Configure OpenLDAP - Revision history

Jchdel: not needed anymore (at least in v3.21)

2025-04-17T06:16:17Z

not needed anymore (at least in v3.21)

@@ Line 44: / Line 44: @@
 Later, this document will assume the domain is <code>dc=home</code> or <code>dc=contoso,dc=com</code>, reflecting a domain of <code>home</code> or <code>contoso.com</code> respectively.
 == Importing the Configuration ==
@@ Line 124: / Line 109: @@
      -e 's/\.la$/.so/' \
      -e "s/dc=my-domain,dc=com/${DOMAIN}/" /etc/openldap/slapd.ldif
    echo "Importing configuration..."

Zcrayfish: /* Creating an Organizational Structure */ Marked a URL that can't be upgraded to https

2023-07-26T21:26:19Z

Creating an Organizational Structure: Marked a URL that can't be upgraded to https

← Older revision		Revision as of 21:26, 26 July 2023
Line 176:		Line 176:
	Import the OUs with an ldapadd command similar to the one used to create the organization.		Import the OUs with an ldapadd command similar to the one used to create the organization.

	Now that this is done, you're ready to connect to the LDAP server with the administration tool of your choice and begin populating users, groups, etc. [http://ldapadmin.org/ LDAPAdmin] is an oldie, but a goodie for Windows users.		Now that this is done, you're ready to connect to the LDAP server with the administration tool of your choice and begin populating users, groups, etc. [http://ldapadmin.org/ LDAPAdmin]{{insecure url\|TLS cert invalid}} is an oldie, but a goodie for Windows users.

	== Next Steps ==		== Next Steps ==

Bbbhltz: Formatting changes, no content changed

2023-04-29T09:12:45Z

Formatting changes, no content changed

← Older revision		Revision as of 09:12, 29 April 2023
Line 7:		Line 7:
	Here's how:		Here's how:

	apk add openldap openldap-back-mdb openldap-clients		{{Cmd\|# apk add openldap openldap-back-mdb openldap-clients}}

	But, before you start up the slapd service and go, there's a bit of configuration to do.		But, before you start up the slapd service and go, there's a bit of configuration to do.
Line 17:		Line 17:
	First, create the slapd.d directory with the proper ownership and permissions.		First, create the slapd.d directory with the proper ownership and permissions.

	install -m 755 -o ldap -g ldap -d /etc/openldap/slapd.d		{{Cmd\|# install -m 755 -o ldap -g ldap -d /etc/openldap/slapd.d}}

	Next, edit the slapd startup configuration to use the directory instead of the file.		Next, edit the slapd startup configuration to use the directory instead of the file.

	# Open up /etc/conf.d/slapd in your favorite editor		# Open up <code>/etc/conf.d/slapd</code> in your favorite editor
	# Comment out cfgfile="/etc/openldap/slapd.conf"		# Comment out <code>cfgfile="/etc/openldap/slapd.conf"</code>
	# Uncomment cfgdir="/etc/openldap/slapd.d"		# Uncomment <code>cfgdir="/etc/openldap/slapd.d"</code>

	Finally, get rid of the included slapd.conf file.		Finally, get rid of the included slapd.conf file.

	rm /etc/openldap/slapd.conf		{{Cmd\|# rm /etc/openldap/slapd.conf}}

	== Updating Shared Libraries File Names ==		== Updating Shared Libraries File Names ==

	Open up /etc/openldap/slapd.ldif in your favorite editor. Search for the file names ending with <code>.la</code> and change the extension to <code>.so</code>		Open up <code>/etc/openldap/slapd.ldif</code> in your favorite editor. Search for the file names ending with <code>.la</code> and change the extension to <code>.so</code>

	== Customizing Configuration for Your Domain ==		== Customizing Configuration for Your Domain ==
Line 49:		Line 49:
	The basic OpenLDAP configuration does not include anything other than core schema definitions. To be useful for Linux systems, the inetOrgPerson schema and NIS schema are often included. The schema files are provided with the OpenLDAP package. All that needs to be done is to include them in the slapd.ldif configuration along with the cosine.ldif dependency.		The basic OpenLDAP configuration does not include anything other than core schema definitions. To be useful for Linux systems, the inetOrgPerson schema and NIS schema are often included. The schema files are provided with the OpenLDAP package. All that needs to be done is to include them in the slapd.ldif configuration along with the cosine.ldif dependency.

	# Edit slapd.ldif again.		# Edit <code>slapd.ldif</code> again.
	# Find the line <code>include: file:///etc/openldap/schema/core.ldif</code>		# Find the line <code>include: file:///etc/openldap/schema/core.ldif</code>
	# Append similar lines referencing ''cosine.ldif'', ''inetorgperson.ldif'', and ''nis.ldif''.		# Append similar lines referencing ''cosine.ldif'', ''inetorgperson.ldif'', and ''nis.ldif''.
Line 55:		Line 55:
	It should look like this when you're done:		It should look like this when you're done:

	include: file:///etc/openldap/schema/core.ldif		{{Cat\|/etc/openldap/slapd.ldif\|include: file:///etc/openldap/schema/core.ldif
	include: file:///etc/openldap/schema/cosine.ldif		include: file:///etc/openldap/schema/cosine.ldif
	include: file:///etc/openldap/schema/inetorgperson.ldif		include: file:///etc/openldap/schema/inetorgperson.ldif
	include: file:///etc/openldap/schema/nis.ldif		include: file:///etc/openldap/schema/nis.ldif}}

	== Importing the Configuration ==		== Importing the Configuration ==

	Verify slapd.ldif one last time and use the <code>slapadd</code> command to import it into the backend database.		Verify slapd.ldif one last time and use the <code>slapadd</code> command to import it into the backend database.

	slapadd -n 0 -F /etc/openldap/slapd.d -l /etc/openldap/slapd.ldif		{{Cmd\|# slapadd -n 0 -F /etc/openldap/slapd.d -l /etc/openldap/slapd.ldif}}

	There should be no errors, only a "Closing DB..." message.		There should be no errors, only a "Closing DB..." message.

	Next, change ownership on the resulting files in /etc/openldap/slapd.d		Next, change ownership on the resulting files in <code>/etc/openldap/slapd.d</code>

	'''If you skip this step, the slapd service will refuse to start.'''		'''If you skip this step, the slapd service will refuse to start.'''

	chown -R ldap:ldap /etc/openldap/slapd.d/*		{{Cmd\|# chown -R ldap:ldap /etc/openldap/slapd.d/*}}

	== Configuring the slapd Service ==		== Configuring the slapd Service ==
Line 77:		Line 78:
	The pid directory is missing. We'll need to create it or the service won't start, so this needs to be done first.		The pid directory is missing. We'll need to create it or the service won't start, so this needs to be done first.

	install -m 755 -o ldap -g ldap -d /var/lib/openldap/run		{{Cmd\|# install -m 755 -o ldap -g ldap -d /var/lib/openldap/run}}

	Next, you can start the service and enable it at boot.		Next, you can start the service and enable it at boot.

	service slapd start		{{Cmd\|# rc-service slapd start
	rc-update add slapd		# rc-update add slapd}}

	== Testing ==		== Testing ==
Line 88:		Line 89:
	The OpenLDAP quickstart guide uses the <code>ldapsearch</code> utility to test the configuration.		The OpenLDAP quickstart guide uses the <code>ldapsearch</code> utility to test the configuration.

	ldapsearch -x -b "" -s base '(objectclass=*)' namingContexts		{{Cmd\|$ ldapsearch -x -b "" -s base '(objectclass{{=}}*)' namingContexts}}

	You should see your domain.		You should see your domain.
Line 94:		Line 95:
	You can also test with <code>slapcat</code>		You can also test with <code>slapcat</code>

	slapcat -n 0		{{Cmd\|$ slapcat -n 0}}

	This will dump the entire config database in LDIF format. You can also pipe to grep and specify your domain name to verify everything looks correct. When using grep, remember LDAP uses the format dc=domain,dc=com and not the more familiar domain.com.		This will dump the entire config database in LDIF format. You can also pipe to grep and specify your domain name to verify everything looks correct. When using grep, remember LDAP uses the format dc=domain,dc=com and not the more familiar domain.com.
Line 181:		Line 182:
	The configuration presented here does not include provisions for TLS (encrypted) communication. It should not be used on an untrusted network. Refer to the official OpenLDAP docs for instructions on setting up encrypted LDAP connections.		The configuration presented here does not include provisions for TLS (encrypted) communication. It should not be used on an untrusted network. Refer to the official OpenLDAP docs for instructions on setting up encrypted LDAP connections.

	== ~~Reference~~ ==		== References ==

	~~https://openldap.org/doc/admin26/quickstart.html~~

	https://stackoverflow.com/questions/72132704/did-i-import-inetorgperson-schema-correctly-for-openldap-on-alpine-linux/		* [https://openldap.org/doc/admin26/quickstart.html OpenLDAP Software 2.6 Administrator's Guide: A Quick-Start Guide]
			* [https://stackoverflow.com/questions/72132704/did-i-import-inetorgperson-schema-correctly-for-openldap-on-alpine-linux/ ldap - Did I import inetOrgPerson schema correctly for OpenLDAP on Alpine Linux? - Stack Overflow]

	[[Category:Networking]]		[[Category:Networking]]

Dhorton: Removing the link to stackoverflow, but keeping the reference. I didn't source the script from there. This is the original. I'm the same guy who asked the question on S.O.

