How we implemented an LDAP directory for Laboratories A Case Study at Hong Kong Institute of Vocational Education (Tsing Yi), Department of ICT Nick Urbanik This work is licensed under the Creative Commons Attribution License. To view a copy of this license, visit http://creativecommons.org/licenses/by/2.1/au/ or send a letter to Creative Commons, 543 Howard Street, 5th Floor, San Francisco, California, 94105, USA. A Original work available with all LTEX and xfig source files at http://nicku.org/slug-talks/ldap-slug-talk/ Sydney Linux Users Group (SLUG) Building 2, Level 4, Room 410, UTS Broadway 24 June 2005, 8.20 pm SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 1/99 Getting Started What do you already know about LDAP? What Do You Want? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References Ummm, Err, ummm. . . Errrrrr . . . what shall we do? SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 2/99 What do you already know about I LDAP? Getting Started What do you already know about LDAP? How many know that a directory is tree shaped? What Do You Want? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 3/99 What do you already know about I I LDAP? Getting Started What do you already know about LDAP? How many know that a directory is tree shaped? How many have worked with a directory before? What Do You Want? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 3/99 What do you already know about I I I LDAP? Getting Started What do you already know about LDAP? How many know that a directory is tree shaped? How many have worked with a directory before? How many know about SNMP object IDs? What Do You Want? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 3/99 What do you already know about I I I I LDAP? Getting Started What do you already know about LDAP? How many know that a directory is tree shaped? How many have worked with a directory before? How many know about SNMP object IDs? How many know . . . What Do You Want? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 3/99 What do you already know about I I I I I LDAP? Getting Started What do you already know about LDAP? How many know that a directory is tree shaped? How many have worked with a directory before? How many know about SNMP object IDs? How many know . . . What. . . is the air-speed velocity of an unladen swallow? What Do You Want? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 3/99 What do you already know about I I I I I I LDAP? Getting Started What do you already know about LDAP? How many know that a directory is tree shaped? How many have worked with a directory before? How many know about SNMP object IDs? How many know . . . What. . . is the air-speed velocity of an unladen swallow? The European swallow appears to do about 11 ms−1 What Do You Want? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 3/99 What Do You Want? I I could talk for ten hours Getting Started What do you already know about LDAP? What Do You Want? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 4/99 What Do You Want? I I I could talk for ten hours (actually, I could go on for twenty after a few beers) N . . . but we have only an hour Getting Started What do you already know about LDAP? What Do You Want? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 4/99 What Do You Want? I I I I could talk for ten hours (actually, I could go on for twenty after a few beers) N . . . but we have only an hour What topics do you want us to cover here? N I think we need to understand the basics of LDAP itself I operations I some simple tools N . . . to make sense of other topics, especially programming N The basics of the way inheritance works in LDAP is important when understanding how to design a schema Getting Started What do you already know about LDAP? What Do You Want? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 4/99 Getting Started Argument for LDAP Account Information Network Accounts Network Accounts — 2 Methods of achieving this Directory systems for authentication Proprietary application directories Problem with proprietary directories Why not buy Microsoft AD? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 5/99 References Reasons for and problems with alternatives LDAP We don’t have time for this! Account Information I I I I I The computer uses numbers to refer to users and groups Humans prefer to use names (like nicku) When you create files in your shared network drive, the client must access them using the same numbers The user ID numbers and group ID numbers must be the same on all computers Otherwise won’t be able to read own files! Getting Started Argument for LDAP Account Information Network Accounts Network Accounts — 2 Methods of achieving this Directory systems for authentication Proprietary application directories Problem with proprietary directories Why not buy Microsoft AD? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 6/99 References Network Accounts I $ ls -ln file Getting Started -rw-rw---I 1 500 500 2057 Nov 1 Argument for LDAP 2000 file Network Accounts I Now nicku with user ID number 500 and group ID 500 can read and write this file . . . But nicku with user ID number 2270 and group ID number 2270 cannot access the file at all: Account Information Network Accounts — 2 Methods of achieving this Directory systems for authentication Proprietary application directories Problem with proprietary directories $ id Why not buy Microsoft AD? uid=2270(nicku) gid=2270(nicku) groups=2270(nicku),14171(staff) LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 7/99 References Network Accounts — 2 I I The user ID numbers and group ID numbers on files on a network drive are fixed The user ID numbers should remain unchanged for all users who read/write the network drive. Getting Started Argument for LDAP Account Information Network Accounts Network Accounts — 2 Methods of achieving this Directory systems for authentication Proprietary application directories Problem with proprietary directories Why not buy Microsoft AD? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 8/99 References Methods of achieving this I I I I Have a directory server of some kind The directory server associates a fixed user ID number with each login ID . . . and a fixed group ID number for each group ID On NT, these are called SIDs (security IDs) Getting Started Argument for LDAP Account Information Network Accounts Network Accounts — 2 Methods of achieving this Directory systems for authentication Proprietary application directories Problem with proprietary directories Why not buy Microsoft AD? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 9/99 References Directory systems for authentication I Proprietary: N Novell Directory Services (NDS) N Microsoft Active Directory (M? AD) N NT 4 domain N NIS + (Network Information System plus) N NIS Getting Started Argument for LDAP Account Information Network Accounts Network Accounts — 2 Methods of achieving this Directory systems for authentication Proprietary application directories Problem with proprietary directories Why not buy Microsoft AD? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about I Open protocols: N LDAP N Hessiod SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 10/99 References Proprietary application directories I I I I Application-specific directories: N Lotus Notes N cc:Mail N Microsoft Exchange N Novell GroupWise These directories come bundled with, or, embedded into an application such as email. If add another such application, must manage one more directory (“N + 1 directory problem”) If add another user, must add to all the directories. Getting Started Argument for LDAP Account Information Network Accounts Network Accounts — 2 Methods of achieving this Directory systems for authentication Proprietary application directories Problem with proprietary directories Why not buy Microsoft AD? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 11/99 References Problem with proprietary directories I I I I Need put the same user into many different directories Need maintain N times the number of user accounts, where N is the number of directories. This is just too much work. The accounts get out of sync. Getting Started Argument for LDAP Account Information Network Accounts Network Accounts — 2 Methods of achieving this Directory systems for authentication Proprietary application directories Problem with proprietary directories Why not buy Microsoft AD? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 12/99 References Why not buy Microsoft AD? I Microsoft leverage their monopoly on the desktop to “embrace and extend” free software written by others Example: N Kerberos is a “Network Authentication Service”, an IETF standard (see RFC 1510) N Kerberos is written by cooperating programmers round the world N Microsoft took Kerberos, and modified the protocol very slightly (they classified this change as a “trade secret”) N So that MS destops can use MS Kerberos servers, but not non-MS Kerberos servers. Although MS claims to support standards, proprietary MS Getting Started Argument for LDAP Account Information Network Accounts Network Accounts — 2 Methods of achieving this Directory systems for authentication Proprietary application directories Problem with proprietary directories Why not buy Microsoft AD? LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about I I solutions are highly I I Designed to lock the user into an all-MS solution. Could be an expensive and insecure mistake. SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 13/99 References Getting Started LDAP Why we chose LDAP LDAP— Why? LDAP LDAP Terminology LDAP? What is The LDAP Protocol Simple Search Examples Multiple Simultaneous Requests LDAP Protocol Operations LDAP Typical LDAP Exchange BER Encoding: LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 14/99 Why we chose LDAP I Single sign on—the . Getting Started LDAP Why we chose LDAP LDAP— Why? LDAP ¡ ¤   ¢ £ ¡ Terminology LDAP? What is The LDAP Protocol Simple Search Examples Multiple Simultaneous Requests LDAP Protocol Operations LDAP Typical LDAP Exchange BER Encoding: LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance I I SLUG — ver. 1.4 King Arthur and his knights support this quest The knights who say Ni all concur with a resounding Ni! Samba Stuff I didn’t talk about References LDAP at HKIVE(TY) - p. 15/99 LDAP— I Why? Getting Started LDAP Why we chose LDAP LDAP— Why? LDAP I I I I I I Non-proprietary, IETF standard N No vendor lock-in N Use standard software components Supports authorisation as well as authentication N E.g., access if “staff, or year 3, group W, CSA student” Very general purpose: use for email, system authentication, application authentication, . . . Reasonably secure Robust Extensible Good open source implementation available at http://www.OpenLDAP.org/ Terminology LDAP? What is The LDAP Protocol Simple Search Examples Multiple Simultaneous Requests LDAP Protocol Operations LDAP Typical LDAP Exchange BER Encoding: LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 16/99 LDAP I LDAP I I I Terminology Getting Started LDAP Why we chose LDAP LDAP— Why? LDAP I I I model is hierarchical, i.e., tree-structured Each object in a directory is an entry Each individual item in an entry is an attribute Each entry has a unique full name called its distinguished name or dn Each entry has a short name that is unique under its parent, called its relative distinguished name, or rdn. The organisation of names in the directory is called the namespace An important initial task is namespace design Terminology LDAP? What is The LDAP Protocol Simple Search Examples Multiple Simultaneous Requests LDAP Protocol Operations LDAP Typical LDAP Exchange BER Encoding: LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 17/99 What is I I LDAP? Getting Started LDAP Why we chose LDAP LDAP— Why? LDAP The LDAP protocol, a standard Internet protocol Four models: name directory data N functional model—what you can do with data N security model—no N unauthorised access LDAP Data Interchange Format (LDIF), a standard text format for representing directory data LDAP server software command line utilities (ldapsearch, ldapmodify, . . . ) N information model— what you can put in directory naming model—how Terminology LDAP? What is The LDAP Protocol Simple Search Examples Multiple Simultaneous Requests LDAP Protocol Operations LDAP Typical LDAP Exchange BER Encoding: I LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References I I I LDAP API SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 18/99 The I LDAP N LDAP Protocol Getting Started LDAP Why we chose LDAP LDAP— Why? LDAP N N is a message-based protocol client sends one or more requests to server, one message per request I Each message has its own message ID server replies with one or more replies. Each reply has message ID matching that of request. Can send several messages at once; results can be out of order, no problem Terminology LDAP? What is The LDAP Protocol Simple Search Examples Multiple Simultaneous Requests LDAP Protocol Operations LDAP Typical LDAP Exchange BER Encoding: LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 19/99 Simple Search Examples Getting Started LDAP Why we chose LDAP LDAP— Why? § § § §                     1. Search operation   ©   © © © ©   ©  ©  ©  ©   ©  ©  ©  2. Returned entry 3. Result code ¥ ¥¦  ©   ©  ©  ©   ©   ©  ©  ©  §      © © © © ©   LDAP Terminology LDAP? ¨ §  ¨ § ¨ § ¨ § ¨ ¨ §  ¨ § ¨ § ¨ § ¨ § § What is The ¨ §  ¨ § ¨ § ¨ § ¨ ¨ §  ¨ § ¨ § ¨ § ¨ ¨ §  ¨ § ¨ § ¨ § ¨ § § § LDAP Protocol ¨ §  ¨ § ¨ § ¨ § ¨ ¨ §  ¨ § ¨ § ¨ § ¨ § § I LDAP gets one single entry from the directory LDAP server Here a clientclient 1. Search operation $ # %&'( %' $ # $ # $ # $ # Simple Search Examples Multiple Simultaneous Requests LDAP Protocol Operations LDAP Typical LDAP $ # $ # $ # $ ! ! ! ! # Exchange BER 2. First entry returned 3. Second entry returned " " Encoding: $ # ! ! %&'( %&'( %&'( %&'( " ! " ! " ! " %&'( ! ... LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References  ! " ! " ! " ! " " ! %&'( " ! " ! " ! " " ! %&'( " ! " ! " ! "  %&'( %&'( %&'( %&'( %&'(    %&'(     ! ! 5. Nth entry returned 6. Result code   !  %&'(     %&'(     %&'(     %&'(     %&'(     %&'(    I LDAP multiple responses from the directory LDAP server A client gets client SLUG — ver. 1.4        LDAP at HKIVE(TY) - p. 20/99 Multiple Simultaneous Requests 1. Search operation, msgid=1 6 5 789@ 6 5 6 5 6 5 6 Getting Started LDAP Why we chose LDAP LDAP— Why? LDAP 2. Search operation, msgid=2 3. Returned entry, msgid=1 4. Returned entry, msgid=2 5. Result code, msgid=2 6. Result code, msgid=1 ) )0 4 4 4 6 5 789@ 6 5 6 5 6 5 6 3 789@ 789@ 3 3 3 3 789@ 4 3 4 3 4 3 4 3 789@ 4 3 4 3 4 3 4 3 789@ 4 3 4 3 4 3 4 4 3 789@ 4 3 4 3 4 3 4 789@ 789@ 789@ 789@ 3 3 3 3 3 5 5 Terminology LDAP? 1 789@ 1 1 1 2 1 789@ 2 1 2 1 2 1 2 2 1 789@ 2 1 2 1 2 1 2 1 1 1 What is The 2 1 789@ 2 1 2 1 2 1 2 2 1 789@ 2 1 2 1 2 1 2 1 1 LDAP Protocol 2 1 789@ 2 1 2 1 2 1 2 2 1 789@ 2 1 2 1 2 1 2 2 1 789@ 2 1 2 1 2 1 2 1 1 1 Simple Search Examples I I I A client sends multiple requests to the directory Note that each request has its own msgid Responses may come out of order (see last two result codes); that’s okay. N These details are hidden from programmer by the SDK (software development kit) LDAP client LDAP server Multiple Simultaneous Requests LDAP Protocol Operations LDAP Typical LDAP Exchange BER Encoding: LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 21/99 LDAP I I Protocol Operations Getting Started LDAP Why we chose LDAP LDAP— Why? LDAP I Interrogation operations: search, compare Update operations: add, delete, modify, modify DN (rename) Authentication and control operations: bind, unbind, abandon bind operation allows a client to identify itself sending identity and authentication credentials unbind operation allows client to terminate session abandon operation allows a client to tell the server it does not need the results of an operation it had requested earlier Terminology LDAP? What is The LDAP Protocol Simple Search Examples Multiple Simultaneous Requests LDAP Protocol