Beyond Linux® From Scratch - Version 2012-05-20

Chapter 23. Other Server Software

OpenLDAP-2.4.31

Introduction to OpenLDAP

The OpenLDAP package provides an open source implementation of the Lightweight Directory Access Protocol.

This package is known to build and work properly using an LFS-7.0 platform.

Package Information

Additional Downloads

OpenLDAP Dependencies

Required

Berkeley DB-5.3.15

Recommended

Cyrus SASL-2.1.25 and OpenSSL-1.0.1a

Optional

ICU-49.1.1, MySQL-5.5.17 or PostgreSQL-9.0.6, OpenSLP, Pth-2.0.7, TCP Wrappers-7.6 and unixODBC-2.3.1

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/openldap

Installation of OpenLDAP

[Note]

Note

Without the following patch, the Evolution Exchange addressbook integration uses simple binds with cleartext passwords. If you are going to build Evolution Data Server with OpenLDAP support, apply the following patch: 

patch -Np1 -i ../openldap-2.4.31-ntlm-1.patch
[Note]

Note

If you only need to install the client side ldap* binaries, corresponding man pages, libraries and header files (referred to as a “client-only” install), issue the following configure command instead of the other one, and then proceed with the remaining commands (no test suite available): 

patch -Np1 -i ../openldap-2.4.31-blfs-paths-1.patch &&
patch -Np1 -i ../openldap-2.4.31-symbol-versions-1.patch &&
autoconf &&
./configure --prefix=/usr \
            --sysconfdir=/etc \
            --enable-dynamic \
            --disable-debug \
            --disable-slapd

Install OpenLDAP by running the following commands: 

patch -Np1 -i ../openldap-2.4.31-blfs-paths-1.patch &&
patch -Np1 -i ../openldap-2.4.31-symbol-versions-1.patch &&
autoconf &&
./configure --prefix=/usr \
            --sysconfdir=/etc \
            --localstatedir=/var \
            --libexecdir=/usr/lib \
            --disable-static \
            --disable-debug \
            --enable-dynamic \
            --enable-crypt \
            --enable-modules \
            --enable-rlookups \
            --enable-backends=mod \
            --enable-overlays=mod \
            --disable-ndb \
            --disable-sql &&
make depend &&
make

To test the results, issue: make test. If you've enabled tcp_wrappers, ensure you add 127.0.0.1 to the slapd line in the /etc/hosts.allow file if you have a restrictive /etc/hosts.deny file.

Now, as the root user: 

make install &&

install -v -m755 -d /usr/share/doc/openldap-2.4.31/{drafts,guide,rfc} &&
install -v -m644    doc/drafts/* \
                    /usr/share/doc/openldap-2.4.31/drafts &&
install -v -m644    doc/rfc/* \
                    /usr/share/doc/openldap-2.4.31/rfc &&
cp -v -R            doc/guide/* \
                    /usr/share/doc/openldap-2.4.31/guide

Command Explanations

--disable-static: This switch prevents installation of static versions of the libraries.

--disable-debug: This parameter disables the debugging code in OpenLDAP.

--enable-dynamic: This parameter forces the OpenLDAP libraries to be dynamically linked to the executable programs.

--enable-crypt: This parameter enables using of crypt(3) passwords.

--enable-modules: This parameter enables dynamic module support.

--enable-rlookups: This parameter enables reverse lookups of client hostnames.

--enable-backends: This parameter enables all available backends.

--enable-overlays: This parameter enables all available overlays.

--disable-ndb: This parameter disables MySQL NDB Cluster backend which causes configure to fail if MySQL is present.

--disable-sql: This parameter explicitly disables the SQL backend. Omit this switch if a SQL server is installed and you are going to use a SQL backend.

--enable-spasswd: This parameter enables SASL password verification.

--enable-slp: This parameter enables SLPv2 support. Use this switch if you have installed OpenSLP.

--enable-wrappers: This parameter enables TCP Wrappers support. Use this switch if you have installed TCP Wrappers-7.6.

[Note]

Note

You can run ./configure --help to see if there are other parameters you can pass to the configure command to enable other options or dependency packages.

