#
# Schema 2 native ldap entries.
#
# This ldif file is invoked during the second phase of the installer
# i.e. by the devsetup program for developer install, or by the configure
#      program for the full habanero installer
#
# For every ldap entry I want to create in the directory (i.e. the
#  DN and its attribute/values). I need several ldif entries:
#  1. one ldif entry for adding the DN in case it does not exist
#  2. one ldif entry for each attribute/value pair regardless of whether
#     it is a "add" or "replace" operation. 
#  3. one ldif entry to do a "delete" if you want the existing attribute
#     to be deleted first, and there are multiple values to add for that
#     attribute. I.e. to "replace" the existing attribute with
#     new values.
#  Instead of a "delete" and "add", you could do "replace" if there is
#  only a single value for the attribute.
#
#  Aside:
#     I realize that I can combine the replace operation for an attribute
#     into a single ldif entry since, replace will not fail if the attribute
#     does not exist. But it is just more flexible to handle each 
#     attribute/value pair individually in case, there are different
#     behaviors for upgrade/uninstall, or if you want to change it to add
#     later. 
#      
# NOTE
# - so be very careful when editing an ldif entry. Be aware that there 
#   may be an attribute of the same name at the same DN. 
#
# This file originally tried to delete all the DNs, but that is a fruitless
# exercise since there is no way to delete a DN and all its leaves.
#
# attributes that have multiple values (i.e. use multiple add ldif entries,
#  instead of a single replace ldif entry)
# - aci
# - nsSSL3Ciphers
#
#--------------------------------------------------
# user/group suffix
#--------------------------------------------------

########################################
# dn: <local.ugldapbasedn>
# Originally from iMS 5.2: msg.ugldap.orgtree.inf
########################################

# user/group suffix was already created by dssetup
#     attribute of objectclass organization
# thus user/group suffix must be of an objectclass that has description for
# an attribute
dn: <local.ugldapbasedn>
changetype: modify
replace: description
description: top level node in the Organization tree

#     attribute of objectclass top
# Originally from iMS 5.2: msg.ugldap.enduser.admin.inf
dn: <local.ugldapbasedn>
changetype: modify
add: aci
aci: (target="ldap:///<local.ugldapbasedn>")
 (targetattr="*")
 (version 3.0; acl "Messaging Server End User Administrator Read Access Rights - product=SOMS,schema 2 support,class=installer,num=1,version=1"; allow (read,search) groupdn="ldap:///cn=Messaging End User Administrators Group, ou=Groups, <local.ugldapbasedn>";)

#     attribute of objectclass top
dn: <local.ugldapbasedn>
changetype: modify
add: aci
aci: (target="ldap:///<local.ugldapbasedn>")
 (targetattr="objectclass||mailalternateaddress||mailautoreplymode||mailprogramdeliveryinfo||nswmextendeduserprefs||preferredlanguage||maildeliveryoption||mailforwardingaddress||mailAutoReplyTimeout||mailautoreplytextinternal||mailautoreplytext||vacationEndDate||vacationStartDate||mailautoreplysubject||pabURI||maxPabEntries||mailMessageStore||mailSieveRuleSource||sunUCDateFormat||sunUCDateDeLimiter||sunUCTimeFormat")
 (version 3.0; acl "Messaging Server End User Adminstrator Write Access Rights - product=SOMS,schema 2 support,class=installer,num=2,version=1"; allow (all) groupdn="ldap:///cn=Messaging End User Administrators Group, ou=Groups, <local.ugldapbasedn>";)

#     attribute of objectclass top
dn: <local.ugldapbasedn>
changetype: modify
add: aci
aci: (targetattr="uid||ou||owner||mail||mailAlternateAddress||mailEquivalentAddress||memberOf||inetuserstatus||mailuserstatus||memberOfManagedGroup||mailQuota||mailMsgQuota||inetSubscriberAccountId||dataSource||mailhost||mailAllowedServiceAccess||pabURI||inetCOS||mailSMTPSubmitChannel||aci")
 (targetfilter=(objectClass=inetMailUser))
 (version 3.0; acl "Deny write access to users over Messaging Server protected attributes - product=SOMS,schema 2 support,class=installer,num=3,version=1 "; deny (write) userdn = "ldap:///self";)