Operations LDAP Typical LDAP Exchange BER Encoding: LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 22/99 Typical 2. Result of bind operation 3. Search operation 4. First entry returned 5. Second entry returned LDAP H G IPQR H G IPQR Exchange Getting Started LDAP Why we chose LDAP LDAP— Why? LDAP H G H G H G H H G H G H G H IPQR IPQR E E E IPQR F E F E F E F E E G G 1. Open connection and bind E F E F E IPQR F E F E F E F F E IPQR F E F E F E F F E IPQR F E F E F E F IPQR IPQR IPQR IPQR E E E Terminology LDAP? C IPQR C C C D C IPQR D C D C D C D D C IPQR D C D C D C D C C C 6. Result code for search operation 6. Unbind operation What is The D C IPQR D C D C D C D D C IPQR D C D C D C D C A AB C LDAP Protocol D C IPQR D C D C D C D D C IPQR D C D C D C D D C IPQR D C D C D C D C C C I I The bind operation provides a distinguished name (DN) and other credentials to authenticate against the directory The unbind operation is a request to disconnect LDAP client 6. Close connection Simple Search Examples LDAP server Multiple Simultaneous Requests LDAP Protocol Operations LDAP Typical LDAP Exchange BER Encoding: LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 23/99 LDAP I Encoding: BER Getting Started LDAP Why we chose LDAP LDAP— Why? LDAP I I The LDAP protocol uses the Basic Encoding Rules, BER to encode various data types in a platform independent way These are the same rules as used in SNMP Therefore it is not a simple text-based protocol, like HTTP or SMTP. Terminology LDAP? What is The LDAP Protocol Simple Search Examples Multiple Simultaneous Requests LDAP Protocol Operations LDAP Typical LDAP Exchange BER Encoding: LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 24/99 LDAP I Search Operation Getting Started LDAP LDAP Operations LDAP I Used to search for entries and retrieve them N This is the only way to read the directory Takes eight parameters, including: N DN of base object for search — see slide §26 N search scope — see slide §26 N search filter — see slide §55 N list of attributes to return Search Operation Search Scope The Compare Operation Add Operation Delete Operation Modify DN (Rename) Operation Modify Operation Bind Operation Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 25/99 Search Scope dc=ict,dc=edu,dc=hk ou=people dc=ict,dc=edu,dc=hk ou=people dc=ict,dc=edu,dc=hk ou=people Getting Started LDAP LDAP Operations LDAP Search Operation Search Scope The Compare Operation Add Operation Delete Operation Modify DN (Rename) Operation Modify Operation Bind Operation Search scope = base I Search scope = one In each case, the search base is ou=People,dc=ict,dc=edu,dc=hk Search scope = subtree Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 26/99 The Compare Operation I I I Not very useful I use it for determining if a user belongs to a particular group main difference from search: N If compare on an attribute that does not exist in a particular entry, returns code indicating this N If search for an attribute that does not exist in a particular entry, then get nothing returned. Getting Started LDAP LDAP Operations LDAP Search Operation Search Scope The Compare Operation Add Operation Delete Operation Modify DN (Rename) Operation Modify Operation Bind Operation Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 27/99 Add Operation I I Creates a new entry, given two parameters: N DN of new entry N list of attributes and their values to put in the new entry Will succeed if and only if: N parent of new entry exists N no entry of same name exists N new entry matches requirements of schemas N access control allows operation Getting Started LDAP LDAP Operations LDAP Search Operation Search Scope The Compare Operation Add Operation Delete Operation Modify DN (Rename) Operation Modify Operation Bind Operation Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 28/99 Delete Operation I I I Deletes an entry Takes DN of entry to delete Succeeds if: N entry exists N entry has no children N access control allows operation Getting Started LDAP LDAP Operations LDAP Search Operation Search Scope The Compare Operation Add Operation Delete Operation Modify DN (Rename) Operation Modify Operation Bind Operation Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 29/99 Modify I DN (Rename) Operation Getting Started LDAP LDAP Operations LDAP I I Used to rename or move an entry from one place in tree to another Has four parameters: N Old DN N New DN N New RDN for entry N optional flag indicating whether to delete the old RDN attribute from the entry Succeeds if: N entry exists N new name not already used N access control allows operation Search Operation Search Scope The Compare Operation Add Operation Delete Operation Modify DN (Rename) Operation Modify Operation Bind Operation Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 30/99 Modify Operation I I I I Allows updating existing entry Can add, delete or replace attributes Can modify many attributes in one modify operation Succeeds if and only if: N entry exists N all attribute modifications must succeed N resulting entry obeys schemas N access control permits modification Getting Started LDAP LDAP Operations LDAP Search Operation Search Scope The Compare Operation Add Operation Delete Operation Modify DN (Rename) Operation Modify Operation Bind Operation Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 31/99 Bind Operation I I I authenticates client to the directory Three bind types: N simple bind, where send DN and password in clear text to server I Need to use TLS to encrypt communication in this case N SASL bind I SASL = Simple Authentication and Security Layer I A standard protocol independent way of negotiating and performing authentication N anonymous bind, where send DN but no passwords Client can bind, perform operations, bind again, and perform other operations Getting Started LDAP LDAP Operations LDAP Search Operation Search Scope The Compare Operation Add Operation Delete Operation Modify DN (Rename) Operation Modify Operation Bind Operation Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 32/99 Command Line Utilities I I With OpenLDAP, the main utilities (in RH Linux, in the package openldap-clients) are: ldapsearch Query directory ldapmodify Perform the modify operation on an entry — see §38 ldapdelete Delete an entry ldapadd Add an entry ldapmodrdn Rename an entry ldapcompare Compare operation ldappasswd Change LDAP password using LDAPv3 Password Modify (RFC 3062) extended operation Each one has a detailed man page Getting Started LDAP LDAP Operations Utilities and LDIF Command Line Utilities Common Parameters ldapsearch LDAP Data Interchange Format LDIF Example LDIF LDIF Update Operation in Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 33/99 Common Parameters I I I I I All commands use the SASL (Simple Authentication and Security Layer) protocol by default N But won’t work in HKIVE Tsing Yi: N . . . we use simple authentication here (we send plain text passwords over link encrypted with Transport Layer Security i.e., TLS or SSL) “-x” use simple authentication instead of SASL specify hostname of server with -h, e.g., -h ldap.vtc.edu.hk Specify a DN to bind with using -D (see §38) Specify a password on command line with -w password or interactively prompt using -W N See §38, §64 for examples Getting Started LDAP LDAP Operations Utilities and LDIF Command Line Utilities Common Parameters ldapsearch LDAP Data Interchange Format LDIF Example LDIF LDIF Update Operation in Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 34/99 ldapsearch I I I Specify base of search with -b DN of search base N Default can be specified as a line in /etc/openldap/ldap.conf, e.g., BASE dc=tyict,dc=vtc,dc=edu,dc=hk HOST ldap.tyict.vtc.edu.hk Specify scope of search with -s [base|one|sub] N Default scope is subtree scope See §61 for more examples. Getting Started LDAP LDAP Operations Utilities and LDIF Command Line Utilities Common Parameters ldapsearch LDAP Data Interchange Format LDIF Example LDIF LDIF Update Operation in Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 35/99 LDAP I I Data Interchange Format LDIF Getting Started LDAP LDAP Operations Utilities and LDIF Command Line Utilities Common Parameters ldapsearch LDAP Data Interchange Format LDIF I A standard defined in RFC 2849 Used to import, export directory data in a standard way N A bit like how all spreadsheets understand tab-delimited text files Can also specify update operations to directory entries. Example LDIF LDIF Update Operation in Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 36/99 Example dn: uid=nicku,ou=People,dc=ict,dc=vtc,dc=edu,dc=hk uid: nicku cn: Nick Urbanik givenName: Nick sn: Urbanik mail: nicku@sysadmin.no-ip.