Index: /trunk/puppet/modules/puppet-openldap/.git/HEAD
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/HEAD	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/HEAD	(revision 444)
@@ -0,0 +1,1 @@
+ref: refs/heads/master
Index: /trunk/puppet/modules/puppet-openldap/.git/config
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/config	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/config	(revision 444)
@@ -0,0 +1,11 @@
+[core]
+	repositoryformatversion = 0
+	filemode = true
+	bare = false
+	logallrefupdates = true
+[remote "origin"]
+	url = git://github.com/camptocamp/puppet-openldap.git
+	fetch = +refs/heads/*:refs/remotes/origin/*
+[branch "master"]
+	remote = origin
+	merge = refs/heads/master
Index: /trunk/puppet/modules/puppet-openldap/.git/description
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/description	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/description	(revision 444)
@@ -0,0 +1,1 @@
+Unnamed repository; edit this file to name it for gitweb.
Index: /trunk/puppet/modules/puppet-openldap/.git/hooks/applypatch-msg
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/hooks/applypatch-msg	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/hooks/applypatch-msg	(revision 444)
@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# An example hook script to check the commit log message taken by
+# applypatch from an e-mail message.
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.  The hook is
+# allowed to edit the commit message file.
+#
+# To enable this hook, make this file executable.
+
+. git-sh-setup
+test -x "$GIT_DIR/hooks/commit-msg" &&
+	exec "$GIT_DIR/hooks/commit-msg" ${1+"$@"}
+:
Index: /trunk/puppet/modules/puppet-openldap/.git/hooks/commit-msg
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/hooks/commit-msg	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/hooks/commit-msg	(revision 444)
@@ -0,0 +1,24 @@
+#!/bin/sh
+#
+# An example hook script to check the commit log message.
+# Called by git-commit with one argument, the name of the file
+# that has the commit message.  The hook should exit with non-zero
+# status after issuing an appropriate message if it wants to stop the
+# commit.  The hook is allowed to edit the commit message file.
+#
+# To enable this hook, make this file executable.
+
+# Uncomment the below to add a Signed-off-by line to the message.
+# Doing this in a hook is a bad idea in general, but the prepare-commit-msg
+# hook is more suited to it.
+#
+# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p')
+# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1"
+
+# This example catches duplicate Signed-off-by lines.
+
+test "" = "$(grep '^Signed-off-by: ' "$1" |
+	 sort | uniq -c | sed -e '/^[ 	]*1[ 	]/d')" || {
+	echo >&2 Duplicate Signed-off-by lines.
+	exit 1
+}
Index: /trunk/puppet/modules/puppet-openldap/.git/hooks/post-commit
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/hooks/post-commit	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/hooks/post-commit	(revision 444)
@@ -0,0 +1,8 @@
+#!/bin/sh
+#
+# An example hook script that is called after a successful
+# commit is made.
+#
+# To enable this hook, make this file executable.
+
+: Nothing
Index: /trunk/puppet/modules/puppet-openldap/.git/hooks/post-receive
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/hooks/post-receive	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/hooks/post-receive	(revision 444)
@@ -0,0 +1,16 @@
+#!/bin/sh
+#
+# An example hook script for the post-receive event
+#
+# This script is run after receive-pack has accepted a pack and the
+# repository has been updated.  It is passed arguments in through stdin
+# in the form
+#  <oldrev> <newrev> <refname>
+# For example:
+#  aa453216d1b3e49e7f6f98441fa56946ddcd6a20 68f7abf4e6f922807889f52bc043ecd31b79f814 refs/heads/master
+#
+# see contrib/hooks/ for an sample, or uncomment the next line (on debian)
+#
+
+
+#. /usr/share/doc/git-core/contrib/hooks/post-receive-email
Index: /trunk/puppet/modules/puppet-openldap/.git/hooks/post-update
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/hooks/post-update	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/hooks/post-update	(revision 444)
@@ -0,0 +1,8 @@
+#!/bin/sh
+#
+# An example hook script to prepare a packed repository for use over
+# dumb transports.
+#
+# To enable this hook, make this file executable by "chmod +x post-update".
+
+exec git-update-server-info
Index: /trunk/puppet/modules/puppet-openldap/.git/hooks/pre-applypatch
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/hooks/pre-applypatch	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/hooks/pre-applypatch	(revision 444)
@@ -0,0 +1,14 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed
+# by applypatch from an e-mail message.
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.
+#
+# To enable this hook, make this file executable.
+
+. git-sh-setup
+test -x "$GIT_DIR/hooks/pre-commit" &&
+	exec "$GIT_DIR/hooks/pre-commit" ${1+"$@"}
+:
Index: /trunk/puppet/modules/puppet-openldap/.git/hooks/pre-commit
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/hooks/pre-commit	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/hooks/pre-commit	(revision 444)
@@ -0,0 +1,70 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed.
+# Called by git-commit with no arguments.  The hook should
+# exit with non-zero status after issuing an appropriate message if
+# it wants to stop the commit.
+#
+# To enable this hook, make this file executable.
+
+# This is slightly modified from Andrew Morton's Perfect Patch.
+# Lines you introduce should not have trailing whitespace.
+# Also check for an indentation that has SP before a TAB.
+
+if git-rev-parse --verify HEAD 2>/dev/null
+then
+	git-diff-index -p -M --cached HEAD --
+else
+	# NEEDSWORK: we should produce a diff with an empty tree here
+	# if we want to do the same verification for the initial import.
+	:
+fi |
+perl -e '
+    my $found_bad = 0;
+    my $filename;
+    my $reported_filename = "";
+    my $lineno;
+    sub bad_line {
+	my ($why, $line) = @_;
+	if (!$found_bad) {
+	    print STDERR "*\n";
+	    print STDERR "* You have some suspicious patch lines:\n";
+	    print STDERR "*\n";
+	    $found_bad = 1;
+	}
+	if ($reported_filename ne $filename) {
+	    print STDERR "* In $filename\n";
+	    $reported_filename = $filename;
+	}
+	print STDERR "* $why (line $lineno)\n";
+	print STDERR "$filename:$lineno:$line\n";
+    }
+    while (<>) {
+	if (m|^diff --git a/(.*) b/\1$|) {
+	    $filename = $1;
+	    next;
+	}
+	if (/^@@ -\S+ \+(\d+)/) {
+	    $lineno = $1 - 1;
+	    next;
+	}
+	if (/^ /) {
+	    $lineno++;
+	    next;
+	}
+	if (s/^\+//) {
+	    $lineno++;
+	    chomp;
+	    if (/\s$/) {
+		bad_line("trailing whitespace", $_);
+	    }
+	    if (/^\s* \t/) {
+		bad_line("indent SP followed by a TAB", $_);
+	    }
+	    if (/^([<>])\1{6} |^={7}$/) {
+		bad_line("unresolved merge conflict", $_);
+	    }
+	}
+    }
+    exit($found_bad);
+'
Index: /trunk/puppet/modules/puppet-openldap/.git/hooks/pre-rebase
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/hooks/pre-rebase	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/hooks/pre-rebase	(revision 444)
@@ -0,0 +1,150 @@
+#!/bin/sh
+#
+# Copyright (c) 2006 Junio C Hamano
+#
+
+publish=next
+basebranch="$1"
+if test "$#" = 2
+then
+	topic="refs/heads/$2"
+else
+	topic=`git symbolic-ref HEAD`
+fi
+
+case "$basebranch,$topic" in
+master,refs/heads/??/*)
+	;;
+*)
+	exit 0 ;# we do not interrupt others.
+	;;
+esac
+
+# Now we are dealing with a topic branch being rebased
+# on top of master.  Is it OK to rebase it?
+
+# Is topic fully merged to master?
+not_in_master=`git-rev-list --pretty=oneline ^master "$topic"`
+if test -z "$not_in_master"
+then
+	echo >&2 "$topic is fully merged to master; better remove it."
+	exit 1 ;# we could allow it, but there is no point.
+fi
+
+# Is topic ever merged to next?  If so you should not be rebasing it.
+only_next_1=`git-rev-list ^master "^$topic" ${publish} | sort`
+only_next_2=`git-rev-list ^master           ${publish} | sort`
+if test "$only_next_1" = "$only_next_2"
+then
+	not_in_topic=`git-rev-list "^$topic" master`
+	if test -z "$not_in_topic"
+	then
+		echo >&2 "$topic is already up-to-date with master"
+		exit 1 ;# we could allow it, but there is no point.