Configuring OpenLDAP

Config Files

/etc/openldap/*

Configuration Information

Configuring the slapd servers can be complex. Securing the LDAP directory, especially if you are storing non-public data such as password databases, can also be a challenging task. You'll need to modify the /etc/openldap/slapd.conf and /etc/openldap/ldap.conf files to set up OpenLDAP for your particular needs.

Resources to assist you with topics such as choosing a directory configuration, backend and database definitions, access control settings, running as a user other than root and setting a chroot environment include:

Mozilla Address Directory

By default, LDAPv2 support is disabled in the slapd.conf file. Once the database is properly set up and Mozilla is configured to use the directory, you must add allow bind_v2 to the slapd.conf file.

Boot Script

To automate the startup of the LDAP server at system bootup, install the /etc/rc.d/init.d/openldap init script included in the blfs-bootscripts-201205011 package using the following command: 

make install-openldap
[Note]

Note

The init script starts the daemon without any parameters. You'll need to modify the /etc/sysconfig/openldap to include the parameters needed for your specific configuration. See the slapd man page for parameter information.

Testing the Configuration

Start the LDAP server using the init script: 

/etc/rc.d/init.d/openldap start

Verify access to the LDAP server with the following command: 

ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts

The expected result is: 

# extended LDIF
#
# LDAPv3
# base <> with scope base
# filter: (objectclass=*)
# requesting: namingContexts
#

#
dn:
namingContexts: dc=my-domain,dc=com

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

Contents

Installed Programs: ldapadd, ldapcompare, ldapdelete, ldapexop, ldapmodify, ldapmodrdn, ldappasswd, ldapsearch, ldapurl, ldapwhoami, slapacl, slapadd, slapauth, slapcat, slapd, slapdn, slapindex, slappasswd, slapschema and slaptest
Installed Libraries: liblber.so, libldap.so,a and libldap_r.so
Installed Directories: /etc/openldap, /usr/lib/openldap and /var/lib/openldap

Short Descriptions

ldapadd

opens a connection to an LDAP server, binds and adds entries.

ldapcompare

opens a connection to an LDAP server, binds and performs a compare using specified parameters.

ldapdelete

opens a connection to an LDAP server, binds and deletes one or more entries.

ldapexop

issues the LDAP extended operation specified by oid or one of the special keywords whoami, cancel, or refresh.

ldapmodify

opens a connection to an LDAP server, binds and modifies entries.

ldapmodrdn

opens a connection to an LDAP server, binds and modifies the RDN of entries.

ldappasswd

is a tool used to set the password of an LDAP user.

ldapsearch

opens a connection to an LDAP server, binds and performs a search using specified parameters.

ldapurl

is a command that allows to either compose or decompose LDAP URIs.

ldapwhoami

opens a connection to an LDAP server, binds and displays whoami information.

slapacl

is used to check the behavior of slapd by verifying access to directory data according to the access control list directives defined in its configuration.

slapadd

is used to add entries specified in LDAP Directory Interchange Format (LDIF) to an LDAP database.

slapauth

is used to check the behavior of the slapd in mapping identities for authentication and authorization purposes, as specified in slapd.conf.

slapcat

is used to generate an LDAP LDIF output based upon the contents of a slapd database.

slapd

is the standalone LDAP server.

slapdn

checks a list of string-represented DNs based on schema syntax.

slapindex

is used to regenerate slapd indexes based upon the current contents of a database.

slappasswd

is an OpenLDAP password utility.

slapschema

is used to check schema compliance of the contents of a slapd database.

slaptest

checks the sanity of the slapd.conf file.

liblber.so

is a set of lightweight Basic Encoding Rules routines. These routines are used by the LDAP library routines to encode and decode LDAP protocol elements using the (slightly simplified) Basic Encoding Rules defined by LDAP. They are not normally used directly by an LDAP application program except in the handling of controls and extended operations.

libldap.so

supports the LDAP programs and provide functionality for other programs interacting with LDAP.

libldap_r.so

contains the functions required by the LDAP programs to produce the results from LDAP requests.

Last updated on 2012-05-11 11:13:04 +0000