Open LDAP – Installation and configuration

Software Download

Download OpenLDAP Source code from 

http://www.openldap.org/software/download/OpenLDAP/openldap-release/

 

Pre Work :

Set below environmental variable. The path may change based on your local system install location of berkleyDB

———————

CPPFLAGS=”-I/usr/local/berkeleyDB/include”

export CPPFLAGS

LDFLAGS=”-L/usr/local/lib -L/usr/local/berkeleyDB/lib -R/usr/loca/berkeleyDB/lib”

export LDFLAGS

LD_LIBRARY_PATH=”/usr/local/berkeleyDB/lib”

export LD_LIBRARY_PATH

———————

 

Building OpenLDAP Source code: 

Go to folder where you have extracted openLDAP

Run below commands: (if you want/need to support TLS , run with flag –with-tls )

# ./configure 

# make depend

# make

# make test (if this fails, please logout and re-login and run this command)

 

Configuring openLDAP :

 

Go to /usr/local/etc/openldap 

Update slapd.conf under title :  BDB database definitions

suffix          “dc=ACME,dc=com”

rootdn          “cn=Manager,dc=idcqa,dc=com”

rootpw          password

Note: Replace “dc=amce,dc=com” with your required DN.

You can set password as hashed value. for that use slappasswd to generate the hash.  

 

Starting the Server

Start LDAP Server using below command

/usr/local/libexec/slapd -d127 -h “ldap://:389/ ldaps://:636/”  &

This will start server in debug mode and it will listen cleartext on 389 and TLS on 636

Sample LDIFs 

Use Below LDIF to add your first entry (save it as root.ldif)

dn: dc=ACME,dc=com

dc: ACME

description: ACME  Corp.

objectClass: dcObject

objectClass: organization

o: Acme

 

Command to add the entry to OpenLDAP: 

ldapadd -a -h localhost -p 389 -D “cn=Manager,dc=idcqa,dc=com” -w password  -f root.ldif -x

# ldapadd command will get installed along with openLDAP installation

 

Create Group:

create a ldif file with following contents to add a group under dc=Acme,dc=com

dn: cn=group1,dc=acme,dc=com

objectClass: groupOfNames

cn: group1

member:

Command:   ldapadd  -h localhost -p 389 -D “cn=Manager,dc=idcqa,dc=com” -w password  -f group.ldif -x

 

Creating User 

create a ldif file with following contents:

dn: cn=u1,dc=acme,dc=com

changetype: add

objectClass: inetOrgPerson

objectClass: organizationalPerson

objectClass: person

objectClass: top

sn: u1

cn: u1

mail: u1@acme.com

userPassword: password

Continue reading

Advertisements

Lightweight Directory Access protocol ( LDAP ) : Basic layman style introduction

LDAP – Lightweight Directory Access Protocol

Basic:

 Think of it as a Tree… “Say Apple tree” . It has leaves , Apple etc..,

Apple has property like Cover, color, seeds etc.

Similarly, Leave has properties like It’s Green , It’s soft etc….

Let’s look closely @ Apple,

We can view Apple as “class” in java and it’s occurrence in the tree as instances of Apple Object…. –> In LDAP, it’s exactly same, Apple is ObjectClass and Instances of it on tree are called Objects or. entries.

Properties of Apple ..Color , Cover , Seeds are property that defines Apple… in LDAP , These can be viewed as attribute that defined the  Objectclass “Apple”.

Similarly you can think of other entries on Apple Tree ..i.e. Leaves , stem etc.

 Now, coming back to LDAP, LDAP is a Database which holds data like any other database, but in Hierarchically fashion and are defined by Objectclasses.

The data/objects could be user , Computer, Server, Customer and everything that needs to be represented as data.

Ex: One of the popular used object class is “user” in Active Directory.

     If you look into the schema, it is defined as an object class which must hold attributes like “CN (common Name)” and SN (surname) . It may additionally hold attribute like UID, UserPassword,photo , member (group membership) , title, Supervisor, etc.

Schema , which defines ldapSyntax, Attribute, Objectlass and extensions , are key which defines the data that is stored in an LDAP Server along with access capabilities. We’ll take deep dive into them later.

Below is Sample LDIF file to create a user in LDAP.

 ——————–

dn: cn=user1,cn=users,dc=domainname,dc=com

change type: Add

Objectclass: inetOrgperson

sn: user1

userpassword: password

uid: user1

——————-