#!/bin/ksh93
#
# $Id$
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
# Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
# Portions Copyright 2013, Jens Elkner.


#############################################################################
# Main global vars
#############################################################################
LIC='[-?$Id$]
[-copyright?Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.]
[-copyright?Portions Copyright (c) 2013 Jens Elkner. All rights reserved.]
[-license?CDDL 1.0]'

typeset -T ManObj_t=(
    typeset -Ah 'Variable descriptions. Key: variable name' VAR
    typeset -Ah 'Function usages. Key: function name' FUNC
    function addVar {
		[[ -n ${_.VAR[$1]} ]] && print -u2 "WARN: Overwriting previous description for $1"
        _.VAR[$1]="[+$1?$2]"
    }
    typeset -fh 'Add a description (arg2) for the given variable name (arg1)' addVar
    function addFunc {
        typeset fname=$1
        typeset X="$2"
		[[ -n ${_.FUNC[$fname]} ]] && print -u2 "WARN: Overwriting previous usage info for $1()"
        [[ -z $X ]] && X="$LIC"
        shift 2
        while [[ -n $1 ]]; do
            X+="$1"
            shift
        done
        _.FUNC[$fname]+="$X"
    }
    typeset -fh $'Add usage info (arg3 ...) for the given function name (arg1). If implementation details (arg2) is empty, the value of \a$LIC\a gets used instead' addFunc
    function varUsage {
        typeset X=""
		[[ "$1" = '@' || "$1" == '*' ]] && set -- ${!_.VAR[@]}
        while [[ -n $1 ]]; do
            X+="${_.VAR[$1]}"
            shift
        done
        print "$X"
    }
    typeset -fh $'Get the variable usage info for the named variables (arg2 ...) if available as a concatenated string. See \baddVar()\b' varUsage
	function funcUsage {
		printf "${_.FUNC[$1]}"
	}
	typeset -fh 'Get the function usage info for the named function (arg1)' funcUsage

	function listVars {
		typeset ALL="${ print ${!_.VAR[*]} | tr ' ' '\n' | sort -u; }" VNAME
		for VNAME in $ALL; do
			[[ $VNAME == OLDENV || $VNAME == LASTENV ]] && continue
			typeset -n X=$VNAME
			print "$VNAME=$X"
		done
		unset -n X
	}
	typeset -fh 'List all registered environment variables and its current value, except for OLDENV and LASTENV.' listVars
)
ManObj_t Man

Man.addFunc showUsage '' '[+NAME?showUsage - show usage info.]
[+DESCRIPTION?Shows usage info for the given \afname\a if available.]
\n\n\afname\a
'
function showUsage {
	typeset WHAT="$2"
	if (( VERBOSE )) && [[ ${WHAT} == MAIN ]]; then
		typeset PRE=${Man.FUNC[$WHAT]%%\[+NOTES*}
		typeset POST=${.sh.match}
		typeset E='[+ENVIRONMENT VARIABLES]{'"${ Man.varUsage '*' ; }"'}'
		getopts -a "${PROG}" "${ print ${PRE}${E}${POST} ; }" OPT --man
	else
		getopts -a "${PROG}" "${ print ${Man.FUNC[$WHAT]}; }" OPT --man
	fi
}

Man.addVar PROG 'String. The basename of this script.'
PROG=${.sh.file##*/}		# Program name


Man.addVar VERBOSE 'Integer. A value > 0 makes the script more chatty.'
integer VERBOSE=0				# Make it less chatty

Man.addVar INT 'Associative array of Integers. Config relevant int values and flags.' 
typeset -A -i INT=( )
Man.addVar STR 'Associative array of Strings. Config relevant string values.'
typeset -A STR=( )

Man.addVar TMPF 'Associative array of Integers. Int values with a more or less a global character in this script.' 
typeset -A -i TMPF=( )
Man.addVar TMP 'Associative array of Strings. String values whith a more or less a global character in this script.' 
typeset -A TMP=( )

Man.addVar CON_ARGS 'String. Contains connection related options for ldap commands.'
typeset CON_ARGS=''

Man.addVar AUTH_ARGS 'Indexed array of Strings. Contains authentification related options for ldap commands.'
typeset -a AUTH_ARGS=( )

Man.addVar SSD 'Indexed array of Strings. Contains the Service Search Decsriptors to use.'
typeset -a SSD=( )

Man.addVar PROXY_ACI_NAME 'String constant. The name of the ACI rule, which allows proxies to read passwords.'
typeset -r PROXY_ACI_NAME='LDAP Naming Services proxy_password_read'

Man.addVar HOST_ACI_NAME 'String constant. The name of the ACI rule, which allows host principals to write passwords.'
typeset  -r HOST_ACI_NAME='LDAP Naming Services host_shadow_write'
Man.addVar NON_HOST_ACI_NAME 'String constant. The name of the ACI rule, which denies non-host principals access to shadow data.'
typeset -r NON_HOST_ACI_NAME='LDAP Naming Services deny_non_host_shadow_access'

Man.addVar ADMIN_ACI_NAME 'String constant. The name of the ACI rule, which allows Admin principals access to shadow, rbac and mount data.'
typeset -r ADMIN_ACI_NAME='LDAP Naming Services admin_shadow_write'
Man.addVar NON_ADMIN_ACI_NAME 'String constant. The name of the ACI rule, which denies non-Admin principals access to shadow data.'
typeset -r NON_ADMIN_ACI_NAME='LDAP Naming Services deny_non_admin_shadow_access'
Man.addVar USER_ACI_NAME 'String constant. The name of the ACI rule, which prevents a user from changing administrative fields like uidNumber, homeDirectory, shadowExpire, etc..'
typeset -r USER_ACI_NAME='LDAP Naming Services deny_write_access'

Man.addVar AUTH_METHODS 'Indexed array of Strings. A list of currently supported authentication methods.'
typeset -a -r AUTH_METHODS=(
	''				'none'					'simple'		'sasl/DIGEST-MD5'
	'tls:simple'	'tls:sasl/DIGEST-MD5'	'sasl/GSSAPI'
) # order is important as well as the empty string @0 for get_auth function

Man.addVar CRED_LEVELS 'Indexed array of Strings. A list of currently supported client credential levels.'
typeset -a -r CRED_LEVELS=( 'anonymous' 'proxy' 'proxy anonymous' 'self' )

Man.addVar OID2ADEF 'Associative array of Strings. Key: OID, Value: attribute definition. Used to cache attribute definitions of schemas currently installed on the DS. Gets lazy initialized, i.e. populated when needed.' 
typeset -a OID2ADEF=( )
Man.addVar ANAME2OID 'Associative array of Strings. Key: attribute name (lowercase), Value: OID. Used to cache name to OID mappings. Gets initialized, when \bOID2ADEF\b gets populated.'
typeset -a ANAME2OID=( )

Man.addVar OID2ODEF 'Associative array of Strings. Key: OID, Value: objectclass definition. Used to cache objectclass definitions of schemas currently installed on the DS. Gets lazy initialized, i.e. populated when needed.' 
typeset -a OID2ODEF=( )

Man.addFunc checkBinary '' '[+NAME?checkBinary - lookup a command.]
[+DESCRIPTION?Check the standard path, whether it contains \acmd\a and if not, use \aPATH\a to lookup the command. If found the full path of the command gets printed to stdout, otherwise an error message to stderr.]
[+RETURN VALUES]{
	[+0?\acmd\a found.]
	[+1?\acmd\a not found.]
}
[+SEE ALSO?\bwhence\b(1).]
\n\n\acmd\a
'
function checkBinary {
	typeset CMD=$1 X=''
	for DIR in /usr/bin /usr/sbin ; do
		[[ -x ${DIR}/${CMD} ]] && print ${DIR}/${CMD} && return 0
	done
	X=${ whence -p ${CMD} ; }
	[[ -n $X ]] && print "${X}" && return 0
	print -u2 "Missing command '${CMD}'."
	return 1
}

Man.addFunc init '' '[+NAME?init - initializes variables and options.]
[+DESCRIPTION?Does some basic binary-avail checks and initializes certain values of \bSTR[]]\b, \bINT[]]\b and \bTMP[]]\b.]
'
function init {
	typeset X='' KEY VAL TAIL
	integer ERR=0

	# General commands
	HOST=${ hostname ; }
	PING=${ checkBinary ping || (( ERR++ )) ; }
	STTY=${ checkBinary stty || (( ERR++ )) ; }
	GETENT=${ checkBinary getent || (( ERR++ )) ; }

	# LDAP COMMANDS
	LDAPSEARCH=${ checkBinary ldapsearch || (( ERR++ )) ; }
	LDAPMODIFY=${ checkBinary ldapmodify || (( ERR++ )) ; }
	LDAPADD=${ checkBinary ldapadd || (( ERR++ )) ; }
	LDAPDELETE=${ checkBinary ldapdelete || (( ERR++ )) ; }
	LDAPCLIENT=${ checkBinary ldapclient || (( ERR++ )) ; }

	if (( ERR )); then
		print -u2 'Please adjust your PATH and try again.'
		return 66
	fi
	LDAPSEARCH+=' -r'

	# If DNS domain (resolv.conf) exists use that, otherwise use domainname.
	if [[ -f /etc/resolv.conf ]]; then
		while read KEY VAL TAIL ; do
			if [[ ${KEY} == 'domain' || ${KEY} == 'search' ]]; then
				X=${VAL}
				break;
			fi
		done < /etc/resolv.conf
	fi

	# If for any reason the DOM did not get set (error'd resolv.conf) set
	# X to the domainname or getent command's output.
	[[ -z $X ]] && X=${ domainname ; }
	if [[ -z $X ]]; then
		typeset -a AX=( ${ ${GETENT} hosts ${HOST} 2>/dev/null ; } )
		integer I
		for (( I=${#AX[@]}-1; I > 0; I++ )); do
			X=${AX[$I]#*.}
			[[ -n $X ]] && break
		done
	fi

	# Actually one needs to init non-null/zero values, only. However, we want
	# to have the keys registered ...

	# idsconfig specific variables.
	INT[LDAP_ENABLE_SHADOW_UPDATE]=0
	INT[NEED_PROXY]=0			# 0 = No Proxy,    1 = Create Proxy.
	INT[NEED_ADMIN]=0			# 0 = No Admin,    1 = Create Admin.
	INT[NEED_HOSTACL]=0			# 0 = No Host ACL, 1 = Create Host ACL.
	INT[EXISTING_PROFILE]=0
	STR[LDAP_PROXYAGENT]=''
	STR[LDAP_PROXYAGENT_CRED]=''
	STR[LDAP_ADMINDN]=''
	STR[LDAP_ADMIN_CRED]=''		# enableShadowUpdate flag and Admin credential
	STR[LDAP_SUFFIX]=''			# storage backend
	STR[LDAP_SUFFIX_OBJ]=''		# suffix objectclass
	STR[LDAP_SUFFIX_ACI]=''		# suffix ACI
	STR[LDAP_DOMAIN]=${X%%.}	# domainname on Server (default value)
	
	# DSEE specific information
	STR[DS_HOST]=''
	INT[DS_PORT]=389
	INT[NEED_TIME]=0
	INT[NEED_SIZE]=0
	INT[NEED_SRVAUTH_PAM]=0
	INT[NEED_SRVAUTH_KEY]=0
	INT[NEED_SRVAUTH_CMD]=0
	INT[DS_TIMELIMIT]=0
	INT[DS_SIZELIMIT]=0

	# LDAP PROFILE related defaults
	STR[LDAP_ROOTDN]='cn=Directory Manager'	# Provide common default.
	STR[LDAP_ROOTPWD]=''					# NULL passwd (is invalid)
	STR[LDAP_PROFILE_NAME]='default'
	STR[LDAP_BASEDN]=''
	STR[LDAP_SERVER_LIST]=''
	STR[LDAP_AUTHMETHOD]=''
	INT[LDAP_FOLLOWREF]=0
	INT[NEED_CRYPT]=0
	# 		make sure, it is registered, but don't change its value
	(( ! INT[NEED_CRYPT_IMPORT] )) && INT[NEED_CRYPT_IMPORT]=0
	STR[LDAP_SEARCH_SCOPE]='one'
	STR[LDAP_SRV_AUTHMETHOD_PAM]=''
	STR[LDAP_SRV_AUTHMETHOD_KEY]=''
	STR[LDAP_SRV_AUTHMETHOD_CMD]=''
	INT[LDAP_SEARCH_TIME_LIMIT]=30
	STR[LDAP_PREF_SRVLIST]=''
	INT[LDAP_PROFILE_TTL]=43200
	STR[LDAP_CRED_LEVEL]='proxy'
	INT[LDAP_BIND_LIMIT]=10

	# Service Search Descriptors (just make sure it is empty)
	SSD=( ); unset SSD[0]				# unset is required!

    # GSSAPI setup
    INT[GSSAPI_ENABLE]=0
    STR[LDAP_KRB_REALM]=''

	# temp settings
	TMPF[IS_OPENDJ]=0					# set if detected DS is OpenDS/OpenDJ
	TMPF[DEL_OLD_PROFILE]=0				# 0 = don't, 1 = delete old profile
	TMPF[STEP]=1						# simple progress indicator
	TMPF[GSSAPI_AUTH_MAY_BE_USED]=0		# DS GSSAPI SASL support
	TMPF[NEED_CREATE_SUFFIX]=0			# see add_suffix()
	TMPF[NEED_CREATE_BACKEND]=0			# see add_suffix()
	# schema completion syntax to use:
	# 0 .. detect, 1 .. force OpenDJ, 2 .. force DSEE
	(( TMPF[SYNTAX] < 0 || TMPF[SYNTAX] > 2 )) && TMPF[SYNTAX]=0

    TMP[LDAP_ROOTPWF]=${TMP[DIR]}/rootPWD	# filename containing the root PW
	TMP[WARN]=''							# set if possibly incompatible DS
	TMP[ATT]=''							# attribute classname for backend (id)
    TMP[VAL]=''							# attribute value for backend
	TMP[DS_DBS_AVAIL]=''				# available suffix DBs
	#	Set via getopts - just make sure, they are registered
	[[ -z ${TMP[IN]} ]] && TMP[IN]=''		# the config file to read
	[[ -z ${TMP[OUT]} ]] && TMP[OUT]='' 	# the config file to write
}

Man.addFunc show_vars '' '[+NAME?show_vars - List of all config variables and their values.]
[+DESCRIPTION?Lists all config variables and their current values in a more or less human readable manner.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage INT STR SSD ; }" '}
'
function show_vars {
	(( ! VERBOSE )) && return

	typeset S=${!STR[@]} OUT='Current non-NULL values:\n'
	S=${ print ${S// /$'\n'} | sort ; }
	for KEY in $S ; do
		[[ -n ${STR[$KEY]} ]] && \
			OUT+=${ printf "%32s = '%s'" ${KEY} "${STR[$KEY]}" ; }'\n'
	done
	S=${!INT[@]}
	S=${ print ${S// /$'\n'} | sort ; }
	for KEY in $S ; do
		(( INT[$KEY] )) && \
			OUT+=${ printf "%32s = %d" ${KEY} "${INT[$KEY]}" ; }'\n'
	done
	if (( ${#SSD[@]} )); then
		OUT+=${ printf "%32s = (" 'SSD' ; }
		for S in "${SSD[@]}" ; do
			OUT+="\t\t${S}\n"
		done
		OUT+='\t)\n'
	fi
	print -u2 "${OUT}"
}

Man.addFunc save_password '' '[+NAME?save_password - Save password to temporary file.]
[+DESCRIPTION?Save the current password from \bSTR[LDAP_ROOTPWD]]\b to the file \bTMP[LDAP_ROOTPWF]]\b.]
'
function save_password {
	print "${STR[LDAP_ROOTPWD]}" >"${TMP[LDAP_ROOTPWF]}"
}
#############################################################################
# EOG
#############################################################################


#############################################################################
# config file stuff
#############################################################################
Man.addFunc create_config_file '' '[+NAME?create_config_file - Write config data to the specified file.]
[+DESCRIPTION?Write config data to \afile\a.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage INT STR SSD ; }" '}
[+RETURN VALUES]{
	[+0?file was written successfully.]
	[+>= 1?otherwise.]
}
[+SEE ALSO?\bload_config_file()\b.]
\n\n\afile\a
'
function create_config_file {
	typeset OUT="$1" KEY
	[[ -z ${OUT} ]] && return 1

	# Create output file.
	(
    	print '
# '"${OUT}"' - This file contains configuration information for
# LDAP naming services.  Use the idsconfig tool to load it.
#
# WARNING: This file was generated by idsconfig, and is intended to
#          be loaded by idsconfig as is.  DO NOT EDIT THIS FILE!
'
		print 'typeset -A -i IIN=( )'
		for KEY in "${!INT[@]}" ; do
			print "IIN[${KEY}]=${INT[${KEY}]}"
		done
		print '\ntypeset -A SIN=( )'
		for KEY in "${!STR[@]}" ; do
			printf "SIN[${KEY}]=%q\n" "${STR[${KEY}]}"
		done
		print '\ntypeset -a SIN_SSD=( )'
		for KEY in "${SSD[@]}" ; do
			[[ -n ${KEY} ]] && printf "SIN_SSD+=( %q )\n" "${KEY}"
		done
		print "\n# End of ${OUT}"
	) >"${OUT}"
}

# for backward compatibilty, but not documented: old format is bogus and should
# not be used anymore.
function source_old_config {
	typeset IN="$1"
	typeset TODO=''
	typeset -A OLDMAP=(
		[DS_HOST]=IDS_SERVER
		[DS_PORT]=IDS_PORT
		[DS_DB]=IDS_DATABASE
		[DS_TIMELIMIT]=IDS_TIMELIMIT
		[DS_SIZELIMIT]=IDS_SIZELIMIT
		[SSD]=LDAP_SERV_SRCH_DES
	)

	for KEY in "${!INT[@]}" ; do
		VNAME=${OLDMAP[${KEY}]}
		[[ -z ${VNAME} ]] && VNAME=${KEY}
		typeset -n VAR=${VNAME}
		INT[${KEY}]=${VAR}
		TODO+="${VNAME} "
	done
	for KEY in "${!STR[@]}" ; do
		VNAME=${OLDMAP[${KEY}]}
		[[ -z ${VNAME} ]] && VNAME=${KEY}
		typeset -n VAR=${VNAME}
		STR[${KEY}]="${VAR}"
		TODO+="${VNAME} "
	done
	while read LINE; do
		if [[ ${LINE:0:19} == 'LDAP_SERV_SRCH_DES=' ]]; then
			VAL="${LINE:19}"
			[[ -n ${VAL} ]] && SSD+=( "${VAL}" )
		fi
	done < "${IN}"

	# cleanup "global" namespace
	[[ -n ${TODO} ]] && eval "unset ${TODO}"
}

Man.addFunc load_config_file '' '[+NAME?load_config_file - load an '"${PROG}"' config file.]
[+DESCRIPTION?Loads the initial config from \afile\a, which has been generated in a previous run by '"${PROG}"'. Sets \bTMPF[DEL_OLD_PROFILE]]\b to 1 on success.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage INT STR SSD ; }" '}
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66? \afile\a is not a file or unreadable.]
}
[+SEE ALSO?\bsave_password()\b, \bshow_vars()\b.]
\n\n\afile\a
'
function load_config_file {
	typeset IN="$1" KEY VAL
	integer I
	[[ ! -f ${IN} ]] && print -u2 "${IN} is not a file!" && return 66
	[[ ! -r ${IN} ]] && print -u2 "${IN} is not readable!" && return  67

	# source in the stuff - not nice but less work ;-)
	. "${IN}"

	KEY=${ typeset -p IIN ; }
	if [[ -z ${KEY} ]]; then
		source_old_config "${IN}" || return 68
	else
		for KEY in "${!INT[@]}" ; do
			INT[${KEY}]=${IIN[${KEY}]}
		done
		for KEY in "${!STR[@]}" ; do
			STR[${KEY}]="${SIN[${KEY}]}"
		done
		for KEY in "${SIN_SSD[@]}" ; do
			[[ -n ${KEY} ]] && SSD+=( "${KEY}" )
		done
		# cleanup "global" namespace
		unset IIN SIN SIN_SSD
	fi

	TMPF[DEL_OLD_PROFILE]=1
	save_password
	show_vars

	return 0
}
#############################################################################
# End Of  config file stuff
#############################################################################


############################################################################
# Basic [menu] stuff
############################################################################
Man.addFunc display_msg '' '[+NAME?display_msg - display a message]
[+DESCRIPTION?Display a message corresponding to the \atag\a passed in.]
[+ENVIRONMENT VARIABLES]{'"${ Man.varUsage INT STR TMP ; }" '}
\n\n\atag\a
'
function display_msg {
	typeset X
	integer I

	case "$1" in
		backup_server)
			print '
It is strongly recommended that you BACKUP the directory server
before running '"${PROG}"'.

Hit Ctrl-C at any time before the final confirmation to exit.\n'
			;;
		setup_complete)
			print '
'"${PROG}"': Setup of DSEE server '"${STR[DS_HOST]}"' is complete.\n'
			;;
		cred_level_menu)
			print 'The following are the supported credential levels:'
			for (( I=0; I < ${#CRED_LEVELS[@]}; I++ )); do
				printf ' %2d %s\n' $((I+1)) "${CRED_LEVELS[I]}"
			done
			;;
		auth_method_menu)
			print 'The following are the supported Authentication Methods:'
			I=0
			for X in "${AUTH_METHODS[@]}" ; do
				[[ -z ${X} ]] && X='none'
				printf ' %-2d  %s\n' $((I+1)) "${X}"
			done
			;;
		srvauth_method_menu)
			print 'The following are the supported Authentication Methods:'
			# just skip '' and use real index
			I=0
			for X in "${AUTH_METHODS[@]}" ; do
				[[ -z ${X} ]] && continue
				printf ' %-2d  %s\n' $((I)) "${X}"
			done
			;;
		prompt_ssd_menu)
			print 'A  Add a Service Search Descriptor
  D  Delete a SSD
  M  Modify a SSD
  P  Display all SSDs
  H  Help
  X  Clear all SSDs

  Q  Exit menu'
			;;
		summary_menu)
			typeset SUFFIX_INFO=''
			typeset DB_INFO=''

			if (( TMPF[NEED_CREATE_SUFFIX] )); then
				SUFFIX_INFO='
         Suffix to create          : '"${STR[LDAP_SUFFIX]}"'\n'
				(( TMPF[NEED_CREATE_BACKEND] )) && DB_INFO='
         Database to create        : '"${STR[DS_DB]}"'\n'
			fi
			typeset BASEDN
			BASEDN="${STR[LDAP_BASEDN]}${STR[SUFFIX_INFO]}${STR[DB_INFO]}"

			print '              Summary of Configuration

  1  Domain to serve               : '"${STR[LDAP_DOMAIN]}"'
  2  Base DN to setup              : '"${BASEDN}"'
  3  Profile name to create        : '"${STR[LDAP_PROFILE_NAME]}"'
  4  Default Server List           : '"${STR[LDAP_SERVER_LIST]}"'
  5  Preferred Server List         : '"${STR[LDAP_PREF_SRVLIST]}"'
  6  Default Search Scope          : '"${STR[LDAP_SEARCH_SCOPE]}"'
  7  Credential Level              : '"${STR[LDAP_CRED_LEVEL]}"'
  8  Authentication Method         : '"${STR[LDAP_AUTHMETHOD]}"'
  9  Enable Follow Referrals       : '"${INT[LDAP_FOLLOWREF]}"'
 10  DS Time Limit                 : '"${INT[DS_TIMELIMIT]}"'
 11  DS Size Limit                 : '"${INT[DS_SIZELIMIT]}"'
 12  Enable crypt password storage : '"${INT[NEED_CRYPT]}"'
 13  Service Auth Method pam_ldap  : '"${STR[LDAP_SRV_AUTHMETHOD_PAM]}"'
 14  Service Auth Method keyserv   : '"${STR[LDAP_SRV_AUTHMETHOD_KEY]}"'
 15  Service Auth Method passwd-cmd: '"${STR[LDAP_SRV_AUTHMETHOD_CMD]}"'
 16  Search Time Limit             : '"${INT[LDAP_SEARCH_TIME_LIMIT]}"'
 17  Profile Time to Live          : '"${INT[LDAP_PROFILE_TTL]}"'
 18  Bind Limit                    : '"${INT[LDAP_BIND_LIMIT]}"'
 19  Enable shadow update          : '"${INT[LDAP_ENABLE_SHADOW_UPDATE]}"'
 20  Service Search Descriptors Menu\n'
			;;
		sfx_not_suitable)
			print '
Sorry, suffix '"${STR[LDAP_SUFFIX]} is not suitable for Base DN" \
				"${STR[LDAP_BASEDN]}\n"
			;;
		sfx_config_incons)
			print '
Sorry, there is no suffix mapping for '"${STR[LDAP_SUFFIX]}"',
while ldbm database exists, server configuration needs to be fixed manually,
look at cn=mapping tree,cn=config and cn=ldbm database,cn=plugins,cn=config\n'
			;;
		ldbm_db_exist)
			print '
Database "'"${STR[DS_DB]}"'" already exists,
however "'"${STR[IDS_DATABASE_AVAIL]}"'" name is available\n'
			;;
		unable_find_db_name)
			print '
Unable to find any available database name close to "'"${STR[DS_DB]}"'
'
			;;
		create_ldbm_db_error)
			print '
ERROR: unable to create suffix '"${STR[LDAP_SUFFIX]}"'
       due to server error that occurred during creation of ldbm database\n'
			;;
		create_suffix_entry_error)
			print '
ERROR: unable to create entry '"${STR[LDAP_SUFFIX]} of" \
				"${STR[LDAP_SUFFIX_OBJ]} class\n"
			;;
		sorry)
			print '
HELP - No help is available for this topic.\n'
			;;
		create_suffix_help)
			print '
HELP - Our Base DN is '"${STR[LDAP_BASEDN]}"'
       and we need to create a Directory Suffix,
       which can be equal to Base DN itself or be any of Base DN parents.
       All intermediate entries up to suffix will be created on demand.\n'
			;;
		enter_ldbm_db_help)
			print '
HELP - ldbm database is an internal database for storage of our suffix data.
       Database name must be alphanumeric due to Directory Server restriction.
'
			;;
		backup_help)
			print '
HELP - Since idsconfig modifies the directory server configuration,
       it is strongly recommended that you backup the server prior
       to running this utility.  This is especially true if the server
       being configured is a production server.\n'
			;;
		port_help)
			print '
HELP - Enter the port number the directory server is configured to
       use for LDAP.\n'
			;;
		domain_help)
			print '
HELP - This is the DNS domain name this server will be serving.  You
       must provide this name even if the server is not going to be populated
       with hostnames.  Any unqualified hostname stored in the directory
       will be fully qualified using this DNS domain name.\n'
			;;
		basedn_help)
			print '
HELP - This parameter defines the default location in the directory tree for
       the naming services entries.  You can override this default by using 
       serviceSearchDescriptors (SSD). You will be given the option to set up 
       an SSD later on in the setup.\n'
			;;
		profile_help)
			print '
HELP - Name of the configuration profile with which the clients will be
       configured. A directory server can store various profiles for multiple 
       groups of clients.  The initialization tool, (ldapclient(1M)), assumes 
       "default" unless another is specified.\n'
			;;
		def_srvlist_help)
			print '
HELP - Provide a list of directory servers to serve clients using this profile.
       All these servers should contain consistent data and provide similar 
       functionality.  This list is not ordered, and clients might change the 
       order given in this list. Note that this is a space separated list of 
       *IP addresses* (not host names).  Providing port numbers is optional.\n'
			;;
		pref_srvlist_help)
			print '
HELP - Provide a list of directory servers to serve this client profile. 
       Unlike the default server list, which is not ordered, the preferred 
       servers must be entered IN THE ORDER you wish to have them contacted. 
       If you do specify a preferred server list, clients will always contact 
       them before attempting to contact any of the servers on the default 
       server list. Note that you must enter the preferred server list as a 
       space-separated list of *IP addresses* (not host names).  Providing port 
       numbers is optional.\n'
			;;
		srch_scope_help)
			print '
HELP - Default search scope to be used for all searches unless they are
       overwritten using serviceSearchDescriptors.  The valid options
       are "one", which would specify the search will only be performed 
       at the base DN for the given service, or "sub", which would specify 
       the search will be performed through *all* levels below the base DN 
       for the given service.\n'
			;;
		cred_lvl_help)
			print '
HELP - This parameter defines what credentials the clients use to
       authenticate to the directory server.  This list might contain
       multiple credential levels and is ordered.  If a proxy level
       is configured, you will also be prompted to enter a bind DN
       for the proxy agent along with a password.  This proxy agent
       will be created if it does not exist.\n'
			;;
		auth_help)
			print '
HELP - The default authentication method(s) to be used by all services
       in the client using this profile.  This is a ordered list of
       authentication methods separated by a ";".  The supported methods
       are provided in a menu.  Note that sasl/DIGEST-MD5 binds require
       passwords to be stored un-encrypted on the server.\n'
			;;
		srvauth_help)
			print '
HELP - The authentication methods to be used by a given service.  Currently
       3 services support this feature: pam_ldap, keyserv, and passwd-cmd.
       The authentication method specified in this attribute overrides
       the default authentication method defined in the profile.  This
       feature can be used to select stronger authentication methods for
       services which require increased security.\n'
			;;
		pam_ldap_help)
			print '
HELP - The authentication method(s) to be used by pam_ldap when contacting
       the directory server.  This is a ordered list, and, if provided, will
       override the default authentication method parameter.\n'
			;;
		keyserv_help)
			print '
HELP - The authentication method(s) to be used by newkey(1M) and chkey(1)
       when contacting the directory server.  This is a ordered list and
       if provided will override the default authentication method
       parameter.\n'
			;;
		passwd-cmd_help)
			print '
HELP - The authentication method(s) to be used by passwd(1) command when
       contacting the directory server.  This is a ordered list and if
       provided will override the default authentication method parameter.\n'
			;;
		referrals_help)
			print '
HELP - This parameter indicates whether the client should follow
       ldap referrals if it encounters one during naming lookups.\n'
			;;
		tlim_help)
			print '
HELP - The server time limit value indicates the maximum amount of time the
       server would spend on a query from the client before abandoning it.
       A value of "-1" indicates no limit.\n'
			;;
		slim_help)
			print '
HELP - The server sizelimit value indicates the maximum number of entries
       the server would return in respond to a query from the client.  A
       value of "-1" indicates no limit.\n'
			;;
		crypt_help)
			print '
HELP - By default DSEE does not store userPassword attribute values using
       unix "crypt" format.  If you need to keep your passwords in the crypt
       format for NIS/NIS+ and pam_unix compatibility, choose "yes".  If
       passwords are stored using any other format than crypt, pam_ldap
       MUST be used by clients to authenticate users to the system. Note 
       that if you wish to use sasl/DIGEST-MD5 in conjunction with pam_ldap,
       user passwords must be stored in the clear format.\n'
			;;
		srchtime_help)
			print '
HELP - The search time limit the client will enforce for directory
       lookups.\n'
			;;
		profttl_help)
			print '
HELP - The time to live value for profile.  The client will refresh its
       cached version of the configuration profile at this TTL interval.\n'
			;;
		bindlim_help)
			print '
HELP - The time limit for the bind operation to the directory.  This
       value controls the responsiveness of the client in case a server
       becomes unavailable.  The smallest timeout value for a given
       network architecture/conditions would work best.  This is very
       similar to setting TCP timeout, but only for LDAP bind operation.\n'
			;;
		ssd_help)
			print '
HELP - Using Service Search Descriptors (SSD), you can override the
       default configuration for a given service.  The SSD can be
       used to override the default search base DN, the default search
       scope, and the default search filter to be used for directory
       lookups.  SSD are supported for all services (databases)
       defined in nsswitch.conf(4).