+	else
+		exit 0
+	fi
+else
+	not_in_next=`git-rev-list --pretty=oneline ^${publish} "$topic"`
+	perl -e '
+		my $topic = $ARGV[0];
+		my $msg = "* $topic has commits already merged to public branch:\n";
+		my (%not_in_next) = map {
+			/^([0-9a-f]+) /;
+			($1 => 1);
+		} split(/\n/, $ARGV[1]);
+		for my $elem (map {
+				/^([0-9a-f]+) (.*)$/;
+				[$1 => $2];
+			} split(/\n/, $ARGV[2])) {
+			if (!exists $not_in_next{$elem->[0]}) {
+				if ($msg) {
+					print STDERR $msg;
+					undef $msg;
+				}
+				print STDERR " $elem->[1]\n";
+			}
+		}
+	' "$topic" "$not_in_next" "$not_in_master"
+	exit 1
+fi
+
+exit 0
+
+################################################################
+
+This sample hook safeguards topic branches that have been
+published from being rewound.
+
+The workflow assumed here is:
+
+ * Once a topic branch forks from "master", "master" is never
+   merged into it again (either directly or indirectly).
+
+ * Once a topic branch is fully cooked and merged into "master",
+   it is deleted.  If you need to build on top of it to correct
+   earlier mistakes, a new topic branch is created by forking at
+   the tip of the "master".  This is not strictly necessary, but
+   it makes it easier to keep your history simple.
+
+ * Whenever you need to test or publish your changes to topic
+   branches, merge them into "next" branch.
+
+The script, being an example, hardcodes the publish branch name
+to be "next", but it is trivial to make it configurable via
+$GIT_DIR/config mechanism.
+
+With this workflow, you would want to know:
+
+(1) ... if a topic branch has ever been merged to "next".  Young
+    topic branches can have stupid mistakes you would rather
+    clean up before publishing, and things that have not been
+    merged into other branches can be easily rebased without
+    affecting other people.  But once it is published, you would
+    not want to rewind it.
+
+(2) ... if a topic branch has been fully merged to "master".
+    Then you can delete it.  More importantly, you should not
+    build on top of it -- other people may already want to
+    change things related to the topic as patches against your
+    "master", so if you need further changes, it is better to
+    fork the topic (perhaps with the same name) afresh from the
+    tip of "master".
+
+Let's look at this example:
+
+		   o---o---o---o---o---o---o---o---o---o "next"
+		  /       /           /           /
+		 /   a---a---b A     /           /
+		/   /               /           /
+	       /   /   c---c---c---c B         /
+	      /   /   /             \         /
+	     /   /   /   b---b C     \       /
+	    /   /   /   /             \     /
+    ---o---o---o---o---o---o---o---o---o---o---o "master"
+
+
+A, B and C are topic branches.
+
+ * A has one fix since it was merged up to "next".
+
+ * B has finished.  It has been fully merged up to "master" and "next",
+   and is ready to be deleted.
+
+ * C has not merged to "next" at all.
+
+We would want to allow C to be rebased, refuse A, and encourage
+B to be deleted.
+
+To compute (1):
+
+	git-rev-list ^master ^topic next
+	git-rev-list ^master        next
+
+	if these match, topic has not merged in next at all.
+
+To compute (2):
+
+	git-rev-list master..topic
+
+	if this is empty, it is fully merged to "master".
Index: /trunk/puppet/modules/puppet-openldap/.git/hooks/prepare-commit-msg
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/hooks/prepare-commit-msg	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/hooks/prepare-commit-msg	(revision 444)
@@ -0,0 +1,36 @@
+#!/bin/sh
+#
+# An example hook script to prepare the commit log message.
+# Called by git-commit with the name of the file that has the
+# commit message, followed by the description of the commit
+# message's source.  The hook's purpose is to edit the commit
+# message file.  If the hook fails with a non-zero status,
+# the commit is aborted.
+#
+# To enable this hook, make this file executable.
+
+# This hook includes three examples.  The first comments out the
+# "Conflicts:" part of a merge commit.
+#
+# The second includes the output of "git diff --name-status -r"
+# into the message, just before the "git status" output.  It is
+# commented because it doesn't cope with --amend or with squashed
+# commits.
+#
+# The third example adds a Signed-off-by line to the message, that can
+# still be edited.  This is rarely a good idea.
+
+case "$2,$3" in
+  merge,)
+    perl -i -ne 's/^/# /, s/^# #/#/ if /^Conflicts/ .. /#/; print' "$1" ;;
+
+# ,|template,)
+#   perl -i -pe '
+#      print "\n" . `git diff --cached --name-status -r`
+#	 if /^#/ && $first++ == 0' "$1" ;;
+
+  *) ;;
+esac
+
+# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p')
+# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1"
Index: /trunk/puppet/modules/puppet-openldap/.git/hooks/update
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/hooks/update	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/hooks/update	(revision 444)
@@ -0,0 +1,107 @@
+#!/bin/sh
+#
+# An example hook script to blocks unannotated tags from entering.
+# Called by git-receive-pack with arguments: refname sha1-old sha1-new
+#
+# To enable this hook, make this file executable by "chmod +x update".
+#
+# Config
+# ------
+# hooks.allowunannotated
+#   This boolean sets whether unannotated tags will be allowed into the
+#   repository.  By default they won't be.
+# hooks.allowdeletetag
+#   This boolean sets whether deleting tags will be allowed in the
+#   repository.  By default they won't be.
+# hooks.allowdeletebranch
+#   This boolean sets whether deleting branches will be allowed in the
+#   repository.  By default they won't be.
+#
+
+# --- Command line
+refname="$1"
+oldrev="$2"
+newrev="$3"
+
+# --- Safety check
+if [ -z "$GIT_DIR" ]; then
+	echo "Don't run this script from the command line." >&2
+	echo " (if you want, you could supply GIT_DIR then run" >&2
+	echo "  $0 <ref> <oldrev> <newrev>)" >&2
+	exit 1
+fi
+
+if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then
+	echo "Usage: $0 <ref> <oldrev> <newrev>" >&2
+	exit 1
+fi
+
+# --- Config
+allowunannotated=$(git config --bool hooks.allowunannotated)
+allowdeletebranch=$(git config --bool hooks.allowdeletebranch)
+allowdeletetag=$(git config --bool hooks.allowdeletetag)
+
+# check for no description
+projectdesc=$(sed -e '1q' "$GIT_DIR/description")
+if [ -z "$projectdesc" -o "$projectdesc" = "Unnamed repository; edit this file to name it for gitweb." ]; then
+	echo "*** Project description file hasn't been set" >&2
+	exit 1
+fi
+
+# --- Check types
+# if $newrev is 0000...0000, it's a commit to delete a ref.
+if [ "$newrev" = "0000000000000000000000000000000000000000" ]; then
+	newrev_type=delete
+else
+	newrev_type=$(git-cat-file -t $newrev)
+fi
+
+case "$refname","$newrev_type" in
+	refs/tags/*,commit)
+		# un-annotated tag
+		short_refname=${refname##refs/tags/}
+		if [ "$allowunannotated" != "true" ]; then
+			echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2
+			echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2
+			exit 1
+		fi
+		;;
+	refs/tags/*,delete)
+		# delete tag
+		if [ "$allowdeletetag" != "true" ]; then
+			echo "*** Deleting a tag is not allowed in this repository" >&2
+			exit 1
+		fi
+		;;
+	refs/tags/*,tag)
+		# annotated tag
+		;;
+	refs/heads/*,commit)
+		# branch
+		;;
+	refs/heads/*,delete)
+		# delete branch
+		if [ "$allowdeletebranch" != "true" ]; then
+			echo "*** Deleting a branch is not allowed in this repository" >&2
+			exit 1
+		fi
+		;;
+	refs/remotes/*,commit)
+		# tracking branch
+		;;
+	refs/remotes/*,delete)
+		# delete tracking branch
+		if [ "$allowdeletebranch" != "true" ]; then
+			echo "*** Deleting a tracking branch is not allowed in this repository" >&2
+			exit 1
+		fi
+		;;
+	*)
+		# Anything else (is there anything else?)
+		echo "*** Update hook: unknown type of update to ref $refname of type $newrev_type" >&2
+		exit 1
+		;;
+esac
+
+# --- Finished
+exit 0
Index: /trunk/puppet/modules/puppet-openldap/.git/info/exclude
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/info/exclude	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/info/exclude	(revision 444)
@@ -0,0 +1,6 @@
+# git-ls-files --others --exclude-from=.git/info/exclude
+# Lines that start with '#' are comments.
