# /etc/nslcd.conf
# nslcd configuration file. See nslcd.conf(5)
# for details.

# The user and group nslcd should run as.
uid nslcd
gid nslcd

# The location at which the LDAP server(s) should be reachable.
uri ldaps://dc.intern.tuwien.ac.at

# The search base that will be used for all queries.
base ou=tu,dc=intern,dc=tuwien,dc=ac,dc=at

# The LDAP protocol version to use.
#ldap_version 3

# The DN to bind with for normal lookups.
binddn cn=E322_LDAP,ou=interactive,ou=exchange,ou=IT-services,ou=TU,dc=intern,dc=tuwien,dc=ac,dc=at
bindpw <obfuscated>

# The DN used for password modifications by root.
#rootpwmoddn cn=admin,dc=example,dc=com

# SSL options
#ssl off
tls_reqcert never
tls_cacertfile /etc/ssl/certs/ca-certificates.crt

# The search scope.
#scope sub

# Customize certain database lookups
base    group   ou=groups,ou=TU,dc=intern,dc=tuwien,dc=ac,dc=at
base    passwd  ou=people,ou=TU,dc=intern,dc=tuwien,dc=ac,dc=at
base    group   ou=people,ou=TU,dc=intern,dc=tuwien,dc=ac,dc=at

# Mappings

# nested group lookup (memberOf: CN=E322-01,.., diese Gruppe ist wiederum
# memberOf: CN=E322_ALL, siehe https://serverfault.com/questions/269344
filter	passwd	(memberOf:1.2.840.113556.1.4.1941:=CN=E322_ALL,OU=groups,OU=TU,DC=intern,DC=tuwien,DC=ac,DC=at)

map     passwd  uid             sAMAccountName
map     passwd  uidNumber       employeeID
map     passwd  gecos           cn
map     passwd  homeDirectory   "/home/${sAMAccountName}"
map     passwd  loginShell      "/bin/bash"
map     passwd  gidNumber       "2153"

filter	shadow	(memberOf:1.2.840.113556.1.4.1941:=CN=E322_ALL,OU=groups,OU=TU,DC=intern,DC=tuwien,DC=ac,DC=at)
map     shadow  uid             sAMAccountName

# Get the objectSid by decoding the base64-decoded string returned by an
# ldap-query, and swapping each pair of byes, and considering least- and
# most significant bit ordering, see
# http://www.selfadsi.org/deep-inside/microsoft-sid-attributes.htm
#   objectSid:: AAU--base64string---AA==
# $ echo AAU--base64string---AA== | base64 -d | od -x
# 000000 0501 0000 0000 0500 0015 0000 097f 1f75
# 000020 1c1d 1a1b 2c2d 2a2b
# The correct number is then, in hex,
# 1-5-21-1f75097f-1a1b1c1d-2a2b2c2d
filter  group   (cn=E322*)
map     group   userPassword    ""
map     group   gidNumber       objectSid:S-1-5-21-527763839-1561677997-902985232
