=head1 SYNOPSIS

  ldap access
  ldap acl dn|principal <hostname>
  ldap auth principal group owner
  ldap auth-report [sql where clause]
  ldap bundle add|list|remove <attribute list>|<workgroup prefix>

  ldap drlist add|update|delete|show <mailman-list>

  ldap group add|update|delete|listen|sync|show <workgroup>
  posixgroup add|show|sync <workgroup>
  suprivilegegroup sync <ldap-filter>

  ldap log [show]
  ldap log set <log-level-list>
  ldap restart
  ldap start
  ldap stop

  ldap add
  ldap remove
  ldap show server|virtual|pool|member <target>
  ldap status
  ldap yank

  ldap ldap-test-updates

  ldap versions

  ldap <subcommand> help
  ldap <subcommand> manual

=head1 DESCRIPTION

Stanford LDAP utility scripts.

=head1 LDAP ACL Commands

=over 4

=item ldap access

Queries an OpenLDAP server's configuration with directory access
control lists stored in the cn=config branch of the directory and
displays access details for principal used to access the command.

Complete documentation for each subcommand while be printed with the
manual option.

=item ldap acl dn|principal

Queries an OpenLDAP server's configuration using directory access
control lists stored in the cn=config branch of the directory and
displays access details for a given principal or distinguished name.

Complete documentation for each subcommand while be printed with the
manual option.

=item ldap auth principal group owner

Update the necessary ACL and group structures to grant access to a
bundle of attributes to a Kerberos principal.  The script creates
krb5principalname entries as necessary and updates auth group
membership.

=item ldap auth-report [sql where clause]

Generates a listing of changes made to the directory access with
the 'ldap auth' command.

=item ldap bundle add|list|remove <attribute list>|<workgroup prefix>

Generates the directory ACLs required to support posix and attribute
bundles.  This command is a companion to the 'ldap auth' command.

=back

=head1 LDAP DR List Command

=over 4

=item ldap drlist add|update|delete|show <mailman-list>

This script adds, deletes, updates, and displays entries in the
cn=drLists branch of the directory.  This branch contains mail
distribution list entries for MailMan lists that can be used in a
disaster when MailMan is not available.

=back

=head1 LDAP Data Synchronization Commands

=over 4

=item ldap group add|update|delete|listen|sync|show <workgroup>

This script adds, updates, or deletes workgroup attributes in
the Stanford Directory that support Posix and Google groups.
The base group entries are created by Workgroup Manager.  This
script updates existing entries.  The listen command is not
intended to be run from remctl.

=item posix group add|show|sync <workgroup>

This is a remctl wrapper script around ldap-group-maint that is
restricted to performing actions for posixGroups only.  It is
intended for use by system administrators.

=item suprivilegegroup sync|help <ldap-filter>

This script ensures that the suPrivilegeGroup attributes in the
cn=accounts branch match the values in the cn=people branch of the
directory.  This script has several other options none of which are
appropriate for use interactively.  See the script help for
documentation of the complete set of script actions.

=back

=head1 Server Control Commands

=over 4

=item ldap log set <log-level-list>

Set the log level for the slapd process.  The log-level-list is a
space separated list of ldap processing elements.  If the
log-level-list is not specified the default is 'stats'.  Valid values
are:

    trace   - trace function calls
    packets - debug packet handling
    args    - heavy trace debugging (function args)
    conns   - connection management
    BER     - print out packets sent and received
    filter  - search filter processing
    config  - configuration file processing
    ACL     - access control list processing
    stats   - connections, LDAP  operations, results
    stats2  - stats log entries sent
    shell   - print communication with shell backends
    parse   - entry parsing
    sync    - LDAPSync replication
    none    - only messages that get logged whatever log level is set

=item ldap log [show]

Display the current log level.

=item ldap restart

Remove the host from the load balanced pool, shutdown slapd, start
slapd, and add the localhost to the load balanced pool unless the
server was not in the pool command originally.

=item ldap start

Start slapd and place the host in the lb pool.

=item ldap stop

Remove the host from the lb pool and stop slapd.  When shutdown of
slapd is requested the script does not exit until slapd has stopped.

=back

=head1 Load Balance Commands

=over 4

=item ldap add

Add the host to the lbdns and hardware load balanced pools.

=item ldap remove

Remove the host from both lbdns and hardware load balanced
pools.  For LBDNS pools the script uses dig to interrogate the
DNS and waits until the localhost is out of the lbdns pool
before exiting.  For hardware load balanced pools this
function connects to the signal port, issues a QUIT, and waits
the configured time before proceeding.  The default is 60
seconds.

=item ldap show server|virtual|pool|member <target>

Displays status information for pool membership for hosts behind a F5
BigIP hardware load balancer.  The script uses SOAP calls the the
iControl service on the BigIP.  The script generates lists of virtual
servers, pools members, and individual hosts.


=item ldap status

Displays the presence or absense of the signal file.  The
signal file is /etc/noldap.

=item ldap versions

Display versions of LDAP related software running on the server.

=item ldap yank

Removes the host from the load balanced pool without waiting.

=item ldap ldap-test-updates

Direct updates to the directory.  This script is intended for testing 
only and is configured only on test master servers.

=back

=head1 AUTHOR

Bill MacAllister <whm@stanford.edu>

=head1 COPYRIGHT

Copyright 2011,2012 Board of Trustees, Leland Stanford Jr. University.

=cut