The LDAPAuth module is for use with Netwin's DMail and DNews products and an LDAP server. Several of Netwin's products allow the use of a separately compiled authentication module which obey a simple command protocol (see External Authentication). Netwin provides several such authentication modules and you can also build your own. LDAPAUTH is one of the modules Netwin provides and enables you to authenticate against an LDAP server rather than standard NT or UNIX password files.
Directory severs contain information about objects. One sort of object is a person and the various bits of information stored in the directory server about that object are called attributes.
The attributes stored will vary from one LDAP server to another. The key one for use with LDAPAuth is the 'mail' attribute which has the form 'user' or 'user@domain' this is what ldapauth refers to as the username (see the ldap_search_name below to change mail to another attribute). The distinguished name or dn is generally of no interest to ldapauth. The @domain part of the username is optional and will default to a setting in the ini file.
To make DMail use ldapauth you need to edit the dmail.conf configuration file,
typically,
c:\winnt\system32\dmail.conf
or
/etc/dmail.conf
and edit the following to settings to read,
authent_method External
authent_process c:\dmail\ldapauth.exe
and then RESTART both DSMTP and DPOP.
More detail is given in,
Installation instructions for use with DMail on NT
Installation instructions for use with DMail on UNIX
For more details on running an external authentication module like ldapauth see,
External Authentication.
Same as with dmail, except that the entry in dnews.conf should be:
auth_spawn d:\dnews\ldapauth.exe
instead of the dmail settings
authent_method External
authent_process c:\dmail\ldapauth.exe
See http://netwinsite.com/dnews/access.htm#pass_ldap for the few dnews specific instructions but in general follow the dmail installation instructions.
The ldapauth module receives commands on stdin and sends replies on stdout. The command set is given below:
NB: Ldapauth does not take any command line arguments.
NB: LDAPAuth's command set is defined by the Netwin External Authentication Protocol.
Command | Function |
---|---|
lookup username | Retrieve drop file location and other information about an already authenticated user |
check username password | Check the a username and password against LDAP directory |
search username | Search for matching users |
set username password option=" value" | Create a new user entry in the LDAP directory |
quit | close down ldapauth |
exit | close down ldapauth |
verbose | Toggle verbose mode. Verbose mode is useful for testing when running ldapauth at the command prompt. It outputs additional information in response to each command |
version | Print the version number |
Replies consist of:
+OK message
-ERR message
+DATA message
Details of the response and additional options within each command are given in the following sections:
Check the a username and password against LDAP directory. The username may be either user@domain or just user. The LDAP directory will be searched for entries with the attribute mail = user@domain. If the supplied username has no @domain section then this will be taken from the ini file setting pop_domain. Once a matching entry is found then ldapauth will try and bind to that entry using the supplied password. The fromip parameter is currently ignored by this module, it is used in other modules to specify different virtual domains. If the bind operation is successful the +OK is returned if not -ERR is returned.
If the bind was successful then the LDAP entry is also checked for drop file, uid and forward attributes. If these are found then they are also returned. If no drop path attribute is found the word config is returned in its place. If no uid attribute is found 0 is returned. Forward addresses, if found, are returned at the end of the +OK line. The attributes to be used for drop_file, uid and forward are specified by the ini settings ldap_drop_file, ldap_mail_uid and ldap_dmail_forward. The default values for these are: drop_file, mail_uid and mailForwardingAddress.
Input:
check username@domain password fromip
check username password fromip
Returns:
+OK username path uid forward
-ERR reason
Shuts down the ldapauth module.
List the available commands using the format
+DATA information
+DATA information
+OK
Retrieves drop file location uid and forward information about an already authenticated user. The format etc. is similar to that used in the check command but no password is required. This is used for example by DPOP when it needs to check the location of a drop file without first authenticating a user.
Input:
lookup user@domain fromip
lookup user fromip
Returns:
+OK username path uid forward
-ERR reason
Search for matching users. The supplied username may be of the form user@domain or just user. The LDAP directory will be searched for entries with the attribute mail matching user*@domain. If the supplied username has no @domain section then this will be taken from the ini file setting pop_domain. To check for users from any domain use: search user@* One line is returned for each matching entry with a +OK or -ERR line at the end.
