LDAPAuth External Authentication Module

The LDAPAuth module is for use with Netwin's DMail and DNews products and an LDAP server. Several of Netwin's products allow the use of a separately compiled authentication module which obey a simple command protocol (see External Authentication). Netwin provides several such authentication modules and you can also build your own. LDAPAUTH is one of the modules Netwin provides and enables you to authenticate against an LDAP server rather than standard NT or UNIX password files.

Contents:

  1. Use with DMail
  2. Use with DNews
  3. LDAPAuth Command Set
  4. LDAPAuth INI File settings
  5. Installation instructions for use with DMail on NT
  6. Installation instructions for use with DMail on UNIX
  7. Building for other platforms
  8. Downloading a recommended LDAP server
  9. Step by Step Example of installing OpenLDAP on a Linux box.
  10. Useful LDAP links

1. Use with DMail

Directory severs contain information about objects. One sort of object is a person and the various bits of information stored in the directory server about that object are called attributes.

The attributes stored will vary from one LDAP server to another. The key one for use with LDAPAuth is the 'mail' attribute which has the form 'user' or 'user@domain' this is what ldapauth refers to as the username (see the ldap_search_name below to change mail to another attribute). The distinguished name or dn is generally of no interest to ldapauth. The @domain part of the username is optional and will default to a setting in the ini file.

To make DMail use ldapauth you need to edit the dmail.conf configuration file, typically,
c:\winnt\system32\dmail.conf
or
/etc/dmail.conf
and edit the following to settings to read,
authent_method External
authent_process c:\dmail\ldapauth.exe
and then RESTART both DSMTP and DPOP.

More detail is given in,
Installation instructions for use with DMail on NT
Installation instructions for use with DMail on UNIX

For more details on running an external authentication module like ldapauth see,
External Authentication.

2. Use with DNews

Same as with dmail, except that the entry in dnews.conf should be:
auth_spawn d:\dnews\ldapauth.exe
instead of the dmail settings
authent_method External
authent_process c:\dmail\ldapauth.exe

See http://netwinsite.com/dnews/access.htm#pass_ldap for the few dnews specific instructions but in general follow the dmail installation instructions.

3. LDAPAUTH Command Set:

The ldapauth  module receives commands on stdin and sends replies on stdout. The command set is given below:

NB: Ldapauth does not take any command line arguments.

NB: LDAPAuth's command set is defined by the Netwin External Authentication Protocol.

Command Function
lookup username Retrieve drop file location and other information about an already authenticated user
check username password Check the a username and password against LDAP directory
search username Search for matching users
set username password option=" value" Create a new user entry in the LDAP directory
quit close down ldapauth
exit close down ldapauth
verbose Toggle verbose mode. Verbose mode is useful for testing when running ldapauth at the command prompt. It outputs additional information in response to each command
version Print the version number

Replies consist of:

+OK message

-ERR message

+DATA message

Details of the response and additional options within each command are given in the following sections:


3.1 Check Command

Check the a username and password against LDAP directory. The username may be either user@domain or just user. The LDAP directory will be searched for entries with the attribute mail = user@domain. If the supplied username has no @domain section then this will be taken from the ini file setting pop_domain. Once a matching entry is found then ldapauth will try and bind to that entry using the supplied password. The fromip parameter is currently ignored by this module, it is used in other modules to specify different virtual domains. If the bind operation is successful the +OK is returned if not -ERR is returned.

If the bind was successful then the LDAP entry is also checked for drop file, uid and forward attributes. If these are found then they are also returned. If no drop path attribute is found the word config is returned in its place. If no uid attribute is found 0 is returned. Forward addresses, if found, are returned at the end of the +OK line. The attributes to be used for drop_file, uid and forward are specified by the ini settings ldap_drop_file, ldap_mail_uid and ldap_dmail_forward. The default values for these are: drop_file, mail_uid and mailForwardingAddress.

Input:

check username@domain password fromip
check username password fromip

Returns:

+OK username path uid forward
-ERR reason



3.2 Exit Command

Shuts down the ldapauth module.


3.3 Help Command

List the available commands using the format
+DATA information
+DATA information
+OK


3.4 Lookup Command

Retrieves drop file location uid and forward information about an already authenticated user. The format etc. is similar to that used in the check command but no password is required. This is used for example by DPOP when it needs to check the location of a drop file without first authenticating a user.


Input:

lookup user@domain fromip
lookup user fromip

Returns:

+OK username path uid forward
-ERR reason


3.5 Search Command

Search for matching users. The supplied username may be of the form user@domain or just user. The LDAP directory will be searched for entries with the attribute mail matching user*@domain. If the supplied username has no @domain section then this will be taken from the ini file setting pop_domain. To check for users from any domain use: search user@* One line is returned for each matching entry with a +OK or -ERR line at the end.

