OpenLDAP installation and configuration

Draft

Introduction

OpenLDAP is the most popular free LDAP server. Documentation is not obvious for beginners, i.e. it takes some time learn how to install and configure a production server.

OpenLDAP 2.x software implements version 3 of LDAP (RFC 4510)

Configuration notes for solaris 10

There is an OpenLDAP version included in a typical installation. You can find it here:

/opt/sfw
/opt/sfw/sbin  - links to binaries
/opt/sfw/libexec - binaries
/opt/sfw/etc/openldap - configuration files
/opt/sfw/var/openldap-data - default data 
/opt/sfw/var/run - PID of the server

Binaires in /opt/sfw/sbin

slapadd -> ../libexec/slapd
slapcat -> ../libexec/slapd
slapdn -> ../libexec/slapd
slapindex -> ../libexec/slapd
slappasswd -> ../libexec/slapd
slaptest -> ../libexec/slapd
slapcat -> ../libexec/slapd
slapdn -> ../libexec/slapd
slapindex -> ../libexec/slapd
slappasswd -> ../libexec/slapd
slaptest -> ../libexec/slapd

The configuration file

Location:

/opt/sfw/etc/openldap/sladpd.conf

You will have to define

• What schemas to load in
• Where datafiles and pidfile etc. go
• What users are allowed to do

Here is a fictional example (comments taken away from the original):

include		/opt/sfw/etc/openldap/schema/core.schema
include		/opt/sfw/etc/openldap/schema/cosine.schema
include		/opt/sfw/etc/openldap/schema/inetorgperson.schema
include		/opt/sfw/etc/openldap/schema/nis.schema
# Add your own
include		/opt/sfw/etc/openldap/schema/tecfa.schema

pidfile		/opt/sfw/var/run/slapd.pid
argsfile	/opt/sfw/var/run/slapd.args

security ssf=1 update_ssf=112 simple_bind=64

access to attr=userpassword
            by self write
            by anonymous auth
access to *
            by self write
            by users read
	    by anonymous read
database	bdb
# Suffix and root dn, adjust to your own organization
suffix		"o=tecfa.unige.ch"
rootdn		"uid=root, o=tecfa.unige.ch"
rootpw		secret
directory	/opt/sfw/var/openldap-data
index	objectClass	eq

You may want to put the data and schema files in some other place than the default, since you may by mistake kill them after an upgrade of the system. e.g. I used /var/openldap instead of /open/sfw/var/

Importing an LDIF file

/opt/sfw/sbin/slapadd -v -l your-ldif-file.ldif

The startup script

To start/stop automatically the server you can write a script like this, put it in /etc/init.d and then make links from /etc/rc3.d, /etc/rc0.d etc.

 ....

Notes for Ubuntu 4.1

OpenLDAP is distributed through the Synaptic Package Manager.

• The installer will ask the rootdn password.
• It also will automatically launch the LDAP server (use Menu System->Administration->Services to stop it again)

Configuration files are in:

/etc/ldap/

Operational attributes

There exist so-called operational attributes like "modifyTimestamp". They are not returned unless you specifically request it. You must also have the appropriate permission to view the attribute.

In OpenLDAP, you can ask for "+" to fetch all the operational attributes for an entry. That would look something like this:

   ldapsearch -LLL -W -D "cn=Manager,dc=example,dc=com" -b
   "cn=Christoph,ou=People,dc=dexample,dc=com" "(objectClass=*)" '+'

Or just ask for the "modifyTimestamp" attribute by name. The "+" is similar in concept to the "*" which returns all the non-operational attributes.

Testing with a client

To connect to your LDAP server, make sure that the port is open both on your client machine and the server machine. By default LDAP uses port 389.

We suggest to install "Apache Directory Studio". To configure a connection to an LDAP server: Menu->LDAP->New connection

In the Authentication tab enter:

Bind DN or user: <the root dn you defined above>

Access control

=== Via the old method

• Read 5.2 Securing the Directory (from the "Rocket scientist" manual).

Via the new method

olcAccess: to <what> [ by <who> <accesslevel> <control> ]+

is a different way of doing it

• Read the Access Control Chapter of the manual.

• Type man slapd.access

Links

• OpenLDAP Software 2.4 Administrator's Guide

• Configuring slapd (version 2.3 on Feb 2008).

• LDAP Tutorial - Exercise with OpenLDAP v2.0.11 on Linux by P. Gietz and N. Klasen (2001)