OpenLDAP config¶

• OpenLDAP config
  • OpenLDAP initialization
  • Extra Schemas

The proposed setup is:

• One openldap server

• One database for dc=athena-innovation,dc=gr
  • one central admin cn=admin,dc=athena-innovation,dc=gr who will have root access everywhere
  • one central ldapbind user cn=ldapbind,dc=athena-innovation.gr,dc=gr for binding for all subdomains

• Each subdomain goes under each own dc e.g. dc=imis,dc=athena-innovation,dc=gr
  • one admin cn=admin,dc=imis,dc=athena-innovation,dc=gr for each domain
  • one ldapbind user cn=ldapbind,dc=imis,dc=athena-innovation.gr,dc=gr for binding for domain

• Each domain gets itown db e.g. dc=dcu,dc=gr (bad idea, no global search!)
  • one admin cn=admin,dc=dcu,dc=gr for each domain
  • one ldapbind user cn=ldapbind,dc=dcu,dc=gr for binding for domain

• Users that do not belong in a subdomain go under dc=hq,dc=athena-innovation,dc=gr

• Anonymous can see address book attributes

• Users from each domain can read everything in their domains, but only anonymous level access to other domains

OpenLDAP initialization¶

• See sample slapd.conf for main slapd configuration

1. Start and stop slapd: /etc/init.d/slapd start && /etc/init.d/slapd stop
2. Use the script source:scripts/openldap/initLdap.sh (edit appropriately) to
   1. Init main database executing
      initLdap main
   2. Init extra domains (like hq) executing
      initLdap hq
   3. Init extra databases (like dc=dcu,dc=gr) executing
      initLdap db "dc=dcu,dc=gr"

• See slapd.athena.conf for complete configuration
  (use the following line to redirect syslog messages
  local4.* -/var/log/slapd.log )

Default password for admin users:12345
Default password for ldapbind users:12345

Extra Schemas¶

• For eduPerson the eduperson.schema is required
  (obtained from https://spaces.internet2.edu/display/macedir/OpenLDAP+eduPerson)

• For LSC synchronization the lscsync.schema is required

attributetype ( 1.3.6.1.4.1.4203.666.100.101.1
        NAME 'sAMAccountName'
        DESC 'Adds sAMAaccountName to users for easier identification of synced users'
        EQUALITY caseIgnoreMatch
        SUBSTR caseIgnoreSubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
attributetype ( 1.3.6.1.4.1.4203.666.100.101.2
        NAME 'userPrincipalName'
        DESC 'Adds sAMAaccountNAme@domain, planned for email-style login'
        EQUALITY caseIgnoreIA5Match
        SUBSTR caseIgnoreIA5SubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )

attributetype ( 1.3.6.1.4.1.4203.666.100.101.3
        NAME 'sourceDN'
        DESC 'Deprecated'
        EQUALITY distinguishedNameMatch
        SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )
attributetype ( 1.3.6.1.4.1.4203.666.100.101.8
        NAME 'uSNCreated'
        DESC 'Added to synchronized OUs. Together with the ou attribute the form the id for an OU'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

attributetype ( 1.3.6.1.4.1.4203.666.100.101.4
        NAME 'groupPrincipalName'
        DESC 'Adds sAMAaccountNAme@domain, no plans for it'
        EQUALITY caseIgnoreIA5Match
        SUBSTR caseIgnoreIA5SubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )

attributetype ( 1.3.6.1.4.1.4203.666.100.101.5
        NAME 'msADmemberOf'
        DESC 'Active Directory memberOf group attribute, for groups members of other groups'
        EQUALITY distinguishedNameMatch
        SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )
attributetype ( 1.3.6.1.4.1.4203.666.100.101.6
        NAME 'msADmember'
        DESC 'Active Directory member, the windows members of a group'
        EQUALITY distinguishedNameMatch
        SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )
attributetype ( 1.3.6.1.4.1.4203.666.100.101.7
        NAME 'msSFU30PosixMember'
        DESC 'Active Directory msSFU30PosixMember, the linux members of a SFU group'
        EQUALITY distinguishedNameMatch
        SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )

objectClass     ( 1.3.6.1.4.1.4203.666.100.102.1
    NAME 'synchronizedUser'
        DESC 'Adds extra attributes for user synchronization'
    AUXILIARY
        MAY  ( sAMAccountName $ userPrincipalName )
        )

objectClass     ( 1.3.6.1.4.1.4203.666.100.102.2
    NAME 'synchronizedOU'
        DESC 'Adds extra attributes for OU synchronization'
    AUXILIARY 
        MAY  ( sourceDN $ uSNCreated)
        )

objectClass     ( 1.3.6.1.4.1.4203.666.100.102.3
    NAME 'synchronizedGroup'
        DESC 'Adds extra attributes for group synchronization'
    AUXILIARY
        MAY  ( sAMAccountName $ userPrincipalName )
        )

objectClass     ( 1.3.6.1.4.1.4203.666.100.102.4
    NAME 'msADGroup'
        DESC 'Adds extra member attributes from Active Directory'
    AUXILIARY
        MAY  ( msADmemberOf $ msADmember $ msSFU30PosixMember)
        )