LDAP Applied (EuroOSCON 2005)
0 likes567 views
This talk will briefly review LDAP concepts, cover common uses of LDAP, and present examples of advanced LDAP usage to inspire using LDAP. It will not provide installation or configuration details for specific operating systems. The speaker will link to online slides and get information about the audience's LDAP knowledge and usage.
![LDAP and Perl
● From Perl, use Net::LDAP
use Net::LDAP;
$ldap = Net::LDAP->new('ldap.eurooscon.com');
$msg = $ldap->bind;
$msg = $ldap->search(
base=>”dc=example,dc=com”,
filter=>”(objectClass=*)”);
$msg->code && die $msg->error;
$result = $ldap->add(
“cn=fran,ou=People,dc=uab,dc=edu”,
attr => [ cn => [“Fran Fabrizio”],
mail => [“fran@cis.uab.edu”],
etc.....](https://image.slidesharecdn.com/eurooscon-ldap-applied-150104222833-conversion-gate02/85/LDAP-Applied-EuroOSCON-2005-38-320.jpg)
LDAP Applied (EuroOSCON 2005)
- 1. LDAP Applied Fran Fabrizio Sr. Systems Administrator Dept. of Computer & Information Sciences U of Alabama at Birmingham EuroOSCON Amsterdam, The Netherlands October 17-20, 2005
- 2. This talk.... WILL ● Briefly review LDAP concepts ● Cover common uses of LDAP ● Present examples of advanced usage ● Hopefully inspire you to use LDAP! WILL NOT ● Show you how to install LDAP ● Teach you how to configure LDAP in specific OSes ● Give all the details needed to use LDAP ● Leave you disappointed (hopefully!)
- 3. Link to Slides ● These slides are available now online at http://www.cis.uab.edu/fran/ if you wish to follow along ● They will also be available after the conference on the conference web site
- 4. Getting to Know the Audience ● How many of you know what LDAP is? ● How many of you are using LDAP right now? ● How many of you are using it for something other than user authentication or email address books?
- 5. Brief Review of LDAP What is it? What does it look like? Common Usage
- 6. What is LDAP? ● Lightweight Directory Access Protocol ● A standard protocol for accessing directory services ● Also used to refer to the directories being accessed ● Based on the X.500 specification ● Represents hierarchical information in entries consisting of a collection of attributes with a unique, or distinguished name
- 7. No really, what is LDAP? ● It's a good way to store data that is: – Mostly read access – Needed by many machines/services on the network – Generally represents collections of entities common in large organizations ● User and Group Accounts ● Computers ● Email Addresses and Contact Information ● Departments and Business Units
- 8. LDAP Structure ● An object class defines the valid attributes and properties for an entry ● A set of related object classes forms a schema. For example, you may have a schema to represent the users in a university department. ● Distinguished names similar to DNS. Ex: ou=People,dc=eurooscon,dc=example,dc=com ● LDIF (Lightweight Directory Interchange Format)
- 9. LDIF Example dn: uid=test,ou=People,dc=eurooscon,dc=example,dc=com cn: Test User uid: testuser uidNumber: 501 loginShell: /bin/sh homeDirectory: /home/testuser gidNumber: 100 userPassword:: e2NyeXB0fVRYaHRIa05GOUdBSWc= objectClass: posixAccount objectClass: shadowAccount objectClass: inetOrgPerson shadowLastChange: 13072 givenName: Test sn: User gecos: Test User
- 10. More on LDAP structure ● One entry can have multiple classes – only one can be structural (inetOrgPerson) – the rest are auxiliary ● For each class, there is a set of required attributes and a set of optional attributes. – If you are a posixAccount, you must have a uid and may have a description ● Each entry will have a unique distinguished name to reference it
- 11. Common Uses of LDAP ● User Directories: email addresses, students ● User Accounts: Centralizing accounts, access control, groups ● Inventory Catalogs: machines, offices ● Network Service Backend: DNS, Email ● Usually NOT a replacement for relational data
- 12. LDAP Applied Various Ways To Apply LDAP to Solve IT Problems
- 13. Migrating User Accounts to LDAP ● Why do you want to do this?
- 14. Migrating User Accounts to LDAP ● Why do you want to do this? ● To centralize user accounts
- 15. Migrating User Accounts to LDAP ● Why do you want to do this? ● To centralize user accounts ● To modernize from some other network account store (e.g. NIS)
- 16. Migrating User Accounts to LDAP ● Why do you want to do this? ● To centralize user accounts ● To modernize from some other network account store (e.g. NIS) ● Eliminate duplication of data (already using LDAP for corporate address book?)
