View source for OpenLDAP

{| style="text-align: left; background-color: AliceBlue;"
|-valign="top"
!Download Source:
| ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-{{OpenLDAP-Version}}.tgz
|}

----

{{Package-Introduction|The OpenLDAP package provides an open source implementation of the Lightweight Directory Access Protocol.|http://www.openldap.org/}}

{{Note|This page contains instructions to compile a OpenLDAP Server, Most of the time it is only the client libraries that are required, you can find this information on the [[OpenLDAP-Client]] page.}}

== Dependencies ==

=== Required ===
* [[Berkeley DB]] or [[GDBM]]

=== Recommended ===
* [[CyrusSASL]]
* [[OpenSSL]]

=== Optional ===
* [[TCP Wrappers]]
* [[unixODBC]]
* [[GNU Pth]]
* [[OpenSLP]]

== Configuration Information ==

If you really want to build OpenLDAP with GNU Database Manager instead of Berkeley DB, add the following flags to configure script:

 --disable-bdb --disable-hdb --with-ldbm-api=gdbm

== Non-Multilib ==

Compile the package:

 sed -i 's@\(^STRIP = \).*@\1 @' build/top.mk &&
 CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \
     --libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \
     --enable-dynamic --enable-crypt --enable-modules --enable-wrappers \
     --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod \
     --enable-monitor=mod --enable-perl=mod --enable-relay=mod \
     --enable-dyngroup=mod --enable-dynlist=mod --enable-memberof=mod \
     --enable-ppolicy=mod --enable-valsort=mod &&
 make depend &&
 make

Install the package

 make install &&
 ln -sv ../lib/openldap/slapd /usr/sbin/slapd &&
 install -dv -m755 /usr/share/doc/openldap-{{OpenLDAP-Version}}/{drafts,guide,rfc} &&
 install -v -m644 doc/drafts/* /usr/share/doc/openldap-{{OpenLDAP-Version}}/drafts &&
 install -v -m644 doc/rfc/*    /usr/share/doc/openldap-{{OpenLDAP-Version}}/rfc &&
 cp -Rv doc/guide/*          /usr/share/doc/openldap-{{OpenLDAP-Version}}/guide

== Multilib ==

=== 32Bit ===

Compile the package:

 sed -i 's@\(^STRIP = \).*@\1 @' build/top.mk &&
 CC="gcc ${BUILD32}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \
     --libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \
     --enable-dynamic --enable-crypt --enable-modules --enable-wrappers \
     --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod \
     --enable-monitor=mod --enable-perl=mod --enable-relay=mod \
     --enable-dyngroup=mod --enable-dynlist=mod --enable-memberof=mod \
     --enable-ppolicy=mod --enable-valsort=mod &&
 make depend &&
 make

Install the package

 make install

=== N32 ===

Compile the package:

 sed -i 's@\(^STRIP = \).*@\1 @' build/top.mk &&
 CC="gcc ${BUILDN32}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \
     --libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \
     --enable-dynamic --enable-crypt --enable-modules --enable-wrappers \
     --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod \
     --enable-monitor=mod --enable-perl=mod --enable-relay=mod \
     --enable-dyngroup=mod --enable-dynlist=mod --enable-memberof=mod \
     --enable-ppolicy=mod --enable-valsort=mod &&
 make depend &&
 make

Install the package

 make install

=== 64Bit ===

Compile the package:

 sed -i 's@\(^STRIP = \).*@\1 @' build/top.mk &&
 CC="gcc ${BUILD64}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr \
     --sysconfdir=/etc --libdir=/usr/lib64 --libexecdir=/usr/lib/openldap \
     --localstatedir=/srv/ldap --disable-debug \
     --enable-dynamic --enable-crypt --enable-modules --enable-wrappers \
     --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod \
     --enable-monitor=mod --enable-perl=mod --enable-relay=mod \
     --enable-dyngroup=mod --enable-dynlist=mod --enable-memberof=mod \
     --enable-ppolicy=mod --enable-valsort=mod &&
 make depend &&
 make

