LDAP and OpenLDAP

subaruwrx · 07-20-2004, 10:37 PM

Can someone tell me in layman terms what does LDAP and OpenLDAP do?

I understand that LDAP is just a protocol right? OpenLDAP is something that helps to ease the managing of samba user accounts?

Actually what I'm trying to pick up now is Samba with OpenLDAP as told by my supervisor .

egyptian · 07-21-2004, 01:42 AM

i 'll answer you as i still biginner to openldap!!
because of the importance of the centralized authentication,companies use directory services to
have a database of all users in thier network and some information about them (fist name,last name, email address,..)
one of these directory services is ldap and its opensource version (openldap)

hob · 07-21-2004, 03:30 PM

If you install the Samba documentation on your Linux box (there may be a separate package for them), you'll find a really excellent manual in:

/usr/share/doc/<samba-version>/html

which includes how to setup Samba to use an existing LDAP service. That should cover the second part.

As Egyptian says, an LDAP service provides information on users (from it's database). This can include security information on what groups they should be member of, what they're password is etc. as well as contact information. "LDAP" is the network protocol, "OpenLDAP" is a Free implementation of the clients and server. A Kerberos service is often used in conjunction with an LDAP service to provide strong encryption to communications between the user clients and the services that they access.

An LDAP service is often both a contacts directory for mail clients and an authentication source for logins. If you are being asked to set up an LDAP service from scratch, then you need to do a fair bit of reading and planning - as the network's central authority on who users are, it's the most important service after DNS, and it requires a similar amount of effort learning the concepts.

subaruwrx · 07-23-2004, 12:45 PM

How about sharing some good links for newbie on ldap and samba with openldap?

hob · 07-24-2004, 05:43 AM

The OpenLDAP site has a good set of documentation about LDAP and setting up the service:

http://www.openldap.org/

The Samba docs I mentioned before are also available from the project's Website.

Between the two you should have enough but again, you'll have to spend a bit of time going over it to grasp the concepts of LDAP.

subaruwrx · 07-29-2004, 04:20 AM

Ok I tried editing the slapd.conf file from this guide.

Edited the slapd.conf and top.ldif as followed.

But after typing "ldapadd -x -D 'cn=manager,dc=foo,dc=com' -W -f top.ldif", it prompt me for a password. What password do I enter? cn=Manager's password?

slapd.conf file

Code:

# Schemas to use
include  /etc/openldap/schema/core.schema
include  /etc/openldap/schema/cosine.schema
include  /etc/openldap/schema/inetorgperson.schema
include  /etc/openldap/schema/nis.schema
include  /etc/openldap/schema/redhat/
rfc822-MailMember.schema
include  /etc/openldap/schema/redhat/autofs.schema
include  /etc/openldap/schema/redhat/
kerberosobject.schema

database       ldbm
suffix         "dc=foo,dc=com"
rootdn         "cn=Manager, dc=foo,dc=com"
rootpw         secret
directory      /var/lib/ldap

index   default                             eq
index   objectClass,uid,uidNumber,gidNumber eq
index   cn,mail,surname,givenname           eq,sub

# Access Control (See openldap v.2.0 Admin Guide)
access to attr=userPassword
   by self         write
   by anonymous    auth
   by dn="cn=manager,dc=foo,dc=com"       write
   by *    compare
access to *
   by self write
   by dn="cn=manager,dc=foo,dc=com"       write
   by * read

test.ldif

Code:

 
dn: dc=foo, dc=com
objectclass: dcObject
objectclass: organization
o: Foo Company
dc: foo

dn: cn=manager, dc=foo, dc=com
objectclass: organizationalRole
cn: manager

dn: ou=people, dc=foo, dc=com
ou: people
objectclass: organizationalUnit
objectclass: domainRelatedObject
associatedDomain: foo.com

dn: ou=contacts, ou=people, dc=foo, dc=com
ou: contacts
ou: people
objectclass: organizationalUnit
objectclass: domainRelatedObject
associatedDomain: foo.com

dn: ou=group, dc=foo, dc=com
ou: group
objectclass: organizationalUnit
objectclass: domainRelatedObject

Error msg

Code:

[root@host MISC]# ldapadd -x -D "cn=Manager,dc=foo,dc=com" -W -f test.ldif
Enter LDAP Password:
ldapadd: invalid format (line 1) entry: ""
[root@host MISC]#

subaruwrx · 07-30-2004, 12:09 PM

egyptian · 08-01-2004, 01:07 AM

password required is the password of the root, that is defined by rootpw (you entered it in the file as "secret")

subaruwrx · 08-01-2004, 01:25 AM

Quote:

Originally posted by egyptian
password required is the password of the root, that is defined by rootpw (you entered it in the file as "secret")

So how do I specify the password? Still don't quite understand rootpw secret.

egyptian · 08-01-2004, 03:16 AM

this is the password of the ldap administrator (defined by rootdn)
you can change the field rootpw in the file slapd.conf to your preferred password
or put it encrypted by using ldappasswd (i don't remember the syntax)

subaruwrx · 08-01-2004, 04:25 AM

Quote:

Originally posted by egyptian
this is the password of the ldap administrator (defined by rootdn)
you can change the field rootpw in the file slapd.conf to your preferred password
or put it encrypted by using ldappasswd (i don't remember the syntax)

So I can just simply put "rootpw password" ?

jamrock · 08-01-2004, 10:22 AM

Every database needs an administrator. The administrator has super user rights in the database. He can add users, delete users, etc.

With OpenLDAP, you specify the name of the administrator and his password in the slapd.conf file.

In your example, the administrator is cn=Manager,dc=foo,dc=com

rootdn "cn=Manager, dc=foo,dc=com"

The administrator's password is secret

rootpw secret

ldapadd -x -D 'cn=manager,dc=foo,dc=com' -W -f top.ldif

This command says:

Add information to the LDAP database from the file called top.ldif. ldapadd -f top.ldif
Use simple authentication -x
The request is being made by the administrator -D 'cn=Manager,dc=foo,dc=com'
Prompt for a password -W

At the password prompt, just enter the password that you have specified in the slapd.conf file. secret

By the way, you have spelt the Manager with a capital letter in the slapd.conf so you need to use a capital letter in the command.

subaruwrx · 08-01-2004, 11:05 AM

Quote:

Originally posted by jamrock
Every database needs an administrator. The administrator has super user rights in the database. He can add users, delete users, etc.

With OpenLDAP, you specify the name of the administrator and his password in the slapd.conf file.

In your example, the administrator is cn=Manager,dc=foo,dc=com

rootdn "cn=Manager, dc=foo,dc=com"

The administrator's password is secret

rootpw secret

ldapadd -x -D 'cn=manager,dc=foo,dc=com' -W -f top.ldif

This command says:

Add information to the LDAP database from the file called top.ldif. ldapadd -f top.ldif
Use simple authentication -x
The request is being made by the administrator -D 'cn=Manager,dc=foo,dc=com'
Prompt for a password -W

At the password prompt, just enter the password that you have specified in the slapd.conf file. secret

By the way, you have spelt the Manager with a capital letter in the slapd.conf so you need to use a capital letter in the command.

Thanx.

So, after adding, if I want to check the database, I just need to check the slap.conf file?

egyptian · 08-02-2004, 01:23 AM

to check the database simply run:
ldapsearch -xb "dc=foo,dc=com"

subaruwrx · 08-02-2004, 04:51 AM

Quote:

Originally posted by egyptian
to check the database simply run:
ldapsearch -xb "dc=foo,dc=com"

Does it mean that the database is transparent? Not stored in any file?