Input:

search user
search r
search *smith
search Ralph@*

Returns:

+DATA dn=(cn=Test0, o=netwin), mail=test0@161.29.2.44
+DATA dn=(cn=Test1, o=netwin), mail=test1@161.29.2.44, path=/spool/mail
+OK Search Complete

-ERR No matching entries


3.6 Set Command

This command has several uses depending on the format used. It can:

set newuser password add a new user and password to the LDAP server
set olduser newpassword change the password of an existing user
set olduser (NULL) age="45" add new attributes for an existing user
set olduser (NULL) age="46" modify the values of attributes for an existing user

When it is adding a new user it will use the ini setting ldap_objectclass setting to specify what the object to be added is. The default is a person. They will have a dn: newuser as well as an attribute mail: newuser@domain where @domain was either part of the specified username or taken from the ini setting pop_domain.

When adding new attributes they are specified in the form name="value" the quotation characters are required and multiple attribute name="values" can be specified separated by spaces.

NB: You MUST ensure that any attributes that you supply to the set command exist in your objectclass, otherwise you will get an error like,
-ERR ld_set: Cant modify entry for cn=fred: Object class violation

If the password is not to be changed or rewritten to the LDAP directory then the password is specified as the string (NULL)

The modify attribute value has the same format as the add new attribute. Note that the new value replaces any existing values.

Input:

set username password|(NULL) [var="value" ...]
set user password
set user (null) age="45" sex="male"

Response:

+OK Database modified for user (mail=ralph@161.29.2.44)
-ERR ld_set: Cant modify entry for cn=Ralph, o=netwin: Protocol error


3.7 Quit Command


Shutdown ldapauth module. Identical to exit command.


3.8 Verbose Command


Toggles the verbose mode. In verbose mode it is assumed the module is being run at a command prompt and additional information can be printed. For example lookup and check will return the full information of all attributes for the selected entry.

 


4. Ini Settings for LDAPAUTH

Netwin supplies several external authentication modules:

These are all supplied with source so they can easily be tailored to your particular use. The LDAPAUTH module allows you to use an LDAP server to authenticate against in addition to storing such things as the location of the users drop file in the LDAP database. It makes use of an ini file which must be called ldapauth.ini an must be stored with the ldapauth executable. The settings which can be used within the ini file are given below:

Setting Description
info_fields Use setting to inform ldapauth of pairs of database field names. It takes a list of up to 20 comma separated pairs of field names, where each pair is two words separated by a space. In each pair the first name is the name that ldapauth should display as the field name and the second name is that of the field in your database. So the pair 'usergroups groups' would mean that ldapauth looks in your database for the field 'groups' and if a 'value' is found returns the field, usergroups="value". Similarly on a set if you enter, 'set bob usergroups="humour"' then ldapauth will set the field 'groups' with the value 'humour'.

Syntax: info_fields field_name1 db_name2[,field name2 db_name2,...]
Example: info_fields usergroups groups,ftpquota diskquota
Default: none
Required Setting: no

ldap_group_base (Version 1.1a, DMail 3.0) These four settings are used to pass the group membership through to dnews for access control. It is much better to use the info_fields when possible (it is much more efficient). ldap_group_base defines where in the ldap database group information is found.  See below this table for more info on using this.

Example: ldap_group_base dc=netwin,dc=co,dc=nz
Default: none
Required Setting: no

ldap_group_search A search that will find the ldap objects that contain usergroup information, it's best to make this as specific as possible.

Example: ldap_group_search cn=group*
Default: none
Required Setting: no

ldap_group_field Specify the field that contains the users email address in usergroup objects.

Example: ldap_group_field cn
Default: cn
Required Setting: no

ldap_group_attrib Specify the attribute in a usergroup object that contains the information about each user.

Example: ldap_group_attrib uniquemember
Default: uniquemember
Required Setting: no

ldap_port The TCPIP port to connect to the LDAP server on.

Example: ldap_port 3890
Default: 389
Required Setting: no

log_path The directory to store log files in

Example: log_path c:\logs
Default: the location of the ldapauth executable
Required Setting: no

max_log_size The size at which log files are rotated. Logs are numbered 1,2,3,4

Example: max_log_size 10000
Default: 100000
Required Setting: no

log_level Controls the amount of information logged during use. One of error, info, debug.

Example: log_level debug
Default: info
Required Setting: no

ldap_host The IP address or domain of the host to connect to, i.e. the machine where the LDAP server is listening.

Example: ldap_host apples.com
Default: localhost
Required Setting: no

ldap_mail_uid The LDAP attribute which will be used to store the uid DMail should use for accessing the users drop file. i.e. the DMail servers will create and check that a user's drop file is owned by this system uid. Typically the default of 0 for root is used. In general we do not recommend changing this setting.

Example: ldap_mail_uid mail (user files owned by 'mail' user)
Default: 0 (root as DMail runs as root)
Required Setting: no

ldap_mgr_dn The LDAP manager distinguished name to bind with. NB: add this field and the ldap_mgr_pw field with blank entries for anonymous login.

