' + DESC 'Modify operation' + SUP auditWriteObject STRUCTURAL + MAY reqOld MUST reqMod ) +.RE +.P +The +.B Modify +operation contains a description of modifications in the +.B reqMod +attribute, which was already described above in the Add operation. It may +optionally contain the previous contents of any modified attributes in the +.B reqOld +attribute, using the same format as described above for the Delete operation. +The +.B reqOld +attribute is only populated if the entry being modified matches the +configured +.B logold +filter. + +.LP +.RS 4 +( 1.3.6.1.4.1.4203.666.11.5.2.10 + NAME 'auditModRDN' + DESC 'ModRDN operation' + SUP auditWriteObject STRUCTURAL + MUST ( reqNewRDN $ reqDeleteOldRDN ) + MAY ( reqNewSuperior $ reqOld ) ) +.RE +.P +The +.B ModRDN +class uses the +.B reqNewRDN +attribute to carry the new RDN of the request. +The +.B reqDeleteOldRDN +attribute is a Boolean value showing +.B TRUE +if the old RDN was deleted from the entry, or +.B FALSE +if the old RDN was preserved. +The +.B reqNewSuperior +attribute carries the DN of the new parent entry if the request specified +the new parent. +The +.B reqOld +attribute is only populated if the entry being modified matches the +configured +.B logold +filter and contains attributes in the +.B logoldattr +list. + +.LP +.RS 4 +( 1.3.6.1.4.1.4203.666.11.5.2.11 + NAME 'auditSearch' + DESC 'Search operation' + SUP auditReadObject STRUCTURAL + MUST ( reqScope $ reqDerefAliases $ reqAttrsOnly ) + MAY ( reqFilter $ reqAttr $ reqEntries $ reqSizeLimit $ + reqTimeLimit ) ) +.RE +.P +For the +.B Search +class the +.B reqScope +attribute contains the scope of the original search request, using the +values specified for the LDAP URL format. I.e. +.BR base , +.BR one , +.BR sub , +or +.BR subord . +The +.B reqDerefAliases +attribute is one of +.BR never , +.BR finding , +.BR searching , +or +.BR always , +denoting how aliases will be processed during the search. +The +.B reqAttrsOnly +attribute is a Boolean value showing +.B TRUE +if only attribute names were requested, or +.B FALSE +if attributes and their values were requested. +The +.B reqFilter +attribute carries the filter used in the search request. +The +.B reqAttr +attribute lists the requested attributes if specific attributes were +requested. +The +.B reqEntries +attribute is the integer count of how many entries were returned by +this search request. +The +.B reqSizeLimit +and +.B reqTimeLimit +attributes indicate what limits were requested on the search operation. + +.LP +.RS 4 +( 1.3.6.1.4.1.4203.666.11.5.2.12 + NAME 'auditExtended' + DESC 'Extended operation' + SUP auditObject STRUCTURAL + MAY reqData ) +.RE +.P +The +.B Extended +class represents an LDAP Extended Operation. As noted above, the actual OID of +the operation is included in the +.B reqType +attribute of the parent class. If any optional data was provided with the +request, it will be contained in the +.B reqData +attribute as an uninterpreted octet string. + +.SH NOTES +The Access Log implemented by this overlay may be used for a variety of +other tasks, e.g. as a ChangeLog for a replication mechanism, as well +as for security/audit logging purposes. + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5). + +.SH ACKNOWLEDGEMENTS +.P +This module was written in 2005 by Howard Chu of Symas Corporation. diff --git a/doc/man/man5/slapo-auditlog.5 b/doc/man/man5/slapo-auditlog.5 new file mode 100644 index 0000000..adcad66 --- /dev/null +++ b/doc/man/man5/slapo-auditlog.5 @@ -0,0 +1,60 @@ +.TH SLAPO-AUDITLOG 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2005-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-auditlog \- Audit Logging overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.TP +ETCDIR/slapd.d +.SH DESCRIPTION +The Audit Logging overlay can be used to record all changes on a given +backend database to a specified log file. Changes are logged as standard +LDIF, with an additional comment header giving the timestamp of the change +and the identity of the user making the change. +.LP +For Add and Modify operations the identity comes from the modifiersName +associated with the operation. This is usually the same as the requestor's +identity, but may be set by other overlays to reflect other values. +.SH CONFIGURATION +This +.B slapd.conf +option applies to the Audit Logging overlay. +It should appear after the +.B overlay +directive. +.TP +.B auditlog <filename> +Specify the fully qualified path for the log file. +.TP +.B olcAuditlogFile <filename> +For use with +.B cn=config +.SH EXAMPLE +The following LDIF could be used to add this overlay to +.B cn=config +(adjust to suit) +.LP +.RS +.nf +dn: olcOverlay=auditlog,olcDatabase={1}mdb,cn=config +changetype: add +objectClass: olcOverlayConfig +objectClass: olcAuditLogConfig +olcOverlay: auditlog +olcAuditlogFile: /tmp/auditlog.ldif +.fi +.RE +.LP +.LP +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.TP +ETCDIR/slapd.d +default slapd configuration directory +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config(5). diff --git a/doc/man/man5/slapo-chain.5 b/doc/man/man5/slapo-chain.5 new file mode 100644 index 0000000..10d71f0 --- /dev/null +++ b/doc/man/man5/slapo-chain.5 @@ -0,0 +1,152 @@ +.TH SLAPO-CHAIN 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation, All Rights Reserved. +.\" Copying restrictions apply. See the COPYRIGHT file. +.\" $OpenLDAP$ +.SH NAME +slapo\-chain \- chain overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.B chain +overlay to +.BR slapd (8) +allows automatic referral chasing. +Any time a referral is returned (except for bind operations), +it is chased by using an instance of the ldap backend. +If operations are performed with an identity (i.e. after a bind), +that identity can be asserted while chasing the referrals +by means of the \fIidentity assertion\fP feature of back-ldap +(see +.BR slapd\-ldap (5) +for details), which is essentially based on the +.B proxied authorization +control [RFC 4370]. +Referral chasing can be controlled by the client by issuing the +\fBchaining\fP control +(see \fIdraft-sermersheim-ldap-chaining\fP for details.) + +.LP +The config directives that are specific to the +.B chain +overlay are prefixed by +.BR chain\- , +to avoid potential conflicts with directives specific to the underlying +database or to other stacked overlays. + +.LP +There are very few chain overlay specific directives; however, directives +related to the instances of the \fIldap\fP backend that may be implicitly +instantiated by the overlay may assume a special meaning when used +in conjunction with this overlay. They are described in +.BR slapd\-ldap (5), +and they also need to be prefixed by +.BR chain\- . + +Note: this overlay is built into the \fIldap\fP backend; it is not +a separate module. + +.TP +.B overlay chain +This directive adds the chain overlay to the current backend. +The chain overlay may be used with any backend, but it is mainly +intended for use with local storage backends that may return referrals. +It is useless in conjunction with the \fIslapd\-ldap\fP and \fIslapd\-meta\fP +backends because they already exploit the libldap specific referral chase +feature. +[Note: this may change in the future, as the \fBldap\fP(5) and +\fBmeta\fP(5) backends might no longer chase referrals on their own.] +.TP +.B chain\-cache\-uri {FALSE|true} +This directive instructs the \fIchain\fP overlay to cache +connections to URIs parsed out of referrals that are not predefined, +to be reused for later chaining. +These URIs inherit the properties configured for the underlying +\fBslapd\-ldap\fP(5) before any occurrence of the \fBchain\-uri\fP +directive; basically, they are chained anonymously. +.TP +.B chain\-chaining [resolve=<r>] [continuation=<c>] [critical] +This directive enables the \fIchaining\fP control +(see \fIdraft-sermersheim-ldap-chaining\fP for details) +with the desired resolve and continuation behaviors and criticality. +The \fBresolve\fP parameter refers to the behavior while discovering +a resource, namely when accessing the object indicated by the request DN; +the \fBcontinuation\fP parameter refers to the behavior while handling +intermediate responses, which is mostly significant for the search +operation, but may affect extended operations that return intermediate +responses. +The values \fBr\fP and \fBc\fP can be any of +.BR chainingPreferred , +.BR chainingRequired , +.BR referralsPreferred , +.BR referralsRequired . +If the \fBcritical\fP flag affects the control criticality if provided. +[This control is experimental and its support may change in the future.] +.TP +.B chain\-max\-depth <n> +In case a referral is returned during referral chasing, further chasing +occurs at most \fB<n>\fP levels deep. Set to \fB1\fP (the default) +to disable further referral chasing. +.TP +.B chain\-return\-error {FALSE|true} +In case referral chasing fails, the real error is returned instead +of the original referral. In case multiple referral URIs are present, +only the first error is returned. This behavior may not be always +appropriate nor desirable, since failures in referral chasing might be +better resolved by the client (e.g. when caused by distributed +authentication issues). +.TP +.B chain\-uri <ldapuri> +This directive instantiates a new underlying \fIldap\fP database +and instructs it about which URI to contact to chase referrals. +As opposed to what stated in \fBslapd\-ldap\fP(5), only one URI +can appear after this directive; all subsequent \fBslapd\-ldap\fP(5) +directives prefixed by \fBchain\-\fP refer to this specific instance +of a remote server. +.LP + +Directives for configuring the underlying ldap database may also +be required, as shown in this example: +.LP +.RS +.nf +overlay chain +chain\-rebind\-as\-user FALSE + +chain\-uri "ldap://ldap1.example.com" +chain\-rebind\-as\-user TRUE +chain\-idassert\-bind bindmethod="simple" + binddn="cn=Auth,dc=example,dc=com" + credentials="secret" + mode="self" + +chain\-uri "ldap://ldap2.example.com" +chain\-idassert\-bind bindmethod="simple" + binddn="cn=Auth,dc=example,dc=com" + credentials="secret" + mode="none" + +.fi +.RE +.LP +Any valid directives for the ldap database may be used; see +.BR slapd\-ldap (5) +for details. +Multiple occurrences of the \fBchain\-uri\fP directive may appear, +to define multiple "trusted" URIs where operations with +\fIidentity assertion\fP are chained. +All URIs not listed in the configuration are chained anonymously. +All \fBslapd\-ldap\fP(5) directives appearing before the first +occurrence of \fBchain\-uri\fP are inherited by all URIs, +unless specifically overridden inside each URI configuration. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd\-ldap (5), +.BR slapd (8). +.SH AUTHOR +Originally implemented by Howard Chu; extended by Pierangelo Masarati. diff --git a/doc/man/man5/slapo-collect.5 b/doc/man/man5/slapo-collect.5 new file mode 100644 index 0000000..c0e644f --- /dev/null +++ b/doc/man/man5/slapo-collect.5 @@ -0,0 +1,52 @@ +.TH SLAPO-COLLECT 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2003-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-collect \- Collective attributes overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The collect overlay is used to provide a relatively coarse +implementation of RFC 3671 collective attributes. +In X.500, a collective attribute is "a user attribute whose +values are the same for each member of an entry collection". + +Collective attributes are added to entries returned by a search operation +when the entry is within the scope of the related ancestor. +Collective attributes can only be modified when the modification affects +the related ancestor. + +.SH CONFIGURATION +This +.B slapd.conf +option applies to the collect overlay. +It should appear after the +.B overlay +directive. +.TP +.B collectinfo <DN> <attrlist> +Specify the +.B DN +of the ancestor entry and the set of related collective attributes, where +.B attrlist +is a comma-separated list of attributes. +The +.B DN +should be within the naming context of the database. + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +The +.BR slapo\-collect (5) +overlay supports dynamic configuration via +.BR back-config . +.SH ACKNOWLEDGEMENTS +This module was written in 2003 by Howard Chu. +This man page was written in 2008 by Pierangelo Masarati. +.so ../Project diff --git a/doc/man/man5/slapo-constraint.5 b/doc/man/man5/slapo-constraint.5 new file mode 100644 index 0000000..8ce4a10 --- /dev/null +++ b/doc/man/man5/slapo-constraint.5 @@ -0,0 +1,149 @@ +.TH SLAPO-CONSTRAINT 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2005-2006 Hewlett-Packard Company +.\" Copyright 2006-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-constraint \- Attribute Constraint Overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The constraint overlay is used to ensure that attribute values match +some constraints beyond basic LDAP syntax. Attributes can +have multiple constraints placed upon them, and all must be satisfied +when modifying an attribute value under constraint. +.LP +This overlay is intended to be used to force syntactic regularity upon +certain string represented data which have well known canonical forms, +like telephone numbers, post codes, FQDNs, etc. +.LP +It constrains only LDAP \fIadd\fP, \fImodify\fP and \fIrename\fP commands +and only seeks to control the \fIadd\fP and \fIreplace\fP values +of \fImodify\fP and \fIrename\fP requests. +.LP +No constraints are applied for operations performed with the +.I relax +control set. +.SH CONFIGURATION +This +.B slapd.conf +option applies to the constraint overlay. +It should appear after the +.B overlay +directive. +.TP +.B constraint_attribute <attribute_name>[,...] <type> <value> [<extra> [...]] +Specifies the constraint which should apply to the comma-separated +attribute list named as the first parameter. +Five types of constraint are currently supported - +.BR regex , +.BR size , +.BR count , +.BR uri , +and +.BR set . + +The parameter following the +.B regex +type is a Unix style regular expression (See +.BR regex (7) +). The parameter following the +.B uri +type is an LDAP URI. The URI will be evaluated using an internal search. +It must not include a hostname, and it must include a list of attributes +to evaluate. + +The parameter following the +.B set +type is a string that is interpreted according to the syntax in use +for ACL sets. This allows one to construct constraints based on the contents +of the entry. + +The +.B size +type can be used to enforce a limit on an attribute length, and the +.B count +type limits the number of values of an attribute. + +Extra parameters can occur in any order after those described above. +.RS +.TP +.B <extra> : restrict=<uri> +.RE + +.RS +This extra parameter allows one to restrict the application of the corresponding +constraint only to entries that match the +.IR base , +.I scope +and +.I filter +portions of the LDAP URI. +The +.IR base , +if present, must be within the naming context of the database. +The +.I scope +is only used when the +.I base +is present; it defaults to +.BR base . +The other parameters of the URI are not allowed. +.RE + +.LP +Any attempt to add or modify an attribute named as part of the +constraint overlay specification which does not fit the +constraint listed will fail with a +LDAP_CONSTRAINT_VIOLATION error. +.SH EXAMPLES +.LP +.RS +.nf +overlay constraint +constraint_attribute jpegPhoto size 131072 +constraint_attribute userPassword count 3 +constraint_attribute mail regex ^[[:alnum:]]+@mydomain.com$ +constraint_attribute title uri + ldap:///dc=catalog,dc=example,dc=com?title?sub?(objectClass=titleCatalog) +constraint_attribute cn,sn,givenName set + "(this/givenName + [ ] + this/sn) & this/cn" + restrict="ldap:///ou=People,dc=example,dc=com??sub?(objectClass=inetOrgPerson)" +.fi + +.RE +A specification like the above would reject any +.B mail +attribute which did not look like +.BR "<alpha-numeric string>@mydomain.com" . +It would also reject any +.B title +attribute whose values were not listed in the +.B title +attribute of any +.B titleCatalog +entries in the given scope. (Note that the +"dc=catalog,dc=example,dc=com" subtree ought to reside +in a separate database, otherwise the initial set of +titleCatalog entries could not be populated while the +constraint is in effect.) +Finally, it requires the values of the attribute +.B cn +to be constructed by pairing values of the attributes +.B sn +and +.BR givenName , +separated by a space, but only for entries derived from the objectClass +.BR inetOrgPerson . +.RE +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.SH ACKNOWLEDGEMENTS +This module was written in 2005 by Neil Dunbar of Hewlett-Packard and subsequently +extended by Howard Chu and Emmanuel Dreyfus. +.so ../Project diff --git a/doc/man/man5/slapo-dds.5 b/doc/man/man5/slapo-dds.5 new file mode 100644 index 0000000..7c29db2 --- /dev/null +++ b/doc/man/man5/slapo-dds.5 @@ -0,0 +1,271 @@ +.TH SLAPO-DDS 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2005-2018 The OpenLDAP Foundation, All Rights Reserved. +.\" Copying restrictions apply. See the COPYRIGHT file. +.\" $OpenLDAP$ +.SH NAME +slapo\-dds \- Dynamic Directory Services overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.B dds +overlay to +.BR slapd (8) +implements dynamic objects as per RFC 2589. +The name +.B dds +stands for +Dynamic Directory Services. +It allows one to define dynamic objects, characterized by the +.B dynamicObject +objectClass. + +Dynamic objects have a limited lifetime, determined by a time-to-live +(TTL) that can be refreshed by means of a specific +.B refresh +extended operation. +This operation allows one to set the Client Refresh Period (CRP), +namely the period between refreshes that is required to preserve the +dynamic object from expiration. +The expiration time is computed by adding the requested TTL to the +current time. +When dynamic objects reach the end of their lifetime without being +further refreshed, they are automatically deleted. +There is no guarantee of immediate deletion, so clients should not count +on it. + +Dynamic objects can have subordinates, provided these also are dynamic +objects. +RFC 2589 does not specify what the behavior of a dynamic directory +service should be when a dynamic object with (dynamic) subordinates +expires. +In this implementation, the lifetime of dynamic objects with subordinates +is prolonged until all the dynamic subordinates expire. + + +This +.BR slapd.conf (5) +directive adds the +.B dds +overlay to the current database: + +.TP +.B overlay dds + +.LP +The database must have a +.B rootdn +specified, otherwise, the +.B dds +overlay will not be able to delete expired objects. The +.B dds +overlay may be used with any backend that implements the +.BR add , +.BR modify , +.BR search , +and +.BR delete +operations. +Since its use may result in many internal entry lookups, adds +and deletes, it should be best used in conjunction with backends +that have reasonably good write performances. + +.LP +The config directives that are specific to the +.B dds +overlay are prefixed by +.BR dds\- , +to avoid potential conflicts with directives specific to the underlying +database or to other stacked overlays. + +.TP +.B dds\-max\-ttl <ttl> +Specifies the max TTL value. +This is also the default TTL newly created +dynamic objects receive, unless +.B dds\-default\-ttl +is set. +When the client with a refresh extended operation requests a TTL higher +than it, sizeLimitExceeded is returned. +This value must be between 86400 (1 day, the default) and 31557600 +(1 year plus 6 hours, as per RFC 2589). + +.TP +.B dds\-min\-ttl <ttl> +Specifies the min TTL value; clients requesting a lower TTL by means +of the refresh extended operation actually obtain this value as CRP. +If set to 0 (the default), no lower limit is set. + +.TP +.B dds\-default\-ttl <ttl> +Specifies the default TTL value that newly created dynamic objects get. +If set to 0 (the default), the +.B dds\-max\-ttl +is used. + +.TP +.B dds\-interval <ttl> +Specifies the interval between expiration checks; defaults to 1 hour. + +.TP +.B dds\-tolerance <ttl> +Specifies an extra time that is added to the timer that actually wakes up +the thread that will delete an expired dynamic object. +So the nominal lifetime of the entry is that specified in the +.B entryTtl +attribute, but its lifetime will actually be +.BR "entryTtl + tolerance" . +Note that there is no guarantee that the lifetime of a dynamic object +will be +.I exactly +the requested TTL; due to implementation details, it may be longer, which +is allowed by RFC 2589. +By default, tolerance is 0. + +.TP +.B dds\-max\-dynamicObjects <num> +Specifies the maximum number of dynamic objects that can simultaneously exist +within a naming context. +This allows one to limit the amount of resources (mostly in terms of +run-queue size) that are used by dynamic objects. +By default, no limit is set. + +.TP +.B dds\-state {TRUE|false} +Specifies if the Dynamic Directory Services feature is enabled or not. +By default it is; however, a proxy does not need to keep track of dynamic +objects itself, it only needs to inform the frontend that support for +dynamic objects is available. + +.SH ACCESS CONTROL +The +.B dds +overlay restricts the refresh operation by requiring +.B manage +access to the +.B entryTtl +attribute (see +.BR slapd.access (5) +for details about the +.B manage +access privilege). +Since the +.B entryTtl +is an operational, NO-USER-MODIFICATION attribute, no direct write access +to it is possible. +So the +.B dds +overlay turns refresh extended operation into an internal modification to +the value of the +.B entryTtl +attribute with the +.B relax +control set. + +RFC 2589 recommends that anonymous clients should not be allowed to refresh +a dynamic object. +This can be implemented by appropriately crafting access control to obtain +the desired effect. + +Example: restrict refresh to authenticated clients + +.RS +.nf +access to attrs=entryTtl + by users manage + by * read + +.fi +.RE +Example: restrict refresh