- name: Load and configure the syncprov overlay
  openldap: module=syncprov
            suffix=dc=fripost,dc=org
            target=etc/ldap/syncprov.ldif
            local=file

## XXX should be /etc/sasl2/slapd.conf ideally, but it doesn't work with
## Stretch, cf #211156 and #798462:
##   ldapsearch -LLLx -H ldapi:// -b "" -s base supportedSASLMechanisms
- name: Enable the EXTERNAL SASL mechanism
  lineinfile: dest=/usr/lib/sasl2/slapd.conf
              regexp='^mech_list{{':'}}'
              line='mech_list{{':'}} EXTERNAL'
              create=yes
              owner=root group=root
              mode=0644

#- name: Load dyngroup schema
#  openldap: target=/etc/ldap/schema/dyngroup.ldif

# TODO: authz constraint