+# For a project mostly in C, the following would be a good set of
+# exclude patterns (uncomment them if you want to use them):
+# *.[oa]
+# *~
Index: /trunk/puppet/modules/puppet-openldap/.git/logs/HEAD
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/logs/HEAD	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/logs/HEAD	(revision 444)
@@ -0,0 +1,1 @@
+0000000000000000000000000000000000000000 e61efc07ab557cc3858be1ebe2209b23155f7e6a root <root@chavez.sedenacional.cta.org.ar> 1257699810 +0000	clone: from git://github.com/camptocamp/puppet-openldap.git
Index: /trunk/puppet/modules/puppet-openldap/.git/logs/refs/heads/master
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/logs/refs/heads/master	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/logs/refs/heads/master	(revision 444)
@@ -0,0 +1,1 @@
+0000000000000000000000000000000000000000 e61efc07ab557cc3858be1ebe2209b23155f7e6a root <root@chavez.sedenacional.cta.org.ar> 1257699810 +0000	clone: from git://github.com/camptocamp/puppet-openldap.git
Index: /trunk/puppet/modules/puppet-openldap/.git/logs/refs/remotes/origin/HEAD
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/logs/refs/remotes/origin/HEAD	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/logs/refs/remotes/origin/HEAD	(revision 444)
@@ -0,0 +1,1 @@
+0000000000000000000000000000000000000000 e61efc07ab557cc3858be1ebe2209b23155f7e6a root <root@chavez.sedenacional.cta.org.ar> 1257699810 +0000	clone: from git://github.com/camptocamp/puppet-openldap.git
Index: /trunk/puppet/modules/puppet-openldap/.git/logs/refs/remotes/origin/master
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/logs/refs/remotes/origin/master	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/logs/refs/remotes/origin/master	(revision 444)
@@ -0,0 +1,1 @@
+0000000000000000000000000000000000000000 e61efc07ab557cc3858be1ebe2209b23155f7e6a root <root@chavez.sedenacional.cta.org.ar> 1257699810 +0000	clone: from git://github.com/camptocamp/puppet-openldap.git
Index: /trunk/puppet/modules/puppet-openldap/.git/refs/heads/master
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/refs/heads/master	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/refs/heads/master	(revision 444)
@@ -0,0 +1,1 @@
+e61efc07ab557cc3858be1ebe2209b23155f7e6a
Index: /trunk/puppet/modules/puppet-openldap/.git/refs/remotes/origin/HEAD
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/refs/remotes/origin/HEAD	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/refs/remotes/origin/HEAD	(revision 444)
@@ -0,0 +1,1 @@
+ref: refs/remotes/origin/master
Index: /trunk/puppet/modules/puppet-openldap/.git/refs/remotes/origin/master
===================================================================
--- /trunk/puppet/modules/puppet-openldap/.git/refs/remotes/origin/master	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/.git/refs/remotes/origin/master	(revision 444)
@@ -0,0 +1,1 @@
+e61efc07ab557cc3858be1ebe2209b23155f7e6a
Index: /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/authldap.schema
===================================================================
--- /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/authldap.schema	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/authldap.schema	(revision 444)
@@ -0,0 +1,70 @@
+#$Id: authldap.schema,v 1.5 2004/04/18 15:54:38 mrsam Exp $
+#
+# OID prefix: 1.3.6.1.4.1.10018
+#
+# Attributes: 1.3.6.1.4.1.10018.1.1
+#
+# Depends on: nis.schema, which depends on cosine.schema
+
+attributetype ( 1.3.6.1.4.1.10018.1.1.1 NAME 'mailbox'
+	DESC 'The absolute path to the mailbox for a mail account in a non-default location'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.10018.1.1.2 NAME 'quota'
+	DESC 'A string that represents the quota on a mailbox'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.10018.1.1.3 NAME 'clearPassword'
+	DESC 'A separate text that stores the mail account password in clear text'
+        EQUALITY octetStringMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128})
+
+attributetype ( 1.3.6.1.4.1.10018.1.1.4 NAME 'maildrop'
+        DESC 'RFC822 Mailbox - mail alias'
+        EQUALITY caseIgnoreIA5Match
+        SUBSTR caseIgnoreIA5SubstringsMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+
+attributetype ( 1.3.6.1.4.1.10018.1.1.5 NAME 'mailsource'
+        DESC 'Message source'
+        EQUALITY caseIgnoreIA5Match
+        SUBSTR caseIgnoreIA5SubstringsMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+
+attributetype ( 1.3.6.1.4.1.10018.1.1.6 NAME 'virtualdomain'
+        DESC 'A mail domain that is mapped to a single mail account'
+        EQUALITY caseIgnoreIA5Match
+        SUBSTR caseIgnoreIA5SubstringsMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+
+attributetype ( 1.3.6.1.4.1.10018.1.1.7 NAME 'virtualdomainuser'
+        DESC 'Mailbox that receives mail for a mail domain'
+        EQUALITY caseIgnoreIA5Match
+        SUBSTR caseIgnoreIA5SubstringsMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+
+attributetype ( 1.3.6.1.4.1.10018.1.1.8 NAME 'defaultdelivery'
+        DESC 'Default mail delivery instructions'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+
+#
+# Objects: 1.3.6.1.4.1.10018.1.2
+#
+
+objectclass ( 1.3.6.1.4.1.10018.1.2.1 NAME 'CourierMailAccount' SUP top AUXILIARY
+	DESC 'Mail account object as used by the Courier mail server'
+	MUST ( mail $ homeDirectory $ uidNumber $ gidNumber )
+        MAY ( mailbox $ uid $ cn $ gecos $ description $ loginShell $ quota $ userPassword $ clearPassword $ defaultdelivery) )
+
+objectclass ( 1.3.6.1.4.1.10018.1.2.2 NAME 'CourierMailAlias' SUP top AUXILIARY
+	DESC 'Mail aliasing/forwarding entry'
+	MUST ( mail $ maildrop )
+        MAY ( mailsource $ description ) )
+
+objectclass ( 1.3.6.1.4.1.10018.1.2.3 NAME 'CourierDomainAlias' SUP top AUXILIARY
+	DESC 'Domain mail aliasing/forwarding entry'
+	MUST ( virtualdomain $ virtualdomainuser )
+        MAY ( mailsource $ description ) )
Index: /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/phpgwaccount.schema
===================================================================
--- /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/phpgwaccount.schema	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/phpgwaccount.schema	(revision 444)
@@ -0,0 +1,79 @@
+# $Id egroupware : phpgwaccount.schema,v 1.0 2000/07/29 01:53:16 milosch Exp $
+
+# (C) 2001-2004 Miles Lott <milos@groupwhere.org>
+# Redistribution and use in original text and binary forms, with or
+# without modification, are permitted provided that the following
+# conditions are met:
+#
+# 1. Redistributions of this schema and/or documentation must retain
+#    the above copyright notice, this list of conditions and the
+#    following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright notice,
+#    this list of conditions and the following disclaimer in the documentation
+#    and/or other materials provided with the distribution.
+# 3. The name of the author may not be used to endorse or promote products
+#    derived from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+# IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+# lastlogin
+attributetype ( 1.3.6.1.4.1.9554.1
+	NAME 'phpgwAccountLastLogin'
+	DESC 'timestamp of last login'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+	SINGLE-VALUE )
+
+# lastloginfrom
+attributetype ( 1.3.6.1.4.1.9554.2
+	NAME 'phpgwAccountLastLoginFrom'
+	DESC 'IP address as a dotted decimal, eg. 192.168.1.1, omitting leading zeros'
+	EQUALITY caseIgnoreIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} )
+
+# lastpasswdchange
+attributetype ( 1.3.6.1.4.1.9554.3
+	NAME 'phpgwLastPasswdChange'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+	SINGLE-VALUE )
+
+# accounttype
+attributetype ( 1.3.6.1.4.1.9554.4
+	NAME 'phpgwAccountType'
+	DESC 'Single-char u/g for user/group'
+	EQUALITY caseExactIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+	SINGLE-VALUE )
+
+# status
+attributetype ( 1.3.6.1.4.1.9554.5
+	NAME 'phpgwAccountStatus'
+	DESC 'Single-char A/L for active/inactive'
+	EQUALITY caseExactIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+	SINGLE-VALUE )
+
+# expires
+attributetype ( 1.3.6.1.4.1.9554.6
+	NAME 'phpgwAccountExpires'
+	DESC 'timestamp for account expiration'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+	SINGLE-VALUE )
+
+# Objectclass definition for phpgwAccount
+objectclass ( 1.3.6.1.4.1.9554.0 NAME 'phpgwAccount' SUP top AUXILIARY
+	DESC 'Abstraction of an account with phpgw attributes'
+	MAY ( phpgwAccountLastLogin $ phpgwAccountLastLoginFrom $ phpgwLastPasswdChange $ phpgwAccountType $ phpgwAccountStatus $ phpgwAccountExpires) )
+
Index: /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/phpgwcontact.schema
===================================================================
--- /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/phpgwcontact.schema	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/phpgwcontact.schema	(revision 444)
@@ -0,0 +1,222 @@
+# $Id egroupware : phpgwcontact.schema,v 1.0 2000/07/29 01:53:16 milosch Exp $
+
+# (C) 2001-2004 Miles Lott <milos@groupwhere.org>
+# Redistribution and use in original text and binary forms, with or
+# without modification, are permitted provided that the following
+# conditions are met:
+#
+# 1. Redistributions of this schema and/or documentation must retain
+#    the above copyright notice, this list of conditions and the
+#    following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright notice,
+#    this list of conditions and the following disclaimer in the documentation
+#    and/or other materials provided with the distribution.
