OpenLDAP, Slapd, Fedora 17 and Authentication

Once the LDAP database is ready following the steps in the previous post, we can use authconfig-gtk to configure authentication via ldap. On Fedora, for using LDAP passwords either TLS/SSL or LDAPS is required.

The changes in Fedora 17 make getting started much easier. OpenLDAP creates a directory /etc/openldap/certs and creates an empty database of certificates (using /usr/libexec/openldap/create-certdb.sh)

During the installation, openldap-servers  runs /usr/libexec/openldap/generate-server-cert.sh which creates a dummy certificate for the local host and adds it to the certificates database in /etc/openldap/certs.

There is a small inconsistency, which should be resolved soon or it could have been caused by a file from earlier versions which is not replaced by the upgrade.

The files /etc/openldap/ldap.conf and /etc/sssd/sssd.conf use /etc/openldap/cacerts as the directory for the certificates. I needed to manually change that to /etc/openldap/certs.

When I was having problems with certificates, including ldaps in SLAPD_URLS in /etc/sysconfig/slapd and using the following command was helpful:

ldapsearch -ZZ -d 1 -x -LLL  -W -D cn=Manager,dc=example,dc=com -H ldaps:///

Update and caution: I find that slapd fails to start on reboot. It seems to timeout on some operation. However, it works fine upon:

$ sudo systemctl start slapd.service

Update: this was an issue of too small a timeout for my system in /usr/lib/systemd/system/slapd.service. Commenting the timeout solved the issue.
#TimeoutSec=3

Next: Modifying the schema.

OpenLDAP on Fedora 17 - Understanding Installation

As per the motivation in my previous post, I cleaned up slapd.d and various other files to start with a blank state on Fedora 17. Slapd would not start. It now needs slapd.d to exist.

Examining the installation script:

rpm -q --scripts openldap-servers

we notice that it creates fresh slapd.d at start as follows:

 /usr/libexec/openldap/convert-config.sh
                           -f /usr/share/openldap-servers/slapd.ldif

Obviously, the script is smart enough to upgrade the existing files and database in case slapd is already running.

We can customize slapd.conf as follows for our needs:

1. Modify realm in olcAccess, olcSuffix and olcRootDN entries. 
2. Add an entry for olcRootPW -  olcRootPW:"slappasswd output"
3. Add needed schemas, e.g. cosine and nis as only core schema is included by default.

Create the starting slapd database and start the daemon:

$ sudo /usr/libexec/openldap/convert-config.sh -f slapd.ldif
$ sudo systemctl start slapd.service

 I created base.ldif, users.ldif and groups.ldif using the migrationtools and added them to the ldap database:

$ ldapadd -x -W  -D cn=Manager,dc=example,dc=com  -f base.ldif 

It should now be possible to use this server for authentication.

More in next post.

OpenLdap, Slapd and Fedora 17

Single most useful statement about OpenLdap I found was in "LDAP for Rocket Scientists" :

The bad news is that IOHO never has so much been written so incomprehensibly about a single topic with the possible exceptions of BIND and ... and ...

Last time I had used slapd was some years ago. I needed to help a colleague. Fortunately, it was on Ubuntu and the absence of slapd.conf was not too intimidating. It wasn't hard to find that all one needed to do was

# dpkg-reconfigure slapd

I would need to help my colleague some more. So, I decided to set one up at home - on Fedora 16. And that is when I found the comment from "LDAP for Rocket Scientists". There did not seem to be an equivalent of Debian option for getting started. Also, the slapd.d files are substantial differences in the files in slapd.d in Debian and Fedora. Although I managed to get started using ldapmodify, the feeling has been that there has to be a simpler way, especially when I started using tls.

I used self-signed certificates but was having difficulty in getting the certificated trusted. Meanwhile, I upgraded to Fedora 17. There were changes in the way slapd is setup. Instead of /usr/openldap/cacerts, it uses /usr/openldap/certs directory. There are some scripts like generate-server-cert.sh and upgrade-db.sh. There must be some documentation somewhere about these changes. I just haven't found it yet.

So, I plan to drop the slap setup done so far. Start afresh on Fedora 17, making use of the tools provided and see if it makes life simpler.

A few simple things which have tripped me so far -

• Each ldap application is a client and has its own configuration file. It does not need to use /etc/openldap/ldap.conf
• Fedora now relies on sssd for ldap authentication. Since I keep upgrading my system, it did not have this server and was using nss_ldap and pam_ldap.
• The 'Common Name' on the certificate. 

The steps in next post.