Enable the following two lines in /etc/ldap/ldap.conf, creating the file if necessary:

Transcription

1 Installation The package will be installed from the official Debian repositories. apt-get install slapd ldap-utils Add an entry in /etc/hosts to define an address to the directory: ldap.localdomain ldap Enable the following two lines in /etc/ldap/ldap.conf, creating the file if necessary: BASE dc=localdomain URI ldap://ldap.localdomain/ Then, let's edit the server's configuration file, /etc/ldap/slapd.conf, to fine-tune its behavior. Change the verbosity level from 0 or "none" to 256: loglevel 256 Search for line "index objectclass eq" and add another search index. In particular combinations, it may be possible to receive no results when the searched entries are not indexed, so this step is important: index objectclass eq index uid eq To make the new index option apply, run the following four commands: /etc/init.d/slapd stop sudo -u openldap slapindex chown -c openldap:openldap /var/lib/ldap/* #not required if slapindex has been executed as openldap /etc/init.d/slapd start Normally, openldap works even if there no much information. Try it with ldapsearch (performs operations "online", using the LDAP protocol) and slapcat (performs operations "offline", directly by opening files on the local filesystem). ldapsearch -x -b "dc=localdomain" slapcat Basic tree structure Here is a basic tree structure which contains "people" and "groups" as Organizational Unit and several groups and users within this Unit. The organizational unit will be called /var/tmp/ou.ldif:

2 dn: dc=localdomain objectclass: top objectclass: dcobject objectclass: organization dc: localdomain dn: ou=people,dc=localdomain ou: people objectclass: organizationalunit dn: ou=groups,dc=localdomain ou: groups objectclass: organizationalunit ldapadd -c -x -D "cn=admin,dc=localdomain" -W -f /var/tmp/ou.ldif The people to add will be called /var/tmp/users.ldif: dn: uid=fpfis_ldap_read,dc=localdomain uid: fpfis_ldap_read cn: fpfis_ldap_read sn: LDAP USER FOR READ DO NOT ALTER (sn) givenname: fpfis_ldap_read mail: description: LDAP applicative user used for reading data - DOT NOT ALTER userpassword: {SSHA}F0wAzx+BqIqAxrnxAgFqPZquQnfEcXkS dn: uid=fpfis_ldap_write,dc=localdomain uid: fpfis_ldap_write cn: fpfis_ldap_write sn: LDAP USER FOR WRITE DO NOT ALTER (sn) givenname: fpfis_ldap_write mail: fpfis_ldap_write@localhost.localdomain description: LDAP applicative user used for writing data - DOT NOT ALTER userpassword: {SSHA}/lT3W6waflCgbQGnEIoPeSLsPhakujW9 dn: uid=fpfis_admin,ou=people,dc=localdomain uid: fpfis_admin cn: ADMINISTRATOR (cn) sn: ADMINISTRATOR (sn) givenname: admin mail: fpfis_admin@example.com

3 telephonenumber: 1111 description: admin of the platform preferredlanguage: FR_fr dn: uid=fpfis_moderator,ou=people,dc=localdomain uid: fpfis_moderator cn: MODERATOR (cn) sn: MODERATOR (sn) givenname: moderator mail: telephonenumber: 2222 description: moderator of the platform dn: uid=fpfis_editor,ou=people,dc=localdomain uid: fpfis_editor cn: MODERATOR (cn) sn: MODERATOR (sn) givenname: moderator mail: telephonenumber: 2222 description: editor of the platform preferredlanguage: DE_de dn: uid=user1,ou=people,dc=localdomain uid: user1 cn: USER1 (cn) sn: USER1 (sn) givenname: USER1 (givenname) mail: telephonenumber: 3333 description: just a registered user preferredlanguage: EN_us dn: uid=user2,ou=people,dc=localdomain

4 uid: user2 cn: USER2 (cn) sn: USER2 (sn) givenname: USER2 (givenname) mail: title: Ms telephonenumber: 4444 description: just a registered user preferredlanguage: EN_us ldapadd -c -x -D "cn=admin,dc=localdomain" -W -f /var/tmp/users.ldif The groups to add will be called /var/tmp/groups.ldif: dn: cn=administrators,ou=groups,dc=localdomain cn: administrators description: administrators of the platform member: uid=fpfis_admin,ou=people,dc=localdomain dn: cn=moderators,ou=groups,dc=localdomain cn: moderators description: moderators of the platform member: uid=fpfis_moderator,ou=people,dc=localdomain dn: cn=editors,ou=groups,dc=localdomain cn: editors description: editors of the platform member: uid=fpfis_editor,ou=people,dc=localdomain dn: cn=users,ou=groups,dc=localdomain cn: users description: users of the platform owner: uid=admin_fpfis,ou=people,dc=localdomain member: uid=user1,ou=people,dc=localdomain member: uid=user2,ou=people,dc=localdomain ldapadd -c -x -D "cn=admin,dc=localdomain" -W -f /var/tmp/groups.ldif Let's use ldapsearch to verify the user entry has been created.

5 ldapsearch -x -b "dc=localdomain" "uid=user1" Add a password to a user: ldappasswd -x -D "cn=admin,dc=localdomain" -W -S "uid=user1,ou=people,dc=localdomain" Activate LDAP module for Apache We need to activate the LDAP module for Apache: a2enmod ldap Apache has to be re-started: /etc/init.d/apache2 restart Available and enabled modules of Apache are listed in /etc/apache2/mods-available/ and /etc/apache2/mods-enabled/.