Installing & Configuring OpenLDAP

Submitted by brians on

This procedure is targeted at the Ubuntu 12.04 LTS (Precise Pangolin) distribution. It also explains how to set up the on-line configuration (OLC) directory information tree (DIT) for dynamic configuration without needing to restart or reload the server software.

  • Install OpenLDAP and the LDAP tools packages. You will be asked to provide a base DN for the new installation, as well as an administrative password. 
    apt-get install slapd ldap-utils
  • Edit /etc/default/slapd and change the SLAPD_SERVICES line to match the following: 
    SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///"
  • Restart the LDAP server. 
    service slapd restart
  • Create an LDIF file to activate the memberOf overlay. This overlay enables clients to determine which groups a given directory entry is a member of without having to perform an additional search, which is useful in situations such as granting access rights to resources based on group membership. The administrator only has to indicate which directory entries are members of a given group, which automatically updates each member's memberOf attribute to reflect the current membership status. 
    cat > /etc/ldap/backend.memberof.ldif <<EOT
dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
objectClass: top
olcModulePath: /usr/lib/ldap
olcModuleLoad: memberof.la
 
dn: olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
EOT
  • Create an LDIF file to activate referential integrity for the memberOf attributes. This overlay is useful to ensure that when user accounts are modified or deleted from the directory, the corresponding member attribute in groups in which the user was a member is also handled accordingly. 
    cat > /etc/ldap/backend.refint.ldif <<EOT
dn: cn=module,cn=config
cn: module
objectclass: olcModuleList
objectclass: top
olcmoduleload: refint.la
olcmodulepath: /usr/lib/ldap
 
dn: olcOverlay={1}refint,olcDatabase={1}hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: {1}refint
olcRefintAttribute: memberof member manager owner
EOT
  • Create an LDIF file that will be used to enable remote access to the backend configuration. This allows configuration changes to be made from clients such as Apache Directory Studio or phpLDAPadmin that are running on a host separate from the OpenLDAP server. 
    cat > /etc/ldap/backend.remote_access.ldif <<EOT
dn: olcDatabase={-1}frontend,cn=config
changetype: modify
delete: olcAccess
 
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootDN
olcRootDN: cn=admin,cn=config
 
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
# Password is set to "admin" - use slappasswd to generate a new one if desired
olcRootPW: {SSHA}cmaKopt8ZxsY1YvGrhhp8DyEs2itmN3w
 
dn: olcDatabase={0}config,cn=config
changetype: modify
delete: olcAccess
EOT
  • Apply the backend configurations to OpenLDAP. 
    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/backend.memberof.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/backend.refint.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/backend.remote_access.ldif
  • Validate the configuration with the following command (when prompted, use the password that was set above for the cn=admin,cn=config administrative user). 
    ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W
  • If you wish to set up a secured LDAPS or TLS connection, the following lines add the CA certificate, server key and server certificate files to the OpenLDAP configuration. 
    ldapmodify -x -D cn=admin,cn=config -W -H ldapi:/// << EOT
dn: cn=config
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/ssl/ldaps_cert.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/ssl/ldaps_key.pem
EOT

    Interesting observation: when using a wildcard certificate that requires an accompanying intermediate bundle certificate, simply concatenating the contents of the intermediate bundle to the end of the wildcard certificate and then restarting slapd got the signing CA to be recognized by my LDAP clients.

  • Check that TLS works: 
    ldapsearch -x -LLL -h ldap.example.com -ZZ -b dc=example,dc=com

Information sources:

Tags: