Changes between Version 15 and Version 16 of ldapiam2018

Timestamp:

Sep 12, 2018, 7:09:12 PM (6 years ago)

Author:

admin

Comment:

--

ldapiam2018

@@ -215 +215 @@
 description: All groups
 
-dn: cn=adm,ou=Group,dc=instXY,dc=ac,dc=lk
-cn: adm
-description: System Admin Staff
-gidNumber: 1500
-objectClass: posixGroup
-objectClass: top
-
-dn: cn=acd,ou=Group,dc=instXY,dc=ac,dc=lk
-cn: acd
-description: Acadamic Staff
-gidNumber: 2000
-objectClass: posixGroup
-objectClass: top
-
-dn: cn=student,ou=Group,dc=instXY,dc=ac,dc=lk
-cn: student
-description: Students
-gidNumber: 5000
-objectClass: posixGroup
-objectClass: top
-
-dn: ou=servers,dc=instXY,dc=ac,dc=lk
+dn: ou=Servers,dc=instXY,dc=ac,dc=lk
 description: servers
 objectClass: top
@@ -242 +221 @@
 ou: servers
 
-dn: cn=idp,ou=servers,dc=instXY,dc=ac,dc=lk
+dn: cn=idp,ou=servers,dc=inst00,dc=ac,dc=lk
 cn: idp
 description: Identity Server
-ipHostNumber: 3ffe:ffff:ffff::9
+ipHostNumber: 3ffe: ffff: ffff: : 9
 objectClass: top
 objectClass: device
@@ -251 +230 @@
 objectClass: simpleSecurityObject
 userPassword: {crypt}idpldap
-
-dn: uid=testme,ou=people,dc=instXY,dc=ac,dc=lk
+}}}
+
+Save the above as a .ldif file and add it to your directory as
+{{{
+sudo ldapadd -H ldap:// -x -D "cn=admin,dc=instXY,dc=ac,dc=lk" -W -Z -f path_to_file.ldif
+}}}
+
+When Creating Users and Groups there are several ways in linking them with each other. This makes easy to search users, their associated groups as well as the groups and their associated users.
+
+* Option 1: Create Posix Groups, define `gidNumber` and link user with it.
+
+{{{
+dn: cn=adm,ou=Group,dc=instXY,dc=ac,dc=lk
+cn: adm
+description: System Admin Staff
+gidNumber: 1000
+objectClass: posixGroup
+objectClass: top
+
+
+dn: uid=testme1,ou=people,dc=instXY,dc=ac,dc=lk
 cn: Test Me
-uid: testme
+uid: testme1
 uidNumber: 1001
 gidNumber: 1000
-givenName: Test Me
+givenName: Test Me1
 homeDirectory: /dev/null
 homePhone: none
@@ -272 +270 @@
 mobile: +94791234567
 userPassword: testme
-mail: testme@instXY.ac.lk
-eduPersonAffiliation: member
-}}}
-
-Save the above as a .ldif file and add it to your directory as
-{{{
-sudo ldapadd -H ldap:// -x -D "cn=admin,dc=instXY,dc=ac,dc=lk" -W -Z -f path_to_file.ldif
-}}}
-
-More about federated attributes http://wiki.aaf.edu.au/tech-info/attributes
-
-More About SCHAC schema https://www.terena.org/activities/tf-emc2/docs/schac/schac-schema-IAD-1.3.0.pdf
+mail: testme1@instXY.ac.lk
+eduPersonAffiliation: staff
+}}}
+
+* Option 2: Define `groupOfNames` with `memberOf` overlay. (recommended in edugain installations)
+  
+   To do this we need to create 3 .ldif files and import to the slapd.
+
+`memberof_config.ldif`
+
+{{{
+dn: cn=module,cn=config
+cn: module
+objectClass: olcModuleList
+olcModuleLoad: memberof
+olcModulePath: /usr/lib/ldap
+
+dn: olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config
+objectClass: olcConfig
+objectClass: olcMemberOf
+objectClass: olcOverlayConfig
+objectClass: top
+olcOverlay: memberof
+olcMemberOfDangling: ignore
+olcMemberOfRefInt: TRUE
+olcMemberOfGroupOC: groupOfNames
+olcMemberOfMemberAD: member
+olcMemberOfMemberOfAD: memberOf
+}}}
+
+`refint1.ldif`
+
+{{{
+dn: cn=module{1},cn=config
+add: olcmoduleload
+olcmoduleload: refint
+}}}
+
+`refint2.ldif`
+
+{{{
+dn: olcOverlay={1}refint,olcDatabase={1}hdb,cn=config
+objectClass: olcConfig
+objectClass: olcOverlayConfig
+objectClass: olcRefintConfig
+objectClass: top
+olcOverlay: {1}refint
+olcRefintAttribute: memberof member manager owner
+}}}
+
+   To set up the memberof module and configure it, run this command:
+
+   `sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f memberof_config.ldif`
+
+   To load and configure the refint module (Referential Integrity overlay)
+
+   `sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f refint1.ldif`
+
+   `sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f refint2.ldif`
+
+   > Every group created before this module is enabled has to be deleted and remade in order for these changes to take effect. LDAP assigns a "member" attribute behind the scenes to existing users when creating a group.
+
+   `addgroup.idif`
+
+{{{
+dn: cn=staff,ou=Group,dc=instXY,dc=ac,dc=lk
+objectClass: groupofnames
+cn: staff
+description: All users
+member: uid=testme1,ou=people,dc=instXY,dc=ac,dc=lk
+}}}
+
+   >Make sure to add "member : user_dn" pair line for each user you want to add to this group.
+
+   Load group to the system by:
+
+   `sudo ldapadd -H ldap:// -x -D "cn=admin,dc=instXY,dc=ac,dc=lk" -W -Z -f addgroup.ldif`
+
+
+
+More details on federated attributes http://wiki.aaf.edu.au/tech-info/attributes
+
+More on SCHAC schema https://www.terena.org/activities/tf-emc2/docs/schac/schac-schema-IAD-1.3.0.pdf
+