Input:
search user
search r
search *smith
search Ralph@*
Returns:
+DATA dn=(cn=Test0, o=netwin), mail=test0@161.29.2.44
+DATA dn=(cn=Test1, o=netwin), mail=test1@161.29.2.44, path=/spool/mail
+OK Search Complete-ERR No matching entries
This command has several uses depending on the format used. It can:
set newuser password | add a new user and password to the LDAP server |
set olduser newpassword | change the password of an existing user |
set olduser (NULL) age="45" | add new attributes for an existing user |
set olduser (NULL) age="46" | modify the values of attributes for an existing user |
When it is adding a new user it will use the ini setting ldap_objectclass setting to specify what the object to be added is. The default is a person. They will have a dn: newuser as well as an attribute mail: newuser@domain where @domain was either part of the specified username or taken from the ini setting pop_domain.
When adding new attributes they are specified in the form name="value" the quotation characters are required and multiple attribute name="values" can be specified separated by spaces.
NB: You MUST ensure that any attributes that you supply to the set command exist in
your objectclass, otherwise you will get an error like,
-ERR ld_set: Cant modify entry for cn=fred: Object class violation
If the password is not to be changed or rewritten to the LDAP directory then the password is specified as the string (NULL)
The modify attribute value has the same format as the add new attribute. Note that the new value replaces any existing values.
Input:
set username password|(NULL) [var="value" ...]
set user password
set user (null) age="45" sex="male"
Response:
+OK Database modified for user (mail=ralph@161.29.2.44)
-ERR ld_set: Cant modify entry for cn=Ralph, o=netwin: Protocol error
Shutdown ldapauth module. Identical to exit command.
Toggles the verbose mode. In verbose mode it is assumed the module is being run at a
command prompt and additional information can be printed. For example lookup and check
will return the full information of all attributes for the selected entry.
Netwin supplies several external authentication modules:
These are all supplied with source so they can easily be tailored to your particular use. The LDAPAUTH module allows you to use an LDAP server to authenticate against in addition to storing such things as the location of the users drop file in the LDAP database. It makes use of an ini file which must be called ldapauth.ini an must be stored with the ldapauth executable. The settings which can be used within the ini file are given below:
Setting | Description |
---|---|
info_fields | Use setting to inform ldapauth of pairs of database field names. It takes a list of up
to 20 comma separated pairs of field names, where each pair is two words separated by a
space. In each pair the first name is the name that ldapauth should display as the field
name and the second name is that of the field in your database. So the pair 'usergroups
groups' would mean that ldapauth looks in your database for the field 'groups' and if a
'value' is found returns the field, usergroups="value". Similarly on a set if
you enter, 'set bob usergroups="humour"' then ldapauth will set the field
'groups' with the value 'humour'. Syntax: info_fields field_name1 db_name2[,field name2
db_name2,...] |
ldap_group_base | (Version 1.1a, DMail 3.0) These four settings are used to pass the group membership
through to dnews for access control. It is much better to use the info_fields when
possible (it is much more efficient). ldap_group_base defines where in the ldap database
group information is found. See below this table for more info on using this. Example:
ldap_group_base dc=netwin,dc=co,dc=nz |
ldap_group_search | A search that will find the ldap objects that contain usergroup information, it's best
to make this as specific as possible. Example: ldap_group_search cn=group* |
ldap_group_field | Specify the field that contains the users email address in usergroup objects. Example:
ldap_group_field cn |
ldap_group_attrib | Specify the attribute in a usergroup object that contains the information about each
user. Example: ldap_group_attrib uniquemember |
ldap_port | The TCPIP port to connect to the LDAP server on. Example: ldap_port 3890 |
log_path | The directory to store log files in Example: log_path c:\logs |
max_log_size | The size at which log files are rotated. Logs are numbered 1,2,3,4 Example:
max_log_size 10000 |
log_level | Controls the amount of information logged during use. One of error, info, debug. Example:
log_level debug |
ldap_host | The IP address or domain of the host to connect to, i.e. the machine where the LDAP
server is listening. Example: ldap_host apples.com |
ldap_mail_uid | The LDAP attribute which will be used to store the uid DMail should use for accessing
the users drop file. i.e. the DMail servers will create and check that a user's drop file
is owned by this system uid. Typically the default of 0 for root is used. In general we do
not recommend changing this setting. Example: ldap_mail_uid mail (user files owned by
'mail' user) |
ldap_mgr_dn | The LDAP manager distinguished name to bind with. NB: add this field and the
ldap_mgr_pw field with blank entries for anonymous login. Example: ldap_mgr_dn cn=Dmail
Manager |
ldap_mgr_pw | The password for the ldap_mgr_dn entry.NB: add this field and the ldap_mgr_dn field