to the creator of the dynamic object + +.RS +.nf +access to attrs=entryTtl + by dnattr=creatorsName manage + by * read + +.fi +.RE +Another suggested usage of dynamic objects is to implement dynamic meetings; +in this case, all the participants to the meeting are allowed to refresh +the meeting object, but only the creator can delete it (otherwise it will +be deleted when the TTL expires) + +Example: assuming \fIparticipant\fP is a valid DN-valued attribute, +allow users to start a meeting and to join it; restrict refresh +to the participants; restrict delete to the creator + +.RS +.nf +access to dn.base="cn=Meetings" + attrs=children + by users write + +access to dn.onelevel="cn=Meetings" + attrs=entry + by dnattr=creatorsName write + by * read + +access to dn.onelevel="cn=Meetings" + attrs=participant + by dnattr=creatorsName write + by users selfwrite + by * read + +access to dn.onelevel="cn=Meetings" + attrs=entryTtl + by dnattr=participant manage + by * read + +.fi +.RE + +.SH REPLICATION +This implementation of RFC 2589 provides a restricted interpretation of how +dynamic objects replicate. Only the master takes care of handling dynamic +object expiration, while replicas simply see the dynamic object as a plain +object. + +When replicating these objects, one needs to explicitly exclude the +.B dynamicObject +class and the +.B entryTtl +attribute. +This implementation of RFC 2589 introduces a new operational attribute, +.BR entryExpireTimestamp , +that contains the expiration timestamp. This must be excluded from +replication as well. + +The quick and dirty solution is to set +.B schemacheck=off +in the syncrepl configuration +and, optionally, exclude the operational attributes from replication, using + +.RS +.nf +syncrepl ... + exattrs=entryTtl,entryExpireTimestamp +.fi +.RE + +In any case the overlay must be either statically built in or run-time loaded +by the consumer, so that it is aware of the +.B entryExpireTimestamp +operational attribute; however, it must not be configured in the shadow +database. +Currently, there is no means to remove the +.B dynamicObject +class from the entry; this may be seen as a feature, since it allows one to see +the dynamic properties of the object. + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd (8). +.SH AUTHOR +Implemented by Pierangelo Masarati. diff --git a/doc/man/man5/slapo-dyngroup.5 b/doc/man/man5/slapo-dyngroup.5 new file mode 100644 index 0000000..d324486 --- /dev/null +++ b/doc/man/man5/slapo-dyngroup.5 @@ -0,0 +1,49 @@ +.TH SLAPO-DYNGROUP 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2005-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-dyngroup \- Dynamic Group overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The Dynamic Group overlay allows clients to use LDAP Compare operations +to test the membership of a dynamic group the same way they would check +against a static group. Compare operations targeting a group's static +member attribute will be intercepted and tested against the configured +dynamic group's URL attribute. +.LP +Note that this intercept only happens if the actual +Compare operation does not return a LDAP_COMPARE_TRUE result. So if a +group has both static and dynamic members, the static member list will +be checked first. +.SH CONFIGURATION +This +.B slapd.conf +option applies to the Dynamic Group overlay. +It should appear after the +.B overlay +directive. +.TP +.B attrpair <memberAttr> <URLattr> +Specify the attributes to be compared. A compare operation on the +.I memberAttr +will cause the +.I URLattr +to be evaluated for the result. +.SH EXAMPLES +.nf + database bdb + ... + overlay dyngroup + attrpair member memberURL +.fi +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5). +.SH AUTHOR +Howard Chu diff --git a/doc/man/man5/slapo-dynlist.5 b/doc/man/man5/slapo-dynlist.5 new file mode 100644 index 0000000..b565d18 --- /dev/null +++ b/doc/man/man5/slapo-dynlist.5 @@ -0,0 +1,212 @@ +.TH SLAPO-DYNLIST 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation, All Rights Reserved. +.\" Copying restrictions apply. See the COPYRIGHT file. +.\" $OpenLDAP$ +.SH NAME +slapo\-dynlist \- Dynamic List overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.B dynlist +overlay to +.BR slapd (8) +allows expansion of dynamic groups and more. +Any time an entry with a specific objectClass (defined in the overlay configuration) is being returned, +the LDAP URI-valued occurrences of a specific attribute (also defined in the overlay configuration) are +expanded into the corresponding entries, and the values +of the attributes listed in the URI are added to the original +entry. +No recursion is allowed, to avoid potential infinite loops. + +Since the resulting entry is dynamically constructed, +it does not exist until it is constructed while being returned. +As a consequence, dynamically added attributes do not participate +in the filter matching phase of the search request handling. +In other words, \fIfiltering for dynamically added attributes always fails\fP. + +The resulting entry must comply with the LDAP data model, so constraints +are enforced. +For example, if a \fISINGLE\-VALUE\fP attribute is listed, +only the first value found during the list expansion appears in the final entry. +The above described behavior is disabled when the \fImanageDSAit\fP +control (RFC 3296) is used. +In that case, the contents of the dynamic group entry is returned; +namely, the URLs are returned instead of being expanded. + +.SH CONFIGURATION +The config directives that are specific to the +.B dynlist +overlay must be prefixed by +.BR dynlist\- , +to avoid potential conflicts with directives specific to the underlying +database or to other stacked overlays. + +.TP +.B overlay dynlist +This directive adds the dynlist overlay to the current database, +or to the frontend, if used before any database instantiation; see +.BR slapd.conf (5) +for details. + +.LP +This +.B slapd.conf +configuration option is defined for the dynlist overlay. It may have multiple +occurrences, and it must appear after the +.B overlay +directive. +.TP +.B dynlist\-attrset <group-oc> [<URI>] <URL-ad> [[<mapped-ad>:]<member-ad> ...] +The value +.B group\-oc +is the name of the objectClass that triggers the dynamic expansion of the +data. + +The optional +.B URI +restricts expansion only to entries matching the \fIDN\fP, +the \fIscope\fP and the \fIfilter\fP portions of the URI. + +The value +.B URL-ad +is the name of the attributeDescription that contains the URI that is +expanded by the overlay; if none is present, no expansion occurs. +If the intersection of the attributes requested by the search operation +(or the asserted attribute for compares) and the attributes listed +in the URI is empty, no expansion occurs for that specific URI. +It must be a subtype of \fIlabeledURI\fP. + +The value +.B member-ad +is optional; if present, the overlay behaves as a dynamic group: this +attribute will list the DN of the entries resulting from the internal search. +In this case, the \fIattrs\fP portion of the URIs in the +.B URL-ad +attribute must be absent, and the \fIDN\fPs +of all the entries resulting from the expansion of the URIs are listed +as values of this attribute. +Compares that assert the value of the +.B member-ad +attribute of entries with +.B group-oc +objectClass apply as if the DN of the entries resulting from the expansion +of the URI were present in the +.B group-oc +entry as values of the +.B member-ad +attribute. + +Alternatively, +.B mapped-ad +can be used to remap attributes obtained through expansion. +.B member-ad +attributes are not filled by expanded DN, but are remapped as +.B mapped-ad +attributes. Multiple mapping statements can be used. + +.LP +The dynlist overlay may be used with any backend, but it is mainly +intended for use with local storage backends. +In case the URI expansion is very resource-intensive and occurs frequently +with well-defined patterns, one should consider adding a proxycache +later on in the overlay stack. + +.SH AUTHORIZATION +By default the expansions are performed using the identity of the current +LDAP user. +This identity may be overridden by setting the +.B dgIdentity +attribute in the group's entry to the DN of another LDAP user. +In that case the dgIdentity will be used when expanding the URIs in the object. +Setting the dgIdentity to a zero-length string will cause the expansions +to be performed anonymously. +Note that the dgIdentity attribute is defined in the +.B dyngroup +schema, and this schema must be loaded before the dgIdentity +authorization feature may be used. +If the +.B dgAuthz +attribute is also present in the group's entry, its values are used +to determine what identities are authorized to use the +.B dgIdentity +to expand the group. +Values of the +.B dgAuthz +attribute must conform to the (experimental) \fIOpenLDAP authz\fP syntax. + +.SH EXAMPLE +This example collects all the email addresses of a database into a single +entry; first of all, make sure that slapd.conf contains the directives: + +.LP +.nf + include /path/to/dyngroup.schema + # ... + + database <database> + # ... + + overlay dynlist + dynlist\-attrset groupOfURLs memberURL +.fi +.LP +and that slapd loads dynlist.la, if compiled as a run-time module; +then add to the database an entry like +.LP +.nf + dn: cn=Dynamic List,ou=Groups,dc=example,dc=com + objectClass: groupOfURLs + cn: Dynamic List + memberURL: ldap:///ou=People,dc=example,dc=com?mail?sub?(objectClass=person) +.fi + +If no <attrs> are provided in the URI, all (non-operational) attributes are +collected. + +This example implements the dynamic group feature on the +.B member +attribute: + +.LP +.nf + include /path/to/dyngroup.schema + # ... + + database <database> + # ... + + overlay dynlist + dynlist\-attrset groupOfURLs memberURL member +.fi +.LP + +A dynamic group with dgIdentity authorization could be created with an +entry like +.LP +.nf + dn: cn=Dynamic Group,ou=Groups,dc=example,dc=com + objectClass: groupOfURLs + objectClass: dgIdentityAux + cn: Dynamic Group + memberURL: ldap:///ou=People,dc=example,dc=com??sub?(objectClass=person) + dgIdentity: cn=Group Proxy,ou=Services,dc=example,dc=com +.fi + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd (8). +The +.BR slapo\-dynlist (5) +overlay supports dynamic configuration via +.BR back-config . +.SH ACKNOWLEDGEMENTS +.P +This module was written in 2004 by Pierangelo Masarati for SysNet s.n.c. +.P +Attribute remapping was contributed in 2008 by Emmanuel Dreyfus. diff --git a/doc/man/man5/slapo-memberof.5 b/doc/man/man5/slapo-memberof.5 new file mode 100644 index 0000000..5e1d31d --- /dev/null +++ b/doc/man/man5/slapo-memberof.5 @@ -0,0 +1,132 @@ +.TH SLAPO-MEMBEROF 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation, All Rights Reserved. +.\" Copying restrictions apply. See the COPYRIGHT file. +.\" $OpenLDAP$ +.SH NAME +slapo\-memberof \- Reverse Group Membership overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.B memberof +overlay to +.BR slapd (8) +allows automatic reverse group membership maintenance. +Any time a group entry is modified, its members are modified as appropriate +in order to keep a DN-valued "is member of" attribute updated with the DN +of the group. + +.SH CONFIGURATION +The config directives that are specific to the +.B memberof +overlay must be prefixed by +.BR memberof\- , +to avoid potential conflicts with directives specific to the underlying +database or to other stacked overlays. + +.TP +.B overlay memberof +This directive adds the memberof overlay to the current database; see +.BR slapd.conf (5) +for details. + +.LP +The following +.B slapd.conf +configuration options are defined for the memberof overlay. + +.TP +.BI memberof\-group\-oc \ <group-oc> +The value +.I <group-oc> +is the name of the objectClass that triggers the reverse group membership +update. +It defaults to \fIgroupOfNames\fP. + +.TP +.BI memberof\-member\-ad \ <member-ad> +The value +.I <member-ad> +is the name of the attribute that contains the names of the members +in the group objects; it must be DN-valued. +It defaults to \fImember\fP. + +.TP +.BI memberof\-memberof\-ad \ <memberof-ad> +The value +.I <memberof-ad> +is the name of the attribute that contains the names of the groups +an entry is member of; it must be DN-valued. Its contents are +automatically updated by the overlay. +It defaults to \fImemberOf\fP. + +.TP +.BI memberof\-dn \ <dn> +The value +.I <dn> +contains the DN that is used as \fImodifiersName\fP for internal +modifications performed to update the reverse group membership. +It defaults to the \fIrootdn\fP of the underlying database. + +.TP +.BI "memberof\-dangling {" ignore ", " drop ", " error "}" +This option determines the behavior of the overlay when, during +a modification, it encounters dangling references. +The default is +.IR ignore , +which may leave dangling references. +Other options are +.IR drop , +which discards those modifications that would result in dangling +references, and +.IR error , +which causes modifications that would result in dangling references +to fail. + +.TP +.BI memberof\-dangling\-error \ <error-code> +If +.BR memberof\-dangling +is set to +.IR error , +this configuration parameter can be used to modify the response code +returned in case of violation. It defaults to "constraint violation", +but other implementations are known to return "no such object" instead. + +.TP +.BI "memberof\-refint {" true "|" FALSE "}" +This option determines whether the overlay will try to preserve +referential integrity or not. +If set to +.IR TRUE , +when an entry containing values of the "is member of" attribute is modified, +the corresponding groups are modified as well. + +.LP +The memberof overlay may be used with any backend that provides full +read-write functionality, but it is mainly intended for use +with local storage backends. The maintenance operations it performs +are internal to the server on which the overlay is configured and +are never replicated. Replica servers should be configured with their +own instances of the memberOf overlay if it is desired to maintain +these memberOf attributes on the replicas. Note that slapo-memberOf +is not compatible with syncrepl based replication, and should not be +used in a replicated environment. An alternative is to use slapo-dynlist +to emulate slapo-memberOf behavior. + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd (8). +The +.BR slapo\-memberof (5) +overlay supports dynamic configuration via +.BR back-config . +.SH ACKNOWLEDGEMENTS +.P +This module was written in 2005 by Pierangelo Masarati for SysNet s.n.c. + diff --git a/doc/man/man5/slapo-pbind.5 b/doc/man/man5/slapo-pbind.5 new file mode 100644 index 0000000..08db58c --- /dev/null +++ b/doc/man/man5/slapo-pbind.5 @@ -0,0 +1,61 @@ +.TH SLAPO-PBIND 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2010-2018 The OpenLDAP Foundation, All Rights Reserved. +.\" Copying restrictions apply. See the COPYRIGHT file. +.\" $OpenLDAP$ +.SH NAME +slapo\-pbind \- proxy bind overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.B pbind +overlay to +.BR slapd (8) +forwards Simple Binds on a local database to a remote +LDAP server instead of processing them locally. The remote +connection is managed using an instance of the ldap backend. + +.LP +The +.B pbind +overlay uses a subset of the \fIldap\fP backend's config directives. They +are described in more detail in +.BR slapd\-ldap (5). + +Note: this overlay is built into the \fIldap\fP backend; it is not a +separate module. + +.TP +.B overlay pbind +This directive adds the proxy bind overlay to the current backend. +The proxy bind overlay may be used with any backend, but it is mainly +intended for use with local storage backends. + +.TP +.B uri <ldapurl> +LDAP server to use. + +.TP +.B tls <TLS parameters> +Specify the use of TLS. + +.TP +.B network\-timeout <time> +Set the network timeout. + +.TP +.B quarantine <quarantine parameters> +Turns on quarantine of URIs that returned +.IR LDAP_UNAVAILABLE . + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd\-ldap (5), +.BR slapd (8). +.SH AUTHOR +Howard Chu diff --git a/doc/man/man5/slapo-pcache.5 b/doc/man/man5/slapo-pcache.5 new file mode 100644 index 0000000..45a9b69 --- /dev/null +++ b/doc/man/man5/slapo-pcache.5 @@ -0,0 +1,323 @@ +.TH SLAPO-PCACHE 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation, All Rights Reserved. +.\" Copying restrictions apply. See the COPYRIGHT file. +.\" Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it> +.\" $OpenLDAP$ +.SH NAME +slapo\-pcache \- proxy cache overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.B pcache +overlay to +.BR slapd (8) +allows caching of LDAP search requests (queries) in a local database. +For an incoming query, the +proxy cache determines its corresponding \fBtemplate\fP. If the template +was specified as cacheable using the \fBpcacheTemplate\fP directive +and the request is contained in a cached request, it is answered from +the proxy cache. +Otherwise, the search is performed as usual and cacheable search results +are saved in the cache for use in future queries. +.LP + +A template is defined by a filter string and an index identifying a set of +attributes. The \fBtemplate string\fP for a query can be obtained by +removing assertion values from the RFC 4515 representation of its search +filter. A query belongs to a template if its template string and set of +projected attributes correspond to a cacheable template. +Examples of template strings are \fB(mail=)\fP, \fB(|(sn=)(cn=))\fP, +\fB(&(sn=)(givenName=))\fP. + +.LP +The config directives that are specific to the +.B pcache +overlay can be prefixed by +.BR pcache\- , +to avoid conflicts with directives specific to the underlying database +or to other stacked overlays. This may be particularly useful for those +directives that refer to the backend used for local storage. +The following cache specific directives can be used to configure the proxy +cache: +.TP +.B overlay pcache +This directive adds the proxy cache overlay to the current backend. The +proxy cache overlay may be used with any backend but is intended for use +with the +.BR ldap , +.BR meta , +and +.BR sql +backends. Please note that the underlying backend must have a configured +.BR rootdn. +.TP +.B pcache <database> <max_entries> <numattrsets> <entry_limit> <cc_period> +The directive enables proxy caching in the current backend and sets general +cache parameters. A <database> backend will be used internally to maintain +the cached entries. The chosen database will need to be configured as well, +as shown below. Cache replacement is invoked when the cache size grows to +<max_entries> entries and continues till the cache size drops below this size. +<numattrsets> should be equal to the number of following \fBpcacheAttrset\fP +directives. Queries are cached only if they correspond to a cacheable template +(specified by the \fBpcacheTemplate\fP directive) and the number of entries +returned is less than <entry_limit>. Consistency check is performed every +<cc_period> duration (specified in secs). In each cycle queries with expired +"time to live(\fBTTL\fP)" are removed. A sample cache configuration is: +.LP +.RS +pcache \fBmdb 10000 1 50 100\fP +.RE + +.TP +.B pcacheAttrset <index> <attrs...> +Used to associate a set of attributes <attrs..