OpenLDAP

Sudoers in LDAP

by

In addition to the standard sudoers file, sudo may be configured via LDAP. This can be especially useful for synchronizing sudoers in a large, distributed environment. You need to have LDAP server and client configured, if you do not have already, see my previous posts. LDAP schema extension for sudo is also required on LDAP … Read more

OpenDJ – online schema modification

by

opendj-logoI wrote before about schema conversion to LDIF format and how to add schemas offline by uploading them to config/schema directory in OpenDJ. Now I will describe how to extend schema online, without restart LDAP server. Most if not all LDAP servers now have possibility to modify configuration and schemas due LDIF files and ldapmodify tool. Let’s prepare our LDIF file, attributes first:

# cat us-newattrs.ldif

Read more

LDAP meta directory

by

Sometimes you need to combine two or more LDAP directories with same suffixes to one directory or you just need to have a proxy. My first attempts to combine two OpenLDAP directories was to make replication from two different sources. This solution however has some disadvantages. First of all: to have syncprov replication your environment must be uniform, this means all source servers and proxy needs to be OpenLDAP. Second: I observed that this is not so stable, because of mentioned earlier issues with OpenLDAP replication.

Read more

Mail delivery configuration with LDAP

by

Last time I wrote about users’ authentication in LDAP directory to allow them receiving and sending e-mails. Now is time to configure Postfix for mail delivery to appropriate mailboxes.
If you compile Postfix themselves, you need to remember to add support for LDAP. My description is based on Ubuntu, so I only need to install postfix-ldap package:

$ sudo -i
# apt-get install postfix-ldap

This will add support for ldap: maps in Postfix.

Now we go to Postfix configuration:

# cd /etc/postfix
# vi main.cf

Read more

Mail system authentication in LDAP

by

I suppose that Dovecot and Postfix are up and running, and you can receive and send mail with system user (see previous posts). It is time to configure authentication in LDAP.

Use of directory service to user authentication allows for flexible management of mail system, hosting and so on. LDAP is established standard for authentication and authorization and almost all software which requires authentication support this protocol.

Let’s begin from POP3/IMAP Dovecot server, which also deliver authentication mechanism for Postfix:


/usr/bin/sudo -i
cd /etc/dovecot
vi dovecot-ldap.conf

In this file you need to define LDAP server/s parameters, authentication method, filter and attributes. I list those most important:


hosts = localhost
auth_bind = yes
base = o=hosting,dc=example,dc=com
scope = subtree
user_attrs = homeDirectory=home
user_filter = (&(objectClass=mailUser)(mail=%u))
pass_attrs = mail=user,userPassword=password
pass_filter = (&(objectClass=mailUser)(mail=%u))

Schema conversion – LDAP to LDIF

by

The power of directory service is possibility to define your own object classes, attributes, rules and so on. It also allows grouping it in schemas, which you can add to LDAP configuration.

As for now most of schemas, which you can find in Internet is organized into blocks, which contains definitions of attributes and object classes. This looks like:

attribute type definition:


attributetype ( 1.3.6.1.4.1.32349.1.2.2.9 NAME 'accountStatus'
    DESC 'The status of a user account: active, disabled'
    EQUALITY caseIgnoreIA5Match
    SUBSTR caseIgnoreSubstringsMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    SINGLE-VALUE )