with blank entries for anonymous login. Example: ldap_mgr_pw secret |
ldap_search_base | The LDAP search base to use for all interactions with the LDAP server Example:
ldap_search_base dc=apples,dc=com |
ldap_search_name | IMPORTANT: Specifies the attribute used for identifying the user's entry in the
database. e.g. when set to the default of mail, lookup bob, makes ldapauth lookup,
mail=bob in database. (Prior to version 1.0k this was only used for lookups and not on the
set command) Example: ldap_search_name uid |
pop_domain | The domain which will be appended to any usernames not containing @domain NB: if
set then you must use the setting, Example: pop_domain apples.com |
ldap_drop_file | Name of LDAP attribute which will be used for storing the full name and path of the
users drop file. Normally this is not set and LDAPAuth returns the keyword 'config' to
indicate that the DMail servers should use their internal settings to locate the user's
drop file location. Example: ldap_drop_file mail_drop_file |
ldap_objectclass | When adding new users LDAPAuth will add the new user to this ObjectClass. Notes:
Example: ldap_objectclass umichPerson |
ldap_dmail_forward | Name of LDAP attribute in database which will be used to store DMail forwarding
addresses. It can be set blank. If a value for this attribute is found when doing a lookup
or check command then LDAPAuth responds with the info field, fwd="value" e.g., fwd="bob@another_domain.com" causing mail redirection to that address. See the DMail Manual section, Example: ldap_dmail_forward alias |
log_name | Base of log file name. Note suffix n.log will be appended so default is ldapauth1.log Example:
log_name c:\mylogdir\ |
sha_hash | On set command only, take password given and use the SHA to hash it. NB: this setting
is really obsoleted by SSHA, which is done by default. If you really want SHA then you
need to set the two settings as per the example below. Example (If you really do want
SHA not SSHA or plaintext): |
ssha_hash_dont | Unless this setting is set to true, on the set command only, ldapauth will hash the
given password using SSHA and prepend the string, {ssha} to the start of it before sending
to the database. That way the database knows to SSHA the password sent by the ldapauth
check command before comparing it with that user's password in the database. Starting with
version 1.0L ldapauth will SSHA all passwords when setting (adding) a user in the
database. This setting is for turning that behaviour off. To make ldapauth add users with plain text passwords as it used to, use the setting as per the example below and check that the sha_hash setting is false or not in the ini file. Example: #sha_hash true (commented out, for plain text passwords) |
Notes on using ldap_group* settings with dnews.
Basically the idea is you tell ldapauth.ini where to find your usergroup objects, within a usergroup object should be a list of entries pointing to the users who belong to that user group here is an example of an object called "group_staff" which has two members, users test198 and test197
ldapsearch -L -b "dc=netwin,dc=co,dc=nz" "cn=*" dn: cn=group_staff,dc=netwin,dc=co,dc=nz cn: group_staff objectclass: umichperson uniquemember: cn=test198,dc=netwin,dc=co,dc=nz uniquemember: cn=test197,dc=netwin,dc=co,dc=nz
Using these settings in ldapauth.ini
ldap_group_base dc=netwin,dc=co,dc=nz ldap_group_search cn=group* ldap_group_field cn ldap_group_attrib uniquemember
Then a lookup will respond like this:
D:\dmail>ldapauth lookup test197 +OK test197 config 0 groups="group_staff"
In dnews's access.conf you can then add a rule like this:
*:read,post:,groups=group_staff::staff.*:add
To add/remove access to the staff newsgroups to users belonging to that ldap group. Always test ldapauth manually to check the response and name of the group before trying to add the entry to access.conf.
You need to perform the following steps:
1. Download the distribution set
2. Unpack the distribution set
3. Copy ldapauth.exe and ldapauth.ini to a directory where DMail can use it.
4. Edit ldapauth.ini to meet your requirements.
5. Update dmail.conf to tell dmail to use ldapauth for authentication.
6. Restart DMail.
7. Test it.
These steps are described in detail below:
1.
NB Windows users: With versions 2.8h and above of DMail you will find the ldapauth files in your DMail distribution set (\dmtemp). They should have been copied into your DMail directory by the DMSetup utility, so you should check step 3 below and then jump to step 4.
Download the distribution set
For the latest versions see, Utilities Download Page
General command line FTP instructions:
ftp ftp.netwinsite.com
(log in with username 'anonymous', use your email address as a password)
cd pub/dmail
hash
binary
get ldp10c.exe
2. Unpack the distribution set
ldp10a
3. Copy files (ldapauth.exe etc.) in temporary unpack directory /ldtemp to a directory where DMail can use them.
NB: You MUST remember to copy the ldap dll
cd \ldtemp
copy * \dmail
You should find the following files,
ldapauth (binary)
nsldap32v11.dll (copy this to dmail directory or c:\winnt\system32\)
ldapauth.ini (sample ini file for you to edit)
ldap.htm (a copy of this page)
authprot.htm (outlines our External Authentication Protocol)
4. Edit ldapauth.ini to meet your requirements.
notepad \dmail\ldapauth.ini
! See other sections of this page for configuration information !