Install the package

 make install &&
 ln -sv ../lib/openldap/slapd /usr/sbin/slapd &&
 install -dv -m755 /usr/share/doc/openldap-{{OpenLDAP-Version}}/{drafts,guide,rfc} &&
 install -v -m644 doc/drafts/* /usr/share/doc/openldap-{{OpenLDAP-Version}}/drafts &&
 install -v -m644 doc/rfc/* /usr/share/doc/openldap-{{OpenLDAP-Version}}/rfc &&
 cp -Rv doc/guide/* /usr/share/doc/openldap-{{OpenLDAP-Version}}/guide

== Configuring ==

The information in the sections below are based off information from the following pages:

 http://www.bayour.com/LDAPv3-HOWTO.html
 http://aput.net/~jheiss/krbldap/

=== Additional Steps with Kerberos ===

If you plan on using LDAP with Kerberos you will need to create the LDAP Service Principle in the Kerberos database. You will also want to create a keytab for LDAP and LDAP alone.

 kadmin.local -q "addprinc -randkey ldap/'''''<fqdn of ldap server>'''''@'''''<REALMNAME.COM>'''''" &&
 kadmin.local -q "ktadd -k /etc/openldap/slapd.keytab ldap/'''''<fqdn of ldap server>'''''@'''''<REALMNAME.COM>'''''" &&
 chmod 600 /etc/openldap/slapd.keytab

You will also need to add the LDAP Service Principle to the system keytab aswell:

 kadmin.local -q "ktadd -k /etc/krb5.keytab ldap/'''''<fqdn of ldap server>'''''@'''''<REALMNAME.COM>'''''" &&
 chmod 600 /etc/krb5.keytab

The '''''slapd''''' binary in /usr/sbin should be a symlink. Remove it and put a wrapper script that will point ldap at the proper keytab in its place:

 rm /usr/sbin/slapd &&
 cat > /usr/sbin/slapd << "EOF"
 #!/bin/sh
 # Kerberos Wrapper Script for Slapd
 if [ -f /etc/openldap/ldap.keytab ]; then
   env KRB5_KTNAME=/etc/openldap/slapd.keytab /usr/lib/openldap/slapd "$@"
 else
   /usr/lib/openldap/slapd "$@"
 fi
 EOF

 chmod +x /usr/sbin/slapd

You also will want to create a user specifically for managing the ldap directory:

 kadmin.local -q "addprinc ldapadm@'''''<REALMNAME.COM>'''''"

=== slapd.conf ===

If you download the following schema files to the ldap schema directory you can remove the comments on the corresponding lines:

 http://cross-lfs.org/~jciccone/ldap-schemas/krb5-kdc.schema
 http://cross-lfs.org/~jciccone/ldap-schemas/sudo.schema

Creating a basic slapd configuration file:

 cat > /etc/openldap/slapd.conf << "EOF"
 # Begin /etc/openldap/slapd.conf
 
 # Schema Definitions
 include /etc/openldap/schema/core.schema
 include /etc/openldap/schema/cosine.schema
 include /etc/openldap/schema/inetorgperson.schema
 include /etc/openldap/schema/nis.schema
 #include /etc/openldap/schema/sudo.schema
 include /etc/openldap/schema/misc.schema
 #include /etc/openldap/schema/krb5-kdc.schema
 
 # The location of the PID file
 pidfile /srv/ldap/run/slapd.pid
 
 # List of arguments that will be passed to the server
 argsfile /srv/ldap/run/slapd.args
 
 # Load dynamic backend modules:
 modulepath /usr/lib/openldap/openldap
 moduleload back_bdb.la
 #moduleload back_ldap.la
 #moduleload back_ldbm.la
 #moduleload back_passwd.la
 #moduleload back_shell.la
 
 # Use crypt to hash the passwords
 password-hash {crypt}
 
 # If you wish to use cyrus-sasl to bind to
 # Kerberos uncomment and configure the
 # following lines
 #sasl-realm '''''<REALMNAME.COM>'''''
 #sasl-host '''''<FQDN OF SASL SERVER>'''''
 #sasl-secprops none
 