       Note: SSD are powerful tools in defining configuration profiles
             and provide a great deal of flexibility.  However, care
             must be taken in creating them.  If you decide to make use
             of SSDs, consult the documentation first.\n'
			;;
		ssd_menu_help)
			print '
HELP - Using this menu SSD can be added, updated, or deleted from
       the profile.

       A - This option creates a new SSD by prompting for the
           service name, base DN, and scope.  Service name is
           any valid service as defined in ldap(1).  base is
           either the distinguished name to the container where
           this service will use, or a relative DN followed
           by a ",".
       D - Delete a previously created SSD.
       M - Modify a previously created SSD.
       P - Display a list of all the previously created SSD.
       X - Delete all of the previously created SSD.

       Q - Exit the menu and continue with the server configuration.\n'
			;;
		enable_shadow_update_help)
			print '
HELP - Enter "y" to set up the LDAP server for shadow update.
       The setup will add an administrator identity/credential
       and modify the necessary access controls for the client
       to update shadow(4), auth_attr(4), exec_attr(4), prof_attr(4),
       user_attr(4), and project(4) data on the LDAP server. If
       sasl/GSSAPI is in use, the Kerberos host principal will be used
       as the administrator identity.

       Shadow data is used for password aging and account locking.
       Please refer to the shadow(4) manual page for details.\n'
			;;
		add_admin_cred_help)
			print '
HELP - Start the setup to add an administrator identity/credential
       and to modify access controls for the client to update
       shadow(4), auth_attr(4), exec_attr(4), prof_attr(4),
       user_attr(4), and project(4) data on the LDAP server.

       Shadow data is used for password aging and account locking.
       Please refer to the shadow(4) manual page for details.\n'
			;;
		use_host_principal_help)
			print '
HELP - A profile with a "sasl/GSSAPI" authentication method and a "self"
       credential level is detected, enter "y" to modify the necessary
       access controls for allowing the client to update shadow(4) data
       on the LDAP server.

       Shadow data is used for password aging and account locking.
       Please refer to the shadow(4) manual page for details.\n'
			;;
	esac
}

Man.addVar ANS 'Variable used to return the user input.'
Man.addFunc get_ans '' '[+NAME?get_ans - gets an answer from the user.]
[+DESCRIPTION?Read a string from stdin. Arguments:]{
	[+prompt?instruction/comment/description/question to show.]
	[+default?Default value to use if no answer/empty string was read.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ANS ; }" '}
\n\n\aprompt\a [\adefault\a]
'
function get_ans {
	typeset PROMPT="$1 "
    [[ -n $2 ]] && PROMPT+="[$2] "

	read ANS?"${PROMPT}"
	[[ -z ${ANS} ]] && ANS="$2"
}


Man.addFunc get_ans_req '' '[+NAME?get_ans_req - get a non-empty answer from the user.]
[+DESCRIPTION?Read a string from stdin. Does not return until the string is a non-empty string or a \adefault\a value is given. Arguments:]{
	[+prompt?instruction/comment/description/question to show.]
	[+default?Default value to use if no answer/empty string was read.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ANS ; }" '}
[+SEE ALSO?\bget_ans()\b]
\n\n\aprompt\a [\adefault\a]
'
function get_ans_req {
	ANS=''
	while [[ -z ${ANS} ]]; do
		get_ans "$@"
		[[ -z ${ANS} ]] && print -u2 'NULL value not allowed!'
	done
}

Man.addFunc is_numeric '' '[+NAME?is_numeric - check whether arg is a numeric string]
[+DESCRIPTION?Check whether the given \astring\a is a numeric string.]
[+RETURN VALUES]{
	[+0?If the string is a numeric string.]
	[+1?Otherwise.]
}
[+SEE ALSO?\bnot_numeric()\b]
\n\n\astring\a
'
function is_numeric {
	# Check for parameter.
	(( $# != 1 )) && return 1

	# Determine if numeric.
    expr "$1 + 1" > /dev/null 2>&1
    (( $? >= 2 )) && return 1

	# Made it here, it's Numeric.
	return 0
}

Man.addFunc not_numeric '' '[+NAME?not_numeric - check whether arg is NOT a numeric string]
[+DESCRIPTION?Check whether the given \astring\a is NOT a numeric string. Useful for if and while statements that want to test for non-numeric data.]
[+RETURN VALUES]{
	[+0?If the string is NOT a numeric string.]
	[+1?Otherwise.]
}
[+SEE ALSO?\bis_numeric()\b]
\n\n\astring\a
'
function not_numeric {
	is_numeric $1 && return 1
	return 0
}

Man.addVar NUM 'Variable used to return the user input as a number.'
Man.addFunc get_number '' '[+NAME?get_number - get a number from the user.]
[+DESCRIPTION?Read a string from stdin until it represents a number. Arguments:]
{
	[+prompt?instruction/comment/description/question to show.]
	[+default?Default value to use if no answer/empty string was read.]
	[+helpTag?Tag of the help message to show, when the string read is h|H|?|help|Help.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage NUM ANS ; }" '}
[+SEE ALSO?\bget_ans()\b, \bis_numeric()\b, \bdisplay_msg()\b]
\n\n\aprompt\a \adefault\a [\ahelpTag\a]
'
function get_number {
	ANS=''

	get_ans "$1" "$2"

	# Verify that value is numeric.
	while not_numeric $ANS ; do
		case "${ANS}" in
			[Hh?] | help | Help) display_msg ${3:-sorry} ;;
			* ) print -u2 -n "Invalid value: '${ANS}'. " ;;
		esac
		# Get a new value.
		get_ans 'Enter a numeric value:' "$2"
	done
	NUM=${ANS}
}


Man.addFunc get_negone_num '' '[+NAME?get_negone_num - get a number >= -1 from the user.]
[+DESCRIPTION?Read a string from stdin until it represents a number >= -1. Arguments:]
{
	[+prompt?instruction/comment/description/question to show.]
	[+default?Default value to use if no answer/empty string was read.]
	[+helpTag?Tag of the help message to show, when the string read is h|H|?|help|Help.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage NUM ANS ; }" '}
[+SEE ALSO?\bget_number()\b]
\n\n\aprompt\a \adefault\a [\ahelpTag\a]
'
function get_negone_num {
	while : ; do
		get_number "$1" "$2" "$3"
		 (( NUM >= -1 )) && break
		# Need to re-enter number.
		print -u2 'Invalid number! Enter a number >= -1.'
	done
}

Man.addFunc get_passwd '' '[+NAME?get_passwd - get a password from the user.]
[+DESCRIPTION?Read a password from stdin and verify with second until both match. Password gets not echoed to stdout. Arguments:]
{
    [+prompt?instruction/comment/description/question to show.]
    [+default?Default value to use if no answer/empty string was read.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ANS ; }" '}
[+SEE ALSO?\bget_ans()\b]
\n\n\aprompt\a [\adefault\a]
'
function get_passwd {
	# Temporary PASSWD variables
	typeset _PASS1='' _PASS2=''

	${STTY} -echo			# Turn echo OFF

	# Endless loop that continues until passwd and re-entered passwd match.
	while : ; do
		ANS=''
		# Don't allow NULL for first try.
		while [[ -z ${ANS}  ]]; do
			get_ans "$@"
			[[ -z ${ANS} ]] && print -u2 '\nEmpty password not allowed!'
		done
		_PASS1="${ANS}"			# Store first try.

		# Get second try.
		print
		get_ans 'Re-enter password:'
		_PASS2="${ANS}"

		[[ ${_PASS1} == ${_PASS2} ]] && break
		print -u2 "\nERROR: passwords don't match; try again."
	done

	${STTY} echo			# Turn echo ON

	print
}

Man.addFunc get_passwd_nochk '' '[+NAME?get_passwd_nochk - get a password from the user w/o check.]
[+DESCRIPTION?Read a password from stdin. Actually the same as \bget_ans()\b but echoing characters read to stdout is switched off. Arguments:]
{
    [+prompt?instruction/comment/description/question to show.]
    [+default?Default value to use if no answer/empty string was read.]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ANS ; }" '}
[+SEE ALSO?\bget_ans()\b]
\n\n\aprompt\a [\adefault\a]
'
function get_passwd_nochk {
	${STTY} -echo			# Turn echo OFF
	get_ans "$@"
	${STTY} echo			# Turn echo ON
	print
}

Man.addFunc get_menu_choice '' '[+NAME?get_menu_choice - get a valid menu choice number.]
[+DESCRIPTION?Get a menu choice from user. Continue prompting until the choice is in required range. Arguments:]
{
	[+prompt?Message text.]
	[+min?Min value.]
	[+max?Max value.]
	[+default?Default value to use if no answer/empty string was read.]
	[+helpTag?If given, "h" is allowed as well and the help message for this tag gets shown, when it got typed and before the prompt is shown the first time. The prompt should contain a hint in this case.]
}
[+RETURN VALUES]{
	[+-1?on error (invalid parameters).]
	[+>= \amin\a?the selected value.]
}
[+SEE ALSO?\bis_numeric()\b, \bget_ans()\b, \bdisplay_msg()\b.]
\n\n\aprompt\a \amin\a \amax\a [\adefault\a [\ahelpTag\a]] 
'
function get_menu_choice {
	# Check for req parameter.
	if (( $# < 3 )); then
		print -u2 "${.sh.fun}(): Did not get required parameters."
		return -1
	fi

	[[ -n $5 ]] && display_msg "$5"
	while : ; do
		get_ans "$1" "$4"
		if is_numeric ${ANS} && (( NUM >= $2 )) && (( NUM <= $3 )); then
			return ${NUM}
		fi
		if [[ -n $5 && ${ANS} == 'h' ]]; then
			display_msg "$5"
			continue
		fi
		print -u2 "Invalid choice! Enter a number in the range $2 .. $5."
	done
	return -1
}

Man.addFunc get_confirm '' '[+NAME?get_confirm - Get confirmation from the user.]
[+DESCRIPTION?Read a string from stdin until it matches Y|y|Yes|yes|YES|N|n|No|no|NO or an empty string. Arguments:]
{
    [+prompt?instruction/comment/description/question to show.]
    [+default?Default value to use if no answer/empty string was read.]
    [+helpTag?Tag of the help message to show, when the string read is h|H|?|help|Help.]
}
[+RETURN VALUES]{
	[+0?for NO]
	[+1?for YES]
}
[+SEE ALSO?\bdisplay_msg()\b]
\n\n\aprompt\a \adefault\a [\ahelpTag\a]
'
function get_confirm {
	typeset _ANSWER=''

	# Display Internal ERROR if $2 not set.
	if [[ -z $2 ]]; then
		print -u2 "INTERNAL ERROR: ${.sh.fun} requires 2 args, 3rd is optional."
		exit 2
	fi

	while : ; do
		read _ANSWER?"$1 [$2] "
		[[ -z ${_ANSWER} ]] && _ANSWER="$2"

		case "${_ANSWER}" in
		    [Yy] | yes | Yes | YES) return 1 ;;
			[Nn] | no  | No  | NO)  return 0 ;;
			[Hh?] | help | Help) display_msg ${3:-sorry} ;;
			* ) print -u2 'Please enter y or n.'  ;;
		esac
	done
}

Man.addFunc get_confirm_nodef '' '[+NAME?get_confirm_nodef - Get confirmation from the user.]
[+DESCRIPTION?Read a string from stdin until it matches Y|y|Yes|yes|YES|N|n|No|no|NO. No default value and help tag supported. Arguments:]
{
	[+prompt?instruction/comment/description/question to show.]
}
[+RETURN VALUES]{
	[+0?for NO]
	[+1?for YES]
}
\n\n[\aprompt\a]...
'
function get_confirm_nodef {
	typeset _ANSWER=''

	while : ; do
		read _ANSWER?"$@ "
		case "${_ANSWER}" in
			[Yy] | yes | Yes | YES) return 1 ;;
			[Nn] | no  | No  | NO)  return 0 ;;
			* ) print -u2 'Please enter y or n.'  ;;
		esac
	done
}
############################################################################
# End of basic [menu] stuff
############################################################################


######################################################################
# FUNCTIONS FOR prompt_config_info() START HERE.
######################################################################
Man.addFunc get_ids_server '' '[+NAME?get_ids_server - Prompt for DS server name.]
[+DESCRIPTION?Ask the user for the DS hostname, store it into \bSTR[DS_HOST]]\b and adjusts \bCON_ARGS\b.]
[+ENVIRONMENT VARIABLES]{'"${ Man.varUsage CON_ARGS ; }"'}
[+SEE ALSO?\bget_ans()\b, \bget_ids_port()\b, \bping\b(1M).]
'
function get_ids_server {
	typeset SRV="${STR[DS_HOST]}"
	typeset OS=${ uname -s ; }

	while : ; do
		get_ans "Enter the Directory Server's hostname to setup:" \
			"${STR[DS_HOST]}" 
		SRV="${ANS}"

		# Ping server to see if live.  If valid break out of loop.
		if [[ ${OS} == 'SunOS' ]]; then
			${PING} "${SRV}" 3 >/dev/null 2>&1 && break
		else
			${PING} -W 3 "${SRV}" >/dev/null 2>&1 && break
		fi
		print -u2 "ERROR: Server '${SRV}' is invalid or unreachable."
	done
	STR[DS_HOST]="${SRV}"

	# Set CON_ARGS since values might have changed.
	CON_ARGS="-h ${SRV} -p ${INT[DS_PORT]}"
}

Man.addFunc get_ids_port '' '[+NAME?get_ids_port - Prompt for DS port number.]
[+DESCRIPTION?Ask the user for the DS port number, store it into \bINT[DS_PORT]]\b and adjust \bCON_ARGS\b.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage CON_ARGS ; }" '}
[+SEE ALSO?\bget_number()\b, \bget_ids_server()\b, \bldapsearch\b(1).]
'
function get_ids_port {
	integer PORT
	while : ; do
		# Enter port number.
		get_number 'Enter the port number for the directory server (h=help):' \
			${INT[DS_PORT]} 'port_help'
		PORT=${ANS}
		# Do a simple search to check hostname and port number.
		if ${LDAPSEARCH} -h ${STR[DS_HOST]} -p ${PORT} -b '' \
			-s base 'objectclass=*' > /dev/null 2>&1
		then
			break
		fi
		print -u2 "ERROR: Invalid host or port '${STR[DS_HOST]}:${PORT}'."
		get_ids_server
	done
	INT[DS_PORT]=${PORT}

	# Set CON_ARGS since values might have changed.
	CON_ARGS="-h ${STR[DS_HOST]} -p ${PORT}"
}

Man.addFunc chk_ids_version '' '[+NAME?chk_ids_version - Read the DS version info.]
[+DESCRIPTION?Query the DS for version info and store it into \bTMP[DS_INFO]]\b as "ProductName MajorVersionNum MinorVersionNum". If the DS is OpenDS or OpenDJ \bTMPF[IS_OPENDJ]]\b gets set to 1, 0 otherwise. If the DS seems to be unsupported by this script, an appropriate message gets stored into \bTMP[WARN]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?on fatal error (got no info).]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function chk_ids_version {
	typeset PROD='' X LINE
	typeset  -a SPLIT=( )
	integer MAJOR=0 MINOR=0
    ${LDAPSEARCH} ${CON_ARGS} -b cn=monitor -s base 'objectclass=*' \
		2>/dev/null | \
	while read LINE ; do
		if [[ ${LINE:0:14} == 'vendorVersion=' ]]; then
			# OpenD*
			X=${LINE:14}
			X=${X//Directory Server }		# usually <= 2.3.x
			PROD=${X%% *}
			SPLIT=( ${.sh.match//./ } )
			MAJOR=${SPLIT[0]}
			MINOR=${SPLIT[1]}
			break
		elif [[ ${LINE:0:8} == 'version=' ]]; then
			# *DSEE
			X=${LINE:8}
			PROD=${X%%/*}
			X=${.sh.match#/}
			SPLIT=( ${X//./ } )
			MAJOR=${SPLIT[0]}
			MINOR=${SPLIT[1]}
			break
		fi
	done
	if [[ -z ${PROD} ]] || (( ${MAJOR} == 0 )); then
		print -u2 'ERROR: Can not determine the version number of the DS!'
		return 66
	fi

	TMP[DS_INFO]="${PROD} ${MAJOR} ${MINOR}"

	# for easier maintainance we don't put it into a single expr
	X=''
	if [[ ${PROD} == 'OpenDS' || ${PROD} == 'OpenDJ' ]]; then
		TMPF[IS_OPENDJ]=1
		(( MAJOR < 2 )) && X='1'
	elif (( MAJOR < 5 || (7 < MAJOR && MAJOR < 11) )); then
		# not a supported DSEE version
		TMPF[IS_OPENDJ]=0
		X='1'
    fi
	if [[ -n ${X} ]]; then
		TMP[WARN]="WARNING: $PROG only works with DSEE version 5.x, 6.x, 7.x, "
		TMP[WARN]+='ODSEE 11g and OpenDS/OpenDJ 2.x.'
		print "${TMP[WARN]}"
	fi
    (( VERBOSE )) && print "Detected DS:  ${PROD} ${MAJOR}.${MINOR}"
	return 0
}

Man.addFunc get_dirmgr_dn '' '[+NAME?get_dirmgr_dn - get the directory manger DN.]
[+DESCRIPTION?Ask the user for the directory manger DN and store it into \bSTR[LDAP_ROOTDN]]\b and adjust \bAUTH_ARGS\b.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage AUTH_ARGS ; }" '}
[+SEE ALSO?\bget_ans()\b.]
'
function get_dirmgr_dn {
	get_ans 'Enter the directory manager DN:' "${STR[LDAP_ROOTDN]}"
    STR[LDAP_ROOTDN]="${ANS}"
	AUTH_ARGS=( '-D' "${STR[LDAP_ROOTDN]}" '-j' "${TMP[LDAP_ROOTPWF]}" )
}

Man.addFunc get_dirmgr_pw '' '[+NAME?get_dirmgr_pw - get the Root DN password.]
[+DESCRIPTION?Ask the user for the Root DN (\bSTR[LDAP_ROOTDN]]\b), store it into \bSTR[LDAP_ROOTPWD]]\b as well as a temp file for later use. Finally adjust \bAUTH_ARGS\b and check, whether the changes work.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage AUTH_ARGS ; }" '}
[+SEE ALSO?\bget_passwd_nochk()\b, \bsave_password()\b, \bldapsearch\b(1).]
'
function get_dirmgr_pw {
	typeset RES

	while : ; do
		get_passwd_nochk "Enter passwd for ${STR[LDAP_ROOTDN]} :"
		STR[LDAP_ROOTPWD]="${ANS}"	# stored for create_config_file(), only
		save_password
		AUTH_ARGS=( '-D' "${STR[LDAP_ROOTDN]}" '-j' "${TMP[LDAP_ROOTPWF]}" )

		# Verify that ROOTDN and ROOTPWD are valid.
		RES=${ ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b '' -s base 'objectclass=*' supportedLDAPVersion 2>&1 ; }
		(( $? == 0 )) && break	# Both are valid.

		if [[ ${RES} =~ credential ]]; then
			print -u2 'ERROR: Password for Root DN is invalid.'
		else
			print -u2 "ERROR: Invalid Root DN '${STR[LDAP_ROOTDN]}'."
			get_dirmgr_dn
		fi
    done
}

Man.addFunc get_domain '' '[+NAME?get_domain - Ask user for domain to be served.]
[+DESCRIPTION?Ask the user for the Domain that will be served by the LDAP server and store it into \bSTR[LDAP_DOMAIN]]\b.]
[+SEE ALSO?\bget_ans()\b.]
'
function get_domain {
	while : ; do
		get_ans 'Enter the domainname to be served (h=help):' \
			"${STR[LDAP_DOMAIN]}"
		case "${ANS}" in
			[Hh?] | help | Help) display_msg 'domain_help' ; continue ;;
		esac
		# check, whether it has at least 2 dot separated components
		[[ ${ANS} =~ [^.]+\.[^.]+ ]] && break
		print -u2 "ERROR: Invalid domainname '${ANS}'."
    done
	STR[LDAP_DOMAIN]="${ANS}"
}

Man.addFunc getDSobjectclasses '' '[+NAME?getDSobjectclasses - get all DS schema objectclasses.]
[+DESCRIPTION?Fetch all objectclasses definitions of the DS via \bcn=schema\b and cache them into \bOID2ODEF\b. Once successfully fetched, this function does nothing but return 0.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>0?failed to retrieve attribute definitions.]
}
'
function getDSobjectclasses {
	(( ${#!OID2ODEF[@]} )) && return 0

	typeset AT OID NAME TAIL
	set -o pipefail
	${LDAPSEARCH} ${CON_ARGS} -b cn=schema -s base 'objectclass=*' \
		objectclasses 2>/dev/null | \
	while read AT OID NAME TAIL ; do
		[[ ${AT} != 'objectclasses=(' ]] && continue
		TAIL=${TAIL%%+( )$')'};
		OID2ODEF["${OID}"]="${TAIL}"
		:			# always return 0
	done
}

Man.addFunc getDSattributes '' '[+NAME?getDSattributes - get all DS schema attributes.]
[+DESCRIPTION?Fetch all attribute definitions of the DS via \bcn=schema\b and cache them into \bOID2ADEF\b. Also populate the hash map \bANAME2OID\b for all the attributes definied. Once successfully fetched, this function does nothing but return 0.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>0?failed to retrieve attribute definitions.]
}
'
function getDSattributes {
	(( ${#!ANAME2OID[@]} )) && return 0

	typeset AT OID NAME TAIL
	typeset -l ALIAS
	set -o pipefail
	${LDAPSEARCH} ${CON_ARGS} -b cn=schema -s base 'objectclass=*' \
		attributeTypes 2>/dev/null | \
	while read AT OID NAME TAIL ; do
		[[ ${AT} != 'attributeTypes=(' ]] && continue
		TAIL=${TAIL%%+( )$')'};
		OID2ADEF["${OID}"]="${TAIL}"
		# 'name'
		if [[ ${TAIL:0:1} == "'" ]]; then
			NAME=${TAIL:1}
			ALIAS=${NAME%%"'"*}
			ANAME2OID["${ALIAS}"]="${OID}"
			continue
		fi
		# ( 'name' 'name 1' ... )
		NAME=${TAIL%%$')'*}
		NAME=${NAME##$'('*([[:space:]])}
		while [[ ${NAME} == ~(E)"'"([^"'"]+)"'" ]]; do
			ALIAS=${.sh.match[1]}
			ANAME2OID["${ALIAS}"]="${OID}"
			NAME=${NAME:${#ALIAS}+2}
			NAME=${NAME#*([[:space:]])}
		done
		:			# always return 0
	done
}

Man.addFunc check_attrName '' '[+NAME?check_attrName - validate an attribute name.]
[+DESCRIPTION?Check that \akey\a is a valid attribute name.]
[+RETURN VALUES]{
	[0?key is a valid name.]
	[1?key is a invalid name.]
	[66?failed to fetch attribute definitions from server.]
}
[+SEE ALSO?\bldapsearch\b(1).]
\n\n\akey\a
'
function check_attrName {
	typeset KEY=$1

	if ! getDSattributes ; then
		print -u2 '  ERROR: Unable to fetch attribute definitions from server!'
		return 66
	fi
	[[ -z ${KEY} ]] && return 1
	if [[ ${KEY} =~ ^[0-9]+(\.[0-9]+)*$ ]]; then	
		# OID value
		[[ -n ${OID2ADEF[${KEY}]} ]] && return 0
	else
		# symbol. name
		KEY=${ANAME2OID[${KEY}]}
		# if have a mapping, than we also have a definition for it - no need
		# to double check
		[[ -n  ${KEY} ]] && return 0
	fi
	return 1
}

Man.addFunc check_baseDN '' '[+NAME?check_baseDN - check validity of the baseDN name.]
[+DESCRIPTION?Check that \abaseDN\a is a valid base DN.]
[+RETURN VALUES]{
    [+0?baseDN is a valid.]
    [+>= 1?baseDN is a invalid.]
}
[+SEE ALSO?\bcheck_attrName()\b.]
[+NOTES?This function does not catch all invalid DNs. Its purpose is to reduce the number of invalid DNs to get past the input routine.  The invalid DNs will be caught by the LDAP server when they are attempted to be created.]
\n\n\abaseDN\a
'
function check_baseDN {
	# NOTE: we preserve spaces! And try to report all errors instead of just one
    print '  Checking LDAP Base DN ...'
	[[ -z $1 ]] && return 0

	# NOTE: when fancy debug via trap is enabled, splitting via IFS does not
	# work: IFS=',' PAIRS=( $1 ) - so we do it manually

	typeset PAIR KEY VAL TAIL="${1},"
	typeset -A UNIQ_KEYS=( )	# avoid repeated lookup of the same attrName
	integer ERR=0
	while [[ -n ${TAIL} ]]; do
		TAIL=${TAIL#*,}
		PAIR=${.sh.match%,}
		VAL=${PAIR#*=}
		KEY=${.sh.match%=}
		if [[ -z ${KEY} || -z ${VAL} ]]; then
			print -u2 "ERROR: Invalid key=value pair '${PAIR}'"
			(( ERR++ ))
			continue
		fi
		UNIQ_KEYS[${KEY}]=1
	done

	for KEY in "${!UNIQ_KEYS[@]}" ; do
		if ! check_attrName "${KEY}" ; then
			print -u2 "ERROR: Unknown attribute name '${KEY}'"
		fi
	done
	return ${ERR}
}

Man.addFunc discover_serv_suffix '' '[+NAME?discover_serv_suffix - query the DS to find suffixes available.]
[+DESCRIPTION?Query the DS to find suffixes available. All suffixes found are stored into the variable \avname\a which must be an indexed array.]
[+RETURN VALUES]{
	[+0?at least one suffix was found.]
	[+1?no suffix found.]
}
[+SEE ALSO?\bldapsearch\b(1).]
\n\n\avname\a
'
function discover_serv_suffix {
	typeset LINE
	integer NUM_TOP=0
	typeset -n DST=$1
	DST=( ); unset DST[0]

	# OpenDJ/OpenDS - usually 'userRoot', only. See
	# ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b 'cn=Backends,cn=config' \
	#	-s sub 'objectclass=ds-cfg-local-db-backend' \
	#		ds-cfg-backend-id ds-cfg-base-dn

	# Search the server for the TOP of the TREE. Usually none for virgin DS
	${LDAPSEARCH} ${CON_ARGS} -b '' -s base 'objectclass=*' namingContexts \
		2>/dev/null | \
	while read LINE ; do
		if [[ -n ${LINE} && ${LINE} != ~(Ei)NetscapeRoot ]]; then
			(( NUM_TOP++ ))
			DST+=( "${LINE#*=}\n" )		# strip off '^namingContexts='
		fi
	done

	if (( NUM_TOP == 0 )); then
		(( VERBOSE )) && print -u2 'No suffix found in LDAP tree.'
		return 1
	fi

	(( VERBOSE )) && print -u2 "  LDAP_SUFFIX_LIST =\n${DST[@]}"
	return 0
}

Man.addFunc get_backend '' '[+NAME?get_backend - get the relevant backend (database) for the Base DN.]
[+DESCRIPTION?Get the relevant backend (database name) for the Base DN and store it into \bSTR[DS_DB]]\b.]
[+?Prerequisite: \bSTR[LDAP_BASEDN]]\b must be set and valid.]
[+?backend is retrieved from suffixes and subsuffixes defined under "cn=mapping tree,cn=config". The nsslapd-state attribute of these suffixes entries is filled with either Backend, Disabled or referrals related values. We only want those that have a true backend database to select the relevant backend.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?an fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function get_backend {
	typeset CUR_DN=${STR[LDAP_BASEDN]} PREV_DN='' FILTER

	while [[ ${CUR_DN} != ${PREV_DN} ]]; do
		typeset -a DB=( )
		(( VERBOSE )) && print "Testing LDAP suffix: ${CUR_DN} ..."