Note ldapauth.ini will normally contain the manager password for your ldap server so it should be suitably protected but ldapauth must be able to read it. LDAPAuth is spawned by DPOP which is spawned by the DWatch service which is normally run as the 'system' account.
5. Update dmail.conf to tell dmail to use ldapauth for authentication.
notepad \winnt\system32\dmail.conf
add/modify the following lines:
authent_method External
authent_process c:\dmail\ldapauth.exe
6. Restart DMail.
Use dmadmin utility for this. Do a stop all and then a start all.
or see Restart information
7. Test it.
Try a search or add user dmadmin or just connecting an email client with a username/password which exists on the ldap server. If these tests fail it may help to run the ldapauth.exe the command line then use commands; help and verbose etc. to see what the problem is.
You need to perform the following steps
1. Download the distribution set
2. Unpack the distribution set
3. Copy ldapauth.exe and ldapauth.ini to a directory where DMail can use it.
4. Edit ldapauth.ini to meet your requirements.
5. Update dmail.conf to tell dmail to use ldapauth for authentication.
6. Restart DMail.
7. Test it.
These steps are described in detail below:
1.
NB Linux Libc6 users: With versions 2.8h and above of DMail you will find the ldapauth files in your DMail distribution set (/dmtemp). They should have been copied into your DMail directory by the DMSetup utility, so you should check step 3 below and then jump to step 4.
Download the distribution set
For the latest versions see, Utilities Download Page
General command line FTP instructions:
ftp ftp.netwinsite.com
(log in with username 'anonymous', use your email address as a password)
cd pub/dmail
binary
hash
get ldp10c.exe
2. Unpack the distribution set by entering at the command prompt,
ldp10c
3. Copy files in temporary unpack directory /ldtemp to a directory where DMail can use them, i.e. to the dsmtp_path.
cd /ldtemp
cp * /usr/local/dmail
You should find the following files,
ldapauth (binary)
ldapauth.ini (sample ini file for you to edit)
ldap.htm (a copy of this page)
authprot.htm (outlines our External Authentication Protocol)
4. Edit ldapauth.ini to meet your requirements.
vi /usr/local/dmail/ldapauth.ini
! See other sections of this page for configuration information !
Note ldapauth.ini will normally contain the manager password your ldap server so it should be suitably protected but ldapauth must be able to read it. NB: LDAPAuth will normally be able to read a protected file as it runs as root, when spawned by DPOP or DSMTP.
5. Update /etc/dmail.conf to tell dmail to use ldapauth for authentication.
vi /etc/dmail.conf
add/modify the following lines:
authent_method External
authent_process /usr/local/dmail/ldapauth
6. Restart DMail.
Use dmadmin utility for this or
tellsmtp shutdown
tellpop shutdown
/usr/local/dmail/dm_start.sh
/usr/local/dmail/dpop_start.sh
7. Test it.
Try a search or add user dmadmin or just connecting an email client with a username/password which exists on the ldap server. If these tests fail it may help to run the ldapauth.exe the command line then use commands; help and verbose etc. to see what the problem is.
It is now our policy to provide a binary form of ldapauth for as many platforms as possible. (For Linux and NT you will find ldapauth binaries in the DMail distribution set).So before building LDAPAuth for yourself, you should check that our utilities page does not have a pre compiled executable for you. And if it doesn't you can of course email us and we will try to build it for you.
We will still provide the source, downloadable our utilities page.
Below are instructions for compiling ldapauth yourself.
