#BASE   dc=example, dc=com 
#HOST   ldap.example.com ldap-master.example.com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15 
#DEREF          never

# SSL/TSL configuration. With CA-signed certs, TLS_REQCERT should be
# "demand", with the CA certificate accessible 
#TLS_REQCERT    ([demand],never,allow,try)
# We ship with allow by default as some LDAP clients (e.g. evolution) have
# no interactive SSL configuration

TLS_REQCERT     allow

# CA Certificate locations 
# Use the default self-signed cert generated by openldap-server postinstall
# by default 
#TLS_CACERT      /etc/pki/tls/certs/ldap.pem
#TLS_CACERT     /etc/ssl/openldap/ldap.mageia.org.pem

# If requiring support for certificates signed by all CAs (noting risks
# pam_ldap if doing DNS-based suffix lookup etc.
#TLS_CACERTDIR  /etc/pki/tls/rootcerts