<?xml version="1.0" encoding="utf-8"?>

<creole>

    <files>
        <file name='/etc/eole/eoleldap.conf'/>
        <file filelist='slapd' name='/tmp/DB_CONFIG'/>
    </files>
    <containers>
        <container name="annuaire">
            <package>eole-annuaire-pkg</package>
            <file filelist='slapd' name='/etc/ldap/slapd.conf' group="openldap" mode="0640"/>
            <file filelist='slapd' name='/etc/default/slapd' source='default.slapd'/>
            <!-- /!\ c'est le /var/lib/eole du conteneur annuaire /!\ -->
            <file filelist='slapd' name='/var/lib/eole/00_annuaire.ldif' mkdir='True'/>
            <file filelist='slapd' name='/etc/apparmor.d/local/usr.sbin.slapd' source='apparmor_usr.sbin.slapd'/>
            <!--<file name='/etc/ldap/ldap.conf'/>
            <file name='/etc/ldap.conf'/>-->
        </container>
    </containers>

    <variables>
        <family name='services'>
            <variable name='activer_client_ldap' redefine='True' description="Emplacement du serveur LDAP">
                <value>local</value>
            </variable>
        </family>
        <family name='annuaire'>
            <variable name='ldap_tls' redefine='True'>
                <value>non</value>
            </variable>
        </family>
        <family name='openldap' mode='expert' icon='book'>
            <variable name='openldap_installed' type='oui/non' hidden='True'>
                <value>oui</value>
            </variable>
            <variable name='ldap_schema' type='filename' description='Schéma LDAP utilisé' hidden='True'>
                <value>eole</value>
            </variable>
            <variable name='ldap_replication' type='oui/non' description='Activer la réplication LDAP (fournisseur)'>
                <value>non</value>
            </variable>
            <variable name='ldap_replication_client' type='oui/non' description='Activer la réplication LDAP (client)' hidden='True'>
                <value>non</value>
            </variable>
            <variable name='ldap_loglevel' type='number' description='Niveau de log'>
                <value>0</value>
            </variable>
            <variable name='ldap_sizelimit' type='number' description="Nombre maximum d'entrées à retourner lors d'une requête">
                <value>5000</value>
            </variable>
            <variable name='ldap_timelimit' type='number' description='Temps de réponse maximum à une requête (en secondes)'>
                <value>3600</value>
            </variable>
            <variable name='ldap_ssl' type="string" description="Activer LDAP sur le port SSL">
                <value>non</value>
            </variable>
            <variable name='ldap_restrict_access' type="string" description="Utilisateur autorisé à accéder à distance au serveur LDAP">
                <value>tous</value>
            </variable>
       </family>
    </variables>

    <constraints>
        <check name='valid_enum' target='ldap_schema'>
            <param>['eole', 'sdet', 'zephir']</param>
        </check>
        <check name='valid_enum' target='ldap_restrict_access'>
            <param>['tous', 'authentifié', 'aucun']</param>
        </check>
        <check name='valid_enum' target='activer_client_ldap'>
            <param>['local', 'distant']</param>
        </check>
        <check name='valid_enum' target='ldap_ssl'>
            <param>['non', 'oui', 'uniquement']</param>
        </check>
        <fill name='calc_multi_condition' target='adresse_ip_ldap'>
            <param>local</param>
            <param type='eole' name='condition_1'>activer_client_ldap</param>
            <param name='match' type='eole'>container_ip_annuaire</param>
            <param name='default_mismatch'>None</param>
        </fill>

        <!-- slapd est activé si client_ldap est configuré sur local -->
        <condition name='disabled_if_not_in' source='activer_client_ldap'>
            <param>local</param>
            <target type='servicelist'>slapd</target>
            <target type='filelist'>slapd</target>
            <target type='family'>openldap</target>
        </condition>

        <condition name='frozen_if_in' source='activer_client_ldap'>
            <param>local</param>
            <target>ldap_reader</target>
            <target>ldap_reader_passfile</target>
            <target>adresse_ip_ldap</target>
        </condition>

    </constraints>

    <help>
        <family name='openldap'>Paramétrage de l'annuaire OpenLDAP local</family>
        <variable name='ldap_ssl'>Permet d'activer LDAP sur le port SSL (636). Si 'uniquement' est choisi, le firewall ne rend accessible que ce port. Le service reste néanmoins accessible en local sur le port 389.</variable>
    </help>

</creole>
<!-- vim: ts=4 sw=4 expandtab
-->