1. Download the ldapauth source our utilities page,
http://www.netwinsite.com/dmail/utils.htm#ldapauth
,or directly our ftp site, login as user 'anonymous',
ftp://ftp.netwinsite.com/pub/dmail/ldp10c_source.tar.Z
(or a similar file name)
2. After downloading the file you would do this:
uncompress ldp10c_source.tar.Z
tar -xvf lpd10c_source.tar
cd buildxx (e.g. build28)
cp config.PLATFORM config.i
(where PLATFORM is your platform, e.g. solaris)
3. If you don't have the sdk installed...
3.a) You can install the LDAP C libraries sdk :
http://www.openldap.org/
or (Netscape)
http://www.mozilla.org/directory/
and then edit the SPECLIBS line of config.i so that you include the correct libraries
for the SDK that you installed, e.g. libldap and liblber, e.g.,
SPECLIBS = -I../ldap/include -L../ldap/libraries -lldap -llber
OR
3.b) Our ldapauth source contains the openldap sdk, so do the following in the buildxx
directory,
*** you may need to edit config.i at this point and uncomment SPECLIBS line ***
uncompress ldapopen-src.tar.Z
tar -xvf ldapopen-src.tar
cd ldap
./configure
make depend
make
(that should make the libraries, see INSTALL for OPENLDAP instructions on installing SDK)
cd .. (back up to buildxx directory)
4. Now LDAPAuth should build correctly:
cd dpop
make ldapauth
If not check that you are including the SDK include directory and providing the
location of the two SDK libraries, libldap and liblber, which should be on the SPECLIBS
line in the config.i you are using, e.g. something like,
SPECLIBS = -I../ldap/include - L../ldap/libraries -lldap -llber
(ensure that the line in your config.i is not commented out with a pound or hash, #, symbol).
5. Then use the resulting ldapauth binary with dmail or dnews.
For DMail,
copy ldapauth to your dmail directory,
cp ldapauth /usr/local/dmail
copy other files to dmail directory,
cp ../misc/ldap* /usr/local/dmail
cd /usr/local/dmail
edit ldapauth.ini (see the config settings on this page for details)
vi ldapauth.ini
6.Test ldapauth at the command line,
./ldapauth
lookup username
+ok username ...
quit
We recommend the OpenLdap server available ,
http://www.openldap.org/
We also test LDAPAuth against Netscape's LDAP server (a number of the defaults reflect this) and the University of Michigan server.
SDKs for LDAP are also available ,
http://www.openldap.org/
OR (Netscape)
http://www.mozilla.org/directory/
download openldap ,
http://www.openldap.org/software/download/
I chose,
1.2.11 (20000704)
and downloaded to,
/usr/local/openldap-stable-20000704.tgz
unpack with,
gzip -d tar -xvf openldap-stable-20000704.tgz
tar -xvf tar -xvf openldap-stable-20000704.tar
ln -s openldap-1.2.11 oldap
cd oldap
Now try to install referring to, http://www.openldap.org/doc/admin/, ... specifically, http://www.openldap.org/doc/admin/quickstart.html
./configure
(no problems there - very lucky indeed - in the past I have often had lots of problems and have had to use ./configure --help and work out a list of options to disable).
make depend
make (seemed to work - sometimes it looks as if it has but way back in all the guff you find something did not build)
make test (complained that there was nothing to do?!)
make install (seemed to work)
vi /usr/local/etc/openldap/slapd.conf
and changed to the following ...
database ldbm
#suffix "dc=my-domain, dc=com"
suffix "dc=netwin,dc=co,dc=nz"
#suffix "o=My Organization Name, c=US"
#rootdn "cn=Manager, dc=my-domain, dc=com"
rootdn "cn=Manager, dc=netwin, dc=co, dc=nz"
#rootdn "cn=Manager, o=My Organization Name, c=US"
# cleartext passwords, especially for the rootdn, should
# be avoid. See slapd.conf(5) for details.
rootpw secret
now started the server,
/usr/local/libexec/slapd
and check with,
[root@dev oldap]# ps ax |grep lap
9140 ? S 0:00 /usr/local/libexec/slapd
9141 ? S 0:00 /usr/local/libexec/slapd
9142 ? S 0:00 /usr/local/libexec/slapd
9187 p1 S 0:00 grep lap
It would seem that it is running - not really sure why there are 3 instances.
Tried,
[root@dev oldap]# ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
ldapsearch: invalid option -- x
usage: ...
so removed the x and got,
[root@dev oldap]# ldapsearch -b '' -s base '(objectclass=*)' namingContexts
ldap_search: No such object
Oh, well seemed to vaguely work.
Try adding a user,
had a look at,
man ldapadd
then saw quickstart has example,
[root@dev oldap]# vi ./example.ldif
dn: dc=netwin,dc=co,dc=nz
objectclass: dcObject
objectclass: organization
o: netwin
dc: netwin.co.nz
dn: cn=Manager,dc=netwin,dc=co,dc=nz
objectclass: organizationalRole
cn: Manager
Remember to trim leading and trailing white space including tabs at the start of lines!