		if (( TMPF[IS_OPENDJ] )); then
			FILTER='(&(&(objectclass=ds-cfg-backend)(ds-cfg-base-dn='"${CUR_DN}"
			FILTER+='))(objectClass=ds-cfg-local-db-backend))'
			${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
				-b 'cn=Backends,cn=config' -s sub "${FILTER}" | \
			while read LINE ; do
				[[ ${LINE:0:18} == 'ds-cfg-backend-id=' && \
					${LINE: -10} != ',cn=config' ]] && DB+=( "${LINE:18}" )
			done
		else

			${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
				-b "cn=${CUR_DN},cn=mapping tree,cn=config" \
				-s 'base nsslapd-state=Backend nsslapd-backend' 2>/dev/null | \
			while read LINE ; do
				[[ ${LINE:0:16} == 'nsslapd-backend=' ]] && DB+=( "${LINE:16}" )
			done
		fi

		if (( ${#DB[@]} == 0 )); then
			# not a suffix, or suffix not activated; try next
			PREV_DN=${CUR_DN}
			CUR_DN="${CUR_DN#*,}"
		elif (( ${#DB[@]} == 1 )); then
			break
		else
			print -u2 'ERROR: More than one database is configured\n' \
				"       for '${CUR_DN}'!\n" \
				"       $PROG can not configure suffixes where\n" \
				'       more than one database is used for one suffix.\n'
			return 66
		fi
	done

	if (( ${#DB[@]} == 0 )); then
		# should not happen, since STR[LDAP_BASEDN] is supposed to be valid
		print -u2 "Could not find a valid backend for '${STR[LDAP_BASEDN]}'."
		if (( TMPF[IS_OPENDJ] )); then
			print -u2 'Check the "Creating a New Database Backend" section in the Administration Guide.'
		fi
		return 67
	fi
	STR[DS_DB]="${DB[0]}"

	(( VERBOSE )) && print -u2 "DB backend '${STR[DS_DB]}' selected."

	return 0
}

Man.addFunc normalizeDN '' '[+NAME?normalizeDN - normalize a [relative]] distinguished name.]
[+DESCRIPTION?Strip off unnecessary spaces around \b,\b and \b=\b as well as at the beginning and end of the given \adn\a, optionally convert it to lower or upper case (if either \bl\b or \bu\b is given) and print it to stdout.]
\n\n\adn\a [\bl\b|\bu\b]
'
function normalizeDN {
	[[ -z $1 ]] && return
	typeset VAL=",${1},"
	VAL="${VAL//*( ),*( )/,}"
	VAL="${VAL//*( )=*( )/=}"
	if [[ $2 == 'l' ]]; then
		typeset -l LC="${VAL}"
		VAL="${LC}"
	elif [[ $2 == 'u' ]]; then
		typeset -u UC="${VAL}"
		VAL="${UC}"
	fi
	print -- "${VAL:1:${#VAL}-2}"
}

Man.addFunc check_basedn_suffix '' '[+NAME?check_basedn_suffix - check that there is an existing valid suffix to hold current base DN.]
[+DESCRIPTION?Check that there is an existing valid suffix for \bSTR[LDAP_BASEDN]]\b. If one is found, store it into \bSTR[LDAP_SUFFIX]]\b and make a corresponding backend check.]
[+RETURN VALUES]{
	[+0?valid suffix found or new one should be created (\bTMPF[NEED_CREATE_SUFFIX]]\b flag actually indicates that).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bdiscover_serv_suffix()\b, \bldapsearch\b(1), \bnormalizeDN()\b, \bget_backend()\b.]
'
function check_basedn_suffix {
	print '  Validating LDAP Base DN and Suffix ...'
	TMPF[NEED_CREATE_SUFFIX]=0

	# check that LDAP Base DN might be added
	typeset CUR_DN="${STR[LDAP_BASEDN]}" PREV_DN=''

	while [[ ${CUR_DN} != ${PREV_DN} ]]; do
		${LDAPSEARCH} ${CON_ARGS} -b "${CUR_DN}" -s one 'objectclass=*' \
			>/dev/null 2>&1 && break
		PREV_DN=${CUR_DN}
		CUR_DN="${CUR_DN#*,}"	# remove leading component
	done

	if [[ ${CUR_DN} == ${PREV_DN} ]]; then
		print -u2 "  No valid suffixes were found for Base DN " \
			"'${STR[LDAP_BASEDN]}'."
		TMPF[NEED_CREATE_SUFFIX]=1
		return 0
	fi

	# find out existing suffixes
	typeset -a SUFFIXES=( )
	discover_serv_suffix SUFFIXES

	# Now looking for relevant suffix for this entry (using lower case - LC).
	# STR[LDAP_SUFFIX] will then be used to add necessary base objects via
	# add_base_objects().
	typeset LC_DN=,${ normalizeDN "${CUR_DN}" l ; }
	typeset SFX LC_SFX
	for SFX in "${SUFFIXES[@]}" ; do
		(( VERBOSE )) && print "Testing suffix: ${SFX} ..."
		# LC_DN ends with ,SFX ?
	    LC_SFX=,${ normalizeDN "${SFX}" l ; }
		if [[ ${LC_DN: -${#LC_SFX}} == ${LC_SFX} ]]; then
			STR[LDAP_SUFFIX]="${SFX}"
			break
		fi
	done

	if [[ -z ${STR[LDAP_SUFFIX]} ]]; then
		# should not happen, since we found the entry
		print -u2 "Could not find a valid suffix for '${STR[LDAP_BASEDN]}'."
	    return 66
	fi
	
	# Getting relevant database (backend)
	# DS_DB will then be used to create indexes.
	get_backend || return 67

	return 0
}

Man.addFunc get_objectclass '' '[+NAME?get_objectclass - get the objectclass for the given attribute name.]
[+DESCRIPTION?Get the objectclass for the given attribute name \aattrName\a and print it to stdout. Right now ou, dc, o, and c and related aliases/OIDs are supported, only. For all others nothing will be printed.]
[+NOTES?An attribute name can be valid but still we might not be able to determine the objectclass from the table. In such cases, the user needs to create the necessary object(s).]
\n\n\aattrName\a
'
function get_objectclass {
    typeset -l ANAME="$1"

	case "${ANAME}" in
		ou | organizationalunitname | 2.5.4.11)
			print 'organizationalUnit'
			;;
		dc | domaincomponent | 0.9.2342.19200300.100.1.25)
			print 'domain'
			;;
		o | organizationname | 2.5.4.10)
			print 'organization'
			;;
		c | countryname | 2.5.4.6)
			print 'country'
			;;
	esac
}

Man.addFunc prep_create_sfx_entry '' '[+NAME?prep_create_sfx_entry - prepare for the suffix entry creation.]
[+DESCRIPTION?Prepare suffix entry creation based on \bSTR[LDAP_BASEDN|LDAP_SUFFIX]]\b and \bSTR[LDAP_SUFFIX_OBJ|LDAP_SUFFIX_ACI]]\b. If the latter are unset (no config file read), set them to defaults depending on the baseDN. Finally check, whether the suffix entry already exists and if so check for consistency with the current config. This function sets:]{
	[+TMPF[NEED_CREATE_BACKEND]]?0 .. backend already exists. 1 .. create a backend.]
	[+TMP[ATT]]?The attribute name of the leading RDN of the suffix (ID).]
	[+TMP[VAL]]?The attribute value of the leading RDN of the suffix (ID).]
}
[+RETURN VALUES]{
	[+0?on success.]
	[+1?an attribute/consistence related error occured.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bnormalizeDN()\b, \bdisplay_msg()\b, \bldapsearch\b(1)]
' 
function prep_create_sfx_entry {
	# check whether suffix corresponds to base dn (i.e. baseDN ends with suffx)
	typeset X=,${ normalizeDN "${STR[LDAP_BASEDN]}" l ; }
	typeset SFX=,${STR[LDAP_SUFFIX]}
	if [[ ${X: -${#SFX}} != ${SFX} ]]; then
		display_msg 'sfx_not_suitable'
		return 1
	fi

	typeset RDN="${STR[LDAP_SUFFIX]%%,*}" ATTR
    TMP[VAL]="${RDN#*=}"
	TMP[ATT]="${.sh.match%=}"

	# find out an objectclass for suffix entry if it is not defined yet
	[[ -z ${STR[LDAP_SUFFIX_OBJ]} ]] && \
		STR[LDAP_SUFFIX_OBJ]=${ get_objectclass "${ATT}" ; }
	if [[ -z ${STR[LDAP_SUFFIX_OBJ]} ]]; then
		print "Unable to find an objectclass for '${TMP[ATT]}' attribute."
		return 1
	fi
	(( VERBOSE )) && print -u2 "Suffix entry object: '${STR[LDAP_SUFFIX_OBJ]}'."

	# TODO: adjust to OpenDJ
	# passwordPolicy 
	if (( TMPF[IS_OPENDJ] )); then
		# OpenDJ has not the DSEE role stuff => no nsroledn
		# see also: http://ludopoitou.wordpress.com/2012/06/20/
		# Here: all *pw{d|p}* attributes except those contained in pwdPolicy 
		# + Password Policy State extended ops 1.3.6.1.4.1.26027.1.6.1.*
		ANY_NO_READ=' || authPassword || pwdHistory || pwdExpirationTime
 || pwdChangedTime || pwdAccountLockedTime || pwdFailureTime || pwdGraceUseTime
 || pwdReset || pwdPolicySubEntry || ds-pwp-password-policy-dn || '
		SELF_NO_WRITE=' || ds-rlim-lookthrough-limit || ds-rlim-size-limit
 || ds-rlim-time-limit || ds-rlim-idle-time-limit'"${NOT_ANY_ATTR}"
	else
		ANY_NO_READ=' || passwordHistory || passwordExpirationTime
 || passwordExpWarned || passwordRetryCount || retryCountResetTime
 || accountUnlockTime || passwordAllowChangeTime'	# == passwordObject:*
		SELF_NO_WRITE='nsroledn || nsLookThroughLimit || nsSizeLimit
 || nsTimeLimit || nsIdleTimeout || passwordPolicySubentry'"${NOT_ANY_ATTR}"
	fi

	[[ -z ${STR[LDAP_SUFFIX_ACI]} ]] && STR[LDAP_SUFFIX_ACI]='
aci: (targetattr != "userPassword'"${ANY_NO_READ}"'")
 (
	version 3.0;  acl "Anonymous access";
	allow (read, search, compare) userdn = "ldap:///anyone";
 )
aci: (targetattr != "aci'"${SELF_NO_WRITE}"'")
 (
	version 3.0;  acl "Limited self entry modification";
	allow (write) userdn = "ldap:///self";
 )
aci: (targetattr = "*")
 (
	version 3.0;  acl "Configuration Administrator access";
	allow (all) userdn = "ldap:///uid=admin,ou=Administrators,
		ou=TopologyManagement,o=NetscapeRoot";
 )
aci: (targetattr ="*")
 (
	version 3.0;  acl "Configuration Administrators Group access";
	allow (all) groupdn = "ldap:///cn=Configuration Administrators,
		ou=Groups,ou=TopologyManagement,o=NetscapeRoot";
 )
'
	(( VERBOSE )) && print -u2 "\nACI for '${STR[LDAP_SUFFIX]}' is\n" \
		"${STR[LDAP_SUFFIX_ACI]}"

	TMPF[NEED_CREATE_BACKEND]=0

	# check the suffix mapping tree ...
	# If mapping exists, suffix should work, otherwise DSEE inconsistent
	# NOTE: -b 'cn=mapping tree,cn=config' -s one 'cn=\"$1\"' won't work
	#       in case of 'cn' value in LDAP is not quoted by '"',
	#       -b 'cn=\"$1\",cn=mapping tree,cn=config' works in all cases
	# TODO: adjust to OpenDJ
	if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-b "cn=\"${STR[LDAP_SUFFIX]}\",cn=mapping tree,cn=config" \
		-s base 'objectclass=*' dn 2>/dev/null
	then
		(( VERBOSE )) && print -u2 "Suffix mapping already exists"
		get_backend || return 66 
		return 0
	fi

    # no suffix mapping, just in case check ldbm backends consistency -
    # there are must be NO any databases pointing to STR[LDAP_SUFFIX] 
    X=${ ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-b 'cn=ldbm database,cn=plugins,cn=config' \
		-s one "nsslapd-suffix=${STR[LDAP_SUFFIX]}" dn 2>/dev/null ; }
	if [[ -n ${X} ]]; then
		display_msg 'sfx_config_incons'
		return 1
	fi

	# Ok, no suffix mapping, no ldbm database
	(( VERBOSE )) && print -u2 "Backend needs to be created ..."
	TMPF[NEED_CREATE_BACKEND]=1
	return 0
}

Man.addFunc prep_create_sfx_backend '' '[+NAME?prep_create_sfx_backend - prepare for the suffix backend creation.]
[+DESCRIPTION?Prepare for the suffix backend creation by checking available DBs starting with \bSTR[DS_DB]]\b. Sets \bTMP[DS_DB_AVAIL]]\b if not yet set or != \bSTR[DS_DB]]\b.]
[+RETURN VALUES]{
	[+0?ldbm db name is ok.]
	[+1?\bSTR[DS_DB]]\b exists, so \bTMP[DS_DB_AVAIL]]\b contains available name.]
	[+2?unable to find any available name.]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function prep_create_sfx_backend {
	# check if requested name available
	[[ ${STR[DS_DB]} == ${TMP[DS_DBS_AVAIL]} ]] && return 0

	# get the list of database names start with a requested name
	# TODO: adjust to OpenDJ, check output format
	typeset -a LDBM_DBS=( )
	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-b 'cn=ldbm database,cn=plugins,cn=config' \
		-s one "cn=${STR[DS_DB]}*" cn 2>/dev/null | \
	while read LINE ; do
		LDBM_DBS+=( "${LINE}" )
	done

	# find available db name based on a requested name
	integer I
	typeset NAME DB
	for (( I=0 ; I < 10; I++ )); do
		NAME="cn=${STR[DS_DB]}${I}"
		for DB in "${LDBM_DBS[@]}" ; do
			# TODO: check whether match works
			if [[ ${DB} == ${NAME} ]]; then
				TMP[DS_DBS_AVAIL]="${NAME#cn=}"
				break 2
			fi
		done
	done

    [[ ${STR[DS_DB]} == ${TMP[DS_DBS_AVAIL]} ]] && return 0

    if [[ -n ${TMP[DS_DBS_AVAIL]} ]]; then
		display_msg 'ldbm_db_exist'
		return 1
	fi

	display_msg 'unable_find_db_name'
    return 2
}

Man.addFunc get_suffix '' '[+NAME?get_suffix - Ask user for suffix and related backend.]
[+DESCRIPTION?Ask the user for the suffix (default: \bSTR[LDAP_BASEDN]]\b) to create and the db name if it does not yet exist. \bTMP[DS_DBS_AVAIL]]\b gets set to the given db name (if any), \bSTR[DS_DB]]\b to the prepared db name and \bSTR[LDAP_SUFFIX]]\b to the given suffix.]
[+RETURN VALUES]{
	[+0?on success (user gave a correct suffix).]
	[+1?unable to create suffix given by user.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b, \bnormalizeDN()\b, \bprep_create_sfx_entry()\b, \bprep_create_sfx_backend()\b.]
'
function get_suffix {
	while : ; do
		get_ans 'Enter suffix to be created (b=back/h=help):' \
			"${STR[LDAP_BASEDN]}"
		case "${ANS}" in
			[Hh?] | Help | help)
				display_msg 'create_suffix_help'
				continue
				;;
			[Bb] | '<' | Back | back)
				return 1
				;;
		esac
		STR[LDAP_SUFFIX]=${ normalizeDN "${ANS}" l ; }
		prep_create_sfx_entry
		integer REDO=$?
		(( ${REDO} >= 66 )) && return 66
		(( ${REDO} )) && continue

		if (( TMPF[NEED_CREATE_BACKEND] )); then
			TMP[DS_DBS_AVAIL]=''		# reset the available db name
			REDO=0
			while : ; do
				X={TMP[DS_DBS_AVAIL]}
				get_ans 'Enter ldbm database name (b=back/h=help):' \
					"${X:-${TMP[VAL]}}"
				case "${ANS}" in
					[Hh?])
						display_msg 'enter_ldbm_db_help'
						continue
						;;
					[Bb] | '<')
						REDO=1
						break
						;;
				esac
				STR[DS_DB]="${ANS}"
				prep_create_sfx_backend && break
			done

			(( REDO )) && continue

			(( VERBOSE )) && print '
Backend name for suffix ${STR[LDAP_SUFFIX]} will be ${DS_DB}'
		fi
		# eventually everything is prepared
		break
	done
	return 0
}

Man.addFunc domain_2_dc '' '[+NAME?domain_2_dc - Convert a domain name into dc string.]
[+DESCRIPTION?Convert a domain name \adomain\a into a dc=...,dc=... string and print it to stdout.]
\n\n\adomain\a
'
function domain_2_dc {
	[[ -z $1 ]] && return
	typeset DC='' SD
	for SD in ${1//./ } ; do	# removes leading && trailing && double dots
		DC+=",dc=${SD}"
	done
	print -- "${DC:1}"
}

Man.addFunc get_basedn  '' '[+NAME?get_basedn - Ask user for Base DN.]
[+DESCRIPTION?Ask the user for the BaseDN to use, check whether to create a suffix and store the value into \bSTR[LDAP_BASEDN]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bget_ans_req()\b, \bdisplay_msg()\b, \bcheck_baseDN()\b, \bcheck_basedn_suffix()\b, \bget_suffix()\b.]
'
function get_basedn {
	typeset BASEDN=${ domain_2_dc ${STR[LDAP_DOMAIN]} ; }

	while : ; do
		# Get Base DN.
		while : ; do
			get_ans_req 'Enter LDAP Base DN (h=help):' "${BASEDN}"
			case "${ANS}" in
				[Hh?] | help | Help) display_msg 'basedn_help' ; continue ;;
			esac
			check_baseDN "${ANS}" && break
			print "Invalid base DN: '${ANS}'."
		done

		# Set base DN and check its suffix
		STR[LDAP_BASEDN]="${ANS}"
		check_basedn_suffix || return 66

		# suffix may need to be created, in that case get suffix from user
		if (( TMPF[NEED_CREATE_SUFFIX] )); then
			get_suffix
			RES=$?
			(( ${RES} >= 66 )) && return 67 
			(( ${RES} )) && continue
		fi

		# suffix is ok, break out of the base dn inquire loop
		break
	done
	return 0
}

Man.addFunc chk_vlv_indexes '' '[+NAME?chk_vlv_indexes - check if server supports VLV.]
[+DESCRIPTION?Checks, whether the DS supports Virtual List Views (VLV).]
[+RETURN VALUES]{
	[+0?if VLVs are supported.]
	[+>= 66?if VLVs are not supported.]
}
[+SEE ALSO?\bldapsearch\b(1).]
'
function chk_vlv_indexes {
	typeset ATTR=''
	${LDAPSEARCH} ${CON_ARGS} -b '' -s base 'objectclass=*' \
		supportedControl 2>/dev/null | \
	while read LINE ; do
		if [[ ${LINE#*=} == '2.16.840.1.113730.3.4.9' ]]; then
			ATTR=${.sh.match%=}
			break
		fi
	done
	if [[ -z ${ATTR} ]]; then
		print 'ERROR: VLV is not supported on LDAP server!'
		return 66
	fi
	return 0
}

Man.addFunc validate_suffix '' '[+NAME?validate_suffix - validate suffix obtained via config file.]
[+DESCRIPTION?This function validates STR[LDAP_SUFFIX]] AFTER THE LOAD OF A CONFIG FILE (should not be used for interactive use). Also does a consistency check wrt. \bSTR[LDAP_BASEDN]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bnormalizeDN()\b, \bldapsearch\b(1), \bprep_create_sfx_entry()\b, \bprep_create_sfx_backend()\b.]
'
function validate_suffix {
	# Check STR[LDAP_SUFFIX] is not null
	if [[ -z ${STR[LDAP_SUFFIX]} ]]; then
		print -u2 "Invalid suffix (null suffix)"
		return 66
	fi

	# STR[LDAP_SUFFIX] and STR[LDAP_BASEDN] are consistent ?
	typeset X=,${ normalizeDN "${STR[LDAP_BASEDN]}" l ; }
	typeset SFX=,${ normalizeDN "${STR[LDAP_SUFFIX]}" l ; }
	if [[ ${X: -${#SFX}} != ${SFX} ]]; then
		print -u2 "Invalid suffix '${SFX}'\nfor Base DN '${X}'."
		return 67
	fi

	# STR[LDAP_SUFFIX] does exist ?
	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${STR[LDAP_SUFFIX]}" \
		-s base 'objectclass=*' >/dev/null 2>&1 && return 0

	# Well, suffix does not exist, try to prepare create it ...
	TMPF[NEED_CREATE_SUFFIX]=1
	prep_create_sfx_entry || return 68
	if (( TMPF[NEED_CREATE_BACKEND] )); then
		# try to use id attr value of the suffix as a database name
		STR[DS_DB]=${TMP[VAL]}
		integer RES
		prep_create_sfx_backend
		RES=$?
		if (( RES == 1 )); then
			# cann't use the name we want, so we can either exit or use
			# some another available name - doing the last ...
			STR[DS_DB]=${TMP[DS_DBS_AVAIL]}
		elif (( RES == 2 )); then
			# unable to determine database name
			return 69
		fi
	fi

    (( VERBOSE )) && print -u2 "Suffix: '${STR[LDAP_SUFFIX]}'," \
		"Database: '${STR[DS_DB]}'"
	return 0
}

Man.addFunc validate_info '' '[+NAME?validate_info - validate basic info obtained via config file.]
[+DESCRIPTION?This function updates \bCON_ARGS\b as well as \bAUTH_ARGS\b, checks, whether they work so that some problems are caught right away AFTER THE LOAD OF A CONFIG FILE (should not be used for interactive use). It also validates the obtained suffix and whether the DS supports VLVs.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bchk_vlv_indexes()\b, \bvalidate_suffix()\b.]
'
function validate_info {
	# Set CON_ARGS and AUTH_ARGS for the config file.
	CON_ARGS="-h ${STR[DS_HOST]} -p ${INT[DS_PORT]}"
	AUTH_ARGS=( '-D' "${STR[LDAP_ROOTDN]}" '-j' "${TMP[LDAP_ROOTPWF]}" )

	# Check the Root DN and Root DN passwd.o Same as for get_dirmgr_pw()
	RES=${ ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b '' -s base \
		'objectclass=*' supportedLDAPVersion 2>&1 ; }
	if (( $? )); then
		if [[ ${RES} =~ credential ]]; then
			print -u2 'ERROR: Root DN passwd is invalid.'
		else
			print -u2 "ERROR2: Invalid Root DN '${STR[LDAP_ROOTDN]}'."
		fi
		return 66
	fi
    (( VERBOSE )) && print -u2 "  RootDN ... OK\n  RootDN passwd ... OK"

	# Check if the server supports the VLV.
	chk_vlv_indexes || return 67
	(( VERBOSE )) && print -u2 "  VLV indexes ... OK"

	# Check LDAP suffix
	validate_suffix || return 66
	(( VERBOSE )) && print -u2 "  LDAP suffix ... OK"
	return 0
}

Man.addFunc gssapi_setup '' '[+NAME?gssapi_setup - set up GSSAPI if necessary.]
[+DESCRIPTION?Check, whether the DS supports the SASL mechanism \bGSSAPI\b. If so, ask the user whether it should be enabled and depending on the answer ask for related Kerberos realm info. \bINT[GSSAPI_ENABLE]]\b and \bTMPF[GSSAPI_AUTH_MAY_BE_USED]]\b and optionally \bSTR[LDAP_KRB_REALM]]\b are set accordingly.]
[+SEE ALSO?\bldapsearch\b(1), \bget_ans_req()\b.]
'
function gssapi_setup {
	INT[GSSAPI_ENABLE]=0
	TMPF[GSSAPI_AUTH_MAY_BE_USED]=0

	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b '' -s base 'objectclass=*' \
		supportedSASLMechanisms 2>/dev/null | \
	while read LINE ; do
		if [[ ${LINE:0:24} == 'supportedSASLMechanisms=' && \
			${LINE:24} == 'GSSAPI' ]]
		then
			TMPF[GSSAPI_AUTH_MAY_BE_USED]=1
			break
		fi
	done
	if (( ! TMPF[GSSAPI_AUTH_MAY_BE_USED] )); then
		print "  sasl/GSSAPI is not supported by this LDAP server"
		return
	fi

	get_confirm 'GSSAPI is supported. Do you want to set up GSSAPI:(y/n)' 'n'
	if (( $? )); then
		INT[GSSAPI_ENABLE]=1
		# get kerberos realm
		typeset -u REALM=${STR[LDAP_DOMAIN]}
		get_ans_req "Enter Kerberos Realm:" "${REALM}"
		REALM="${ANS}"		# make sure, it is upper case
		STR[LDAP_KRB_REALM]="${REALM}"
	else
		print '\nGSSAPI is not set up.' \
			'\nsasl/GSSAPI bind may not work if it is not set up first.'
	fi
}

Man.addFunc get_profile_name '' '[+NAME?get_profile_name - Ask user for client profile name.]
[+DESCRIPTION?Ask the user for the name of the client profile to create, check whether it already exists, and if so ask whether it should be overwritten. Sets \bSTR[LDAP_PROFILE_NAME]]\b, \bTMPF[DEL_OLD_PROFILE]]\b and if the user wants to just enable shadow update \bINT[LDAP_ENABLE_SHADOW_UPDATE]]\b and \bINT[EXISTING_PROFILE]]\b.]
[+SEE ALSO?\bget_ans()\b, \bldapsearch\b(1), \bget_confirm()\b, \bget_confirm_nodef()\b, \bdisplay_msg()\b.]
'
function get_profile_name {
	TMPF[DEL_OLD_PROFILE]=0		# Reset since getting new profile name

	typeset PNAME="${STR[LDAP_PROFILE_NAME]}"
	# Loop until valid profile name, or replace.
	while : ; do
		get_ans 'Enter the client profile name (h=help):' "${PNAME}"
		case "${ANS}" in
			[Hh] | help | Help | '?') display_msg 'profile_help' ; continue ;; 
		esac

		# Search to see if profile name already exists.
		if ! ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b "cn=${ANS},ou=profile,${STR[LDAP_BASEDN]}" -s base \
			'objectclass=*' >/dev/null 2>&1
		then
			break  # Unique profile name (does not yet exist)
		fi

		print '
Profile "'"${ANS}"'" already exists, it is possible to enable
shadow update now. idsconfig will exit after shadow update
is enabled. You can also continue to overwrite the profile 
or create a new one and be given the chance to enable
shadow update later.
'
	    get_confirm 'Just enable shadow update (y/n/h)?' 'n' \
			'enable_shadow_update_help'
	    if (( $? )); then
			# set up credentials for shadow update
			INT[LDAP_ENABLE_SHADOW_UPDATE]=1
			# display alternate messages
			INT[EXISTING_PROFILE]=1
			break
		fi

		get_confirm_nodef \
			"Are you sure you want to overwrite profile 'cn=${ANS}'?"
		if (( $? )); then
			TMPF[DEL_OLD_PROFILE]=1		# Replace old profile name
			break
		fi

		print 'Please re-enter a new profile name.'
	done

	STR[LDAP_PROFILE_NAME]="${ANS}"
}

Man.addFunc getACIs '' '[+NAME?getACIs - get ACIs for the current base DN.]
[+DESCRIPTION?Get all ACIs for \abaseDN\a and append them to the indexed array of strings \avname\a. If \abaseDN\a is not given, \bSTR[LDAP_BASEDN]]\b will be used instead.]
[+RETURN VALUES]{
	[+-1?invalid function usage.]
	[+0?on success.]
	[+1?an error occured when executing the ldapsearch operation.]
}
\n\n\avname\a [\abaseDN\a]
'
function getACIs {
	set -o pipefail
	[[ -z $1 ]] && print -u2 "${.sh.fun}(): invalid function usage." && \
		return -1
	typeset -n ACILIST=$1
	typeset LINE
	typeset DN="$2"
	[[ -z ${DN} ]] && DN="${STR[LDAP_BASEDN]}"

    ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${DN}" -s base \
		'objectclass=*' aci 2>/dev/null | \
	while read LINE ; do
		[[ ${LINE:0:4} == 'aci=' ]] && ACILIST+=( ${LINE:4} ) || :
	done
	if (( $? )); then
		print -u2 "Unable to get aci list for ${STR[LDAP_BASEDN]}."
		return 1
	fi
	return 0
}

Man.addFunc findACI '' '[+NAME?findACI - find an ACI in the given list.]
[+DESCRIPTION?Find the first ACI which matches \aregex\a in the indexed array of ACIs \avname\a. If a match occurs,  print out a message using \aaciName\a and increment \bTMPF[STEP]]\b by 1.]
[+RETURN VALUES]{
	[+0?no ACI matched.]
	[+>=1?the index+1 of the ACI matched.]
}
[+SEE ALSO?\bgetACIs()\b, \bfindACI()\b, \bfind_and_delete_ACI\b()]
\n\n\avname\a \aaciName\a \aregex\a
'
function findACI {
	typeset -n LIST=$1
	typeset ACI_NAME="$2" REGEX="$3" ACI
	integer MAX=${#LIST[@]} I
	for (( I=0; I < MAX; I++ )); do
		if [[ ${LIST[${I}]} =~ ${REGEX} ]]; then
			if (( INT[EXISTING_PROFILE] )); then
				ACI='NOT ADDED:'
			else
				ACI="${STEP}."
				(( TMPF[STEP]++ ))
			fi
			print "  ${ACI} ACI '${ACI_NAME}' already exists for" \
				"'${STR[LDAP_BASEDN]}'."
			return $((I+1))
		fi
	done
	return 0
}

Man.addFunc allow_proxy_read_pw '' '[+NAME?allow_proxy_read_pw - add Proxy Agent read permission for password.]
[+DESCRIPTION?Add the ACI \bPROXY_ACI_NAME\b for \bSTR[LDAP_PROXYAGENT]]\b to \bSTR[LDAP_BASEDN]]\b if it not already exists.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage PROXY_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (ACI already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bldapmodify\b(1).]
'
function allow_proxy_read_pw {
	typeset ACI PATTERN

	typeset -a LIST=( )
	getACIs LIST || return 66

	PATTERN='acl[ ]+"?('"${PROXY_ACI_NAME}|${PROXY_ACI_NAME// /_}"')"?'
	findACI LIST "${PROXY_ACI_NAME}" "${PATTERN}" || return 0

	# Create the tmp file to add.
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: (target = "ldap:///'"${STR[LDAP_BASEDN]}"'") (targetattr = "userPassword") (version 3.0;  acl "'"${PROXY_ACI_NAME}"'";  allow (compare,read,search) userdn = "ldap:///'"${STR[LDAP_PROXYAGENT]}"'";)
'		> ${TMP[DIR]}/proxy_read
    
	# Add the entry.
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/proxy_read 2>/dev/null
	then
		print -u2 "  ERROR: Allow '${STR[LDAP_PROXYAGENT]}' to read" \
			'password failed!'
		return 66
	fi

	print "  ${TMPF[STEP]}. Give '${STR[LDAP_PROXYAGENT]} read permission" \
		'for password.'
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc delete_proxy_read_pw '' '[+NAME?delete_proxy_read_pw - delete Proxy Agent read permission for password.]
[+DESCRIPTION?Remove the ACI \bPROXY_ACI_NAME\b from \bSTR[LDAP_BASEDN]]\b if such an ACI exists.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage PROXY_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (no delete required or ACI deleted).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bget_menu_choice()\b, \bldapmodify\b(1).]
'
function delete_proxy_read_pw {
	typeset PROXY_ACI='' ACI PATTERN

	typeset -a LIST=( )
	getACIs ACILIST || return 66

	# Search for ACI_NAME
	typeset -a ACILIST=( )
	PATTERN='acl[ ]+"?('"${PROXY_ACI_NAME}|${PROXY_ACI_NAME// /_}"')"?'
	for ACI in "${LIST[@]}" ; do
		[[ ${ACI} =~ ${PATTERN} ]] && ACILIST+=( "${ACI#*=}" )
	done

	# We need to remove proxy agent's read access to user passwords,
	# but We do not know the value of the ${LDAP_PROXYAGENT} here, so
	# 1. if only one match found, delete it
	# 2. if more than one matches found, ask the user which one to delete
	if (( ${#ACILIST[@]} == 0 )); then
		print "Proxy ACI '${PROXY_ACI_NAME}' does not exist for" \
			"'${STR[LDAP_BASEDN]}'."
		return 0
    fi
	if (( ${#ACILIST[@]} == 1 ));then
		PROXY_ACI="${ACI[0]}"
    else
		print '
Proxy agent is not allowed to read user passwords when shadow
update is enabled. There are more than one proxy agents found.
Please select the currently proxy agent being used, so that
idsconfig can remove its read access to user passwords.