########################################
# dn: ou=Groups, <local.ugldapbasedn>
# Originally from iMS 5.2: msg.ugldap.orgtree.inf
########################################

# creates dn if it does not exist
dn: ou=Groups, <local.ugldapbasedn>
changetype: add
objectClass: top
objectClass: organizationalunit

# objectclass organizationalunit
dn: ou=Groups, <local.ugldapbasedn>
changetype: modify
add: objectClass
objectClass: organizationalunit

########################################
# dn: cn=Service Administrators, ou=Groups, <local.ugldapbasedn>
# Originally from iMS 5.2: msg.ugldap.orgtree.inf
########################################

# creates dn if it does not exist
dn: cn=Service Administrators, ou=Groups, <local.ugldapbasedn>
changetype: add
objectclass: top
objectclass: groupOfUniqueNames

# objectclass groupOfUniqueNames
dn: cn=Service Administrators, ou=Groups, <local.ugldapbasedn>
changetype: modify
add: objectclass
objectclass: groupOfUniqueNames

# objectclass iplanet-am-managed-static-group
dn: cn=Service Administrators, ou=Groups, <local.ugldapbasedn>
changetype: modify
add: objectclass
objectclass: iplanet-am-managed-static-group

#     attribute of objectclass groupOfUniqueNames
# Originally from iMS 5.2: msg.ugldap.orgtree.serviceadmin.inf
dn: cn=Service Administrators, ou=Groups, <local.ugldapbasedn>
changetype: modify
add: uniquemember
uniquemember: uid=admin, ou=People,
 <deforgdn>

########################################
# dn: cn=Messaging End User Administrators Group,
#     ou=Groups, <local.ugldapbasedn>
# Originally from iMS 5.2: msg.ugldap.enduser.admin.inf
########################################

# creates dn if it does not exist
dn: cn=Messaging End User Administrators Group,
 ou=Groups, <local.ugldapbasedn>
changetype: add
objectClass: top
objectClass: groupofuniquenames

# objectclass groupofuniquenames
dn: cn=Messaging End User Administrators Group,
 ou=Groups, <local.ugldapbasedn>
changetype: modify
add: objectclass
objectClass: groupofuniquenames

# objectclass iplanet-am-managed-static-group
dn: cn=Messaging End User Administrators Group,
 ou=Groups, <local.ugldapbasedn>
changetype: modify
add: objectclass
objectClass: iplanet-am-managed-static-group

#     attribute of objectclass groupofuniquenames
dn: cn=Messaging End User Administrators Group,
 ou=Groups, <local.ugldapbasedn>
changetype: modify
add: uniqueMember
uniqueMember: uid=msg-admin-<msg.ServerHostName>-<msg.product.InstallationTimestamp>,
 ou=People, <deforgdn>

########################################
# dn: <deforgdn>
# Originally from iMS 5.2 : msg.ugldap.orgtree.deforg.inf
########################################

# creates dn if it does not exist
dn: <deforgdn>
changetype: add
objectClass: top
objectClass: organization

# objectclass organization
dn: <deforgdn>
changetype: modify
add: objectClass
objectClass: organization

# objectclass sunManagedOrganization
dn: <deforgdn>
changetype: modify
add: objectClass
objectClass: sunManagedOrganization

# objectclass sunNameSpace
dn: <deforgdn>
changetype: modify
add: objectClass
objectClass: sunNameSpace

# objectclass mailDomain
dn: <deforgdn>
changetype: modify
add: objectClass
objectClass: mailDomain

#  attribute of objectclass sunNameSpace
dn: <deforgdn>
changetype: modify
add: sunNameSpaceUniqueAttrs
sunNameSpaceUniqueAttrs: uid

#  attribute of objectclass sunManagedOrganization
dn: <deforgdn>
changetype: modify
replace: sunPreferredDomain
sunPreferredDomain: <local.defdomain>

#  attribute of objectclass sunManagedOrganization
dn: <deforgdn>
changetype: modify
replace: inetDomainStatus
inetDomainStatus: active

#  attribute of objectclass mailDomain
dn: <deforgdn>
changetype: modify
replace: mailDomainStatus
mailDomainStatus: active

#  attribute of objectclass mailDomain
dn: <deforgdn>
changetype: modify
replace: preferredMailHost
preferredMailHost: <msg.ServerHostName>

########################################
# dn: ou=People, <deforgdn>
# Originally from iMS 5.2 : msg.ugldap.orgtree.deforg.inf
########################################

# creates dn if it does not exist
dn: ou=People, <deforgdn>
changetype: add
objectClass: top
objectClass: organizationalUnit

# objectClass organizationalUnit
dn: ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: organizationalUnit

# objectClass iplanet-am-managed-people-container
dn: ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: iplanet-am-managed-people-container

########################################
# dn: ou=Groups, <deforgdn>
# Originally from iMS 5.2 : msg.ugldap.orgtree.deforg.inf
# QQQ does this need to be created before acis refer to it?
########################################

# creates dn if it does not exist
dn: ou=Groups, <deforgdn>
changetype: add
objectClass: top
objectClass: organizationalUnit

# objectClass organizationalUnit
dn: ou=Groups, <deforgdn>
changetype: modify
add: objectClass
objectClass: organizationalUnit

# objectClass iplanet-am-managed-group-container
dn: ou=Groups, <deforgdn>
changetype: modify
add: objectClass
objectClass: iplanet-am-managed-group-container

########################################
# dn: uid=admin, ou=People, <deforgdn>
# This is for the store administrator
########################################

# creates dn if it does not exist
dn: uid=admin, ou=People, <deforgdn>
changetype: add
objectClass: top
objectClass: person
objectClass: inetorgperson
objectclass: iplanet-am-managed-person
cn: Store Administrator
sn: Administrator

# objectClass: person
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: person
objectClass: inetorgperson
objectclass: iplanet-am-managed-person
-
add: cn
#     attribute for objectclass person
# MUST attribute
cn: Store Administrator
-
add: sn
#     attribute for objectclass person
# MUST attribute
sn: Administrator

#     attribute of objectClass person
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace: userPassword
userPassword: <admin.password>

# objectClass organizationalPerson
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: organizationalPerson

# objectClass inetOrgPerson
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: inetOrgPerson

# objectClass iplanet-am-managed-person
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: iplanet-am-managed-person

#     attribute of objectClass inetOrgPerson
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace:initials 
initials: SA

#     attribute of objectClass inetOrgPerson
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace: givenName
givenName: Store

#     attribute of objectClass inetOrgPerson
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace: mail
mail: Store.Administrator@<local.defdomain>

# objectClass inetUser
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: inetUser

#     attribute of objectclass inetUser
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace: inetUserStatus
inetUserStatus: active

#     attribute of objectclass inetUser
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace: memberOf
memberOf: cn=Service Administrators,ou=Groups,<local.ugldapbasedn>

# objectClass ipUser
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: ipUser

# objectClass userPresenceProfile
# QQQ no attributes added?
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: userPresenceProfile

# objectClass inetMailUser
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: inetMailUser

#     attribute of objectClass inetMailuser
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace: mailDeliveryOption
mailDeliveryOption: mailbox

#     attribute of objectClass inetMailuser
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace: datasource
datasource: Sun ONE Messaging Server Installer

#     attribute of objectClass inetMailuser
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace: mailUserStatus
mailUserStatus: active

#     attribute of objectClass inetMailuser
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace: mailQuota
mailQuota: -1

#     attribute of objectClass inetMailuser
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace: mailMsgQuota
mailMsgQuota: -1

# objectClass inetLocalMailRecipient
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: inetLocalMailRecipient

#     attribute of objectClass inetLocalMailRecipient
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
replace: mailHost
mailHost: <msg.ServerHostName>

