So I'm not a big fan of LDAP of any kind. It could entirely be out of ignorance I will admit to that. It seems very out dated when the info you store can be done SOOOO much easier in a database.
Having said that it seems all "real" applications have an LDAP server back end. So, tonight I have decided that this is the night when flyingspheres has a working LDAP server. Not that I really need one mind you it is really just me for the most part, but to really play with security modules in Java you need to have the container working together with an ldap server.
So here we go...
I will be referencing lots of sites to get this work done. Mostly cause me not so smart when it come to LDAP...
OpenLDAP comes down from the friendly synaptic manager. Once you get that installed (very easily mind you) you get a new config directory at /etc/ldap which looks like this:
-rw-r--r-- 1 root root 333 2007-04-27 10:19 ldap.conf
drwxr-xr-x 2 root root 4096 2007-12-03 14:05 sasl2
drwxr-xr-x 2 root root 4096 2008-02-08 18:38 schema
-rw------- 1 root root 4340 2008-02-14 21:56 slapd.conf
Now, when I installed OpenLDAP I think my server wasn't named very well so if you were to try and connect to me (and I opened a hole in my firewall) you would see the DN of nodomain. Heh, is that cool or what?
So first order of business how do I change that?
Sprinkled liberally throughout our slapd.conf file is a reference to nodomain. This is no doubt a problem. Before we go mucking around it let's back up that file first...
... ok backup complete.
Now let's go through and change the cn="nodomain" to cn="flyingspheres",cn="com" (make sure you get them all).
Ok, that's done.
YoLinux points out that the database our ldap server is under the directory attribute. By default uBuntu put mine here: "/var/lib/ldap". Common sense says that's where the nodomain database lives so I'm going to move it somewhere else. if you look in that /var/lib/ldap directory there is a lot of stuff there. I wonder what it all is... oh well.... so made my new directory and pointed slapd.conf to it. I'm hoping that when I restart slapd (openLdap) all that stuff will be created in my new directory. Once the directory is created and slapd points to the correct location it's time for a restart. (upon restart there was no love.... my directory was empty... maybe that's ok).
So after about 20 minutes of poking around looking through the OpenLdap link things started working.... I can connect there are db files in the directory defined for the db. I initially created an ldif file with only the admin user and that worked pretty well, although connecting went through anonymous bind only.
So, many minutes later (maybe an hour or so). There is a mildly intuitive relationship between the object classes and attributes to what you are wanting to store in your LDAP. I'm sure if someone reading this knows what they're doing they're laughing now. You need to pull in the objectClasses that you want into your LDIF file and then add the attributes you care about (and the ones that are required, hopefully they're the same).
I ran the ldapadd probably 50 times trying to figure out the right combination.
Like I said I'm not a real big fan of LDAP...
-Aaron
No comments:
Post a Comment