The proxy agents are:
'
		# print the list of ACIs for selection
		integer I MAX
		MAX=${#ACILIST[@]}
		for (( I=0; I < ${MAX}; I++ )) ; do
			ACI="${ACILIST[${I}]}"
			if (( ! VERBOSE )); then
	    		# older versions used
				# sed -e 's|.*ldap:///.*ldap:///||' -e 's|";)||'
				ACI=${ACI##*ldap:///}
				ACI=${ACI%\"*}
			fi
			printf '%2d: %s\n' $((I+1)) "${ACI}"
		done

	    # ask the user to pick one
		get_menu_choice "Select the proxy agent (1-${MAX}): " 1 ${MAX}
		I=$(( $? - 1 ))
		PROXY_ACI="${ACILIST[$I]}"
	fi

	# Create the tmp file to delete the ACI
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
delete: aci
aci: '"${PROXY_ACI}"'
'		>${TMP[DIR]}/proxy_delete

	# Delete the ACI
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/proxy_delete 2>/dev/null
	then
		print -u2 "  ERROR: Remove of ${PROXY_ACI_NAME} ACI failed!"
		cat ${TMP[DIR]}/proxy_delete
		return 66
	fi

	# Display message that ACI is updated.
    print "\n  ACI REMOVED: Removed '${PROXY_ACI_NAME}' ACI for proxyagent" \
		"read permission for password. The ACI removed is:\n\t${PROXY_ACI}\n"
	return 0
}

Man.addFunc allow_host_read_write_shadow '' '[+NAME?allow_host_read_write_shadow - add host principal read/write permission for shadow data.]
[+DESCRIPTION?Add the ACI \bHOST_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b  unless it already exists.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage HOST_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (ACI already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bldapmodify\b(1).]
'
function allow_host_read_write_shadow {
	typeset ACI PATTERN

	typeset -a LIST=( )
	getACIs LIST || return 66

	PATTERN='acl[ ]+"?('"${HOST_ACI_NAME}|${HOST_ACI_NAME// /_}"')"?'
	findACI LIST "${HOST_ACI_NAME}" "${PATTERN}" || return 0

	# Create the tmp file to add
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: (target = "ldap:///'"${STR[LDAP_BASEDN]}"') (targetattr = "shadowLastChange||shadowMin||shadowMax||shadowWarning||shadowInactive||shadowExpire||shadowFlag||userPassword||loginShell||homeDirectory||gecos") (version 3.0;  acl '"${HOST_ACI_NAME}"';  allow (write,compare,read,search) authmethod = "sasl GSSAPI" and userdn = "ldap:///cn=*+ipHostNumber=*,ou=Hosts,'"${STR[LDAP_BASEDN]}"';)
'		> ${TMP[DIR]}/host_read_write
    
	# Add the entry.
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/host_read_write 2>/dev/null
	then
		print -u2 "  ERROR: Allow Host Principal to write shadow data failed!"
		return 66
	fi

	if (( INT[EXISTING_PROFILE] )); then
		ACI='ACI SET:'
	else
		ACI="${STEP}."
		(( TMPF[STEP]++ ))
	fi
	print "  ${ACI} Give host principal read/write permission for shadow."
	return 0
}

Man.addFunc find_and_delete_ACI '' '[+NAME?find_and_delete_ACI - find and delete an ACI in the given list.]
[+DESCRIPTION?Find the first ACI which matches \aregex\a in the indexed array of ACIs \avname\a and delete it. If no ACI matches, the function does nothing and returns. Otherwise it tries to delete it from \bSTR[LDAP_BASEDN]]\b and prints out a message using \aaciName\a.]
[+RETURN VALUES]{
	[+0?on success (no ACI matched or ACI removed successfully).]
	[+66?an error occured when removing the matched ACI.]
}
[+SEE ALSO?\bgetACIs()\b, \bldapmodify\b(1)]
\n\n\avname\a \aaciName\a \aregex\a
'
function find_and_delete_ACI {
	typeset -n LIST=$1
	typeset ACI_NAME="$2" REGEX="$3" DEL='' ACI

	for ACI in "${LIST[@]}" ; do
		[[ ${ACI} =~ ${REGEX} ]] && DEL="${ACI}" && break
	done
	[[ -z ${DEL} ]] && return 0

	# Create the tmp file to delete the ACI.
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
delete: aci
aci: '"${DEL}"'
'		> ${TMP[DIR]}/find_delete_aci

	# Delete the ACI
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/find_delete_aci 2>/dev/null
	then
		print -u2 "  ERROR: Remove of '${ACI_NAME}' ACI failed!"
		return 66
	fi

	# Display message that an ACL is deleted.
	if (( INT[EXISTING_PROFILE] )); then
		ACI='ACI DELETED:'
	else
		ACI="${TMPF[STEP]}."
		(( TMPF[STEP]++ ))
	fi
	print "  ${ACI} ACI '${ACI_NAME}' deleted."
	return 0
}

Man.addFunc deny_non_host_shadow_access '' '[+NAME?deny_non_host_shadow_access - add a deny non-host access to shadow data.]
[+DESCRIPTION?Add the ACI \bNON_HOST_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b  unless it already exists. If it does not exists the ACI \bNON_ADMIN_ACI_NAME\b gets deleted first if available.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage NON_HOST_ACI_NAME NON_ADMIN_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (ACI already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfind_and_delete_ACI()\b, \bldapmodify\b(1).]
'
function deny_non_host_shadow_access {
	typeset ACI PATTERN

	typeset -a LIST=( )
	getACIs LIST || return 66

    # If an ACI with ${NON_HOST_ACI_NAME} already exists, we are done.
	PATTERN='acl[ ]+"?('"${NON_HOST_ACI_NAME}|${NON_HOST_ACI_NAME// /_}"')"?'
	findACI LIST "${NON_HOST_ACI_NAME}" "${PATTERN}" || return 0

	# The deny_non_admin_shadow_access and deny_non_host_shadow_access ACIs
	# should be mutually exclusive, so if the former exists, delete it.
	PATTERN='acl[ ]+"?('"${NON_ADMIN_ACI_NAME}|${NON_ADMIN_ACI_NAME// /_}"')"?'
	find_and_delete_ACI LIST "${NON_ADMIN_ACI_NAME}" "${PATTERN}" || return 67

	# Create the tmp file to add.
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: (target = "ldap:///'"${STR[LDAP_BASEDN]}"'") (targetattr = "shadowLastChange|| shadowMin|| shadowMax||shadowWarning||shadowInactive||shadowExpire|| shadowFlag||userPassword") (version 3.0;  acl "'"${NON_HOST_ACI_NAME}"'";  deny (write,read,search,compare) userdn != "ldap:///cn=*+ipHostNumber=*,ou=Hosts,'"${STR[LDAP_BASEDN]}"'";)
'		> ${TMP[DIR]}/non_host_aci_write
    
	# Add the entry.
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/non_host_aci_write 2>/dev/null
	then
		print -u2 "  ERROR: Adding ACI '${NON_HOST_ACI_NAME}' failed!"
		cat ${TMP[DIR]}/non_host_aci_write
		return 67
	fi

	if (( INT[EXISTING_PROFILE] )); then
		ACI='ACI SET:'
	else
		ACI="${TMPF[STEP]}."
		(( TMPF[STEP]++ ))
	fi
	print  "  ${ACI} Non-host access to shadow data is denied."
	return 0
}

Man.addFunc get_adminDN '' '[+NAME?get_adminDN - ask user for Admin DN.]
[+DESCRIPTION?Ask the user for the Admin DN and store it into \bSTR[LDAP_BASEDN]]\b.]
[+SEE ALSO?\bget_ans()\b.]
'
function get_adminDN {
    get_ans 'Enter DN for the administrator:' \
		"cn=admin,ou=profile,${STR[LDAP_BASEDN]}"
	STR[LDAP_ADMINDN]="${ANS}"
}

Man.addFunc get_admin_pw '' '[+NAME?get_admin_pw - ask user for Admin password]
[+DESCRIPTION?Ask the user for the Admin password and store it into \bSTR[LDAP_ADMIN_CRED]]\b.]
[+SEE ALSO?\bget_passwd()\b.]
'
function get_admin_pw {
	get_passwd 'Enter passwd for the administrator:'
	STR[LDAP_ADMIN_CRED]="${ANS}"
}

Man.addFunc add_admin '' '[+NAME?add_admin - Add administrator identity.]
[+DESCRIPTION?Add the \bSTR[LDAP_ADMINDN]]\b entry with the password \bSTR[LDAP_ADMIN_CRED]]\b unless it already exists.]
[+RETURN VALUES]{
	[+0?on success (entry already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_admin {
	typeset CN

	# Check if the admin user already exists.
	if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${STR[LDAP_ADMINDN]}" \
		-s base 'objectclass=*' >/dev/null 2>&1
	then
		if (( INT[EXISTING_PROFILE] )); then
			CN='NOT ADDED:'
		else
			CN="${TMPF[STEP]}."
			(( TMPF[STEP]++ ))
		fi
		print "  ${CN} Administrator ${STR[LDAP_ADMINDN]} already exists."
		return 0
	fi

	CN="${STR[LDAP_ADMINDN]%%,*}"
	CN="${CN#*=}"

    # Create the tmp file to add.
	print '
dn: '"${STR[LDAP_ADMINDN]}"'
cn: '"${CN}"'
sn: '"${CN}"'
objectclass: top
objectclass: person
userpassword: '"${STR[LDAP_ADMIN_CRED]}"'
'		> ${TMP[DIR]}/admin

	# Add the entry.
	if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/admin 2>/dev/null
	then
		print -u2 '  ERROR: Adding administrator identity failed!'
		return 66
	fi

	if (( INT[EXISTING_PROFILE] )); then
		CN='ADDED:'
    else
		CN="${TMPF[STEP]}. Added"
		(( TMPF[STEP]++ ))
	fi
	print "  ${CN} Administrator identity '${STR[LDAP_ADMINDN]}'."
	return 0
}

Man.addFunc allow_admin_read_write_shadow '' '[+NAME?allow_admin_read_write_shadow - add Admin read/write permission for shadow, rbac and mount data.]
[+DESCRIPTION?Add the ACI \bADMIN_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b  unless it already exists. Also tries to remove old similar ACIs if they exist.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ADMIN_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (aci already exists or addition was successfull).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfind_and_delete_ACI()\b, \bldapmodify\b(1).]
'
function allow_admin_read_write_shadow {
	typeset PERMS='write,compare,read,search,add,delete' ACI RBAC PATTERN

	typeset -a LIST=( )
	getACIs LIST || return 66

    # If an ACI already exists, we are done
	PATTERN='acl[ ]+"?('"${ADMIN_ACI_NAME}|${ADMIN_ACI_NAME// /_}"')"?'
	PATTERN+='.*\('"${PERMS}"'\).*'"${STR[LDAP_ADMINDN]}"
	findACI LIST "${ADMIN_ACI_NAME}" "${PATTERN}" || return 0

    # If an ACI with ${ADMIN_ACI_NAME} and "(write|write,compare,read,search)"
	# and ${LDAP_ADMINDN} exists, delete it.
	PATTERN='acl[ ]+"?('"${ADMIN_ACI_NAME}|${ADMIN_ACI_NAME// /_}"')"?'
	PATTERN+='.*\(write\).*'"${STR[LDAP_ADMINDN]}"
    find_and_delete_ACI LIST "${ADMIN_ACI_NAME}" "${PATTERN}" || return 67

	PATTERN='acl[ ]+"?('"${ADMIN_ACI_NAME}|${ADMIN_ACI_NAME// /_}"')"?'
	PATTERN+='.*\(write,compare,read,search\).*'"${STR[LDAP_ADMINDN]}"
    find_and_delete_ACI LIST "${ADMIN_ACI_NAME}" "${PATTERN}" || return 68

    # Create the tmp file to add.
    RBAC='objectClass||uid||uidNumber||gidNumber||cn'
    RBAC+='||SolarisAttrKeyValue||SolarisAttrShortDesc||SolarisAttrLongDesc'
    RBAC+='||SolarisKernelSecurityPolicy||SolarisProfileType'
    RBAC+='||SolarisProfileId||SolarisUserQualifier'
    RBAC+='||SolarisReserved1||SolarisReserved2'
    RBAC+='||SolarisAttrReserved1||SolarisAttrReserved2'
    RBAC+='||SolarisProjectID||SolarisProjectName'
    RBAC+='||SolarisProjectAttr||memberUid||memberGid||description'
    RBAC+='||automountKey||automountMapName||automountInformation'
    RBAC+='||ipTnetTemplateName||ipTnetNumber'

	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: (target = "ldap:///'"${STR[LDAP_BASEDN]}"'") (targetattr = "shadowLastChange||shadowMin||shadowMax||shadowWarning||shadowInactive||shadowExpire||shadowFlag||userPassword||loginShell||homeDirectory||gecos||'"${RBAC}"'") (version 3.0;  acl "'${ADMIN_ACI_NAME}'";  allow ('"${PERMS}"') userdn = "ldap:///'"${STR[LDAP_ADMINDN]}"'";)
'		> ${TMP[DIR]}/admin_write
    
	# Add the entry.
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/admin_write 2>/dev/null
	then
		print -u2 "  ERROR: Allow '${STR[LDAP_ADMINDN]} read/write access" \
			'to shadow data failed!'
		return 69
	fi

	if (( INT[EXISTING_PROFILE] )); then
		ACI='ACI SET:'
	else
		ACI="${TMPF[STEP]}."
		(( TMPF[STEP]++ ))
	fi
	print "  ${ACI} Give '${STR[LDAP_ADMINDN]}' read/write access to shadow data."
	return 0
}

Man.addFunc deny_non_admin_shadow_access '' '[+NAME?deny_non_admin_shadow_access - add a deny Admin access to shadow data.]
[+DESCRIPTION?Add the ACI \bNON_ADMIN_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b  unless it already exists. If it does not exists the ACI \bNON_HOST_ACI_NAME\b gets deleted first if available.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage NON_ADMIN_ACI_NAME NON_HOST_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (ACI already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfind_and_delete_ACI()\b, \bldapmodify\b(1).]
'
function deny_non_admin_shadow_access {
	typeset -a LIST=( )
	getACIs LIST || return 66

    # If an ACI already exists, we are done
	PATTERN='acl[ ]+"?('"${NON_ADMIN_ACI_NAME}|${NON_ADMIN_ACI_NAME// /_}"')"?'
	findACI LIST "${NON_ADMIN_ACI_NAME}" "${PATTERN}" || return 0

	# The deny_non_admin_shadow_access and deny_non_host_shadow_access ACIs
	# should be mutually exclusive, so if the latter exists, delete it.
	PATTERN='acl[ ]+"?('"${NON_HOST_ACI_NAME}|${NON_HOST_ACI_NAME// /_}"')"?'
	find_and_delete_ACI LIST "${NON_HOST_ACI_NAME}" "${PATTERN}" || return 67

    # Create the tmp file to add
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: (target = "ldap:///'"${STR[LDAP_BASEDN]}"'") (targetattr = "shadowLastChange||shadowMin|| shadowMax||shadowWarning||shadowInactive||shadowExpire||shadowFlag||userPassword") (version 3.0;  acl "'"${NON_ADMIN_ACI_NAME}"'";  deny (write,read,search,compare,add,delete) userdn != "ldap:///'"${STR[LDAP_ADMINDN]}"'";)
'		> ${TMP[DIR]}/non_admin_aci_write
    
	# Add the entry.
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/non_admin_aci_write 2>/dev/null
	then
		print -u2 "  ERROR: Adding ACI '${NON_ADMIN_ACI_NAME}' failed!"
		${CAT} ${TMP[DIR]}/non_admin_aci_write
		return 68
	fi

	if (( INT[EXISTING_PROFILE] )); then
		PATTERN='ACI SET:'
	else
		PATTERN="${TMPF[STEP]}."
		(( TMPF[STEP]++ ))
	fi
	print "  ${PATTERN} Non-Admin access to shadow data denied."
	return 0
}

Man.addFunc setup_shadow_update '' '[+NAME?setup_shadow_update - set up shadow update.]
[+DESCRIPTION?Check whether the profile \bSTR[LDAP_PROFILE_NAME]]\b for \bSTR[LDAP_BASEDN]]\b exists. If not simply notify the user and return. Otherwise check whether the profile uses authenticationMethod "GSSAPI" and credentialLevel "self". If so ask the user whether to use host or "Admin" user principal for shadow updates and collect the related info. Sets \bINT[NEED_HOSTACL]]\b if the host principal should be used for shadow update (requires that \bTMPF[GSSAPI_AUTH_MAY_BE_USED]]\b is already set).]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66? a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bget_confirm()\b, \bdelete_proxy_read_pw()\b, \ballow_host_read_write_shadow()\b, \bdeny_non_host_shadow_access()\b, \bget_adminDN()\b, \bget_admin_pw()\b, \badd_admin()\b, \ballow_admin_read_write_shadow()\b, \bdeny_non_admin_shadow_access()\b.]
'
function setup_shadow_update {
	# get content of the profile
	integer CN=0 GSSAPI=0 SELF=0

	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-b "cn=${STR[LDAP_PROFILE_NAME]},ou=profile,${STR[LDAP_BASEDN]}" \
		-s base 'objectclass=*' 2>/dev/null | \
	while read LINE ; do
		# TODO: Optimize, i.e. stronger matching
		if [[ ${LINE} != ~(Ei)cn ]]; then
			CN=1
		fi
		if [[ ${LINE} =~ authenticationMethod && ${LINE} =~ GSSAPI ]]; then
			GSSAPI=1
		fi
		if [[ ${LINE} =~ credentialLevel && ${LINE} =~ self ]]; then
			SELF=1
		fi
	done
	if (( ! CN )); then
		(( VERBOSE )) && \
			print -u2 "Profile ${STR[LDAP_PROFILE_NAME]} does not exist."
		return 0
	fi

	# If authenticationMethod has 'GSSAPI' and credentialLevel
	# has 'self', ask to use the host principal for shadow update
	if (( TMPF[GSSAPI_AUTH_MAY_BE_USED] && GSSAPI && SELF )); then
		INT[NEED_HOSTACL]=1
	fi
	(( VERBOSE )) && print -u2 "NEED_HOSTACL = ${INT[NEED_HOSTACL]}"

	if (( INT[NEED_HOSTACL] )); then
		get_confirm 'Use host principal for shadow data update (y/n/h)?' 'y' \
			'use_host_principal_help'
		if (( $? )); then
			delete_proxy_read_pw || return 66
			allow_host_read_write_shadow || return 67
			deny_non_host_shadow_access || return 68
			print '\n  Shadow update has been enabled.'
		else
			print '\n  Shadow update may not work.'
		fi
		return 0
	fi

	get_confirm 'Add the administrator identity (y/n/h)?' 'y' \
		'add_admin_cred_help'
	if (( $? )); then
		get_adminDN
		get_admin_pw
		add_admin || return 69
		delete_proxy_read_pw || return 66
		allow_admin_read_write_shadow || return 70
		deny_non_admin_shadow_access || return 71
		print '\n  Shadow update has been enabled.'
	else
		print '  No administrator identity specified, shadow update may not work.'
	fi
	return 0
}

Man.addFunc get_srv_list '' '[+NAME?get_srv_list - Ask user for default server list.]
[+DESCRIPTION?Ask the user for the default server list and store it into \bSTR[LDAP_SERVER_LIST]]\b.]
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_srv_list {
	# If LDAP_SERVER_LIST is NULL, then set, otherwise leave alone.
	if [[ -z ${STR[LDAP_SERVER_LIST]} ]]; then
		ANS=${ ${GETENT} hosts ${STR[DS_HOST]} ; }
		STR[LDAP_SERVER_LIST]=${ANS%%[[:space:]]*}
		if (( INT[DS_PORT] != 389 )); then
			STR[LDAP_SERVER_LIST]="${STR[LDAP_SERVER_LIST]}:${INT[DS_PORT]}"
		fi
	fi

	# Prompt for new LDAP_SERVER_LIST.
	while : ; do
		get_ans 'Default server list (h=help):' "${STR[LDAP_SERVER_LIST]}"
		case "${ANS}" in
			[Hh] | help | Help | '?') display_msg 'def_srvlist_help' ;;
			* ) break ;;
		esac
	done
	STR[LDAP_SERVER_LIST]="${ANS}"
}

Man.addFunc get_pref_srv '' '[+NAME?get_pref_srv - Ask user for preferred server list.]
[+DESCRIPTION?Ask the user for the preferred server list and store it into \bSTR[LDAP_PREF_SRVLIST]]\b (overrides the server list).]
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_pref_srv {
	while : ; do
		get_ans 'Preferred server list (h=help):' "${STR[LDAP_PREF_SRVLIST]}"
		case "${ANS}" in
			[Hh] | help | Help | '?') display_msg 'pref_srvlist_help' ;;
			* ) break ;;
		esac
	done
	STR[LDAP_PREF_SRVLIST]="${ANS}"
}

Man.addFunc get_search_scope '' '[+NAME?get_search_scope - Ask user for search scope.]
[+DESCRIPTION?Ask the user for the search scope and store it into \bSTR[LDAP_SEARCH_SCOPE]]\b.]
[+RETURN VALUES]{
	[+1?search scope "one" selected.]
	[+2?search scope "sub" selected.]
}
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_search_scope {
	integer RES
	get_menu_choice 'Choose desired search scope (1=one, 2=sub, h=help): ' \
		1 2 1 srch_scope_help
	(( $? == 2 )) && { STR[LDAP_SEARCH_SCOPE]='sub' ; return 2 ; }
	STR[LDAP_SEARCH_SCOPE]='one'
	return 1
}

Man.addFunc get_cred_level '' '[+NAME?get_cred_level - Ask user for credential level.]
[+DESCRIPTION?Ask the user for the client credential level to use and store it into \bSTR[LDAP_CRED_LEVEL]]\b.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage CRED_LEVELS STR ; }" '}
[+RETURN VALUES?The index wrt. \bCRED_LEVELS\b of the selected credential level \b+1\b.]
[+SEE ALSO?\bget_ans()\b, \bdisplay_msg()\b.]
'
function get_cred_level {
	integer RES
	typeset PROMPT=''
	(( INT[GSSAPI_ENABLE] )) && PROMPT='"self" is needed for GSSAPI profile.\n'
	PROMPT+='Choose Credential level [h=help]:'

	get_menu_choice "${PROMPT}" 1 4 1 'cred_lvl_help'
	RES=$?
	STR[LDAP_CRED_LEVEL]="${CRED_LEVELS[RES-1]}"
	return ${RES}
}

Man.addFunc get_auth '' '[+NAME?get_auth - ask user for authentication methods.]
[+DESCRIPTION?Ask the user for authentication methods to enable and store them  as a semicolon separated list into \bSTR[LDAP_AUTHMETHOD | LDAP_SRV_AUTHMETHOD_{PAM|KEY|CMD}}]]\b and set \bINT[NEED_SRVAUTH_{PAM|KEY|CMD}]]\b to 0 depending on the given \atype\a (either "client", "pam_ldap", "keyserv", or "passwd-cmd") and selected methods.]
[+ENVIRONMENT VARIABLES]{' "${  Man.varUsage AUTH_METHODS STR ; }" '}
[+RETURN VALUES]{
	[+0?on success.]
	[+-1?if an invalid \atype\a was given.]
}
[+SEE ALSO?\bget_menu_choice()\b, \bget_confirm_nodef()\b.]
\n\n\atype\a
'
function get_auth {
	typeset TYPE=$1 VNAME HELPTAG
	integer RES MAX=${#AUTH_METHODS[@]} OFFSET=0
	typeset -a SELECTED=( )

	case "${TYPE}" in
		client) VNAME=LDAP_AUTHMETHOD ; OFFSET=1 ;;
		pam_ldap) VNAME=LDAP_SRV_AUTHMETHOD_PAM ;;
		keyserv) VNAME=LDAP_SRV_AUTHMETHOD_KEY ;;
		passwd-cmd) VNAME=LDAP_SRV_AUTHMETHOD_CMD ;;
		*) print -u2 "${.sh.fun}() bug: invalid type argument" && return -1 ;;
	esac
		
	typeset PROMPT='' VAL='' M=''
	if (( OFFSET )); then
		# client
		(( INT[GSSAPI_ENABLE] )) && \
			PROMPT='"sasl/GSSAPI" is needed for GSSAPI profile.\n'
		PROMPT+='Choose Client Authentication Method (0=reset, h=help):'
		HELPTAG='auth_method_menu'
	else
		PROMPT="Choose ${TYPE} Service Authentication Method (0=reset, h=help):"
		(( MAX-- ))
		HELPTAG='srvauth_method_menu'
	fi

	while : ; do
		get_menu_choice "${PROMPT}" 0 ${MAX} 1 ${HELPTAG}
		RES=$?
		if (( RES )); then
			M=${METHOD[RES - OFFSET]}
			# avoid doubles
			[[ ${VAL} != ~(E)[ ]${M}[ ] ]] && SELECTED+=( ${M} )
			VAL=" ${SELECTED[@]} "
			M=${VAL// /;}
			M=${M#;}
		else
			typeset -a SELECTED=( )		# reset
			VAL=''
			M=''
		fi
		print "\nCurrent authentication method(s): ${M%;}\n"

		# Prompt for another Auth Method, or break out.
		get_confirm_nodef 'Do you want to add another Authentication Method?' \
			&& break
	done
	M=${M%;}
	if (( ! OFFSET )); then
		M=${M//;/;${TYPE}:}
		if [[ -n ${M} ]]; then
			STR[${VNAME}]="${TYPE}:${M}"
		else
			STR[${VNAME}]=''
			INT[NEED_SRVAUTH_${TYPE##*_}]=0
		fi
	else
		STR[${VNAME}]="${M}"
	fi
	(( VERBOSE )) && \
		print -u2 "Selected authentication methods: '${STR[${VNAME}]}'"
	return 0
}

Man.addFunc get_followref '' '[+NAME?get_followref - Ask user whether or not to follow referrals.]
[+DESCRIPTION?Ask the user whether the client should follow referrals. Result gets stored into \bINT[LDAP_FOLLOWREF]]\b.]
[+SEE ALSO?\bget_confirm()\b, \bldapclient\b(1M).]
'
function get_followref {
	get_confirm 'Do you want the clients to follow referrals (y/n/h)?' 'n' \
		'referrals_help'
	INT[LDAP_FOLLOWREF]=$?
}

Man.addFunc get_timelimit '' '[+NAME?get_timelimit - Ask user for search time limit.]
[+DESCRIPTION?Ask the user for the max. time allowed to process a search operation and store it into \bINT[DS_TIMELIMIT]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bis_numeric()\b, \bget_negone_num()\b.]
'
function get_timelimit {
	typeset NAME='nsslapd-timelimit' VAL=''
	(( TMPF[IS_OPENDJ] )) && NAME='ds-cfg-time-limit'	# min val = 0