+# 3. The name of the author may not be used to endorse or promote products
+#    derived from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+# IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+# REQUIRED
+attributetype ( 1.3.6.1.4.1.9554.100
+	NAME 'phpgwContactTypeId'
+	EQUALITY caseIgnoreMatch
+	SUBSTR caseIgnoreSubstringsMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{16}
+	SINGLE-VALUE )
+
+# REQUIRED
+attributetype ( 1.3.6.1.4.1.9554.101
+	NAME 'phpgwContactCatId'
+	EQUALITY caseIgnoreMatch
+	SUBSTR caseIgnoreSubstringsMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{16})
+
+# REQUIRED
+attributetype ( 1.3.6.1.4.1.9554.102
+	NAME 'phpgwContactAccess'
+	EQUALITY caseIgnoreMatch
+	SUBSTR caseIgnoreSubstringsMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024}
+	SINGLE-VALUE )
+
+# REQUIRED
+attributetype ( 1.3.6.1.4.1.9554.103
+	NAME 'phpgwContactOwner'
+	EQUALITY numericStringMatch
+	SUBSTR numericStringSubstringsMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16}
+	SINGLE-VALUE )
+
+# BELOW ARE OPTIONAL
+attributetype ( 1.3.6.1.4.1.9554.105
+	NAME 'phpgwMiddlename'
+	SUP name )
+
+attributetype ( 1.3.6.1.4.1.9554.106
+	NAME 'phpgwPrefix'
+	SUP name )
+
+attributetype ( 1.3.6.1.4.1.9554.107
+	NAME 'phpgwSuffix'
+	SUP name )
+
+attributetype ( 1.3.6.1.4.1.9554.108
+	NAME 'phpgwAudio'
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.4{25000} )
+
+attributetype ( 1.3.6.1.4.1.9554.109
+	NAME 'phpgwBirthday'
+	EQUALITY caseIgnoreMatch
+	SUBSTR caseIgnoreSubstringsMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} )
+
+attributetype ( 1.3.6.1.4.1.9554.110
+	NAME 'phpgwTz'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+	SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.9554.111
+	NAME 'phpgwGeo'
+ 	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+	SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.9554.112
+	NAME 'phpgwUrl'
+	EQUALITY caseIgnoreMatch
+	SUBSTR caseIgnoreSubstringsMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} )
+
+attributetype ( 1.3.6.1.4.1.9554.113
+	NAME 'phpgwPublicKey'
+	EQUALITY caseIgnoreMatch
+	SUBSTR caseIgnoreSubstringsMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} )
+
+attributetype ( 1.3.6.1.4.1.9554.114
+	NAME 'phpgwAdrOneType'
+	EQUALITY caseIgnoreMatch
+	SUBSTR caseIgnoreSubstringsMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} )
+
+attributetype ( 1.3.6.1.4.1.9554.115
+	NAME 'phpgwAddressLabel'
+	EQUALITY caseIgnoreListMatch
+	SUBSTR caseIgnoreListSubstringsMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )
+
+attributetype ( 1.3.6.1.4.1.9554.116
+	NAME 'phpgwAdrTwoStreet'
+	SUP street )
+
+attributetype ( 1.3.6.1.4.1.9554.117
+	NAME 'phpgwAdrTwoLocality'
+	SUP l )
+
+attributetype ( 1.3.6.1.4.1.9554.118
+	NAME 'phpgwAdrTwoRegion'
+	SUP st )
+
+attributetype ( 1.3.6.1.4.1.9554.119
+	NAME 'phpgwAdrTwoPostalCode'
+	SUP postalcode )
+
+attributetype ( 1.3.6.1.4.1.9554.120
+	NAME 'phpgwAdrTwoCountryName'
+	SUP friendlyCountryName )
+
+attributetype ( 1.3.6.1.4.1.9554.121
+	NAME 'phpgwAdrTwoType'
+	SUP phpgwAdrOneType )
+
+attributetype ( 1.3.6.1.4.1.9554.122
+	NAME 'phpgwVoiceTelephoneNumber'
+	SUP telephonenumber )
+
+attributetype ( 1.3.6.1.4.1.9554.123
+	NAME 'phpgwMsgTelephoneNumber'
+	SUP telephonenumber )
+
+attributetype ( 1.3.6.1.4.1.9554.124
+	NAME 'phpgwPagerTelephoneNumber'
+	SUP telephonenumber )
+ 
+attributetype ( 1.3.6.1.4.1.9554.125
+	NAME 'phpgwCellTelephoneNumber'
+	SUP telephonenumber )
+ 
+attributetype ( 1.3.6.1.4.1.9554.126
+	NAME 'phpgwBbsTelephoneNumber'
+	SUP telephonenumber )
+ 
+attributetype ( 1.3.6.1.4.1.9554.127
+	NAME 'phpgwModemTelephoneNumber'
+	SUP telephonenumber )
+
+attributetype ( 1.3.6.1.4.1.9554.128
+	NAME 'phpgwMobileTelephoneNumber'
+	SUP telephonenumber )
+ 
+attributetype ( 1.3.6.1.4.1.9554.129
+	NAME 'phpgwIsdnphoneNumber'
+	SUP telephonenumber )
+
+attributetype ( 1.3.6.1.4.1.9554.130
+	NAME 'phpgwVideophoneNumber'
+	SUP telephonenumber )
+
+attributetype ( 1.3.6.1.4.1.9554.131
+	NAME 'phpgwPreferPhone'
+	EQUALITY caseExactIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.9554.132
+	NAME 'phpgwMailType'
+	EQUALITY caseExactIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.9554.133
+	NAME 'phpgwMailHome'
+	SUP mail )
+
+attributetype ( 1.3.6.1.4.1.9554.134
+	NAME 'phpgwMailHomeType'
+	SUP phpgwMailType )
+
+# phpgwContact
+# The phpgwContact represents people who are associated with a
+# phpgw install in some way.  It is a structural class and is derived
+# from the inetOrgPerson schema.
+objectclass	( 1.3.6.1.4.1.9554.200
+	NAME 'phpgwContact'
+	DESC 'phpGroupWare Contact Entry'
+	SUP inetOrgPerson
+	MUST(
+		uid $ uidnumber $ phpgwContactTypeId $ phpgwContactCatId $
+		phpgwContactAccess $ phpgwContactOwner )
+	MAY ( cn $ givenname $ sn $ phpgwMiddlename $ phpgwPrefix $
+		phpgwSuffix $ phpgwAudio $ phpgwBirthday $ phpgwTz $ phpgwGeo $
+		phpgwUrl $ phpgwPublicKey $ o $ ou $ title $ streetaddress $
+		l $ st $ postalcode $ friendlyCountryName $ c $ co $ countryname $
+		phpgwAdrOneType $ phpgwAddressLabel $
+		phpgwAdrTwoStreet $ phpgwAdrTwoLocality $ phpgwAdrTwoRegion $
+		phpgwAdrTwoPostalCode $ phpgwAdrTwoCountryName $ phpgwAdrTwoType $
+		telephonenumber $ homephone $ phpgwVoiceTelephoneNumber $ facsimiletelephonenumber $
+		phpgwMsgTelephoneNumber $ phpgwCellTelephoneNumber $ phpgwPagerTelephoneNumber $
+		phpgwBbsTelephoneNumber $ phpgwModemTelephoneNumber $
+		phpgwMobileTelephoneNumber $ phpgwIsdnphoneNumber $
+		phpgwVideophoneNumber $ phpgwPreferPhone $
+		mail $ phpgwMailType $ phpgwMailHome $ phpgwMailHomeType )
+	)
+
Index: /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/pubkeys-ldap.schema
===================================================================
--- /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/pubkeys-ldap.schema	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/pubkeys-ldap.schema	(revision 444)
@@ -0,0 +1,25 @@
+#
+# LDAP Public Key Patch schema for use with openssh-ldappubkey
+# Author: Eric AUGE <eau@phear.org>
+# 
+# Based on the proposal of : Mark Ruijter
+#
+
+
+# octetString SYNTAX
+attributetype ( 1.3.6.1.4.1.24552.500.1.1.1 
+    NAME 'sshPublicKey' 
+	DESC 'MANDATORY: OpenSSH Public key' 
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+
+attributetype ( 1.3.6.1.4.1.24552.500.1.1.2
+    NAME 'gpgPublicKey' 
+	DESC 'MANDATORY: GnuPG Public key' 
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+
+# printableString SYNTAX yes|no
+objectclass ( 1.3.6.1.4.1.24552.500.1.1.0 
+    NAME 'ldapPublicKey' SUP top AUXILIARY
+    DESC 'MANDATORY: Public key for SSH and GPG'
+    MAY ( sshPublicKey $ gpgPublicKey ) 
+    )
Index: /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/samba.schema
===================================================================
--- /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/samba.schema	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/files/etc/ldap/schema/samba.schema	(revision 444)
@@ -0,0 +1,496 @@
+##
+## schema file for OpenLDAP 2.x
+## Schema for storing Samba user accounts and group maps in LDAP
+## OIDs are owned by the Samba Team
+##
+## Prerequisite schemas - uid         (cosine.schema)
+##                      - displayName (inetorgperson.schema)
+##                      - gidNumber   (nis.schema)
+##
+## 1.3.6.1.4.1.7165.2.1.x - attributetypes
+## 1.3.6.1.4.1.7165.2.2.x - objectclasses
+##
+## Printer support
+## 1.3.6.1.4.1.7165.2.3.1.x - attributetypes
+## 1.3.6.1.4.1.7165.2.3.2.x - objectclasses
+##
+## ----- READ THIS WHEN ADDING A NEW ATTRIBUTE OR OBJECT CLASS ------
+##
+## Run the 'get_next_oid' bash script in this directory to find the 
+## next available OID for attribute type and object classes.
