Ldapsession

Systems Integration with Free Software - openldap - Xavier Castaño García

This session We are going to talk about: Introduction to LDAP Installing and configuring LDAP LDAP utilities LDAP schemes Working with LDAP

Introduction to LDAP (I) Lightweight Directory Access Protocol (LDAP). Internet protocol for accessing X.500 directory services. LDAP is a lightweight alternative to the X.500 Directory Access Protocol (DAP) for use on the Internet. References: http://www.openldap.org/faq/data/cache/29.html http://www.itu.int/

Introduction to LDAP (II) LDAP maintain and offer information about objects. Objects are identifiable, that is, objects have a name. All the objects belong, at least, to one object class. An object class is a family for similar objects that have similar issues. An object class can be a subclass of another. A directory entry is the basic unit of information in the directory.

Introduction to LDAP (III) Stored information is known as DIB (Directory Information Base). Entries are stored in the DIB using a tree structure (Directory Information Tree).

Introduction to LDAP (IV) An entry is a set of attributes which maintaing information about the object it represents. objectClass: top objectClass: person objectClass: posixAccount description: Testing LDAP userPassword:: e1NIQX1VK3FvWjUzdDBPaTdVcTNFMjlyY013VUphM2M9 sn: Surname cn: Name Each attribute is defined by a description and a value or list of values. Attributes are defined by types, which define if attribute can have one or more values, or define sintaxes.

Introduction to LDAP (V) Each entry is relative to the immediately upper. For example, the previous image shows that “B” will have in its name a reference to “A”. Entry names can be: RDN: Relative distinguish name. Identify the entry inside the branch. DN: Distinguish name. Identify the entry in all the LDAP.

Introduction to LDAP (VI) RDN's are composed by an attribute name and the attribute value used as RDN. RDN is defined by the main classes used to define the entry, for example: UID=userid (user) O=organizationname (organization) CN=systemgroup (groupOfNames) DN is composed by RDN + “DN of upper entity”

Introduction to LDAP (VII) An LDAP can have a “base” as top of the LDAP. The rest of the LDAP names are related to the base. For example: LDAP base (baseDN): dc=project,dc=organizationname,dc=org RDN's: Organization: o=organizationname Organizational units: ou=groupname Groups or roles: cn=rolname Users: uid=userid

Introduction to LDAP (VIII) Object classes are used to categorize, control operations, regulate possitions at DIT, regulate attributes that should have an entry which could have some kind of policy. An object class is composed by a set of attributes that objects can or should satisfy. Object classes can be abstract, structural or auxiliar. An object class inherits from other class. All structural classes inherit from “top” class.

Introduction to LDAP (IX) Abstract classes define features that other classes should satisfy. Structural classes define the entry conformation. DIP rules only refer to structural. Auxiliar classes serve to determine not basic features.

LDAP schemes (I) Classes definition and type definition determine the LDAP scheme. LDAP scheme, when elements are defined, uses unique identifiers (offer by IANA): 1.3.6.1.4.1.4203 (OpenLDAP OID) OpenLDAP defines a tree for defining object and attributes syntax: .1 (published) .3 (attribute) .4 (object)

LDAP schemes (II) You have to ask for an identifier if you want to define a custom syntax. When you receive the OID, you'll be able to use this prefix: 1.3.6.1.4.1.OID For example, you can use this identifier to new attributes and classes, setting own rules: .0 for experimental attributes. .1 for confirmed attributes.

LDAP schemes (III) .1 for confirmed attributes (cont.) .3 for types. .1,.2,.N each type. .4 for object classes .1,.2,.N each class. OpenLDAP registry: http://www.openldap.org/faq/data/cache/200.html Example: Clase: objectclass ( 1.3.6.1.4.1.OID.1.4.1 NAME 'location' At: attributetype ( 1.3.6.1.4.1.OID.1.3.2 NAME 'VATNumber' ...

Working with LDAP (I) Example for users: dn: uid=xavi,ou=People,dc=mswl,dc=org uid: xavi cn: Xavier objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 11296 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 500 gidNumber: 500 homeDirectory: /home/xavi gecos: Xavier userPassword:: ...

Working with LDAP (II) Example for groups: dn: cn=ldapgroup,ou=Group,dc=example,dc=org objectClass: posixGroup objectClass: top cn: ldapgroup userPassword:: {crypt}x gidNumber: 389 memberUid: xavi

Installing and configuring LDAP (I) Exercise: Install OpenLDAP in your computer, select the base DN, user and password with all privileges. Steps: apt-get install slapd ldap-utils Dependencies: libiodbc2, libldap-2.3.0 Admin password and confirmation. For example: 1dM1M9W Access to /etc/ldap: The main configuration file is: slapd.conf By default it stores database in /var/lib/ldap There is a template for slapd.conf in /usr/share/slapd/slapd.conf. This exercise will work with the template.