 # Map the kerberos principals to actual ldap entities.
 #authz-policy from
 #authz-regexp 
     "^uid=([^,]+),cn='''''<realm>''''',cn=gssapi,cn=auth"
     "uid=$1,ou=people,'''''<BASE DN>'''''"
 
 # Define SSL and TLS properties (optional)
 #TLSCertificateFile /etc/ssl/ldap.pem
 #TLSCertificateKeyFile /etc/openldap/ldap-key.pem
 #TLSCACertificateFile /etc/ssl/ldap.pem 
 
 #######################################################################
 # Access Lists
 #######################################################################
 
 access to attrs=userPassword
   by dn="cn=Manager,'''''<BASE DN>'''''" write
 #  by dn="uid=ldapadm,ou=people,'''''<BASE DN>'''''" write
   by dn="uid=root,ou=people,'''''<BASE DN>'''''" write
   by self write
   by anonymous auth
   by * none
 
 access to attrs=gecos,description,loginShell
   by self write
 
 access to *
   by dn="cn=Manager,'''''<BASE DN>'''''" write
 #  by dn="uid=ldapadm,ou=people,'''''<BASE DN>'''''" write
   by dn="uid=root,ou=people,'''''<BASE DN>'''''" write
   by * read
   by * search
 
 #######################################################################
 # BDB database definitions
 #######################################################################
 
 database bdb
 suffix "'''''<BASEDN>'''''"
 
 # By Default the rootdn always has complete access to the entire ldap directory regardless of ACLs
 # It is for this reason that after the database is populated, you disable the rootdn by either
 # removing or commenting out the following 2 lines.
 rootdn "cn=Manager,'''''<BASEDN>'''''"
 rootpw '''''<password hash>'''''
 
 directory "/srv/ldap/openldap-data"
 
 # Indexes
 index default pres,eq
 index objectClass,uid,uidnumber,gidnumber,cn
 index mail eq
 
 # End /etc/openldap/slapd.conf
 EOF

When creating the configuration file above replace ''<BASEDN>'' with your Base DN. eg. ''dc=cross-lfs,dc=org''.

You can generate a password hash for the rootdn with the following command:

 slappasswd -h {SHA}

=== Bootscript ===

Install the init script included in the [[bootscripts]] package.

 make install-openldap1

{{Note|The bootscript '''openldap1''' only starts slapd. '''openldap2''' starts slapd and slurpd.}}

=== Populating the Directory ===

Before continuing with the following, start the ldap service:

 /etc/rc.d/init.d/openldap start

Creating an initial LDIF:

 cat > entries.ldif << "EOF"
 # Organization for Example Corporation
 dn: '''''<BASEDN>'''''
 objectClass: dcObject
 objectClass: organization
 dc: '''''example'''''
 o: '''''Example Corporation'''''
 description: '''''The Example Corperation'''''
 
 # Organizational Role for Directory Manager
 dn: cn=Manager,'''''<BASEDN>'''''
 objectClass: organizationalRole
 cn: Manager
 description: Directory Manager
 EOF

Adding the entries into the LDAP directory:

 ldapadd -f entries.ldif -x -D "cn=Manager,'''''<BASEDN>'''''" -W

=== ldap.conf ===

Create a basic ldap.conf:

 cat > /etc/openldap/ldap.conf << "EOF"
 # Begin /etc/openldap/ldap.conf
 
 BASE    '''''<BASE DN>'''''
 URI     ldap://'''''<fqdn of ldap server>'''''
 
 #SASL_MECH      GSSAPI
 #SASL_REALM     '''''<REALM>'''''
 #SASL_SECPROPS  none
 
 # End /etc/openldap/ldap.conf
 EOF

=== Where to go from here? ===

Configuring clients to authenticate against LDAP, and possibly Kerberos

The [[nss_ldap]] page contains information on creating some base OUs (Organizational Units) and starting to create your users and groups.

[[Category:Servers]]