+##
+##   $ ./get_next_oid
+##   attributetype ( 1.3.6.1.4.1.7165.2.1.XX NAME ....
+##   objectclass ( 1.3.6.1.4.1.7165.2.2.XX NAME ....
+##
+## Also ensure that new entries adhere to the declaration style
+## used throughout this file
+##
+##    <attributetype|objectclass> ( 1.3.6.1.4.1.7165.2.XX.XX NAME ....
+##                               ^ ^                        ^
+##
+## The spaces are required for the get_next_oid script (and for 
+## readability).
+##
+## ------------------------------------------------------------------
+
+# objectIdentifier SambaRoot 1.3.6.1.4.1.7165
+# objectIdentifier Samba3 SambaRoot:2
+# objectIdentifier Samba3Attrib Samba3:1
+# objectIdentifier Samba3ObjectClass Samba3:2
+
+########################################################################
+##                            HISTORICAL                              ##
+########################################################################
+
+##
+## Password hashes
+##
+#attributetype ( 1.3.6.1.4.1.7165.2.1.1 NAME 'lmPassword'
+#	DESC 'LanManager Passwd'
+#	EQUALITY caseIgnoreIA5Match
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.2 NAME 'ntPassword'
+#	DESC 'NT Passwd'
+#	EQUALITY caseIgnoreIA5Match
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE )
+
+##
+## Account flags in string format ([UWDX     ])
+##
+#attributetype ( 1.3.6.1.4.1.7165.2.1.4 NAME 'acctFlags'
+#	DESC 'Account Flags'
+#	EQUALITY caseIgnoreIA5Match
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE )
+
+##
+## Password timestamps & policies
+##
+#attributetype ( 1.3.6.1.4.1.7165.2.1.3 NAME 'pwdLastSet'
+#	DESC 'NT pwdLastSet'
+#	EQUALITY integerMatch
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.5 NAME 'logonTime'
+#	DESC 'NT logonTime'
+#	EQUALITY integerMatch
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.6 NAME 'logoffTime'
+#	DESC 'NT logoffTime'
+#	EQUALITY integerMatch
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.7 NAME 'kickoffTime'
+#	DESC 'NT kickoffTime'
+#	EQUALITY integerMatch
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.8 NAME 'pwdCanChange'
+#	DESC 'NT pwdCanChange'
+#	EQUALITY integerMatch
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.9 NAME 'pwdMustChange'
+#	DESC 'NT pwdMustChange'
+#	EQUALITY integerMatch
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+##
+## string settings
+##
+#attributetype ( 1.3.6.1.4.1.7165.2.1.10 NAME 'homeDrive'
+#	DESC 'NT homeDrive'
+#	EQUALITY caseIgnoreIA5Match
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.11 NAME 'scriptPath'
+#	DESC 'NT scriptPath'
+#	EQUALITY caseIgnoreIA5Match
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} SINGLE-VALUE )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.12 NAME 'profilePath'
+#	DESC 'NT profilePath'
+#	EQUALITY caseIgnoreIA5Match
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} SINGLE-VALUE )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.13 NAME 'userWorkstations'
+#	DESC 'userWorkstations'
+#	EQUALITY caseIgnoreIA5Match
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} SINGLE-VALUE )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.17 NAME 'smbHome'
+#	DESC 'smbHome'
+#	EQUALITY caseIgnoreIA5Match
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.18 NAME 'domain'
+#	DESC 'Windows NT domain to which the user belongs'
+#	EQUALITY caseIgnoreIA5Match
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} )
+
+##
+## user and group RID
+##
+#attributetype ( 1.3.6.1.4.1.7165.2.1.14 NAME 'rid'
+#	DESC 'NT rid'
+#	EQUALITY integerMatch
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+#attributetype ( 1.3.6.1.4.1.7165.2.1.15 NAME 'primaryGroupID'
+#	DESC 'NT Group RID'
+#	EQUALITY integerMatch
+#	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+##
+## The smbPasswordEntry objectclass has been depreciated in favor of the
+## sambaAccount objectclass
+##
+#objectclass ( 1.3.6.1.4.1.7165.2.2.1 NAME 'smbPasswordEntry' SUP top AUXILIARY
+#        DESC 'Samba smbpasswd entry'
+#        MUST ( uid $ uidNumber )
+#        MAY  ( lmPassword $ ntPassword $ pwdLastSet $ acctFlags ))
+
+#objectclass ( 1.3.6.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL
+#	DESC 'Samba Account'
+#	MUST ( uid $ rid )
+#	MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
+#               logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
+#               displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
+#               description $ userWorkstations $ primaryGroupID $ domain ))
+
+#objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY
+#	DESC 'Samba Auxiliary Account'
+#	MUST ( uid $ rid )
+#	MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
+#              logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
+#              displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
+#              description $ userWorkstations $ primaryGroupID $ domain ))
+
+########################################################################
+##                        END OF HISTORICAL                           ##
+########################################################################
+
+#######################################################################
+##                Attributes used by Samba 3.0 schema                ##
+#######################################################################
+
+##
+## Password hashes
+##
+attributetype ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword'
+	DESC 'LanManager Password'
+	EQUALITY caseIgnoreIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword'
+	DESC 'MD4 hash of the unicode password'
+	EQUALITY caseIgnoreIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE )
+
+##
+## Account flags in string format ([UWDX     ])
+##
+attributetype ( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags'
+	DESC 'Account Flags'
+	EQUALITY caseIgnoreIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE )
+
+##
+## Password timestamps & policies
+##
+attributetype ( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet'
+	DESC 'Timestamp of the last password update'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange'
+	DESC 'Timestamp of when the user is allowed to update the password'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange'
+	DESC 'Timestamp of when the password will expire'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime'
+	DESC 'Timestamp of last logon'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime'
+	DESC 'Timestamp of last logoff'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime'
+	DESC 'Timestamp of when the user will be logged off automatically'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.48 NAME 'sambaBadPasswordCount'
+	DESC 'Bad password attempt count'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.49 NAME 'sambaBadPasswordTime'
+	DESC 'Time of the last bad password attempt'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours'
+	DESC 'Logon Hours'
+	EQUALITY caseIgnoreIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{42} SINGLE-VALUE )
+
+##
+## string settings
+##
+attributetype ( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive'
+	DESC 'Driver letter of home directory mapping'
+	EQUALITY caseIgnoreIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript'
+	DESC 'Logon script path'
+	EQUALITY caseIgnoreMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath'
+	DESC 'Roaming profile path'
+	EQUALITY caseIgnoreMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations'
+	DESC 'List of user workstations the user is allowed to logon to'
+	EQUALITY caseIgnoreMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath'
+	DESC 'Home directory UNC path'
+	EQUALITY caseIgnoreMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName'
+	DESC 'Windows NT domain to which the user belongs'
+	EQUALITY caseIgnoreMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial'
+	DESC ''
+	EQUALITY caseExactMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory'
+	DESC 'Concatenated MD4 hashes of the unicode passwords used on this account'
+	EQUALITY caseIgnoreIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} )
+
+##
+## SID, of any type
+##
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID'
+	DESC 'Security ID'
+	EQUALITY caseIgnoreIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
+
+
+##
+## Primary group SID, compatible with ntSid
+##
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID'
+	DESC 'Primary Group Security ID'
+	EQUALITY caseIgnoreIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList'
+	DESC 'Security ID List'
+	EQUALITY caseIgnoreIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} )
+
+##
+## group mapping attributes
+##
+attributetype ( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType'
+	DESC 'NT Group Type'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+##
+## Store info on the domain
+##
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid'
+	DESC 'Next NT rid to give our for users'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid'
+	DESC 'Next NT rid to give out for groups'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid'
+	DESC 'Next NT rid to give out for anything'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase'
+	DESC 'Base at which the samba RID generation algorithm should operate'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.41 NAME 'sambaShareName'
+	DESC 'Share Name'
+	EQUALITY caseIgnoreMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName'
+	DESC 'Option Name'
+	EQUALITY caseIgnoreMatch
+	SUBSTR caseIgnoreSubstringsMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.43 NAME 'sambaBoolOption'
+	DESC 'A boolean option'
+	EQUALITY booleanMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.44 NAME 'sambaIntegerOption'
+	DESC 'An integer option'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.45 NAME 'sambaStringOption'
+	DESC 'A string option'
+	EQUALITY caseExactIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.46 NAME 'sambaStringListOption'
+	DESC 'A string list option'
+	EQUALITY caseIgnoreMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+
+
+##attributetype ( 1.3.6.1.4.1.7165.2.1.50 NAME 'sambaPrivName' 
+##	SUP name )
+
+##attributetype ( 1.3.6.1.4.1.7165.2.1.52 NAME 'sambaPrivilegeList'
+##	DESC 'Privileges List'
+##	EQUALITY caseIgnoreIA5Match
+##	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.53 NAME 'sambaTrustFlags'
+	DESC 'Trust Password Flags'
+	EQUALITY caseIgnoreIA5Match
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.56 NAME 'sambaAccountPolicyName'
+	DESC 'Account Policy Name'
+	EQUALITY caseIgnoreMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
+
+attributetype ( 1.3.6.1.4.1.7165.2.1.57 NAME 'sambaAccountPolicyValue'
+	DESC 'Account Policy Value'
+	EQUALITY integerMatch
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+
+
+#######################################################################
+##              objectClasses used by Samba 3.0 schema               ##
+#######################################################################
+
+## The X.500 data model (and therefore LDAPv3) says that each entry can
+## only have one structural objectclass.  OpenLDAP 2.0 does not enforce
+## this currently but will in v2.1
+
+##
+## added new objectclass (and OID) for 3.0 to help us deal with backwards
+## compatibility with 2.2 installations (e.g. ldapsam_compat)  --jerry
+##
+objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY
+	DESC 'Samba 3.0 Auxilary SAM Account'
+	MUST ( uid $ sambaSID )
+	MAY  ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $
+	       sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $
+	       sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $
+               displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $
+	       sambaProfilePath $ description $ sambaUserWorkstations $
+	       sambaPrimaryGroupSID $ sambaDomainName $ sambaMungedDial $
+	       sambaBadPasswordCount $ sambaBadPasswordTime $
+	       sambaPasswordHistory $ sambaLogonHours))
+
+##
+## Group mapping info
+##
+objectclass ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' SUP top AUXILIARY
+	DESC 'Samba Group Mapping'
+	MUST ( gidNumber $ sambaSID $ sambaGroupType )
+	MAY  ( displayName $ description $ sambaSIDList ))
+
+##
+## Trust password for trust relationships (any kind)
+##
+objectclass ( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' SUP top STRUCTURAL
+	DESC 'Samba Trust Password'
+	MUST ( sambaDomainName $ sambaNTPassword $ sambaTrustFlags )
+	MAY ( sambaSID $ sambaPwdLastSet ))
+
+##
+## Whole-of-domain info
+##
+objectclass ( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' SUP top STRUCTURAL
+	DESC 'Samba Domain Information'
+	MUST ( sambaDomainName $ 
+	       sambaSID ) 
+	MAY ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $
+	      sambaAlgorithmicRidBase ) )
+
+##
+## used for idmap_ldap module
+##
+objectclass ( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' SUP top AUXILIARY
+        DESC 'Pool for allocating UNIX uids/gids'
+        MUST ( uidNumber $ gidNumber ) )
+
+
+objectclass ( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' SUP top AUXILIARY
+        DESC 'Mapping from a SID to an ID'
+        MUST ( sambaSID )
+	MAY ( uidNumber $ gidNumber ) )
+
+objectclass ( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' SUP top STRUCTURAL
+	DESC 'Structural Class for a SID'
+	MUST ( sambaSID ) )
+
+objectclass ( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' SUP top AUXILIARY
+	DESC 'Samba Configuration Section'
+	MAY ( description ) )
+
+objectclass ( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' SUP top STRUCTURAL
+	DESC 'Samba Share Section'
+	MUST ( sambaShareName )
+	MAY ( description ) )
+
+objectclass ( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' SUP top STRUCTURAL
+	DESC 'Samba Configuration Option'
+	MUST ( sambaOptionName )
+	MAY ( sambaBoolOption $ sambaIntegerOption $ sambaStringOption $ 
+	      sambaStringListoption $ description ) )
+
+
+## retired during privilege rewrite
+##objectclass ( 1.3.6.1.4.1.7165.2.2.13 NAME 'sambaPrivilege' SUP top AUXILIARY
+##	DESC 'Samba Privilege'
+##	MUST ( sambaSID )
+##	MAY ( sambaPrivilegeList ) )
+
+objectclass ( 1.3.6.1.4.1.7165.2.2.15 NAME 'sambaAccountPolicy' SUP top STRUCTURAL
+	DESC 'Samba Account Policy'
+	MUST ( sambaAccountPolicyName $ sambaAccountPolicyValue )
+	MAY ( description ) )
+
Index: /trunk/puppet/modules/puppet-openldap/files/usr/local/sbin/ldap-backup.sh
===================================================================
--- /trunk/puppet/modules/puppet-openldap/files/usr/local/sbin/ldap-backup.sh	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/files/usr/local/sbin/ldap-backup.sh	(revision 444)
@@ -0,0 +1,3 @@
+#!/bin/sh
+DIR=/var/backups/ldap
+/usr/sbin/slapcat |gzip > $DIR/ldap_`date +%A |tr 'A-Z' 'a-z'`.gz
Index: /trunk/puppet/modules/puppet-openldap/manifests/classes/client.pp
===================================================================
--- /trunk/puppet/modules/puppet-openldap/manifests/classes/client.pp	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/manifests/classes/client.pp	(revision 444)
@@ -0,0 +1,16 @@
+class openldap::client {
+  package {"ldap-utils":
+    ensure => installed,
+  }
+
+  file { 
+    "/etc/ldap":
+      ensure  => directory,
+      owner   => root,
+      group   => root,
+      mode    => 755;
+    "/etc/ldap/ldap.conf":
+      require => Package["ldap-utils"],
+      content => template("openldap/ldap.conf.erb");
+  }
+}
Index: /trunk/puppet/modules/puppet-openldap/manifests/classes/server.pp
===================================================================
--- /trunk/puppet/modules/puppet-openldap/manifests/classes/server.pp	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/manifests/classes/server.pp	(revision 444)
@@ -0,0 +1,75 @@
+class openldap::server {
+
+  debug ("configuring openldap::server with dn '$ldap_base'")
+
+  package {"slapd":
+    ensure        => installed,
+    responsefile  => "/var/cache/debconf/slapd.preseed",
+    require       => File["/var/cache/debconf/slapd.preseed"],
+  }
+  if defined(Package["ldap-utils"]) { } else {
+    package {"ldap-utils": ensure => present, }
+  }
+  
+  service {"slapd":
+    ensure  => running,
+    require => Package[slapd],
+  }
+
+  if ($ldap_ssl_only) {
+    $line = 'SLAPD_SERVICES="ldaps:///"'
+  } else {
+    $line = 'SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///"'
+  }
+  line {"listen_locally":
+#    line    => 'SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///"',
+    line    => $line,
+    file    => "/etc/default/slapd",
+    ensure  => present,
+    require => Package[slapd],
+    notify  => Service[slapd],
+  }
+
+  file {
+    "/var/cache/debconf/slapd.preseed":
+      content => template("openldap/slapd.preseed.erb"),
+      mode    => 0600, 
+      owner   => root, 
+      group   => root;
+   "/usr/local/sbin/ldap-backup.sh":
+      ensure  => present,
+      owner   => root,
+      group   => root,
+      mode    => 755,
+      source  => "puppet:///openldap/usr/local/sbin/ldap-backup.sh";
+    "/var/backups/ldap":
+      ensure  => directory,
+      owner   => root,
+      group   => root,
+      mode    => 750;
+  }
+  
+  file {
+    "/etc/ldap/schema":
+      ensure => directory,
+      mode   => 755,
+      owner  => root,
+      group  => root,
+      require => Package[slapd];
+    "/etc/ldap/schema/authldap.schema":
+      ensure => present,
+      mode   => 644,
+      owner  => root,
+      group  => root,