Installing and configuring LDAP (II) Steps: Configuration file template has the following things that you should replace: @BACKEND@ with bdb (Berkeley DB transactional backend is the type of database used, this is the recommended for a normal usage). There are other possibilities: hdb (hierarchical variant of dbd backend), perl (perl programmable backend), ldif (uses ldif files to store information, only for very small systems), etc. @CHECKPOINT@ with checkpoint 512 30: How often to checkpoint the DB transaction log, these are default values, where 512 are kilobytes and 30 seconds. @SUFFIX@ with the suffix of your database (for example dc=mswl,dc=com or something like that). @ADMIN@ with the admin DN (typically cn=admin,dc=mswl,dc=com). @BACKENDOPTIONS@ (only some versions of Debian) with this: dbconfig set_cachesize 0 2097152 0 #Cache size 2Mb dbconfig set_lk_max_objects 1500 # Number of objects that can be locked at the same time dbconfig set_lk_max_locks 1500 # Number of locks dbconfig set_lk_max_lockers 1500 # Number of lockers. References: http://www.openldap.org/doc/admin24/slapdconfig.html#Configuration%20File%20Directives

Installing and configuring LDAP (III) Steps: Other general configuration parameters: loglevel: 0, 1, 2, 4, 8 ... more level more information... See previous reference or “man 5 slapd.conf”. sizelimit: 500. The number of entries that is returned for a search operation. You need to configure the options for your database, each database needs all the configuration params below. For example, configuring one example database: database “dbd” suffix “dc=mswl,dc=com” rootdn “cn=admin,dc=mswl,dc=com” #If you want to grant root privileges... directory: /var/lib/ldap. Is that OK for you? If you want several trees you'll have to create a new directory for each one. lastmod on: Activate lastmod overlay. index objectClass eq. Index options for first database. You'll need to think about it when you setup real life systems, because you could need more indexes. “Eq” is the mode openldap create the index, other options are: pres (present), sub (substring) approx (approximation).

Installing and configuring LDAP (IV) Steps: Continuing with configuration parameters... Access control: access to attrs=userPassword, shadowLastChange by dn=”cn=admin,dc=mswl,dc=com” write by anonymous auth by self write by * none access to dn.base=”” by * read access to * by dn=”cn=admin,dc=mswl,dc=com” write by * read

Installing and configuring LDAP (V) Steps: Before starting, we need to add some data creating a file with this lines: #Each dn is a different object. First object dn: dc=mswl,dc=com dc: mswl objectClass: domain #Each dn is a different object. Second object dn: cn=admin,dc=mswl,dc=com objectClass: organizationalRole objectClass: simpleSecurityObject cn: admin description: LDAP administrator userPassword: 1dM1M9W Then, you should call: slapadd -b dc=mswl,dc=com -l file.txt Now, we can restart ldap: /etc/init.d/sldap restart

Installing and configuring LDAP (VI) Comments: Overlays: There are some wrappers over openldap that can add and control information about the directory. For example: accesslog: Can record accesses to a given backend database. lastmod: Maintains a service entry with type, modifiersName and modifyTimestamp of the last write operation performed on a given database. pcache: Allows caching of LDAP search requests in a local database. ppolicy: Provides a variety of password control mechanisms: password aging, password reuse and duplication control, ... unique: Enforces the uniqueness of some or all attributes within a subtree.

LDAP utilities (I) There are several commands: ldapsearch ldapsearch -x -D "cn=admin,dc=mswl,dc=org” -W -b "dc=mswl,dc=org" -h localhost ldapadd ldapadd -x -D "cn=admin,dc=mswl,dc=org” -W -h localhost -f file.txt ldapmodify ldapmodify -x -D "cn=admin,dc=mswl,dc=org” -W -h localhost -f file.txt ldapdelete ldapdelete -x -D "cn=admin,dc=mswl,dc=org” -W -h localhost “dn”

LDAP utilities (II) Exercise: Add a organizationalUnit: People and Group Add a group with objectClass posixGroup. Search the posixGroups that belongs a specific organizationalUnit. Add a user with objectClass: top, person, shadowAccount, posixAccount.

Ldapsession

More Related Content

What's hot

Viewers also liked

Similar to Ldapsession

More from guest648519

Recently uploaded

Ldapsession