Update slapd features and formating

doc/guide/admin/intro.sdf

@@ -4,10 +4,11 @@
 H1: Introduction to slapd and slurpd
 
 This document describes how to build, configure, and run the stand-alone
-LDAP daemon ({{I:slapd}}) and the stand-alone LDAP update replication
+{{TERM:LDAP}} daemon ({{slapd}}) and the stand-alone LDAP update replication
-daemon ({{I:slurpd}}). It is intended for newcomers and experienced
+daemon ({{slurpd}}). It is intended for newcomers and experienced
-administrators alike. This section provides a basic introduction to directory
+administrators alike. This section provides a basic introduction to
-service, and the directory service provided by {{I:slapd}} in particular.
+directory services and, in particular, the directory services provided
+by {{slapd}}.
 
 
 
@@ -30,31 +31,31 @@ There are many different ways to provide a directory service. Different
 methods allow different kinds of information to be stored in the directory,
 place different requirements on how that information can be referenced,
 queried and updated, how it is protected from unauthorized access, etc.
-Some directory services are {{I:local}}, providing service to a restricted 
+Some directory services are {{local}}, providing service to a restricted 
 context (e.g., the finger service on a single machine). Other services are 
 global, providing service to a much broader context (e.g., the entire Internet).
-Global services are usually {{I:distributed}}, meaning that the data they
+Global services are usually {{distributed}}, meaning that the data they
 contain is spread across many machines, all of which cooperate to provide
 the directory service. Typically a global service defines a uniform
-{{I:namespace}} which gives the same view of the data no matter where
+{{namespace}} which gives the same view of the data no matter where
-you are in relation to the data itself.  The Internet {{Domain Name System}}
+you are in relation to the data itself.  The Internet {{TERM[expand]DNS}}
 is an example of a globally distributed directory service.
 
 
 
 H2: What is LDAP?
 
-{{I:Slapd}}'s model for directory service is based on a global directory
+{{slapd}}'s model for directory service is based on a global directory
 model called {{TERM:LDAP}}.  LDAP stands for {{TERM[expand]LDAP}}.
 LDAP is a directory access protocol that runs over
-{{TCP/IP}}. The nitty-gritty details of LDAP are defined in
+{{TERM:TCP}}/{{TERM:IP}}. The nitty-gritty details of LDAP are defined in
 {{REF:RFC2251}} "The Lightweight Directory Access Protocol (v3)."
 This section gives an overview of LDAP from a user's perspective.
 
-{{I:What kind of information can be stored in the directory?}}
+{{What kind of information can be stored in the directory?}}
 The LDAP information model is based on {{entries}}. An entry is a
-collection of attributes that has a globally-unique {{distinguished
+collection of attributes that has a globally-unique
-name}} (DN). 
+{{TERM[expand]DN}} (DN). 
 The DN is used to refer to the entry unambiguously. Each of the 
 entry's attributes has a {{type}} and one or more {{values}}. 
 The types are typically mnemonic strings, like "{{EX:cn}}" for common
@@ -64,7 +65,7 @@ be the value {{EX: Babs Jensen}}.  A {{EX:mail}} attribute might
 contain the value "{{EX:babs@openldap.org}}". A {{EX:jpegPhoto}}
 attribute would contain a photograph in the JPEG (binary) format.
 
-{{I:How is the information arranged?}}
+{{How is the information arranged?}}
 In LDAP, directory entries are arranged in a hierarchical tree-like
 structure.  Traditionally, this structure reflected the geographic
 and/or organizational boundaries.  Entries representing countries
@@ -87,20 +88,20 @@ FT[align="Center"] Figure 1.2: LDAP directory tree (Internet naming)
 
 In addition, LDAP allows you to control which attributes are required
 and allowed in an entry through the use of a special attribute called 
-{{I:objectClass}}.  The values of the {{I:objectClass}} attribute
+{{objectClass}}.  The values of the {{objectClass}} attribute
-determine the {{I:schema}} rules the entry must obey.
+determine the {{schema}} rules the entry must obey.
 
-{{I:How is the information referenced?}}
+{{How is the information referenced?}}
 An entry is referenced by its distinguished name, which is constructed
-by taking the name of the entry itself (called the relative distinguished
+by taking the name of the entry itself (called the {{TERM[expand]RDN}}
-name, or RDN) and concatenating the names of its ancestor entries. For
+or RDN) and concatenating the names of its ancestor entries. For
 example, the entry for Barbara Jensen in the Internet naming example
 above has an RDN of {{EX:uid=babs}} and a DN of
 {{EX:uid=babs, ou=People, dc=OpenLDAP, dc=com}}". The full DN format is
 described in {{REF:RFC2253}}, "Lightweight Directory Access Protocol (v3):
 UTF-8 String Representation of Distinguished Names."
 
-{{I:How is the information accessed?}}
+{{How is the information accessed?}}
 LDAP defines operations for interrogating and updating the directory.
 Operations are provided for adding and deleting
 an entry from the directory, changing an existing entry, and changing the
@@ -119,7 +120,7 @@ string {{EX:Acme}} in their name, and that have a fax number. LDAP lets
 you do this too. The next section describes in more detail what you can
 do with LDAP and how it might be useful to you.
 
-{{I:How is the information protected from unauthorized access?}}
+{{How is the information protected from unauthorized access?}}
 Some directory services provide no protection, allowing anyone to see
 the information. LDAP provides a method for a client to authenticate,
 or prove its identity to a directory server, paving the way for rich
@@ -128,7 +129,7 @@ access control to protect the information the server contains.
 
 H2: How does LDAP work?
 
-LDAP directory service is based on a {{I:client-server}} model. One or more
+LDAP directory service is based on a {{client-server}} model. One or more
 LDAP servers contain the data making up the LDAP directory tree. An LDAP
 client connects to an LDAP server and asks it a question. The server
 responds with the answer and/or with a pointer to where the client can
@@ -141,51 +142,77 @@ a global directory service, like LDAP.
 
 H2: What is slapd and what can it do?
 
-{{I:Slapd}} is an LDAP directory server that runs on many different
+{{slapd}} is an LDAP directory server that runs on many different
 platforms. You can use it to provide a directory service of your very own.
 Your directory can contain pretty much anything you want to put in it. You
 can connect it to the global LDAP directory service, or run a service all by
 yourself. Some of slapd's more interesting features and capabilities include:
 
-{{B:Choice of databases}}: {{I:Slapd}} comes with a variety of different
+{{B:LDAPv2}} and {{B:LDAPv3}}: {{slapd}} supports both version 2 and 3
-backend databases you can choose from. They include LDBM, a high-performance
+of the {{TERM[expand]LDAP}}.  {{slapd}} provides support
-disk-based {{embedded}} database; SHELL, a database interface to arbitrary
+for the latest features while maintaining interoperability with existing
-shell scripts; and PASSWD, a simple password file database.
+clients.  {{slapd}} supports both IPv4 and IPv6 protocols.
 
-{{B:Multiple database instances}}: {{I:Slapd}} can be configured to serve 
+{{B:{{TERM[expand]SASL}}}}: {{slapd}} supports
-multiple databases at the same time. This means that a single {{I:slapd}}
+strong authentication services through the use of SASL.  {{slapd}}'s
+SASL implementation utilizes {{PRD:Cyrus}} software which supports
+a number of mechanisms including DIGEST-MD5, EXTERNAL, and GSSAPI.
+
+{{B:{{TERM[expand]TLS}}}}: {{slapd}} provides privacy and 
+integrity protections through the use of TLS (or SSL).  {{slapd}}'s
+TLS implementation utilizes {{PRD:OpenSSL}} software.
+
+{{B:Access control}}: {{slapd}} provides a rich and powerful access 
+control facility, allowing you to control access to the information 
+in your database(s). You can control access to entries based on 
+LDAP authorization information, {{TERM:IP}} address, domain name
+and other criteria.
+{{slapd}} supports both {{static}} and {{dynamic}} access control
+information.
+
+{{B:Internationalization}}: {{slapd}} supports Unicode and language
+tags.
+
+{{B:Choice of databases}}: {{slapd}} comes with a variety of different
+backend databases you can choose from. They include
+{{TERM:LDBM}}, a high-performance disk-based {{embedded}} database;
+SHELL, a database interface to arbitrary shell scripts; and
+PASSWD, a simple password file database.  LDBM utilizes either
+{{PRD:BerkeleyDB}} or {{PRD:GDBM}}.
+
+{{B:Multiple database instances}}: {{slapd}} can be configured to serve 
+multiple databases at the same time. This means that a single {{slapd}}
 server can respond to requests for many logically different portions 
 of the LDAP tree, using the same or different backend databases.
 
-{{B:Generic database API}}: If you require even more customization,
+{{B:Generic modules API}}: If you require even more customization,
-{{I:slapd}} lets you write your own backend database easily. {{I:Slapd}} 
+{{slapd}} lets you write your own modules easily. {{slapd}} 
 consists of two distinct parts: a front end that handles protocol 
-communication with LDAP clients; and a backend that handles database 
+communication with LDAP clients; and modules which handles specific
-operations. Because these two pieces communicate via a well-defined 
+tasks such as database operations. Because these two pieces communicate
-C API, you can write your own customized database backend to {{I:slapd}}.
+via a well-defined C API, you can write your own customized modules
-A number of {{programmable}} backends are also provided.
+which extend {{slapd}} in numerous ways.  Also, a number of
+{{programmable database}} modules are provided.  These allowing you
+to expose external data sources to {{slapd}} using popular programming
+languages ({{PRD:Perl}}, {{Shell}}, {{PRD:SQL}}, and {{PRD:TCL}}.
 
-{{B:Access control}}: {{I:Slapd}} provides a rich and powerful access 
+{{B:Threads}}: {{slapd}} is threaded for high performance. A 
-control facility, allowing you to control access to the information 
+single multi-threaded {{slapd}} process handles all incoming 
-in your database(s). You can control access to entries based on 
+requests, reducing the amount of system overhead required.
-LDAP authentication information, IP address, domain name and other criteria.
 
-{{B:Threads}}: {{I:Slapd}} is threaded for high performance. A 
+{{B:Replication}}: {{slapd}} can be configured to maintain replica 
-single multi-threaded {{I:slapd}} process handles all incoming 
+copies of its database. This {{single-master/multiple-slave}}
-requests, reducing the amount of system overhead required. {{I:Slapd}}
+replication scheme is vital in high-volume environments where a
-will automatically select the best thread support for your platform.
+single {{slapd}} just doesn't provide the necessary availability
+or reliability.  {{slapd}}
+also includes experimental support for {{multi-master}} replication.
 
-{{B:Replication}}: {{I:Slapd}} can be configured to maintain replica 
+{{B:Configuration}}: {{slapd}} is highly configurable through a 
-copies of its database. This master/slave replication scheme is 
-vital in high-volume environments where a single {{I:slapd}} just 
-doesn't provide the necessary availability or reliability.
-
-{{B:Configuration}}: {{I:Slapd}} is highly configurable through a 
 single configuration file which allows you to change just about 
 everything you'd ever want to change.  Configuration options have 
 reasonable defaults, making your job much easier.
 
-{{I:Slapd}} also has its limitations, of course. The main LDBM
+{{slapd}} also has its limitations, of course. The main LDBM
 database backend does not handle range queries or negation queries
 very well. These features and more will be coming in a future release.
 
@@ -193,33 +220,34 @@ very well. These features and more will be coming in a future release.
 
 H2: What about X.500?
 
-Technically, LDAP is a directory access protocol to an X.500 directory
+Technically, LDAP is a directory access protocol to an {{TERM:X.500}}
-service, the OSI directory service.  Initial LDAP servers were
+directory service, the {{TERM:OSI}} directory service.  Initial
-were gateway between LDAP and the X.500 Directory Access Protocol (DAP).
+LDAP servers were were gateway between LDAP and the X.500
-DAP is a heavyweight protocol that runs over a full OSI stack and
+{{TERM[expand]DAP}} (DAP).
-requires a significant amount of computing resources to run. LDAP
+DAP is a heavyweight protocol that runs over a full OSI protocol stack
-runs directly over TCP and provides most of the functionality of DAP
+and requires a significant amount of computing resources to run.
-at a much lower cost.
+LDAP is designed to operate over {{TERM:TCP}}/{{TERM:IP}} and provides
+most of the functionality of DAP at a much lower cost.
 
 This use of LDAP makes it easy to access the X.500 directory, but still
 requires a full X.500 service to make data available to the many LDAP
 clients being developed. As with full X.500 DAP clients, a full X.500
 DAP server is no small piece of software to run.
 
-The stand-alone LDAP daemon, or {{I:slapd}}(8), is meant to remove much
+The stand-alone LDAP daemon, or {{slapd}}(8), is meant to remove much
 of the burden from the server side just as LDAP itself removed much of
 the burden from clients. If you are already running an X.500 DAP service
 and you want to continue to do so, you can probably stop reading this
-guide, which is all about running LDAP via {{I:slapd}}, without running
+guide, which is all about running LDAP via {{slapd}}, without running
 X.500 DAP. If you are not running X.500 DAP, want to stop running
 X.500 DAP, or have no immediate plans to run X.500 DAP, read on.
 
-It is possible to replicate data from a {{I:slapd}} directory 
+It is possible to replicate data from a {{slapd}} directory 
-server to a X.500 DSA, which allows your organization to make your 
+server to a X.500 {{TERM:DSA}}, which allows your organization to
-data available as part of the global X.500 DAP directory service
+make your data available as part of the global X.500 DAP directory
-on a "read-only" basis. This is discussed in section 11.6.
+service on a "read-only" basis. This is discussed in section 11.6.
 
-Another way to make data in a {{I:slapd}} server available to the
+Another way to make data in a {{slapd}} server available to the
 X.500 community would be by using a X.500 DAP to LDAP gateway. At
 this time, no such software has been written (to the best of our
 knowledge), but hopefully some group will see fit to write such a
@@ -228,11 +256,11 @@ gateway.
 
 H2: What is slurpd and what can it do?
 
-{{I:Slurpd}}(8) is a daemon that helps {{I:slapd}} provide 
+{{slurpd}}(8) is a daemon that helps {{slapd}} provide 
 replicated service. It is responsible for distributing changes made 
-to the master {{I:slapd}} database out to the various {{I:slapd}} 
+to the master {{slapd}} database out to the various {{slapd}} 
-replicas. It frees {{I:slapd}} from having to worry that some
+replicas. It frees {{slapd}} from having to worry that some
 replicas might be down or unreachable when a change comes through;
-{{I:slurpd}} handles retrying failed requests automatically. 
+{{slurpd}} handles retrying failed requests automatically. 
-{{I:Slapd}} and {{I:slurpd}} communicate through a simple text 
+{{slapd}} and {{slurpd}} communicate through a simple text 
 file that is used to log changes.