# (C) 2020 Starburstdata
# Template for configuring Apache Ranger LDAP user sync for Starburstdata Presto on AWS.
# Edit this file providing values matching your LDAP server configuration and upload it
# to S3 bucket. Provide path to uploaded file as RangerUserSyncConfigFile parameter when
# configuring Starburstdata Presto in Cloud Formation Marketplace.


# Sync interval in minutes, defaults to 360.
# Type: Number
# Default: 360
# MinValue: 360
SYNC_INTERVAL=

# If provided, Ranger roles are automatically assigned based on user or group names in LDAP.
# Type: String
# Example: (assuming default delimiter values):
# ROLE_SYS_ADMIN:u:userName1,userName2&ROLE_SYS_ADMIN:g:groupName1,groupName2&ROLE_KEY_ADMIN:u:userName&ROLE_KEY_ADMIN:g:groupName
# Optional
GROUP_BASED_ROLE_ASSIGNMENT_RULES=

# Delimiter for role assignment, change if your user or group names include default delimiter.
# Type: String
# Default: &
ROLE_ASSIGNMENT_LIST_DELIMITER=

# Delimiter for role and user/groups in role assignment, change if your user or group names include default delimiter.
# Type: String
# Default: :
USERS_GROUPS_ASSIGNMENT_LIST_DELIMITER=

# Delimiter for users or groups in role assignment, change if your user or group names include default delimiter.
# Type: String
# Default: ","
USERNAME_GROUPNAME_ASSIGNMENT_LIST_DELIMITER=

# URL of source LDAP server, for example ldap://ldap.example.com:389
# Type: String
# Required
SYNC_LDAP_URL=

# Type: String
# Description: User to connect to LDAP and query for users/groups.
# Example: cn=ldapbind,ou=users,dc=example,dc=com
# Required
SYNC_LDAP_BIND_DN=

# Password for LDAP bind user.
# Type: String
# Required
SYNC_LDAP_BIND_PASSWORD=

# Search base for users and groups.
# Type: String
# Example: dc=example,dc=com
# Required
SYNC_LDAP_SEARCH_BASE=

# Search base for users, overwrites RangerUserSyncSearchBase.
# Type: String
# Example: ou=users,dc=example,dc=com
# Optional
SYNC_LDAP_USER_SEARCH_BASE=

# Search scope for users
# Type: String
# AllowedValues: base, one, sub
# Default: sub
SYNC_LDAP_USER_SEARCH_SCOPE=

# LDAP objectclass to identify user entries.
# Type: String
# Default: person
SYNC_LDAP_USER_OBJECT_CLASS=

# Additional filter for selecting users to sync.
# Type: String
# Example: (dept=sales)
# Optional
SYNC_LDAP_USER_SEARCH_FILTER=

# User attribute to treat as user name.
# Type: String
# Default: cn
SYNC_LDAP_USER_NAME_ATTRIBUTE=

# User attribute to treat as group name to be synced. You may provide multiple values, separated by commas.
# Type: String
# Default: memberof,ismemberof
SYNC_LDAP_USER_GROUP_NAME_ATTRIBUTE=

# Type of case conversion to perform on user names during sync.
# Type: String
# AllowedValues: none, lower, upper
# Default: lower
SYNC_LDAP_USERNAME_CASE_CONVERSION=

# Type of case conversion to perform on group names during sync.
# Type: String
# AllowedValues: none, lower, upper
# Default: lower
SYNC_LDAP_GROUPNAME_CASE_CONVERSION=

# If enabled, usersync will not rely on user entries to find groups to sync.
# Instead it will directly search for group entries. Useful if your LDAP does not provide
# attributes such as memberof.
# Type: String
# AllowedValues: true, false
# Default: false
SYNC_GROUP_SEARCH_ENABLED=

# If enabled, usersync will not rely on user entries to sync group membership.
# Instead it will search for group entries and sync their members. Useful if your LDAP does
# not provide attributes such as memberof.
# Type: String
# AllowedValues: true, false
# Default: false
SYNC_GROUP_USER_MAP_SYNC_ENABLED=

# Search base for groups if group search is enabled. If not specified, SYNC_LDAP_SEARCH_BASE
# is used.
# Type: String
# Optional
SYNC_GROUP_SEARCH_BASE=

# Search scope for groups if groups search is enabled.
# Type: String
# AllowedValues: base, one, sub
# Default: sub
SYNC_GROUP_SEARCH_SCOPE=

# LDAP objectclass to identify group entries if group search is enabled.
# Type: String
# Default: groupofnames
SYNC_GROUP_OBJECT_CLASS=

# Additional filter for selecting groups to sync if group search is enabled.
# Type: String
# Example: (dept=sales)
# Optional
SYNC_LDAP_GROUP_SEARCH_FILTER=

# Group attribute to treat as group name.
# Type: String
# Default: cn
SYNC_GROUP_NAME_ATTRIBUTE=

# Group attribute containing list of members, used if group sync is enabled.
# Type: String
# Default: member
SYNC_GROUP_MEMBER_ATTRIBUTE_NAME=

# Should we use paged results control while fetching data from LDAP.
# If set to false, some LDAP servers may return partial results.
# Type: String
# Allowed values: true, false
# Default: true
SYNC_PAGED_RESULTS_ENABLED=

# Number of entries to fetch from LDAP in one go if paging is enabled.
# Type: Number
# Default: 500
SYNC_PAGED_RESULTS_SIZE=

# Should we follow LDAP context referrals.
# Type: String
# AllowedValues: follow, ignore
# DefaultValue: ignore
SYNC_LDAP_REFERRAL=