	# Get current timeout value from cn=config.
	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b 'cn=config' -s base \
		'objectclass=*' "${NAME}" 2>/dev/null | \
	while read LINE; do
		if [[ ${LINE%%=*} == ${NAME} ]]; then
			VAL=${LINE#*=}
			break
		fi
	done
	if [[ -z ${VAL} ]]; then
		print -u2 '  ERROR: Unable to check current search processing' \
			'timeout of the DS!'
		return 66
	fi
	VAL=${VAL%%[[:space:]]*}
	is_numeric ${VAL} && NUM=${VAL} || NUM=INT[DS_TIMELIMIT]
    
	get_negone_num "DS: Enter the search processing time limit in seconds (current=${NUM}):" \
		'30'
	(( TMPF[IS_OPENDJ] && NUM < 0 )) && NUM=0	# unlimited

	INT[DS_TIMELIMIT]=${NUM}
	return 0
}

Man.addFunc get_sizelimit '' '[+NAME?get_sizelimit - Ask user for search size limit.]
[+DESCRIPTION?Ask the user for the max. number of entries to return for a single search operation and store it into \bINT[DS_SIZELIMIT]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bis_numeric()\b, \bget_negone_num()\b.]
'
function get_sizelimit {
	typeset NAME='nsslapd-sizelimit' VAL=''
	(( TMPF[IS_OPENDJ] )) && NAME='ds-cfg-size-limit'	# min val = 0

	# Get current sizelimit value from cn=config.
	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b 'cn=config' -s base \
		'objectclass=*' "${NAME}" 2>/dev/null | \
	while read LINE; do
		if [[ ${LINE%%=*} == ${NAME} ]]; then
			VAL=${LINE#*=}
			break
		fi
	done
	if [[ -z ${VAL} ]]; then
		print -u2 '  ERROR: Unable to check current search entry result' \
			'limit of the DS!'
		return 66
	fi
	is_numeric ${VAL} && NUM=${VAL} || NUM=INT[DS_SIZELIMIT]

	get_negone_num "DS: Enter max. number of entries per search to return (current=${NUM}" '1000'
	(( TMPF[IS_OPENDJ] && NUM < 0 )) && NUM=0	# unlimited
	INT[DS_SIZELIMIT]=${NUM}
	return 0
}

Man.addFunc get_want_crypt '' '[+NAME?get_want_crypt - Ask user whether to store passwords in crypt.]
[+DESCRIPTION?Ask the user whether the default password storage scheme should be set to "CRYPT" and stores the result into \bINT[NEED_CRYPT]]\b.]
[+SEE ALSO?\bget_confirm()\b.]
'
function get_want_crypt {
	get_confirm 'Do you want to store passwords in "CRYPT" format (y/n/h)?' \
		'n' 'crypt_help'
	INT[NEED_CRYPT]=$?
}

Man.addFunc get_srch_time '' '[+NAME?get_srch_time - Ask user for client search time limit.]
[+DESCRIPTION?Ask the user for the max. time in seconds a client waits for a search result and store it into \bINT[LDAP_SEARCH_TIME_LIMIT]]\b.]
[+SEE ALSO?\bget_negone_num()\b, \bldapclient\b(1M).]
'
function get_srch_time {
	get_negone_num 'Client search time limit in seconds (h=help):' \
		${INT[LDAP_SEARCH_TIME_LIMIT]} 'srchtime_help'
	INT[LDAP_SEARCH_TIME_LIMIT]=${NUM}
}

Man.addFunc get_prof_ttl '' '[+NAME?get_prof_ttl - Ask user for client profile time to live (TTL).]
[+DESCRIPTION?Ask the user for the max. time in seconds a client may cache its profile before refreshing again and store it into \bINT[LDAP_PROFILE_TTL]]\b.]
[+SEE ALSO?\bget_negone_num()\b, \bldapclient\b(1M).]
'
function get_prof_ttl {
	get_negone_num 'Client Profile Time To Live in seconds (h=help):' \
		${INT[LDAP_PROFILE_TTL]} 'profttl_help'
	INT[LDAP_PROFILE_TTL]=${NUM}
}

Man.addFunc get_bind_limit '' '[+NAME?get_bind_limit - Ask user for client bind time limit.]
[+DESCRIPTION?Ask the user for the max. time in seconds a client may try to bind to the server and store it into \bINT[LDAP_BIND_LIMIT]]\b.]
[+SEE ALSO?\bget_negone_num()\b, \bldapclient\b(1M).]
'
function get_bind_limit {
	get_negone_num 'Client bind time limit in seconds (h=help):' \
		${INT[LDAP_BIND_LIMIT]} 'bindlim_help'
	INT[LDAP_BIND_LIMIT]=${NUM}
}

Man.addFunc get_want_shadow_update '' '[+NAME?get_want_shadow_update - Ask user whether to enable shadow update.]
[+DESCRIPTION?Ask the user whether to enable shadow update. Set \bINT[LDAP_ENABLE_SHADOW_UPDATE]]\b to 0 if not desired, to 1 otherwise.]
[+SEE ALSO?\bget_confirm()\b.]
'
function get_want_shadow_update {
	get_confirm 'Do you want to enable shadow update (y/n/h)?' 'n' \
		'enable_shadow_update_help'
	INT[LDAP_ENABLE_SHADOW_UPDATE]=$?
}

	######################################################################
	# FUNCTIONS  FOR Service Search Descriptor's START HERE.
	######################################################################
Man.addFunc add_ssd '' '[+NAME?add_ssd - Ask user for SSD to add.]
[+DESCRIPTION?Ask the user for the ID:BASE:SCOPE and add it to \bSSD\b list.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage SSD ; }" '}
[+SEE ALSO?\bget_ans\b, \bget_ans_req()\b.]
'
function add_ssd {
	typeset ID='' BASE='' X
	typeset -l SCOPE=''
	integer FOUND

	while : ; do
		get_ans 'Enter the service id:'
		[[ -z ${ANS} ]] && return
		[[ ${ANS} =~ [:] ]] && print 'Invalid Service id' && continue

		FOUND=0
		for X  in "${SSD[@]}" ; do
			[[ ${X%%:*} == ${ANS} ]] && FOUND=1 && break
		done
		(( ! FOUND )) && break
		print -u2 "ERROR: Service id '${ANS}' already exists:\n${X}\n"
	done
	ID="${ANS}"
    
	while : ; do
		get_ans_req 'Enter the base:'
		[[ ${ANS} != ~(E)[:] ]] && break
		print 'Invalid base' && continue
	done
	BASE="${ANS}"

	while : ; do
		get_ans_req "Enter the scope:"
		SCOPE=${ANS}
		[[ ${SCOPE} == 'one' || ${SCOPE} == 'sub' ]] && break
		print -u2 "'${ANS}' is NOT valid - Enter 'one' or 'sub'"
	done

	SSD+=( "${ID}:${BASE}?${SCOPE}" )
}

Man.addFunc delete_ssd '' '[+NAME?delete_ssd - Ask user which SSD to delete.]
[+DESCRIPTION?Ask the user for the ID of the SSD to delete and remove it from \bSSD\b list.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage SSD ; }" '}
[+SEE ALSO?\bget_ans()\b.]
'
function delete_ssd {
	get_ans 'Enter service id to delete:'
	[[ -z ${ANS} ]] && return

	typeset X
	integer I FOUND=-1 MAX=${#SSD[@]}

	for (( I=0; I < MAX ; I++ )); do
		X=${SSD[I]}
		[[ ${X%%:*} == ${ANS} ]] && FOUND=$I && break
	done
	if (( FOUND == -1 )); then
		print -u2 "Invalid service id: '${ANS}' not present in list."
		return
	fi
	(( FOUND == 0 )) && unset SSD[0] && return

	# need to do a little bit more, since ksh allows to remove the 1st entry,
	# only (i.e. like "shift 1" for positional params)
	for (( I=FOUND; I > 0; I-- )); do
		SSD[${I}]="${SSD[I-1]}"
	done
	unset SSD[0]
}

Man.addFunc modify_ssd '' '[+NAME?modify_ssd - Allow user to modify an SSD.]
[+DESCRIPTION?Ask the user for the ID of the SSD to modify, let the user modify it and finally save changes back to the \bSSD\b list.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage SSD ; }" '}
[+SEE ALSO?\bget_ans()\b, \bread\b(1).]
'
function modify_ssd {
	# Prompt user for service id.
	get_ans 'Enter service id to modify:'
	[[ -z ${ANS} ]] && return
    
	typeset ID BASE
	typeset -l SCOPE
	integer I FOUND=-1 MAX=${#SSD[@]}
	for (( I=0; I < MAX ; I++ )); do
		X=${SSD[I]}
		[[ ${X%%:*} == ${ANS} ]] && FOUND=$I && break
	done
	if (( FOUND == -1 )); then
		print -u2 "Invalid service id: '${ANS}'"
		return 0
	fi

	# most users expect emacs edit behavior (don't have a proper profile)
	set -o emacs
	read -v X?'Current SSD: '

	# now verify
	ID=${X%%:*}
	BASE=${.sh.match#:}
	SCOPE=${BASE#*$'?'}
	BASE=${.sh.match%$'?'}
	if [[ -z ${ID} || -z ${BASE} || -z ${SCOPE} ]] || \
		[[ ${SCOPE} != 'one' && ${SCOPE} != 'sub' ]]
	then
		print -u2 ' ERROR: SSD is invalid. Change skipped!'
		return
	fi
	SSD[${FOUND}]="${ID}:${BASE}?${SCOPE}"
}

Man.addFunc reset_ssd '' '[+NAME?reset_ssd - Blank out current list of SSDs.]
[+DESCRIPTION?Clear the \bSSD\b array.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage SSD ; }" '}
'
function reset_ssd {
    SSD=( )
	unset SSD[0]	# required otherwise it would contain a single '\n'. Bug?
}

Man.addFunc display_ssd '' '[+NAME?display_ssd -  Display current SSD list.]
[+DESCRIPTION?Display the current \bSSD\b list and return, when the user hit the enter key.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage SSD ; }" '}
'
function display_ssd {
	typeset X
	print '
Current Service Search Descriptors:
=================================='
	for X in "${SSD[@]}" ; do
		print "  ${X}"
	done
    print '\nHit return to continue.'
	read
}

Man.addFunc prompt_ssd '' '[+NAME?prompt_ssd - Get SSDs from user.]
[+DESCRIPTION?Ask the user whether to add/delete/modify/display one or more SSDs currently set and execute the corresponding action.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage ANS ; }" '}
[+SEE ALSO?\bdisplay_msg()\b, \bget_ans()\b, \badd_ssd()\b, \bdelete_ssd()\b, \bmodify_ssd()\b, \bdisplay_ssd()\b, \breset_ssd()\b.]
'
function prompt_ssd {
	if get_confirm 'Do you wish to setup Service Search Descriptors (y/n/h)?' \
		'n' 'ssd_help'
	then
		return
	fi

	# Display menu for SSD choices.
	while : ; do
		display_msg prompt_ssd_menu
		get_ans 'Enter menu choice:' 'Quit'
		case "${ANS}" in
			[Qq] | Quit | quit)		return ;;
			[Aa] | add)				add_ssd ;;
			[Dd] | delete)			delete_ssd ;;
			[Mm] | modify)			modify_ssd ;;
			[Pp] | print | display)	display_ssd ;;
			[Xx] | reset | clear)	reset_ssd ;;
			[Hh] | Help | help)
				display_msg 'ssd_menu_help '
				print ' Press return to continue.'
				read
				;;
			*) print "Invalid choice: '${ANS}' please re-enter from menu." ;;
		esac
	done
}

	######################################################################
	# End Of FUNCTIONS FOR Service Search Descriptor's
	######################################################################
Man.addFunc prompt_config_info '' '[+NAME?prompt_config_info - Ask user for missing config info.]
[+DESCRIPTION?Ask the user for the config info not yet available/read from an '"${PROG}"' config file.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage INT STR SSD ; }" '}
[+RETURN VALUES]{
	[+0?on success (all info aquired).]
	[+>= 66?a fatal error occured.]
}
'
function prompt_config_info {
	# Prompt for DSEE server name.
	get_ids_server

	# Prompt for DSEE port number.
	get_ids_port

	# Check DSEE version for compatibility.
	chk_ids_version || return 66

	# Check if the server supports the VLV.
	chk_vlv_indexes || return 67

	# Get the Directory manager DN and passwd.
	get_dirmgr_dn
	get_dirmgr_pw

	# LDAP CLIENT PROFILE SPECIFIC INFORMATION.
	#   (i.e. The fields that show up in the profile.)
	get_domain
	get_basedn || return 68

	# Check/Get Kerberos infos
    gssapi_setup

    get_profile_name

	if (( INT[LDAP_ENABLE_SHADOW_UPDATE] ));then
		setup_shadow_update || return 69
		return 0
	fi

	get_srv_list
	get_pref_srv
	get_search_scope

	# If cred is "anonymous", make auth == "none"
	get_cred_level
	[[ ${STR[LDAP_CRED_LEVEL]} != anonymous ]]  && get_auth 'client'

    get_followref

	# Query user about timelimt.
	get_confirm 'Do you want to modify the server timelimit value (y/n/h)?' \
		'n' 'tlim_help'
	INT[NEED_TIME]=$?
	if (( INT[NEED_TIME] )); then
		get_timelimit || return 70
	fi

    # Query user about sizelimit.
	get_confirm 'Do you want to modify the server sizelimit value (y/n/h)?' \
		'n' 'slim_help'
	INT[NEED_SIZE]=$?
	if (( INT[NEED_SIZE] )); then
		get_sizelimit || return 71
	fi

	# Does the user want to store passwords in crypt format?
	get_want_crypt

	# Prompt for any Service Authentication Methods?
	get_confirm 'Do you want to setup a Service Authentication Methods (y/n/h)?' 'n' 'srvauth_help'
	if (( $? )); then
		get_confirm 'Do you want to setup a Service Auth. Method for "pam_ldap" (y/n/h)?' 'n' 'pam_ldap_help'
		INT[NEED_SRVAUTH_PAM]=$?
		(( INT[NEED_SRVAUTH_PAM] )) && get_auth 'pam_ldap'

		get_confirm 'Do you want to setup a Service Auth. Method for "keyserv" (y/n/h)?' 'n' 'keyserv_help'
		INT[NEED_SRVAUTH_KEY]=$?
		(( INT[NEED_SRVAUTH_KEY] )) && get_auth 'keyserv'

		get_confirm 'Do you want to setup a Service Auth. Method for "passwd-cmd (y/n/h)?' 'n' 'passwd-cmd_help'
		INT[NEED_SRVAUTH_CMD]=$?
		(( INT[NEED_SRVAUTH_CMD] )) && get_auth 'passwd-cmd'
	fi

	# Get Timeouts
	get_srch_time
	get_prof_ttl
	get_bind_limit

	# Ask whether to enable shadow update
	get_want_shadow_update

	# Reset the SSDs and prompt user for SSD
	reset_ssd
	prompt_ssd

	# Display FULL debugging info.
	show_vars

	# Extra blank line to separate prompt lines from steps.
	print
	return 0
}
######################################################################
# End Of FUNCTIONS FOR prompt_config_info()
######################################################################


######################################################################
# FUNCTIONS  FOR display_summary() START HERE.
######################################################################
Man.addFunc get_proxyagent '' '[+NAME?get_proxyagent - Ask user for the proxy agent DN and password.]
[+DESCRIPTION?Ask the user for the proxy agent DN and password to use and store it into \bSTR[LDAP_PROXYAGENT]]\b, \bSTR[LDAP_PROXYAGENT_CRED]]\b.]
[+SEE ALSO?\bget_ans()\b.]
'
function get_proxyagent {
	STR[LDAP_PROXYAGENT]="cn=proxyagent,ou=profile,${STR[LDAP_BASEDN]}"
	get_ans 'Enter DN for proxy agent:' "${STR[LDAP_PROXYAGENT]}"
	STR[LDAP_PROXYAGENT]="${ANS}"
	get_passwd 'Enter passwd for proxyagent:'
	STR[LDAP_PROXYAGENT_CRED]="${ANS}"
}

Man.addFunc display_summary '' '[+NAME?display_summary - Display a summary of values entered and let the user modify values at will.]
[+DESCRIPTION?Display a summary of all configuration relevant info and let the user re-enter data if needed.]
'
function display_summary {
	# Create lookup table for function names. Needs to be in sync with 
	# helpTag 'summary_menu' in display_msg()!
	typeset -a FN=( 'dummy' )					# dummy for commit and quit
	FN+=( 'get_domain' 'get_basedn' 'get_profile_name' )
	FN+=( 'get_srv_list' 'get_pref_srv' 'get_search_scope' 'get_cred_level' )
	FN+=( 'get_auth client' 'get_followref' )
    FN+=( 'get_timelimit' 'get_sizelimit' 'get_want_crypt' )
    FN+=( 'get_auth pam_ldap' 'get_auth keyserv' 'get_auth passwd-cmd' )
    FN+=( 'get_srch_time' 'get_prof_ttl' 'get_bind_limit' )
    FN+=( 'get_want_shadow_update' )
    FN+=( 'prompt_ssd' )

    # Since menu prompt string is long, set here.
    typeset PROMPT="Enter config value to change: (1-20 0=commit changes)"
	integer RES MAX=${#FN[@]}
	(( MAX-- ))

	while : ; do
		# Display menu and get value in range.
		get_menu_choice "${PROMPT}" '0' ${MAX} '0' 'summary_menu'
		RES=$?
	
		# Make sure where not exiting.
		(( $RES == 0 )) && break			# quit selected

		# Call appropriate function from function table.
		${FN[RES]}
	done

    # If cred level is still see if user wants a change?
	if [[ ${STR[LDAP_CRED_LEVEL]:0:5} == proxy ]]; then
		if [[ ${STR[LDAP_AUTHMETHOD]} != none ]]; then
			INT[NEED_PROXY]=1
			get_proxyagent
		else
			print 'WARNING: Since Authentication method is "none".' \
				'\n         Credential level will be set to "anonymous".'
			STR[LDAP_CRED_LEVEL]='anonymous'
		fi
	fi

	# If shadow update is enabled, set up administrator credential
	if (( INT[LDAP_ENABLE_SHADOW_UPDATE] )); then
		INT[NEED_ADMIN]=1
		if [[ ${STR[LDAP_CRED_LEVEL]} == self && \
			${STR[LDAP_AUTHMETHOD]} == sasl/GSSAPI ]];
		then
				INT[NEED_HOSTACL]=1
				INT[NEED_ADMIN]=0
		fi
		if (( INT[NEED_ADMIN] )); then
			get_adminDN
			get_admin_pw
		fi
	fi

	show_vars

	# Final confirmation message. (ARE YOU SURE!)
	if ! get_confirm_nodef '\nWARNING: About to start committing changes. (y=continue, n=EXIT)'
	then
		print 'Terminating setup without making changes at users request.'
		return 1
	fi

	print
	return 0
}
######################################################################
# End Of FUNCTIONS  FOR display_summary()
######################################################################

Man.addFunc modify_cn '' '[+NAME?modify_cn - modify objectclass "ipNetwork" to RFC 2307bis.]
[+DESCRIPTION?Change the cn from MUST to MAY in ipNetwork objectclass.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_cn {
	getDSobjectclasses || return 66
	typeset NEWDEF="'ipNetwork' SUP top STRUCTURAL DESC 'Abstraction of a network. The distinguished value of the cn attribute denotes the canonical name of the network' MUST ipNetworkNumber MAY "'( cn $ ipNetmaskNumber $ l $ description $ manager )'" X-ORIGIN 'draft-howard-rfc2307bis'"

	# bis-delta: MUST ( -cn )  MAY ( +cn )
	typeset DEF=${OID2ODEF['1.3.6.1.1.1.2.7']}
	if [[ -n ${DEF} ]]; then
		DEF=${DEF##*MUST*([[:space:]])}
		if [[ ${DEF:0:9} == 'ipNetwork' ]]; then
			# assume no need to fix
			print '  INFO: Leaving attribute definition 1.3.6.1.1.1.2.7' \
				'(ipNetwork) as is.'
			return 0
		fi
	fi
		
	print '
dn: cn=schema
changetype: modify
add: objectclasses
objectclasses: ( 1.3.6.1.1.1.2.7 NAME '"${NEWDEF}"')
'	> ${TMP[DIR]}/ipNetwork_cn

	# Modify the cn for ipNetwork.
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/ipNetwork_cn 2>/dev/null
	then
		print -u2 '  ERROR: update of cn for ipNetwork failed!'
		return 67
	fi
	OID2ODEF['1.3.6.1.1.1.2.7']="${NEWDEF}"
	return 0
}

Man.addFunc modify_timelimit '' '[+NAME?modify_timelimit - Set the DS timelimit.]
[+DESCRIPTION?Set the DS timelimit to \bINT[DS_TIMELIMIT]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_timelimit {
	typeset NAME='nsslapd-timelimit'
	(( TMPF[IS_OPENDJ] )) && NAME='ds-cfg-time-limit'

	print '
dn: cn=config
changetype: modify
replace: '"${NAME}"'
'"${NAME}"': '"${INT[DS_TIMELIMIT]}"'
'		> ${TMP[DIR]}/ids_timelimit

	# Add the entry.
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/ids_timelimit 2>/dev/null
	then
		print -u2 '  ERROR: update of nsslapd-timelimit failed!'
		return 66
	fi

	# Display messages for modifications made in patch.
	print "  ${TMPF[STEP]}. Changed timelimit to ${INT[DS_TIMELIMIT]} in" \
		"'cn=config'."
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc modify_sizelimit '' '[+NAME?modify_sizelimit - Set the DS sizelimit.]
[+DESCRIPTION?Set the DS sizelimit to \bINT[DS_SIZELIMIT]]\b.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_sizelimit {
	typeset NAME='nsslapd-sizelimit'
	(( TMPF[IS_OPENDJ] )) && NAME='ds-cfg-size-limit'

	print '
dn: cn=config
changetype: modify
replace: '"${NAME}"'
'"${NAME}"': '"${INT[DS_SIZELIMIT]}"'
'		> ${TMP[DIR]}/ids_sizelimit

	# Add the entry.
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/ids_sizelimit 2>/dev/null
	then
		print -u2 '  ERROR: update of nsslapd-sizelimit failed!'
		return 66
	fi

	# Display messages for modifications made in patch.
	print "  ${TMPF[STEP]}. Changed sizelimit to ${INT[DS_SIZELIMIT]} in" \
		"'cn=config'."
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc modify_pwd_crypt '' '[+NAME?modify_pwd_crypt - modify the passwd storage scheme to use CRYPT.]
[+DESCRIPTION?Set the default password policy of the DS to CRYPT.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function modify_pwd_crypt {
    # DS 5.2 moved passwordchangesceme off to a new data structure.
	typeset -a INFO=( ${TMP[DS_INFO]} )
	typeset DN='cn=config' TARGET='passwordStorageScheme' VALUE='CRYPT' MSG=''
	typeset FMT='dn: %s\nchangetype: modify\nreplace: %s\n%s: %s\n\n'
	typeset OUT=${TMP[DIR]}/ids_crypt

	if (( TMPF[IS_OPENDJ] )); then
		DN='cn=Default Password Policy,cn=Password Policies,cn=config'
		TARGET='ds-cfg-default-password-storage-scheme'
		VALUE='cn=CRYPT,cn=Password Storage Schemes,cn=config'
	else
		# DSEE
		integer VER=$(( ${INFO[1]} * 1000 + ${INFO[2]} ))
		(( ${VER} >= 5002 )) && DN='cn=Password Policy,cn=config'
	fi
	printf "${FMT}" "${DN}" "${TARGET}" "${TARGET}" "${VALUE}" >${OUT}
	MSG="  ${TMPF[STEP]}. Changed '${TARGET} to 'CRYPT'"

	if (( TMPF[IS_OPENDJ] )); then
		if (( INT[NEED_CRYPT_IMPORT] )); then 
			TARGET='ds-cfg-allow-pre-encoded-passwords'
			printf "${FMT}" "${DN}" "${TARGET}" "${TARGET}" 'true' >>${OUT}
			MSG+=", '${TARGET}=true'"
		fi
		MSG+=" in '${DN}'"
		DN='cn=Password Policy Import,cn=Plugins,cn=config'
		TARGET='ds-cfg-default-user-password-storage-scheme'
		printf "${FMT}" "${DN}" "${TARGET}" "${TARGET}" "${VALUE}" >>${OUT}
		MSG+=", and '${TARGET}' to 'CRYPT' in '${DN}'" 
	else
		MSG+=" in '${DN}'"
	fi

	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${OUT} 2>/dev/null
	then
		print -u2 '  ERROR: update of passwordStorageScheme failed!'
		return 66
	fi

	# Display messages for modifications made in patch.
	print "${MSG}."
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc update_schema_attr '' '[+NAME?update_schema_attr -  Update DS schema to support Naming Services.]
[+DESCRIPTION?Update the schema of the DS with the attribute types required for the Solaris Naming Services.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1), \bgetDSattributes()\b.]
'
function update_schema_attr {

	# incorporate former 'keep_backward_compatibility()'
	getDSattributes || return 66
	typeset MEMBERGID_OID='1.3.6.1.4.1.42.2.27.5.1.30'
	typeset DEF=${ANAME2OID['membergid-oid']}
	[[ -n ${DEF} ]] && MEMBERGID_OID='memberGid-oid'
	typeset RFC822MAILMEMBER_OID='1.3.6.1.4.1.42.2.27.2.1.15'
	DEF=${ANAME2OID['rfc822mailmember-oid']}
	[[ -n ${DEF} ]] && RFC822MAILMEMBER_OID='rfc822mailMember-oid'

	# EE and OD definitions seem to be compatible wrt. to Solaris. However, the
	# OD defs usually specifies explicitly the server behavior (what happens, if
	# EQUALITY|SUBSTR is not specified => caseIgnore[Substring]Match)) and 
	# sometimes a different kind of String to use (see RFC 4517):
	# IA5 String: ASCII character in the range of 0..127
	# Octet String: byte collection (0..255), usually not human readable,
	#               bytewise comparision
	# Directory String: an UTF-8 string
	# DN: basically an UTF-8 string, but with some constraints wrt. backslash
	#     escaping '\0', '"', '+', ',', ';', '<', '>',  and '\'
	# Boolean String: TRUE|FALSE
	typeset -A EE=( )
	typeset -A OD=( )
	EE['1.3.6.1.1.1.1.28']="'nisPublickey' DESC 'NIS public key' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.1.1.1.28']="'nisPublicKey' DESC 'NIS public key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'" # Directory vs. Octet String

	EE['1.3.6.1.1.1.1.29']="'nisSecretkey' DESC 'NIS secret key' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.1.1.1.29']="'nisSecretKey' DESC 'NIS secret key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'"	# Directory vs. Octet String

	EE['1.3.6.1.1.1.1.30']="'nisDomain' DESC 'NIS domain' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.1.1.1.30']="'nisDomain' DESC 'NIS domain' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'draft-howard-rfc2307bis'"	# Directory vs. IA5 String

	EE['1.3.6.1.1.1.1.31']="'automountMapName' DESC 'automount Map Name' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.1.1.1.31']="'automountMapName' DESC 'automount Map Name' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.1.1.1.32']="'automountKey' DESC 'automount Key Value' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.1.1.1.32']="'automountKey' DESC 'Automount Key value' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.1.1.1.33']="'automountInformation' DESC 'automount information' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.1.1.1.33']="'automountInformation' DESC 'Automount information' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.4.1.42.2.27.1.1.12']="'nisNetIdUser' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.42.2.27.1.1.12']="'nisNetIdUser' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.1.1.13']="'nisNetIdGroup' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.42.2.27.1.1.13']="'nisNetIdGroup' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.1.1.14']="'nisNetIdHost' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.42.2.27.1.1.14']="'nisNetIdHost' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"

	EE[${RFC822MAILMEMBER_OID}]="'rfc822mailMember' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD[${RFC822MAILMEMBER_OID}]="'rfc822mailMember' DESC 'rfc822 mail addresss of group member' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"

	EE['2.16.840.1.113730.3.1.30']="'mgrpRFC822MailMember' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['2.16.840.1.113730.3.1.30']="'mgrpRFC822MailMember' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.15']="'SolarisLDAPServers' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.15']="'SolarisLDAPServers' DESC 'LDAP Server address eg. 76.234.3.1:389' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.16']="'SolarisSearchBaseDN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.16']="'SolarisSearchBaseDN' DESC 'Search Base Distinguished Name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# DN vs. Directory String

	EE['1.3.6.1.4.1.42.2.27.5.1.17']="'SolarisCacheTTL' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.17']="'SolarisCacheTTL' DESC 'TTL value for the Domain information eg. 1w, 2d, 3h, 10m, or 5s' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.18']="'SolarisBindDN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.18']="'SolarisBindDN' DESC 'DN to be used to bind to the directory as proxy' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# DN vs. Directory String

	EE['1.3.6.1.4.1.42.2.27.5.1.19']="'SolarisBindPassword' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.19']="'SolarisBindPassword' DESC 'Password for bindDN to authenticate to the directory' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# IA5 vs. Octet String

	EE['1.3.6.1.4.1.42.2.27.5.1.20']="'SolarisAuthMethod' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.20']="'SolarisAuthMethod' DESC 'Authentication method to be used eg. \"NS_LDAP_AUTH_NONE\", \"NS_LDAP_AUTH_SIMPLE\" or \"NS_LDAP_AUTH_SASL_CRAM_MD5\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.21']="'SolarisTransportSecurity' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.21']="'SolarisTransportSecurity' DESC 'Transport Level Security method to be used eg. \"NS_LDAP_SEC_NONE\" or \"NS_LDAP_SEC_SASL_TLS\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.22']="'SolarisCertificatePath' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.22']="'SolarisCertificatePath' DESC 'Path to certificate file/device' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.23']="'SolarisCertificatePassword' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.23']="'SolarisCertificatePassword' DESC 'Password or PIN that grants access to certificate.' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# IA5 vs. Octet String