- 17. Migrating User Accounts to LDAP ● Why do you want to do this? ● To centralize user accounts ● To modernize from some other network account store (e.g. NIS) ● Eliminate duplication of data (already using LDAP for corporate address book?) ● To better scale to the needs of a growing organization
- 18. Migrating User Accounts to LDAP ● NIS/NIS+ LDAP or /etc/passwd LDAP ● PADL.com MigrationTools scripts – May need to be modified ● General solution: – produce LDIF – Import into LDAP with ldapadd and ldapmodify
- 19. Migrating User Accounts to LDAP ● posixAccount – a standard LDAP schema to represent user accounts ● Demo: migrate_passwd.pl nisSchema.2.0 NAME 'posixAccount' SUP top AUXILIARY DESC 'Abstraction of an account with POSIX attributes' MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description )
- 20. Activating LDAP-Based Logins ● pam_ldap (from PADL.com), inserts into the PAM authentication stack and partners with nss_ldap (also PADL.com) to provide authentication against LDAP ● Seamlessly authenticates both local and LDAP- based users ● Many distros automate configuration (e.g. Fedora) ● Demo: pam_ldap configuration
- 21. Integrating LDAP and Email ● Client Side - why? – Address Book lookups in LDAP – Autocompletion of partial email addresses
- 22. Integrating LDAP and Email ● Client Side - why? – Address Book lookups in LDAP – Autocompletion of partial email addresses ● Server Side - why? – Store white/blacklists – virtual mailboxes – Aliases – User preferences
- 23. Integrating LDAP and Email ● Client Side - why? – Address Book lookups in LDAP – Autocompletion of partial email addresses ● Server Side - why? – Store white/blacklists – virtual mailboxes – Aliases – User preferences ● Add the inetOrgPerson schema to LDAP entries
- 24. LDAP and Email - Client ● Demo: Thunderbird and LDAP ● Many other email clients support LDAP lookups – Outlook, Outlook Express, Netscape, Pine, Eudora, Evolution, SquirrelMail, Mac Mail, etc... ● Clients can use LDAP for other things besides just address lookups – ex. SquirrelMail (web mail) has a plugin to store user preferences in LDAP.
- 25. LDAP and Email - Server ● Many email servers can integrate with LDAP ● Alias lookups (Postfix) alias_maps = hash:/etc/aliases, ldap:/etc/postfix/ldap-aliases.cf (all on one line) ldap-aliases.cf contains: server_host = 192.168.139.128 sever_base = dc=eurooscon,dc=example,dc=com ● Now, Postfix can deliver to both local and LDAP user mail aliases
- 26. LDAP and Email - Server ● Postfix expects a certain LDAP schema to support this (these names are configurable) dn: cn=Accounting Staff List, dc=my, dc=com cn: Accounting Staff List o: my.com objectclass: maillist mailacceptinggeneralid: accountingstaff mailacceptinggeneralid: accounting-staff maildrop: mylist-owner maildrop: an-accountant maildrop: some-other-accountant maildrop: this, that, theother
- 27. LDAP and Email - Server ● Common usage is virtual mailboxes (e.g. ISP) ● Another common usage is to rewrite addresses fran@eurooscon.example.com to Fran.Fabrizio@eurooscon.example.com ● Sendmail, Exim, Courier, Courier-IMAP, Cyrus, uw-imap, and Qmail (and many others) all support integration with LDAP to various degrees
- 28. LDAP and Web-Based Resources ● Authenticate users to gain access to restricted parts of web site ● mod_auth_ldap – Apache module ● User-based and group-based authentication
- 29. Using LDAP with Apache ● Apache 2.0 ships with mod_auth_ldap ● Restrict access to a directory with Location <Location /protected> AuthName “Protected Directory” AuthType basic AuthLDAPURL ldap://ldap.cis.uab.edu:389/ou=People,dc=cis,dc =uab,dc=edu require valid-user # OR require group membership instead AuthLDAPGroupAttribute memberUid AuthLDAPGroupAttributeIsDN off require group cn=admin,ou=group, dc=eurooscon,dc=example,dc=com </Location>
- 30. Using LDAP with Apache ● Demo: valid-user access ● Demo: group access