Example: ldap_mgr_dn cn=Dmail Manager
Default: cn=Directory Manager
Required Setting: yes

ldap_mgr_pw The password for the ldap_mgr_dn entry.NB: add this field and the ldap_mgr_dn field with blank entries for anonymous login.

Example: ldap_mgr_pw secret
Default: none
Required Setting: yes

ldap_search_base The LDAP search base to use for all interactions with the LDAP server

Example: ldap_search_base dc=apples,dc=com
    (or, ldap_search_base o=apples)
Default: none
Required Setting: yes

ldap_search_name IMPORTANT: Specifies the attribute used for identifying the user's entry in the database. e.g. when set to the default of mail, lookup bob, makes ldapauth lookup, mail=bob in database. (Prior to version 1.0k this was only used for lookups and not on the set command)

Example: ldap_search_name uid
Default: mail
Required Setting: no

pop_domain The domain which will be appended to any usernames not containing @domain

NB: if set then you must use the setting,
authent_domain true
in dmail.conf (and in netauth.ini if using NetAuth);

Example: pop_domain apples.com
Default: none
Required Setting: no, but recommended

ldap_drop_file Name of LDAP attribute which will be used for storing the full name and path of the users drop file. Normally this is not set and LDAPAuth returns the keyword 'config' to indicate that the DMail servers should use their internal settings to locate the user's drop file location.

Example: ldap_drop_file mail_drop_file
    (makes LDAPAuth get value from the DB field 'mail_drop_file');
Default: none - so default 'config' keyword is returned.
Required Setting: no and not recommended

ldap_objectclass When adding new users LDAPAuth will add the new user to this ObjectClass.

Notes:

  • When using the set command, you must specify attributes (fields) and values for any attributes 'required' by the object class that you specify with this setting. You may not specify any attributes that are 'not allowed' in the objectclass.

    You must enter something like,
    set username pass a="x" b="y" c="z"
    , where the fields a, b and c MUST be allowed in the specified objectclass, otherwise you will get an 'objectclass violation' error message. If you get that message then generally you need to alter the fields you are trying to set. Yes we wish there was a more informative error message also! Version 1.0k of LDAPAuth (and above) at least logs exactly which attributes and their values it is trying to set.

  • Often people forget to set cn="xxx" and 'violate the objectclass', so remember to place it on the end of the set command (or make NetAuth put it there if using NetAuth).
  • Some older versions of LDAPAuth have the incorrect setting name,
    ldapobjectclass
    as an example in the example ldapauth.ini file.

Example: ldap_objectclass umichPerson
    (umichPerson has the mail attribute that Person often does not);
Default: Person
Required Setting: no if using LDAPAuth for read-only, yes if using set command.

ldap_dmail_forward Name of LDAP attribute in database which will be used to store DMail forwarding addresses. It can be set blank. If a value for this attribute is found when doing a lookup or check command then LDAPAuth responds with the info field,
fwd="value"
e.g.,
fwd="bob@another_domain.com"
causing mail redirection to that address.

See the DMail Manual section,
Ext. Auth Fwd Field for further details.

Example: ldap_dmail_forward alias
Default: mailForwardingAddress
Required Setting: yes, because you probably don't want that bad default!

log_name Base of log file name. Note suffix n.log will be appended so default is ldapauth1.log

Example: log_name c:\mylogdir\
    (umichPerson has the mail attribute that Person often does not);
Default: ldapauth
Required Setting: no

sha_hash On set command only, take password given and use the SHA to hash it. NB: this setting is really obsoleted by SSHA, which is done by default. If you really want SHA then you need to set the two settings as per the example below.

Example (If you really do want SHA not SSHA or plaintext):
    sha_hash true
    ssha_hash_dont true
Default: false (ssha instead)
Required Setting: no

ssha_hash_dont Unless this setting is set to true, on the set command only, ldapauth will hash the given password using SSHA and prepend the string, {ssha} to the start of it before sending to the database. That way the database knows to SSHA the password sent by the ldapauth check command before comparing it with that user's password in the database. Starting with version 1.0L ldapauth will SSHA all passwords when setting (adding) a user in the database. This setting is for turning that behaviour off.

To make ldapauth add users with plain text passwords as it used to, use the setting as per the example below and check that the sha_hash setting is false or not in the ini file.

Example: #sha_hash true (commented out, for plain text passwords)
    ssha_hash_dont true
Default: false (ssha done automatically)
Required Setting: no

Notes on using ldap_group* settings with dnews.