+      source  => "puppet:///openldap/etc/ldap/schema/authldap.schema",
+      require => File["/etc/ldap/schema"];
+  }
+
+  cron {"ldap-backup":
+    command => "/usr/local/sbin/ldap-backup.sh",
+    user    => "root",
+    hour    => 2,
+    minute  => 0,
+    require => File["/var/backups/ldap"],
+  } 
+}
Index: /trunk/puppet/modules/puppet-openldap/manifests/classes/smbldap-server.pp
===================================================================
--- /trunk/puppet/modules/puppet-openldap/manifests/classes/smbldap-server.pp	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/manifests/classes/smbldap-server.pp	(revision 444)
@@ -0,0 +1,47 @@
+class openldap::smbldap-server inherits openldap::server {
+
+  debug ("configuring openldap::smbldap with dn '$ldap_base'")
+
+  package {"smbldap-tools":
+    ensure   => installed,
+    require  => [ Package[slapd], Package[samba-common] ],
+  }
+
+  case $localsid { 
+    '': {
+        err("$fqdn: no \$localsid, not installing samba-common")
+    }
+
+    default: {
+      file {"/etc/smbldap-tools/smbldap.conf":
+        content => template("openldap/smbldap.conf.erb"),
+        mode    => 0644,
+        owner   => root,
+        group   => root,
+        require => Package[smbldap-tools];
+      }
+    }
+  }
+
+  file {
+    "/etc/ldap/schema/samba.schema":
+      source  => "puppet:///openldap/etc/ldap/schema/samba.schema",
+      mode    => 0644, 
+      owner   => root, 
+      group   => root,
+      require => [Package[slapd], File["/etc/ldap/schema"]],
+      notify  => Service[slapd];
+    "/etc/smbldap-tools/":
+      ensure  => directory, 
+      mode    => 0755, 
+      owner   => root, 
+      group   => root,
+      require => Package[smbldap-tools];
+    "/etc/smbldap-tools/smbldap_bind.conf":
+      content => template("openldap/smbldap_bind.conf.erb"),
+      mode    => 0600, 
+      owner   => root, 
+      group   => root,
+      require => Package[smbldap-tools];
+  }
+}
Index: /trunk/puppet/modules/puppet-openldap/manifests/init.pp
===================================================================
--- /trunk/puppet/modules/puppet-openldap/manifests/init.pp	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/manifests/init.pp	(revision 444)
@@ -0,0 +1,1 @@
+import "classes/*.pp"
Index: /trunk/puppet/modules/puppet-openldap/templates/ldap.conf.erb
===================================================================
--- /trunk/puppet/modules/puppet-openldap/templates/ldap.conf.erb	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/templates/ldap.conf.erb	(revision 444)
@@ -0,0 +1,23 @@
+#
+# LDAP Defaults
+#
+
+# See ldap.conf(5) for details
+# This file should be world readable but not world writable.
+
+URI <%= ldap_uri %>
+BASE <%= ldap_base %>
+LDAP_VERSION 3
+
+#SIZELIMIT      12
+#TIMELIMIT      15
+#DEREF          never
+<% if has_variable?("ldap_ssl") -%>
+ssl start_tls
+ssl on
+TLS_CACERTFILE /etc/ssl/certs/ldap.pem
+<% else -%>
+#ssl start_tls
+#ssl on
+#TLS_CACERTFILE /etc/ssl/certs/ldap.pem
+<% end -%>
Index: /trunk/puppet/modules/puppet-openldap/templates/slapd.conf.erb
===================================================================
--- /trunk/puppet/modules/puppet-openldap/templates/slapd.conf.erb	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/templates/slapd.conf.erb	(revision 444)
@@ -0,0 +1,103 @@
+# This is the main slapd configuration file. See slapd.conf(5) for more
+
+# Features to permit
+# allow bind_v2
+
+# Schema and objectClass definitions
+include         /etc/ldap/schema/core.schema
+include         /etc/ldap/schema/cosine.schema
+include         /etc/ldap/schema/nis.schema
+include         /etc/ldap/schema/inetorgperson.schema
+<% if has_variable?("ldap_smb") -%>
+include         /etc/ldap/schema/samba.schema
+<% end -%>
+include         /etc/ldap/schema/authldap.schema
+
+# Schema check allows for forcing entries to
+# match schemas for their objectClasses's
+schemacheck     on
+
+# Where the pid file is put. The init.d script
+# will not stop the server if you change this.
+pidfile         /var/run/slapd/slapd.pid
+
+# List of arguments that were passed to the server
+argsfile        /var/run/slapd/slapd.args
+
+# Read slapd.conf(5) for possible values
+loglevel        0
+
+# to use ldapsearch
+sizelimit 2000
+
+# Where the dynamically loaded modules are stored
+modulepath	/usr/lib/ldap
+moduleload	back_bdb
+
+# Specific Backend Directives for bdb
+backend		  bdb
+checkpoint  512 30
+database    bdb
+
+# The base of your directory in database #1
+suffix          "<%= ldap_base %>"
+
+# rootdn directive for specifying a superuser on the database. This is needed
+# # for syncrepl.
+#rootdn          "cn=admin,<%= ldap_base %>"
+
+# Where the database file are physically stored for database #1
+directory       "/var/lib/ldap"
+
+# Indexing options for database #1
+index         uid,uidNumber,gidNumber,memberUid       eq
+index         cn,mail,surname,givenname               eq,subinitial
+<% if has_variable?("ldap_smb") -%>
+index         sambaSID                                eq
+index         sambaPrimaryGroupSID                    eq
+index         sambaDomainName                         eq
+<% end -%>
+# Save the time that the entry gets modified, for database #1
+lastmod         on
+
+# Where to store the replica logs for database #1
+# replogfile	/var/lib/ldap/replog
+
+# The userPassword by default can be changed
+# by the entry owning it if they are authenticated.
+# Others should not be able to see it, except the
+# admin entry below
+# These access lines apply to database #1 only
+<% if has_variable?("ldap_smb") -%>
+access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdCanChange,sambaPwdMustChange,sambaPwdLastSet,sambaAcctFlags
+<% else -%>
+access to attrs=userPassword
+<% end -%>
+        by dn="cn=admin,<%= ldap_base %>" write
+        by anonymous auth
+        by self write
+        by * none
+# Ensure read access to the base for things like
+# # supportedSASLMechanisms.  Without this you may
+# # have problems with SASL not knowing what
+# # mechanisms are available and the like.
+# # Note that this is covered by the 'access to *'
+# # ACL below too but if you change that as people
+# # are wont to do you'll still need this if you
+# # want SASL (and possible other things) to work 
+# # happily.
+access to dn.base="" by * read
+
+# The admin dn has full write access, everyone else
+# can read everything.
+access to *
+        by dn="cn=admin,<%= ldap_base %>" write
+        by * read
+
+<% if has_variable?("ldap_ssl") -%>
+TLSCipherSuite HIGH:MEDIUM:-SSLv2
+TLSVerifyClient never
+TLSCertificateFile /etc/ssl/certs/ldap.pem
+TLSCertificateKeyFile /etc/ssl/certs/ldap.pem
+TLSCACertificateFile /etc/ssl/certs/ldap.pem
+<% end -%>
Index: /trunk/puppet/modules/puppet-openldap/templates/slapd.preseed.erb
===================================================================
--- /trunk/puppet/modules/puppet-openldap/templates/slapd.preseed.erb	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/templates/slapd.preseed.erb	(revision 444)
@@ -0,0 +1,26 @@
+# 
+# to create this file :
+# $ dpkg-reconfigure --priority medium slapd
+# $ debconf-get-selections |slapd > slapd.preseed
+#
+slapd	slapd/password1	password <%= ldap_admin_password %>
+slapd	slapd/internal/adminpw	password <%= ldap_admin_password %>
+slapd	slapd/password2	password <%= ldap_admin_password %>
+slapd	slapd/allow_ldap_v2	boolean	false
+slapd	slapd/password_mismatch	note	
+slapd	slapd/suffix_change	boolean	false
+slapd	slapd/fix_directory	boolean	true
+slapd	slapd/invalid_config	boolean	true
+slapd	slapd/slave_databases_require_updateref	note	
+slapd	shared/organization	string <%= ldap_organization_name %>
+slapd	slapd/dump_database_destdir	string	/var/backups/slapd-VERSION
+slapd	slapd/upgrade_slapcat_failure	note	
+slapd	slapd/autoconf_modules	boolean	true
+slapd	slapd/purge_database	boolean	false
+slapd	slapd/domain	string <%= domain %>
+slapd	slapd/backend	select	BDB
+slapd	slapd/no_configuration	boolean	false
+slapd	slapd/migrate_ldbm_to_bdb	boolean	true
+slapd	slapd/move_old_database	boolean	true
+slapd	slapd/dump_database	select	when needed
+slapd	slapd/upgrade_slapadd_failure	note	
Index: /trunk/puppet/modules/puppet-openldap/templates/smbldap.conf.erb
===================================================================
--- /trunk/puppet/modules/puppet-openldap/templates/smbldap.conf.erb	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/templates/smbldap.conf.erb	(revision 444)
@@ -0,0 +1,224 @@
+
+# $Source: /opt/cvs/samba/smbldap-tools/configure.pl,v 
+# smbldap-tools.conf : Q & D configuration file for smbldap-tools
+
+#  This code was developped by IDEALX (http://IDEALX.org/) and
+#  contributors (their names can be found in the CONTRIBUTORS file).