- 31. Advanced Apache/LDAP Integration ● Fancy filters AuthLDAPURL ldap://eurooscon.example.com:389/ou=people,dc=e urooscon,dc=example,dc=com??(| (pagerID=*)(uid=fran)) ● Demo: Fancy Filters Example – “LDAP Applied Attendees Only”
- 32. Fancy Filter Example ● Configuration for the demo... <Location /ldapapplied> AuthType basic AuthName "LDAP Applied Attendees Only" AuthLDAPURL ldap://192.168.139.128/ou=people,dc=eurooscon,dc=example,d c=com?uid??(comExampleEuroosconSession=LDAPApplied) require valid-user </Location>
- 33. Extending LDAP Schemas ● Last slide implies attribute comExampleEuroosconSession with a value of “LDAPApplied” exists for some users ● How'd that work? We extend the LDAP Schema... – Store information custom to your environment
- 34. local.schema ● We define a local schema for this attribute in a file called local.schema: attributetype (1.3.6.1.4.1.7341.999.2.1 NAME 'comExampleEuroosconSession' DESC 'a session at EuroOSCON' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectclass (1.3.6.1.4.1.7341.999.1.1 NAME 'comExampleEuroosconAttendee' DESC 'optional class to represent EuroOSCON sessions' AUXILIARY MAY comExampleEuroosconSession ) The “1.3.6.1.4.1.7341.999.2.1” is an OID, a unique LDAP object identifier. More information available at http://www.iana.org/. This one was taken from my workplace. You probably don't need to use them, but I do just to be complete.
- 35. local.schema continued ● We tell the LDAP server to include this in its known schemas include /etc/openldap/schema/local.schema ● Now LDAP user entries can have: – comExampleEuroosconAttendee - optional auxiliary class – comExampleEuroosconSession – optional attribute within that class
- 36. LDAP and DNS ● Storing DNS tables in LDAP instead of flat files ● Bind, tinydns, PowerDNS and others support this ● dnsZone structural object class ● zone2ldap tool with bind will convert flat files to LDAP
- 37. Scripting LDAP Getting at LDAP from various languages
- 38. LDAP and Perl ● From Perl, use Net::LDAP use Net::LDAP; $ldap = Net::LDAP->new('ldap.eurooscon.com'); $msg = $ldap->bind; $msg = $ldap->search( base=>”dc=example,dc=com”, filter=>”(objectClass=*)”); $msg->code && die $msg->error; $result = $ldap->add( “cn=fran,ou=People,dc=uab,dc=edu”, attr => [ cn => [“Fran Fabrizio”], mail => [“fran@cis.uab.edu”], etc.....
- 39. LDAP and Perl ● Demo: Adding a User from Perl
- 40. LDAP and PHP ● PHP has an LDAP API <?php $ldap = ldap_connect('ldap.cis.uab.edu'); $result = ldap_bind($ldap); $search=ldap_search($ldap, “dc=cis,dc=uab,dc=edu”, “sn=Fabr*”); $data = ldap_get_entries($ldap, $search); $result = ldap_add(.....);
- 41. Programmatic LDAP - Others ● Java – Support through the JNDI or JLDAP (openldap.org) ● C – OpenLDAP's C API ● Ruby – Ruby-ldap ● Python – Python-ldap
- 42. LDAP and Relational Data ● Would be neat to do queries that link LDAP and relational data – Example: CIS Web Site ● dblink-ldap – http://pgfoundry.org/projects/dblink-ldap/ – beta project to provide LDAP data as a table/view within PostgreSQL ● Microsoft has OLE DB Provider for Directory Services – access AD with SQL queries
- 43. LDAP and Windows Strategies for LDAP in a multiplatform environment
- 44. Strategy 1: AD -is- LDAP ● Active Directory -is- an LDAP version 3 server
- 45. Strategy 1: AD -is- LDAP ● Active Directory -is- an LDAP version 3 server ● AD can import LDIF – Ldifde.exe included with Windows Server 2003 and supports batch LDIF operations
- 46. Strategy 1: AD -is- LDAP ● Active Directory -is- an LDAP version 3 server ● AD can import LDIF – Ldifde.exe included with Windows Server 2003 and supports batch LDIF operations ● Can also script from VBScript
- 47. Strategy 1: AD -is- LDAP ● Active Directory -is- an LDAP version 3 server ● AD can import LDIF – Ldifde.exe included with Windows Server 2003 and supports batch LDIF operations ● Can also script from VBScript ● AD4Unix is a plugin (sf.net/projects/ad4unix) that adds Unix attributes to AD and manages them through AD Users and Computers MMC.
- 48. Strategy 1: AD -is- LDAP ● Active Directory -is- an LDAP version 3 server ● AD can import LDIF – Ldifde.exe included with Windows Server 2003 and supports batch LDIF operations ● Can also script from VBScript ● AD4Unix is a plugin (sf.net/projects/ad4unix) that adds Unix attributes to AD and manages them through AD Users and Computers MMC. ● pam_ldap can auth against AD
- 49. Strategy 1: AD -is- LDAP ● This model can be expanded to allow pam_ldap to update user passwords in AD
- 50. Strategy 1: AD -is- LDAP ● This model can be expanded to allow pam_ldap to update user passwords in AD ● Additionally, nss_ldap can also talk to AD, but is expecting Unix-like attributes for home dirs, uid/gid, shells, etc... – Installing MS's Services for Unix installs the NIS server, which has the side effect of doing this for you – Or, extend the schema yourself – install MKSADExtPlugin, and register the Active Directory Schema MMC to set the option to allow schema edits
- 51. Strategy 2: Migrate AD to LDAP ● ldifde.exe can export AD forest
- 52. Strategy 2: Migrate AD to LDAP ● ldifde.exe can export AD forest ● Unless you plan to use Kerberos authentication with your LDAP server, you'll need to reset users' passwords
- 53. Strategy 2: Migrate AD to LDAP ● ldifde.exe can export AD forest ● Unless you plan to use Kerberos authentication with your LDAP server, you'll need to reset users' passwords ● This will also require alteration of the LDIF that Microsoft produces to be more Unix friendly
- 54. Strategy 2: Migrate AD to LDAP ● ldifde.exe can export AD forest ● Unless you plan to use Kerberos authentication with your LDAP server, you'll need to reset users' passwords ● This will also require alteration of the LDIF that Microsoft produces to be more Unix friendly ● pGina can authenticate Windows clients against Unix LDAP server
- 55. Strategy 2: pGina ● pGina is an open source replacement for Microsoft's Gina (Graphical Identification and Authentication)
- 56. Strategy 2: pGina ● pGina is an open source replacement for Microsoft's Gina (Graphical Identification and Authentication) ● Allows Windows clients to authenticate against various sources via a plugin architecture – including LDAP, of course
- 57. Strategy 2: pGina ● pGina is an open source replacement for Microsoft's Gina (Graphical Identification and Authentication) ● Allows Windows clients to authenticate against various sources via a plugin architecture – including LDAP, of course ● Highly customizable
- 58. Strategy 2: pGina ● pGina is an open source replacement for Microsoft's Gina (Graphical Identification and Authentication) ● Allows Windows clients to authenticate against various sources via a plugin architecture – including LDAP, of course ● Highly customizable ● Demo: pGina
- 59. Monitoring LDAP ● Reading LDAP logs – Debug levels allow output of useful information – /usr/sbin/slapd -d xxx ● 8 – connection management ● 32 – search filter processing ● 64 – config file processing ● 128 – access control list processing ● 256 – connections/operations/results ● additive – 288 is conn/ops/results and search filters
- 60. Managing LDAP ● Command line – ldap* and slap* tools for OpenLDAP ● Scripting ● GQ – Simple GTK+/GTK2 GUI – sf.net/projects/gqclient ● Webmin – webmin.com – LDAP Users and Groups plugin ● Demo: webmin
- 61. Other Uses of LDAP ● Samba authentication – advantages over smbpasswd file ● Serving certificates ● Machine configurations ● Radius authentication ● Managing network printers
- 62. Conclusions ● LDAP can consolidate many administrative tasks ● LDAP is optimized for reads and will be faster than SQL for simple reads ● LDAP can improve scalability – all mail servers in organization can use same data store, for instance ● Once in place, LDAP can often be reapplied to solve new problems
- 63. For More Information ● www.openldap.org ● PADL.com – pam_ldap – nss_ldap – MigrationTools ● Book: LDAP System Administration by Gerald Carter, published by O'Reilly – More detail about a lot of these ideas is found there
- 64. Thank You ● Thanks for coming! ● My contact information is: Fran Fabrizio fran@cis.uab.edu http://www.cis.uab.edu/fran/ ● Feel free to email any questions you may have, or catch me at the conference for the rest of the week!