Basically the idea is you tell ldapauth.ini where to find your usergroup objects, within a usergroup object should be a list of entries pointing to the users who belong to that user group here is an example of an object called "group_staff" which has two members, users test198 and test197

ldapsearch -L -b "dc=netwin,dc=co,dc=nz" "cn=*"

dn: cn=group_staff,dc=netwin,dc=co,dc=nz
cn: group_staff
objectclass: umichperson
uniquemember: cn=test198,dc=netwin,dc=co,dc=nz
uniquemember: cn=test197,dc=netwin,dc=co,dc=nz
Using these settings in ldapauth.ini
ldap_group_base dc=netwin,dc=co,dc=nz
ldap_group_search cn=group*
ldap_group_field cn
ldap_group_attrib uniquemember
Then a lookup will respond like this:
D:\dmail>ldapauth
lookup test197
+OK test197 config 0  groups="group_staff"
In dnews's access.conf you can then add a rule like this:
	*:read,post:,groups=group_staff::staff.*:add

To add/remove access to the staff newsgroups to users belonging to that ldap group. Always test ldapauth manually to check the response and name of the group before trying to add the entry to access.conf.


5. NT Installation with DMail:

You need to perform the following steps:


1. Download the distribution set
2. Unpack the distribution set
3. Copy ldapauth.exe and ldapauth.ini to a directory where DMail can use it.
4. Edit ldapauth.ini to meet your requirements.
5. Update dmail.conf to tell dmail to use ldapauth for authentication.
6. Restart DMail.
7. Test it.

These steps are described in detail below:

1.

NB Windows users: With versions 2.8h and above of DMail you will find the ldapauth files in your DMail distribution set (\dmtemp). They should have been copied into your DMail directory by the DMSetup utility, so you should check step 3 below and then jump to step 4.

Download the distribution set
For the latest versions see,
Utilities Download Page
General command line FTP instructions:
    ftp ftp.netwinsite.com
    (log in with username 'anonymous', use your email address as a password)
    cd pub/dmail
    hash
    binary
    get ldp10c.exe

2. Unpack the distribution set
    ldp10a

3. Copy files (ldapauth.exe etc.) in temporary unpack directory /ldtemp to a directory where DMail can use them.

NB: You MUST remember to copy the ldap dll

    cd \ldtemp
    copy * \dmail

You should find the following files,
    ldapauth (binary)
    nsldap32v11.dll (copy this to dmail directory or c:\winnt\system32\)
    ldapauth.ini (sample ini file for you to edit)
    ldap.htm (a copy of this page)
    authprot.htm (outlines our External Authentication Protocol)

4. Edit ldapauth.ini to meet your requirements.
    notepad \dmail\ldapauth.ini
    ! See other sections of this page for configuration information !
    Note ldapauth.ini will normally contain the manager password for your ldap server so it should be suitably protected but ldapauth must be able to read it. LDAPAuth is spawned by DPOP which is spawned by the DWatch service which is normally run as the 'system' account.

5. Update dmail.conf to tell dmail to use ldapauth for authentication.
    notepad \winnt\system32\dmail.conf
add/modify the following lines:
        authent_method External
        authent_process c:\dmail\ldapauth.exe

6. Restart DMail.
    Use dmadmin utility for this. Do a stop all and then a start all.
or see Restart information

7. Test it.
    Try a search or add user dmadmin or just connecting an email client with a username/password which exists on the ldap server. If these tests fail it may help to run the ldapauth.exe the command line then use commands; help and verbose etc. to see what the problem is.


6. UNIX Installation with DMail:

You need to perform the following steps

1. Download the distribution set
2. Unpack the distribution set
3. Copy ldapauth.exe and ldapauth.ini to a directory where DMail can use it.
4. Edit ldapauth.ini to meet your requirements.
5. Update dmail.conf to tell dmail to use ldapauth for authentication.
6. Restart DMail.
7. Test it.

These steps are described in detail below:

1.

NB Linux Libc6 users: With versions 2.8h and above of DMail you will find the ldapauth files in your DMail distribution set (/dmtemp). They should have been copied into your DMail directory by the DMSetup utility, so you should check step 3 below and then jump to step 4.

Download the distribution set
For the latest versions see,
Utilities Download Page
General command line FTP instructions:
    ftp ftp.netwinsite.com
    (log in with username 'anonymous', use your email address as a password)
    cd pub/dmail
    binary
    hash
    get ldp10c.exe

2. Unpack the distribution set by entering at the command prompt,
    ldp10c

3. Copy files in temporary unpack directory /ldtemp to a directory where DMail can use them, i.e. to the dsmtp_path.
    cd /ldtemp
    cp * /usr/local/dmail

You should find the following files,
    ldapauth (binary)
    ldapauth.ini (sample ini file for you to edit)
    ldap.htm (a copy of this page)
    authprot.htm (outlines our External Authentication Protocol)

4. Edit ldapauth.ini to meet your requirements.
    vi /usr/local/dmail/ldapauth.ini
   ! See other sections of this page for configuration information !
    Note ldapauth.ini will normally contain the manager password your ldap server so it should be suitably protected but ldapauth must be able to read it. NB: LDAPAuth will normally be able to read a protected file as it runs as root, when spawned by DPOP or DSMTP.


5. Update /etc/dmail.conf to tell dmail to use ldapauth for authentication.
    vi /etc/dmail.conf
add/modify the following lines:
        authent_method External
        authent_process /usr/local/dmail/ldapauth

6. Restart DMail.
    Use dmadmin utility for this or
    tellsmtp shutdown
    tellpop shutdown
    /usr/local/dmail/dm_start.sh
    /usr/local/dmail/dpop_start.sh

7. Test it.
    Try a search or add user dmadmin or just connecting an email client with a username/password which exists on the ldap server. If these tests fail it may help to run the ldapauth.exe the command line then use commands; help and verbose etc. to see what the problem is.


7. Building for other platforms:

It is now our policy to provide a binary form of ldapauth for as many platforms as possible. (For Linux and NT you will find ldapauth binaries in the DMail distribution set).So before building LDAPAuth for yourself, you should check that our utilities page does not have a pre compiled executable for you. And if it doesn't you can of course email us and we will try to build it for you.

We will still provide the source, downloadable our utilities page.

Below are instructions for compiling ldapauth yourself.

1. Download the ldapauth source our utilities page,
http://www.netwinsite.com/dmail/utils.htm#ldapauth
,or directly our ftp site, login as user 'anonymous',
ftp://ftp.netwinsite.com/pub/dmail/ldp10c_source.tar.Z
(or a similar file name)

2. After downloading the file you would do this:
    uncompress ldp10c_source.tar.Z
    tar -xvf lpd10c_source.tar
    cd buildxx (e.g. build28)
    cp config.PLATFORM config.i
(where PLATFORM is your platform, e.g. solaris)

3. If you don't have the sdk installed...

3.a) You can install the LDAP C libraries sdk :
http://www.openldap.org/
or (Netscape) http://www.mozilla.org/directory/

and then edit the SPECLIBS line of config.i so that you include the correct libraries for the SDK that you installed, e.g. libldap and liblber, e.g.,
SPECLIBS = -I../ldap/include -L../ldap/libraries -lldap -llber

OR

3.b) Our ldapauth source contains the openldap sdk, so do the following in the buildxx directory,

*** you may need to edit config.i at this point and uncomment SPECLIBS line ***

   uncompress ldapopen-src.tar.Z
   tar -xvf ldapopen-src.tar
   cd ldap
   ./configure
   make depend
   make

(that should make the libraries, see INSTALL for OPENLDAP instructions on installing SDK)

   cd .. (back up to buildxx directory)

4. Now LDAPAuth should build correctly:
    cd dpop
    make ldapauth

If not check that you are including the SDK include directory and providing the location of the two SDK libraries, libldap and liblber, which should be on the SPECLIBS line in the config.i you are using, e.g. something like,
    SPECLIBS = -I../ldap/include - L../ldap/libraries -lldap -llber

(ensure that the line in your config.i is not commented out with a pound or hash, #, symbol).

5. Then use the resulting ldapauth binary with dmail or dnews.

For DMail,
copy ldapauth to your dmail directory,
    cp ldapauth /usr/local/dmail

copy other files to dmail directory,
    cp ../misc/ldap* /usr/local/dmail
    cd /usr/local/dmail

edit ldapauth.ini (see the config settings on this page for details)
    vi ldapauth.ini

6.Test ldapauth at the command line,
    ./ldapauth
    lookup username
    +ok username ...
    quit


8. Downloading a recommended LDAP server

We recommend the OpenLdap server available ,
http://www.openldap.org/

We also test LDAPAuth against Netscape's LDAP server (a number of the defaults reflect this) and the University of Michigan server.

SDKs for LDAP are also available ,
http://www.openldap.org/
OR (Netscape) http://www.mozilla.org/directory/


9. Step by Step Example of installing OpenLDAP on a Linux box.

9A. Download and Compile OpenLDAP:

download openldap ,
http://www.openldap.org/software/download/
I chose,
1.2.11 (20000704)
and downloaded to,

/usr/local/openldap-stable-20000704.tgz

unpack with,

gzip -d tar -xvf openldap-stable-20000704.tgz
tar -xvf tar -xvf openldap-stable-20000704.tar
ln -s openldap-1.2.11 oldap
cd oldap

Now try to install referring to, http://www.openldap.org/doc/admin/, ... specifically, http://www.openldap.org/doc/admin/quickstart.html

./configure

(no problems there - very lucky indeed - in the past I have often had lots of problems and have had to use ./configure --help and work out a list of options to disable).

make depend
make (seemed to work - sometimes it looks as if it has but way back in all the guff you find something did not build)
make test (complained that there was nothing to do?!)
make install (seemed to work)

vi /usr/local/etc/openldap/slapd.conf

and changed to the following ...

database ldbm
#suffix "dc=my-domain, dc=com"
suffix "dc=netwin,dc=co,dc=nz"
#suffix "o=My Organization Name, c=US"
#rootdn "cn=Manager, dc=my-domain, dc=com"
rootdn "cn=Manager, dc=netwin, dc=co, dc=nz"
#rootdn "cn=Manager, o=My Organization Name, c=US"
# cleartext passwords, especially for the rootdn, should
# be avoid. See slapd.conf(5) for details.
rootpw secret

now started the server,

/usr/local/libexec/slapd

and check with,

[root@dev oldap]# ps ax |grep lap
9140 ? S 0:00 /usr/local/libexec/slapd
9141 ? S 0:00 /usr/local/libexec/slapd
9142 ? S 0:00 /usr/local/libexec/slapd
9187 p1 S 0:00 grep lap

It would seem that it is running - not really sure why there are 3 instances.

