Description: Candidates should be able to perform queries and updates to an LDAP server. Also included is importing and adding items, as well as adding and managing users.
Key Knowledge Areas:
LDAP utilities for data management and queries
Change user passwords
Querying the LDAP directory
Terms and Utilities:
ldapsearch
ldappasswd
ldapadd
ldapdelete
This course is about LDAP Client utilities and their usage. Obviously we need and OpenLDAP server up and running inorder to perform queries and do modifcations.
We recommend you to study 210.4 course before start reading this course :-o
note:LDAP client utilities usage might be different based on OpenLDAP server versions. To get the best results and covering LPIC2 exam objectives, we have used OpenLDAP v2.3.x on CentOS 5 in this course.
ldapsearch
ldapsearch opens a connection to an LDAP server, binds, and performs a search using specified parameters. By default ldapsearch query local host computer for LDAP server but its is possible to run it from a remote client using -h option and specifying the server.
Now that some LDAP configuration has been added, lets check the results using ldapsearch command:
The ldapadd command is an LDAP add-entry tool. Here we use ldapadd command which takes our ldif file definations and add it to our configuration:
Create OU inorder to give structure to our Directory Server, again we need to required ldif file:
[root@centos5-1 openldap]# vi myou.ldif
[root@centos5-1 openldap]# cat myou.ldif
dn: ou=managers,dc=example,dc=com
ou: managers
description : Managers in the company
objectclass: organizationalunit
and lets run ldapadd commands :
[root@centos5-1 openldap]# ldapadd -x -D "cn=ldapadm,dc=example,dc=com" -W -f myou.ldif
Enter LDAP Password:
adding new entry "ou=managers,dc=example,dc=com"
-x means use simple authentication,-Dsays that the admin account is setup here to adding things to our configuration, -W Prompt for simple authentication (This is used instead of specifying the password on the command line).-f specify ldif file.
Now that we have "managers" ou we can add a record to it:
[root@centos5-1 openldap]# vi myuser.ldif
[root@centos5-1 openldap]# cat myuser.ldif
dn: cn=Bob Smith,ou=managers,dc=example,dc=com
objectclass: inetOrgperson
cn: Bob Smith
cn: Bob J Smith
cn: bob smith
sn: smith
uid: bjsmith
userpassword: Aa12345
carlicense: abc123
homephone: 111-222-3344
mail: b.smith@example.com
mail: bsmith@example.com
mail: bob.smith@exmple.com
description: Big Boss
ou: IT Department
For more info about objectClass "inetOrgperson" try cat schema/inetorgperson.schema .
[root@centos5-1 openldap]# ldapadd -x -D "cn=ldapadm,dc=example,dc=com" -W -f myuser.ldif
Enter LDAP Password:
adding new entry "cn=Bob Smith,ou=managers,dc=example,dc=com"
[root@centos5-1 openldap]# cat moreusers.ldif
dn: cn=James Smith,ou=managers,dc=example,dc=com
objectclass: inetOrgPerson
cn: James Smith
cn: James J Smith
sn: James
uid: jsmith
userpassword: Aa12345
carlicense: A1B2C3
homephone: 222-333-4455
mail: j.smith@example.com
mail: jsmith@example.com
mail: james.smith@example.com
ou: managers
### add anothr Entry to our OU
dn: cn=Maria Garcia,ou=managers,dc=example,dc=com
objectclass: inetOrgPerson
cn: Maria Garcia
sn: garcia
uid: mgarcia
userpassword: Aa12345
carlicense: AABBCC
homephone: 333-444-4466
mail: m.garcia@example.com
mail: mgarcia@example.com
mail: maria.garcia@example.com
ou: managers
[root@centos5-1 openldap]# ldapadd -x -D "cn=ldapadm,dc=example,dc=com" -W -f moreusers.ldif
Enter LDAP Password:
adding new entry "cn=James Smith,ou=managers,dc=example,dc=com"
adding new entry "cn=Maria Garcia,ou=managers,dc=example,dc=com"
[root@centos5-1 openldap]# cat moreou.ldif
### Add Users OU
dn: ou=users,dc=example,dc=com
ou: users
description : Ordinary users in the company
objectclass: organizationalunit
### Add Devices OU
dn: ou=sales,dc=example,dc=com
ou: sales
description: Sales group OU
objectclass: organizationalunit
[root@centos5-1 openldap]# ldapadd -x -D "cn=ldapadm,dc=example,dc=com" -W -f moreou.ldif
Enter LDAP Password:
adding new entry "ou=users,dc=example,dc=com"
adding new entry "ou=sales,dc=example,dc=com"
and see current Directory Structure in our LDAP server:
But that is lots of information. By using -L switche Search results are display in LDAP Data Interchange Format detailed in ldif. A single -L restricts the output to LDIFv1. A second-L disables comments. A third-L disables printing of the LDIF version. The default is to use an extended version of LDIF.
-x for simple authentication , -D say this is the user that has the authorizationon on this particular directory server inorder to make these kind of changes, -s to set what ever password we like, -w for getting prompted for rootdn password, and finally secify who we are quering for. Now lets check th old password hash QWExMjM0NQ== with the new one:
