Installing OpenLDAP-2.4 and Configuring Apache DS – Part 2
This web series is brought to you by: dOpenSource and Flyball Labs
This post is PART 2 of a series that details how to install Apache Directory Studio and OpenLDAP server and connect the two seamlessly. In the last post we went over installing OpenLDAP server and you should now have an operating OpenLDAP server on either a Debian based or Cent-OS based machine.
If you haven’t read PART 1 you can find it here: Installing OpenLDAP
We will now go over adding users, groups and organizations to your nice and shiny OpenLDAP server. These are all LDAP entries that will go in your OpenLDAP tree. The examples below assume that the domain is dopensource.com but, you MUST REPLACE this with your own domain. Lets get started!
Requirements
This guide assumes you have either a Debian-based or cent-os / red-hat based linux distro.
This guide also assumes that you have root access on the server to install the software.
This guide assumes you have followed the steps in PART 1 of the series and have an OpenLDAP server configured and running already.
Adding LDAP entries to your OpenLDAP tree
Switch to root user and enter your root users pw
Either using sudo:
sudo -i
Or if you prefer using su:
su
Adding an Organization Unit (OU)
Lets add an OU to our tree called ‘users’ that will hold all of our companies users.
We will modify our tree the same we did before, using tmp .ldif files and loading into ldap.
cat << EOF > /tmp/users.ldif
dn: ou=Users,dc=dopensource,dc=com
objectClass: organizationalUnit
ou: Users
EOF
Then add it to the tree using the following cmd:
ldapadd -f /tmp/users.ldif -D cn=Manager,dc=dopensource,dc=com -w < ldap admin pw >
And of course we clean up after ourselves:
rm -f /tmp/users.ldif
Lets check out our new and shiny organization in ldap:
ldapsearch -x -L -b dc=dopensource,dc=com
Adding Users to the OU
Next lets add some of our employess to the users OU:
cat << EOF > /tmp/fred.ldif
dn: cn=Fred Flintstone,ou=Users,dc=dopensource,dc=com
cn: Fred Flintstone
sn: Flintstone
objectClass: inetOrgPerson
userPassword: < user password >
uid: fflintstone
EOF
cat << EOF > /tmp/wilma.ldif
dn: cn=Wilma Flintstone,ou=Users,dc=dopensource,dc=com
cn: Wilma Flintstone
sn: Flintstone
objectClass: inetOrgPerson
userPassword: < user password >
uid: wflintstone
EOF
Like before we need to add the entry to our tree:
ldapadd -f fred.ldif -D cn=Manager,dc=dopensource,dc=com -w < ldap admin pw >
ldapadd -f wilma.ldif -D cn=Manager,dc=dopensource,dc=com -w < ldap admin pw >
And then cleanup for a nice and clean system:
rm -f /tmp/fred.ldif
rm -f /tmp/wilma.ldif
Lets make sure we didn’t miss any employees in our long list of users:
ldapsearch -x -L -b ou=Users,dc=dopensource,dc=com
Adding a Group to the OU
We have to seperate our employees because the Engineers don’t play nice with the Salesperson’s:
cat << EOF > /tmp/engineering.ldif
dn: cn=Engineering,ou=Users,dc=dopensource,dc=com
cn: Engineering
objectClass: groupOfNames
member: cn=Fred Flintstone,ou=Users,dc=dopensource,dc=com
EOF
cat << EOF > /tmp/sales.ldif
dn: cn=Sales,ou=Users,dc=dopensource,dc=com
cn: Sales
objectClass: groupOfNames
member: cn=Wilma Flintstone,ou=Users,dc=dopensource,dc=com
EOF
Lets add it to the good ‘ol christmass tree of ldap:
ldapadd -f /tmp/engineering.ldif -D cn=Manager,dc=dopensource,dc=com -w < ldap admin pw >
ldapadd -f /tmp/sales.ldif -D cn=Manager,dc=dopensource,dc=com -w < ldap admin pw >
And we have to cleanup after the holiday party:
rm -f /tmp/engineering.ldif
rm -f /tmp/sales.ldif
Lets check our groups and make sure they mingle well together:
ldapsearch -x -L -b ou=Users,dc=dopensource,dc=com cn=Engineering
ldapsearch -x -L -b ou=Users,dc=dopensource,dc=com cn=Sales
We can narrow it down even further, if we only want to see what groups exist:
ldapsearch -x -LLL -b "ou=Users,dc=dopensource,dc=com" "(&(objectclass=groupOfNames))" *
Adding an Existing User to an Existing Group
So Fred is sick and tired of R&D and wants to sell stuff, lets transfer him over to sales:
cat << EOF > /tmp/addtogroup.ldif
dn: cn=Sales,ou=Users,dc=dopensource,dc=com
changetype: modify
add: member
member: cn=Fred Flintstone,ou=Users,dc=dopensource,dc=com
EOF
Get him on the sales floor by adding into Sales group:
ldapadd -f /tmp/addtogroup.ldif -D cn=Manager,dc=dopensource,dc=com -w < ldap admin pw >
Gotta cleanup his desk before we go visit:
rm -f /tmp/addtogroup.ldif
Lets check out Fred’s new office:
ldapsearch -x -LLL -b "ou=Users,dc=dopensource,dc=com" "(&(cn=Engineering))" member
Looks like he’s right next to Wilma, hopefully they work well together 🙂
For More Information
For more information, the next post in the series or for any questions visit us at:
For Professional services and Ldap configurations see:
dOpenSource OepnLDAP
dOpenSource OpenLDAP Services
Written By:
DevOpSec
Software Engineer
Flyball Labs