> with an <index>. Each attribute +set is associated with an integer from 0 to <numattrsets>\-1. These indices are +used by the \fBpcacheTemplate\fP directive to define cacheable templates. +A set of attributes cannot be empty. A set of attributes can contain the +special attributes "*" (all user attributes), "+" (all operational attributes) +or both; in the latter case, any other attribute is redundant and should +be avoided for clarity. A set of attributes can contain "1.1" as the only +attribute; in this case, only the presence of the entries is cached. +Attributes prefixed by "undef:" need not be present in the schema. + +.TP +.B pcacheMaxQueries <queries> +Specify the maximum number of queries to cache. The default is 10000. + +.TP +.B pcacheValidate { TRUE | FALSE } +Check whether the results of a query being cached can actually be returned +from the cache by the proxy DSA. When enabled, the entries being returned +while caching the results of a query are checked to ensure consistency +with the schema known to the proxy DSA. In case of failure, the query +is not cached. By default, the check is off. + +.TP +.B pcacheOffline { TRUE | FALSE } +Set the cache to offline mode. While offline, the consistency checker +will be stopped and no expirations will occur. This allows the cache +contents to be used indefinitely while the proxy is cut off from network +access to the remote DSA. The default is FALSE, i.e. consistency +checks and expirations will be performed. + +.TP +.B pcachePersist { TRUE | FALSE } +Specify whether the cached queries should be saved across restarts +of the caching proxy, to provide hot startup of the cache. Only non-expired +queries are reloaded. The default is FALSE. + +.BR CAVEAT : +of course, the configuration of the proxy cache must not change +across restarts; the pcache overlay does not perform any consistency +checks in this sense. +In detail, this option should be disabled unless the existing +.B pcacheAttrset +and +.B pcacheTemplate +directives are not changed neither in order nor in contents. +If new sets and templates are added, or if other details of the pcache +overlay configuration changed, this feature should not be affected. + +.TP +.B pcacheTemplate <template_string> <attrset_index> <ttl> [<negttl> [<limitttl> [<ttr>]]] +Specifies a cacheable template and "time to live" <ttl> of queries +belonging to the template. An optional <negttl> can be used to specify +that negative results (i.e., queries that returned zero entries) +should also be cached for the specified amount of time. Negative +results are not cached by default (<negttl> set to 0). +An optional <limitttl> can be used to specify that results +hitting a sizelimit should also be cached for the specified amount of time. +Results hitting a sizelimit are not cached by default (<limitttl> set to 0). +An optional <ttr> "time to refresh" can be used to specify that cached +entries should be automatically refreshed after a certain time. Entries +will only be refreshed while they have not expired, so the <ttl> should +be larger than the <ttr> for this option to be useful. Entries are not +refreshed by default (<ttr> set to 0). + +.TP +.B pcacheBind <filter_template> <attrset_index> <ttr> <scope> <base> +Specifies a template for caching Simple Bind credentials based on an +already defined \fBpcacheTemplate\fP. The <filter_template> is similar +to a <template_string> except that it may have some values present. Its +purpose is to allow the overlay to generate filters similar to what other +applications do when they do a Search immediately before a Bind. E.g., +if a client like nss_ldap is configured to search for a user with the +filter "(&(objectClass=posixAccount)(uid=<username>))" then the corresponding +template "(&(objectClass=posixAccount)(uid=))" should be used here. When +converted to a regular template e.g. "(&(objectClass=)(uid=))" this +template and the <attrset_index> must match an already defined +\fBpcacheTemplate\fP clause. The "time to refresh" <ttr> determines the +time interval after which the cached credentials may be refreshed. The +first Bind request that occurs after that time will trigger the refresh +attempt. Refreshes are not performed when the overlay is Offline. There +is no "time to live" parameter for the Bind credentials; the credentials +will expire according to the \fBpcacheTemplate\fP ttl. The <scope> and +<base> should match the search scope and base used by the authentication +clients. The cached credentials are not stored in cleartext, they are +hashed using the default password hash. +By default Bind caching is not enabled. + +.TP +.B pcachePosition { head | tail } +Specifies whether the response callback should be placed at the +.B tail +(the default) or at the +.B head +(actually, wherever the stacking sequence would make it appear) +of the callback list. This affects how the overlay interacts with other +overlays, since the proxycache overlay should be executed as early +as possible (and thus configured as late as possible), to get +a chance to return the cached results; however, if executed early +at response, it would cache entries that may be later "massaged" +by other databases and thus returned \fIafter\fP massaging the first +time, and \fIbefore\fP massaging when cached. + +.TP +There are some constraints: + +all values must be positive; + +.B <entry_limit> +must be less than or equal to +.BR <max_entries> ; + +.B <numattrsets> +attribute sets SHOULD be defined by using the directive +.BR pcacheAttrset ; + +all attribute sets SHOULD be referenced by (at least) one +.B pcacheTemplate +directive; + +.LP +The following adds a template with filter string \fB(&(sn=)(givenName=))\fP +and attributes mail, postaladdress, telephonenumber and a TTL of 1 hour. +.LP +.RS +.nf +pcacheAttrset \fB0 mail postaladdress telephonenumber\fP +pcacheTemplate \fB(&(sn=)(givenName=)) 0 3600\fP +.fi +.RE + +.LP +Directives for configuring the underlying database must also be given, as +shown here: +.LP +.RS +.nf +directory /var/tmp/cache +cachesize 100 +.fi +.RE +.LP +Any valid directives for the chosen database type may be used. Indexing +should be used as appropriate for the queries being handled. In addition, +an equality index on the \fBpcacheQueryid\fP attribute should be configured, to +assist in the removal of expired query data. +.SH BACKWARD COMPATIBILITY +The configuration keywords have been renamed and the older form is +deprecated. These older keywords are still recognized but may disappear +in future releases. + +.TP +.B proxycache +use pcache + +.TP +.B proxyattrset +use pcacheAttrset + +.TP +.B proxycachequeries +use pcacheMaxQueries + +.TP +.B proxycheckcacheability +use pcacheValidate + +.TP +.B proxysavequeries +use pcachePersist + +.TP +.B proxytemplate +use pcacheTemplate + +.TP +.B response-callback +use pcachePosition + +.SH CAVEATS +Caching data is prone to inconsistencies because updates on the remote server +will not be reflected in the response of the cache at least (and at most) +for the duration of the +.B pcacheTemplate +.BR TTL . +These inconsistencies can be minimized by careful use of the TTR. + +The remote server should expose the +.B objectClass +attribute because the underlying database that actually caches the entries +may need it for optimal local processing of the queries. + +The proxy server should contain all the schema information required for caching. +Significantly, it needs the schema of attributes used in the query templates. +If the objectClass attribute is used in a query template, it needs the definition +of the objectClasses of the entries it is supposed to cache. +It is the responsibility of the proxy administrator to keep the proxy schema +lined up with that of the proxied server. + +Another potential (and subtle) inconsistency may occur when data is retrieved +with different identities and specific per-identity access control +is enforced by the remote server. +If data was retrieved with an identity that collected only partial results +because of access rules enforcement on the remote server, other users +with different access privileges on the remote server will get different +results from the remote server and from the cache. +If those users have higher access privileges on the remote server, they will +get from the cache only a subset of the results they would get directly +from the remote server; but if they have lower access privileges, they will +get from the cache a superset of the results they would get directly +from the remote server. +Either occurrence may or may not be acceptable, based on the security policy +of the cache and of the remote server. +It is important to note that in this case the proxy is violating the security +of the remote server by disclosing to an identity data that was collected +by another identity. +For this reason, it is suggested that, when using +.BR back-ldap , +proxy caching be used in conjunction with the +.I identity assertion +feature of +.BR slapd\-ldap (5) +(see the +.B idassert\-bind +and the +.B idassert\-authz +statements), so that remote server interrogation occurs with a vanilla identity +that has some relatively high +.B search +and +.B read +access privileges, and the "real" access control is delegated to the proxy's ACLs. +Beware that since only the cached fraction of the real datum is available +to the cache, it may not be possible to enforce the same access rules that +are defined on the remote server. +When security is a concern, cached proxy access must be carefully tailored. +.SH FILES + +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd\-ldap (5), +.BR slapd\-meta (5), +.BR slapd\-sql (5), +.BR slapd (8). +.SH AUTHOR +Originally implemented by Apurva Kumar as an extension to back-meta; +turned into an overlay by Howard Chu. diff --git a/doc/man/man5/slapo-ppolicy.5 b/doc/man/man5/slapo-ppolicy.5 new file mode 100644 index 0000000..041f615 --- /dev/null +++ b/doc/man/man5/slapo-ppolicy.5 @@ -0,0 +1,827 @@ +.TH SLAPO_PPOLICY 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2004-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-ppolicy \- Password Policy overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +.LP +The +.B ppolicy +overlay +is an implementation of the most recent IETF Password +Policy proposal for LDAP. When instantiated, it intercepts, +decodes and applies specific password policy controls to overall +use of a backend database, changes to user password fields, etc. +.P +The overlay provides a variety of password control mechanisms. They +include password aging -- both minimum and maximum ages, password +reuse and duplication control, account time-outs, mandatory password +resets, acceptable password content, and even grace logins. +Different groups of users may be associated with different password +policies, and there is no limit to the number of password policies +that may be created. +.P +Note that some of the policies do not take effect when the operation +is performed with the +.B rootdn +identity; all the operations, when performed with any other identity, +may be subjected to constraints, like access control. This overlay +requires a rootdn to be configured on the database. +.P +Note that the IETF Password Policy proposal for LDAP makes sense +when considering a single-valued password attribute, while +the userPassword attribute allows multiple values. This implementation +enforces a single value for the userPassword attribute, despite +its specification. + +.SH CONFIGURATION +These +.B slapd.conf +configuration options apply to the ppolicy overlay. They should appear +after the +.B overlay +directive. +.TP +.B ppolicy_default <policyDN> +Specify the DN of the pwdPolicy object to use when no specific policy is +set on a given user's entry. If there is no specific policy for an entry +and no default is given, then no policies will be enforced. +.TP +.B ppolicy_forward_updates +Specify that policy state changes that result from Bind operations (such +as recording failures, lockout, etc.) on a consumer should be forwarded +to a master instead of being written directly into the consumer's local +database. This setting is only useful on a replication consumer, and +also requires the +.B updateref +setting and +.B chain +overlay to be appropriately configured. +.TP +.B ppolicy_hash_cleartext +Specify that cleartext passwords present in Add and Modify requests should +be hashed before being stored in the database. This violates the X.500/LDAP +information model, but may be needed to compensate for LDAP clients that +don't use the Password Modify extended operation to manage passwords. It +is recommended that when this option is used that compare, search, and +read access be denied to all directory users. +.TP +.B ppolicy_use_lockout +A client will always receive an LDAP +.B InvalidCredentials +response when +Binding to a locked account. By default, when a Password Policy control +was provided on the Bind request, a Password Policy response will be +included with no special error code set. This option changes the +Password Policy response to include the +.B AccountLocked +error code. Note +that sending the +.B AccountLocked +error code provides useful information +to an attacker; sites that are sensitive to security issues should not +enable this option. + +.SH OBJECT CLASS +The +.B ppolicy +overlay depends on the +.B pwdPolicy +object class. The definition of that class is as follows: +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.2.1 + NAME 'pwdPolicy' + AUXILIARY + SUP top + MUST ( pwdAttribute ) + MAY ( + pwdMinAge $ pwdMaxAge $ pwdInHistory $ + pwdCheckQuality $ pwdMinLength $ + pwdExpireWarning $ pwdGraceAuthnLimit $ + pwdLockout $ pwdLockoutDuration $ + pwdMaxFailure $ pwdFailureCountInterval $ + pwdMustChange $ pwdAllowUserChange $ + pwdSafeModify $ pwdMaxRecordedFailure ) ) +.RE + +This implementation also provides an additional +.B pwdPolicyChecker +objectclass, used for password quality checking (see below). +.LP +.RS 4 +( 1.3.6.1.4.1.4754.2.99.1 + NAME 'pwdPolicyChecker' + AUXILIARY + SUP top + MAY ( pwdCheckModule ) ) +.RE +.P +Every account that should be subject to password policy control should +have a +.B +pwdPolicySubentry +attribute containing the DN of a valid +.B pwdPolicy +entry, or they can simply use the configured default. +In this way different users may be managed according to +different policies. + +.SH OBJECT CLASS ATTRIBUTES +.P +Each one of the sections below details the meaning and use of a particular +attribute of this +.B pwdPolicy +object class. +.P + +.B pwdAttribute +.P +This attribute contains the name of the attribute to which the password +policy is applied. For example, the password policy may be applied +to the +.B userPassword +attribute. +.P +Note: in this implementation, the only +value accepted for +.B pwdAttribute +is +.IR " userPassword ". +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.1 + NAME 'pwdAttribute' + EQUALITY objectIdentifierMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) +.RE + +.B pwdMinAge +.P +This attribute contains the number of seconds that must elapse +between modifications allowed to the password. If this attribute +is not present, zero seconds is assumed (i.e. the password may be +modified whenever and however often is desired). +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.2 + NAME 'pwdMinAge' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE + +.B pwdMaxAge +.P +This attribute contains the number of seconds after which a modified +password will expire. If this attribute is not present, or if its +value is zero (0), then passwords will not expire. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.3 + NAME 'pwdMaxAge' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE + +.B pwdInHistory +.P +This attribute is used to specify the maximum number of used +passwords that will be stored in the +.B pwdHistory +attribute. If the +.B pwdInHistory +attribute is not present, or if its value is +zero (0), used passwords will not be stored in +.B pwdHistory +and thus any previously-used password may be reused. +No history checking occurs if the password is being modified by the +.BR rootdn , +although the password is saved in the history. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.4 + NAME 'pwdInHistory' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE + +.B pwdCheckQuality +.P +This attribute indicates if and how password syntax will be checked +while a password is being modified or added. If this attribute is +not present, or its value is zero (0), no syntax checking will be +done. If its value is one (1), the server will check the syntax, +and if the server is unable to check the syntax, +whether due to a client-side hashed password or some other reason, +it will be +accepted. If its value is two (2), the server will check the syntax, +and if the server is unable to check the syntax it will return an +error refusing the password. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.5 + NAME 'pwdCheckQuality' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE + +.B pwdMinLength +.P +When syntax checking is enabled +(see also the +.B pwdCheckQuality +attribute), this attribute contains the minimum +number of characters that will be accepted in a password. If this +attribute is not present, minimum password length is not +enforced. If the server is unable to check the length of the password, +whether due to a client-side hashed password or some other reason, +the server will, depending on the +value of +.BR pwdCheckQuality , +either accept the password +without checking it (if +.B pwdCheckQuality +is zero (0) or one (1)) or refuse it (if +.B pwdCheckQuality +is two (2)). +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.6 + NAME 'pwdMinLength' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE + +.B pwdExpireWarning +.P +This attribute contains the maximum number of seconds before a +password is due to expire that expiration warning messages will be +returned to a user who is authenticating to the directory. +If this attribute is not +present, or if the value is zero (0), no warnings will be sent. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.7 + NAME 'pwdExpireWarning' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE + +.B pwdGraceAuthnLimit +.P +This attribute contains the number of times that an expired password +may be used to authenticate a user to the directory. If this +attribute is not present or if its value is zero (0), users with +expired passwords will not be allowed to authenticate to the +directory. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.8 + NAME 'pwdGraceAuthnLimit' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE + +.B pwdLockout +.P +This attribute specifies the action that should be taken +by the directory when a user has made a number of failed attempts +to authenticate to the directory. If +.B pwdLockout +is set (its value is "TRUE"), the user will not be allowed to +attempt to authenticate to the directory after there have been a +specified number of consecutive failed bind attempts. The maximum +number of consecutive failed bind attempts allowed is specified by +the +.B pwdMaxFailure +attribute. If +.B pwdLockout +is not present, or if its value is "FALSE", the password may be +used to authenticate no matter how many consecutive failed bind +attempts have been made. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.9 + NAME 'pwdLockout' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 + SINGLE\-VALUE ) +.RE + +.B pwdLockoutDuration +.P +This attribute contains the number of seconds during +which the password cannot be used to authenticate the +user to the directory due to too many consecutive failed +bind attempts. +(See also +.B pwdLockout +and +.BR pwdMaxFailure .) +If +.B pwdLockoutDuration +is not present, or if its value is zero (0), the password +cannot be used to authenticate the user to the directory +again until it is reset by an administrator. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.10 + NAME 'pwdLockoutDuration' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE + +.B pwdMaxFailure +.P +This attribute contains the number of consecutive failed bind +attempts after which the password may not be used to authenticate +a user to the directory. +If +.B pwdMaxFailure +is not present, or its value is zero (0), then a user will +be allowed to continue to attempt to authenticate to +the directory, no matter how many consecutive failed +bind attempts have occurred with that user's DN. +(See also +.B pwdLockout +and +.BR pwdLockoutDuration .) +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.11 + NAME 'pwdMaxFailure' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE + +.B pwdMaxRecordedFailure +.P +This attribute contains the maximum number of failed bind +attempts to store in a user's entry. +If +.B pwdMaxRecordedFailure +is not present, or its value is zero (0), then it defaults +to the value of +.BR pwdMaxFailure . +If that value is also 0, the default is 5. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.16 + NAME 'pwdMaxRecordedFailure' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE + +.B pwdFailureCountInterval +.P +This attribute contains the number of seconds after which old +consecutive failed bind attempts are purged from the failure counter, +even though no successful authentication has occurred. +If +.B pwdFailureCountInterval +is not present, or its value is zero (0), the failure +counter will only be reset by a successful authentication. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.12 + NAME 'pwdFailureCountInterval' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE + +.B pwdMustChange +.P +This attribute specifies whether users must change their passwords +when they first bind to the directory after a password is set or +reset by the administrator, or not. If +.B pwdMustChange +has a value of "TRUE", users must change their passwords when they +first bind to the directory after a password is set or reset by +the administrator. If +.B pwdMustChange +is not present, or its value is "FALSE", +users are not required to change their password upon binding after +the administrator sets or resets the password. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.13 + NAME 'pwdMustChange' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 + SINGLE\-VALUE ) +.RE + +.B pwdAllowUserChange +.P +This attribute specifies whether users are allowed to change their own +passwords or not. If +.B pwdAllowUserChange +is set to "TRUE", or if the attribute is not present, users will be +allowed to change their own passwords. If its value is "FALSE", +users will not be allowed to change their own passwords. +.LP +Note: this implies that when +.B pwdAllowUserChange +is set to "TRUE", +users will still be able to change the password of another user, +subjected to access control. +This restriction only applies to modifications of ones's own password. +It should also be noted that +.B pwdAllowUserChange +was defined in the specification to provide rough access control +to the password attribute in implementations that do not allow fine-grain +access control. +Since OpenLDAP provides fine-grain access control, the use of this attribute +is discouraged; ACLs should be used instead +(see +.BR slapd.access (5) +for details). +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.14 + NAME 'pwdAllowUserChange' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 + SINGLE\-VALUE ) +.RE + +.B pwdSafeModify +.P +This attribute denotes whether the user's existing password must be sent +along with their new password when changing a password. If +.B pwdSafeModify +is set to "TRUE", the existing password must be sent +along with the new password. If the attribute is not present, or +its value is "FALSE", the existing password need not be sent +along with the new password. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.15 + NAME 'pwdSafeModify' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 + SINGLE\-VALUE ) +.RE + +.B pwdCheckModule +.P +This attribute names a user-defined loadable module that must +instantiate the check_password() function. This function +will be called to further check a new password if +.B pwdCheckQuality +is set to one (1) or two (2), +after all of the built-in password compliance checks have +been passed. This function will be called according to this +function prototype: +.RS 4 +int +.I check_password +(char *pPasswd, char **ppErrStr, Entry *pEntry); +.RE +The +.B pPasswd +parameter contains the clear-text user password, the +.B ppErrStr +parameter contains a double pointer that allows the function +to return human-readable details about any error it encounters. +The optional +.B pEntry +parameter, if non-NULL, carries a pointer to the +entry whose password is being checked. +If +.B ppErrStr +is NULL, then +.I funcName +must NOT attempt to use it/them. +A return value of LDAP_SUCCESS from the called +function indicates that the password is ok, any other value +indicates that the password is unacceptable. If the password is +unacceptable, the server will return an error to the client, and +.B ppErrStr +may be used to return a human-readable textual explanation of the +error. The error string must be dynamically allocated as it will +be free()'d by slapd. +.LP +.RS 4 +( 1.3.6.1.4.1.4754.1.99.1 + NAME 'pwdCheckModule' + EQUALITY caseExactIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 + SINGLE\-VALUE ) +.RE +.P +Note: +The user-defined loadable module named by +.B pwdCheckModule +must be in +.B slapd's +standard executable search PATH. +.P +Note: +.B pwdCheckModule +is a non-standard extension to the LDAP password +policy proposal. + +.SH OPERATIONAL ATTRIBUTES +.P +The operational attributes used by the +.B ppolicy +module are stored in the user's entry. Most of these attributes +are not intended to be changed directly by users; they are there +to track user activity. They have been detailed here so that +administrators and users can both understand the workings of +the +.B ppolicy +module. + +.P +Note that the current IETF Password Policy proposal does not define +how these operational attributes are expected to behave in a +replication environment. In general, authentication attempts on +a slave server only affect the copy of the operational attributes +on that slave and will not affect any attributes for +a user's entry on the master server. Operational attribute changes +resulting from authentication attempts on a master server +will usually replicate to the slaves (and also overwrite +any changes that originated on the slave). +These behaviors are not guaranteed and are subject to change +when a formal specification emerges. + +.B userPassword +.P +The +.B userPassword +attribute is not strictly part of the +.B ppolicy +module. It is, however, the attribute that is tracked and controlled +by the module. Please refer to the standard OpenLDAP schema for +its definition. + +.B pwdPolicySubentry +.P +This attribute refers directly to the +.B pwdPolicy +subentry that is to be used for this particular directory user. +If +.B pwdPolicySubentry +exists, it must contain the DN of a valid +.B pwdPolicy +object. If it does not exist, the +.B ppolicy +module will enforce the default password policy rules on the +user associated with this authenticating DN. If there is no +default, or the referenced subentry does not exist, then no +policy rules will be enforced. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.23 + NAME 'pwdPolicySubentry' + DESC 'The pwdPolicy subentry in effect for + this object' + EQUALITY distinguishedNameMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 + SINGLE\-VALUE + NO\-USER\-MODIFICATION + USAGE directoryOperation) +.RE + +.B pwdChangedTime +.P +This attribute denotes the last time that the entry's password was +changed. This value is used by the password expiration policy to +determine whether the password is too old to be allowed to be used +for user authentication. If +.B pwdChangedTime +does not exist, the user's password will not expire. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.16 + NAME 'pwdChangedTime' + DESC 'The time the password was last changed' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 + EQUALITY generalizedTimeMatch + ORDERING generalizedTimeOrderingMatch + SINGLE\-VALUE + NO\-USER\-MODIFICATION + USAGE directoryOperation) +.RE + +.B pwdAccountLockedTime +.P +This attribute contains the time that the user's account was locked. +If the account has been locked, the password may no longer be used to +authenticate the user to the directory. If +.B pwdAccountLockedTime +is set to 000001010000Z, the user's account has been permanently locked +and may only be unlocked by an administrator. Note that account locking +only takes effect when the +.B pwdLockout +password policy attribute is set to "TRUE". +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.17 + NAME 'pwdAccountLockedTime' + DESC 'The time an user account was locked' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 + EQUALITY generalizedTimeMatch + ORDERING generalizedTimeOrderingMatch + SINGLE\-VALUE + NO\-USER\-MODIFICATION + USAGE directoryOperation) +.RE + +.B pwdFailureTime +.P +This attribute contains the timestamps of each of the consecutive +authentication failures made upon attempted authentication to this +DN (i.e. account). If too many timestamps accumulate here (refer to +the +.B pwdMaxFailure +password policy attribute for details), +and the +.B pwdLockout +password policy attribute is set to "TRUE", the +account may be locked. +(Please also refer to the +.B pwdLockout +password policy attribute.) +Excess timestamps beyond those allowed by +.B pwdMaxFailure +or +.B pwdMaxRecordedFailure +may also be purged. If a successful authentication is made to this +DN (i.e. to this user account), then +.B pwdFailureTime +will be cleansed of entries. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.19 + NAME 'pwdFailureTime' + DESC 'The timestamps of the last consecutive + authentication failures' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 + EQUALITY generalizedTimeMatch + ORDERING generalizedTimeOrderingMatch + NO\-USER\-MODIFICATION + USAGE directoryOperation ) +.RE + +.B pwdHistory +.P +This attribute contains the history of previously used passwords +for this DN (i.e. for this user account). +The values of this attribute are stored in string format as follows: + +.RS 4 + +pwdHistory= +.RS 4 +time "#" syntaxOID "#" length "#" data +.RE + +time= +.RS 4 +GeneralizedTime as specified in section 3.3.13 of [RFC4517] +.RE + +.P +syntaxOID = numericoid +.RS 4 +This is the string representation of the dotted-decimal OID that +defines the syntax used to store the password. numericoid is +described in section 1.4 of [RFC4512]. +.RE + +length = NumericString +.RS 4 +The number of octets in the data. NumericString is described in +section 3.3.23 of [RFC4517]. +.RE + +data = +.RS 4 +Octets representing the password in the format specified by syntaxOID. +.RE + +.RE + +This format allows the server to store and transmit a history of +passwords that have been used. In order for equality matching +on the values in this attribute to function properly, the time +field is in GMT format. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.20 + NAME 'pwdHistory' + DESC 'The history of user passwords' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 + EQUALITY octetStringMatch + NO\-USER\-MODIFICATION + USAGE directoryOperation) +.RE + +.B pwdGraceUseTime +This attribute contains the list of timestamps of logins made after +the user password in the DN has expired. These post-expiration +logins are known as "\fIgrace logins\fP". +If too many +.I grace logins +have been used (please refer to the +.B pwdGraceLoginLimit +password policy attribute), then the DN will no longer be allowed +to be used to authenticate the user to the directory until the +administrator changes the DN's +.B userPassword +attribute. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.21 + NAME 'pwdGraceUseTime' + DESC 'The timestamps of the grace login once the password has expired' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 + EQUALITY generalizedTimeMatch + NO\-USER\-MODIFICATION + USAGE directoryOperation) +.RE + +.B pwdReset +.P +This attribute indicates whether the user's password has been reset +by the administrator and thus must be changed upon first use of this +DN for authentication to the directory. If +.B pwdReset +is set to "TRUE", then the password was reset and the user must change +it upon first authentication. If the attribute does not exist, or +is set to "FALSE", the user need not change their password due to +administrative reset. +.LP +.RS 4 +( 1.3.6.1.4.1.42.2.27.8.1.22 + NAME 'pwdReset' + DESC 'The indication that the password has + been reset' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 + SINGLE\-VALUE + USAGE directoryOperation) +.RE + +.SH EXAMPLES +.LP +.RS +.nf +database bdb +suffix dc=example,dc=com +\|... +overlay ppolicy +ppolicy_default "cn=Standard,ou=Policies,dc=example,dc=com" +.fi +.RE + +.SH SEE ALSO +.BR ldap (3), +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapo\-chain (5). +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.LP +IETF LDAP password policy proposal by P. Behera, L. Poitou and J. +Sermersheim: documented in IETF document +"draft-behera-ldap-password-policy-09.txt". + +.SH BUGS +The LDAP Password Policy specification is not yet an approved standard, +and it is still evolving. This code will continue to be in flux until the +specification is finalized. + +.SH ACKNOWLEDGEMENTS +.P +This module was written in 2004 by Howard Chu of Symas Corporation +with significant input from Neil Dunbar and Kartik Subbarao of Hewlett-Packard. +.P +This manual page borrows heavily and shamelessly from the specification +upon which the password policy module it describes is based. This +source is the +IETF LDAP password policy proposal by P. Behera, L. +Poitou and J. Sermersheim. +The proposal is fully documented in +the +IETF document named draft-behera-ldap-password-policy-09.txt, +written in July of 2005. +.P +.so ../Project diff --git a/doc/man/man5/slapo-refint.5 b/doc/man/man5/slapo-refint.5 new file mode 100644 index 0000000..6440b76 --- /dev/null +++ b/doc/man/man5/slapo-refint.5 @@ -0,0 +1,78 @@ +.TH SLAPO-REFINT 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2004-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-refint \- Referential Integrity overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The Referential Integrity overlay can be used with a backend database such as +.BR slapd\-bdb (5) +to maintain the cohesiveness of a schema which utilizes reference attributes. +.LP +Integrity is maintained by updating database records which contain the named +attributes to match the results of a +.B modrdn +or +.B delete +operation. For example, if the integrity attribute were configured as +.BR manager , +deletion of the record "uid=robert,ou=people,dc=example,dc=com" would trigger a +search for all other records which have a +.B manager +attribute containing that DN. Entries matching that search would have their +.B manager +attribute removed. +Or, renaming the same record into "uid=george,ou=people,dc=example,dc=com" +would trigger a search for all other records which have a +.B manager +attribute containing that DN. +Entries matching that search would have their +.B manager +attribute deleted and replaced by the new DN. +.LP +.B rootdn +must be set for the database. refint runs as the rootdn +to gain access to make its updates. +.B rootpw +is not needed. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the Referential Integrity overlay. +They should appear after the +.B overlay +directive. +.TP +.B refint_attributes <attribute> [...] +Specify one or more attributes for which integrity will be maintained +as described above. +.TP +.B refint_nothing <string> +Specify an arbitrary value to be used as a placeholder when the last value +would otherwise be deleted from an attribute. This can be useful in cases +where the schema requires the existence of an attribute for which referential +integrity is enforced. The attempted deletion of a required attribute will +otherwise result in an Object Class Violation, causing the request to fail. +The string must be a valid DN. +.TP +.B refint_modifiersname <DN> +Specify the DN to be used as the modifiersName of the internal modifications +performed by the overlay. +It defaults to "\fIcn=Referential Integrity Overlay\fP". +.LP +Modifications performed by this overlay are not propagated during +replication. This overlay must be configured identically on +replication consumers in order to maintain full synchronization +with the provider. + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5). +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man5/slapo-retcode.5 b/doc/man/man5/slapo-retcode.5 new file mode 100644 index 0000000..3acd44f --- /dev/null +++ b/doc/man/man5/slapo-retcode.5 @@ -0,0 +1,257 @@ +.TH SLAPO-RETCODE 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation, All Rights Reserved. +.\" Copying restrictions apply. See the COPYRIGHT file. +.\" Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it> +.\" $OpenLDAP$ +.SH NAME +slapo\-retcode \- return code overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.B retcode +overlay to +.BR slapd (8) +is useful to test the behavior of clients when server-generated erroneous +and/or unusual responses occur, e.g. error codes, referrals, +excessive response times and so on. + +The error responses are generated according to different strategies. +.LP +In the first case, all operations targeted at a specific configurable +subtree cause the object related to the request DN to be looked up +and checked for return code data: a response code, plus an optional +textual message, an optional configurable delay, an optional matched DN +field, and, when the response code is "referral", a (list of) referral(s). +.LP +Well-known response codes from standard track documents are provided +in \fBretcode.conf\fP, which can be included after instantiating +the overlay. +.LP +In the second case, objects of classes inherited from +the \fBerrAbsObject\fP, like \fBerrObject\fP or \fBerrAuxObject\fP, +when returned as intermediate responses of a search request, are changed +into the response dictated by their content. +.LP +A third mode causes objects to be looked up from the underlying database +to discover if their class inherits from \fBerrABsObject\fP; +in that case, their content is used to compute the corresponding response. +.LP +The behavior is disabled by using the \fBmanageDSAit\fP control (RFC 3296); +in that case, the resulting object, either present in the directory +or dynamically generated by the overlay, or contained in the request, +is handled as usual. +.LP +The config directives that are specific to the +.B retcode +overlay must be prefixed by +.BR retcode\- , +to avoid conflicts with directives specific to the underlying database +or to other stacked overlays. The following specific directives +can be used to configure the retcode overlay: +.TP +.B retcode\-parent <DN> +This directive defines the parent DN where dynamically generated +entries reside. +If not defined, the suffix of the database is used. +.HP +.hy 0 +.B retcode\-item <RDN> <errCode> [op=<oplist>] [text=<message>] +.B [ref=<referral>] [sleeptime=<sec>] [matched=<DN>] +.B [unsolicited=<OID>[:<data>]] [flags=[\{pre|post\}\-]disconnect[,...]] +.RS +A dynamically generated entry, located below \fBretcode\-parent\fP. +The \fBerrCode\fP is the number of the response code; +it can be in any format supported by +.BR strtol (3). +The optional \fBoplist\fP is a list of operations that cause +response code generation; if absent, all operations are affected. +The \fBmatched\fP field is the matched DN that is returned +along with the error, while the \fBtext\fP field is an optional +diagnostics message. +The \fBref\fP field is only allowed for the \fBreferral\fP +response code. +The \fBsleeptime\fP field causes +.BR slapd (8) +to sleep the specified number of seconds before proceeding +with the operation. +The \fBunsolicited\fP field can be used to cause the return +of an RFC 4511 unsolicited response message; if \fBOID\fP +is not "0", an extended response is generated, with the optional +\fBdata\fP appended. +If \fBflags\fP contains \fBdisconnect\fP, or \fBpre\-disconnect\fP, +.BR slapd (8) +disconnects abruptly, without notice; \fBpost\-disconnect\fP +causes disconnection right after sending response as appropriate. +.RE +.TP +.B retcode\-indir +Enables exploitation of in-directory stored errAbsObject. +May result in a lot of unnecessary overhead. +.TP +.B retcode\-sleep [\-]<n> +Defines a sleep time in seconds that is spent before actually handling +any operation. +If negative, a random time between 0 and the absolute value of the argument +is used. + +.SH SCHEMA +The +.B retcode +overlay utilizes the "return code" schema described herein. +This schema is specifically designed for use with this +overlay and is not intended to be used otherwise. +It is also noted that the schema described here is +.I a work in +.IR progress , +and hence subject to change without notice. +The schema is loaded automatically by the overlay. + +The schema includes a number of object classes and associated +attribute types as described below. + +.LP +The error code: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.1.1 + NAME ( 'errCode' ) + DESC 'LDAP error code' + EQUALITY integerMatch + ORDERING integerOrderingMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE +.LP +The operations that trigger the response code: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.1.2 + NAME ( 'errOp' ) + DESC 'Operations the errObject applies to' + EQUALITY caseIgnoreMatch + SUBSTR caseIgnoreSubstringsMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) +.RE +.LP +The text message: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.1.3 + NAME ( 'errText' ) + DESC 'LDAP error textual description' + EQUALITY caseIgnoreMatch + SUBSTR caseIgnoreSubstringsMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 + SINGLE\-VALUE ) +.RE +.LP +The sleep time before the response is actually returned to the client: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.1.4 + NAME ( 'errSleepTime' ) + DESC 'Time to wait before returning the error' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE\-VALUE ) +.RE +.LP +The matched DN returned to the client: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.1.5 + NAME ( 'errMatchedDN' ) + DESC 'Value to be returned as matched DN' + EQUALITY distinguishedNameMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 + SINGLE\-VALUE ) +.RE +.LP +The OID to be returned as extended response OID +in RFC 4511 unsolicited responses +("0" generates a regular response with msgid set to 0): +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.1.6 + NAME ( 'errUnsolicitedOID' ) + DESC 'OID to be returned within unsolicited response' + EQUALITY objectIdentifierMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 + SINGLE\-VALUE ) +.RE +.LP +The octet string to be returned as extended response data +in RFC 4511 unsolicited response: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.1.7 + NAME ( 'errUnsolicitedData' ) + DESC 'Data to be returned within unsolicited response' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 + SINGLE\-VALUE ) +.RE +.LP +If TRUE, +.BR slapd (8) +disconnects abruptly without notice; if FALSE, it disconnects +after sending response as appropriate: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.1.8 + NAME ( 'errDisconnect' ) + DESC 'Disconnect without notice' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 + SINGLE\-VALUE ) +.RE +.LP +The abstract class that triggers the overlay: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.3.0 + NAME ( 'errAbsObject' ) + SUP top ABSTRACT + MUST ( errCode ) + MAY ( cn $ description $ errOp $ errText $ errSleepTime + $ errMatchedDN ) ) +.RE +.LP +The standalone structural objectclass for specifically created data: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.3.1 + NAME ( 'errObject' ) + SUP errAbsObject STRUCTURAL ) +.RE +.LP +The auxiliary objectclass to alter the behavior of existing objects: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.3.2 + NAME ( 'errAuxObject' ) + SUP errAbsObject AUXILIARY ) +.RE + +.SH EXAMPLE +.LP +.RS +.nf +overlay retcode +retcode\-parent "ou=RetCodes,dc=example,dc=com" + +# retcode.conf is found in tests/data/ of the source tree +include ./retcode.conf + +# Wait 10 seconds, then return success (0x00) +retcode\-item "cn=Success after 10 seconds" 0x00 sleeptime=10 +# Wait 10 seconds, then return timelimitExceeded (0x03) +retcode\-item "cn=Timelimit after 10 seconds" 0x03 sleeptime=10 +.fi +.RE +.LP +.LP + +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd (8). +The +.BR slapo\-retcode (5) +overlay supports dynamic configuration via +.BR back-config . +.SH ACKNOWLEDGEMENTS +.P +This module was written in 2005 by Pierangelo Masarati for SysNet s.n.c. diff --git a/doc/man/man5/slapo-rwm.5 b/doc/man/man5/slapo-rwm.5 new file mode 100644 index 0000000..bebded5 --- /dev/null +++ b/doc/man/man5/slapo-rwm.5 @@ -0,0 +1,675 @@ +.TH SLAPO-RWM 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation, All Rights Reserved. +.\" Copying restrictions apply. See the COPYRIGHT file. +.\" Copyright 2004, Pierangelo Masarati, All rights reserved. <ando@sys-net.it> +.\" $OpenLDAP$ +.\" +.\" Portions of this document should probably be moved to slapd-ldap(5) +.\" and maybe manual pages for librewrite. +.