+#
+#                 Copyright (C) 2001-2002 IDEALX
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public License
+#  as published by the Free Software Foundation; either version 2
+#  of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program; if not, write to the Free Software
+#  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
+#  USA.
+
+#  Purpose :
+#       . be the configuration file for all smbldap-tools scripts
+
+##############################################################################
+#
+# General Configuration
+#
+##############################################################################
+
+# Put your own SID. To obtain this number do: "net getlocalsid".
+# If not defined, parameter is taking from "net getlocalsid" return
+SID="<%= localsid %>"
+
+# Domain name the Samba server is in charged.
+# If not defined, parameter is taking from smb.conf configuration file
+# Ex: sambaDomain="IDEALX-NT"
+sambaDomain="<%= samba_domain_name %>"
+
+##############################################################################
+#
+# LDAP Configuration
+#
+##############################################################################
+
+# Notes: to use to dual ldap servers backend for Samba, you must patch
+# Samba with the dual-head patch from IDEALX. If not using this patch
+# just use the same server for slaveLDAP and masterLDAP.
+# Those two servers declarations can also be used when you have 
+# . one master LDAP server where all writing operations must be done
+# . one slave LDAP server where all reading operations must be done
+#   (typically a replication directory)
+
+# Slave LDAP server
+# Ex: slaveLDAP=127.0.0.1
+# If not defined, parameter is set to "127.0.0.1"
+# slaveLDAP=""
+
+# Slave LDAP port
+# If not defined, parameter is set to "389"
+slavePort="389"
+
+# Master LDAP server: needed for write operations
+# Ex: masterLDAP=127.0.0.1
+# If not defined, parameter is set to "127.0.0.1"
+# masterLDAP=""
+
+# Master LDAP port
+# If not defined, parameter is set to "389"
+masterPort="389"
+
+# Use TLS for LDAP
+# If set to 1, this option will use start_tls for connection
+# (you should also used the port 389)
+# If not defined, parameter is set to "1"
+ldapTLS="0"
+
+# How to verify the server's certificate (none, optional or require)
+# see "man Net::LDAP" in start_tls section for more details
+#verify="none"
+
+# CA certificate
+# see "man Net::LDAP" in start_tls section for more details
+#cafile="/etc/smbldap-tools//ca.pem"
+
+# certificate to use to connect to the ldap server
+# see "man Net::LDAP" in start_tls section for more details
+#clientcert="/etc/smbldap-tools//smbldap-tools.pem"
+
+# key certificate to use to connect to the ldap server
+# see "man Net::LDAP" in start_tls section for more details
+#clientkey="/etc/smbldap-tools//smbldap-tools.key"
+
+# LDAP Suffix
+# Ex: suffix=dc=IDEALX,dc=ORG
+suffix="<%= ldap_base %>"
+
+# Where are stored Users
+# Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG"
+# Warning: if 'suffix' is not set here, you must set the full dn for usersdn
+usersdn="ou=users,${suffix}"
+
+# Where are stored Computers
+# Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG"
+# Warning: if 'suffix' is not set here, you must set the full dn for computersdn
+computersdn="ou=computers,${suffix}"
+
+# Where are stored Groups
+# Ex: groupsdn="ou=Groups,dc=IDEALX,dc=ORG"
+# Warning: if 'suffix' is not set here, you must set the full dn for groupsdn
+groupsdn="ou=groups,${suffix}"
+
+# Where are stored Idmap entries (used if samba is a domain member server)
+# Ex: groupsdn="ou=Idmap,dc=IDEALX,dc=ORG"
+# Warning: if 'suffix' is not set here, you must set the full dn for idmapdn
+idmapdn="ou=idmap,${suffix}"
+
+# Where to store next uidNumber and gidNumber available for new users and groups
+# If not defined, entries are stored in sambaDomainName object.
+# Ex: sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"
+# Ex: sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}"
+sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"
+
+# Default scope Used
+scope="sub"
+
+# Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT)
+hash_encrypt="SSHA"
+
+# if hash_encrypt is set to CRYPT, you may set a salt format.
+# default is "%s", but many systems will generate MD5 hashed
+# passwords if you use "$1$%.8s". This parameter is optional!
+crypt_salt_format="$1$%.8s"
+
+##############################################################################
+# 
+# Unix Accounts Configuration
+# 
+##############################################################################
+
+# Login defs
+# Default Login Shell
+# Ex: userLoginShell="/bin/bash"
+userLoginShell="/bin/bash"
+
+# Home directory
+# Ex: userHome="/home/%U"
+userHome="/home/%U"
+
+# Default mode used for user homeDirectory
+userHomeDirectoryMode="751"
+
+# Gecos
+userGecos="User"
+
+# Default User (POSIX and Samba) GID
+defaultUserGid="513"
+
+# Default Computer (Samba) GID
+defaultComputerGid="515"
+
+# Skel dir
+skeletonDir="/etc/skel"
+
+# Default password validation time (time in days) Comment the next line if
+# you don't want password to be enable for defaultMaxPasswordAge days (be
+# careful to the sambaPwdMustChange attribute's value)
+#defaultMaxPasswordAge="40000"
+
+##############################################################################
+#
+# SAMBA Configuration
+#
+##############################################################################
+
+# The UNC path to home drives location (%U username substitution)
+# Just set it to a null string if you want to use the smb.conf 'logon home'
+# directive and/or disable roaming profiles
+# Ex: userSmbHome="\\PDC-SMB3\%U"
+userSmbHome=""
+
+# The UNC path to profiles locations (%U username substitution)
+# Just set it to a null string if you want to use the smb.conf 'logon path'
+# directive and/or disable roaming profiles
+# Ex: userProfile="\\PDC-SMB3\profiles\%U"
+userProfile=""
+
+# The default Home Drive Letter mapping
+# (will be automatically mapped at logon time if home directory exist)
+# Ex: userHomeDrive="H:"
+userHomeDrive="H:"
+
+# The default user netlogon script name (%U username substitution)
+# if not used, will be automatically username.cmd
+# make sure script file is edited under dos
+# Ex: userScript="startup.cmd" # make sure script file is edited under dos
+userScript=""
+
+# Domain appended to the users "mail"-attribute
+# when smbldap-useradd -M is used
+# Ex: mailDomain="idealx.com"
+mailDomain="<%= domain %>"
+
+##############################################################################
+#
+# SMBLDAP-TOOLS Configuration (default are ok for a RedHat)
+#
+##############################################################################
+
+# Allows not to use smbpasswd (if with_smbpasswd == 0 in smbldap_conf.pm) but
+# prefer Crypt::SmbHash library
+with_smbpasswd="0"
+smbpasswd="/usr/bin/smbpasswd"
+
+# Allows not to use slappasswd (if with_slappasswd == 0 in smbldap_conf.pm)
+# but prefer Crypt:: libraries
+with_slappasswd="0"
+slappasswd="/usr/sbin/slappasswd"
+
+# comment out the following line to get rid of the default banner
+# no_banner="1"
Index: /trunk/puppet/modules/puppet-openldap/templates/smbldap_bind.conf.erb
===================================================================
--- /trunk/puppet/modules/puppet-openldap/templates/smbldap_bind.conf.erb	(revision 444)
+++ /trunk/puppet/modules/puppet-openldap/templates/smbldap_bind.conf.erb	(revision 444)
@@ -0,0 +1,11 @@
+############################
+# Credential Configuration #
+############################
+# Notes: you can specify two differents configuration if you use a
+# master ldap for writing access and a slave ldap server for reading access
+# By default, we will use the same DN (so it will work for standard Samba
+# release)
+slaveDN="cn=admin,<%= ldap_base %>"
+slavePw="<%= ldap_admin_password %>"
+masterDN="cn=admin,<%= ldap_base %>"
+masterPw="<%= ldap_admin_password %>"
