Directory Server Campus Booster ID: Copyright © SUPINFO. All rights reserved OpenLDAP

Course objectives OpenLDAP Know what directory server are. Know what is OpenLDAP. Know how to install and configure OpenLDAP. By completing this course, you will :

Course topics OpenLDAP Directories. Which purposes. LDAP. Theory and protocol. OpenLDAP. Practice. Course’s plan :

Directories From X.500 to nowadays OpenLDAP

Preview Directories What is it ? What is it intended for ? Evolution.

The yellow pages Directories Mapping "name" to “telephone number" Sort by category Sort by city Find the information As fast as possible

A database ? Directories A database ? Not exactly. Arborescent structure Like a filesystem No limit on attributes No columns, no tables Optimized for read and search operations

History Directories X.500 OSI Directory Access Protocol Created by telecom operators Created in 1988 Impossible to port on micro-computers Not compatible with TCP/IP( OSI )

Problems Directories Need for classified data Need for security. Need for speed.

LDAP v3 Lightweight Directory Access Protocol OpenLDAP

Preview LDAP v3 Advantages Components Models

LDAPv3 advantages LDAP v3 SASL (single-sign-on) authentification SSL/TLS encryption Schemas discovery

Data model LDAP v3 Defines the type of stored data An entry is an LDAP object It contains some attributes  An attribute match a data type  An attribute can have multiple values Directory

Attributes LDAP v3 Two kinds of attributes : User attributes System attributes Easy to remember names : Cn : Common Name userPassword : Password objectClass : Class of the object

Inheritance LDAP v3 The entries inherits from their parent

Naming convention LDAP v3 Directory Information Tree (DIT) creation Organizes the entries Defines inheritances The DIT is important, it must reflect the reality

DIT example LDAP v3

Stop-and-think LDAP v3 Do we have to create the data model ? Is the DIT important ?

OpenLDAP A free Implementation of LDAP protocol OpenLDAP

Preview OpenLDAP Installation Configuration First step inside the system Let’s practice

Server side OpenLDAP The daemon is slapd Standalone LDAP Daemon Replication daemon : slurpd Standalone LDAP Update Replication Daemon The configuration file is slapd.conf Located in : /etc/openldap

Slapd.conf OpenLDAP Important statements : include file : include a schema database type : may be bdb, ldbd,... suffix path : our tree suffix rootdn path : Who is root ? rootpw secret : the root password ! pidfile : file holding the server PID argfile : file holding default server arguments.

Example OpenLDAP include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema databasebdb suffix"c=FR, o=Labo-linux" rootdn"cn=admin,c=FR,o=Labo-linux" rootpw {SSHA}ZKKuqbEKJfKSXhUbHG3fG8MDn9j1v4QN include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema databasebdb suffix"c=FR, o=Labo-linux" rootdn"cn=admin,c=FR,o=Labo-linux" rootpw {SSHA}ZKKuqbEKJfKSXhUbHG3fG8MDn9j1v4QN

ACL OpenLDAP Restrict access to attributes access to by access to attr=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=example,dc=com" write by * none access to attr=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=example,dc=com" write by * none

ACL OpenLDAP * Anonymous Self Everybody Anonymous users User associated with concerned attribute dn.style= User matching the regex Object name * means all objects.

ACL OpenLDAP base One Subtree  dn.style=  style: Exact matching One child below matching expression Subtree beginning with matching expression Children Like subtree but excluding matching head

ACL OpenLDAP Example : 0: o=suffix 1: cn=Manager,o=suffix 2: ou=people,o=suffix 3: uid=kdz,ou=people,o=suffix 4: cn=addresses,uid=kdz,ou=people,o=suffix 5: uid=hyc,ou=people,o=suffix dn.base="ou=people,o=suffix" dn.one="ou=people,o=suffix" dn.subtree="ou=people,o=suffix" 2 3, 5 2,3,4,5 dn.children="ou=people,o=suffix" 3,4,5

ACL OpenLDAP None Auth Search  Permissions  : No rights at all Requiered to authentificate Apply search filters Read Reading data Write Writing data

Data adding OpenLDAP LDIF files Contains structured data Added with the ldapadd command # ldapadd -D 'cn=Manager,o=Labo-linux' -W -f file.ldif

LDIF Files OpenLDAP dn: o=Labo-linux objectclass: organization o: Labo-linux dn: o=Labo-linux objectclass: organization o: Labo-linux dn: ou=Ressources, o=Labo-linux objectclass: organizationalUnit ou: Ressources description: Ressources de l'organisation dn: ou=Ressources, o=Labo-linux objectclass: organizationalUnit ou: Ressources description: Ressources de l'organisation

Starting server OpenLDAP Add a special user for LDAP for security purposes. And then look at the logs... # slapd -u ldapuser -g ldapgroup \ > -h 'ldap://localhost/' # slapd -u ldapuser -g ldapgroup \ > -h 'ldap://localhost/' # tail /var/log/ldap/ldap.log

Stop-and-think OpenLDAP The only way to learn is to practice !

Course Summary OpenLDAP What is directory LDAP OpenLDAP Administration

For more OpenLDAP CoursesPublications Web sites -Kerberos Conferences

Congratulations You have successfully completed the SUPINFO course OpenLDAP

The end