210.4. Configuring an OpenLDAP server
Weight: 4
Description: Candidates should be able to configure a basic OpenLDAP server including knowledge of LDIF format and essential access controls.
Key Knowledge Areas:
OpenLDAP
Directory based configuration
Access Control
Distinguished Names
Changetype Operations
Schemas and Whitepages
Directories
Object IDs, Attributes and Classes
Terms and Utilities:
slapd
slapd-config
LDIF
slapadd
slapcat
slapindex
/var/lib/ldap/
loglevel
We begin this course by talking about basics of LDAP. What is LDAP? Where it is used and why ?
LDAP
LDAP is not a program, that is a protocol. LDAP stands for Lightweight Directory Access Protocol and consists in a set of protocols that allows a client to access centrally stored information (over a network). It can be used in numerous ways such as for authentication, shared directory (for mail clients), address book, etc. As LDAP different usages, it can store any kind of information.
The standard TCP ports for LDAP are 389 for unencrypted communication and 636 for LDAP over a TLS-encrypted channel, although it’s not uncommon for LDAP servers to listen on alternate ports for a variety of reasons.
LDAP Directory tree structure
An LDAP directory has a tree structure. All entries (called objects) of the directory have a defined position within this hierarchy. This hierarchy is called the directory information tree (DIT).
Entries at the higher level of hierarchy, represent larger groupings or organizations. Entries under the larger organizations represent smaller organizations that make up the larger ones. The leaf nodes (or entries) of the tree structure represent the individuals or resources.
Namig Model
The naming model defines how entries and data in the DIT are uniquely referenced.
There are some defination which we are expected to know about before start working with ldap:
Object: Sometimes reffered to as a record or an entry, reperesnt a single item in the direstory. This object provides a description based on the structure of the schema.
Schema: This is the structure that is built to define the characteristics (or attributes) of an object. It also defines what can be stored in each attributes.
Attribute: This is a part of an object. One or more attributes make up an object, as defined by schema.
LDIF: Stands for LDAP Interchange Format. It is used to create objects within the LDAP directory. These values are placed into a file and can be loaded into a directory with the slapadd command.
DC: Stands for Domain Component. And that is one of the domain that is reflected in hierarchy.
OU: Stands for Organizational Unit.
CN: Stands for Common Name and is the name of object(often a username, but not always)
DN: Stands for Distinguished Name. Each object in our directory has to have a unique name in order to provide structure. It is build with a CN and one or more DC (example: cn=user,dc=abc,dc=com)
SSSD
Stands for System Security Service Daemon. This provides authentication of user accounts for a LDAP Server(if we want we can use a different solutions)
Note: Configuration of this item is NOT an eaxm objective, Only that we know what it is.
OpenLDAP
OpenLDAP is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. It is released under its own BSD-style license called the OpenLDAP Public License.
OpenLDAP provides a distributed directory service. It stores information associated with users that can be used to authenticate them for login and can provide other information about those users.
OpenLDAP is most commonly used in Linux, but can be compared to Active Directory on Windows as a service provided hierarchical based user information much the same as OpenLDAP.
Installing OpenLDAP server
For demonstaration Lets install OpenLDAP server on a centOS system, we install both sever and client packages to work with that. We should install the following three packages:
openldap-servers – This is the main LDAP server
openldap-clients – This contains all required LDAP client utilities
openldap – This packages contains the LDAP support libraries
Next try to start slapd service(do not forget to disable selinux with setenforce 0 command):
and check whether it is listening or not:
/etc/openldap
There are number of diffrent things:
ldap.conf
Used to set system-wide defaults to be applied when running LDAP client tools( likeldapsearchandldapadd).
Where
SIZELIMIT <integer> : Specifies a size limit (number of entries) to use when performing searches.
TIMELIMIT <integer> : Specifies a time limit (in seconds) to use when performing searches.
By default ldap.conf is world readable and there are no special setting to edit and it is not a part of exam objective.
/etc/openldap/schema/*
Directory that contains a set of default schema specifications which describe the different object classes that are available by default with the OpenLDAP Software. Each set is defined in a file (i.e. core.schema) suitable for inclusion using the include directive in the global definitions portion of the slapd.conf file. It is helpful to browse the contents of these files to determine the required and available attributes for a particular object class.
Try to cat some of core.ldif files and see how they look like.This a part of that:
slapd.conf
Main server configuration file that contains information needed by the slapd LDAP server. Lets take a look at it:
Where is it?
