Directory Server Campus Booster ID: 351 Copyright © SUPINFO. All rights reserved OpenLDAP.
-
Upload
jonas-walton -
Category
Documents
-
view
221 -
download
4
Transcript of Directory Server Campus Booster ID: 351 Copyright © SUPINFO. All rights reserved OpenLDAP.
Directory Server
Campus Booster ID: 351
www.supinfo.com
Copyright © SUPINFO. All rights reserved
OpenLDAP
Course objectivesOpenLDAP
Know what directory server are.
Know what is OpenLDAP.
Know how to install and configure OpenLDAP.
By completing this course, you will :
Course topicsOpenLDAP
Directories. Which purposes.
LDAP. Theory and protocol.
OpenLDAP. Practice.
Course’s plan :
The yellow pagesDirectories
Mapping "name" to “telephone number"
Sort by category
Sort by city
Find the information
As fast as possible
A database ?Directories
A database ? Not exactly.
Arborescent structure
Like a filesystem
No limit on attributes
No columns, no tables
Optimized for read and search operations
HistoryDirectories
X.500
OSI Directory Access Protocol
Created by telecom operators
Created in 1988
Impossible to port on micro-computers
Not compatible with TCP/IP( OSI )
LDAPv3 advantagesLDAP v3
SASL (single-sign-on) authentification
SSL/TLS encryption
Schemas discovery
Data modelLDAP v3
Defines the type of stored data
An entry is an LDAP object
It contains some attributes
An attribute match a data type
An attribute can have multiple values
Directory
AttributesLDAP v3
Two kinds of attributes :
User attributes
System attributes
Easy to remember names :
Cn : Common Name
userPassword : Password
objectClass : Class of the object
Naming conventionLDAP v3
Directory Information Tree (DIT) creation
Organizes the entries
Defines inheritances
The DIT is important, it must reflect the reality
Server sideOpenLDAP
The daemon is slapd
Standalone LDAP Daemon
Replication daemon : slurpd
Standalone LDAP Update Replication Daemon
The configuration file is slapd.conf
Located in : /etc/openldap
Slapd.confOpenLDAP
Important statements :
include file : include a schema
database type : may be bdb, ldbd, ...
suffix path : our tree suffix
rootdn path : Who is root ?
rootpw secret : the root password !
pidfile : file holding the server PID
argfile : file holding default server arguments.
ExampleOpenLDAP
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/inetorgperson.schema
database bdb
suffix "c=FR, o=Labo-linux"
rootdn "cn=admin,c=FR,o=Labo-linux"
rootpw {SSHA}ZKKuqbEKJfKSXhUbHG3fG8MDn9j1v4QN
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/inetorgperson.schema
database bdb
suffix "c=FR, o=Labo-linux"
rootdn "cn=admin,c=FR,o=Labo-linux"
rootpw {SSHA}ZKKuqbEKJfKSXhUbHG3fG8MDn9j1v4QN
ACLOpenLDAP
Restrict access to attributes
access to <what>
by <who> <access type>
access to <what>
by <who> <access type>
access to attr=userPassword
by self write
by anonymous auth
by dn.base="cn=Admin,dc=example,dc=com" write
by * none
access to attr=userPassword
by self write
by anonymous auth
by dn.base="cn=Admin,dc=example,dc=com" write
by * none
ACLOpenLDAP
*
Anonymous
Self
Everybody
Anonymous users
User associated with concerned attribute
dn.style=<regex> User matching the regex
<what>
Object name
* means all objects.
<who>
ACLOpenLDAP
base
One
Subtree
dn.style=<regex>
style:
Exact matching
One child below matching expression
Subtree beginning with matching expression
Children Like subtree but excluding matching head
ACLOpenLDAP
Example :
0: o=suffix
1: cn=Manager,o=suffix
2: ou=people,o=suffix
3: uid=kdz,ou=people,o=suffix
4: cn=addresses,uid=kdz,ou=people,o=suffix
5: uid=hyc,ou=people,o=suffix
dn.base="ou=people,o=suffix"
dn.one="ou=people,o=suffix"
dn.subtree="ou=people,o=suffix"
2
3, 5
2,3,4,5
dn.children="ou=people,o=suffix" 3,4,5
ACLOpenLDAP
None
Auth
Search
Permissions
<access type> :
No rights at all
Requiered to authentificate
Apply search filters
Read Reading data
Write Writing data
Data addingOpenLDAP
LDIF files
Contains structured data
Added with the ldapadd command
# ldapadd -D 'cn=Manager,o=Labo-linux' -W -f file.ldif
# ldapadd -D 'cn=Manager,o=Labo-linux' -W -f file.ldif
LDIF FilesOpenLDAP
dn: o=Labo-linux
objectclass: organization
o: Labo-linux
dn: o=Labo-linux
objectclass: organization
o: Labo-linux
dn: ou=Ressources, o=Labo-linux
objectclass: organizationalUnit
ou: Ressources
description: Ressources de l'organisation
dn: ou=Ressources, o=Labo-linux
objectclass: organizationalUnit
ou: Ressources
description: Ressources de l'organisation
Starting serverOpenLDAP
Add a special user for LDAP for security purposes.
And then look at the logs ...
# slapd -u ldapuser -g ldapgroup \
> -h 'ldap://localhost/'
# slapd -u ldapuser -g ldapgroup \
> -h 'ldap://localhost/'
# tail /var/log/ldap/ldap.log# tail /var/log/ldap/ldap.log
Course SummaryOpenLDAP
What is directoryWhat is
directory LDAPLDAPOpenLDAPOpenLDAP
AdministrationAdministration
For moreOpenLDAP
CoursesPublications
Web sites
www.openldap.org
-Kerberos
Conferences
www.labo-linux.org
http://www.oreilly.com/catalog/ldapsa/