###########################################################################
#
#                    PopProxyAService Config File
#
# When PopProxyAService reads this config file, it looks for the 
#   section that corresponds to its instance name (given in AService.cfg).
#
# You may specify an alternate config file in AService.cfg by 
#   giving an instance name of the form: FILE [ "|" SECTION ].  Otherwise,
#   instance name is read as: FILE, and the section "default" is read.
# 
# The format of each non-comment line is:
#
#   SECTION:KEY VALUE*
#
# Some parameters are listed with their default values, to reconfigure, 
#   it may be necessary to uncomment a config line
#
###########################################################################

#
# LdapUrl is the site's domain (DC) directory server tree.  
#  ldaps is supported, but the ssl config below must also be correct.
#  To enable failover, the hostpart of the url may be a space-separated
#  list of hosts e.g. "ldap://ldap1 ldap2/o=internet".  The port
#  389 is not necessary, as it is the default.
#
default:LdapUrl "ldap://<local.ugldaphost>/<msg.dctree.Suffix.1>"

#
# BaseDN for the user/group tree in the directory.  Used to look up
#  the email address from a client certificate.
#
default:UserGroupDN "<local.ugldapbasedn>"

# 
# LogDir is the directory where PopProxyAService writes log files
# LogLevel controls the verbosity of the logging
#
default:LogDir <msg.RootPath>/data/log
#default:LogLevel 1

#
# BindDN and BindPass are the credentials used to bind to directory
#   to do searches.  Using "cn=Directory Manager" is overkill, but will 
#   always work.  A more restricted user with read-only privileges is
#   recommended.  Note that the ability to fetch the userPassword attribute
#   is required to support CRAM-MD5 or APOP.
#
default:BindDN   "uid=msg-admin-<msg.ServerHostName>-<msg.product.InstallationTimestamp>, ou=People, <deforgdn>"
default:BindPass "<msg.enduser.AdminPassword>"

#
# Backside port is the port on which the store servers listen, and 
#   to which the PopProxy should connect
#
#default:BacksidePort 110

#
# Session protocol timeout.
#
#default:Timeout 1800

#
# LDAP operation timeout (in seconds)
#
#default:LDAPTimeout 25

#
# LDAP refresh interval (in seconds)
#  This specifies how long to reuse an LDAP connection before it is
#  closed.  The default is 35 minutes.
#
#default:LDAPRefreshInterval 2100

#
# Banner override
#
#default:Banner

#
# "SearchFormat" dictates how the PopProxy will search directory.  It is a 
#   printf-style string.  The following substitutions are made:
#
#  "%s" - userid+virtualdomain (with CanonicalVirtualDomainDelim)
#  "%U" - userid only
#  "%V" - virtual domain only
#  "%C" - client IP address 
#  "%S" - server IP address
#  "%D" - client cert DN 
#
# If any of these are not applicable (can't be determined, or aren't 
#   available), they are replaced by "*".  The default is "(uid=%s)".
#	
#default:SearchFormat (uid=%s)

#
# if a user's server is unavailable, the MMP can present a phony inbox with
#    one message in it.  This file is that message. It must be in 
#    RFC822 format, have CRLF line termination and be dot-stuffed.
#
#default:SpoofMessageFile

#
# SSL configuration
#
#  Enable SSL from client to MMP with this:
#default:SSLEnable         yes
#default:SSLPorts          995
#default:SSLCertNicknames  Server-Cert
#  Password File for SSL server keys:
#default:SSLKeyPasswdFile  <msg.RootPath>/config/sslpassword.conf
#  Where SSL session cache, secmod, cert, and key files are located:
#default:SSLCacheDir       <msg.RootPath>/config
#  Customizable SSL security module database file name:
#default:SSLSecmodFile     secmod.db
#  Customizable SSL cert7.db and key3.db file prefixes:
#default:SSLCertPrefix     ""
#default:SSLKeyPrefix      ""
#  Use SSL on this port when talking to the backend server (0 = don't use SSL)
#default:SSLBacksidePort   995

#
# VirtualDomain config 
#
#default:VirtualDomainFile <msg.RootPath>/config/vdmap.cfg

#
# list of valid delimiters
# 
#default:VirtualDomainDelim @

#
# canonical delimiter
#
#default:CanonicalVirtualDomainDelim @


#
# list of attributes (space separated) to try as user's store server
#
#default:MailHostAttrs mailHost

#
# certmap file (for SSL client-cert-based authentication)
#
#default:CertMapFile

#
# proxyauth credentials, necessary for client-cert-based auth
#
#default:StoreAdmin
#default:StoreAdminPass

#
# whether to pre-authenticate sessions before forwarding to store server
#
#default:PreAuth no

#
# How the Proxy reconstructs a userid for playback to store server.
#  It is a printf-style string.  The following substitutions are made:
#
#  "%V" - Virtual Domain Name
#  "%U" - userid only
#  "%A[ATTR]" - the value of the user attribute ATTR
#
#default:ReplayFormat

#
# whether Challenge-Response Authentication is enabled (CRAM-MD5 and APOP)
#
#default:CRAMs no

#
# whether to require SSL/STLS prior to allowing plaintext passwords
#
#default:RestrictPlainPasswords no

#
# AuthCache config (applicable only for PreAuth), defaults listed
#
#default:AuthCacheSize 10000
#default:AuthCacheTTL 900

#
# AuthService config (for POPb4SMTP), defaults off.
#
#default:AuthService no
#default:AuthServiceTTL -1

#
# BadGuys config
#
#default:BGMax        10000
#default:BGPenalty    2
#default:BGMaxBadness 60
#default:BGDecay      900
#default:BGLinear     no
#default:BGExcluded   <msg.RootPath>/config/bgexcl.cfg

#
# ConnLimits this can either be a comma-separated list of entries of 
#  the form:
#
#   IP "|" MASK ":" NUM
#
# or the name of a file containing one of the above entries per line, 
#  most specific IP-MASK pairs to least specific
#
default:ConnLimits 0.0.0.0|0.0.0.0:20

#
# LdapCache config
#
#default:LdapCacheSize 10000
#default:LdapCacheTTL 900

#
# TCPAccess (global)
#
#default:TCPAccess

#
# TCPAccess (per-user)
#
#default:TCPAccessAttr

#
# do HostedDomains (if not specified, defaults on) 
#
#default:HostedDomains yes

#
# default HostedDomain (NULL default)
#
default:DefaultDomain <local.defdomain>