2023-04-28T16:11:40Z

Removing the link to stackoverflow, but keeping the reference. I didn't source the script from there. This is the original. I'm the same guy who asked the question on S.O.

← Older revision		Revision as of 16:11, 28 April 2023
Line 104:		Line 104:
	== Scripted Installation ==		== Scripted Installation ==

	If you want to automate the steps above, use the ~~[https://stackoverflow.com/q/72132704~~ following script]. Be sure to adjust the DOMAIN value to fit your needs.		If you want to automate the steps above, use the following script. Be sure to adjust the DOMAIN value to fit your needs.

	export DOMAIN="dc=home"		export DOMAIN="dc=home"

Bbbhltz: added to Networking category - not sure if another category should be created

2023-04-18T14:26:47Z

added to Networking category - not sure if another category should be created

← Older revision		Revision as of 14:26, 18 April 2023
Line 186:		Line 186:

	https://stackoverflow.com/questions/72132704/did-i-import-inetorgperson-schema-correctly-for-openldap-on-alpine-linux/		https://stackoverflow.com/questions/72132704/did-i-import-inetorgperson-schema-correctly-for-openldap-on-alpine-linux/

			[[Category:Networking]]

Xyhhx: Add ref to SO question where script is sourced from

2022-08-06T18:14:59Z

Add ref to SO question where script is sourced from

← Older revision		Revision as of 18:14, 6 August 2022
Line 104:		Line 104:
	== Scripted Installation ==		== Scripted Installation ==

	If you want to automate the steps above, use the following script. Be sure to adjust the DOMAIN value to fit your needs.		If you want to automate the steps above, use the [https://stackoverflow.com/q/72132704 following script]. Be sure to adjust the DOMAIN value to fit your needs.

	export DOMAIN="dc=home"		export DOMAIN="dc=home"

Xyhhx: /* Creating an Organizational Structure */

2022-08-06T18:06:01Z

Creating an Organizational Structure

← Older revision		Revision as of 18:06, 6 August 2022
Line 141:		Line 141:
	Now that the installation is done, you can start using your LDAP database. At a minimum, you'll need to create an organization within your LDAP directory. This is covered as step 11 in the OpenLDAP [https://openldap.org/doc/admin26/quickstart.html quickstart] document.		Now that the installation is done, you can start using your LDAP database. At a minimum, you'll need to create an organization within your LDAP directory. This is covered as step 11 in the OpenLDAP [https://openldap.org/doc/admin26/quickstart.html quickstart] document.

	Here is an example using the contoso.com domain as the organization:		Here is an example using the contoso.com domain as the organization and <code>home</code>/<code>dc=home</code> as the base DN (update the baseDN if yours differs):

	cat <<EOF >org.ldif		cat <<EOF >org.ldif

Xyhhx: /* Customizing Configuration for Your Domain */

2022-08-06T18:03:23Z

Customizing Configuration for Your Domain

← Older revision		Revision as of 18:03, 6 August 2022
Line 42:		Line 42:
	# Find <code>olcRootDN:</code>		# Find <code>olcRootDN:</code>
	# Change the value to match your domain		# Change the value to match your domain

			Later, this document will assume the domain is <code>dc=home</code> or <code>dc=contoso,dc=com</code>, reflecting a domain of <code>home</code> or <code>contoso.com</code> respectively.

	== Adding Schema for Linux User Accounts ==		== Adding Schema for Linux User Accounts ==

Dhorton: /* Adding Schema for Linux User Accounts */

2022-05-06T15:34:21Z

Adding Schema for Linux User Accounts

← Older revision		Revision as of 15:34, 6 May 2022
Line 48:		Line 48:

	# Edit slapd.ldif again.		# Edit slapd.ldif again.
	# Find the line <code>include: file:///etc/openldap/schema/core.ldif</code> ~~and append~~ similar lines referencing ''cosine.ldif'', ''inetorgperson.ldif'', and ''nis.ldif''.		# Find the line <code>include: file:///etc/openldap/schema/core.ldif</code>
			# Append similar lines referencing ''cosine.ldif'', ''inetorgperson.ldif'', and ''nis.ldif''.

	It should look like this when you're done:		It should look like this when you're done:

Dhorton: /* Adding Schema for Linux User Accounts */

2022-05-06T15:33:43Z

Adding Schema for Linux User Accounts

← Older revision		Revision as of 15:33, 6 May 2022
Line 48:		Line 48:

	# Edit slapd.ldif again.		# Edit slapd.ldif again.
	# Find the line <code>include: file:///etc/openldap/schema/core.ldif</code> and append similar lines referencing cosine.ldif, inetorgperson.ldif, and nis.ldif.		# Find the line <code>include: file:///etc/openldap/schema/core.ldif</code> and append similar lines referencing ''cosine.ldif'', ''inetorgperson.ldif'', and ''nis.ldif''.

	It should look like this when you're done:		It should look like this when you're done: