#
# Ldap entries regardless of schema type for the PAB (personal address book)
# tree.
#
# This ldif file is invoked during the second phase of the installer
# i.e. by the devsetup program for developer install, or by the configure
#      program for the full habanero installer
#
# TODO: split this file into cfgldap and ugldap entries, because those
#   maybe separate directories
#
# For every ldap entry I want to create in the directory (i.e. the
#  DN and its attribute/values). I need several ldif entries:
#  1. one ldif entry for adding the DN in case it does not exist
#  2. one ldif entry for each attribute/value pair regardless of whether
#     it is a "add" or "replace" operation. 
#  3. one ldif entry to do a "delete" if you want the existing attribute
#     to be deleted first, and there are multiple values to add for that
#     attribute. I.e. to "replace" the existing attribute with
#     new values.
#  Instead of a "delete" and "add", you could do "replace" if there is
#  only a single value for the attribute.
#
#  Aside:
#     I realize that I can combine the replace operation for an attribute
#     into a single ldif entry since, replace will not fail if the attribute
#     does not exist. But it is just more flexible to handle each 
#     attribute/value pair individually in case, there are different
#     behaviors for upgrade/uninstall, or if you want to change it to add
#     later. 
#      
# NOTE
# - so be very careful when editing an ldif entry. Be aware that there 
#   may be an attribute of the same name at the same DN. 
#
# This file originally tried to delete all the DNs, but that is a fruitless
# exercise since there is no way to delete a DN and all its leaves.
#
# attributes that have multiple values (i.e. use multiple add ldif entries,
#  instead of a single replace ldif entry)
# - aci
# - nsSSL3Ciphers
#
#--------------------------------------------------
# pab suffix
#--------------------------------------------------

########################################
# dn: <local.service.pab.ldapbasedn>
# Originally from iMS 5.2: msg.ugldap.pab.inf
########################################

# pab suffix was created by dssetup
dn: <local.service.pab.ldapbasedn>
changetype: modify
add: aci
aci: (target="ldap:///<local.service.pab.ldapbasedn>")
 (targetattr="*")
 (version 3.0; acl "PAB Administrator access rights"; allow (all) groupdn="ldap:///cn=Messaging End User Administrators Group, ou=Groups, <local.ugldapbasedn>";)