Then,
[root@dev oldap]# ldapadd -x -D "cn=Manager,dc=netwin,dc=co,dc=nz" -W -f example.ldif
ldapadd: invalid option -- x
usage: ldapadd [-abcknrvWF] [-d debug-level] [-h ldaphost] [-p ldapport] [-D binddn] [-w passwd] [ -f file | < entryfile ]
wonder what -x was, lets change it to -v for verbose :-)
[root@dev oldap]# ldapadd -v -D "cn=Manager,dc=netwin,dc=co,dc=nz" -W -f example.ldif
Enter LDAP Password:
add objectclass:
dcObject
organization
add o:
netwin
add dc:
netwin.co.nz
adding new entry dc=netwin,dc=co,dc=nz
modify complete
add objectclass:
organizationalRole
add cn:
Manager
adding new entry cn=Manager,dc=netwin,dc=co,dc=nz
modify complete
[root@dev oldap]#
see if it works,
[Root@dev oldap]# ldapsearch -b 'dc=netwin,dc=co,dc=nz' '(objectclass=*)'
which gives result,
dc=netwin,dc=co,dc=nz
objectclass=dcObject
objectclass=organization
o=netwin
dc=netwin.co.nz
cn=Manager,dc=netwin,dc=co,dc=nz
objectclass=organizationalRole
cn=Manager
Success!
Now try lookup command with ldapauth,
cd /usr/local/dmail
vi ldapauth.ini
# ldapauth ini file settings
# Lines starting with # are comments
ldap_host 127.0.0.1
log_level debug
ldap_mgr_pw secret
ldap_mgr_dn cn=Directory Manager
# Required settings
#pop_domain pop_host_domain
#ldap_host server.running.ldap
#ldap_mgr_pw secret
#ldap_mgr_dn cn=Directory Manager
#ldap_search_base dc=netwin,dc=co,dc=nz (see later where this line has to be added in for lookup to work)
# Optional settings: see ldapauth.htm
# ldap_port
# log_level
# log_name
# log_path
# max_log_size
# ldap_host
# ldap_mail_uid
# ldap_drop_file
# ldap_objectclass
# ldap_dmail_forward
"ldapauth.ini" 29 lines, 605 characters written
[root@dev dmail]# ./ldapauth
lookup bob
-ERR bob ld_check: Cant bind to ldap host as cn=Directory Manager: Invalid credentials quit
so changed the line in ./ldapauth.ini to,
ldap_mgr_dn cn=Manager,dc=netwin,dc=co,dc=nz
and then success (well the login succeeded because ldapauth got to the search stage but the lookup failed),
[root@dev dmail]# ./ldapauth
lookup bob
-ERR bob ld_check: ldap search failed for (mail=bob)
quit
So now add a test user,
fred
[root@dev oldap]# vi example3.ldif
dn: cn=fred,dc=netwin,dc=co,dc=nz
objectclass: person
cn: fred
mail: fred@dev.netwin.co.nz
sn: Jensen
~
~
"example3.ldif" 5 lines, 100 characters written
[root@dev oldap]# ldapadd -v -D "cn=Manager,dc=netwin,dc=co,dc=nz" -W -f example3.ldif
Enter LDAP Password:
add objectclass:
person
add cn:
fred
add mail:
fred@dev.netwin.co.nz
add sn:
Jensen
adding new entry cn=fred,dc=netwin,dc=co,dc=nz
modify complete
Try the lookup again ...
[root@dev oldap]# cd /usr/local/dmail
[root@dev dmail]# ./ldapauth
lookup fred@dev.netwin.co.nz
-ERR fred@dev.netwin.co.nz ld_check: ldap search failed for (mail=fred@dev.netwin.co.nz)
quit
So now try a search using the ldap command line tool ...
[root@dev dmail]# ldapsearch -b 'dc=netwin,dc=co,dc=nz' '(objectclass=*)'
dc=netwin,dc=co,dc=nz
objectclass=dcObject
objectclass=organization
o=netwin
dc=netwin.co.nz
cn=Manager,dc=netwin,dc=co,dc=nz
objectclass=organizationalRole
cn=Manager
cn=bob,dc=netwin,dc=co,dc=nz
objectclass=person
cn=bob
sn=Jensen
cn=fred,dc=netwin,dc=co,dc=nz
objectclass=person
cn=fred
mail=fred@dev.netwin.co.nz
sn=Jensen
hmmm... maybe we need to set the search base ...
so add the line to ldapauth.ini,
ldap_search_base dc=netwin,dc=co,dc=nz
and try again ...
[root@dev dmail]# ./ldapauth
lookup fred@dev.netwin.co.nz
+OK fred@dev.netwin.co.nz config 0
quit
Bingo!