\" +.SH NAME +slapo\-rwm \- rewrite/remap overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The +.B rwm +overlay to +.BR slapd (8) +performs basic DN/data rewrite and objectClass/attributeType mapping. +Its usage is mostly intended to provide virtual views of existing data +either remotely, in conjunction with the proxy backend described in +.BR slapd\-ldap (5), +or locally, in conjunction with the relay backend described in +.BR slapd\-relay (5). +.LP +This overlay is experimental. +.SH MAPPING +An important feature of the +.B rwm +overlay is the capability to map objectClasses and attributeTypes +from the local set (or a subset of it) to a foreign set, and vice versa. +This is accomplished by means of the +.B rwm\-map +directive. +.TP +.B rwm\-map "{attribute | objectclass} [<local name> | *] {<foreign name> | *}" +Map attributeTypes and objectClasses from the foreign server to +different values on the local slapd. +The reason is that some attributes might not be part of the local +slapd's schema, some attribute names might be different but serve the +same purpose, etc. +If local or foreign name is `*', the name is preserved. +If local name is omitted, the foreign name is removed. +Unmapped names are preserved if both local and foreign name are `*', +and removed if local name is omitted and foreign name is `*'. +.LP +The local +.I objectClasses +and +.I attributeTypes +must be defined in the local schema; the foreign ones do not have to, +but users are encouraged to explicitly define the remote attributeTypes +and the objectClasses they intend to map. All in all, when remapping +a remote server via back-ldap (\fBslapd\-ldap\fP(5)) +or back-meta (\fBslapd\-meta\fP(5)) +their definition can be easily obtained by querying the \fIsubschemaSubentry\fP +of the remote server; the problem should not exist when remapping a local +database. +Note, however, that the decision whether to rewrite or not attributeTypes +with +.IR "distinguishedName syntax" , +requires the knowledge of the attributeType syntax. +See the REWRITING section for details. +.LP +Note that when mapping DN-valued attributes from local to remote, +first the DN is rewritten, and then the attributeType is mapped; +while mapping from remote to local, first the attributeType is mapped, +and then the DN is rewritten. +As such, it is important that the local attributeType is appropriately +defined as using the distinguishedName syntax. +Also, note that there are DN-related syntaxes (i.e. compound types with +a portion that is DN-valued), like nameAndOptionalUID, +whose values are currently not rewritten. +.LP +If the foreign type of an attribute mapping is not defined on the local +server, it might be desirable to have the attribute values normalized after +the mapping process. Not normalizing the values can lead to wrong results, +when the +.B rwm +overlay is used together with e.g. the +.B pcache +overlay. This normalization can be enabled by means of the +.B rwm\-normalize\-mapped\-attrs +directive. +.TP +.B rwm\-normalize\-mapped\-attrs {yes|no} +Set this to "yes", if the +.B rwm +overlay should try to normalize the values of attributes that are mapped from +an attribute type that is unknown to the local server. The default value of +this setting is "no". +.TP +.B rwm-drop-unrequested-attrs {yes|no} +Set this to "yes", if the +.B rwm +overlay should drop attributes that are not explicitly requested +by a search operation. +When this is set to "no", the +.B rwm +overlay will leave all attributes in place, so that subsequent modules +can further manipulate them. +In any case, unrequested attributes will be omitted from search results +by the frontend, when the search entry response package is encoded. +The default value of this setting is "yes". +.SH SUFFIX MASSAGING +A basic feature of the +.B rwm +overlay is the capability to perform suffix massaging between a virtual +and a real naming context by means of the +.B rwm\-suffixmassage +directive. +This, in conjunction with proxy backends, +.BR slapd\-ldap (5) +and +.BR slapd\-meta (5), +or with the relay backend, +.BR slapd\-relay (5), +allows one to create virtual views of databases. +A distinguishing feature of this overlay is that, when instantiated +before any database, it can modify the DN of requests +.I before +database selection. +For this reason, rules that rewrite the empty DN ("") +or the subschemaSubentry DN (usually "cn=subschema"), +would prevent clients from reading the root DSE or the DSA's schema. +.TP +.B rwm\-suffixmassage "[<virtual naming context>]" "<real naming context>" +Shortcut to implement naming context rewriting; the trailing part +of the DN is rewritten from the virtual to the real naming context +in the bindDN, searchDN, searchFilterAttrDN, compareDN, compareAttrDN, +addDN, addAttrDN, modifyDN, modifyAttrDN, modrDN, newSuperiorDN, +deleteDN, exopPasswdDN, and from the real to the virtual naming context +in the searchEntryDN, searchAttrDN and matchedDN rewrite contexts. +By default no rewriting occurs for the searchFilter +and for the referralAttrDN and referralDN rewrite contexts. +If no \fI<virtual naming context>\fP is given, the first suffix of the +database is used; this requires the +.B rwm\-suffixmassage +directive be defined \fIafter\fP the database +.B suffix +directive. +The +.B rwm\-suffixmassage +directive automatically sets the +.B rwm\-rewriteEngine +to +.BR ON . +.LP +See the REWRITING section for details. +.SH REWRITING +A string is rewritten according to a set of rules, called a `rewrite +context'. +The rules are based on POSIX (''extended'') regular expressions with +substring matching; basic variable substitution and map resolution +of substrings is allowed by specific mechanisms detailed in the following. +The behavior of pattern matching/substitution can be altered by a set +of flags. +.LP +.RS +.nf +<rewrite context> ::= <rewrite rule> [...] +<rewrite rule> ::= <pattern> <action> [<flags>] +.fi +.RE +.LP +The underlying concept is to build a lightweight rewrite module +for the slapd server (initially dedicated to the LDAP backend): +.LP +.SH Passes +An incoming string is matched against a set of +.IR rewriteRules . +Rules are made of a +.IR "regex match pattern" , +a +.I "substitution pattern" +and a set of actions, described by a set of +.IR "optional flags" . +In case of match, string rewriting is performed according to the +substitution pattern that allows one to refer to substrings matched in the +incoming string. +The actions, if any, are finally performed. +Each rule is executed recursively, unless altered by specific action +flags; see "Action Flags" for details. +A default limit on the recursion level is set, and can be altered +by the +.B rwm\-rewriteMaxPasses +directive, as detailed in the "Additional Configuration Syntax" section. +The substitution pattern allows map resolution of substrings. +A map is a generic object that maps a substitution pattern to a value. +The flags are divided in "Pattern Matching Flags" and "Action Flags"; +the former alter the regex match pattern behavior, while the latter +alter the actions that are taken after substitution. +.SH "Pattern Matching Flags" +.TP +.B `C' +honors case in matching (default is case insensitive) +.TP +.B `R' +use POSIX ''basic'' regular expressions (default is ''extended'') +.TP +.B `M{n}' +allow no more than +.B n +recursive passes for a specific rule; does not alter the max total count +of passes, so it can only enforce a stricter limit for a specific rule. +.SH "Action Flags" +.TP +.B `:' +apply the rule once only (default is recursive) +.TP +.B `@' +stop applying rules in case of match; the current rule is still applied +recursively; combine with `:' to apply the current rule only once +and then stop. +.TP +.B `#' +stop current operation if the rule matches, and issue an `unwilling to +perform' error. +.TP +.B `G{n}' +jump +.B n +rules back and forth (watch for loops!). +Note that `G{1}' is implicit in every rule. +.TP +.B `I' +ignores errors in rule; this means, in case of error, e.g. issued by a +map, the error is treated as a missed match. +The `unwilling to perform' is not overridden. +.TP +.B `U{n}' +uses +.B +n +as return code if the rule matches; the flag does not alter the recursive +behavior of the rule, so, to have it performed only once, it must be used +in combination with `:', e.g. +.B `:U{32}' +returns the value `32' (indicating noSuchObject) after exactly +one execution of the rule, if the pattern matches. +As a consequence, its behavior is equivalent to `@', with the return +code set to +.BR n ; +or, in other words, `@' is equivalent to `U{0}'. +Positive errors are allowed, indicating the related LDAP error codes +as specified in \fIdraft-ietf-ldapbis-protocol\fP. +.LP +The ordering of the flags can be significant. +For instance: `IG{2}' means ignore errors and jump two lines ahead +both in case of match and in case of error, while `G{2}I' means ignore +errors, but jump two lines ahead only in case of match. +.LP +More flags (mainly Action Flags) will be added as needed. +.SH "Pattern Matching" +See +.BR regex (7) +and/or +.BR re_format (7). +.SH "Substitution Pattern Syntax" +Everything starting with `$' requires substitution; +.LP +the only obvious exception is `$$', which is turned into a single `$'; +.LP +the basic substitution is `$<d>', where `<d>' is a digit; +0 means the whole string, while 1-9 is a submatch, as discussed in +.BR regex (7) +and/or +.BR re_format (7). +.LP +a `$' followed by a `{' invokes an advanced substitution. +The pattern is: +.LP +.RS +`$' `{' [ <operator> ] <name> `(' <substitution> `)' `}' +.RE +.LP +where <name> must be a legal name for the map, i.e. +.LP +.RS +.nf +<name> ::= [a-z][a-z0-9]* (case insensitive) +<operator> ::= `>' `|' `&' `&&' `*' `**' `$' +.fi +.RE +.LP +and <substitution> must be a legal substitution +pattern, with no limits on the nesting level. +.LP +The operators are: +.TP +.B > +sub-context invocation; <name> must be a legal, already defined +rewrite context name +.TP +.B | +external command invocation; <name> must refer to a legal, already +defined command name (NOT IMPLEMENTED YET) +.TP +.B & +variable assignment; <name> defines a variable in the running +operation structure which can be dereferenced later; operator +.B & +assigns a variable in the rewrite context scope; operator +.B && +assigns a variable that scopes the entire session, e.g. its value +can be dereferenced later by other rewrite contexts +.TP +.B * +variable dereferencing; <name> must refer to a variable that is +defined and assigned for the running operation; operator +.B * +dereferences a variable scoping the rewrite context; operator +.B ** +dereferences a variable scoping the whole session, e.g. the value +is passed across rewrite contexts +.TP +.B $ +parameter dereferencing; <name> must refer to an existing parameter; +the idea is to make some run-time parameters set by the system +available to the rewrite engine, as the client host name, the bind DN +if any, constant parameters initialized at config time, and so on; +no parameter is currently set by either +.B back\-ldap +or +.BR back\-meta , +but constant parameters can be defined in the configuration file +by using the +.B rewriteParam +directive. +.LP +Substitution escaping has been delegated to the `$' symbol, +which is used instead of `\e' in string substitution patterns +because `\e' is already escaped by slapd's low level parsing routines; +as a consequence, regex escaping requires +two `\e' symbols, e.g. `\fB.*\e.foo\e.bar\fP' must +be written as `\fB.*\e\e.foo\e\e.bar\fP'. +.\" +.\" The symbol can be altered at will by redefining the related macro in +.\" "rewrite-int.h". +.\" +.SH "Rewrite Context" +A rewrite context is a set of rules which are applied in sequence. +The basic idea is to have an application initialize a rewrite +engine (think of Apache's mod_rewrite ...) with a set of rewrite +contexts; when string rewriting is required, one invokes the +appropriate rewrite context with the input string and obtains the +newly rewritten one if no errors occur. +.LP +Each basic server operation is associated to a rewrite context; +they are divided in two main groups: client \-> server and +server \-> client rewriting. +.LP +client \-> server: +.LP +.RS +.nf +(default) if defined and no specific context + is available +bindDN bind +searchDN search +searchFilter search +searchFilterAttrDN search +compareDN compare +compareAttrDN compare AVA +addDN add +addAttrDN add AVA (DN portion of "ref" excluded) +modifyDN modify +modifyAttrDN modify AVA (DN portion of "ref" excluded) +referralAttrDN add/modify DN portion of referrals + (default to none) +renameDN modrdn (the old DN) +newSuperiorDN modrdn (the new parent DN, if any) +newRDN modrdn (the new relative DN) +deleteDN delete +exopPasswdDN password modify extended operation DN +.fi +.RE +.LP +server \-> client: +.LP +.RS +.nf +searchEntryDN search (only if defined; no default; + acts on DN of search entries) +searchAttrDN search AVA (only if defined; defaults + to searchEntryDN; acts on DN-syntax + attributes of search results) +matchedDN all ops (only if applicable; defaults + to searchEntryDN) +referralDN all ops (only if applicable; defaults + to none) +.fi +.RE +.LP +.SH "Basic Configuration Syntax" +All rewrite/remap directives start with the prefix +.BR rwm\- ; +for backwards compatibility with the historical +.BR slapd\-ldap (5) +and +.BR slapd\-meta (5) +builtin rewrite/remap capabilities, the prefix may be omitted, +but this practice is strongly discouraged. +.TP +.B rwm\-rewriteEngine { on | off } +If `on', the requested rewriting is performed; if `off', no +rewriting takes place (an easy way to stop rewriting without +altering too much the configuration file). +.TP +.B rwm\-rewriteContext <context name> "[ alias <aliased context name> ]" +<Context name> is the name that identifies the context, i.e. the name +used by the application to refer to the set of rules it contains. +It is used also to reference sub contexts in string rewriting. +A context may alias another one. +In this case the alias context contains no rule, and any reference to +it will result in accessing the aliased one. +.TP +.B rwm\-rewriteRule "<regex match pattern>" "<substitution pattern>" "[ <flags> ]" +Determines how a string can be rewritten if a pattern is matched. +Examples are reported below. +.SH "Additional Configuration Syntax" +.TP +.B rwm\-rewriteMap "<map type>" "<map name>" "[ <map attrs> ]" +Allows one to define a map that transforms substring rewriting into +something else. +The map is referenced inside the substitution pattern of a rule. +.TP +.B rwm\-rewriteParam <param name> <param value> +Sets a value with global scope, that can be dereferenced by the +command `${$paramName}'. +.TP +.B rwm\-rewriteMaxPasses <number of passes> [<number of passes per rule>] +Sets the maximum number of total rewriting passes that can be +performed in a single rewrite operation (to avoid loops). +A safe default is set to 100; note that reaching this limit is still +treated as a success; recursive invocation of rules is simply +interrupted. +The count applies to the rewriting operation as a whole, not +to any single rule; an optional per-rule limit can be set. +This limit is overridden by setting specific per-rule limits +with the `M{n}' flag. + +.SH "MAPS" +Currently, few maps are builtin but additional map types may be +registered at runtime. + +Supported maps are: +.TP +.B LDAP <URI> [bindwhen=<when>] [version=<version>] [binddn=<DN>] [credentials=<cred>] +The +.B LDAP +map expands a value by performing a simple LDAP search. +Its configuration is based on a mandatory URI, whose +.B attrs +portion must contain exactly one attribute +(use +.B entryDN +to fetch the DN of an entry). +If a multi-valued attribute is used, only the first value is considered. + +The parameter +.B bindwhen +determines when the connection is established. +It can take the values +.BR now , +.BR later , +and +.BR everytime , +respectively indicating that the connection should be created at startup, +when required, or any time it is used. +In the former two cases, the connection is cached, while in the latter +a fresh new one is used all times. This is the default. + +The parameters +.B binddn +and +.B credentials +represent the DN and the password that is used to perform an authenticated +simple bind before performing the search operation; if not given, +an anonymous connection is used. + +The parameter +.B version +can be 2 or 3 to indicate the protocol version that must be used. +The default is 3. + +.TP +.B slapd <URI> +The +.B slapd +map expands a value by performing an internal LDAP search. +Its configuration is based on a mandatory URI, which must begin with +.B "ldap:///" +(i.e., it must be an LDAP URI and it must not specify a host). +As with the +LDAP map, the +.B attrs +portion must contain exactly one attribute, and if +a multi-valued attribute is used, only the first value is considered. + +.SH "REWRITE CONFIGURATION EXAMPLES" +.nf +# set to `off' to disable rewriting +rwm\-rewriteEngine on + +# the rules the "suffixmassage" directive implies +rwm\-rewriteEngine on +# all dataflow from client to server referring to DNs +rwm\-rewriteContext default +rwm\-rewriteRule "(.+,)?<virtualnamingcontext>$" "$1<realnamingcontext>" ":" +# empty filter rule +rwm\-rewriteContext searchFilter +# all dataflow from server to client +rwm\-rewriteContext searchEntryDN +rwm\-rewriteRule "(.+,)?<realnamingcontext>$" "$1<virtualnamingcontext>" ":" +rwm\-rewriteContext searchAttrDN alias searchEntryDN +rwm\-rewriteContext matchedDN alias searchEntryDN +# misc empty rules +rwm\-rewriteContext referralAttrDN +rwm\-rewriteContext referralDN + +# Everything defined here goes into the `default' context. +# This rule changes the naming context of anything sent +# to `dc=home,dc=net' to `dc=OpenLDAP, dc=org' + +rwm\-rewriteRule "(.+,)?dc=home,[ ]?dc=net$" + "$1dc=OpenLDAP, dc=org" ":" + +# since a pretty/normalized DN does not include spaces +# after rdn separators, e.g. `,', this rule suffices: + +rwm\-rewriteRule "(.+,)?dc=home,dc=net$" + "$1dc=OpenLDAP,dc=org" ":" + +# Start a new context (ends input of the previous one). +# This rule adds blanks between DN parts if not present. +rwm\-rewriteContext addBlanks +rwm\-rewriteRule "(.*),([^ ].*)" "$1, $2" + +# This one eats blanks +rwm\-rewriteContext eatBlanks +rwm\-rewriteRule "(.*), (.*)" "$1,$2" + +# Here control goes back to the default rewrite +# context; rules are appended to the existing ones. +# anything that gets here is piped into rule `addBlanks' +rwm\-rewriteContext default +rwm\-rewriteRule ".*" "${>addBlanks($0)}" ":" + +.\" # Anything with `uid=username' is looked up in +.\" # /etc/passwd for gecos (I know it's nearly useless, +.\" # but it is there just as a guideline to implementing +.\" # custom maps). +.\" # Note the `I' flag that leaves `uid=username' in place +.\" # if `username' does not have a valid account, and the +.\" # `:' that forces the rule to be processed exactly once. +.\" rwm\-rewriteContext uid2Gecos +.\" rwm\-rewriteRule "(.*)uid=([a\-z0\-9]+),(.+)" +.\" "$1cn=$2{xpasswd},$3" "I:" +.\" +.\" # Finally, in a bind, if one uses a `uid=username' DN, +.\" # it is rewritten in `cn=name surname' if possible. +.\" rwm\-rewriteContext bindDN +.\" rwm\-rewriteRule ".*" "${>addBlanks(${>uid2Gecos($0)})}" ":" +.\" +# Rewrite the search base according to `default' rules. +rwm\-rewriteContext searchDN alias default + +# Search results with OpenLDAP DN are rewritten back with +# `dc=home,dc=net' naming context, with spaces eaten. +rwm\-rewriteContext searchEntryDN +rwm\-rewriteRule "(.*[^ ],)?[ ]?dc=OpenLDAP,[ ]?dc=org$" + "${>eatBlanks($1)}dc=home,dc=net" ":" + +# Bind with email instead of full DN: we first need +# an ldap map that turns attributes into a DN (the +# argument used when invoking the map is appended to +# the URI and acts as the filter portion) +rwm\-rewriteMap ldap attr2dn "ldap://host/dc=my,dc=org?dn?sub" + +# Then we need to detect DN made up of a single email, +# e.g. `mail=someone@example.com'; note that the rule +# in case of match stops rewriting; in case of error, +# it is ignored. In case we are mapping virtual +# to real naming contexts, we also need to rewrite +# regular DNs, because the definition of a bindDN +# rewrite context overrides the default definition. +rwm\-rewriteContext bindDN +rwm\-rewriteRule "^mail=[^,]+@[^,]+$" "${attr2dn($0)}" ":@I" + +# This is a rather sophisticated example. It massages a +# search filter in case who performs the search has +# administrative privileges. First we need to keep +# track of the bind DN of the incoming request, which is +# stored in a variable called `binddn' with session scope, +# and left in place to allow regular binding: +rwm\-rewriteContext bindDN +rwm\-rewriteRule ".+" "${&&binddn($0)}$0" ":" + +# A search filter containing `uid=' is rewritten only +# if an appropriate DN is bound. +# To do this, in the first rule the bound DN is +# dereferenced, while the filter is decomposed in a +# prefix, in the value of the `uid=<arg>' AVA, and +# in a suffix. A tag `<>' is appended to the DN. +# If the DN refers to an entry in the `ou=admin' subtree, +# the filter is rewritten OR-ing the `uid=<arg>' with +# `cn=<arg>'; otherwise it is left as is. This could be +# useful, for instance, to allow apache's auth_ldap-1.4 +# module to authenticate users with both `uid' and +# `cn', but only if the request comes from a possible +# `cn=Web auth,ou=admin,dc=home,dc=net' user. +rwm\-rewriteContext searchFilter +rwm\-rewriteRule "(.*\e\e()uid=([a\-z0\-9_]+)(\e\e).*)" + "${**binddn}<>${&prefix($1)}${&arg($2)}${&suffix($3)}" + ":I" +rwm\-rewriteRule "^[^,]+,ou=admin,dc=home,dc=net$" + "${*prefix}|(uid=${*arg})(cn=${*arg})${*suffix}" ":@I" +rwm\-rewriteRule ".*<>$" "${*prefix}uid=${*arg}${*suffix}" ":" + +# This example shows how to strip unwanted DN-valued +# attribute values from a search result; the first rule +# matches DN values below "ou=People,dc=example,dc=com"; +# in case of match the rewriting exits successfully. +# The second rule matches everything else and causes +# the value to be rejected. +rwm\-rewriteContext searchEntryDN +rwm\-rewriteRule ".+,ou=People,dc=example,dc=com$" "$0" ":@" +rwm\-rewriteRule ".*" "" "#" +.fi +.SH "MAPPING EXAMPLES" +The following directives map the object class `groupOfNames' to +the object class `groupOfUniqueNames' and the attribute type +`member' to the attribute type `uniqueMember': +.LP +.RS +.nf +map objectclass groupOfNames groupOfUniqueNames +map attribute uniqueMember member +.fi +.RE +.LP +This presents a limited attribute set from the foreign +server: +.LP +.RS +.nf +map attribute cn * +map attribute sn * +map attribute manager * +map attribute description * +map attribute * +.fi +.RE +.LP +These lines map cn, sn, manager, and description to themselves, and +any other attribute gets "removed" from the object before it is sent +to the client (or sent up to the LDAP server). This is obviously a +simplistic example, but you get the point. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd\-ldap (5), +.BR slapd\-meta (5), +.BR slapd\-relay (5), +.BR slapd (8), +.BR regex (7), +.BR re_format (7). +.SH AUTHOR +Pierangelo Masarati; based on back-ldap rewrite/remap features +by Howard Chu, Pierangelo Masarati. diff --git a/doc/man/man5/slapo-sssvlv.5 b/doc/man/man5/slapo-sssvlv.5 new file mode 100644 index 0000000..cf80d92 --- /dev/null +++ b/doc/man/man5/slapo-sssvlv.5 @@ -0,0 +1,57 @@ +.TH SLAPO-SSSVLV 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2009-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copyright 2009 Symas Corporation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-sssvlv \- Server Side Sorting and Virtual List View overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +This overlay implements the LDAP Server Side Sorting (RFC2891) control +as well as the Virtual List View control. It also replaces the default +implementation of the LDAP PagedResults (RFC2696) control, to ensure +that it works with Sorting. The overlay can be used with any backend +or globally for all backends. + +Since a complete result set must be generated in memory before sorting can +be performed, processing sort requests can have a large impact on the +server's memory use. As such, any connection is limited to having only +a limited number of sort requests active at a time. Additional limits may +be configured as described below. + +.SH CONFIGURATION +These +.B slapd.conf +options apply to the SSSVLV overlay. +They should appear after the +.B overlay +directive. +.TP +.B sssvlv\-max <num> +Set the maximum number of concurrent sort requests allowed across all +connections. The default is one half of the number of server threads. +.TP +.B sssvlv\-maxkeys <num> +Set the maximum number of keys allowed in a sort request. The default is 5. +.TP +.B sssvlv\-maxperconn <num> +Set the maximum number of concurrent paged search requests per connection. The default is 5. The number of concurrent requests remains limited by +.B sssvlv-max. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.TP +ETCDIR/slapd.d +default slapd configuration directory +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5). +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.LP +IETF LDAP Virtual List View proposal by D. Boreham, J. Sermersheim, +and A. Kashi in IETF document "draft-ietf-ldapext-ldapv3-vlv-09.txt". +.SH AUTHOR +Howard Chu diff --git a/doc/man/man5/slapo-syncprov.5 b/doc/man/man5/slapo-syncprov.5 new file mode 100644 index 0000000..0940f1d --- /dev/null +++ b/doc/man/man5/slapo-syncprov.5 @@ -0,0 +1,73 @@ +.TH SLAPO-SYNCPROV 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2004-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-syncprov \- Sync Provider overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The Sync Provider overlay implements the provider-side support for the +LDAP Content Synchronization (RFC4533) as well as syncrepl replication +support. The overlay +can be used with any backend that maintains entryCSN and entryUUID +attributes for its entries. It also creates a contextCSN attribute in +the root entry of the database. + +The contextCSN is updated for every write operation performed against the +database. To reduce database contention, the contextCSN is only updated in +memory. The value is written to the database on server shutdown and read into +memory on startup, and maintained in memory thereafter. Checkpoints may be +configured to write the contextCSN into the underlying database to minimize +recovery time after an unclean shutdown. + +On databases that support inequality indexing, it is mandatory to set an +eq index on the entryCSN attribute when using this overlay. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the Sync Provider overlay. +They should appear after the +.B overlay +directive. +.TP +.B syncprov\-checkpoint <ops> <minutes> +After a write operation has succeeded, write the contextCSN to the underlying +database if +.B <ops> +write operations or more than +.B <minutes> +time have passed +since the last checkpoint. Checkpointing is disabled by default. +.TP +.B syncprov\-sessionlog <ops> +Configures an in-memory session log for recording information about write +operations made on the database. The +.B <ops> +specifies the number of operations that are recorded in the log. All write +operations (except Adds) are recorded in the log. +When using the session log, it is helpful to set an eq index on the +entryUUID attribute in the underlying database. +.TP +.B syncprov\-nopresent TRUE | FALSE +Specify that the Present phase of refreshing should be skipped. This value +should only be set TRUE for a syncprov instance on top of a log database +(such as one managed by the accesslog overlay). +The default is FALSE. +.TP +.B syncprov\-reloadhint TRUE | FALSE +Specify that the overlay should honor the reloadHint flag in the Sync +Control. It must be set TRUE when using the accesslog overlay for +delta-based syncrepl replication support. +The default is FALSE. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapo\-accesslog (5). +OpenLDAP Administrator's Guide. +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man5/slapo-translucent.5 b/doc/man/man5/slapo-translucent.5 new file mode 100644 index 0000000..19906d7 --- /dev/null +++ b/doc/man/man5/slapo-translucent.5 @@ -0,0 +1,133 @@ +.TH SLAPO-TRANSLUCENT 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2004-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-translucent \- Translucent Proxy overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The Translucent Proxy overlay can be used with a backend database such as +.BR slapd\-bdb (5) +to create a "translucent proxy". Entries retrieved from a remote LDAP +server may have some or all attributes overridden, or new attributes +added, by entries in the local database before being presented to the +client. +.LP +A +.BR search +operation is first populated with entries from the remote LDAP server, the +attributes of which are then overridden with any attributes defined in the +local database. Local overrides may be populated with the +.BR add , +.B modify , +and +.B modrdn +operations, the use of which is restricted to the root user. +.LP +A +.BR compare +operation will perform a comparison with attributes defined in the local +database record (if any) before any comparison is made with data in the +remote database. +.SH CONFIGURATION +The Translucent Proxy overlay uses a proxied database, +typically a (set of) remote LDAP server(s), which is configured with the options shown in +.BR slapd\-ldap (5), +.BR slapd\-meta (5) +or similar. +These +.B slapd.conf +options are specific to the Translucent Proxy overlay; they must appear +after the +.B overlay +directive that instantiates the +.B translucent +overlay. +.TP +.B translucent_strict +By default, attempts to delete attributes in either the local or remote +databases will be silently ignored. The +.B translucent_strict +directive causes these modifications to fail with a Constraint Violation. +.TP +.B translucent_no_glue +This configuration option disables the automatic creation of "glue" records +for an +.B add +or +.B modrdn +operation, such that all parents of an entry added to the local database +must be created by hand. Glue records are always created for a +.B modify +operation. +.TP +.B translucent_local <attr[,attr...]> +Specify a list of attributes that should be searched for in the local database +when used in a search filter. By default, search filters are only handled by +the remote database. With this directive, search filters will be split into a +local and remote portion, and local attributes will be searched locally. +.TP +.B translucent_remote <attr[,attr...]> +Specify a list of attributes that should be searched for in the remote database +when used in a search filter. This directive complements the +.B translucent_local +directive. Attributes may be specified as both local and remote if desired. +.LP +If neither +.B translucent_local +nor +.B translucent_remote +are specified, the default behavior is to search the remote database with the +complete search filter. If only +.B translucent_local +is specified, searches will only be run on the local database. Likewise, if only +.B translucent_remote +is specified, searches will only be run on the remote database. In any case, both +the local and remote entries corresponding to a search result will be merged +before being returned to the client. + +.TP +.B translucent_bind_local +Enable looking for locally stored credentials for simple bind when binding +to the remote database fails. Disabled by default. + +.TP +.B translucent_pwmod_local +Enable RFC 3062 Password Modification extended operation on locally stored +credentials. The operation only applies to entries that exist in the remote +database. Disabled by default. + +.SH ACCESS CONTROL +Access control is delegated to either the remote DSA(s) or to the local database +backend for +.B auth +and +.B write +operations. +It is delegated to the remote DSA(s) and to the frontend for +.B read +operations. +Local access rules involving data returned by the remote DSA(s) should be designed +with care. In fact, entries are returned by the remote DSA(s) only based on the +remote fraction of the data, based on the identity the operation is performed as. +As a consequence, local rules might only be allowed to see a portion +of the remote data. + +.SH CAVEATS +.LP +The Translucent Proxy overlay will disable schema checking in the local database, +so that an entry consisting of overlay attributes need not adhere to the +complete schema. +.LP +Because the translucent overlay does not perform any DN rewrites, the local +and remote database instances must have the same suffix. Other configurations +will probably fail with No Such Object and other errors. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd\-ldap (5). diff --git a/doc/man/man5/slapo-unique.5 b/doc/man/man5/slapo-unique.5 new file mode 100644 index 0000000..b23a202 --- /dev/null +++ b/doc/man/man5/slapo-unique.5 @@ -0,0 +1,175 @@ +.TH SLAPO-UNIQUE 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2004-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-unique \- Attribute Uniqueness overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The Attribute Uniqueness overlay can be used with a backend database such as +.BR slapd\-mdb (5) +to enforce the uniqueness of some or all attributes within a +scope. This subtree defaults to all objects within the subtree of the +database for which the Uniqueness overlay is configured. +.LP +Uniqueness is enforced by searching the subtree to ensure that the values of +all attributes presented with an +.BR add , +.B modify +or +.B modrdn +operation are unique within the scope. +For example, if uniqueness were enforced for the +.B uid +attribute, the subtree would be searched for any other records which also +have a +.B uid +attribute containing the same value. If any are found, the request is +rejected. +.LP +The search is performed using the rootdn of the database, to avoid issues +with ACLs preventing the overlay from seeing all of the relevant data. As +such, the database must have a rootdn configured. +.SH CONFIGURATION +These +.B slapd.conf +options apply to the Attribute Uniqueness overlay. +They should appear after the +.B overlay +directive. +.TP +.B unique_uri <[strict ][ignore ]URI[URI...]...> +Configure the base, attributes, scope, and filter for uniqueness +checking. Multiple URIs may be specified within a domain, +allowing complex selections of objects. Multiple +.B unique_uri +statements or +.B olcUniqueURI +attributes will create independent domains, each with their own +independent lists of URIs and ignore/strict settings. + +Keywords +.B strict +and +.B ignore +have to be enclosed in quotes (") together with the URI. + +The LDAP URI syntax is a subset of +.B RFC-4516, +and takes the form: + +ldap:///[base dn]?[attributes...]?scope[?filter] + +The +.B base dn +defaults to that of the back-end database. +Specified base dns must be within the subtree of the back-end database. + +If no +.B attributes +are specified, the URI applies to all non-operational attributes. + +The +.B scope +component is effectively mandatory, because LDAP URIs default to +.B base +scope, which is not valid for uniqueness, because groups of one object +are always unique. Scopes of +.B sub +(for subtree) and +.B one +for one-level are valid. + +The +.B filter +component causes the domain to apply uniqueness constraints only to +matching objects. e.g. +.B ldap:///?cn?sub?(sn=e*) +would require unique +.B cn +attributes for all objects in the subtree of the back-end database whose +.B sn +starts with an e. + +It is possible to assert uniqueness upon all non-operational +attributes except those listed by prepending the keyword +.B ignore +If not configured, all non-operational (e.g., system) attributes must be +unique. Note that the +.B attributes +list of an +.B ignore +URI should generally contain the +.BR objectClass , +.BR dc , +.B ou +and +.B o +attributes, as these will generally not be unique, nor are they operational +attributes. + +It is possible to set strict checking for the uniqueness domain by +prepending the keyword +.B strict. +By default, uniqueness is not enforced +for null values. Enabling +.B strict +mode extends the concept of uniqueness to include null values, such +that only one attribute within a subtree will be allowed to have a +null value. Strictness applies to all URIs within a uniqueness +domain, but some domains may be strict while others are not. +.LP +It is not possible to set both URIs and legacy slapo\-unique configuration +parameters simultaneously. In general, the legacy configuration options +control pieces of a single unfiltered subtree domain. +.TP +.B unique_base <basedn> +This legacy configuration parameter should be converted to the +.B base dn +component of the above +.B unique_uri +style of parameter. +.TP +.B unique_ignore <attribute...> +This legacy configuration parameter should be converted to a +.B unique_uri +parameter with +.B ignore +keyword as described above. +.TP +.B unique_attributes <attribute...> +This legacy configuration parameter should be converted to a +.B unique_uri +parameter, as described above. +.TP +.B unique_strict <attribute...> +This legacy configuration parameter should be converted to a +.B strict +keyword prepended to a +.B unique_uri +parameter, as described above. +.SH CAVEATS +.LP +.B unique_uri +cannot be used with the old-style of configuration, and vice versa. +.B unique_uri +can implement everything the older system can do, however. +.LP +Typical attributes for the +.B ignore ldap:///... +URIs are intentionally not hardcoded into the overlay to allow for +maximum flexibility in meeting site-specific requirements. +.LP +Replication and operations with +.B manageDsaIt +control are allowed to bypass this enforcement. It is therefore important that +all servers accepting writes have this overlay configured in order to maintain +uniqueness in a replicated DIT. +.SH FILES +.TP +ETCDIR/slapd.conf +default slapd configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5). diff --git a/doc/man/man5/slapo-valsort.5 b/doc/man/man5/slapo-valsort.5 new file mode 100644 index 0000000..217d2b0 --- /dev/null +++ b/doc/man/man5/slapo-valsort.5 @@ -0,0 +1,97 @@ +.TH SLAPO-VALSORT 5 "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2005-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapo\-valsort \- Value Sorting overlay to slapd +.SH SYNOPSIS +ETCDIR/slapd.conf +.SH DESCRIPTION +The Value Sorting overlay can be used with a backend database to sort the +values of specific multi-valued attributes within a subtree. The sorting +occurs whenever the attributes are returned in a search response. +.LP +Sorting can be specified in ascending or descending order, using either +numeric or alphanumeric sort methods. Additionally, a "weighted" sort can +be specified, which uses a numeric weight prepended to the attribute values. +The weighted sort is always performed in ascending order, but may be combined +with the other methods for values that all have equal weights. The weight +is specified by prepending an integer weight {<\fIweight\fP>} +in front of each value of the attribute for which weighted sorting is +desired. This weighting factor is stripped off and not returned in search +results unless the valsort control is specified (1.3.6.1.4.1.4203.666.5.14). + +The valsort control requires a value consisting of a Sequence that contains +a boolean flag. The weighting factor is only returned if the boolean value is TRUE. In +.BR lber-encode (3) +format, the required value must conform to "{b}" syntax. + +.SH CONFIGURATION +These +.I slapd.conf +options apply to the Value Sorting overlay. +They should appear after the +.B overlay +directive. +.TP +valsort\-attr <\fIattribute\fP> <\fIbaseDN\fP> (<\fIsort-method\fP> | weighted [<\fIsort-method\fP>]) +Configure a sorting method for the specified +.I attribute +in the subtree rooted at +.IR baseDN . +The +.I sort-method +may be one of +.BR alpha\-ascend , +.BR alpha\-descend , +.BR numeric\-ascend , +or +.BR numeric\-descend . +If the special +.B weighted +method is specified, a secondary +.I sort-method +may also be specified. It is an +error to specify an alphanumeric +.I sort-method +for an attribute with Integer +or NumericString syntax, and it is an error to specify a numeric +.I sort-method +for an attribute with a syntax other than Integer or NumericString. +.SH EXAMPLES +.LP +.nf + database bdb + suffix dc=example,dc=com + ... + overlay valsort + valsort\-attr member ou=groups,dc=example,dc=com alpha\-ascend +.fi + +To invoke +.BR ldapsearch (1) +with the valsort control, the control value must be set appropriately. +The following octets represent the desired "{b}" encoding: +.LP +.nf + 0x30 0x03 0x01 0x01 0xff +.fi + +The control can be sent from the command-line using the base64 +encoding of the value: +.LP +.nf + ldapsearch \-E 1.3.6.1.4.1.4203.666.5.14=::MAMBAf8= +.fi + +.SH FILES +.TP +\fIETCDIR/slapd.conf\fP +default \fBslapd\fP configuration file +.SH SEE ALSO +.BR slapd.conf (5), +.BR slapd\-config (5). +.SH ACKNOWLEDGEMENTS +.P +This module was written in 2005 by Howard Chu of Symas Corporation. The +work was sponsored by Stanford University. diff --git a/doc/man/man8/Makefile.in b/doc/man/man8/Makefile.in new file mode 100644 index 0000000..1b18a45 --- /dev/null +++ b/doc/man/man8/Makefile.in @@ -0,0 +1,16 @@ +# man8 Makefile.in for OpenLDAP +# $OpenLDAP$ +## This work is part of OpenLDAP Software <http://www.openldap.org/>. +## +## Copyright 1998-2018 The OpenLDAP Foundation. +## All rights reserved. +## +## Redistribution and use in source and binary forms, with or without +## modification, are permitted only as authorized by the OpenLDAP +## Public License. +## +## A copy of this license is available in the file LICENSE in the +## top-level directory of the distribution or, alternatively, at +## <http://www.OpenLDAP.org/license.html>. + +MANSECT=8 diff --git a/doc/man/man8/slapacl.8 b/doc/man/man8/slapacl.8 new file mode 100644 index 0000000..d3c50f4 --- /dev/null +++ b/doc/man/man8/slapacl.8 @@ -0,0 +1,203 @@ +.TH SLAPACL 8C "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2004-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapacl \- Check access to a list of attributes. +.SH SYNOPSIS +.B SBINDIR/slapacl +.BI \-b \ DN +[\c +.BI \-d \ debug-level\fR] +[\c +.BI \-D \ authcDN\ \fR| +.BI \-U \ authcID\fR] +[\c +.BI \-f \ slapd.conf\fR] +[\c +.BI \-F \ confdir\fR] +[\c +.BI \-o \ option\fR[ = value\fR]] +[\c +.BR \-u ] +[\c +.BR \-v ] +[\c +.BI \-X \ authzID\ \fR| +.BI "\-o \ authzDN=" DN\fR] +[\c +.IR attr [\fB/\fI access ][\fB:\fI value ]]\fR\ [...] +.LP +.SH DESCRIPTION +.LP +.B slapacl +is used to check the behavior of +.BR slapd (8) +by verifying access to directory data according to the access control list +directives defined in its configuration. +. +It opens the +.BR slapd.conf (5) +configuration file or the +.BR slapd\-config (5) +backend, reads in the +.BR access / olcAccess +directives, and then parses the +.B attr +list given on the command-line; if none is given, access to the +.B entry +pseudo-attribute is tested. +.LP +.SH OPTIONS +.TP +.BI \-b \ DN +specify the +.I DN +which access is requested to; the corresponding entry is fetched +from the database, and thus it must exist. +The +.I DN +is also used to determine what rules apply; thus, it must be +in the naming context of a configured database. See also +.BR \-u . +.TP +.BI \-d \ debug-level +enable debugging messages as defined by the specified +.IR debug-level ; +see +.BR slapd (8) +for details. +.TP +.BI \-D \ authcDN +specify a DN to be used as identity through the test session +when selecting appropriate +.B <by> +clauses in access lists. +.TP +.BI \-f \ slapd.conf +specify an alternative +.BR slapd.conf (5) +file. +.TP +.BI \-F \ confdir +specify a config directory. +If both +.B \-f +and +.B \-F +are specified, the config file will be read and converted to +config directory format and written to the specified directory. +If neither option is specified, an attempt to read the +default config directory will be made before trying to use the default +config file. If a valid config directory exists then the +default config file is ignored. +.TP +.BI \-o \ option\fR[ = value\fR] +Specify an +.I option +with a(n optional) +.IR value . +Possible generic options/values are: +.LP +.nf + syslog=<subsystems> (see `\-s' in slapd(8)) + syslog\-level=<level> (see `\-S' in slapd(8)) + syslog\-user=<user> (see `\-l' in slapd(8)) + +.fi +.RS +Possible options/values specific to +.B slapacl +are: +.RE +.nf + + authzDN + domain + peername + sasl_ssf + sockname + sockurl + ssf + tls_ssf + transport_ssf + +.fi +.RS +See the related fields in +.BR slapd.access (5) +for details. +.RE +.TP +.BI \-u +do not fetch the entry from the database. +In this case, if the entry does not exist, a fake entry with the +.I DN +given with the +.B \-b +option is used, with no attributes. +As a consequence, those rules that depend on the contents +of the target object will not behave as with the real object. +The +.I DN +given with the +.B \-b +option is still used to select what rules apply; thus, it must be +in the naming context of a configured database. +See also +.BR \-b . +.TP +.BI \-U \ authcID +specify an ID to be mapped to a +.B DN +as by means of +.B authz\-regexp +or +.B authz\-rewrite +rules (see +.BR slapd.conf (5) +for details); mutually exclusive with +.BR \-D . +.TP +.B \-v +enable verbose mode. +.TP +.BI \-X \ authzID +specify an authorization ID to be mapped to a +.B DN +as by means of +.B authz\-regexp +or +.B authz\-rewrite +rules (see +.BR slapd.conf (5) +for details); mutually exclusive with \fB\-o\fP \fBauthzDN=\fIDN\fR. +.SH EXAMPLES +The command +.LP +.nf +.ft tt + SBINDIR/slapacl \-f ETCDIR/slapd.conf \-v \\ + \-U bjorn \-b "o=University of Michigan,c=US" \\ + "o/read:University of Michigan" + +.ft +.fi +tests whether the user +.I bjorn +can access the attribute +.I o +of the entry +.I o=University of Michigan,c=US +at +.I read +level. +.SH "SEE ALSO" +.BR ldap (3), +.BR slapd (8), +.BR slaptest (8), +.BR slapauth (8) +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man8/slapadd.8 b/doc/man/man8/slapadd.8 new file mode 100644 index 0000000..938a8f0 --- /dev/null +++ b/doc/man/man8/slapadd.8 @@ -0,0 +1,217 @@ +.TH SLAPADD 8C "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapadd \- Add entries to a SLAPD database +.SH SYNOPSIS +.B SBINDIR/slapadd +[\c +.BI \-b \ suffix\fR] +[\c +.BR \-c ] +[\c +.BI \-d \ debug-level\fR] +[\c +.BI \-f \ slapd.conf\fR] +[\c +.BI \-F \ confdir\fR] +[\c +.BR \-g ] +[\c +.BI \-j \ lineno\fR] +[\c +.BI \-l \ ldif-file\fR] +[\c +.BI \-n \ dbnum\fR] +[\c +.BI \-o \ option\fR[ = value\fR]] +[\c +.BR \-q ] +[\c +.BR \-s ] +[\c +.BI \-S \ SID\fR] +[\c +.BR \-u ] +[\c +.BR \-v ] +[\c +.BR \-w ] +.SH DESCRIPTION +.LP +.B Slapadd +is used to add entries specified in LDAP Directory Interchange Format +(LDIF) to a +.BR slapd (8) +database. +It opens the given database determined by the database number or +suffix and adds entries corresponding to the provided LDIF to +the database. +Databases configured as +.B subordinate +of this one are also updated, unless \fB\-g\fP is specified. +The LDIF input is read from standard input or the specified file. + +All files eventually created by +.BR slapadd +will belong to the identity +.BR slapadd +is run as, so make sure you either run +.BR slapadd +with the same identity +.BR slapd (8) +will be run as (see option +.B \-u +in +.BR slapd (8)), +or change file ownership before running +.BR slapd (8). + +Note: slapadd will also perform the relevant indexing whilst adding the database if +any are configured. For specific details, please see +.BR slapindex (8). +.SH OPTIONS +.TP +.BI \-b \ suffix +Use the specified \fIsuffix\fR to determine which database to +add entries to. The \fB\-b\fP cannot be used in conjunction +with the +.B \-n +option. +.TP +.B \-c +enable continue (ignore errors) mode. +.TP +.BI \-d \ debug-level +enable debugging messages as defined by the specified +.IR debug-level ; +see +.BR slapd (8) +for details. +.TP +.BI \-f \ slapd.conf +specify an alternative +.BR slapd.conf (5) +file. +.TP +.BI \-F \ confdir +specify a config directory. +If both +.B \-f +and +.B \-F +are specified, the config file will be read and converted to +config directory format and written to the specified directory. +If neither option is specified, an attempt to read the +default config directory will be made before trying to use the default +config file. If a valid config directory exists then the +default config file is ignored. If dry-run mode is also specified, +no conversion will occur. +.TP +.B \-g +disable subordinate gluing. Only the specified database will be +processed, and not its glued subordinates (if any). +.TP +.BI \-j \ lineno +Jump to the specified line number in the LDIF file before processing +any entries. This allows a load that was aborted due to errors in the +input LDIF to be resumed after the errors are corrected. +.TP +.BI \-l \ ldif-file +Read LDIF from the specified file instead of standard input. +.TP +.BI \-n \ dbnum +Add entries to the \fIdbnum\fR-th database listed in the +configuration file. The +.B \-n +cannot be used in conjunction with the +.B \-b +option. +To populate the config database +.BR slapd\-config (5), +use +.B \-n 0 +as it is always the first database. It must physically exist +on the filesystem prior to this, however. +.TP +.BI \-o \ option\fR[ = value\fR] +Specify an +.I option +with a(n optional) +.IR value . +Possible generic options/values are: +.LP +.nf + syslog=<subsystems> (see `\-s' in slapd(8)) + syslog\-level=<level> (see `\-S' in slapd(8)) + syslog\-user=<user> (see `\-l' in slapd(8)) + + schema-check={yes|no} + value-check={yes|no} + +.in +The \fIschema\-check\fR option toggles schema checking (default on); +the \fIvalue\-check\fR option toggles value checking (default off). +The latter is incompatible with \fB-q\fR. +.TP +.B \-q +enable quick (fewer integrity checks) mode. Does fewer consistency checks +on the input data, and no consistency checks when writing the database. +Improves the load time but if any errors or interruptions occur the resulting +database will be unusable. +.TP +.B \-s +disable schema checking. This option is intended to be used when loading +databases containing special objects, such as fractional objects on a +partial replica. Loading normal objects which do not conform to +schema may result in unexpected and ill behavior. +.TP +.BI \-S \ SID +Server ID to use in generated entryCSN. Also used for contextCSN +if \fB\-w\fP is set as well. Defaults to \fB0\fP. +.TP +.B \-u +enable dry-run (don't write to backend) mode. +.TP +.B \-v +enable verbose mode. +.TP +.BI \-w +write syncrepl context information. +After all entries are added, the contextCSN +will be updated with the greatest CSN in the database. +.SH LIMITATIONS +Your +.BR slapd (8) +should not be running +when you do this to ensure consistency of the database. +.LP +.B slapadd +may not provide naming or schema checks. It is advisable to +use +.BR ldapadd (1) +when adding new entries into an existing directory. +.SH EXAMPLES +To import the entries specified in file +.B ldif +into your +.BR slapd (8) +database give the command: +.LP +.nf +.ft tt + SBINDIR/slapadd \-l ldif +.ft +.fi +.SH "SEE ALSO" +.BR ldap (3), +.BR ldif (5), +.BR slapcat (8), +.BR slapindex (8), +.BR ldapadd (1), +.BR slapd (8) +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man8/slapauth.8 b/doc/man/man8/slapauth.8 new file mode 100644 index 0000000..1fa8f87 --- /dev/null +++ b/doc/man/man8/slapauth.8 @@ -0,0 +1,152 @@ +.TH SLAPAUTH 8C "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2004-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapauth \- Check a list of string-represented IDs for LDAP authc/authz +.SH SYNOPSIS +.B SBINDIR/slapauth +[\c +.BI \-d \ debug-level\fR] +[\c +.BI \-f \ slapd.conf\fR] +[\c +.BI \-F \ confdir\fR] +[\c +.BI \-M \ mech\fR] +[\c +.BI \-o \ option\fR[ = value\fR]] +[\c +.BI \-R \ realm\fR] +[\c +.BI \-U \ authcID\fR] +[\c +.BR \-v ] +[\c +.BI \-X \ authzID\fR] +.IR ID \ [ ... ] +.LP +.SH DESCRIPTION +.LP +.B Slapauth +is used to check the behavior of the slapd in mapping identities +for authentication and authorization purposes, as specified in +.BR slapd.conf (5). +It opens the +.BR slapd.conf (5) +configuration file or the +.BR slapd\-config (5) +backend, reads in the +.BR authz\-policy / olcAuthzPolicy +and +.BR authz\-regexp / olcAuthzRegexp +directives, and then parses the +.I ID +list given on the command-line. +.LP +.SH OPTIONS +.TP +.BI \-d \ debug-level +enable debugging messages as defined by the specified +.IR debug-level ; +see +.BR slapd (8) +for details. +.TP +.BI \-f \ slapd.conf +specify an alternative +.BR slapd.conf (5) +file. +.TP +.BI \-F \ confdir +specify a config directory. +If both +.B \-f +and +.B \-F +are specified, the config file will be read and converted to +config directory format and written to the specified directory. +If neither option is specified, an attempt to read the +default config directory will be made before trying to use the default +config file. If a valid config directory exists then the +default config file is ignored. +.TP +.BI \-M \ mech +specify a mechanism. +.TP +.BI \-o \ option\fR[ = value\fR] +Specify an +.I option +with a(n optional) +.IR value . +Possible generic options/values are: +.LP +.nf + syslog=<subsystems> (see `\-s' in slapd(8)) + syslog\-level=<level> (see `\-S' in slapd(8)) + syslog\-user=<user> (see `\-l' in slapd(8)) + +.fi +.TP +.BI \-R \ realm +specify a realm. +.TP +.BI \-U \ authcID +specify an ID to be used as +.I authcID +throughout the test session. +If present, and if no +.I authzID +is given, the IDs in the ID list are treated as +.IR authzID . +.TP +.BI \-X \ authzID +specify an ID to be used as +.I authzID +throughout the test session. +If present, and if no +.I authcID +is given, the IDs in the ID list are treated as +.IR authcID . +If both +.I authcID +and +.I authzID +are given via command line switch, the ID list cannot be present. +.TP +.B \-v +enable verbose mode. +.SH EXAMPLES +The command +.LP +.nf +.ft tt + SBINDIR/slapauth \-f /ETCDIR/slapd.conf \-v \\ + \-U bjorn \-X u:bjensen + +.ft +.fi +tests whether the user +.I bjorn +can assume the identity of the user +.I bjensen +provided the directives +.LP +.nf +.ft tt + authz\-policy from + authz\-regexp "^uid=([^,]+).*,cn=auth$" + "ldap:///dc=example,dc=net??sub?uid=$1" + +.ft +.fi +are defined in +.BR slapd.conf (5). +.SH "SEE ALSO" +.BR ldap (3), +.BR slapd (8), +.BR slaptest (8) +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man8/slapcat.8 b/doc/man/man8/slapcat.8 new file mode 100644 index 0000000..637916c --- /dev/null +++ b/doc/man/man8/slapcat.8 @@ -0,0 +1,205 @@ +.TH SLAPCAT 8C "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapcat \- SLAPD database to LDIF utility +.SH SYNOPSIS +.B SBINDIR/slapcat +[\c +.BI \-a filter\fR] +[\c +.BI \-b suffix\fR] +[\c +.BR \-c ] +[\c +.BI \-d debug-level\fR] +[\c +.BI \-f slapd.conf\fR] +[\c +.BI \-F confdir\fR] +[\c +.BR \-g ] +[\c +.BI \-H URI\fR] +[\c +.BI \-l ldif-file\fR] +[\c +.BI \-n dbnum\fR] +[\c +.BI \-o option\fR[ = value\fR]] +[\c +.BI \-s subtree-dn\fR] +[\c +.BR \-v ] +.LP +.SH DESCRIPTION +.LP +.B Slapcat +is used to generate an LDAP Directory Interchange Format +(LDIF) output based upon the contents of a +.BR slapd (8) +database. +It opens the given database determined by the database number or +suffix and writes the corresponding LDIF to standard output or +the specified file. +Databases configured as +.B subordinate +of this one are also output, unless \fB\-g\fP is specified. +.LP +The entry records are presented in database order, not superior first +order. The entry records will include all (user and operational) +attributes stored in the database. The entry records will not include +dynamically generated attributes (such as subschemaSubentry). +.LP +The output of slapcat is intended to be used as input to +.BR slapadd (8). +The output of slapcat cannot generally be used as input to +.BR ldapadd (1) +or other LDAP clients without first editing the output. +This editing would normally include reordering the records +into superior first order and removing no-user-modification +operational attributes. +.SH OPTIONS +.TP +.BI \-a \ filter +Only dump entries matching the asserted filter. +For example + +slapcat \-a \\ + "(!(entryDN:dnSubtreeMatch:=ou=People,dc=example,dc=com))" + +will dump all but the "ou=People,dc=example,dc=com" subtree +of the "dc=example,dc=com" database. +Deprecated; use \fB-H\fP \fIldap:///???(filter)\fP instead. +.TP +.BI \-b \ suffix +Use the specified \fIsuffix\fR to determine which database to +generate output for. The \fB\-b\fP cannot be used in conjunction +with the +.B \-n +option. +.TP +.B \-c +Enable continue (ignore errors) mode. +Multiple occorrences of +.B \-c +make +.BR slapcat (8) +try harder. +.TP +.BI \-d \ debug-level +Enable debugging messages as defined by the specified +.IR debug-level ; +see +.BR slapd (8) +for details. +.TP +.BI \-f \ slapd.conf +Specify an alternative +.BR slapd.conf (5) +file. +.TP +.BI \-F \ confdir +specify a config directory. +If both +.B \-f +and +.B \-F +are specified, the config file will be read and converted to +config directory format and written to the specified directory. +If neither option is specified, an attempt to read the +default config directory will be made before trying to use the default +config file. If a valid config directory exists then the +default config file is ignored. +.TP +.B \-g +disable subordinate gluing. Only the specified database will be +processed, and not its glued subordinates (if any). +.TP +.B \-H \ URI +use dn, scope and filter from URI to only handle matching entries. +.TP +.BI \-l \ ldif-file +Write LDIF to specified file instead of standard output. +.TP +.BI \-n \ dbnum +Generate output for the \fIdbnum\fR-th database listed in the +configuration file. The config database +.BR slapd\-config (5), +is always the first database, so use +.B \-n 0 +to select it. + +The +.B \-n +cannot be used in conjunction with the +.B \-b +option. +.TP +.BI \-o \ option\fR[ = value\fR] +Specify an +.I option +with a(n optional) +.IR value . +Possible generic options/values are: +.LP +.nf + syslog=<subsystems> (see `\-s' in slapd(8)) + syslog\-level=<level> (see `\-S' in slapd(8)) + syslog\-user=<user> (see `\-l' in slapd(8)) + + ldif-wrap={no|<n>} + +.in +\fIn\fP is the number of columns allowed for the LDIF output +(\fIn\fP equal to \fI0\fP uses the default, corresponding to 78). +The minimum is 2, leaving space for one character and one +continuation character. +Use \fIno\fP for no wrap. +.TP +.BI \-s \ subtree-dn +Only dump entries in the subtree specified by this DN. +Implies \fB\-b\fP \fIsubtree-dn\fP if no +.B \-b +or +.B \-n +option is given. +Deprecated; use \fB-H\fP \fIldap:///subtree-dn\fP instead. +.TP +.B \-v +Enable verbose mode. +.SH LIMITATIONS +For some backend types, your +.BR slapd (8) +should not be running (at least, not in read-write +mode) when you do this to ensure consistency of the database. It is +always safe to run +.B slapcat +with the +.BR slapd\-bdb (5), +.BR slapd\-hdb (5), +.BR slapd\-mdb (5), +and +.BR slapd\-null (5) +backends. +.SH EXAMPLES +To make a text backup of your SLAPD database and put it in a file called +.BR ldif , +give the command: +.LP +.nf +.ft tt + SBINDIR/slapcat \-l ldif +.ft +.fi +.SH "SEE ALSO" +.BR ldap (3), +.BR ldif (5), +.BR slapadd (8), +.BR ldapadd (1), +.BR slapd (8) +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8 new file mode 100644 index 0000000..b554305 --- /dev/null +++ b/doc/man/man8/slapd.8 @@ -0,0 +1,362 @@ +.TH SLAPD 8C "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapd \- Stand-alone LDAP Daemon +.SH SYNOPSIS +.B LIBEXECDIR/slapd +[\c +.BR \-4 | \-6 ] +[\c +.BR \-T \ { acl \||\| a [ dd ]\||\| auth \||\| c [ at ]\||\| +.BR d [ n ]\||\| i [ ndex ]\||\| p [ asswd ]\||\| s [ chema ]\||\| t [ est ]}] +[\c +.BI \-d \ debug-level\fR] +[\c +.BI \-f \ slapd-config-file\fR] +[\c +.BI \-F \ slapd-config-directory\fR] +[\c +.BI \-h \ URLs\fR] +[\c +.BI \-n \ service-name\fR] +[\c +.BI \-s \ syslog-level\fR] +[\c +.BI \-l \ syslog-local-user\fR] +[\c +.BI \-o \ option\fR[ = value\fR]] +[\c +.BI \-r \ directory\fR] +[\c +.BI \-u \ user\fR] +[\c +.BI \-g \ group\fR] +[\c +.BI \-c \ cookie\fR] +.SH DESCRIPTION +.LP +.B Slapd +is the stand-alone LDAP daemon. It listens for LDAP connections on +any number of ports (default \fB389\fP), responding +to the LDAP operations it receives over these connections. +.B slapd +is typically invoked at boot time, usually out of +.BR /etc/rc.local . +Upon startup, +.B slapd +normally forks and disassociates itself from the invoking tty. +If configured in the config file (or config directory), +the +.B slapd +process will print its process ID (see +.BR getpid (2)) +to a +.B .pid +file, as well as the command line options during invocation to an +.B .args +file (see +.BR slapd.conf (5)). +If the +.B \-d +flag is given, even with a zero argument, +.B slapd +will not fork and disassociate from the invoking tty. +.LP +See the "OpenLDAP Administrator's Guide" for more details on +.BR slapd . +.SH OPTIONS +.TP +.B \-4 +Listen on IPv4 addresses only. +.TP +.B \-6 +Listen on IPv6 addresses only. +.TP +.BI \-T \ tool +Run in Tool mode. The \fItool\fP argument selects whether to run as +.IR slapadd , +.IR slapcat , +.IR slapdn , +.IR slapindex , +.IR slappasswd , +.IR slapschema , +or +.I slaptest +(\fIslapacl\fP and \fIslapauth\fP need the entire \fBacl\fP and \fBauth\fP +option value to be spelled out, as \fBa\fP is reserved to +.IR slapadd ). +This option should be the first option specified when it is used; +any remaining options will be interpreted by the corresponding +slap tool program, according to the respective man pages. +Note that these tool programs will usually be symbolic links to +.BR slapd . +This option is provided for situations where symbolic links +are not provided or not usable. +.TP +.BI \-d \ debug-level +Turn on debugging as defined by +.IR debug-level . +If this option is specified, even with a zero argument, +.B slapd +will not fork or disassociate from the invoking terminal. Some general +operation and status messages are printed for any value of \fIdebug-level\fP. +\fIdebug-level\fP is taken as a bit string, with each bit corresponding to a +different kind of debugging information. See <ldap_log.h> for details. +Comma-separated arrays of friendly names can be specified to select +debugging output of the corresponding debugging information. +All the names recognized by the \fIloglevel\fP directive +described in \fBslapd.conf\fP(5) are supported. +If \fIdebug-level\fP is \fB?\fP, a list of installed debug-levels is printed, +and slapd exits. + +Remember that if you turn on packet logging, packets containing bind passwords +will be output, so if you redirect the log to a logfile, that file should +be read-protected. +.TP +.BI \-s \ syslog-level +This option tells +.B slapd +at what debug-level debugging statements should be logged to the +.BR syslog (8) +facility. +The value \fIsyslog-level\fP can be set to any value or combination +allowed by the \fB\-d\fP switch. +Slapd logs all messages selected by \fIsyslog-level\fP +at the +.BR syslog (3) +severity debug-level \fBDEBUG\fP, +on the unit specified with \fB\-l\fP. +.TP +.BI \-n \ service-name +Specifies the service name for logging and other purposes. Defaults +to basename of argv[0], i.e.: "slapd". +.TP +.BI \-l \ syslog-local-user +Selects the local user of the +.BR syslog (8) +facility. Value can be +.BR LOCAL0 , +through +.BR LOCAL7 , +as well as +.B USER +and +.BR DAEMON . +The default is +.BR LOCAL4 . +However, this option is only permitted on systems that support +local users with the +.BR syslog (8) +facility. +Logging to syslog(8) occurs at the "DEBUG" severity debug-level. +.TP +.BI \-f \ slapd-config-file +Specifies the slapd configuration file. The default is +.BR ETCDIR/slapd.conf . +.TP +.BI \-F \ slapd-config-directory +Specifies the slapd configuration directory. The default is +.BR ETCDIR/slapd.d . +If both +.B \-f +and +.B \-F +are specified, the config file will be read and converted to +config directory format and written to the specified directory. +If neither option is specified, slapd will attempt to read the +default config directory before trying to use the default +config file. If a valid config directory exists then the +default config file is ignored. All of the slap tools that +use the config options observe this same behavior. +.TP +.BI \-h \ URLlist +.B slapd +will by default serve +.B ldap:/// +(LDAP over TCP on all interfaces on default LDAP port). That is, +it will bind using INADDR_ANY and port \fB389\fP. +The +.B \-h +option may be used to specify LDAP (and other scheme) URLs to serve. +For example, if slapd is given +.BR "\-h \(dqldap://127.0.0.1:9009/ ldaps:/// ldapi:///\(dq" , +it will listen on 127.0.0.1:9009 for LDAP, 0.0.0.0:636 for LDAP over TLS, +and LDAP over IPC (Unix domain sockets). Host 0.0.0.0 represents +INADDR_ANY (any interface). +A space separated list of URLs is expected. The URLs should be of +the LDAP, LDAPS, or LDAPI schemes, and generally +without a DN or other optional parameters (excepting as discussed below). +Support for the latter two schemes depends on selected configuration +options. Hosts may be specified by name or IPv4 and IPv6 address formats. +Ports, if specified, must be numeric. The default ldap:// port is \fB389\fP +and the default ldaps:// port is \fB636\fP. + +For LDAP over IPC, +.B name +is the name of the socket, and no +.B port +is required, nor allowed; note that directory separators must be +URL-encoded, like any other characters that are special to URLs; +so the socket + + /usr/local/var/ldapi + +must be specified as + + ldapi://%2Fusr%2Flocal%2Fvar%2Fldapi + +The default location for the IPC socket is LOCALSTATEDIR/run/ldapi + +The listener permissions are indicated by +"x\-mod=\-rwxrwxrwx", "x\-mod=0777" or "x\-mod=777", where any +of the "rwx" can be "\-" to suppress the related permission, while any +of the "7" can be any legal octal digit, according to chmod(1). +The listeners can take advantage of the "x\-mod" +extension to apply rough limitations to operations, e.g. allow read operations +("r", which applies to search and compare), write operations ("w", +which applies to add, delete, modify and modrdn), and execute operations +("x", which means bind is required). +"User" permissions apply to authenticated users, while "other" apply +to anonymous users; "group" permissions are ignored. +For example, "ldap:///????x\-mod=\-rw\-\-\-\-\-\-\-" means that read and write is only allowed +for authenticated connections, and bind is required for all operations. +This feature is experimental, and requires to be manually enabled +at configure time. +.TP +.BI \-r \ directory +Specifies a directory to become the root directory. slapd will +change the current working directory to this directory and +then +.BR chroot (2) +to this directory. This is done after opening listeners but before +reading any configuration file or initializing any backend. When +used as a security mechanism, it should be used in conjunction with +.B \-u +and +.B \-g +options. +.TP +.BI \-u \ user +.B slapd +will run slapd with the specified user name or id, and that user's +supplementary group access list as set with initgroups(3). The group ID +is also changed to this user's gid, unless the \fB\-g\fP option is used to +override. Note when used with +.BR \-r , +slapd will use the user database in the change root environment. + +Note that on some systems, running as a non-privileged user will prevent +passwd back-ends from accessing the encrypted passwords. Note also that +any shell back-ends will run as the specified non-privileged user. +.TP +.BI \-g \ group +.B slapd +will run with the specified group name or id. Note when used with +.BR \-r , +slapd will use the group database in the change root environment. +.TP +.BI \-c \ cookie +This option provides a cookie for the syncrepl replication consumer. +The cookie is a comma separated list of \fIname=value\fP pairs. +Currently supported syncrepl cookie fields are +.BR rid , +.BR sid , +and +.BR csn . +.B rid +identifies a replication thread within the consumer server +and is used to find the syncrepl specification in +.BR slapd.conf (5) +or +.BR slapd\-config (5) +having the matching replication identifier in its definition. The +.B rid +must be provided in order for any other specified values to be used. +.B sid +is the server id in a multi-master/mirror-mode configuration. +.B csn +is the commit sequence number received by a previous synchronization +and represents the state of the consumer replica content which the +syncrepl engine will synchronize to the current provider content. +In case of \fImirror-mode\fP or \fImulti-master\fP replication agreement, +multiple +.B csn +values, semicolon separated, can appear. +Use only the +.B rid +part to force a full reload. +.TP +.BI \-o \ option\fR[ = value\fR] +This option provides a generic means to specify options without the need to reserve +a separate letter for them. + +It supports the following options: +.RS +.TP +.BR slp= { on \||\| off \||\| \fIslp-attrs\fP } +When SLP support is compiled into slapd, disable it (\fBoff\fP), + enable it by registering at SLP DAs without specific SLP attributes (\fBon\fP), +or with specific SLP attributes +.I slp-attrs +that must be an SLP attribute list definition according to the SLP standard. + +For example, \fB"slp=(tree=production),(server-type=OpenLDAP),(server\-version=2.4.15)"\fP +registers at SLP DAs with the three SLP attributes tree, server-type and server-version +that have the values given above. +This allows one to specifically query the SLP DAs for LDAP servers holding the +.I production +tree in case multiple trees are available. +.RE +.SH EXAMPLES +To start +.I slapd +and have it fork and detach from the terminal and start serving +the LDAP databases defined in the default config file, just type: +.LP +.nf +.ft tt + LIBEXECDIR/slapd +.ft +.fi +.LP +To start +.B slapd +with an alternate configuration file, and turn +on voluminous debugging which will be printed on standard error, type: +.LP +.nf +.ft tt + LIBEXECDIR/slapd \-f /var/tmp/slapd.conf \-d 255 +.ft +.fi +.LP +To test whether the configuration file is correct or not, type: +.LP +.nf +.ft tt + LIBEXECDIR/slapd \-Tt +.ft +.fi +.LP +.SH "SEE ALSO" +.BR ldap (3), +.BR slapd.conf (5), +.BR slapd\-config (5), +.BR slapd.access (5), +.BR slapacl (8), +.BR slapadd (8), +.BR slapauth (8), +.BR slapcat (8), +.BR slapdn (8), +.BR slapindex (8), +.BR slappasswd (8), +.BR slapschema (8), +.BR slaptest (8). +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH BUGS +See http://www.openldap.org/its/ +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man8/slapdn.8 b/doc/man/man8/slapdn.8 new file mode 100644 index 0000000..0232f1a --- /dev/null +++ b/doc/man/man8/slapdn.8 @@ -0,0 +1,108 @@ +.TH SLAPDN 8C "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2004-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapdn \- Check a list of string-represented LDAP DNs based on schema syntax +.SH SYNOPSIS +.B SBINDIR/slapdn +[\c +.BI \-d \ debug-level\fR] +[\c +.BI \-f \ slapd.conf\fR] +[\c +.BI \-F \ confdir\fR] +[\c +.BR \-N | \-P ] +[\c +.BI \-o \ option\fR[ = value\fR]] +[\c +.BR \-v ] +.IR DN \ [...] +.LP +.SH DESCRIPTION +.LP +.B Slapdn +is used to check the conformance of a DN based on the schema +defined in +.BR slapd (8) +and that loaded via +.BR slapd.conf (5). +It opens the +.BR slapd.conf (5) +configuration file or the slapd\-config (5) backend, reads in the schema definitions, and then +parses the +.I DN +list given on the command-line. +.LP +.SH OPTIONS +.TP +.BI \-d \ debug-level +enable debugging messages as defined by the specified +.IR debug-level ; +see +.BR slapd (8) +for details. +.TP +.BI \-f \ slapd.conf +specify an alternative +.BR slapd.conf (5) +file. +.TP +.BI \-F \ confdir +specify a config directory. +If both +.B \-f +and +.B \-F +are specified, the config file will be read and converted to +config directory format and written to the specified directory. +If neither option is specified, an attempt to read the +default config directory will be made before trying to use the default +config file. If a valid config directory exists then the +default config file is ignored. +.TP +.BI \-N +only output a normalized form of the \fIDN\fP, suitable to be used +in a normalization tool; incompatible with +.BR \-P . +.TP +.BI \-o \ option\fR[ = value\fR] +Specify an +.I option +with a(n optional) +.IR value . +Possible generic options/values are: +.LP +.nf + syslog=<subsystems> (see `\-s' in slapd(8)) + syslog\-level=<level> (see `\-S' in slapd(8)) + syslog\-user=<user> (see `\-l' in slapd(8)) + +.fi +.TP +.BI \-P +only output a prettified form of the \fIDN\fP, suitable to be used +in a check and beautification tool; incompatible with +.BR \-N . +.TP +.B \-v +enable verbose mode. +.SH EXAMPLES +To check a +.B DN +give the command: +.LP +.nf +.ft tt + SBINDIR/slapdn \-f /ETCDIR/slapd.conf \-v DN +.ft +.fi +.SH "SEE ALSO" +.BR ldap (3), +.BR slapd (8), +.BR slaptest (8) +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man8/slapindex.8 b/doc/man/man8/slapindex.8 new file mode 100644 index 0000000..51c19ac --- /dev/null +++ b/doc/man/man8/slapindex.8 @@ -0,0 +1,178 @@ +.TH SLAPINDEX 8C "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapindex \- Reindex entries in a SLAPD database +.SH SYNOPSIS +.B SBINDIR/slapindex +[\c +.BI \-b \ suffix\fR] +[\c +.BR \-c ] +[\c +.BI \-d \ debug-level\fR] +[\c +.BI \-f \ slapd.conf\fR] +[\c +.BI \-F \ confdir\fR] +[\c +.BR \-g ] +[\c +.BI \-n \ dbnum\fR] +[\c +.BI \-o \ option\fR[ = value\fR]] +[\c +.BR \-q ] +[\c +.BR \-t ] +[\c +.BR \-v ] +[\c +.IR attr [ ... ]] +.B +.LP +.SH DESCRIPTION +.LP +.B Slapindex +is used to regenerate +.BR slapd (8) +indices based upon the current contents of a database. +It opens the given database determined by the database number or +suffix and updates the indices for all values of all attributes +of all entries. If a list of specific attributes is provided +on the command line, only the indices for those attributes will +be regenerated. +Databases configured as +.B subordinate +of this one are also re-indexed, unless \fB\-g\fP is specified. + +All files eventually created by +.BR slapindex +will belong to the identity +.BR slapindex +is run as, so make sure you either run +.BR slapindex +with the same identity +.BR slapd (8) +will be run as (see option +.B \-u +in +.BR slapd (8)), +or change file ownership before running +.BR slapd (8). +.SH OPTIONS +.TP +.BI \-b \ suffix +Use the specified \fIsuffix\fR to determine which database to +generate output for. The \fB\-b\fP cannot be used in conjunction +with the +.B \-n +option. +.TP +.B \-c +enable continue (ignore errors) mode. +.TP +.BI \-d \ debug-level +enable debugging messages as defined by the specified +.IR debug-level ; +see +.BR slapd (8) +for details. +.TP +.BI \-f \ slapd.conf +specify an alternative +.BR slapd.conf (5) +file. +.TP +.BI \-F \ confdir +specify a config directory. +If both +.B \-f +and +.B \-F +are specified, the config file will be read and converted to +config directory format and written to the specified directory. +If neither option is specified, an attempt to read the +default config directory will be made before trying to use the default +config file. If a valid config directory exists then the +default config file is ignored. +.TP +.B \-g +disable subordinate gluing. Only the specified database will be +processed, and not its glued subordinates (if any). +.TP +.BI \-n \ dbnum +Generate output for the \fIdbnum\fR-th database listed in the +configuration file. The config database +.BR slapd\-config (5), +is always the first database, so use +.B \-n 0 + +The +.B \-n +cannot be used in conjunction with the +.B \-b +option. +.TP +.BI \-o \ option\fR[ = value\fR] +Specify an +.I option +with a(n optional) +.IR value . +Possible generic options/values are: +.LP +.nf + syslog=<subsystems> (see `\-s' in slapd(8)) + syslog\-level=<level> (see `\-S' in slapd(8)) + syslog\-user=<user> (see `\-l' in slapd(8)) + +.fi +.TP +.B \-q +enable quick (fewer integrity checks) mode. Performs no consistency checks +when writing the database. Improves indexing time, +.B however +the database will most likely be unusable if any errors or +interruptions occur. +.TP +.B \-t +enable truncate mode. Truncates (empties) an index database before indexing +any entries. May only be used with Quick mode. +.TP +.B \-v +enable verbose mode. +.SH LIMITATIONS +Your +.BR slapd (8) +should not be running (at least, not in read-write +mode) when you do this to ensure consistency of the database. +.LP +This command provides ample opportunity for the user to obtain +and drink their favorite beverage. +.SH EXAMPLES +To reindex your SLAPD database, give the command: +.LP +.nf +.ft tt + SBINDIR/slapindex +.ft +.fi +To regenerate the index for only a specific attribute, e.g. "uid", +give the command: +.LP +.nf +.ft tt + SBINDIR/slapindex uid +.ft +.fi +.SH "SEE ALSO" +.BR ldap (3), +.BR ldif (5), +.BR slapadd (8), +.BR ldapadd (1), +.BR slapd (8) +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man8/slappasswd.8 b/doc/man/man8/slappasswd.8 new file mode 100644 index 0000000..7880784 --- /dev/null +++ b/doc/man/man8/slappasswd.8 @@ -0,0 +1,203 @@ +.TH SLAPPASSWD 8C "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slappasswd \- OpenLDAP password utility +.SH SYNOPSIS +.B SBINDIR/slappasswd +[\c +.BR \-v ] +[\c +.BR \-u ] +[\c +.BR \-g \||\| \-s \ \fIsecret\fR \||\| \fB\-T \ \fIfile\fR] +[\c +.BI \-h \ hash\fR] +[\c +.BI \-c \ salt-format\fR] +[\c +.BR \-n ] +[\c +.BI \-o \ option\fR[ = value\fR]] +.LP +.SH DESCRIPTION +.LP +.B Slappasswd +is used to generate an userPassword value +suitable for use with +.BR ldapmodify (1), +.BR slapd.conf (5) +.I rootpw +configuration directive or the +.BR slapd\-config (5) +.I olcRootPW +configuration directive. +. +.SH OPTIONS +.TP +.B \-v +enable verbose mode. +.TP +.B \-u +Generate RFC 2307 userPassword values (the default). Future +versions of this program may generate alternative syntaxes +by default. This option is provided for forward compatibility. +.TP +.BI \-s \ secret +The secret to hash. +If this, +.B \-g +and +.B \-T +are absent, the user will be prompted for the secret to hash. +.BR \-s , +.B \-g +and +.B \-T +are mutually exclusive flags. +.TP +.BI \-g +Generate the secret. +If this, +.B \-s +and +.B \-T +are absent, the user will be prompted for the secret to hash. +.BR \-s , +.B \-g +and +.B \-T +are mutually exclusive flags. +If this is present, +.I {CLEARTEXT} +is used as scheme. +.B \-g +and +.B \-h +are mutually exclusive flags. +.TP +.BI \-T \ "file" +Hash the contents of the file. +If this, +.B \-g +and +.B \-s +are absent, the user will be prompted for the secret to hash. +.BR \-s , +.B \-g +and +.B \-T +and mutually exclusive flags. +.TP +.BI \-h \ "scheme" +If \fB\-h\fP is specified, one of the following RFC 2307 schemes may +be specified: +.BR {CRYPT} , +.BR {MD5} , +.BR {SMD5} , +.BR {SSHA} ", and" +.BR {SHA} . +The default is +.BR {SSHA} . + +Note that scheme names may need to be protected, due to +.B { +and +.BR } , +from expansion by the user's command interpreter. + +.B {SHA} +and +.B {SSHA} +use the SHA-1 algorithm (FIPS 160-1), the latter with a seed. + +.B {MD5} +and +.B {SMD5} +use the MD5 algorithm (RFC 1321), the latter with a seed. + +.B {CRYPT} +uses the +.BR crypt (3). + +.B {CLEARTEXT} +indicates that the new password should be added to userPassword as +clear text. +Unless +.I {CLEARTEXT} +is used, this flag is incompatible with option +.BR \-g . +.TP +.BI \-c \ crypt-salt-format +Specify the format of the salt passed to +.BR crypt (3) +when generating {CRYPT} passwords. +This string needs to be in +.BR sprintf (3) +format and may include one (and only one) +.B %s +conversion. +This conversion will be substituted with a string of random +characters from [A\-Za\-z0\-9./]. For example, +.RB ' %.2s ' +provides a two character salt and +.RB ' $1$%.8s ' +tells some +versions of +.BR crypt (3) +to use an MD5 algorithm and provides +8 random characters of salt. +The default is +.RB ' %s ' , +which provides 31 characters of salt. +.TP +.BI \-n +Omit the trailing newline; useful to pipe the credentials +into a command. +.TP +.BI \-o \ option\fR[ = value\fR] +Specify an +.I option +with a(n optional) +.IR value . +Possible generic options/values are: +.LP +.nf + module\-path=<pathspec> (see `\fBmodulepath\fP' in slapd.conf(5)) + module\-load=<filename> (see `\fBmoduleload\fP' in slapd.conf(5)) + +.in +You can load a dynamically loadable password hash module by +using this option. +.SH LIMITATIONS +The practice of storing hashed passwords in userPassword violates +Standard Track (RFC 4519) schema specifications and may hinder +interoperability. A new attribute type, authPassword, to hold +hashed passwords has been defined (RFC 3112), but is not yet +implemented in +.BR slapd (8). +.LP +It should also be noted that the behavior of +.BR crypt (3) +is platform specific. +.SH "SECURITY CONSIDERATIONS" +Use of hashed passwords does not protect passwords during +protocol transfer. TLS or other eavesdropping protections +should be in-place before using LDAP simple bind. +.LP +The hashed password values should be protected as if they +were clear text passwords. +.SH "SEE ALSO" +.BR ldappasswd (1), +.BR ldapmodify (1), +.BR slapd (8), +.BR slapd.conf (5), +.BR slapd\-config (5), +.B RFC 2307\fP, +.B RFC 4519\fP, +.B RFC 3112 +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man8/slapschema.8 b/doc/man/man8/slapschema.8 new file mode 100644 index 0000000..3cf6f5b --- /dev/null +++ b/doc/man/man8/slapschema.8 @@ -0,0 +1,194 @@ +.TH SLAPSCHEMA 8C "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slapschema \- SLAPD in-database schema checking utility +.SH SYNOPSIS +.B SBINDIR/slapschema +[\c +.BI \-a filter\fR] +[\c +.BI \-b suffix\fR] +[\c +.BR \-c ] +[\c +.BI \-d debug-level\fR] +[\c +.BI \-f slapd.conf\fR] +[\c +.BI \-F confdir\fR] +[\c +.BR \-g ] +[\c +.BI \-H URI\fR] +[\c +.BI \-l error-file\fR] +[\c +.BI \-n dbnum\fR] +[\c +.BI \-o option\fR[ = value\fR]] +[\c +.BI \-s subtree-dn\fR] +[\c +.BR \-v ] +.LP +.SH DESCRIPTION +.LP +.B Slapschema +is used to check schema compliance of the contents of a +.BR slapd (8) +database. +It opens the given database determined by the database number or +suffix and checks the compliance of its contents with the corresponding +schema. Errors are written to standard output or the specified file. +Databases configured as +.B subordinate +of this one are also output, unless \fB\-g\fP is specified. +.LP +Administrators may need to modify existing schema items, including +adding new required attributes to objectClasses, +removing existing required or allowed attributes from objectClasses, +entirely removing objectClasses, +or any other change that may result in making perfectly valid entries +no longer compliant with the modified schema. +The execution of the +.B slapschema +tool after modifying the schema can point out +inconsistencies that would otherwise surface only when +inconsistent entries need to be modified. + +.LP +The entry records are checked in database order, not superior first +order. The entry records will be checked considering all +(user and operational) attributes stored in the database. +Dynamically generated attributes (such as subschemaSubentry) +will not be considered. +.SH OPTIONS +.TP +.BI \-a \ filter +Only check entries matching the asserted filter. +For example + +slapschema \-a \\ + "(!(entryDN:dnSubtreeMatch:=ou=People,dc=example,dc=com))" + +will check all but the "ou=People,dc=example,dc=com" subtree +of the "dc=example,dc=com" database. +Deprecated; use \fB-H\fP \fIldap:///???(filter)\fP instead. +.TP +.BI \-b \ suffix +Use the specified \fIsuffix\fR to determine which database to +check. The \fB\-b\fP cannot be used in conjunction +with the +.B \-n +option. +.TP +.B \-c +Enable continue (ignore errors) mode. +.TP +.BI \-d \ debug-level +Enable debugging messages as defined by the specified +.IR debug-level ; +see +.BR slapd (8) +for details. +.TP +.BI \-f \ slapd.conf +Specify an alternative +.BR slapd.conf (5) +file. +.TP +.BI \-F \ confdir +specify a config directory. +If both +.B \-f +and +.B \-F +are specified, the config file will be read and converted to +config directory format and written to the specified directory. +If neither option is specified, an attempt to read the +default config directory will be made before trying to use the default +config file. If a valid config directory exists then the +default config file is ignored. +.TP +.B \-g +disable subordinate gluing. Only the specified database will be +processed, and not its glued subordinates (if any). +.TP +.B \-H \ URI +use dn, scope and filter from URI to only handle matching entries. +.TP +.BI \-l \ error-file +Write errors to specified file instead of standard output. +.TP +.BI \-n \ dbnum +Check the \fIdbnum\fR\-th database listed in the +configuration file. The config database +.BR slapd\-config (5), +is always the first database, so use +.B \-n 0 + +The +.B \-n +cannot be used in conjunction with the +.B \-b +option. +.TP +.BI \-o \ option\fR[ = value\fR] +Specify an +.I option +with a(n optional) +.IR value . +Possible generic options/values are: +.LP +.nf + syslog=<subsystems> (see `\-s' in slapd(8)) + syslog\-level=<level> (see `\-S' in slapd(8)) + syslog\-user=<user> (see `\-l' in slapd(8)) + +.fi +.TP +.BI \-s \ subtree-dn +Only check entries in the subtree specified by this DN. +Implies \fB\-b\fP \fIsubtree-dn\fP if no +.B \-b +nor +.B \-n +option is given. +Deprecated; use \fB-H\fP \fIldap:///subtree-dn\fP instead. +.TP +.B \-v +Enable verbose mode. +.SH LIMITATIONS +For some backend types, your +.BR slapd (8) +should not be running (at least, not in read-write +mode) when you do this to ensure consistency of the database. It is +always safe to run +.B slapschema +with the +.BR slapd\-bdb (5), +.BR slapd\-hdb (5), +and +.BR slapd\-null (5) +backends. +.SH EXAMPLES +To check the schema compliance of your SLAPD database after modifications +to the schema, and put any error in a file called +.BR errors.ldif , +give the command: +.LP +.nf +.ft tt + SBINDIR/slapschema \-l errors.ldif +.ft +.fi +.SH "SEE ALSO" +.BR ldap (3), +.BR ldif (5), +.BR slapd (8) +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project diff --git a/doc/man/man8/slaptest.8 b/doc/man/man8/slaptest.8 new file mode 100644 index 0000000..9fb2516 --- /dev/null +++ b/doc/man/man8/slaptest.8 @@ -0,0 +1,117 @@ +.TH SLAPTEST 8C "RELEASEDATE" "OpenLDAP LDVERSION" +.\" Copyright 2004-2018 The OpenLDAP Foundation All Rights Reserved. +.\" Copying restrictions apply. See COPYRIGHT/LICENSE. +.\" $OpenLDAP$ +.SH NAME +slaptest \- Check the suitability of the OpenLDAP slapd configuration +.SH SYNOPSIS +.B SBINDIR/slaptest +[\c +.BI \-d \ debug-level\fR] +[\c +.BI \-f \ slapd.conf\fR] +[\c +.BI \-F \ confdir\fR] +[\c +.BI \-n dbnum\fR] +[\c +.BI \-o \ option\fR[ = value\fR]] +[\c +.BR \-Q ] +[\c +.BR \-u ] +[\c +.BR \-v ] +.LP +.SH DESCRIPTION +.LP +.B Slaptest +is used to check the conformance of the +.BR slapd (8) +configuration. +It opens the +.BR slapd.conf (5) +configuration file or the +.BR slapd\-config (5) +backend, and parses it according to the general and the backend-specific +rules, checking its sanity. +.LP +.SH OPTIONS +.TP +.BI \-d \ debug-level +enable debugging messages as defined by the specified +.IR debug-level ; +see +.BR slapd (8) +for details. +.TP +.BI \-f \ slapd.conf +specify an alternative +.BR slapd.conf (5) +file. +.TP +.BI \-F \ confdir +specify a config directory. +If both +.B \-f +and +.B \-F +are specified, the config file will be read and converted to +config directory format and written to the specified directory. +If neither option is specified, slaptest will attempt to read the +default config directory before trying to use the default +config file. If a valid config directory exists then the +default config file is ignored. If dry-run mode is also specified, +no conversion will occur. +.TP +.BI \-n \ dbnum +Just open and test the \fIdbnum\fR-th database listed in the +configuration file. +To only test the config database +.BR slapd\-config (5), +use +.B \-n 0 +as it is always the first database. +.TP +.BI \-o \ option\fR[ = value\fR] +Specify an +.I option +with a(n optional) +.IR value . +Possible generic options/values are: +.LP +.nf + syslog=<subsystems> (see `\-s' in slapd(8)) + syslog\-level=<level> (see `\-S' in slapd(8)) + syslog\-user=<user> (see `\-l' in slapd(8)) + +.fi +.TP +.BI \-Q +Be extremely quiet: only the exit code indicates success (0) or not +(any other value). +.TP +.B \-u +enable dry-run mode (i.e. don't fail if databases cannot be opened, +but config is fine). +.TP +.B \-v +enable verbose mode. +.SH EXAMPLES +To check a +.BR slapd.conf (5) +give the command: +.LP +.nf +.ft tt + SBINDIR/slaptest \-f /ETCDIR/slapd.conf \-v +.ft +.fi +.SH "SEE ALSO" +.BR ldap (3), +.BR slapd (8), +.BR slapdn (8) +.LP +"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/) +.SH ACKNOWLEDGEMENTS +.so ../Project |
