OpenLDAP
From CBLFS
Jump to navigationJump to search| Download Source: | ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.19.tgz |
|---|
Contents
Introduction to OpenLDAP
The OpenLDAP package provides an open source implementation of the Lightweight Directory Access Protocol.
Project Homepage: http://www.openldap.org/
Note
This page contains instructions to compile a OpenLDAP Server, Most of the time it is only the client libraries that are required, you can find this information on the OpenLDAP-Client page.
Dependencies
Required
- Berkeley DB or GDBM
Recommended
Optional
Configuration Information
If you really want to build OpenLDAP with GNU Database Manager instead of Berkeley DB, add the following flags to configure script:
--disable-bdb --disable-hdb --with-ldbm-api=gdbm
Non-Multilib
Compile the package:
CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \
--libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \
--enable-dynamic --enable-crypt --enable-modules --enable-wrappers \
--enable-bdb=mod --enable-hdb=mod --enable-ldap=mod \
--enable-monitor=mod --enable-perl=mod --enable-relay=mod \
--enable-dyngroup=mod --enable-dynlist=mod --enable-memberof=mod \
--enable-ppolicy=mod --enable-valsort=mod &&
make depend &&
make
Install the package
make install &&
ln -sv ../lib/openldap/slapd /usr/sbin/slapd &&
install -dv -m755 /usr/share/doc/openldap-2.4.19/{drafts,guide,rfc} &&
install -v -m644 doc/drafts/* /usr/share/doc/openldap-2.4.19/drafts &&
install -v -m644 doc/rfc/* /usr/share/doc/openldap-2.4.19/rfc &&
cp -Rv doc/guide/* /usr/share/doc/openldap-2.4.19/guide
Multilib
32Bit
Compile the package:
CC="gcc ${BUILD32}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \
--libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \
--enable-dynamic --enable-crypt --enable-modules --enable-wrappers \
--enable-bdb=mod --enable-hdb=mod --enable-ldap=mod \
--enable-monitor=mod --enable-perl=mod --enable-relay=mod \
--enable-dyngroup=mod --enable-dynlist=mod --enable-memberof=mod \
--enable-ppolicy=mod --enable-valsort=mod &&
make depend &&
make
Install the package
make install
N32
Compile the package:
CC="gcc ${BUILDN32}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \
--libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \
--enable-dynamic --enable-crypt --enable-modules --enable-wrappers \
--enable-bdb=mod --enable-hdb=mod --enable-ldap=mod \
--enable-monitor=mod --enable-perl=mod --enable-relay=mod \
--enable-dyngroup=mod --enable-dynlist=mod --enable-memberof=mod \
--enable-ppolicy=mod --enable-valsort=mod &&
make depend &&
make
Install the package
make install
64Bit
Compile the package:
CC="gcc ${BUILD64}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr \
--sysconfdir=/etc --libdir=/usr/lib64 --libexecdir=/usr/lib/openldap \
--localstatedir=/srv/ldap --disable-debug \
--enable-dynamic --enable-crypt --enable-modules --enable-wrappers \
--enable-bdb=mod --enable-hdb=mod --enable-ldap=mod \
--enable-monitor=mod --enable-perl=mod --enable-relay=mod \
--enable-dyngroup=mod --enable-dynlist=mod --enable-memberof=mod \
--enable-ppolicy=mod --enable-valsort=mod &&
make depend &&
make
Install the package
make install &&
ln -sv ../lib/openldap/slapd /usr/sbin/slapd &&
install -dv -m755 /usr/share/doc/openldap-2.4.19/{drafts,guide,rfc} &&
install -v -m644 doc/drafts/* /usr/share/doc/openldap-2.4.19/drafts &&
install -v -m644 doc/rfc/* /usr/share/doc/openldap-2.4.19/rfc &&
cp -Rv doc/guide/* /usr/share/doc/openldap-2.4.19/guide
Configuring
Additional Steps with Kerberos
If you plan on using LDAP with Kerberos you will need to create the LDAP Service Principle in the Kerberos database. You will also want to create a keytab for LDAP and LDAP alone.
kadmin.local -q "addprinc -randkey ldap/<fqdn of ldap server>@<REALMNAME.COM>" && kadmin.local -q "ktadd -k /etc/openldap/ldap.keytab ldap/<fqdn of ldap server>@<REALMNAME.COM>" && chmod 600 /etc/openldap/ldap.keytab
slapd.conf
If you download the following schema files to the ldap schema directory you can remove the comments on the corresponding lines:
http://cross-lfs.org/~jciccone/ldap-schemas/krb5-kdc.schema http://cross-lfs.org/~jciccone/ldap-schemas/sudo.schema
Creating a basic slapd configuration file:
cat > /etc/openldap/slapd.conf << "EOF"
# Begin /etc/openldap/slapd.conf
# Schema Definitions
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
#include /etc/openldap/schema/sudo.schema
include /etc/openldap/schema/misc.schema
#include /etc/openldap/schema/krb5-kdc.schema
# The location of the PID file
pidfile /srv/ldap/run/slapd.pid
# List of arguments that will be passed to the server
argsfile /srv/ldap/run/slapd.args
# Load dynamic backend modules:
modulepath /usr/lib/openldap/openldap
moduleload back_bdb.la
#moduleload back_ldap.la
#moduleload back_ldbm.la
#moduleload back_passwd.la
#moduleload back_shell.la
# Use crypt to hash the passwords
password-hash {crypt}
# If you wish to use cyrus-sasl to bind to
# Kerberos uncomment and configure the
# following lines
#sasl-realm <REALMNAME.COM>
#sasl-host <FQDN OF SASL SERVER>
# Define SSL and TLS properties (optional)
#TLSCertificateFile /etc/ssl/ldap.pem
#TLSCertificateKeyFile /etc/openldap/ldap-key.pem
#TLSCACertificateFile /etc/ssl/ldap.pem
#######################################################################
# Access Lists
#######################################################################
access to attrs=userPassword
by self write
by anonymous auth
by * none
access to attrs=gecos,description,loginShell
by self write
access to *
by * read
by * search
#######################################################################
# BDB database definitions
#######################################################################
database bdb
suffix "<BASEDN>"
# By Default the rootdn always has complete access to the entire ldap directory
rootdn "cn=Manager,<BASEDN>"
rootpw <password hash>
directory "/srv/ldap/openldap-data"
# Indexes
index default pres,eq
index objectClass,uid,uidnumber,gidnumber,cn
index mail eq
# End /etc/openldap/slapd.conf
EOF
When creating the configuration file above replace <BASEDN> with your Base DN. eg. dc=cross-lfs,dc=org.
You can generate a password hash for the rootdn with the following command:
slappasswd -h {SHA}
Bootscript
Install the init script included in the bootscripts package.
make install-openldap1
Note
The bootscript openldap1 only starts slapd. openldap2 starts slapd and slurpd.
Populating the Directory
Before continuing with the following, start the ldap service:
/etc/rc.d/init.d/openldap start
Creating an initial LDIF:
cat > entries.ldif << "EOF" # Organization for Example Corporation dn: <BASEDN> objectClass: dcObject objectClass: organization dc: example o: Example Corporation description: The Example Corperation # Organizational Role for Directory Manager dn: cn=Manager,<BASEDN> objectClass: organizationalRole cn: Manager description: Directory Manager EOF
Adding the entries into the LDAP directory:
ldapadd -f entries.ldif -x -D "cn=Manager,<BASEDN>" -W