9B.Users, ldapadd and ldapsearch etc.

Tried,

[root@dev oldap]# ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
ldapsearch: invalid option -- x
usage: ...

so removed the x and got,

[root@dev oldap]# ldapsearch -b '' -s base '(objectclass=*)' namingContexts
ldap_search: No such object

Oh, well seemed to vaguely work.

Try adding a user,
had a look at,

man ldapadd

then saw quickstart has example,

[root@dev oldap]# vi ./example.ldif
dn: dc=netwin,dc=co,dc=nz
objectclass: dcObject
objectclass: organization
o: netwin
dc: netwin.co.nz
    
dn: cn=Manager,dc=netwin,dc=co,dc=nz
objectclass: organizationalRole
cn: Manager

Remember to trim leading and trailing white space including tabs at the start of lines!
Then,

[root@dev oldap]# ldapadd -x -D "cn=Manager,dc=netwin,dc=co,dc=nz" -W -f example.ldif
ldapadd: invalid option -- x
usage: ldapadd [-abcknrvWF] [-d debug-level] [-h ldaphost] [-p ldapport] [-D binddn] [-w passwd] [ -f file | < entryfile ]

wonder what -x was, lets change it to -v for verbose :-)

[root@dev oldap]# ldapadd -v -D "cn=Manager,dc=netwin,dc=co,dc=nz" -W -f example.ldif
Enter LDAP Password:
add objectclass:
     dcObject
     organization
add o:
     netwin
add dc:
     netwin.co.nz
adding new entry dc=netwin,dc=co,dc=nz
modify complete
    
add objectclass:
     organizationalRole
add cn:
     Manager
adding new entry cn=Manager,dc=netwin,dc=co,dc=nz
modify complete
    
[root@dev oldap]#

see if it works,

[Root@dev oldap]# ldapsearch -b 'dc=netwin,dc=co,dc=nz' '(objectclass=*)'

which gives result,


dc=netwin,dc=co,dc=nz
objectclass=dcObject
objectclass=organization
o=netwin
dc=netwin.co.nz
    
cn=Manager,dc=netwin,dc=co,dc=nz
objectclass=organizationalRole
cn=Manager

Success!

9C.Users - reading database with LDAPAuth e.g. lookup,check and search

Now try lookup command with ldapauth,

cd /usr/local/dmail
vi ldapauth.ini

# ldapauth ini file settings
# Lines starting with # are comments
ldap_host 127.0.0.1
log_level debug
ldap_mgr_pw secret
ldap_mgr_dn cn=Directory Manager
    
# Required settings
#pop_domain pop_host_domain
#ldap_host server.running.ldap
#ldap_mgr_pw secret
#ldap_mgr_dn cn=Directory Manager
#ldap_search_base dc=netwin,dc=co,dc=nz (see later where this line has to be added in for lookup to work)
    
# Optional settings: see ldapauth.htm
# ldap_port
# log_level
# log_name
# log_path
# max_log_size
# ldap_host
# ldap_mail_uid
# ldap_drop_file
# ldap_objectclass
# ldap_dmail_forward
    
"ldapauth.ini" 29 lines, 605 characters written

[root@dev dmail]# ./ldapauth
lookup bob
-ERR bob ld_check: Cant bind to ldap host as cn=Directory Manager: Invalid credentials quit

so changed the line in ./ldapauth.ini to,

ldap_mgr_dn cn=Manager,dc=netwin,dc=co,dc=nz

and then success (well the login succeeded because ldapauth got to the search stage but the lookup failed),

[root@dev dmail]# ./ldapauth
lookup bob
-ERR bob ld_check: ldap search failed for (mail=bob)
quit

So now add a test user,

fred

[root@dev oldap]# vi example3.ldif

dn: cn=fred,dc=netwin,dc=co,dc=nz
objectclass: person
cn: fred
mail: fred@dev.netwin.co.nz
sn: Jensen
~
~
"example3.ldif" 5 lines, 100 characters written

[root@dev oldap]# ldapadd -v -D "cn=Manager,dc=netwin,dc=co,dc=nz" -W -f example3.ldif
Enter LDAP Password:
add objectclass:
     person
add cn:
     fred
add mail:
     fred@dev.netwin.co.nz
add sn:
     Jensen
adding new entry cn=fred,dc=netwin,dc=co,dc=nz
modify complete

Try the lookup again ...

[root@dev oldap]# cd /usr/local/dmail
[root@dev dmail]# ./ldapauth
lookup fred@dev.netwin.co.nz
-ERR fred@dev.netwin.co.nz ld_check: ldap search failed for (mail=fred@dev.netwin.co.nz)
quit

So now try a search using the ldap command line tool ...

[root@dev dmail]# ldapsearch -b 'dc=netwin,dc=co,dc=nz' '(objectclass=*)'
dc=netwin,dc=co,dc=nz
objectclass=dcObject
objectclass=organization
o=netwin
dc=netwin.co.nz
    
cn=Manager,dc=netwin,dc=co,dc=nz
objectclass=organizationalRole
cn=Manager
    
cn=bob,dc=netwin,dc=co,dc=nz
objectclass=person
cn=bob
sn=Jensen
    
cn=fred,dc=netwin,dc=co,dc=nz
objectclass=person
cn=fred
mail=fred@dev.netwin.co.nz
sn=Jensen

hmmm... maybe we need to set the search base ...
so add the line to ldapauth.ini,

ldap_search_base dc=netwin,dc=co,dc=nz

and try again ...

[root@dev dmail]# ./ldapauth
lookup fred@dev.netwin.co.nz
+OK fred@dev.netwin.co.nz config 0
quit

Bingo!

9D.Users - setting in LDAP database using ldapauth on NT

(now using Windows NT client ...) try adding a user ...

C:\dmail>ldapauth
set tam@dev.netwin.co.nz tam
+OK User (mail=tam@dev.netwin.co.nz) added to database
lookup tam@dev.netwin.co.nz
+OK tam@dev.netwin.co.nz config 0 fwd=""
quit

and check what we have added on linux box (dev) with ldapsearch,

NB: if you set is not working so easily then see further down where I turn schema checking on and have more troubles.

[root@dev dmail]# ldapsearch -b 'dc=netwin,dc=co,dc=nz' '(objectclass=*)'

dc=netwin,dc=co,dc=nz
objectclass=dcObject
objectclass=organization
o=netwin
dc=netwin.co.nz
    
cn=Manager,dc=netwin,dc=co,dc=nz
objectclass=organizationalRole
cn=Manager
    
cn=bob,dc=netwin,dc=co,dc=nz
objectclass=person
cn=bob
sn=Jensen
    
cn=fred,dc=netwin,dc=co,dc=nz
objectclass=person
cn=fred
mail=fred@dev.netwin.co.nz
sn=Jensen
    
cn=tam, dc=netwin,dc=co,dc=nz
mail=tam@dev.netwin.co.nz
objectclass=person
userpassword=tam

NB: the users get added to objectclass=person by default.

now add a user and set some other fields,

set jane@dev.netwin.co.nz jane sn="smith"
+OK User (mail=jane@dev.netwin.co.nz) added to database

gives search result ...

cn=jane, dc=netwin,dc=co,dc=nz
mail=jane@dev.netwin.co.nz
objectclass=person
userpassword=jane
sn=smith

9E. LDAP Schema and ObjectClass - adding a user with Schema Checking turned on.

Found this which I think kind of defines the schema,

vi /usr/local/etc/openldap/slapd.oc.conf

which has amongst other things...

objectclass person
     requires
         objectClass,
         sn,
         cn
     allows
         description,
         seeAlso,
         telephoneNumber,
         userPassword
    
objectclass umichPerson
     requires
         objectClass,
         sn,
         cn,
         universityID
     allows
         affiliationCode,
         audio,
         businessCategory,
         classStanding,
         description,
         destinationIndicator,
         doNotDelete,
         doNotMove,
         drink,
         expire,
         facsimileTelephoneNumber,
         homePhone,
         homePostalAddress,
         internationaliSDNNumber,
         janetMailbox,
         jpegPhoto,
         keepNames,
         krbName,
         l,
         labeledURL,
         mail,
         mailPreferenceOption,
         memberOfGroup,
         mobile,
         multiLineDescription,
         noBatchUpdates,
         notRegistered,
         notice,
         onVacation,
         organizationalStatus,
         otherMailbox,
         ou,
         pager,
         personalSignature,
         personalTitle,
         photo,
         physicalDeliveryOfficeName,
         postOfficeBox,
         postalAddress,
         postalCode,
         preferredDeliveryMethod,
         proxy,
         registeredAddress,
         registrationStatus,
         roomNumber,
         secretary,
         seeAlso,
         st,
         streetAddress,
         telephoneNumber,
         teletexTerminalIdentifier,
         telexNumber,
         textEncodedORaddress,
         title,
         uid,
         updateSource,
         userCertificate,
         userClass,
         userPassword,
         vacationMessage,
         x121Address,
         xacl

So we could set ObjectClass to,

umichPerson

but then I think that we would have to set the universityID attribute when adding users. Let's try ...
- stopped slapd process (kill pid)
- edited slapd.conf so,

schemacheck off

and then restarted to see if can still add user ...