	EE['1.3.6.1.4.1.42.2.27.5.1.24']="'SolarisDataSearchDN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.24']="'SolarisDataSearchDN' DESC 'Search DN for data lookup in \":(DN0),(DN1),...\" format' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.25']="'SolarisSearchScope' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.25']="'SolarisSearchScope' DESC 'Scope to be used for search operations eg. \"NS_LDAP_SCOPE_BASE\", \"NS_LDAP_SCOPE_ONELEVEL\" or \"NS_LDAP_SCOPE_SUBTREE\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.26']="'SolarisSearchTimeLimit' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.26']="'SolarisSearchTimeLimit' DESC 'Time Limit in seconds for search operations' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.27']="'SolarisPreferredServer' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.27']="'SolarisPreferredServer' DESC 'Preferred LDAP Server address or network number' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.28']="'SolarisPreferredServerOnly' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.28']="'SolarisPreferredServerOnly' DESC 'Boolean flag for use of preferredServer or not' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. Boolean String

	EE['1.3.6.1.4.1.42.2.27.5.1.29']="'SolarisSearchReferral' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.29']="'SolarisSearchReferral' DESC 'referral chasing option eg. \"NS_LDAP_NOREF\" or \"NS_LDAP_FOLLOWREF\"' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.4']="'SolarisAttrKeyValue' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.4']="'SolarisAttrKeyValue' DESC 'Semi-colon separated key=value pairs of attributes' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.5']="'SolarisAuditAlways' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.5']="'SolarisAuditAlways' DESC 'Always audited attributes per-user' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.6']="'SolarisAuditNever' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.6']="'SolarisAuditNever' DESC 'Never audited attributes per-user' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.7']="'SolarisAttrShortDesc' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.7']="'SolarisAttrShortDesc' DESC 'Short description about an entry, used by GUIs' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.8']="'SolarisAttrLongDesc' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.8']="'SolarisAttrLongDesc' DESC 'Detail description about an entry' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.9']="'SolarisKernelSecurityPolicy' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.9']="'SolarisKernelSecurityPolicy' DESC 'Solaris kernel security policy' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.10']="'SolarisProfileType' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.10']="'SolarisProfileType' DESC 'Type of object defined in profile'EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.11']="'SolarisProfileId' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.11']="'SolarisProfileId' DESC 'Identifier of object defined in profile' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.12']="'SolarisUserQualifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.12']="'SolarisUserQualifier' DESC 'Per-user login attributes' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.13']="'SolarisAttrReserved1' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.13']="'SolarisAttrReserved1' DESC 'Reserved for future use' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.14']="'SolarisAttrReserved2' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.14']="'SolarisAttrReserved2' DESC 'Reserved for future use' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.42.2.27.5.1.1']="'SolarisProjectID' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.1']="'SolarisProjectID' DESC 'Unique ID for a Solaris Project entry' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.2']="'SolarisProjectName' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.2']="'SolarisProjectName' DESC 'Name of a Solaris Project Entry' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.3']="'SolarisProjectAttr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.42.2.27.5.1.3']="'SolarisProjectAttr' DESC 'Attributes of a Solaris Project entry' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE[${MEMBERGID_OID}]="'memberGid' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD[${MEMBERGID_OID}]="'memberGid' DESC 'Posix Group Name' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.11.1.3.1.1.0']="'defaultServerList' DESC 'Default LDAP server host address used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.0']="'defaultServerList' DESC 'List of default servers' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.1']="'defaultSearchBase' DESC 'Default LDAP base DN used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.1']="'defaultSearchBase' DESC 'Default base for searches' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.2']="'preferredServerList' DESC 'Preferred LDAP server host addresses to be used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.2']="'preferredServerList' DESC 'List of preferred servers' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.3']="'searchTimeLimit' DESC 'Maximum time in seconds a DUA should allow for a search to complete' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.3']="'searchTimeLimit' DESC 'Maximum time an agent or service allows for a search to complete' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.4']="'bindTimeLimit' DESC 'Maximum time in seconds a DUA should allow for the bind operation to complete' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.4']="'bindTimeLimit' DESC 'Maximum time an agent or service allows for a bind operation to complete' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.5']="'followReferrals' DESC 'Tells DUA if it should follow referrals returned by a DSA search result' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.5']="'followReferrals' DESC 'An agent or service does or should follow referrals' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'RFC 4876'"	# Directory vs. Boolean String

	EE['1.3.6.1.4.1.11.1.3.1.1.6']="'authenticationMethod' DESC 'A keystring which identifies the type of authentication method used to contact the DSA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.6']="'authenticationMethod' DESC 'Identifies the types of authentication methods either used, required, or provided by a service or peer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.7']="'profileTTL' DESC 'Time to live before a client DUA should re-read this configuration profile' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.7']="'profileTTL' DESC 'Time to live, in seconds, before a profile is considered stale' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.14']="'serviceSearchDescriptor' DESC 'LDAP search descriptor list used by Naming-DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.11.1.3.1.1.14']="'serviceSearchDescriptor' DESC 'Specifies search descriptors required, used, or supported by a particular service or agent' EQUALITY caseExactMatch SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 4876'"	# IA5 vs. Directory String

	EE['1.3.6.1.4.1.11.1.3.1.1.9']="'attributeMap' DESC 'Attribute mappings used by a Naming-DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.11.1.3.1.1.9']="'attributeMap' DESC 'Attribute mappings used, required, or supported by an agent or service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 4876'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.11.1.3.1.1.10']="'credentialLevel' DESC 'Identifies type of credentials a DUA should use when binding to the LDAP server' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.10']="'credentialLevel' DESC 'Identifies type of credentials either used, required, or supported by an agent or service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'RFC 4876'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.11.1.3.1.1.11']="'objectclassMap' DESC 'Objectclass mappings used by a Naming-DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.11.1.3.1.1.11']="'objectclassMap' DESC 'Object class mappings used, required, or supported by an agent or service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 4876'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.11.1.3.1.1.12']="'defaultSearchScope' DESC 'Default search scope used by a DUA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.11.1.3.1.1.12']="'defaultSearchScope' DESC 'Default scope used when performing a search' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'RFC 4876'"	# Directory vs. IA5 String

	EE['1.3.6.1.4.1.11.1.3.1.1.13']="'serviceCredentialLevel' DESC 'Search scope used by a service of the DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26"
	OD['1.3.6.1.4.1.11.1.3.1.1.13']="'serviceCredentialLevel' DESC 'Specifies the type of credentials either used, required, or supported by a specific service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 4876'"

	EE['1.3.6.1.4.1.11.1.3.1.1.15']="'serviceAuthenticationMethod' DESC 'Authentication Method used by a service of the DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.11.1.3.1.1.15']="'serviceAuthenticationMethod' DESC 'Specifies types authentication methods either used, required, or supported by a particular service' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 4876'"

	EE['1.3.18.0.2.4.1140']="'printer-uri' DESC 'A URI supported by this printer.  This URI SHOULD be used as a relative distinguished name (RDN).  If printer-xri-supported is implemented, then this URI value MUST be listed in a member value of printer-xri-supported.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1140']="'printer-uri' DESC 'A URI supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1107']="'printer-xri-supported' DESC 'The unordered list of XRI (extended resource identifiers) supported by this printer.  Each member of the list consists of a URI (uniform resource identifier) followed by optional authentication and security metaparameters.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.18.0.2.4.1107']="'printer-xri-supported' DESC 'The unordered list of XRI (extended resource identifiers) supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1135']="'printer-name' DESC 'The site-specific administrative name of this printer, more end-user friendly than a URI.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}  SINGLE-VALUE"
	OD['1.3.18.0.2.4.1135']="'printer-name' DESC 'The site-specific administrative name of this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1119']="'printer-natural-language-configured' DESC 'The configured language in which error and status messages will be generated (by default) by this printer.  Also, a possible language for printer string attributes set by operator, system administrator, or manufacturer.  Also, the (declared) language of the \"printer-name\", \"printer-location\", \"printer-info\", and \"printer-make-and-model\" attributes of this printer. For example: \"en-us\" (US English) or \"fr-fr\" (French in France) Legal values of language tags conform to [RFC3066] \"Tags for the Identification of Languages\".' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}  SINGLE-VALUE"
	OD['1.3.18.0.2.4.1119']="'printer-natural-language-configured' DESC 'The configured natural language in which error and status messages will be generated (by default) by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1136']="'printer-location' DESC 'Identifies the location of the printer. This could include things like: \"in Room 123A\", \"second floor of building XYZ\".' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
	OD['1.3.18.0.2.4.1136']="'printer-location' DESC 'The physical location of this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1139']="'printer-info' DESC 'Identifies the descriptive information about this printer.  This could include things like: \"This printer can be used for printing color transparencies for HR presentations\", or \"Out of courtesy for others, please print only small (1-5 page) jobs at this printer\", or even \"This printer is going away on July 1, 1997, please find a new printer\".' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
	OD['1.3.18.0.2.4.1139']="'printer-info' DESC 'Descriptive information about this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1134']="'printer-more-info' DESC 'A URI used to obtain more information about this specific printer.  For example, this could be an HTTP type URI referencing an HTML page accessible to a Web Browser.  The information obtained from this URI is intended for end user consumption.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1134']="'printer-more-info' DESC 'A URI for more information about this specific printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1138']="'printer-make-and-model' DESC 'Identifies the make and model of the device.  The device manufacturer MAY initially populate this attribute.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}  SINGLE-VALUE"
	OD['1.3.18.0.2.4.1138']="'printer-make-and-model' DESC 'Make and model of this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1133']="'printer-ipp-versions-supported' DESC 'Identifies the IPP protocol version(s) that this printer supports, including major and minor versions, i.e., the version numbers for which this Printer implementation meets the conformance requirements.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1133']="'printer-ipp-versions-supported' DESC 'IPP protocol version(s) that this printer supports.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1132']="'printer-multiple-document-jobs-supported' DESC 'Indicates whether or not the printer supports more than one document per job, i.e., more than one Send-Document or Send-Data operation with document data.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1132']="'printer-multiple-document-jobs-supported' DESC 'Indicates whether or not this printer supports more than one document per job.' EQUALITY booleanMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1109']="'printer-charset-configured' DESC 'The configured charset in which error and status messages will be generated (by default) by this printer.  Also, a possible charset for printer string attributes set by operator, system administrator, or manufacturer.  For example: \"utf-8\" (ISO 10646/Unicode) or \"iso-8859-1\" (Latin1).  Legal values are defined by the IANA Registry of Coded Character Sets and the \"(preferred MIME name)\" SHALL be used as the tag.  For coherence with IPP Model, charset tags in this attribute SHALL be lowercase normalized.  This attribute SHOULD be static (time of registration) and SHOULD NOT be dynamically refreshed attributetypes: (subsequently).' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63} SINGLE-VALUE"
	OD['1.3.18.0.2.4.1109']="'printer-charset-configured' DESC 'The configured charset in which error and status messages will be generated (by default) by this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1131']="'printer-charset-supported' DESC 'Identifies the set of charsets supported for attribute type values of type Directory String for this directory entry.  For example: \"utf-8\" (ISO 10646/Unicode) or \"iso-8859-1\" (Latin1).  Legal values are defined by the IANA Registry of Coded Character Sets and the preferred MIME name.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63}"
	OD['1.3.18.0.2.4.1131']="'printer-charset-supported' DESC 'Set of charsets supported for the attribute values of syntax DirectoryString for this directory entry.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1137']="'printer-generated-natural-language-supported' DESC 'Identifies the natural language(s) supported for this directory entry.  For example: \"en-us\" (US English) or \"fr-fr\" (French in France).  Legal values conform to [RFC3066], Tags for the Identification of Languages.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63}"
	OD['1.3.18.0.2.4.1137']="'printer-generated-natural-language-supported' DESC 'Natural language(s) supported for this directory entry.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{63} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1130']="'printer-document-format-supported' DESC 'The possible document formats in which data may be interpreted and printed by this printer.  Legal values are MIME types come from the IANA Registry of Internet Media Types.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1130']="'printer-document-format-supported' DESC 'The possible source document formats which may be interpreted and printed by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1129']="'printer-color-supported' DESC 'Indicates whether this printer is capable of any type of color printing at all, including highlight color.' EQUALITY booleanMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1129']="'printer-color-supported' DESC 'Indicates whether this printer is capable of any type of color printing at all, including highlight color.' EQUALITY booleanMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1128']="'printer-compression-supported' DESC 'Compression algorithms supported by this printer.  For example: \"deflate, gzip\".  Legal values include; \"none\", \"deflate\" attributetypes: (public domain ZIP), \"gzip\" (GNU ZIP), \"compress\" (UNIX).' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255}"
	OD['1.3.18.0.2.4.1128']="'printer-compression-supported' DESC 'Compression algorithms supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1127']="'printer-pages-per-minute' DESC 'The nominal number of pages per minute which may be output by this printer (e.g., a simplex or black-and-white printer).  This attribute is informative, NOT a service guarantee.  Typically, it is the value used in marketing literature to describe this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1127']="'printer-pages-per-minute' DESC 'The nominal number of pages per minute which may be output by this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1126']="'printer-pages-per-minute-color' DESC 'The nominal number of color pages per minute which may be output by this printer (e.g., a simplex or color printer).  This attribute is informative, NOT a service guarantee.  Typically, it is the value used in marketing literature to describe this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1126']="'printer-pages-per-minute-color' DESC 'The nominal number of color pages per minute which may be output by this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1125']="'printer-finishings-supported' DESC 'The possible finishing operations supported by this printer. Legal values include; \"none\", \"staple\", \"punch\", \"cover\", \"bind\", \"saddle-stitch\", \"edge-stitch\", \"staple-top-left\", \"staple-bottom-left\", \"staple-top-right\", \"staple-bottom-right\", \"edge-stitch-left\", \"edge-stitch-top\", \"edge-stitch-right\", \"edge-stitch-bottom\", \"staple-dual-left\", \"staple-dual-top\", \"staple-dual-right\", \"staple-dual-bottom\".' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255}"
	OD['1.3.18.0.2.4.1125']="'printer-finishings-supported' DESC 'The possible finishing operations supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1124']="'printer-number-up-supported' DESC 'The possible numbers of print-stream pages to impose upon a single side of an instance of a selected medium. Legal values include; 1, 2, and 4.  Implementations may support other values.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27"
	OD['1.3.18.0.2.4.1124']="'printer-number-up-supported' DESC 'The possible numbers of print-stream pages to impose upon a single side of an instance of a selected medium.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1123']="'printer-sides-supported' DESC 'The number of impression sides (one or two) and the two-sided impression rotations supported by this printer.  Legal values include; \"one-sided\", \"two-sided-long-edge\", \"two-sided-short-edge\".' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1123']="'printer-sides-supported' DESC 'The number of impression sides (one or two) and the two-sided impression rotations supported by this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1122']="'printer-media-supported' DESC 'The standard names/types/sizes (and optional color suffixes) of the media supported by this printer.  For example: \"iso-a4\",  \"envelope\", or \"na-letter-white\".  Legal values  conform to ISO 10175, Document Printing Application (DPA), and any IANA registered extensions.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255}"
	OD['1.3.18.0.2.4.1122']="'printer-media-supported' DESC 'The standard names/types/sizes (and optional color suffixes) of the media supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1117']="'printer-media-local-supported' DESC 'Site-specific names of media supported by this printer, in the language in \"printer-natural-language-configured\".  For example: \"purchasing-form\" (site-specific name) as opposed to (in \"printer-media-supported\"): \"na-letter\" (standard keyword from ISO 10175).' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255}"
	OD['1.3.18.0.2.4.1117']="'printer-media-local-supported' DESC 'Site-specific names of media supported by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1121']="'printer-resolution-supported' DESC 'List of resolutions supported for printing documents by this printer.  Each resolution value is a string with 3 fields:  1) Cross feed direction resolution (positive integer), 2) Feed direction resolution (positive integer), 3) Resolution unit.  Legal values are \"dpi\" (dots per inch) and \"dpcm\" (dots per centimeter).  Each resolution field is delimited by \">\".  For example:  \"300> 300> dpi>\".' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255}"
	OD['1.3.18.0.2.4.1121']="'printer-resolution-supported' DESC 'List of resolutions supported for printing documents by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{255} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1120']="'printer-print-quality-supported' DESC 'List of print qualities supported for printing documents on this printer.  For example: \"draft, normal\".  Legal values include; \"unknown\", \"draft\", \"normal\", \"high\".' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1120']="'printer-print-quality-supported' DESC 'List of print qualities supported for printing documents on this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1110']="'printer-job-priority-supported' DESC 'Indicates the number of job priority levels supported.  An IPP conformant printer which supports job priority must always support a full range of priorities from \"1\" to \"100\" (to ensure consistent behavior), therefore this attribute describes the \"granularity\".  Legal values of this attribute are from \"1\" to \"100\".' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1110']="'printer-job-priority-supported' DESC 'Indicates the number of job priority levels supported by this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1118']="'printer-copies-supported' DESC 'The maximum number of copies of a document that may be printed as a single job.  A value of \"0\" indicates no maximum limit.  A value of \"-1\" indicates unknown.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1118']="'printer-copies-supported' DESC 'The maximum number of copies of a document that may be printed as a single job on this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1111']="'printer-job-k-octets-supported' DESC 'The maximum size in kilobytes (1,024 octets actually) incoming print job that this printer will accept.  A value of \"0\" indicates no maximum limit.  A value of \"-1\" indicates unknown.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE"
	OD['1.3.18.0.2.4.1111']="'printer-job-k-octets-supported' DESC 'The maximum size in kilobytes (1,024 octets actually) incoming print job that this printer will accept.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1112']="'printer-current-operator' DESC 'The name of the current human operator responsible for operating this printer.  It is suggested that this string include information that would enable other humans to reach the operator, such as a phone number.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE"
	OD['1.3.18.0.2.4.1112']="'printer-current-operator' DESC 'The identity of the current human operator responsible for operating this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1113']="'printer-service-person' DESC 'The name of the current human service person responsible for servicing this printer.  It is suggested that this string include information that would enable other humans to reach the service person, such as a phone number.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}  SINGLE-VALUE"
	OD['1.3.18.0.2.4.1113']="'printer-service-person' DESC 'The identity of the current human service person responsible for servicing this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} SINGLE-VALUE X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1114']="'printer-delivery-orientation-supported' DESC 'The possible delivery orientations of pages as they are printed and ejected from this printer.  Legal values include; \"unknown\", \"face-up\", and \"face-down\".' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1114']="'printer-delivery-orientation-supported' DESC 'The possible delivery orientations of pages as they are printed and ejected from this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1115']="'printer-stacking-order-supported' DESC 'The possible stacking order of pages as they are printed and ejected from this printer. Legal values include; \"unknown\", \"first-to-last\", \"last-to-first\".' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1115']="'printer-stacking-order-supported' DESC 'The possible stacking order of pages as they are printed and ejected from this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1116']="'printer-output-features-supported' DESC 'The possible output features supported by this printer. Legal values include; \"unknown\", \"bursting\", \"decollating\", \"page-collating\", \"offset-stacking\".' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1116']="'printer-output-features-supported' DESC 'The possible output features supported by this printer.' EQUALITY caseIgnoreMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.4.1108']="'printer-aliases' DESC 'Site-specific administrative names of this printer in addition the printer name specified for printer-name.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127}"
	OD['1.3.18.0.2.4.1108']="'printer-aliases' DESC 'List of site-specific administrative names of this printer in addition to the value specified for printer-name.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX  1.3.6.1.4.1.1466.115.121.1.15{127} X-ORIGIN 'RFC 3712'"

	EE['1.3.6.1.4.1.42.2.27.5.1.63']="'sun-printer-bsdaddr' DESC 'Sets the server, print queue destination name and whether the client generates protocol extensions. \"Solaris\" specifies a Solaris print server extension. The value is represented by the following value: server \",\" destination \", Solaris\".' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.63']="'sun-printer-bsdaddr' DESC 'Sets the server, print queue destination name and whether the client generates protocol extensions. \"Solaris\" specifies a Solaris print server extension. The value is represented by the following value: server \",\" destination \", Solaris\".' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.64']="'sun-printer-kvp' DESC 'This attribute contains a set of key value pairs which may have meaning to the print subsystem or may be user defined. Each value is represented by the following: key \"=\" value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15"
	OD['1.3.6.1.4.1.42.2.27.5.1.64']="'sun-printer-kvp' DESC 'This attribute contains a set of key value pairs which may have meaning to the print subsystem or may be user defined. Each value is represented by the following: key \"=\" value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.57']="'nisplusTimeZone' DESC 'tzone column from NIS+ timezone table' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.57']="'nisplusTimeZone' DESC 'tzone column from NIS+ timezone table' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.67']="'ipTnetTemplateName' DESC 'Trusted Solaris network template template_name' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.67']="'ipTnetTemplateName' DESC 'Trusted Solaris network template template_name' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.1.68']="'ipTnetNumber' DESC 'Trusted Solaris network template ip_address' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE"
	OD['1.3.6.1.4.1.42.2.27.5.1.68']="'ipTnetNumber' DESC 'Trusted Solaris network template ip_address' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Solaris Specific'"

	# write out the defs
	if (( TMPF[SYNTAX] == 1 )); then
		typeset -n MAP=OD
	elif (( TMPF[SYNTAX] == 2 )); then
		typeset -n MAP=EE
	elif (( TMPF[IS_OPENDJ] )); then
		typeset -n MAP=OD
	else
		typeset -n MAP=EE
	fi
	typeset TODO='' OID X
	for OID in ${!MAP[@]}; do
		[[ -n ${OID2ADEF[${OID}]} ]] && continue
		X="${MAP[${OID}]}"
		TODO+='attributetypes: ( '"${OID} NAME ${X}"' )\n'
		OID2ADEF["${OID}"]="${X}"
		X=${X:1}
		X=${X%%"'"*}	# we have no aliases above
		ANAME2OID["${X}"]="${OID}"
	done

	if [[ -z ${TODO} ]]; then
		print "  ${TMPF[STEP]}.  Schema attributes are up-to-date."
	else
		typeset OUT="${TMP[DIR]}/schema_attr"
		print 'dn: cn=schema\nchangetype: modify\nadd: attributetypes\n' \
			"${TODO}" >"${OUT}"
		# Add all.
		if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f "${OUT}" 2>/dev/null
		then
			print -u2 '  ERROR: update of schema attributes failed!'
			return 67
		fi
		print "  ${TMPF[STEP]}. Schema attributes have been updated."
	fi
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc update_schema_obj '' '[+NAME?update_schema_obj -  Update DS schema to support Naming Services.]
[+DESCRIPTION?Update the schema of the DS with the objectclasses required for the Solaris Naming Services.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occurred.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function update_schema_obj {
	getDSobjectclasses || return 66

	typeset -A EE=( )
	typeset -A OD=( )
	EE['1.3.6.1.1.1.2.14']="'NisKeyObject' SUP top MUST "'( cn $ nisPublickey $ nisSecretkey ) MAY ( uidNumber $ description )'
	OD['1.3.6.1.1.1.2.14']="'nisKeyObject' SUP top AUXILIARY DESC 'An object with a public and secret key' MUST "'( cn $ nisPublicKey $ nisSecretKey ) MAY ( uidNumber $ description )'" X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.1.1.2.15']="'nisDomainObject' SUP top MUST nisDomain"
	OD['1.3.6.1.1.1.2.15']="'nisDomainObject' SUP top AUXILIARY DESC 'Associates a NIS domain with a naming context' MUST nisDomain X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.1.1.2.16']="'automountMap' SUP top MUST automountMapName MAY description"
	OD['1.3.6.1.1.1.2.16']="'automountMap' SUP top STRUCTURAL MUST ( automountMapName ) MAY description X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.1.1.2.17']="'automount' SUP top MUST "'( automountKey $ automountInformation ) MAY description'
	OD['1.3.6.1.1.1.2.17']="'automount' SUP top STRUCTURAL DESC 'Automount information' MUST "'( automountKey $ automountInformation )'" MAY description X-ORIGIN 'draft-howard-rfc2307bis'"

	EE['1.3.6.1.4.1.42.2.27.5.2.7']="'SolarisNamingProfile' SUP top MUST "'( cn $ SolarisLDAPservers $ SolarisSearchBaseDN ) MAY ( SolarisBindDN $ SolarisBindPassword $ SolarisAuthMethod $ SolarisTransportSecurity $ SolarisCertificatePath $ SolarisCertificatePassword $ SolarisDataSearchDN $ SolarisSearchScope $ SolarisSearchTimeLimit $ SolarisPreferredServer $ SolarisPreferredServerOnly $ SolarisCacheTTL $ SolarisSearchReferral )'
	OD['1.3.6.1.4.1.42.2.27.5.2.7']="'SolarisNamingProfile' SUP top STRUCTURAL DESC 'Solaris LDAP Naming client profile objectClass' MUST "'( cn $ SolarisLDAPServers $ SolarisSearchBaseDN ) MAY ( SolarisBindDN $ SolarisBindPassword $ SolarisAuthMethod $ SolarisTransportSecurity $ SolarisCertificatePath $ SolarisCertificatePassword $ SolarisDataSearchDN $ SolarisSearchScope $ SolarisSearchTimeLimit $ SolarisPreferredServer $ SolarisPreferredServerOnly $ SolarisCacheTTL $ SolarisSearchReferral $ SolarisBindTimeLimit )'" X-ORIGIN 'Solaris Specific'"

	EE['2.16.840.1.113730.3.2.4']="'mailGroup' SUP top MUST mail MAY "'( cn $ mgrpRFC822MailMember )'
	OD['2.16.840.1.113730.3.2.4']="'mailGroup' SUP top STRUCTURAL MUST mail MAY "'( cn $ mgrpRFC822MailMember )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.1.2.5']="'nisMailAlias' SUP top MUST cn MAY rfc822mailMember"
	OD['1.3.6.1.4.1.42.2.27.1.2.5']="'nisMailAlias' SUP top MUST cn MAY rfc822mailMember X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.1.2.6']="'nisNetId' SUP top MUST cn MAY "'( nisNetIdUser $ nisNetIdGroup $ nisNetIdHost )'
	OD['1.3.6.1.4.1.42.2.27.1.2.6']="'nisNetId' SUP top MUST cn MAY "'( nisNetIdUser $ nisNetIdGroup $ nisNetIdHost )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.2']="'SolarisAuditUser' SUP top AUXILIARY MAY "'( SolarisAuditAlways $ SolarisAuditNever )'
	OD['1.3.6.1.4.1.42.2.27.5.2.2']="'SolarisAuditUser' SUP top AUXILIARY MAY "'( SolarisAuditAlways $ SolarisAuditNever )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.3']="'SolarisUserAttr' SUP top AUXILIARY MAY "'( SolarisUserQualifier $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrKeyValue )'
	OD['1.3.6.1.4.1.42.2.27.5.2.3']="'SolarisUserAttr' SUP top AUXILIARY DESC 'User attributes' MAY "'( SolarisUserQualifier $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.4']="'SolarisAuthAttr' SUP top MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrShortDesc $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'
	OD['1.3.6.1.4.1.42.2.27.5.2.4']="'SolarisAuthAttr' SUP top STRUCTURAL DESC 'Authorizations data' MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrShortDesc $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.5']="'SolarisProfAttr' SUP top MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'
	OD['1.3.6.1.4.1.42.2.27.5.2.5']="'SolarisProfAttr' SUP top STRUCTURAL DESC 'Profiles data' MUST cn MAY "'( SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisAttrLongDesc $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.6']="'SolarisExecAttr' SUP top AUXILIARY MAY "'( SolarisKernelSecurityPolicy $ SolarisProfileType $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisProfileID $ SolarisAttrKeyValue )'
	OD['1.3.6.1.4.1.42.2.27.5.2.6']="'SolarisExecAttr' SUP top AUXILIARY DESC 'Profiles execution attributes' MAY "'( SolarisKernelSecurityPolicy $ SolarisProfileType $ SolarisAttrReserved1 $ SolarisAttrReserved2 $ SolarisProfileId $ SolarisAttrKeyValue )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.1']="'SolarisProject' SUP top MUST "'( SolarisProjectID $ SolarisProjectName ) MAY ( memberUid $ memberGid $ description $ SolarisProjectAttr )'
	OD['1.3.6.1.4.1.42.2.27.5.2.1']="'SolarisProject' SUP top STRUCTURAL MUST "'( SolarisProjectID $ SolarisProjectName ) MAY ( memberUid $ memberGid $ description $ SolarisProjectAttr )'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.11.1.3.1.2.4']="'DUAConfigProfile' SUP top DESC 'Abstraction of a base configuration for a DUA' MUST cn MAY "'( defaultServerList $ preferredServerList $ defaultSearchBase $ defaultSearchScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel $ authenticationMethod $ followReferrals $ serviceSearchDescriptor $ serviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $ attributeMap $ profileTTL )'
	OD['1.3.6.1.4.1.11.1.3.1.2.4']="'DUAConfigProfile' SUP top STRUCTURAL DESC 'Abstraction of a base configuration for a DUA' MUST "'( cn ) MAY ( defaultServerList $ preferredServerList $ defaultSearchBase $ defaultSearchScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel $ authenticationMethod $ followReferrals $ dereferenceAliases $ serviceSearchDescriptor $ serviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $ attributeMap $ profileTTL )'" X-ORIGIN 'RFC 4876'"

	EE['1.3.18.0.2.6.2549']="'slpService' DESC 'DUMMY definition' SUP top MUST objectclass"
	OD['1.3.18.0.2.6.2549']="'slpService' DESC 'parent superclass for SLP services' SUP top ABSTRACT MUST  "'( template-major-version-number $ template-minor-version-number $ description $ template-url-syntax $ service-advert-service-type $ service-advert-scopes ) MAY ( service-advert-url-authenticator $ service-advert-attribute-authenticator )'" X-ORIGIN 'RFC 2926'"

