back-ldap データベースに直にバインドするセッションは、常に リモート LDAP サーバとの内部的な接続を確立します。 匿名セッションは、リモートサーバとの単一の匿名接続を共有します。 その他の機構でバインドしているセッションは、 同じ DN のセッションすべてが同じ接続を共有します。 この接続のプーリング方針により、多くの接続を確立/切断を繰り返す負荷を低減 するので、代理サーバの効率が上がります。
The ldap database can also act as an information service, i.e. the identity of locally authenticated clients is asserted to the remote server, possibly in some modified form. For this purpose, the proxy binds to the remote server with some administrative identity, and, if required, authorizes the asserted identity. See the idassert-* rules below. The administrative identity of the proxy, on the remote server, must be allowed to authorize by means of appropriate authzTo rules; see slapd.conf(5) for details.
注記：back-ldap の初期バージョンでは、次の設定を強く勧めていました。
lastmod off
このようにしたのは、エントリの作成と更新に関係する運用属性が使われる べきではないからです。運用属性がダーゲットサーバに渡されるとエラーが置きます。 現在の実装では lastmod が自動的に off に設定されるので、無用な lastmod の記述は除いてください。lastmod ディレクティブは将来的に利用できなくなる予定です。
URI のリストはスペースかカンマで区切ります。 このディレクティブの指定は必須です。 時代遅れのオプション。`uri ldap://<hostport>/' と指定するのと同じです。
This identity is by no means implicitly used by the proxy when the client connects anonymously.
none|simple|sasl
where none is the default, i.e. no identity assertion is performed.
The authz parameter is used to instruct the SASL bind to exploit native SASL authorization, if available; since connections are cached, this should only be used when authorizing with a fixed identity (e.g. by means of the authzDN or authzID parameters). Otherwise, the default proxyauthz is used, i.e. the proxyAuthz control is added to all operations.
The supported modes are:
<mode> := {legacy|anonymous|none|self}
If <mode> is not present, and authzId is given, the proxy always authorizes that identity. <authorization ID> can be
u:<user>
[dn:]<DN>
The former is supposed to be expanded by the remote server according to the authz rules; see slapd.conf(5) for details. In the latter case, whether or not the dn: prefix is present, the string must pass DN validation and normalization.
The default mode is legacy, which implies that the proxy will either perform a simple bind as the authcDN or a SASL bind as the authcID and assert the client's identity when it is not anonymous. Direct binds are always proxied. The other modes imply that the proxy will always either perform a simple bind as the authcDN or a SASL bind as the authcID, unless restricted by idassert-authzFrom rules (see below), in which case the operation will fail; eventually, it will assert some other identity according to <mode>. Other identity assertion modes are anonymous and self, which respectively mean that the empty or the client's identity will be asserted; none, which means that no proxyAuthz control will be used, so the authcDN or the authcID identity will be asserted. For all modes that require the use of the proxyAuthz control, on the remote server the proxy identity must have appropriate authzTo permissions, or the asserted identities must have appropriate authzFrom permissions. Note, however, that the ID assertion feature is mostly useful when the asserted identities do not exist on the remote server.
When the override flag is used, identity assertion takes place even when the database is authorizing for the identity of the client, i.e. after binding with the provided identity, and thus authenticating it, the proxy performs the identity assertion using the configured identity and authentication method.
This directive obsoletes idassert-authcDN, idassert-passwd, idassert-mode, and idassert-method.
map objectclass groupOfNames group
次の設定は外部サーバの限定した属性だけを与えます。
map attribute cn * map attribute sn * map attribute manager * map attribute description * map attribute *
これらの行は cn, sn, manager, description をその名前でマッピングし、 他の属性はクライアントに送り返す前にオブジェクトクラスから「除去」します。 これは単純明解な例ですが要点はおさえています。