(now using Windows NT client ...) try adding a user ...
C:\dmail>ldapauth
set tam@dev.netwin.co.nz tam
+OK User (mail=tam@dev.netwin.co.nz) added to database
lookup tam@dev.netwin.co.nz
+OK tam@dev.netwin.co.nz config 0 fwd=""
quit
and check what we have added on linux box (dev) with ldapsearch,
NB: if you set is not working so easily then see further down where I turn schema checking on and have more troubles.
[root@dev dmail]# ldapsearch -b 'dc=netwin,dc=co,dc=nz' '(objectclass=*)'
dc=netwin,dc=co,dc=nz
objectclass=dcObject
objectclass=organization
o=netwin
dc=netwin.co.nz
cn=Manager,dc=netwin,dc=co,dc=nz
objectclass=organizationalRole
cn=Manager
cn=bob,dc=netwin,dc=co,dc=nz
objectclass=person
cn=bob
sn=Jensen
cn=fred,dc=netwin,dc=co,dc=nz
objectclass=person
cn=fred
mail=fred@dev.netwin.co.nz
sn=Jensen
cn=tam, dc=netwin,dc=co,dc=nz
mail=tam@dev.netwin.co.nz
objectclass=person
userpassword=tam
NB: the users get added to objectclass=person by default.
now add a user and set some other fields,
set jane@dev.netwin.co.nz jane sn="smith"
+OK User (mail=jane@dev.netwin.co.nz) added to database
gives search result ...
cn=jane, dc=netwin,dc=co,dc=nz
mail=jane@dev.netwin.co.nz
objectclass=person
userpassword=jane
sn=smith
Found this which I think kind of defines the schema,
vi /usr/local/etc/openldap/slapd.oc.conf
which has amongst other things...
objectclass person
requires
objectClass,
sn,
cn
allows
description,
seeAlso,
telephoneNumber,
userPassword
objectclass umichPerson
requires
objectClass,
sn,
cn,
universityID
allows
affiliationCode,
audio,
businessCategory,
classStanding,
description,
destinationIndicator,
doNotDelete,
doNotMove,
drink,
expire,
facsimileTelephoneNumber,
homePhone,
homePostalAddress,
internationaliSDNNumber,
janetMailbox,
jpegPhoto,
keepNames,
krbName,
l,
labeledURL,
mail,
mailPreferenceOption,
memberOfGroup,
mobile,
multiLineDescription,
noBatchUpdates,
notRegistered,
notice,
onVacation,
organizationalStatus,
otherMailbox,
ou,
pager,
personalSignature,
personalTitle,
photo,
physicalDeliveryOfficeName,
postOfficeBox,
postalAddress,
postalCode,
preferredDeliveryMethod,
proxy,
registeredAddress,
registrationStatus,
roomNumber,
secretary,
seeAlso,
st,
streetAddress,
telephoneNumber,
teletexTerminalIdentifier,
telexNumber,
textEncodedORaddress,
title,
uid,
updateSource,
userCertificate,
userClass,
userPassword,
vacationMessage,
x121Address,
xacl
So we could set ObjectClass to,
umichPerson
but then I think that we would have to set the universityID attribute when adding
users. Let's try ...
- stopped slapd process (kill pid)
- edited slapd.conf so,
schemacheck off
and then restarted to see if can still add user ...
C:\dmail>ldapauth
lookup bob@dev.netwin.co.nz
-ERR bob@dev.netwin.co.nz ld_check: no matching entries
lookup fred@dev.netwin.co.nz
+OK fred@dev.netwin.co.nz config 0 fwd=""
search *
-ERR No matching entries
set tam2@dev.netwin.co.nz tam
-ERR ld_set: Cant modify entry for cn=tam2, dc=netwin,dc=co,dc=nz: Object class
violation
as I expected I can't. So now,
1. set to use umichPerson objectclass in ldapauth.ini file, and
2. also set the, universityID attribute,
C:\dmail>ldapauth -log -debug
set tam2@dev.netwin.co.nz tam universityID="22" sn="smith"
-ERR ld_set: Cant modify entry for cn=tam2, dc=netwin,dc=co,dc=nz: Object class violation
NB: found that my ini file had,
ldapobjectclass umichPerson
when it should be,
ldap_objectclass umichPerson
(with an underscore). So I changed that, but still no luck.
Let's try adding with an ldiff file and work out what is needed...
