3.2. Global Directives

Directives described in this section apply to all backends and databases unless specifically overridden in a backend or database definition. Arguments that should be replaced by actual text are shown in brackets <>.

access to <what> [ by <who> <accesslevel> <control> ]+

This directive grants access (specified by <accesslevel>) to a set of entries and/or attributes (specified by <what>) by one or more requesters (specified by <who>). See the Section 3.7 examples for more details.

Important: If no access directives are specified, the default access control policy, access to * by * read, allows all both authenticated and anonymous users read access.

attributetype <RFC2252 Attribute Type Description>

This directive defines an attribute type. Check the following URL for more details: Schema Specification

idletimeout <integer>

Specify the number of seconds to wait before forcibly closing an idle client connection. An idletimeout of 0, the default, disables this feature.

include <filename>

This directive specifies that slapd should read additional configuration information from the given file before continuing with the next line of the current file. The included file should follow the normal slapd config file format. The file is commonly used to include files containing schema specifications.

Note:You should be careful when using this directive - there is no small limit on the number of nested include directives, and no loop detection is done.

loglevel <integer>

This directive specifies the level at which debugging statements and operation statistics should be syslogged (currently logged to the syslogd(8) LOCAL4 facility). You must have configured OpenLDAP --enable-debug (the default) for this to work (except for the two statistics levels, which are always enabled). Log levels are additive. To display what numbers correspond to what kind of debugging, invoke slapd with -? or consult the table below. The possible values for <integer> are:

Table 3-1. Debugging Levels

Level	Description
-1	enable all debugging
0	no debugging
1	trace function calls
2	debug packet handling
4	heavy trace debugging
8	connection management
16	print out packets sent and received
32	search filter processing
64	configuration file processing
128	access control list processing
256	stats log connections/operations/results
512	stats log entries sent
1024	print communication with shell backends
2048	print entry parsing debugging

Example:

loglevel 255 or loglevel -1

This will cause lots and lots of debugging information to be syslogged.

Default:

loglevel 256

objectclass <RFC2252 Object Class Description>

This directive defines an object class. Check the following URL for more details: Schema Specification

referral <URI>

This directive specifies the referral to pass back when slapd cannot find a local database to handle a request.

Example:

referral ldap://root.openldap.org

This will refer non-local queries to the global root LDAP server at the OpenLDAP Project. Smart LDAP clients can re-ask their query at that server, but note that most of these clients are only going to know how to handle simple LDAP URLs that contain a host part and optionally a distinguished name part.

sizelimit <integer>

This directive specifies the maximum number of entries to return from a search operation.

Default:

sizelimit 500

timelimit <integer>

This directive specifies the maximum number of seconds (in real time) slapd will spend answering a search request. If a request is not finished in this time, a result indicating an exceeded timelimit will be returned.

Default:

timelimit 3600