Differences between revisions 9 and 11 (spanning 2 versions)
Revision 9 as of 2006-06-07 14:12:13
Size: 6544
Editor: 213
Revision 11 as of 2006-06-19 16:06:45
Size: 58
Editor: 127
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
= Introduction =


  * "People" node where your users will be stored
  * "Groups" node where your groups will be stored

You have to first determine what the root of your LDAP will be. By default, your tree will be determined by your internet domain. If your domain is example.com (we will use it in the above example), your root will be {{{dc=example,dc=com}}}.

= Installation =

First of all, install the ldap server daemon (slapd) on the server ; install the following packages: {{{slapd}}} and {{{ldap-utils}}} (see InstallingSoftware).


Only few changes will be operated on the default configuration. First set the root password in the configuration file (instead of in the directory) by editing the file {{{/etc/ldap/slapd.conf}}}.

Don't use a cleartext password however. To generate an encrypted password first use {{{slappasswd yourpasswd}}}

$ slappasswd
New password:
Re-enter password:

This example shows what happens when using the string "secret" as the password. (By nature of the SSHA encryption scheme, your result will vary.)

Now edit {{{/etc/ldap/slapd.conf}}} and copy paste the generated string.
# Make sure you edit or add these directives after the first 'database' directive.

suffix "dc=example,dc=com"
directory "/var/lib/ldap"
rootpw {SSHA}d2BamRTgBuhC6SxC0vFGWol31ki8iq5m


= Populating LDAP =


LDAP directory can be fed with a ldif file (ldif means ldap directory interchange format). Generate this example text file {{{init.ldif}}} somewhere on your system:

dn: dc=example,dc=com
objectClass: dcObject
objectClass: organizationalUnit
dc: example
ou: Example Dot Com

objectClass: organizationalUnit
ou: people

objectClass: organizationalUnit
ou: groups

objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: lionel
sn: Porcheron
givenName: Lionel
cn: Lionel Porcheron
displayName: Lionel Porcheron
uidNumber: 1000
gidNumber: 10000
gecos: Lionel Porcheron
loginShell: /bin/bash
homeDirectory: /home/lionel
shadowExpire: -1
shadowFlag: 0
shadowWarning: 7
shadowMin: 8
shadowMax: 999999
shadowLastChange: 10877
mail: lionel.porcheron@example.com
postalCode: 31000
l: Toulouse
o: Example
mobile: +33 (0)6 xx xx xx xx
homePhone: +33 (0)5 xx xx xx xx
title: System Administrator
initials: LP

objectClass: posixGroup
cn: example
gidNumber: 10000
displayName: Example group

In the example above, the directory structure, a user and group have been setup. In other example you might see the objectClass: top added in every entry, but that is default behaviour so you don't have to add it explicitely.

Now, add your entries to the LDAP :

  * stop LDAP daemon: {{{sudo /etc/init.d/slapd stop}}}
  * delete the content that was automaticaly added at installation: {{{sudo rm -rf /var/lib/ldap/*}}}
  * add the content {{{sudo slapadd -l init.ldif }}}

We can check that the content has been correctly added with the tools from the ldap-utils package. In order to execute a search in the LDAP directory :

ldapsearch -xLLL uid=lionel sn givenName cn
cn: Lionel Porcheron
sn: Porcheron
givenName: Lionel

Just a quick explanation :
  * {{{-x}}} is because we do not use SASL authentication method (by default)
  * {{{-LLL}}} disable printing LDIF informations

= Put your LDAP server to use =

Now that it is up and running you can:

 * authenticate your users on the directory as explained in ["LDAPClientAuthentication"]
 * authenticate your users in a web application.
 * use it as a shared address directory for your mail agent.

Use of LDAP are infinite !

= LDAP replication =


== Introduction ==



== LDAP master ==

On the master, you have to modify the database section of the {{{/etc/ldap/slapd.conf}}} to add a {{{replica}}} instruction. The following example shows a replica on {{{ldap-2.example.com}}} with the Manager user with {{{secret}}} as password. The replication logfile is the place modifications are stored before they are send to the LDAP slave.


replogfile /var/lib/ldap/replog

Restart your LDAP server.

== LDAP slave ==

On the slave, you have to authorize your master to update LDAP database. Add the following lines to your {{{/etc/ldap/slapd.conf}}} file in the database section:

updatedn cn=Manager,dc=example,dc=com
updateref ldap://ldap-1.example.com

Restart your LDAP server.

= Links =

 * [http://www.openldap.org OpenLDAP website] give you lot of informations
 * [http://www.tldp.org/HOWTO/html_single/LDAP-HOWTO/ LDAP HOWTO]
 * [http://luma.sourceforge.net/] Simple gui to LDAP administration, available in repositories.
#REFRESH 0 http://help.ubuntu.com/community/OpenLDAPServer

OpenLDAPServer (last edited 2008-08-06 16:22:34 by localhost)