C:\dmail>ldapauth
lookup bob@dev.netwin.co.nz
-ERR bob@dev.netwin.co.nz ld_check: no matching entries
lookup fred@dev.netwin.co.nz
+OK fred@dev.netwin.co.nz config 0 fwd=""
search *
-ERR No matching entries
set tam2@dev.netwin.co.nz tam
-ERR ld_set: Cant modify entry for cn=tam2, dc=netwin,dc=co,dc=nz: Object class
violation

as I expected I can't. So now,
1. set to use umichPerson objectclass in ldapauth.ini file, and
2. also set the, universityID attribute,

C:\dmail>ldapauth -log -debug
set tam2@dev.netwin.co.nz tam universityID="22" sn="smith"
-ERR ld_set: Cant modify entry for cn=tam2, dc=netwin,dc=co,dc=nz: Object class violation

NB: found that my ini file had,

ldapobjectclass umichPerson

when it should be,

ldap_objectclass umichPerson

(with an underscore). So I changed that, but still no luck.

Let's try adding with an ldiff file and work out what is needed...

[root@dev oldap]# vi schemaoff1.ldif
    
dn: cn=tam10,dc=netwin,dc=co,dc=nz
objectclass: person
cn: fred
mail: fred@dev.netwin.co.nz sn: Jensen

[root@dev oldap]# ldapadd -v -D "cn=Manager,dc=netwin,dc=co,dc=nz" -W -f schemaoff1.ldif
Enter LDAP Password:
add objectclass:
     person
add cn:
     fred
add mail:
     fred@dev.netwin.co.nz
add sn:
     Jensen
adding new entry cn=tam10,dc=netwin,dc=co,dc=nz ldap_add: Object class violation

So try a umichPerson... (have to add universityID as it is a required attribute),

root@dev oldap]# ldapadd -v -D "cn=Manager,dc=netwin,dc=co,dc=nz" -W -f schemaoff2.ldif
Enter LDAP Password:
add objectclass:
     umichPerson
add cn:
     fred
add mail:
     fred@dev.netwin.co.nz
add universityID:
     fred
add sn:
     Jensen
adding new entry cn=tam10,dc=netwin,dc=co,dc=nz modify complete

a search shows,

cn=tam10,dc=netwin,dc=co,dc=nz
objectclass=umichPerson
cn=fred
mail=fred@dev.netwin.co.nz
universityid=fred
sn=Jensen

so my dn: line just seems to become the first line on the response. Now try with ldapauth ...using these settings ...

ldap_host 10.0.0.24
ldap_mgr_pw secret
ldap_mgr_dn cn=Manager,dc=netwin,dc=co,dc=nz
ldap_search_base dc=netwin,dc=co,dc=nz
#ldapobjectclass umichPerson
#ldapobjectclass ubob
#ldap_objectclass newPilotPerson
ldap_objectclass umichPerson

C:\dmail>ldapauth
set tam11@dev.netwin.co.nz secret sn="smith" universityID="tam11_smith"
-ERR ld_set: Cant modify entry for cn=tam11,dc=netwin,dc=co,dc=nz: Object class violation

log shows (in my new better logging version)...

26 16:25:20 Debug: In search before set, filter = ((mail=tam11@dev.netwin.co.nz)) and search_base = (dc=netwin,dc=co,dc=nz)
26 16:25:20 Debug: Set will add dn = (cn=tam11,dc=netwin,dc=co,dc=nz)
26 16:25:20 Debug: Set will enter user value (tam11@dev.netwin.co.nz) into (mail) attribute
26 16:25:20 Debug: Set will use objectclass (umichPerson)
26 16:25:20 Debug: Setting (sn) = (smith)
26 16:25:20 Debug: Setting (universityID) = (tam11_smith)
26 16:25:20 Debug: cmd finished, reason=ld_set: Cant modify entry for cn=tam11,dc=netwin,dc=co,dc=nz: Object class violation

See that there is not cn value being set (although it is part of the dn), so let's set that specifically,

set tam11@dev.netwin.co.nz secret cn="tam11" sn="smith" universityID="tam11_smith"
+OK User (mail=tam11@dev.netwin.co.nz) added to database

Hooray, we can add a user when schema checking is on :-)

9F. Notes:


Useful LDAP links

See the section above,
    
Downloading a recommended LDAP server

and also...

Directory Server and the Secure Hash Algorithm (SHA):
    http://developer.netscape.com:80/docs/technote/ldap/pass_sha.html

U-M LDAP Man Page Gateway:
    http://www.umich.edu/cgi-bin/ldapman

Netscape Directory SDK for C: Source Code Documentation:
    http://www.mozilla.org/directory/sourcedocs.html

Netscape Directory SDK: Source Code Release:
    http://www.mozilla.org/directory/

Netscape's LDAP Client/SDK Documentation (probably most complete and easiest to read) -
    http://developer.netscape.com/docs/manuals/dirsdk/csdk30/contents.htm

Netscape's LDAP, Directory Server Documentation,
    http://developer.netscape.com/docs/manuals/


Products Downloads Prices Support Company