splat.conf — Scalable Periodic LDAP Attribute Transmogrifier configuration file
The Splat configuration file is composed of three different section types:
LDAP Configuration
Service Helper Configuration
Logging Configuration
The configuration uses an Apache-style syntax:
<LDAP> # The LDAP Server configuration. # URI of the server(s) URI ldaps://ldap1.example.com # The default search base for the server BaseDN dc=example,dc=com </LDAP>
The LDAP
section defines
connection parameters for your LDAP server, and may appear once within
a Splat configuration file. If you make use of SSL/TLS, you will need to
ensure that the appropriate settings are enabled in your system
ldap.conf
(e.g.
TLS_CACERT
or
TLS_CACERTDIR
, if necessary).
The Logging
section configures
logging for the Splat daemon. It is composed of any number of
syslog
or
logfile
subsections.
The Service
section configures
Splat's service helper modules. It is composed service-specific
settings, including any number of
Option
, and
Group
subsections. Group and Service
names (such as UserSSH or
Administrators) must be unique within their
scope, but are not interpreted by Splat in any other way.
Option
subsections may be
specified in both the Service section and the Group subsection.
Options are used to set and unset helper-specific settings. Module
options are documented in the module-specific documentation. Example:
<Option mingid> # Do not write keys for users with a GID less than mingid Value 1000 </Option> # Unset the Command option <Option command/>
Python Helper Module. Example: splat.helpers.sshPublicKeys
Frequency at which helper is invoked. Units may be specified in hours (h), minutes (m), or seconds (s).
LDAP search base. If left unspecified, defaults to the BaseDN specified in the LDAP configuration section.
LDAP search filter. All records that match this filter (and, optionally, are members of a permitted group) will be passed to the service helper module.
Require that returned entries match one of the specified Groups.
LDAP search base. If left unspecified, defaults to the BaseDN specified in the LDAP configuration section.
LDAP search filter. All records that match this filter will determine this groups membership. The filter should return groupOfUniqueNames or groupOfNames objects. I suggest using RFC2307bis to combine posixGroup and groupOfUniqueName.
LDAP attribute used to store member DNs. Defaults to uniqueMember.