# objectClass iplanet-am-managed-person
dn: uid=admin, ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: iplanet-am-managed-person

########################################
# dn: cn=Postmaster,ou=Groups,<deforgdn>
# Originally from iMS 5.2: msg.ugldap.orgtree.postmaster.inf
########################################

# creates dn if it does not exist
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: add
objectClass: top
objectClass: groupOfUniqueNames

# objectClass groupOfUniqueNames
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
add: objectClass
objectClass: groupOfUniqueNames

# objectClass iplanet-am-managed-static-group
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
add: objectClass
objectClass: iplanet-am-managed-static-group

# objectClass inetMailGroup
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
add: objectClass
objectClass: inetMailGroup

#     attribute of inetMailGroup
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
replace: dataSource
dataSource: Sun ONE Messaging Server Installer

#     attribute of inetMailGroup
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
replace: inetMailGroupStatus
inetMailGroupStatus: active

#     attribute of inetMailGroup
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
add: mgrpRFC822MailMember
mgrpRFC822MailMember: <msg.postmaster.username>

# objectClass inetLocalMailRecipient
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
add: objectClass
objectClass: inetLocalMailRecipient

#     attribute of objectClass inetLocalMailRecipient
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
replace: mail
mail: postmaster@<local.defdomain>

#     attribute of objectClass inetLocalMailRecipient
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
add: mailAlternateAddress
mailAlternateAddress: postmast@<local.defdomain>

# objectClass inetMailGroupManagement
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
add: objectClass
objectClass: inetMailGroupManagement

#     attribute of inetMailGroupManagement
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
replace: mgmanJoinability
mgmanJoinability: NONE

#     attribute of inetMailGroupManagement
dn: cn=Postmaster,ou=Groups,<deforgdn>
changetype: modify
replace: multiLineDescription
multiLineDescription: Postmaster group for domain <local.defdomain>

########################################
# dn: uid=msg-admin-<msg.ServerHostName>-<msg.product.InstallationTimestamp>,
#     ou=People, <deforgdn>
# Originally from iMS 5.2: msg.ugldap.enduser.admin.inf
########################################

# creates dn if it does not exist
dn: uid=msg-admin-<msg.ServerHostName>-<msg.product.InstallationTimestamp>,
 ou=People, <deforgdn>
changetype: add
objectClass: top
objectClass: person
objectClass: inetorgperson
objectclass: iplanet-am-managed-person
cn: Messaging End User Administrator
sn: Administrator

# objectClass person
dn: uid=msg-admin-<msg.ServerHostName>-<msg.product.InstallationTimestamp>,
 ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: person
objectClass: inetorgperson
objectclass: iplanet-am-managed-person
-
add: cn
#     attribute of objectClass person
# MUST attribute
cn: Messaging End User Administrator
-
add: sn
# MUST attribute
#     attribute of objectClass person
sn: Administrator

#     attribute of objectClass person
dn: uid=msg-admin-<msg.ServerHostName>-<msg.product.InstallationTimestamp>,
 ou=People, <deforgdn>
changetype: modify
replace: userPassword
userPassword: <msg.enduser.AdminPassword>

# objectClass organizationalPerson
# QQQ no attributes added?
dn: uid=msg-admin-<msg.ServerHostName>-<msg.product.InstallationTimestamp>,
 ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: organizationalPerson

# objectClass inetorgperson
dn: uid=msg-admin-<msg.ServerHostName>-<msg.product.InstallationTimestamp>,
 ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: inetorgperson

# objectClass iplanet-am-managed-person
dn: uid=msg-admin-<msg.ServerHostName>-<msg.product.InstallationTimestamp>,
 ou=People, <deforgdn>
changetype: modify
add: objectClass
objectClass: iplanet-am-managed-person

#     attribute of objectClass inetorgperson
dn: uid=msg-admin-<msg.ServerHostName>-<msg.product.InstallationTimestamp>,
 ou=People, <deforgdn>
changetype: modify
replace: givenName
givenName: Messaging End User