[root@dev oldap]# vi schemaoff1.ldif
dn: cn=tam10,dc=netwin,dc=co,dc=nz
objectclass: person
cn: fred
mail: fred@dev.netwin.co.nz sn: Jensen
[root@dev oldap]# ldapadd -v -D "cn=Manager,dc=netwin,dc=co,dc=nz" -W -f schemaoff1.ldif
Enter LDAP Password:
add objectclass:
person
add cn:
fred
add mail:
fred@dev.netwin.co.nz
add sn:
Jensen
adding new entry cn=tam10,dc=netwin,dc=co,dc=nz ldap_add: Object class violation
So try a umichPerson... (have to add universityID as it is a required attribute),
root@dev oldap]# ldapadd -v -D "cn=Manager,dc=netwin,dc=co,dc=nz" -W -f schemaoff2.ldif
Enter LDAP Password:
add objectclass:
umichPerson
add cn:
fred
add mail:
fred@dev.netwin.co.nz
add universityID:
fred
add sn:
Jensen
adding new entry cn=tam10,dc=netwin,dc=co,dc=nz modify complete
a search shows,
cn=tam10,dc=netwin,dc=co,dc=nz
objectclass=umichPerson
cn=fred
mail=fred@dev.netwin.co.nz
universityid=fred
sn=Jensen
so my dn: line just seems to become the first line on the response. Now try with ldapauth ...using these settings ...
ldap_host 10.0.0.24
ldap_mgr_pw secret
ldap_mgr_dn cn=Manager,dc=netwin,dc=co,dc=nz
ldap_search_base dc=netwin,dc=co,dc=nz
#ldapobjectclass umichPerson
#ldapobjectclass ubob
#ldap_objectclass newPilotPerson
ldap_objectclass umichPerson
C:\dmail>ldapauth
set tam11@dev.netwin.co.nz secret sn="smith" universityID="tam11_smith"
-ERR ld_set: Cant modify entry for cn=tam11,dc=netwin,dc=co,dc=nz: Object class violation
log shows (in my new better logging version)...
26 16:25:20 Debug: In search before set, filter = ((mail=tam11@dev.netwin.co.nz)) and search_base = (dc=netwin,dc=co,dc=nz)
26 16:25:20 Debug: Set will add dn = (cn=tam11,dc=netwin,dc=co,dc=nz)
26 16:25:20 Debug: Set will enter user value (tam11@dev.netwin.co.nz) into (mail) attribute
26 16:25:20 Debug: Set will use objectclass (umichPerson)
26 16:25:20 Debug: Setting (sn) = (smith)
26 16:25:20 Debug: Setting (universityID) = (tam11_smith)
26 16:25:20 Debug: cmd finished, reason=ld_set: Cant modify entry for cn=tam11,dc=netwin,dc=co,dc=nz: Object class violation
See that there is not cn value being set (although it is part of the dn), so let's set that specifically,
set tam11@dev.netwin.co.nz secret cn="tam11" sn="smith" universityID="tam11_smith"
+OK User (mail=tam11@dev.netwin.co.nz) added to database
Hooray, we can add a user when schema checking is on :-)
cn=tam3,dc=netwin,dc=co,dc=nz
as the suffix setting in my slapd.conf file reads,
suffix dc=netwin,dc=co,dc=nz
i.e. that is the domain that my DB looks after is netwin.co.nz so when adding a user the cn has to include that domain information.
The slapcat program is used to dump the database to an LDIF file. This can be useful when you want to make a human-readable backup of your database or when you want to edit your database off-line. The program is invoked like this:
slapcat -l
-f
[-d] [-n |-b ]
where -n or -b is used to select the database in the slapd.conf(5) specified using -f. The corresponding LDIF output is written to standard output or to the file specified using the -l option"
See the section above,
and also...
Directory Server and the Secure Hash Algorithm (SHA):
http://developer.netscape.com:80/docs/technote/ldap/pass_sha.html
U-M LDAP Man Page Gateway:
http://www.umich.edu/cgi-bin/ldapman
Netscape Directory SDK for C: Source Code Documentation:
http://www.mozilla.org/directory/sourcedocs.html
Netscape Directory SDK: Source Code Release:
http://www.mozilla.org/directory/
Netscape's LDAP Client/SDK Documentation (probably most complete and easiest to read) -
http://developer.netscape.com/docs/manuals/dirsdk/csdk30/contents.htm
Netscape's LDAP, Directory Server Documentation,
http://developer.netscape.com/docs/manuals/
Products | Downloads | Prices | Support | Company |
---|---|---|---|---|
![]() |
![]() |
![]() |
![]() |
![]() |
|