Oracle Linux/OpenLDAP

OpenLDAP

Overview

Installed on CentOS 7

Installation

~$ sudo yum install -y openldap-clients openldap-servers
~$ systemctl start slapd
~$ systemctl enable slapd

Configuration

LDAP User Account

Setup new user account for ldap admin

~$ sudo useradd ldapadmin -d /home/ldapadmin/ -G wheel
~$ sudo passwd ldapadmin

Setup LDAP Admin password

Create a SHA hash of the desired password for the ldap admin and add it to the ldap config. The parameter may not exist in the config file, you may need to add it.

~$ slappasswd -h {SSHA} -s ldappassword
==Configure LDAP Server==
create db.ldif and update:
*SSHA password
*olcRootDN
 <nowiki>~$ vim db.ldif
...
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=itzgeek,dc=local

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=ldapadm,dc=itzgeek,dc=local

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}d/thexcQUuSfe3rx3gRaEhHpNJ52N8D3

Send the configuration to the server.

~$ sudo ldapmodify -Y EXTERNAL  -H ldapi:/// -f db.ldif

restrict the monitor access only to ldap root. Update:

• dn.base

~$ vim monitor.ldif
...
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external, cn=auth" read by dn.base="cn=ldapadm,dc=itzgeek,dc=local" read by * none

update the server.

~$ sudo ldapmodify -Y EXTERNAL  -H ldapi:/// -f monitor.ldif

Setup Database

~$ sudo cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
~$ sudo chown -R ldap:ldap /var/lib/ldap
~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

Setup the domain information. Update:

• dn (x4)

~$ vim base.ldif
...
dn: dc=itzgeek,dc=local
dc: itzgeek
objectClass: top
objectClass: domain

dn: cn=ldapadm ,dc=itzgeek,dc=local
objectClass: organizationalRole
cn: ldapadm
description: LDAP Manager

dn: ou=People,dc=itzgeek,dc=local
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=itzgeek,dc=local
objectClass: organizationalUnit
ou: Group

Build the directory structure

~$ sudo ldapadd -x -W -D "cn=ldapadm,dc=itzgeek,dc=local" -f base.ldif

PHPLDAPAdmin

Installation

~$ sudo yum install -y epel-release
sudo yum install -y phpldapadmin

Edit Configuration

~$ sudo vim /etc/phpldapadmin/config.php
...
around line 300, update the domain info
$servers->setValue('server','base',array('dc=itzgeek,dc=local'));

around line 326, update the admin and domain info
$servers->setValue('login','bind_id','cn=ldapadm,dc=itzgeek,dc=local');

around line 397/398, uncomment and comment the following lines
$servers->setValue(‘login’,’attr’,’dn’);
// $servers->setValue(‘login’,’attr’,’uid’);

Update HTTPD

next, update the virtual host configuration to allow connections

sudo vim /etc/httpd/conf.d/phpldapadmin.conf
...
Alias /phpldapadmin /usr/share/phpldapadmin/htdocs
Alias /ldapadmin /usr/share/phpldapadmin/htdocs

usr/share/phpldapadmin/htdocs>
  <IfModule mod_authz_core.c>
    # Apache 2.4
    # Require local
    Require all granted
  IfModule>
  <IfModule !mod_authz_core.c>
    # Apache 2.2
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
    Allow from ::1
  </IfModule>
</Directory>

restart

~$ sudo systemctl restart httpd.service

Update firewalld

~$ sudo firewall-cmd --permanent --add-service=http
~$ sudo firewall-cmd --reload