	EE['1.3.18.0.2.6.254']="'slpServicePrinter' DESC 'Service Location Protocol (SLP) information.' SUP slpService AUXILIARY"
	OD['1.3.18.0.2.6.254']="'slpServicePrinter' DESC 'Service Location Protocol (SLP) information.' SUP slpService AUXILIARY X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.6.258']="'printerAbstract' DESC 'Printer related information.' SUP top ABSTRACT MAY "'( printer-name $ printer-natural-language-configured $ printer-location $ printer-info $ printer-more-info $ printer-make-and-model $ printer-multiple-document-jobs-supported $ printer-charset-configured $ printer-charset-supported $ printer-generated-natural-language-supported $ printer-document-format-supported $ printer-color-supported $ printer-compression-supported $ printer-pages-per-minute $ printer-pages-per-minute-color $ printer-finishings-supported $ printer-number-up-supported $ printer-sides-supported $ printer-media-supported $ printer-media-local-supported $ printer-resolution-supported $ printer-print-quality-supported $ printer-job-priority-supported $ printer-copies-supported $ printer-job-k-octets-supported $ printer-current-operator $ printer-service-person $ printer-delivery-orientation-supported $ printer-stacking-order-supported $ printer-output-features-supported )'
	OD['1.3.18.0.2.6.258']="'printerAbstract' DESC 'Printer related information.' SUP top ABSTRACT MAY "'( printer-name $ printer-natural-language-configured $ printer-location $ printer-info $ printer-more-info $ printer-make-and-model $ printer-multiple-document-jobs-supported $ printer-charset-configured $ printer-charset-supported $ printer-generated-natural-language-supported $ printer-document-format-supported $ printer-color-supported $ printer-compression-supported $ printer-pages-per-minute $ printer-pages-per-minute-color $ printer-finishings-supported $ printer-number-up-supported $ printer-sides-supported $ printer-media-supported $ printer-media-local-supported $ printer-resolution-supported $ printer-print-quality-supported $ printer-job-priority-supported $ printer-copies-supported $ printer-job-k-octets-supported $ printer-current-operator $ printer-service-person $ printer-delivery-orientation-supported $ printer-stacking-order-supported $ printer-output-features-supported )'" X-ORIGIN 'RFC 3712' )"

	EE['1.3.18.0.2.6.255']="'printerService' DESC 'Printer information.' SUP printerAbstract STRUCTURAL MAY "'( printer-uri $ printer-xri-supported )'
	OD['1.3.18.0.2.6.255']="'printerService' DESC 'Printer information.' SUP printerAbstract STRUCTURAL MAY "'( printer-uri $ printer-xri-supported )'" X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.6.257']="'printerServiceAuxClass' DESC 'Printer information.' SUP printerAbstract AUXILIARY MAY "'( printer-uri $ printer-xri-supported )'
	OD['1.3.18.0.2.6.257']="'printerServiceAuxClass' DESC 'Printer information.' SUP printerAbstract AUXILIARY MAY "'( printer-uri $ printer-xri-supported )'" X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.6.256']="'printerIPP' DESC 'Internet Printing Protocol (IPP) information.' SUP top AUXILIARY MAY "'( printer-ipp-versions-supported $ printer-multiple-document-jobs-supported )'
	OD['1.3.18.0.2.6.256']="'printerIPP' DESC 'Internet Printing Protocol (IPP) information.' SUP top AUXILIARY MAY "'( printer-ipp-versions-supported $ printer-multiple-document-jobs-supported )'" X-ORIGIN 'RFC 3712'"

	EE['1.3.18.0.2.6.253']="'printerLPR' DESC 'LPR information.' SUP top AUXILIARY MUST printer-name MAY printer-aliases"
	OD['1.3.18.0.2.6.253']="'printerLPR' DESC 'LPR information.' SUP top AUXILIARY MUST ( printer-name ) MAY ( printer-aliases ) X-ORIGIN 'RFC 3712'"

	EE['1.3.6.1.4.1.42.2.27.5.2.14']="'sunPrinter' DESC 'Sun printer information' SUP top AUXILIARY MUST printer-name MAY "'( sun-printer-bsdaddr $ sun-printer-kvp )'
	OD['1.3.6.1.4.1.42.2.27.5.2.14']="'sunPrinter' DESC 'Sun printer information' SUP top AUXILIARY MUST printer-name MAY "'(sun-printer-bsdaddr $ sun-printer-kvp)'" X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.12']="'nisplusTimeZoneData' DESC 'NIS+ timezone table data' SUP top STRUCTURAL MUST cn MAY "'( nisplusTimeZone $ description )'
	OD['1.3.6.1.4.1.42.2.27.5.2.12']="'nisplusTimeZoneData' DESC 'NIS+ timezone table data' SUP top STRUCTURAL MUST cn MAY "'( nisplusTimeZone $ description )'" X-ORIGIN 'Solaris Specific'"

	EE[' 1.3.6.1.4.1.42.2.27.5.2.8']="'ipTnetTemplate' DESC 'Object class for TSOL network templates' SUP top MUST ipTnetTemplateName MAY SolarisAttrKeyValue"
	OD[' 1.3.6.1.4.1.42.2.27.5.2.8']="'ipTnetTemplate' DESC 'Object class for TSOL network templates' SUP top STRUCTURAL MUST ipTnetTemplateName MAY SolarisAttrKeyValue X-ORIGIN 'Solaris Specific'"

	EE['1.3.6.1.4.1.42.2.27.5.2.9']="'ipTnetHost' DESC 'Associates an IP address or wildcard with a TSOL template_name' SUP top AUXILIARY MUST ipTnetNumber"
	OD['1.3.6.1.4.1.42.2.27.5.2.9']="'ipTnetHost' DESC 'Associates an IP address or wildcard with a TSOL template_name' SUP top AUXILIARY MUST ipTnetNumber X-ORIGIN 'Solaris Specific'"

	# write out the defs
	if (( TMPF[SYNTAX] == 1 )); then
		typeset -n MAP=OD
	elif (( TMPF[SYNTAX] == 2 )); then
		typeset -n MAP=EE
	elif (( TMPF[IS_OPENDJ] )); then
		typeset -n MAP=OD
	else
		typeset -n MAP=EE
	fi
	typeset TODO='' OID X
	for OID in ${!MAP[@]}; do
		[[ -n ${OID2ODEF[${OID}]} ]] && continue
		X="${MAP[${OID}]}"
		TODO+='objectclasses: ( '"${OID} NAME ${X}"' )\n'
		OID2ODEF["${OID}"]="${X}"
	done

	if [[ -z ${TODO} ]]; then
		print "  ${TMPF[STEP]}.  Schema objectclasses are up-to-date."
	else
		typeset OUT="${TMP[DIR]}/schema_obj"
		print 'dn: cn=schema\nchangetype: modify\nadd: objectclasses\n' \
			"${TODO}" >"${OUT}"
		# Add all.
		if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f "${OUT}" 2>/dev/null
		then
			print -u2 '  ERROR: update of schema objectclasses failed!'
			return 67
		fi
		print "  ${TMPF[STEP]}. Schema objectclasses have been updated."
	fi

	print "  ${TMPF[STEP]}. Schema objectclass definitions have been added."
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc add_suffix '' '[+NAME?add_suffix - add suffix to DS if needed.]
[+DESCRIPTION?Add a suffix to the DS if needed (\bTMPF[NEED_CREATE_SUFFIX]]\b is set) and optionally create the backend for it (\bTMPF[NEED_CREATE_BACKEND]]\b is set). Suffix entry and backend MUST be prepared by \bprep_create_sfx_entry()\b and \bprep_create_sfx_backend()\b correspondingly to have the following vars set:]{
	[+STR[LDAP_SUFFIX]] ]
	[+STR[DS_DB]] ]
	[+STR[LDAP_SUFFIX_OBJ]] ]
	[+TMP[ATT]] ]
	[+TMP[VAL]] ]
	[+STR[LDAP_SUFFIX_ACI]] ]
}
[+RETURN VALUES]{
	[+0?on success (suffix not needed or created successfully).]
	[+1?otherwise (unable to create suffix).]
}
[+SEE ALSO?\bldapadd\b(1), \bdisplay_msg()\b.]
'
function add_suffix {
	(( TMPF[NEED_CREATE_SUFFIX] )) || return 0

	# TODO: adjust to OpenDJ
	if (( TMPF[NEED_CREATE_BACKEND] )); then
		${LDAPADD} ${CON_ARGS} "${AUTH_ARGS[@]}" 2>/dev/null <<EOF
dn: cn="${STR[LDAP_SUFFIX]}",cn=mapping tree,cn=config
objectclass: top
objectclass: extensibleObject
objectclass: nsMappingTree
cn: ${STR[LDAP_SUFFIX]}
nsslapd-state: backend
nsslapd-backend: ${STR[DS_DB]}

dn: cn=${STR[DS_DB]},cn=ldbm database,cn=plugins,cn=config
objectclass: top
objectclass: extensibleObject
objectclass: nsBackendInstance
cn: ${STR[DS_DB]}
nsslapd-suffix: ${STR[LDAP_SUFFIX]}
EOF
		if (( $? )); then
			display_msg 'create_ldbm_db_error'
			return 1
		fi

		print "  ${TMPF[STEP]}. Database ${STR[DS_DB]} successfully created"
		(( TMPF[STEP]++ ))
	fi

	${LDAPADD} ${CON_ARGS} "${AUTH_ARGS[@]}" 2>/dev/null<<EOF
dn: ${STR[LDAP_SUFFIX]}
objectclass: ${STR[LDAP_SUFFIX_OBJ]}
${TMP[ATT]}: ${TMP[VAL]}
${STR[LDAP_SUFFIX_ACI]}
EOF
	if (( $? )); then
		display_msg 'create_suffix_entry_error'
		return 1
	fi

	print "  ${TMPF[STEP]}. Suffix ${STR[LDAP_SUFFIX]} successfully created"
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc add_base_objects '' '[+NAME?add_base_objects - add possibly missing, necessary base objects.]
[+DESCRIPTION?Determine all RDNs required to form the \bSTR[LDAP_BASEDN]]\b using the suffix \bSTR[LDAP_SUFFIX]]\b (RDN1,RDN2,...,suffix == baseDN) and create the missing entries.]
[+RETURN VALUES]{
	[+0?on success (all entries available or created successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bnormalizeDN()\b, \bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_base_objects {
	# typeset -A STR
	# STR[LDAP_BASEDN]=dc=x,dc=iws,dc=cs,dc=ovgu,dc=de
	# STR[LDAP_SUFFIX]=dc=cs,dc=ovgu,dc=de

	# Convert to lower case for basename.
	typeset LC_DN=','${ normalizeDN "${STR[LDAP_BASEDN]}" l ; }
	typeset LC_SFX=','${ normalizeDN "${STR[LDAP_SUFFIX]}" l ; }

	# first, test that baseDN ends with suffix
	if [[ ${LC_DN: -${#LC_SFX}} != ${LC_SFX} ]]; then
		# should not happen since check_basedn_suffix() succeeded
		print -u2 "Invalid suffix ${LC_SFX}\nfor Base DN ${LC_DN}"
		return 66
	fi
	# Save the stuff before LC_SFX w/o leading ',' -> further called prefix
	LC_DN=${LC_DN:1:${#LC_DN}-${#LC_SFX}-1}

	# Remove redundant spaces around ',' and '=' first from LDAP_BASEDN
	typeset DN=${ normalizeDN ${STR[LDAP_BASEDN]} ; }

	# Now LC_DN and DN differ at most in lower vs. uppercase character and
	# we can get the prefix of the baseDN by just copying corresponding chars
	DN=",${DN:0:${#LC_DN}}"
	
	typeset LAST=${ normalizeDN ${STR[LDAP_SUFFIX]} ; } DC KEY VAL CLASS
	while [[ -n ${DN} ]]; do
	    # Get trailing key=val (DC) from DN and strip it off
		DN=${DN%,*}
		DC="${.sh.match#,}"
		LAST="${DC},${LAST}"

		# Check if entry exists first, if so, skip to next.
	    ${LDAPSEARCH} ${CON_ARGS} -b "${LAST}" -s base \
			'objectclass=*' >/dev/null 2>&1  &&  continue

		VAL=${DC#*=}
		KEY=${.sh.match%=}
		# Determine the objectclass for the entry.
		CLASS=${ get_objectclass ${KEY} ; }
		if [[ -z ${CLASS} ]]; then
			print -u2 "Unable to determine objectClass for '${KEY}'." \
				"\nPlease create the following entry and rerun ${PROG}:" \
				"\n\t${KEY}=${VAL},${LAST}"
			return 66
		fi

		# Add the new container.
	    print '
dn: '"${LAST}"'
'"${KEY}: ${VAL}"'
objectClass: top
objectClass: '"${CLASS}"'
'			> ${TMP[DIR]}/base_objects

	    # Add the entry.
	    if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-f ${TMP[DIR]}/base_objects 2>/dev/null
		then
			print -u2 "  ERROR: update of base objects ${DC} failed."
			return 66
		fi

		# Display message that schema is updated.
		print "  ${TMPF[STEP]}. Created DN component ${DC}."
		(( TMPF[STEP]++ ))
	done
	return 0
}

Man.addFunc set_nisdomain '' '[+NAME?set_nisdomain - Add the NisDomainObject to the Base DN.]
[+DESCRIPTION?Add a NisDomainObject with nisdomain \bSTR[LDAP_DOMAIN]]\b to the \bSTR[LDAP_BASEDN]]\b unless there is already one.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function set_nisdomain {
	# Check if nisDomain is already set.
	${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${STR[LDAP_BASEDN]}" \
		-s base 'objectclass=*' 2>/dev/null | \
	while read LINE ; do
		if [[ ${LINE} == ~(Ei)nisDomain ]]; then
			print "  ${TMPF[STEP]}.  NisDomainObject was already set for" \
				"'${STR[LDAP_BASEDN]}'."
			(( TMPF[STEP]++ ))
			return 0
		fi
	done

	# Add the new class
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
objectclass: nisDomainObject
nisdomain: '"${STR[LDAP_DOMAIN]}"'
'		>${TMP[DIR]}/nis_domain

	# Add the entry.
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/nis_domain 2>/dev/null
	then
		print -u2 '  ERROR: update of NisDomainObject in' \
			"'${STR[LDAP_BASEDN]}' failed."
		return 66
	fi

	# Display message that schema is updated.
	print "  ${TMPF[STEP]}. NisDomainObject added to '${STR[LDAP_BASEDN]}'."
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc add_new_containers '' '[+NAME?add_new_containers - Add top level containers to the base DN.]
[+DESCRIPTION?Add the Name Service Switch top level containers to the \bSTR[LDAP_BASEDN]]\b unless they already exist.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\b/etc/nsswitch.ldap\b, \bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_new_containers {
	typeset OU

	for OU in people group rpc protocols networks netgroup \
		aliases hosts services ethers profile printers projects \
		SolarisAuthAttr SolarisProfAttr Timezone ipTnet
	do
		# Check if nismaps already exist.
		${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b "ou=${OU},${STR[LDAP_BASEDN]}" -s base 'objectclass=*' \
			>/dev/null 2>&1  && continue

		# Create TMP file to add.
		print '
dn: ou='"${OU},${STR[LDAP_BASEDN]}"'
ou: '"${OU}"'
objectClass: top
objectClass: organizationalUnit
'			> ${TMP[DIR]}/toplevel.${OU}

		# Add the entry.
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-f ${TMP[DIR]}/toplevel.${OU} 2>/dev/null
		then
			print -u2 "  ERROR: Add of 'ou=${OU}' container failed!"
			return 66
		fi
	done

	# Display message that top level OU containers complete.
	print "  ${TMPF[STEP]}. Top level 'ou' containers complete."
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc add_auto_maps '' '[+NAME?add_auto_maps - Add the automount map entries.]
[+DESCRIPTION?Add the automount maps \bauto_home\b, \bauto_direct\b, \bauto_master\b, \bauto_shared\b to \bSTR[LDAP_BASEDN]]\b unless they already exist.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_auto_maps {
	# Set AUTO_MAPS for maps to create.
	typeset AUTO_MAPS="auto_home auto_direct auto_master auto_shared" MAP

	for MAP in ${AUTO_MAPS}; do
		# Check if automaps already exist.
		${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-b "automountMapName=${MAP},${STR[LDAP_BASEDN]}" -s base \
			'objectclass=*' >/dev/null 2>&1  && continue

		# Create the tmp file to add.
		print '
dn: automountMapName='"${MAP},${STR[LDAP_BASEDN]}"'
automountMapName: '"${MAP}"'
objectClass: top
objectClass: automountMap
'			> ${TMP[DIR]}/automap.${MAP}
    
		# Add the entry.
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-f ${TMP[DIR]}/automap.${MAP} 2>/dev/null
		then
			print -u2 "  ERROR: Add of automap '${MAP}' failed!"
			return 66
		fi
	done

	# Display message that automount entries are updated.
	print "  ${TMPF[STEP]}. Automount maps ${AUTO_MAPS} processed."
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc modify_top_aci '' '[+NAME?modify_top_aci - add a deny self modify ACI.]
[+DESCRIPTION?Add the ACI \bUSER_ACI_NAME\b to \bSTR[LDAP_BASEDN]]\b to disable self modify of user attributes like uid, uidNumber, gidNumber, shadowExpire, etc.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage USER_ACI_NAME ; }" '}
[+RETURN VALUES]{
	[+0?on success (ACI already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bgetACIs()\b, \bfindACI()\b, \bldapmodify\b(1).]
'
function modify_top_aci {
	typeset ACI PATTERN

	typeset -a LIST=( )
	getACIs LIST || return 66

    # check, whether ACI already exists
	PATTERN='acl[ ]+"?('"${USER_ACI_NAME}|${USER_ACI_NAME// /_}"')"?'
	findACI LIST "${USER_ACI_NAME}" "${PATTERN}" || return 0	# exists

	# Create LDIF for top level ACI
	print '
dn: '"${STR[LDAP_BASEDN]}"'
changetype: modify
add: aci
aci: (targetattr = "cn||uid||uidNumber||gidNumber||homeDirectory||shadowLastChange||shadowMin||shadowMax||shadowWarning||shadowInactive||shadowExpire||shadowFlag||memberUid||SolarisAttrKeyValue||SolarisAttrReserved1||SolarisAttrReserved2||SolarisUserQualifier") (version 3.0;  acl "'"${USER_ACI_NAME}"'";  deny (write) userdn = "ldap:///self";)
'		> ${TMP[DIR]}/top_aci

	# Add the entry.
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[DIR]}/top_aci \
		2>/dev/null
	then
		print -u2 '  ERROR: Deny user to change non-password fields failed!'
		return 66
	fi

	# Display message that ACI is updated.
	if (( INT[EXISTING_PROFILE] )); then
		ACI='ACI SET:'
	else
		ACI="${STEP}."
		(( TMPF[STEP]++ ))
	fi
	print "  ${ACI} User self modify disabled."
	return 0
}

Man.addFunc add_vlv_aci '' '[+NAME?add_vlv_aci - Add ACI for VLV.]
[+DESCRIPTION?Add the global ACI to allow everyone read-only access to VLVs.]
[+RETURN VALUES]{
	[+0?on success (ACI added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function add_vlv_aci {
	# TODO: check for OpenDJ compat
	print '
dn: oid=2.16.840.1.113730.3.4.9,cn=features,cn=config
changetype: modify
replace: aci
aci: (targetattr != "aci") (version 3.0;  acl "VLV Request Control";  allow (read,search,compare) userdn = "ldap:///anyone";)
'		> ${TMP[DIR]}/vlv_aci

	# Add the entry.
	if ! ${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" -f ${TMP[DIR]}/vlv_aci \
		2>/dev/null
	then
		print -u2 '  ERROR: Add of VLV ACI failed!'
		return 66
	fi

	# Display message that schema is updated.
	print "  ${TMPF[STEP]}. Add of VLV Access Control Information (ACI)."
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc add_proxyagent '' '[+NAME?add_proxyagent - Add proxy agent user to DS.]
[+DESCRIPTION?Add the proxy agent user \bSTR[LDAP_PROXYAGENT]]\b to the DS unless it already exists to allow nameservice access to the server.]
[+RETURN VALUES]{
	[+0?on success (entry already exists or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\bldapmodify\b(1).]
'
function add_proxyagent {
	# Check if proxy agent already exists.
	if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-b "${STR[LDAP_PROXYAGENT]}" -s base 'objectclass=*' >/dev/null 2>&1
	then
		print "  ${TMPF[STEP]}. Proxy Agent '${STR[LDAP_PROXYAGENT]}'" \
			'already exists.'
		(( TMPF[STEP]++ ))
		return 0
	fi

	# Get cn and sn names from LDAP_PROXYAGENT.
	typeset NAME="${STR[LDAP_PROXYAGENT]%%,*}"
	NAME=${NAME#*=}

    # Create the tmp file to add.
	print '
dn: '"${STR[LDAP_PROXYAGENT]}"'
cn: '"${NAME}"'
sn: '"${NAME}"'
objectclass: top
objectclass: person
userpassword: '"${STR[LDAP_PROXYAGENT_CRED]}"'
'		> ${TMP[DIR]}/proxyagent
    
	# Add the entry.
	if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/proxyagent 2>/dev/null
	then
		print -u2 '  ERROR: Adding proxyagent failed!'
		return 66
	fi

	# Display message that schema is updated.
	print "  ${TMPF[STEP]}. Proxy Agent '${STR[LDAP_PROXYAGENT]}' added."
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc add_entry_by_DN '' '[+NAME?add_entry_by_DN - Add an ldif file by DN.]
[+DESCRIPTION?Add the entries in the given LDIF \afile\a to the DS unless a base entry for \aDN\a already exists.]
[+RETURN VALUES]{
	[+0?on success (\aDN\a already exists or added successfully).]
	[+1?on error (failed to add entries).]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapadd\b(1).]
\n\n\aDN\a \afile\a
'
function add_entry_by_DN {
	if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "$1" -s base \
		'objectclass=*' >/dev/null 2>&1
	then
		print "  '${1}' already exists."
		return 0
    fi
	if ${LDAPADD} ${CON_ARGS} "${AUTH_ARGS[@]}" -f "$2" 2>/dev/null ; then
		print "  '${1}' added."
		return 0
	fi
	print -u2 "  ERROR: failed to add '${1}'."
	return 1
}

Man.addFunc add_id_mapping_rules '' '[+NAME?add_id_mapping_rules - Add Kerberos principal to DN mapping rules to the DS.]
[+DESCRIPTION?Add GSSAPI identity mapping rules for host credentails and user credentials to the DS config unless they already exists. Hosts are matched against \b*.STR[LDAP_DOMAIN]]@STR[LDAP_KRB_REALM]]\b and ou=hosts in \bSTR[LDAP_BASEDN]]\b, users against \b*.@STR[LDAP_KRB_REALM]]\b and uid=$1,ou=People in \bSTR[LDAP_BASEDN]]\b.]
[+SEE ALSO?\badd_entry_by_DN()\b.]
'
function add_id_mapping_rules {
	print '  Adding Kerberos principal to DN mapping rules...'
	# TODO: check C_DN wrt. OpenDJ
	typeset C_DN='cn=GSSAPI,cn=identity mapping,cn=config'

	print '
dn: cn='"${C_DN}"'
objectClass: top
objectClass: nsContainer
cn: GSSAPI
'		> ${TMP[DIR]}/GSSAPI_container.ldif

	add_entry_by_DN "${C_DN}" "${TMP[DIR]}/GSSAPI_container.ldif" || return

	typeset H_CN="host_auth_${STR[LDAP_KRB_REALM]}"
	typeset H_DN="cn=${H_CN}, ${C_DN}"
	print '
dn: '"${H_DN}"'
objectClass: top
objectClass: nsContainer
objectClass: dsIdentityMapping
objectClass: dsPatternMatching
cn: '"${H_CN}"'
dsMatching-pattern: ${Principal}
dsMatching-regexp: host\/(.*).'"${STR[LDAP_DOMAIN]}@${STR[LDAP_KRB_REALM]}"'
dsSearchBaseDN: ou=hosts,'"${STR[LDAP_BASEDN]}"'
dsSearchFilter: (&(objectClass=ipHost)(cn=$1))
dsSearchScope: one
'		>${TMP[DIR]}/${H_CN}.ldif

	add_entry_by_DN "${H_DN}" "${TMP[DIR]}/${H_CN}.ldif"

	typeset U_CN="user_auth_${STR[LDAP_KRB_REALM]}"
	typeset U_DN="cn=${U_CN}, ${C_DN}"
	print '
dn: '"${U_DN}"'
objectClass: top
objectClass: nsContainer
objectClass: dsIdentityMapping
objectClass: dsPatternMatching
cn: '"${U_CN}"'
dsMatching-pattern: ${Principal}
dsMatching-regexp: (.*)@'"${STR[LDAP_KRB_REALM]}"'
dsMappedDN: uid=$1,ou=People,'"${STR[LDAP_BASEDN]}"'
'		> ${TMP[DIR]}/${U_CN}.ldif

	add_entry_by_DN "${U_DN}" "${TMP[DIR]}/${U_CN}.ldif"
}

Man.addFunc modify_userpassword_acl_for_gssapi '' '[+NAME?modify_userpassword_acl_for_gssapi - Allow hosts and user to read password(s).]
[+DESCRIPTION?Modify ACL to allow hosts to read all and a user to read its own password only, when sasl/GSSAPI bind is used.]
[+RETURN VALUES]{
	[+0?on success (entries already exist or added successfully).]
	[+>= 66?a fatal error occured.]
}
[+SEE ALSO?\badd_entry_by_DN()\b.]
'
function modify_userpassword_acl_for_gssapi {
	typeset P_DN="ou=People,${STR[LDAP_BASEDN]}"
	typeset H_DN="ou=Hosts,${STR[LDAP_BASEDN]}"
	typeset P_ACI="self-read-pwd"

	if ! ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${P_DN}" -s base \
		'objectclass=*' > /dev/null 2>&1
	then
		print "  '${P_DN}' does not exist"
		# Not Found. Create a new entry
		print '
dn: '"${P_DN}"'
ou: People
objectClass: top
objectClass: organizationalUnit
'			> ${TMP[DIR]}/gssapi_people.ldif

		add_entry_by_DN "${P_DN}" "${TMP[DIR]}/gssapi_people.ldif"
	else 
		print "  '${P_DN}' already exists"
	fi

	typeset -a LIST=( )
	getACIs LIST "${P_DN}" || return 66

	findACI LIST "userpassword ${P_ACI}" "${P_ACI}" || return 0
	print "  userpassword ACL ${P_ACI} not found. Create a new one."

	print '
dn: '"${P_DN}"'
changetype: modify
add: aci
aci: (targetattr = "userPassword") (version 3.0;  acl self-read-pwd;  allow (read,search) userdn="ldap:///self" and authmethod="sasl GSSAPI";)
- 
add: aci
aci: (targetattr = "userPassword") (version 3.0;  acl host-read-pwd;  allow (read,search) userdn="ldap:///cn=*+ipHostNumber=*,ou=Hosts,'"${STR[LDAP_BASEDN]}"'" and authmethod="sasl GSSAPI";)
'		> ${TMP[DIR]}/user_gssapi.ldif

	${LDAPMODIFY} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/user_gssapi.ldif >/dev/null 2>&1
	integer RES=$?

	if (( RES == 0 )); then
		print "  ${P_DN} userpassword ACL is updated."
	elif (( RES == 20 )); then
		print "  ${P_DN} userpassword ACL already exists."
	else
		print "  ERROR: update of userpassword ACL for ${P_DN} failed!"
		return 66
    fi
	return 0
}

Man.addFunc add_profile '' '[+NAME?add_profile - Add client profile to server.]
[+DESCRIPTION?Generates a client profile and adds it to the DS as "\bcn=STR[LDAP_PROFILE_NAME]],ou=profile,STR[LDAP_BASEDN]]\b" unless it already exists and \bTMPF[DEL_OLD_PROFILE]]\b is not set. Other profile related variables are:]{
	[+?STR[LDAP_SERVER_LIST]] ]
	[+?STR[LDAP_SEARCH_SCOPE]] ]
	[+?STR[LDAP_CRED_LEVEL]] ]
	[+?STR[LDAP_AUTHMETHOD]] ]
	[+?INT[LDAP_FOLLOWREF]] ]
	[+?INT[LDAP_SEARCH_TIME_LIMIT]] ]
	[+?INT[LDAP_PROFILE_TTL]] ]
	[+?INT[LDAP_BIND_LIMIT]] ]
	[+?STR[LDAP_PREF_SRVLIST]] ]
	[+?STR[LDAP_SRV_AUTHMETHOD_PAM]] ]
	[+?STR[LDAP_SRV_AUTHMETHOD_KEY]] ]
	[+?STR[LDAP_SRV_AUTHMETHOD_CMD]] ]
	[+?SSD]
}
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage INT STR SSD ; }" '}
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?fatal error.]
}
[+SEE ALSO?\bldapclient\b(1M), \bldapdelete\b(1), \bldapmodify\b(1).]
'
function add_profile {
	typeset X

	# If profile name already exists, DELETE it, and add new one.
	if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-b "cn=${STR[LDAP_PROFILE_NAME]},ou=profile,${STR[LDAP_BASEDN]}" \
		-s base 'objectclass=*' 2>/dev/null
	then
		# Create Delete file.
		print "cn=${STR[LDAP_PROFILE_NAME]},ou=profile,${STR[LDAP_BASEDN]}" \
			>${TMP[DIR]}/del_profile

		if (( ! TMPF[DEL_OLD_PROFILE] )); then
			print -u2 "ERROR: Profile name ${STR[LDAP_PROFILE_NAME]} exists!" \
				'Add failed!'
			return 66
		fi

		# Delete the OLD profile.
		if ! ${LDAPDELETE} ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-f ${TMP[DIR]}/del_profile 2>/dev/null
		then
			print -u2 '  ERROR: Attempt to DELETE profile failed!'
			return 67
		fi
	fi

	# Build the "ldapclient genprofile" command string to execute.
	typeset -a ARG=( )
	ARG+=( genprofile -a "profileName=${STR[LDAP_PROFILE_NAME]}" )

	# Add required argument defaultSearchBase.
	ARG+=( -a "defaultSearchBase=${STR[LDAP_BASEDN]}" )

	# Add optional parameters.
	[[ -n ${STR[LDAP_SERVER_LIST]} ]] && \
		ARG+=( -a "defaultServerList=${STR[LDAP_SERVER_LIST]}" )
	[[ -n ${STR[LDAP_SEARCH_SCOPE]} ]] && \
		ARG+=( -a "defaultSearchScope=${STR[LDAP_SEARCH_SCOPE]}" )
	[[ -n ${STR[LDAP_CRED_LEVEL]} ]] && \
		ARG+=( -a "credentialLevel=${STR[LDAP_CRED_LEVEL]}" )
	[[ -n ${STR[LDAP_AUTHMETHOD]} ]] && \
		ARG+=( -a "authenticationMethod=${STR[LDAP_AUTHMETHOD]}" )
    (( ${INT[LDAP_FOLLOWREF]} )) && X='TRUE"' || X='FALSE"'
	ARG+=( -a "followReferrals=${X}" )
	(( ${INT[LDAP_SEARCH_TIME_LIMIT]} )) && \
		ARG+=( -a "searchTimeLimit=${INT[LDAP_SEARCH_TIME_LIMIT]}" )
	(( ${INT[LDAP_PROFILE_TTL]} )) && \
		ARG+=( -a "profileTTL=${INT[LDAP_PROFILE_TTL]}" )
	[[ -n ${INT[LDAP_BIND_LIMIT]} ]] && \
		ARG+=( -a "bindTimeLimit=${INT[LDAP_BIND_LIMIT]}" )
	[[ -n ${STR[LDAP_PREF_SRVLIST]} ]] && \
		ARG+=( -a "preferredServerList=${STR[LDAP_PREF_SRVLIST]}" )
	[[ -n ${STR[LDAP_SRV_AUTHMETHOD_PAM]} ]] && \
		ARG+=(-a "serviceAuthenticationMethod=${STR[LDAP_SRV_AUTHMETHOD_PAM]}")
	[[ -n ${STR[LDAP_SRV_AUTHMETHOD_KEY]} ]] && \
		ARG+=(-a "serviceAuthenticationMethod=${STR[LDAP_SRV_AUTHMETHOD_KEY]}")
	[[ -n ${STR[LDAP_SRV_AUTHMETHOD_CMD]} ]] && \
		ARG+=(-a "serviceAuthenticationMethod=${STR[LDAP_SRV_AUTHMETHOD_CMD]}")

	# Add SSDs
	while X in "${SSD[@]}" ; do
		ARG+=( -a "serviceSearchDescriptor=${X}" )
	done

    # Execute "ldapclient genprofile" to create profile.
	if ! ${LDAPCLIENT} "${ARG[@]}" >${TMP[DIR]}/gen_profile \
		2>${TMP[DIR]}/gen_profile_ERR
	then
		print -u2 '  ERROR: ldapclient genprofile failed!'
		return 68
	fi

	# Add the generated profile..
	if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" \
		-f ${TMP[DIR]}/gen_profile 2>/dev/null
	then
		print '  ERROR: Attempt to add profile failed!'
		return 69
	fi

	# Display message that schema is updated.
	print "  ${TMPF[STEP]}. Generated client profile and loaded on server."
	(( TMPF[STEP]++ ))
	return 0
}

Man.addFunc add_indexes '' '[+NAME?add_indexes - Add indexes.]
[+DESCRIPTION?Add indexes of the given \atypes\a (e.g. "pres eq") for the given \aattributes\a (e.g. "uidNumber gidnumber") and schedule corresponding tasks to actually create the indexes unless they already exist. Both arguments are handle as a whitespace separated list.]
[+RETURN VALUES]{
	[+-1?syntax error (insufficient parameters).]
	[+0?on success.]
	[+>= 66?fatal error.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
\n\n\atypes\a \aattributes\a
'
function add_eq_indexes {
	if [[ -z ${STR[DS_DB]} ]]; then
		get_backend || return 66
	fi
	[[ -z $1 || -z $2 ]] && print -u2 "${.sh.fun}(): syntax error" && return -1

	typeset -l TYPES=${1//,/ }		# we allow comma separated lists as well
	typeset IDX=${2//,/ }

    # Display message to id current step.
    print "  ${TMPF[STEP]}. Processing '${TYPES// /,}' indexes:"
	(( TMPF[STEP]++ ))

	typeset DN="cn=index,cn=${STR[DS_DB]},cn=ldbm database,cn=plugins,cn=config"
	typeset LTYPE="nsIndexType: ${TYPES// /'\n'nsIndexType: }"
	typeset DST TASKNAME STATUS LINE
	integer SEEN


	for DST in ${IDX} ; do
		(( VERBOSE )) && print "  Adding index for '${DST}'"
		# Check if entry exists first, if so, skip to next.
		if ${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" -b "cn=${DST},${DN}" \
			-s base 'objectclass=*' > /dev/null 2>&1
		then
			print "      '${DST}' (${TYPES// /,}) skipped already exists"	
			continue
		fi

		print '
dn: cn='"${DST},${DN}"'
objectClass: top
objectClass: nsIndex
cn: '"${DST}"'
nsSystemIndex: false
'"${LTYPE}"'
'			> ${TMP[DIR]}/index_${DST}

		# Add the index.
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-f ${TMP[DIR]}/index_${DST} 2>/dev/null
		then
			print "  ERROR: Adding ${TYPES// /,} index for '${DST}' failed!"
			return 67
		fi

		# Build the task entry to add.
		TASKNAME=${DST}_${ date "+%y_%m_%d_%H_%M_%S" ; }
		print '
dn: cn='"${TASKNAME}"', cn=index, cn=tasks, cn=config
changetype: add
objectclass: top
objectclass: extensibleObject
cn: '"${TASKNAME}"'
nsInstance: '"${STR[DS_DB]}"'
nsIndexAttribute: '"${DST}"'
'			> ${TMP[DIR]}/task_${DST}

		# Add the task.
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-f ${TMP[DIR]}/task_${DST} 2>/dev/null
		then
			print -u2 "  ERROR: Adding task for '${DST}' failed!"
			return 66
		fi

		# Wait for task to finish, display current status.
		while : ; do
			SEEN=0 STATUS=''
			${LDAPSEARCH} ${CON_ARGS} "${AUTH_ARGS[@]}" \
				-b "cn=${TASKNAME}, cn=index, cn=tasks, cn=config" -s base \
				'objectclass=*' nstaskstatus 2>&1 | \
			while read LINE ; do
				[[ ${LINE} =~ ${TASKNAME} ]] && SEEN=1
				if [[ -z ${STATUS} && ${LINE} == ~(Ei)nstaskstatus ]]; then
					STATUS=${LINE#*:}
					STATUS=${STATUS%%:*}
				fi 
			done
			(( ! SEEN )) && break
			print -n "      ${DST} (eq,pres)  ${STATUS}                  \r"
			[[ ${STATUS} =~ Finished ]] && break
			sleep 2
		done
		print
	done
	return 0
}

Man.addFunc add_eq_indexes '' '[+NAME?add_eq_indexes - Add indexes of type pres and eq.]
[+DESCRIPTION?Add eq,pres indexes and schedule corresponding tasks to actually create the indexes unless they already exist.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?fatal error.]
}
[+SEE ALSO?\badd_indexes()\b.]
'
function add_eq_indexes {
	add_indexes "pres eq" \
		"uidNumber ipNetworkNumber gidnumber oncrpcnumber automountKey"
}

Man.addFunc add_sub_indexes '' '[+NAME?add_sub_indexes - Add indexes of type pres, eq and sub.]
[+DESCRIPTION?Add eq,pres,sub indexes and schedule corresponding tasks to actually create the indexes unless they already exist.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?fatal error.]
}
[+SEE ALSO?\badd_indexes()\b.]
'
function add_sub_indexes {
	add_indexes "pres eq sub" \
		"ipHostNumber membernisnetgroup nisnetgrouptriple"
}

Man.addFunc add_vlv_indexes_OpenDJ '' '[+NAME?add_vlv_indexes_OpenDJ - Add VLV indexes to OpenDS/OpenDJ.]
[+DESCRIPTION?OpenDS/OpenDJ specialized part of \badd_vlv_indexes()\b (pulled out for easier maintenance).]
[+SEE ALSO?\badd_vlv_indexes()\b, https://blogs.oracle.com/kanthi/entry/ldap_paged_results_more]
[+NOTES?\bpagedResultsControl\b and \bVLV\b is per default allowed for authenticated users, only. To check, try something like this:]{
	[+?ldapsearch -r -j /tmp/pw -D "cn=Directory Manager" -h ldaphost \]
	[+?	-b "cn=Access Control Handler,cn=config" "objectclass=*" | \]
	[+?	egrep "1.2.840.113556.1.4.319|2.16.840.1.113730.3.4.9"]
}
\n\n\avname\a \afile\a
'
function add_vlv_indexes_OpenDJ {
	typeset -n INDEX_TABLE=$1
	typeset OUT="$2" ENTRY IDX_NAME CN SCOPE='single-level' BASE FILTER

	[[ ${STR[LDAP_SEARCH_SCOPE]} == sub ]] && SCOPE='subordinate-subtree'
	BACKEND="cn=VLV Index,ds-cfg-backend-id=${STR[DS_DB]},cn=Backends,cn=config"

	# check, whether VLV Index container exists - if not, create it
	if ! ${LDAPSEARCH} -a ${CON_ARGS} "${AUTH_ARGS[@]}" -b "${BACKEND}" \
		-s base 'objectclass=*' > /dev/null 2>&1
	then
		print '
dn: '"${BACKEND}"'
objectClass: top
objectClass: ds-cfg-branch
cn: VLV Index
'			>${TMP[DIR]}/vlv_index
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" \	
			-f ${TMP[DIR]}/vlv_index 2>/dev/null
		then
			print -u2 '  ERROR: Adding VLV Index base.'
			return 66
		fi
	fi

    # create index entries
    for ENTRY in "${INDEX_TABLE[@]}" ; do
		typeset -a F=( ${ENTRY} )					# split columns
		
		IDX_NAME="${STR[LDAP_DOMAIN]}.get${F[0]}"
		BASE="ou=${F[2]},${STR[LDAP_BASEDN]}"
		[[ ${F[2]} =~ = ]] && BASE="${BASE:3}"		# cut out ou=
		FILTER="objectClass=${F[3]}"
		[[ ${F[3]:0:1} == '&' ]] && FILTER="&(objectClass=${F[3]:2}"

		if ${LDAPSEARCH} ${CON_ARGS} -b "ds-cfg-name=${IDX_NAME},${BACKEND}" \
			-s base 'objectclass=*' > /dev/null 2>&1
		then
			print "  '${IDX_NAME}' VLV index skipped (already exists)."
			continue
		fi

		print -n "  Configuring VLV index for '${IDX_NAME}' ..."
		# dsconfig create-local-db-vlv-index --backend-name "${STR[DS_DB]}" \
		#	--index-name "${IDX_NAME}" --set "sort-order:cn uid" \
		#	--set "scope:${SCOPE}" --set "base-dn:${BASE}" \
		#	--set "filter:${FILTER}"
		print '
dn: ds-cfg-name='"${IDX_NAME},${BACKEND}"'
objectClass: top
objectClass: ds-cfg-local-db-vlv-index
ds-cfg-name: '"${IDX_NAME}"'
ds-cfg-base-dn: '"${BASE}"'
ds-cfg-scope: '"${SCOPE}"'
ds-cfg-filter: '"${FILTER}"'
ds-cfg-sort-order: cn uid
'		> ${TMP[DIR]}/vlv_index_${IDX_NAME}

		# Add the index.
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-f ${TMP[DIR]}/vlv_index_${IDX_NAME} 2>/dev/null
		then
			print
			print -u2 "  ERROR: Adding VLV index for '${IDX_NAME}' failed!"
			return 67
		fi
		print " Done."

		print "rebuild-index -b '${STR[LDAP_BASEDN]}' " \
			"--index 'vlv.${IDX_NAME}'" >>${OUT}
	done
}

Man.addFunc add_vlv_indexes_DSEE '' '[+NAME?add_vlv_indexes_DSEE - Add VLV indexes to DSEE.]
[+DESCRIPTION?DSEE specialized part of \badd_vlv_indexes()\b (pulled out for easier maintenance).]
[+SEE ALSO?\b\badd_vlv_indexes()\b.]
\n\n\avname\a \afile\a
'
function add_vlv_indexes_DSEE {
	typeset -n INDEX_TABLE=$1
	typeset OUT="$2" ENTRY IDX_NAME CN SCOPE=1 BASE FILTER

	typeset INFO=( ${DS_INFO[@]} )
	if (( INFO[1] < 6 )); then
		# DSEE 5.x
		typeset INSTANCE="<server-instance>" LINE
		${LDAPSEARCH} -v ${CON_ARGS} "${AUTH_ARGS[@]}" -b 'cn=config' \
			-s base 'objectclass=*' nsslapd-instancedir 2>/dev/null | \
		while read LINE ; do
			if [[ ${LINE:0:20} == 'nsslapd-instancedir=' ]]; then
				LINE=${LINE#*=}
				[[ ${LINE} =~ slapd- ]] && \
					{ LINE=${LINE#*/} ; INSTANCE=${LINE#*-} ; break ; }
			fi
		done
	fi
	[[ ${STR[LDAP_SEARCH_SCOPE]} == sub ]] && SCOPE=2
	BACKEND="cn=${STR[DS_DB]},cn=ldbm database,cn=plugins,cn=config"

    # create index entries
    for ENTRY in "${INDEX_TABLE[@]}" ; do
		typeset -a F=( ${ENTRY} )					# split columns
		
		IDX_NAME="${STR[LDAP_DOMAIN]}.get${F[0]}"
		CN="${STR[LDAP_DOMAIN]}_${F[1]}_vlv_index"
		BASE="ou=${F[2]},${STR[LDAP_BASEDN]}"
		[[ ${F[2]} =~ = ]] && BASE="${BASE:3}"		# cut out ou=
		FILTER="objectClass=${F[3]}"
		[[ ${F[3]:0:1} == '&' ]] && FILTER="&(objectClass=${F[3]:2}"

		if ${LDAPSEARCH} ${CON_ARGS} -b "cn=${IDX_NAME},cn=${CN},${BACKEND}" \
			-s base 'objectclass=*' > /dev/null 2>&1
		then
			print "  '${IDX_NAME}' VLV index skipped (already exists)."
			continue
		fi

		print -n "  Configuring VLV index for '${IDX_NAME}' ..."
		print '
dn: '"cn=${CN},${BACKEND}"'
objectClass: top
objectClass: vlvSearch
cn: '"${CN}"'
vlvbase: '"${BASE}"'
vlvscope: '${SCOPE}'
vlvfilter: ('"${FILTER}"')
aci: (target = "ldap:///'"cn=${CN},${BACKEND}"'") (targetattr = "*") (version 3.0;  acl "Config";  allow (read,search,compare) userdn="ldap:///anyone";)

dn: cn='"${IDX_NAME},cn=${CN},${BACKEND}"'
cn: '"${IDX_NAME}"'
vlvSort: cn uid
objectclass: top
objectclass: vlvIndex
'		> ${TMP[DIR]}/vlv_index_${IDX_NAME}

		# Add the index.
		if ! ${LDAPMODIFY} -a ${CON_ARGS} "${AUTH_ARGS[@]}" \
			-f ${TMP[DIR]}/vlv_index_${IDX_NAME} 2>/dev/null
		then
			print
			print -u2 "  ERROR: Adding VLV index for '${IDX_NAME}' failed!"
			return 66
		fi
		print " Done."

		if (( INFO[1] < 6 )); then
			# DSEE 5.x
			print "directoryserver -s '${INSTANCE}' vlvindex" \
				"-n '${STR[DS_DB]}' -T '${IDX_NAME}'" >> ${OUT}
		else
			# assume DSEE 6+
			print "<install-path>/bin/dsadm reindex -l -t '${IDX_NAME}'" \
				"<directory-instance-path> '${STR[LDAP_SUFFIX]}'" >> ${OUT}
		fi
	done
}

Man.addFunc add_vlv_indexes '' '[+NAME?add_vlv_indexes - Add VLV indexes.]
[+DESCRIPTION?Create VLV indexes entries on the \bSTR[DS_DB]]\b for \bSTR[LDAP_DOMAIN]]\b with \bSTR[LDAP_SEARCH_SCOPE]]\b and create the script \bTMP[DIR]]/do_vlv_index\b to be started on the DS to actually re-index the DB.]
[+RETURN VALUES]{
	[+0?on success.]
	[+>= 66?fatal error.]
}
[+SEE ALSO?\bldapsearch\b(1), \bldapmodify\b(1).]
'
function add_vlv_indexes {
    print "  ${TMPF[STEP]}. Processing VLV indexes:"
	(( TMPF[STEP]++ ))

	# ${LDAP_DOMAIN}.get ${LDAP_DOMAIN}_%s_vlv_index ou=%s objectClass=$1||&(%s)
	typeset -a INDEXES=( 
		'grent		group		group			posixGroup'
		'hostent	hosts		hosts			ipHost'
		'netent		networks	networks		ipNetwork'
		'pwent		passwd		people			posixAccount'
		'rpcent		rpc			rpc				oncRpc'
		'spent		shadow		people			shadowAccount'
		# Indexes added during NIS to LDAP transition
		'auhoent	auho		automountMapName=auto_home	automount'
		'soluent	solu		people			SolarisUserAttr'
		'authent	auth		SolarisAuthAttr	SolarisAuthAttr'
		'execent	exec		SolarisProfAttr	&(SolarisExecAttr)(SolarisKernelSecurityPolicy=*)'
		'profent	prof		SolarisProfAttr	&(SolarisProfAttr)(SolarisAttrLongDesc=*)'
		'mailent	mail		aliases			mailGroup'
		'bootent	_boot		ethers			&(bootableDevice)(bootParameter=*)'
		'ethent		ethers		ethers			&(ieee802Device)(macAddress=*)'
		'ngrpent	netgroup	netgroup		nisNetgroup'
		'ipnent		ipn			networks		&(ipNetwork)(cn=*)'
		'maskent	mask		networks		&(ipNetwork)(ipNetmaskNumber=*)'
		'prent		pr			printers		printerService'
		'ip4ent		ip4			hosts			&(ipHost)(ipHostNumber=*.*)'
		'ip6ent		ip6			hosts			&(ipHost)(ipHostNumber=*:*)'
	)

    # Reset temp file for vlvindex commands.
	typeset OUT=${TMP[DIR]}/do_vlv_index
	rm -f ${OUT} && touch ${OUT}

	if (( TMPF[IS_OPENDJ] )); then
		add_vlv_indexes_OpenDJ INDEXES ${OUT}
	else
		add_vlv_indexes_DSEE INDEXES ${OUT}
	fi
}

Man.addFunc display_vlv_cmds '' '[+NAME?display_vlv_cmds - Display VLV index commands to run on server.]
[+DESCRIPTION?Display VLV index commands to run on server and save the file to /var/tmp/doIndexVLV-\bSTR[DS_HOST]].sh\b.]
'
function display_vlv_cmds {
	typeset OUT=${TMP[DIR]}/do_vlv_index
	typeset SAV="/var/tmp/doIndexVLV-${STR[DS_HOST]}.sh"

	[[ -s ${OUT} ]] || return
	[[ -e ${SAV} ]] && SAV="${SAV%.sh}-$$.sh"
	cp -p ${OUT} "${SAV}"

	if (( TMPF[IS_OPENDJ] )); then
		print '\nNote: idsconfig configured the entries for VLV indexes.\n
      To create the actual VLV indexes, you need to stop the DS on
      '"${STR[DS_HOST]}"' , e.g. using "svcadm disable -t opendj25"
      or if manually started "ds-stop" and than run the commands shown in
      the file: '"${SAV}"'\n
      Last but not least restart the DS e.g. using "svcadm enable opendj25
      or "ds-start".\n'
	else
		print 'Note: idsconfig has created entries for VLV indexes.\n'
		typeset INFO=( ${DS_INFO[@]} )
		if (( INFO[1] >= 6 )); then
			print '
      Use the dsadm command delivered with the DS on '"${STR[DS_HOST]}"'
      to stop the server.  Then, using dsadm, follow the
      dsadm examples shown in  ${SAV}
      to create the actual VLV indexes.\n'
		else
			print '
      Use the directoryserver(1m) script on '"${STR[DS_HOST]}"'
      to stop the server.  Then, using directoryserver, follow the
      directoryserver examples shown in  ${SAV}
      to create the actual VLV indexes.\n'
		fi
    fi
}

Man.addFunc doMain '' '[+NAME?doMain - the main entry point.]
[+DESCRIPTION?The entry point, where the real work starts.]
'
function doMain {
	# Initialize the variables that need to be set to NULL, or some 
	# other initial value before the rest of the functions can be called.
	init || return 1
	show_vars

	# Print extra line to separate from prompt.
	print

	# Either Load the user specified config file 
	# or prompt user for config info.
	if [[ -n ${TMP[IN]} ]]; then 
		load_config_file "${TMP[IN]}"
		validate_info || return 1	# Validate basic info in file.
		chk_ids_version || return 1	# Check DSEE version for compatibility.
	else
		# Display BACKUP warning to user.
		display_msg 'backup_server'
		get_confirm 'Do you wish to continue with server setup (y/n/h)?' \
			'n' 'backup_help' && return 1

		# Prompt for values.
		prompt_config_info || return 1
		(( INT[LDAP_ENABLE_SHADOW_UPDATE] )) && return 0
		display_summary || return 1	# Allow user to modify results.
	fi
	exit

	# Modify slapd.oc.conf to ALLOW cn instead of REQUIRE.
	modify_cn || return 1

	# Modify timelimit to user value.
	if (( INT[NEED_TIME] )); then
		modify_timelimit || return 1
	fi

	# Modify sizelimit to user value.
	if (( INT[NEED_SIZE] )); then
		modify_sizelimit || return 1
	fi

	# Modify the password storage scheme to support CRYPT.
	if (( INT[NEED_CRYPT] )); then
		modify_pwd_crypt || return 1
	fi

	# Update the schema (Attributes, Objectclass Definitions)
	update_schema_attr || return 1
	update_schema_obj || return 1

	# Add suffix together with its root entry (if needed)
	add_suffix || return 1

	# Add base objects (if needed)
	add_base_objects || return 1

	# Update the NisDomainObject.  
	#   The Base DN might of just been created, so this MUST happen after
	#   the base objects have been added!
	set_nisdomain || return 1

	# Add top level classes (new containers)
	add_new_containers || return 1

	# Add common nismaps.
	add_auto_maps || return 1

	# Modify top ACI.
	modify_top_aci || return 1

	# Add Access Control Information for VLV.
	add_vlv_aci || return 1

	# if Proxy needed, Add Proxy Agent and give read permission for password.
	if (( ${INT[NEED_PROXY]} )); then
		add_proxyagent || return 1
		if (( ! INT[LDAP_ENABLE_SHADOW_UPDATE] )); then
			allow_proxy_read_pw || return 1
		fi
	fi

	# If admin needed for shadow update, Add the administrator identity and
	# give read/write permission for shadow, and deny all others read/write
	# access to it.
	if (( INT[NEED_ADMIN] )); then
		add_admin || return 1
		allow_admin_read_write_shadow || return 1
		# deny non-admin access to shadow data
		deny_non_admin_shadow_access || return 1
	fi

	if (( INT[GSSAPI_ENABLE] )); then
		add_id_mapping_rules
		# do not modify ACI if "sasl/GSSAPI" and "self" are not selected
		if [[ ${STR[LDAP_CRED_LEVEL]} == self && \
			${STR[LDAP_AUTHMETHOD]} == sasl/GSSAPI ]]
		then
			modify_userpassword_acl_for_gssapi || return 1
		else
			print -u2 '  ACL for GSSAPI was not set because of' \
				'incompatibility in profile.'
		fi
	fi

	# If use host principal for shadow update, give read/write permission for
	# shadow, and deny all others' read/write access to it.
	if (( INT[NEED_HOSTACL] )); then
		allow_host_read_write_shadow || return 66
		# deny non-host access to shadow data
		deny_non_host_shadow_access || return 67
	fi


	# Generate client profile and add it to the server.
	add_profile || return 1

	# Add Indexes to improve Search Performance.
	add_eq_indexes || return 1
	add_sub_indexes || return 1
	add_vlv_indexes || return 1

	# Display setup complete message
	display_msg setup_complete

	# Display VLV index commands to be executed on server.
	display_vlv_cmds

	# Create config file if requested.
	[[ -n ${TMP[OUT]} ]] && create_config_file "${TMP[OUT]}"
	return 0
}

Man.addFunc cleanup '' '[+NAME?cleanup - cleanup tempfiles, tty and exit.]
[+DESCRIPTION?Removes \a$TMP[DIR]\a unless \a$DEBUG\a is set and restores the echo for the tty.]
[+ENVIRONMENT VARIABLES]{' "${ Man.varUsage DEBUG TMP ; }" '}
'
function cleanup {
	if (( ${DEBUG} )); then
		print -u2 "Leaving temp dir ${TMP[DIR]} as is. Remove it manually."
	elif [[ -d ${TMP[DIR]} ]]; then
		rm -rf ${TMP[DIR]}
	fi
	${STTY:-/usr/bin/stty} echo
	# Might be trapped in the scope of a function which will stop executing
	# the function itself but not the script. So:
	[[ -z $1 ]] && kill $$
}

showCommand() {
	typeset CMD="${.sh.command}"
	[[ -z ${CMD} ]] && return
	print -n -u2 '\E[0;30;47m'
	print -u2 -r -n "DEBUG: ${.sh.fun} '${CMD}'"
	print '\E[0m'
}

Man.addFunc MAIN '' '[+NAME?'"${PROG}"' - setup the infrastructure of a directory server to provide data and security required by the Solaris (or similar OS) LDAP Naming Services.]
[+DESCRIPTION?This script assumes that the Sun/Oracle Directory Server Enterprise Edition (DSEE), or Sun OpenDS or Forgerock OpenDJ is installed and that its setup has been run.  This script takes the directory server from that point and sets up the infrastructure for LDAP Naming Services.  After running this script, \bldapaddent\b(1M) or some other tools can be used to populate data.]
[h:help?Print this help and exit.]
[F:functions?Print out a list of names of all currently defined script functions and exit (see \btypeset +f\b).]
[H:usage]:[function?Show the usage info for the function with the given name if available and exit. (see also option \b-F\b).]
[T:trace]:[fname_list?A comma or whitespace separated list of function names, which should be traced when running this script. If the list consist of the single word "ALL" or "*" all known functions get traced. "MAIN" is the special word to enable the trace of the main script. Gets activated as soon as this option gets processed, so option order might be important.]
[i:in]:[file?Get setup info from the given file.]
[o:out]:[file?Generate a server configuration output file.]
[I:importpwp?If specified, the storage scheme for Password Policy Import will be changed as well (as for Default Password Policy), if needed. This option gets ignored for non-OpenDS/OpenDJ directory servers.]
[s:djSyntax?If given, the OpenDJ schema defintions will be used to complement the servers schema if needed, no matter which kind of server has been detected.]
[S:eeSyntax?If given, the Sun DSEE schema defintions will be used to complement the servers schema if needed, no matter which kind of server has been detected. 
Wrt. Solaris it should not make a difference, whether OpenDJ or DSEE syntax is used. OpenDJ syntax is usually a little bit more precise.]
[v:verbose?Verbose mode - makes the script more chatty.]
[d:debug?Enable debug info.]
[+NOTES?This script should work for the following DS:]{
	[+?Sun DS 5.x]
	[+?Sun DSEE 6.x/7.x]
	[+?Oracle ODSEE 11g]
	[+?Sun OpenDS 2.x]
	[+?Forgerock OpenDJ 2.x]
}
'
while getopts "${ print ${Man.FUNC[MAIN]}; }" option ; do
	case "${option}" in
		'?'|h)	showUsage ${PROG} MAIN ; exit 0 ;;
		F) typeset +f ; exit 0 ;;
		T)	if [[ ${OPTARG} == '*' || ${OPTARG} == 'ALL' ]]; then
				typeset -ft ${ typeset +f ; }
			elif [[ ${OPTARG} == 'MAIN' ]]; then
				set -x
			else
				typeset -ft ${OPTARG//,/ }
			fi
			;;
		H)  if [[ ${OPTARG%_t} != $OPTARG ]]; then
				$OPTARG --man   # self-defined types
			else
				showUsage "$OPTARG" "$OPTARG"   # functions
			fi
			exit 0
			;;
		d)	DEBUG=1;;
		v)	VERBOSE=1 ;;
		i)	TMP[IN]="${OPTARG}" ;;
		o)	TMP[OUT]="${OPTARG}" ;;
		I)	INT[NEED_CRYPT_IMPORT]=1 ;;
		s)	TMPF[SYNTAX]=1 ; print DJ ;;
		S)	TMPF[SYNTAX]=2 ; print DSEE ;;
	    *)	print -u2 '**Internal ERROR: Supported option missing handler!'
			exit 1
			;;
	esac
done
X=$(( OPTIND - 1 ))
shift $X
(( $DEBUG )) &&	Man.listVars

# Create TMP[DIR]
TMP[DIR]=${ mktemp -d /tmp/${PROG}.XXXXX ; }
if [[ -z ${TMP[DIR]} ]]; then
	print -u2 'ERROR: unable to create a safe temporary directory.'
	exit 1
fi
trap cleanup EXIT 1 2 3 6 15		# and register to cleanup on exit/sig.
if (( ${DEBUG} )); then
	trap 'typeset _CMD_="${.sh.command}"
	print -u2 -n "\E[0;30;47m"
	print -u2 -n -r "${.sh.fun:-MAIN}(): ${_CMD_}"
	print -u2 "\E[0m"
	' DEBUG
fi

# Prevent new files from being read by group or others.
umask 077

doMain
X=$?

cleanup NOKILL

exit ${X}

# vim:ts=4 filetype=sh