Historically OpenLDAP has been statically configured, that is, to make a change to the configuration the slapd.conf file was modified and slapd stopped and started. In the case of larger users this could take a considerable period of time and had become increasingly unacceptable as an operational method.
slapd.conf or dynamic runtime configuration engine
Significant changes to slapd were introduced with version 2.3 and 2.4. The most significant change is that, while slapd.conf is still supported (as of 2.4), increasingly OpenLDAP is moving toward On-Line Configuration (OLC) - frequently also known as cn=config or slapd.d configuration. This method enables most configuration changes to be made without starting and stopping the LDAP server.
If you have got confused, in a simple world, it is like having a configuration data base for configuring a database and no more single configuration file slapd.conf.
Unfortunately LPIC2 exam objective is about Old OpenLDAP versions (perior v2.3 ) but here what we have is OpenLDAP v2.4:
So lets stick to our modern OpenLDAP how ever we need to cover exam objectives .So i have prepared another system, with CentOS5 and OpenLDAP 2.3.x on it to show differences:
Configuring OpenLDAP v 2.4 :
OpenLDAP v2.4 servers configuration files are found in /etc/openldap/slapd.d/
Note : Although the slapd-config system stores its configuration as (text-based) LDIF files, you should never edit any of the LDIF files directly. Configuration changes should be performed via LDAP operations, e.g. ldapadd, ldapdelete, or ldapmodify.
slapcat
Slapcat is used to generate an LDAP Directory Interchange Format (LDIF) output based upon the contents of a slapd database. It opens the given database determined by the database number or suffix and writes the corresponding LDIF to standard output or the specified file.
By default slapcat in version 2.3 (and prior versions) shows default database .but here in version 2.4.x (and above) it shows nothing , so we define where configuration database is placed in slapd data base and it shows default configurations:
-bsuffix Use the specified suffix to determine which database to generate output for.
To start with the configuration of LDAP, we would need to update the variables “olcSuffix” and “olcRootDN“.
olcSuffix – Database Suffix, it is the domain name for which the LDAP server provides the information. In simple words, it should be changed to your domainname.
olcRootDN – Root Distinguished Name (DN) entry for the user who has the unrestricted access to perform all administration activities on LDAP, like a root user.
olcRootPW – LDAP admin password for the above RootDN.
The above entries need to be updated in /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif file. Manually edit of LDAP configuration is not recommended as we will lose changes whenever you run ldapmodify command.
First lets generate an admin password:
slappasswd
OpenLDAP password utility, Slappasswd is used to generate an userPassword value suitable for use with ldapmodify, slapd.conf(5) rootpw configuration directive or the slapd-config olcRootPW configuration directive.
To add something to the LDAP directory, we need to first create a LDIF file.The ldif file should contain definitions for all attributes that are required for the entries that you want to create, modify or change.
Now lets create a ldif file define requiered changes inside that (include generated password for ldap admin user"ldapadm"):
Now send the configuration to the LDAP server:
ldapmodify
ldapmodify opens a connection to an LDAP server, binds, and modifies or adds entries. The entry information is read from standard input or from file through the use of the -f option.
by default ldapmodify chekh our ldif file for syntax errors before inserting into ldap databas and it seems good.
slaptest
slaptest - Check the suitability of the OpenLDAP slapd.conf file. Although there is no slapd.conf in 2.4 version but it still works . We use -u switch to enable dry-run mode (i.e. don't fail if databases cannot be opened, but config is fine) and -v for verbrosity:
and finally lets see what we have added:
Configuring OpenLDAP v2.3.X (and perior) :
Configuting OpenLDAP v2.3.x is much easier. We need to configure Database-Specific Directives in slapd.conf:
database: The type of database, a Berkeley database in this case, is determined in the first line of this section.
suffix: The suffix line names the domain for which the LDAP server provides information and should be changed.
rootdn:The rootdn entry is the Distinguished Name (DN) for a user who is unrestricted by access controls or administrative limit parameters set for operations on the LDAP directory. The rootdn user can be thought of as the root user for the LDAP directory. In the configuration file, change the rootdn line from its default value.
rootpw : The administrator password is set with rootpw. Instead of using secret here, it is possible to enter the hash of the administrator password created by slappasswd.
directory : The directory directive indicates the directory (in the file system) where the database directories are stored on the server. There is no need to change it.
and the slapd.conf file would be like this after doing changes:
test configuration (we are using OpenLDAP server version before 2.3):
and done:
/var/lib/ldap
Contains all files that make up the LDAP directory database( LDAP Background Data Bases and log files). None of the files contained in this directory should be manually edited. The LDAP directory database type and location will be defined in the/etc/openldap/slapd.conf
These files are reponsible for serving the context of our directory server once we start the service .
Note:slapd runs as ldap user by default, if you attempted to start it (or loaded ldif etc..) as root user, it'd create files with incorrect permission. Try chown -R ldap.ldap /var/lib/ldap to fix the permissions and start the service.
OpenLDAP v2.4:
But the way Where is the configuration data base in Version 2.4.X and higher?
/etc/openldad/slapd.d (Ver 2.4.X and above)
OpenLDAP v2.3.x:
and restart the Open LDAP service to check:
OpenLDAP v2.4:
OpenLDAP v2.3.x:
to make sure every thing is okey lets do a search in our directory server:
ldapsearch
ldapsearch opens a connection to an LDAP server, binds, and performs a search using specified parameters. The filter should conform to the string representation for search filters:
OpenLDPA v2.4 :
-x means use simple authentication ,-b for defining search base that we want to run search on (which is blank in our example because we want to search for every thing), -s indicates the base we want to use (we defined just our base with all object classes in our directory server) and finally we want all of the names (namingContext).
OpenLDAP v2.3.x:
Quick look at OpenLDAP Back-end Database:
The bdb backend to slapd uses the Oracle Berkeley DB (BDB) package to store data. It makes extensive use of indexing and caching to speed data access.
Note that BDB is deprecated and support will be dropped in future OpenLDAP releases. Installations should use the mdb backend instead.
hdb is a variant of the bdb backend that uses a hierarchical database layout which supports subtree renames. It is both more space-efficient and more execution-efficient than the bdb backend. It is otherwise identical to the bdb behavior, and all the same configuration options apply.
Please notice that these options are intended to complement Berkeley DB configuration options set in the environment's DB_CONFIG file. See Berkeley DB documentation for details on DB_CONFIG configuration options. Where there is overlap, settings in DB_CONFIG take precedence.
slapindex
slapindex - Reindex entries in a SLAPD database. It makes extensive use of indexing and caching to speed data access.
Unfortunately there are no usefull documentation for slapindex in OpenLDAP2.4 and its still show information for previous OpenLDAP versions and needs slapd.conf file!(try man slapindex on CentOS7 to see ).So lets try it using OpenLDAP v2.3.X:
As you can see it nags about not founding DB_CONFIG file. Fortunately there is Example DB_CONFIG file for use in conjunction with slapd databases.We can simply copy this file to your LDAP directory's base directory.
and take look at it:
and check again:
loglevel
Although not included by default in the configuration file, logging can be setup using the loglevel directive. This directive specifies the level at which debugging statements and operation statistics should be logged. Log levels may be specified as integers or by keyword; however, most people stick to using loglevel integers.
Log levels may be specified as integers or by keyword.
Multiple log levels may be used and the levels are additive.
Another setting related to logging that is not included by default is thelogfiledirective. By default, log entries for LDAP are sent to syslog. While this has its benefits, I find it more convenient to direct log entries to a file using thelogfiledirective:
When specifying thelogfiledirective, we need to make certain that the log file exists prior to starting the LDAP server.
LDAP implementations
Once upon a time OpenLDAP was the only game in the Open Source LDAP town. It is still regarded as the LDAP reference implementation and remains an excellent system with many production implementations, is actively developed and extremly complex to implement for other than trivial applications. It is, however, no longer the only game in town. There is now the 389 Directory Server (ex-Fedora Directory Server), another University of Michigan derivative, OpenDJ (a fork of OpenDS a Sun-led Java-based LDAP implementation which now appears inactive), and the ApacheDS (Apache Directory) project. All appear excellent projects and together with OpenLDAP provide an embarrassment of riches in the Open Source LDAP space - driving forward capabilities and functionality.
Now that we have our OpenLDAP up and running it is time to create some OU and Users inside it.
slapadd
slapadd: Adds entries to an LDAP directory by accepting input via a file or standard input; ldapadd is actually a hard link to ldapmodify -a
slapdelete: Deletes entries from an LDAP directory by accepting user input at a shell prompt or via a file.
Now we have created our inital LDAP server, we have to create DN an the associated top levels DCs that we can add entries into.To get the best results and covering LPIC2 exam objectives, we have used OpenLDAP v2.3.x on CentOS 5 in this section. First we need to create LDIF file:
Flash back: How it can realize dcObject consept or organization concept? From schema files! Try ls -l schema/ and cat schema/core.ldif | grep dcObject or grep for organization.
slapadd command writes directly into Ldap data base, so obviously it is not possible if the service is running :
and lets check the result:
yes we actually modified ldap data base:
as slapadd and slapdelete access directly to the data base it is not possible to use them from a remote computer. In the next lesson we will learn how to use ldapadd and ldapdelete tools inorder to configure our Open LDAP server from a remote host.
Please go back to 210.3 course for more details. :-)
Any problem in install OpenLDAP 2.3.x on CentOS5? Look at here and here .
Last updated