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top loginShell: /bin/sh uidNumber: 1000 gidNumber: 1000 homeDirectory: /opt/nicku mail: nicku@nickpc.tyict.vtc.edu.hk description: Interested in free software LDIF Getting Started LDAP LDAP Operations Utilities and LDIF Command Line Utilities Common Parameters ldapsearch LDAP Data Interchange Format LDIF Example LDIF LDIF Update Operation in Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 37/99 Update Operation in LDIF Getting Started $ cat /tmp/update-nick.ldif dn: uid=nicku,ou=People,dc=ict,dc=vtc,dc=edu,dc=hk LDAP changetype: modify LDAP Operations replace: mail Utilities and LDIF Command Line Utilities mail: nicku@nicku.org Common Parameters ldapsearch LDAP Data Interchange Format LDIF add: title Example LDIF title: No longer a lecturer in Hong Kong Update Operation in LDIF Schemas add: jpegPhoto LDAP Filters & URLs jpegPhoto:< file:///tmp/penguin.jpg ICT Schema Design Flat, Hierarchical Structures delete: description Maintenance Problems and solutions $ ldapmodify -x \ Performance -D ’uid=nicku,ou=People,dc=ict,dc=vtc,dc=edu,dc=hk’ \ Samba -W -f /tmp/update-nick.ldif Stuff I didn’t talk about Enter LDAP password: References modifying entry "uid=nicku,ou=People,dc=ict,dc=vtc,dc=edu,dc=hk" SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 38/99 LDAP I Schemas Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP I I I The directory has a set of rules that determine the allowed objectclasses and attributes Called the schemas Can be defined in N ASN.1, or N University of Michigan style, or N LDAPv3 style Each object, and its syntax, are both defined using OIDs, as in SNMP. Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 39/99 Performance Side track on Object IDs I LDAP I I I uses a tree structure of Object IDs (OIDs), the same as SNMP, to identify objects and attributes Better not to invent your own to avoid clashing with those used in other schemas Apply to Internet Assigned Numbers for your own enterprise number N from Application Forms choose Private Enterprise Numbers (SNMP) See ours (11400) at IANA http://www.iana.org/ assignments/enterprise-numbers, grep for nicku. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 40/99 Performance Tree of object IDs (root node) Getting Started LDAP ccitt (0) iso (1) iso−ccit (2) LDAP Operations Utilities and LDIF standard (0) registration− authority (1) member− body (2) dod (6) identified− organisation (3) Schemas LDAP Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes internet (1) LDAP LDAP Structural Classes Entries: Selecting Object Class directory (1) mgmnt (2) experimental (3) private (4) security (5) snmpV2 (6) Types Rules for LDAP Entries Namespace of attributes mib−2 (1) enterprise (1) Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions ibm (2) cisco (9) Dept of Info. & Comms. Tech. HKIVE(TY) (11400) SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 41/99 Performance Attributes — Defined in Schema I I For each attribute, schema defines: N Name N Description N Permitted compare operations N Syntax (i.e., data type). LDAP server ensures that all added data matches the schema Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 42/99 Performance LDAP I I I I objectClass — 1 Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Each attribute belongs to one or more objectClasses objectClasses are defined in schemas Defines what attributes must, or may be present in an entry objectClass definition includes: N Name of objectClass N What subclass this is derived from N The type of objectClass: structural, auxiliary or abstract N Description N List of required attributes N List of allowed attributes Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 43/99 Performance Object Class and Attributes I The entry can use all the attributes allowed in all the objectClasses. N See in slide §50 how LDAP attributes differ from attributes in, say, a Java class Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 44/99 Performance LDAP I LDAP I Object Class Inheritance Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP I I I implements a limited form of object oriented inheritance One entry may contain many objectClasses N We say, “an entry belongs to many classes” Cannot override any schema rules defined in superior class Example: top person organizationalPerson inetOrgPerson N In /etc/openldap/schema, core.schema defines person, organizationalPerson; inetorgperson.schema defines inetOrgPerson A class derived from another class includes the attributes of its superior class(es) Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 45/99 Performance LDAP I I I Object Class Type Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP I I objectClass has a type: structural, auxiliary, or abstract Default is structural Structural is for the fundamental, basic aspects of the object, e.g., person, posixGroup, device. Auxiliary classes place no restrictions on where an entry is stored, and are used to add more attributes to structural classes. Abstract classes are not usually created by users; the class top and alias are abstract. Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 46/99 Performance Structural Classes I I Rule of LDAP standards: if an entry belongs to more than one structural class, they must be related by inheritance N OpenLDAP 2.0.x does not implement this restriction, but OpenLDAP 2.1.x and later versions (including 2.2.x) do. To get around this, can either: N Implement a new objectClass that is of type auxiliary that allows the attributes you require—see http://www.openldap.org/faq/data/cache/883.html N Implement a new objectClass that inherits from both unrelated structural classes and use that—See http://www.openldap.org/faq/data/cache/807.html . LDAP LDAP LDAP LDAP LDAP Getting Started LDAP Operations Utilities and LDIF Schemas Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes Structural Classes Entries: Selecting Object Class LDAP Types Rules for Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 47/99 Performance Entries: Selecting Object Class Types I I I I Entries contain one or more objectClasses Choose the attributes you need Select the objectClasses that provide these attributes Add the objectClass to your entry. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 48/99 Performance Rules for I I LDAP Entries Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP I Each entry must be a member of the objectClass top Each entry must be a member of the objectClass that provides the attributes Exactly one objectClass should be structural, the rest auxiliary (or abstract) N An entry may belong to more than one structural class if all structural classes are related by inheritance Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 49/99 Performance Namespace of attributes I I There is only one namespace for attributes The definition of the attribute cn (common name) is the same for all objectClasses that support the cn attribute. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 50/99 Performance Example objectTypes I I I Here is the definition for person from core.schema: objectclass ( 2.5.6.6 NAME ’person’ SUP top STRUCTURAL MUST ( sn $ cn ) MAY ( userPassword $ telephoneNumber $ seeAlso $ description ) ) This says a person entry must contain: N a surname (sn) and N common name (cn), and may contain a userPassword, a telephoneNumber, a description, and a reference to another LDAP entry. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 51/99 Performance Want to support network login I I Does the objectClass person provide what is needed for network login? For network accounts, need replace (at minimum): N N Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP /etc/passwd /etc/shadow N /etc/group Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP I So in addition to attributes of person, need: N Gecos information (fifth User ID name (log in name) field of /etc/passwd) N User ID number N Home directory N Primary group ID N Login shell number Also the password aging information from /etc/shadow N objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions I SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 52/99 Performance Supporting network login I Use the existing objectClass posixAccount: objectclass ( 1.3.6.1.1.1.2.0 NAME ’posixAccount’ SUP top AUXILIARY DESC ’Abstraction of an account with POSIX attributes’ MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP I Provides fields from /etc/passwd Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 53/99 Performance Authorisation as well as authentication I I I Suppose you have an online web-based quiz, want only staff, or year 3, group W, CSA student to be allowed to log in. For this to work: Each person entry has attributes including: N Course, e.g., 41300 N classCode, e.g., W N Year, e.g., 3 N acType, e.g., STU or STF Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Schemas Side track on Object IDs Tree of object IDs Attributes — Defined in Schema LDAP objectClass — 1 Object Class Inheritance Object Class Type Object Class and Attributes LDAP LDAP Structural Classes Entries: Selecting Object Class Types Rules for LDAP Entries Namespace of attributes Example objectTypes Want to support network login Supporting network login Authorisation as well as authentication LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 54/99 Performance LDAP I LDAP I filters Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP provides a standard method for selecting authenticated users who match authorisation criteria The filter to select staff or students in year 3, CSA, group W is: (|(acType=STF) (&(year=3)(course=41300)(classcode=W))) (This line is wrapped to fit on the slide, but normally given on one line) All filters are enclosed in parentheses Filters can be combined with OR ‘|’, AND ‘&’ filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP I I URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 55/99 Samba RFC 2254 — 1 Find this in /usr/share/doc/openldap-devel-2.2. 23/rfc/rfc2254.txt filter = "(" filtercomp ")" filtercomp = and / or / not / item and = "&" filterlist or = "|" filterlist not = "!" filter filterlist = 1*filter = simple / present / substring item simple = attr filtertype value filtertype = equal / approx / greater / less equal = "=" approx = "˜=" greater = ">=" = "<=" less Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 56/99 Samba RFC 2254 — 2 present substring initial any final attr attr "=*" attr "=" [initial] any [final] value "*" *(value "*") value AttributeDescription from Section 4.1.5 of [1] = AttributeValue from value Section 4.1.6 of [1] I [1] is RFC 2251. I Grammar is defined in RFC 822 = = = = = = Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 57/99 Samba Examples of Filters from RFC 2254 Return all entries in the scope of the search with attribute cn having the value “Babs Jensen”: (cn=Babs Jensen) Return all entries in the scope of the search which do not have the attribute cn with the value “Tim Howes”: (!(cn=Tim Howes)) Return all entries in the scope of the search which have the attibute (&(objectClass=Person)(|(sn=Jensen)(cn=Babs J*))) Return all entries having an attribute o (i.e., organisation) which contains the strings univ, of, mich with zero or more of any characters between, and with any number of any characters at the end. (o=univ*of*mich*) Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 58/99 Samba More Filter Examples I I I I Note that a filter such as (age>21) is not allowed. Use (!(age<=21)) instead. Similarly, instead of (age<21), use (!(age>=21)). search for all students in group X, year 3, CSA course, who enrolled this year: (&(year=3)(course=41300)(classcode=W) (registrationDate=*-03)) Note that there is a substring match on registrationDate here. A substring match is like a wildcard in filename matching. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 59/99 Samba Escaping Characters in a Filter Character * (asterisk) ( (left parenthesis) ) (right parenthesis) \ (backslash) NUL (the null byte) Getting Started Escape Sequence \2A \28 \29 \5C \00 LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 60/99 Samba Using the command line tool ldapsearch I I I $ ldapsearch -x -h ldap.vtc.edu.hk \ -b "dc=vtc.edu.hk" \ "(&(department=ICT)(site=TY) (|(acType=STF) (&(year=3)(course=41300)(classcode=W))))" cn The result is a list of all the DNs that match the filter, with the students’ and staff names. Can filter out the DNs and blank lines by piping the command though grep ’ cn:’ | sort Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 61/99 Samba Output of this ldapsearch without staff cn: cn: cn: cn: cn: cn: cn: cn: cn: cn: cn: cn: cn: cn: cn: cn: cn: cn: cn: CHAN Kwok Kam CHEUK Suk Lai CHUNG Ming Kit LAI Man Chiu LAM Lai Hang LAU Siu Ying LAW Yuk Woon LI Kim Wah LI Siu Kai LI Yuet Cheung MA Hei Man MO Hoi Yu POON Chun Chung TAM Kin Fai TSO Yee Yee WONG Chi Man WONG Hoi Shan WONG Siu Fai WOO Kin Fan Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 62/99 Samba Get All the Results $ ldapsearch -x -h ldap.vtc.edu.hk -b ’dc=vtc.edu.hk’ \ Getting Started "(&(department=ICT)(site=TY)(|(actype=STF)(&(year=3) LDAP (classcode=W)(course=41300))))" cn \ LDAP Operations | grep ’ˆcn: ’ | sed ’s/ˆcn: //;s/ˆ\(.\{15\}\).*/\1/’ | sort | column Utilities and LDIF Andy LAI C M Ho LEE HUNG KIN SIU CHONG PUI CHAN CHIN PANG Curtis H.K. Tsa LEE KOON HUNG K SIU WAI CHEUNG Schemas CHAN Kwok Kam Esther YUEN LEUNG KAM SHEK Stella Chu LDAP Filters & URLs CHAN KWOK KEUNG Eva Chung LI Kim Wah TAM CHI HO LDAP filters RFC 2254 — 1 CHAN SHIU CHUAN FONG CHI KIT LI Siu Kai TAM Kin Fai RFC 2254 — 2 Examples of Filters from RFC CHAN TAI HING Henry Leung LI Yuet Cheung TSANG KWOK TUNG 2254 CHAN TAI MING R HO CHUN WAH MA Hei Man TSO Yee Yee More Filter Examples Escaping Characters in a Filter Charles Wu HO KIM MAN ALBE MA SUI WAH WONG Chi Man Using the command line tool CHEUK Suk Lai Josephine Wan MICHAEL LEUNG WONG Hoi Shan ldapsearch Output of this ldapsearch CHEUNG KAM HOI Karl Leung MO Hoi Yu WONG Siu Fai without staff CHEUNG SAI MING Ken LI MONTAGUE NIGEL WONG WAI YIP FR Get All the Results ldapsearch NG HOI KOW Wong Y.L. Lawre CHIK FUNG YING Kit K. KO LDAP URLs: RFC 2255 CHIU SUET FAN J LAI HING BIU NG SZE CHIU EDD WOO HUNG CHEUNG mod_auth_ldap with Apache Authenticating web Chou Siu Chuen LAI Man Chiu Nick Urbanik WOO Kin Fan pages—continued CHUNG Ming Kit LAM Lai Hang PATRICK K.S. TO YIM KWOK HO ICT Schema Design CHU SHING TSU J LAU KWOK ON POON Chun Chung Y.K. Leung Flat, Hierarchical Structures Clarence Lau LAU Siu Ying Rick Liu LAW Yuk Woon SCOTT ALBERT HE Clarence Lo Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 63/99 Samba ldapsearch I I I Needs the -x option to work here Check ssl works with the -ZZ option Can “bind” as a user to get all the info you are allowed to see after binding: $ ldapsearch -x -W -D \ "uid=nicku,ou=People,dc=tyict,dc=vtc,dc=edu,dc=hk" \ ’(uid=nicku)’ Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP I Can then see own passwords URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 64/99 Samba LDAP I I URLs: RFC 2255 Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP Have the form: ldap:// host : port / base ? attr ? scope ? filter ldapurl = ldap://" [hostport] ["/" [dn ["?" [attributes] ["?" [scope] ["?" [filter] ["?" extensions]]]]]] I I I The base or dn is the distinguished name of the starting entry for your search. scope is one of base, one or sub Examples: filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP ldap://ictlab/ou=People,dc=tyict,dc=vtc,dc=edu,dc=hk?uid?one?(uid=nicku) URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 65/99 Samba mod_auth_ldap with Apache I I mod_auth_ldap is part of the httpd RPM package on Fedora Core versions 1 to 4. Here we allow staff or students from group W, year 3 CSA to access the web pages under http://hostname/group-w/ if the user provides a correct password: AuthType Basic AuthName "\LDAP authentication to class W only" AuthLDAPURL ldap://ldap.tyict.vtc.edu.hk/ ou=People,dc=tyict,dc=vtc, dc=edu,dc=hk?uid?one?(|(acType=STF)(&(course=41300) (classCode=W)(year=3))) require valid-user Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance I See http://httpd.apache.org/docs-2.0/mod/mod_auth_ldap.html, and also http://httpd.apache.org/docs-2.0/mod/mod_ldap.html for manual. SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 66/99 Samba Authenticating web pages—continued I I I I Unfortunately, mod_auth_ldap disappeared from Red Hat 8.0 and 9, to reappear in Fedora Core but not RHEL 3, where another module was provided that did not work the same. I ended up modifying Apache::AuthNetLDAP (available with my changes from CPAN) I used that on our servers in the department. N . . . a more portable method of authentication, provided we are using mod_perl I haven’t tried it with the final mod_perl version 2 on FC4 yet. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs LDAP filters RFC 2254 — 1 RFC 2254 — 2 Examples of Filters from RFC 2254 More Filter Examples Escaping Characters in a Filter Using the command line tool ldapsearch Output of this ldapsearch without staff Get All the Results ldapsearch LDAP URLs: RFC 2255 mod_auth_ldap with Apache Authenticating web pages—continued ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 67/99 Samba Getting Started LDAP LDAP Operations ICT Schema Design Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Authorisation of Students and Staff Other objectTypes for IVE The whole schema for IVE Case Study: ICT laboratories ICT case study ICT case study — 2 Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 68/99 Authorisation of Students and Staff I I I We need a new schema to support the required attributes We create three new objectClasses and associated attributes: The first is common to students and staff: objectclass ( 1.3.6.1.4.1.11400.2.2.1 NAME ’institute’ SUP top AUXILIARY DESC ’Any person in the institute, staff or student’ MAY ( acOwner $ acType $ answer1 $ answer2 $ answer3 $ batchUpdateFlag $ department $ site $ instituteEmail ) ) Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Authorisation of Students and Staff Other objectTypes for IVE The whole schema for IVE Case Study: ICT laboratories ICT case study ICT case study — 2 Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References I See slides 40–41 for more about the funny numbers. SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 69/99 Other objectTypes for IVE I Then on top of this, we have attributes for students: objectclass ( 1.3.6.1.4.1.11400.2.2.2 NAME ’student’ SUP top AUXILIARY DESC ’A student in the institute’ MAY ( academicYear $ award $ classCode $ course $ courseDuration $ FinalYear $ registrationDate $year $ fullPartTime ) ) Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Authorisation of Students and Staff Other objectTypes for IVE The whole schema for IVE Case Study: ICT laboratories ICT case study ICT case study — 2 Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References I . . . and staff: objectclass ( 1.3.6.1.4.1.11400.2.2.3 NAME ’staff’ SUP top AUXILIARY DESC ’A staff member of the insitute.’ MAY ( titleDes $ employerID ) ) SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 70/99 The whole schema for IVE I The whole schema can be seen here: http://ictlab.tyict.vtc.edu.hk/oids/institute.schema Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Authorisation of Students and Staff Other objectTypes for IVE The whole schema for IVE Case Study: ICT laboratories ICT case study ICT case study — 2 Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References I If planets are alligned, then this local link will work. SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 71/99 Case Study: ICT laboratories I I I I I I I I I Old system: An ancient DEC Alpha running NIS Hardware insufficient for demand Very expensive maintenance, stopped paying Technician reported a hardware failure close to first day of term New system: We were planning to introduce LDAP authentication gradually Failure required planning move faster Needed to maintain old legacy accounts, plus introduce new accounts Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Authorisation of Students and Staff Other objectTypes for IVE The whole schema for IVE Case Study: ICT laboratories ICT case study ICT case study — 2 Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 72/99 ICT case study I I I I I We chose OpenLDAP on Linux Running on an Acer Altos dual CPU P-III Migrated from the NIS using the migration scripts provided with OpenLDAP Migrated from the VTC LDAP accounts using a Perl program, written (quickly!) for the purpose, Uses the Net::LDAP Perl modules Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Authorisation of Students and Staff Other objectTypes for IVE The whole schema for IVE Case Study: ICT laboratories ICT case study ICT case study — 2 Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 73/99 ICT case study — 2 I I I I I I After migrating the legacy accounts, and creating new accounts for staff, full and part time students, had more than 5000 accounts The LDAP server was using a high CPU load Was able to solve this using caching: Use nscd (name service caching daemon) on client Use memory in server to increase local cache size drastically. CPU load reduced to a very acceptable level. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Authorisation of Students and Staff Other objectTypes for IVE The whole schema for IVE Case Study: ICT laboratories ICT case study ICT case study — 2 Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 74/99 Directory Structure — 1 I The ICT LDAP server namespace design: dc=tyict,dc=vtc,dc=edu,dc=hk Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ou=people ou=group ou=devices ICT Schema Design Flat, Hierarchical Structures Directory Structure — 1 Directory Structure — 2 Hierarchical Directory Structure New VTC LDAP uid=albertho ... uid=nicku cn=staff ... cn=students cn=ictlab ... cn=printer7 Namespace Hierarchical Directory Structure Directory Design Guidelines Designing a Schema Designing a Schema: Example Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 75/99 Directory Structure — 2 I I I I We chose a fairly flat directory structure Recommended by reference, pages 239, 249. Reason: flexibility: allows for change without major reorganisation of data. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Directory Structure — 1 Directory Structure — 2 Hierarchical Directory Structure New VTC LDAP Namespace Hierarchical Directory Structure Directory Design Guidelines Designing a Schema Designing a Schema: Example Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 76/99 Hierarchical Directory Structure I This directory structure is hierarchical: dc=tyict,dc=vtc,dc=edu,dc=hk Getting Started LDAP LDAP Operations Utilities and LDIF Schemas ou=TY ou=ICT ou=MH ou=ENG ou=ICT ou=TM ou=ICT LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Directory Structure — 1 Directory Structure — 2 Hierarchical Directory Structure New VTC LDAP ... ... ou=ENG ... ou=ENG cn=people cn= group cn=devices cn=people cn= group cn=devices Namespace Hierarchical Directory Structure Directory Design Guidelines Designing a Schema Designing a Schema: Example Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References uid=albertho ... cn=staff ... cn=ictlab uid=nicku cn=students ... cn=printer7 SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 77/99 New VTC I LDAP Namespace Getting Started LDAP LDAP Operations This new 2003: VTC LDAP namespace was introduced in April dc=vtc.edu.hk Utilities and LDIF Schemas o=ftstudents ... o=staff ... o=ptstudents LDAP Filters & URLs ICT Schema Design ou=TY ou=ICT ... ou=TY ou=ICT ... ou=ENG ou=ICT ou=MH ... ... ou=ENG ou=ICT ou=TM ... ... ou=ENG ou=TY ... ou=ENG Flat, Hierarchical Structures Directory Structure — 1 Directory Structure — 2 Hierarchical Directory Structure New VTC LDAP ... ou=ENG ... ou=ICT ... Namespace Hierarchical Directory Structure ... uid=nicku uid=albertho uid=000123456 uid=922123412 ... ... Directory Design Guidelines uid=022121232 uid=000123123 Designing a Schema Designing a Schema: Example Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 78/99 Hierarchical Directory Structure I I I I I I I I This is an alternative data arrangement Divide into different campuses Advantage: can easily delegate management to local campus But: suppose ENG changes to EE? Suppose staff move from one department to another? Suppose equipment is transferred? Not only need change the attributes in the entry, but also move the entry. Overall, a flatter structure is easier to manage. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Directory Structure — 1 Directory Structure — 2 Hierarchical Directory Structure New VTC LDAP Namespace Hierarchical Directory Structure Directory Design Guidelines Designing a Schema Designing a Schema: Example Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 79/99 Directory Design Guidelines I I I I I Design as flat as possible given constraints: Replication Access Control Limitations of directory software Requirements of applications that use the directory Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Directory Structure — 1 Directory Structure — 2 Hierarchical Directory Structure New VTC LDAP Namespace Hierarchical Directory Structure Directory Design Guidelines Designing a Schema Designing a Schema: Example Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 80/99 Designing a Schema I I I I I I After selecting the schema attributes needed for your application, you may find that not all are available with the server Search web for more schemas If none provide all you need, Select a suitable structural base class Create an auxiliary class to be used with the base class Define the objectClass and its attributes Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Directory Structure — 1 Directory Structure — 2 Hierarchical Directory Structure New VTC LDAP Namespace Hierarchical Directory Structure Directory Design Guidelines Designing a Schema Designing a Schema: Example Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 81/99 Designing a Schema: Example I I I I I I I For our ICT LDAP server, we use enough attributes to be able to log in But we also want to select users on the basis of course, year, class Want to add these attributes to the existing objectClasses Create three object classes: Institute Student Staff Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Directory Structure — 1 Directory Structure — 2 Hierarchical Directory Structure New VTC LDAP Namespace Hierarchical Directory Structure Directory Design Guidelines Designing a Schema Designing a Schema: Example Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 82/99 Getting Started LDAP LDAP Operations Maintenance Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Building the original directory Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 83/99 Building the original directory I I I I I I built the original directory from the old failing NIS data, using some modified padl import scripts Then quickly wrote a nasty Perl script that reads the LDAP data from the VTC directory server, and builds POSIX accounts from that data The nasty Perl script stuck around, and we used it ever since. I extended it to read the student enrollment data directly. N . . . this was only available in “unparseable” PDF files with about 7–10 students per A3 page! Henry now uses the Perl programs written by Gerald Carter that come with samba. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Building the original directory Problems and solutions Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 84/99 Getting Started LDAP LDAP Operations Problems and solutions Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions How we started up Performance Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 85/99 How we started up I The original machine was an Asus Altos P-III with 256 MB RAM Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions How we started up Performance Samba Stuff I didn’t talk about References I I Running Red Hat 7.1, openldap 2.0.x. Was providing: N Home directories by NFS N Web service to the Internet N telnet :-( and SSH login to students to do their programming assignments on N . . . and now LDAP accounts for all our students (there were 5000 accounts). SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 86/99 Getting Started LDAP LDAP Operations Performance Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Problems Solutions The FAM storm problem Problem with automounter Problem with shared Gconf data How the server is now Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 87/99 Problems I CPU I I load would get very high when assignments were left with tight, infinite loops (a load average of 10 or so) CPU load would get very high when classes logged in (a load average of about 4–6. Occasionally the CPU would go up to 10 and stay there solidly for a while, and the load would be all from slapd. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Problems Solutions The FAM storm problem Problem with automounter Problem with shared Gconf data How the server is now Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 88/99 Solutions I I I I I Openldap came with a tiny default value of memory and disk caching. Needed to increase this to a much higher level. In /etc/openldap/slapd.conf: cachesize 100000 dbcachesize 25600000 timelimit 60 index for all the common searches your system will do N Enable logging of all search filters N index almost every attribute you see being searched for. Enable caching on the clients N Turn on the Name Service Caching Daemon (nscd) Add RAM to the directory server (We added to a total of 1GB) We didn’t do this, but obviously, use replication to two or more LDAP servers, one master, others slaves, and round-robin DNS to select directory server. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Problems Solutions The FAM storm problem Problem with automounter Problem with shared Gconf data How the server is now Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 89/99 The FAM storm problem I I I I An amazing problem occurred when older Red Hat (about 7.2) client machines were booted: the fam daemon (file alteration monitor) on the client would be involved in causing a storm of LDAP requests that would drive the CPU usage of the server to stratospheric limits. Used cricket http://cricket.sourceforge.net/ to monitor CPU and network usage on server N See my notes on cricket, snmp, snmp version 3 and all my free network management notes http://nicku.org/snm/ Wrote a perl program to watch the LDAP logs and send me an email if any problems. Upgraded clients to a later version of Red Hat, or turned off the fam service. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Problems Solutions The FAM storm problem Problem with automounter Problem with shared Gconf data How the server is now Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 90/99 Problem with automounter I I I I We used the automounter to mount home directories when people log in The automounter uses LDAP version 2 OpenLDAP 2.x.y, where x > 0 defaults to version 3 only Need enable LDAP version 2 in /etc/openldap/slapd.conf with allow bind_v2 bind_anon_dn Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Problems Solutions The FAM storm problem Problem with automounter Problem with shared Gconf data How the server is now Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 91/99 Problem with shared Gconf data I I I I I When people log in twice both using Gnome, then things go horribly weird From memory: panel does not work properly, clicking on some things don’t work. The problem appears to be that the same Gconf data is shared out over NFS, and there is a file lock to ensure exclusive access. I haven’t found a work around except KDE or something that does not use GConf. I’d be very grateful for ideas here. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Problems Solutions The FAM storm problem Problem with automounter Problem with shared Gconf data How the server is now Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 92/99 How the server is now I I I I I I It is now running nicely on a single P4 system that my friend Henry built, running a RHEL 3 clone (actually, the Department paid for a RHEL license, but never perhaps got around to using it) Just before I left, I tendered for an Adaptec hardware cluster system suitable for running the Red Hat cluster manager My friend Henry has been too busy to get it up and running. Besides, the old P4 system works well. Students do not log into the server very often any more. Better to ban this completely right from the start! If I started from scratch again, I would use a shorter DN suffix: dc=tyict,dc=vtc,dc=edu,dc-hk simply adds unnecessary bulk to the directory storage on disk. I would have used o=ICT. At home I use dc=nicku,dc=org which is not too much to type. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Problems Solutions The FAM storm problem Problem with automounter Problem with shared Gconf data How the server is now Samba Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 93/99 Samba gotchas I Refer to the latest version of Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Samba gotchas The Administrator account Stuff I didn’t talk about References Samba-3 by Example: Practical Exercises in Successful Samba Deployment I http://samba.mirror.aarnet.edu.au/samba/ docs/man/Samba-Guide/ Carefully follow the steps in the section Samba Domain with Samba Domain Member Server Using LDAP I I I http: //samba.mirror.aarnet.edu.au/samba/docs/man/ Samba-Guide/unixclients.html#sdcsdmldap. You need to set up the smbldap tools so that they do not get overwritten as your samba setup is updated. The computers needed to be put in the same place (in the directory tree) as user accounts (this was true for recent versions of samba) You don’t need winbind if you are running a samba PDC, only if you want to authenticate Linux machines to a Windows server. SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 94/99 The Administrator account I I I I I I I I I The biggest concern to me has been putting a root account in the directory My conscience screams at me! Latest samba supports non-root administrators for joining machines to the domain. I haven’t tried that yet. Other concern: smbldap tools need to read administrator password So does samba samba reads it from /etc/samba/secrets.tdb Nice to write a program to read it from there for smbldap tools, so only need maintain it in one place. My crude attempt used tdbdump, part of samba. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Samba gotchas The Administrator account Stuff I didn’t talk about References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 95/99 Didn’t include I I I I I I I I I I replication distributed directories access control lists (for examples, see slapd.conf on ictlab, slapd.conf on nicku, and the program to make ACLs for student LDAP workshops). How the automounter is set up to run from LDAP simplicity of client setup using authconfig (or kickstart) with Red Hat/Fedora Setting up local user accounts and network user accounts Use of GQ or directory_administrator, LDAP Account Manager high availability the fabulous new Fedora Directory Server Life, the Universe and Everything. Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about Didn’t include References SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 96/99 References I LDAP System Administration, Gerald Carter, ISBN 1-565-92491-6, Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References References The RFCs RFC numbers O’Reilly, March 2003 I Understanding and Deploying LDAP Directory Services (2nd Edition), Tim Howes, Timothy A. Howes, Mark C. Smith, Gordon S. Good, ISBN: 0672323168, Publisher: Addison Wesley Professional, May 2, 2003 Mark Smith and Gordon Good, Macmillan, 1999. Tsing Yi library: TK 5105.595.H69 1999 I Understanding and Deploying LDAP Directory Services, Timothy Howes, I LDAP Programming, Management and Integration, Clayton Donley, ISBN: 1-930110-40-5, Manning Publications, 2003 I LDAP Directories Explained: An Introduction and Analysis, Brian Arkills, ISBN 0-201-78792-X, Addison-Wesley, 2003. I Understanding LDAP Redbook (registration required): http://www.redbooks.ibm.com/abstracts/sg244986.html I LDAP Implementation Cookbook Redbook (registration required): http://www.redbooks.ibm.com/abstracts/sg245110.html I Implementing LDAP, Mark Wilcox, Wrox Press, 2000 I The many RFCs are helpful. SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 97/99 The RFCs You could get a list of (most) of the relevant RFCs with something like this: 1823 The LDAP Application Program Interface. T. Howes, M. Smith. August 1995. (Format: TXT=41081 bytes) (Status: INFORMATIONAL) Getting Started LDAP LDAP Operations $ wget -O - ftp://ftp.isi.edu/in-notes/rfc-index.txt 2>/dev/null \ | perl -n00 -e "print if /ldap|lightweight/i and not /obsoleted\s*by/i" Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References References The RFCs RFC numbers 2164 Use of an X.500/LDAP directory to support MIXER address mapping. S. Kille. January 1998. (Format: TXT=16701 bytes) (Obsoletes RFC1838) (Status: PROPOSED STANDARD) 2247 Using Domains in LDAP/X.500 Distinguished Names. S. Kille, M. Wahl, A. Grimstad, R. Huber, S. Sataluri. January 1998. (Format: TXT=12411 bytes) (Status: PROPOSED STANDARD) 2251 Lightweight Directory Access Protocol (v3). M. Wahl, T. Howes, S. Kille. December 1997. (Format: TXT=114488 bytes) (Updated by RFC3377, RFC3771) (Status: PROPOSED STANDARD) 2252 Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions. M. Wahl, A. Coulbeck, T. Howes, S. Kille. December 1997. (Format: TXT=60204 bytes) (Updated by RFC3377) (Status: PROPOSED STANDARD) 2253 Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names. M. Wahl, S. Kille, T. Howes. December 1997. (Format: TXT=18226 bytes) (Obsoletes RFC1779) (Updated by RFC3377) (Status: PROPOSED STANDARD) 2254 The String Representation of LDAP Search Filters. T. Howes. December 1997. (Format: TXT=13511 bytes) (Obsoletes RFC1960) (Updated by RFC3377) (Status: PROPOSED STANDARD) SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 98/99 RFC numbers And while we’re crazy, let’s see the RFC numbers: $ cat ldap-rfc-list.txt | perl -n00 -e \ ’{($rfc)=split;push @R, $rfc}END{print join " ", @R, "\n"’} 1823 2164 2247 2251 2252 2253 2254 2255 2256 2307 2587 2589 2649 2657 2696 2713 2714 2739 2798 2820 2829 2830 2849 2891 2926 2927 3045 3062 3088 3112 3296 3352 3377 3383 3384 3494 3663 3671 3672 3673 3674 3687 3698 3703 3712 3727 3771 3828 3829 3866 3876 3909 3928 4104 $ ls /usr/share/doc/openldap-devel-2.2.23/rfc INDEX rfc1274.txt rfc2079.txt rfc2247.txt rfc2251.txt rfc2252.txt rfc2253.txt rfc2254.txt rfc2255.txt rfc2256.txt rfc2293.txt rfc2294.txt rfc2307.txt rfc2377.txt rfc2587.txt rfc2589.txt rfc2649.txt rfc2696.txt rfc2713.txt rfc2714.txt rfc2798.txt rfc2829.txt rfc2830.txt rfc2849.txt rfc2891.txt rfc2926.txt rfc3045.txt rfc3062.txt rfc3088.txt rfc3112.txt rfc3296.txt rfc3377.txt rfc3383.txt rfc3663.txt rfc3671.txt rfc3672.txt rfc3673.txt rfc3674.txt rfc3687.txt rfc3698.txt rfc3703.txt rfc3712.txt rfc3727.txt rfc3771.txt rfc3829.txt rfc3866.txt rfc3876.txt rfc3909.txt rfc3928.txt Getting Started LDAP LDAP Operations Utilities and LDIF Schemas LDAP Filters & URLs ICT Schema Design Flat, Hierarchical Structures Maintenance Problems and solutions Performance Samba Stuff I didn’t talk about References References The RFCs RFC numbers SLUG — ver. 1.4 LDAP at HKIVE(TY) - p. 99/99