close Warning: Can't synchronize with repository "(default)" (/common/SVN/wimax does not appear to be a Subversion repository.). Look in the Trac log for more information.

Changes between Version 10 and Version 11 of dSite/e0LDAP


Ignore:
Timestamp:
Oct 3, 2014, 6:02:04 PM (6 years ago)
Author:
ssugrim
Comment:

Legend:

Unmodified
Added
Removed
Modified
  • dSite/e0LDAP

    v10 v11  
    11== Configure LDAP ==
    2 
    3 These instructions assume that the FQDN is console.geni.net and that (based on FQDN) LDAP DN base is '''dc=geni,dc=net'''.
    42
    53[[TOC(WiMAX/dSite*)]]
    64 
     5The following steps will configure the LDAP server.
    76=== Setting up LDAP server ===
    8 1. Create file '''/etc/ssl/geni-site-ca.info''' with:
    9 {{{
     7 1. Create file ''/etc/ssl/geni-site-ca.info'' with:
     8    {{{
    109cn = GENI WiMAX Company
    1110ca
    1211cert_signing_key
    13 }}}
    14 1. Create file '''/etc/ssl/geni-site-console.info''' with (please change console.geni.net to match your FQDN):
    15 {{{
     12    }}}
     13 1. Create file ''/etc/ssl/geni-site-console.info'' with (please change console.geni.net to match
     14    your FQDN):
     15    {{{
    1616organization = Example Company
    1717cn = console.geni.net
     
    2020signing_key
    2121expiration_days = 3650
    22 }}}
    23 1. Execute the following command to create SSL certificates:
    24 {{{
     22    }}}
     23 1. Execute the following command to create SSL certificates:
     24    {{{
    2525/usr/sbin/create_ldap_certificates.sh
    26 }}}
    27 1. Create LDIF file for our newly created certificates in the file named '''/etc/ssl/geni-cert-info.ldif''':
    28 {{{
     26    }}}
     27 1. Create LDIF file for our newly created certificates in the file named
     28    ''/etc/ssl/geni-cert-info.ldif'':
     29    {{{
    2930dn: cn=config
    3031add: olcTLSCACertificateFile
     
    3637add: olcTLSCertificateKeyFile
    3738olcTLSCertificateKeyFile: /etc/ssl/private/console_slapd_key.pem
    38 }}}
    39 and then execute:
    40 {{{
     39    }}}
     40    and then execute:
     41    {{{
    4142ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/geni-cert-info.ldif
    42 }}}
    43 The expected output is:
    44 {{{
     43    }}}
     44    The expected output is:
     45    {{{
    4546SASL/EXTERNAL authentication started
    4647SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
    4748SASL SSF: 0
    4849modifying entry "cn=config"
    49 }}}
    50 5. Fix the configuration for newly create LDAP for phpldapadmin by editing '''/etc/phpldapadmin/config.php''' and changing ''dc=example,dc=com'' to ''dc=geni,dc=net''
    51 {{{
    52 
     50    }}}
     51 5. Fix the configuration for newly create LDAP for phpldapadmin by editing
     52    ''/etc/phpldapadmin/config.php'' and changing ''dc=example,dc=com'' to ''dc=geni,dc=net''
     53    {{{
    5354$servers->setValue('server','base',array('dc=geni,dc=net'));
    5455$servers->setValue('login','bind_id','cn=admin,dc=geni,dc=net');
    55 }}}
    56 1. Point the Firefox web browser to http://<console-ip-address>/phpldapadmin. Set password for group admin user (add attribute -> Password -> set password -> update object)
    57 1. Make sure you can access the service with admin credentials:
    58 {{{
     56    }}}
     57 6. Point the Firefox web browser to http://<console-ip-address>/phpldapadmin. Set password for group admin user (add attribute -> Password -> set password -> update object)
     58 7. Make sure you can access the service with admin credentials:
     59    {{{
    5960   ldapsearch -x   -b "dc=geni,dc=net"  "objectClass=organizationalRole"
    6061   ldapsearch -x   -b "dc=geni,dc=net"  "objectClass=organizationalUnit"
     
    6263   ldapsearch -x   -b "dc=geni,dc=net"  "objectClass=posixGroup"
    6364   ldapsearch -x localhost -D "cn=admin,dc=geni,dc=net" -W -b "dc=geni,dc=net" uid=*
    64 }}}
     65    }}}
    6566
    6667=== Import initial LDAP content ===
    67 Import initial content consisting of first group and account that will be used as administrators for the range of services. The deployment assumes the following delegated accounting structure: users are organized into groups based on their organization or project (or in LDAP terms organizational units (OUs)). Each group can have number of administrators (or users with group management capabilities) but has to have one person who is the main administrator for the OU (the principal investigator - PI). While most of the account management is performed through Control Panel functions, the initial site administrator and the first OU need to be added to LDAP manually. That could be done through ''phpldapadmin'' or through LDIF configuration file and command line tools. LDIF config for initial import:
     68Next we will import initial content consisting of first groups and accounts that will be used as administrators for the range of services. The deployment assumes the following delegated accounting structure: users are organized into groups based on their organization or project (or in LDAP terms organizational units (OUs)). Each group can have number of administrators (or users with group management capabilities) but has to have one person who is the main administrator for the OU (the principal investigator - PI). While most of the account management is performed through Control Panel functions, the initial site administrator and the first OU need to be added to LDAP manually. This can be done through ''phpldapadmin'' or through LDIF configuration file and command line tools. The LDIF config for initial import looks like:
    6869{{{
    6970dn: ou=GENI,dc=geni,dc=net
     
    117118roleOccupant: uid=globaladmin,ou=GENI,dc=geni,dc=net
    118119}}}
    119 Typically one needs to replace:
     120Typically you will needs to replace:
    120121 1. Every occurrence of DN base in the file (i.e. do a global replace of '''dc=geni,dc=net''' with corresponding DN e.g. '''dc=rutgers,dc=edu''')
    121122 1. Initial group/organization name (i.e. do a global replace of '''GENI'' with the group name e.g. '''Rutgers''')
     
    123124 1. (optional) Initial administrator account user id (i.e. replace every occurrence of '''globaladmin''' with say '''ruadmin''')
    124125
    125 Also, any person that is a member of sysadmin group in LDAP and admin group in /etc/omf-aggmgr-5.4/ogs-aggmgr.yaml will be able to use Control Panel to manage ALL accounts.
     126Any person that is a member of sysadmin group in LDAP and admin group in /etc/omf-aggmgr-5.4/ogs-aggmgr.yaml will be able to use Control Panel to manage ALL accounts.
    126127
    127128In order to create initial LDAP structure:
    128  * Grab the initial configuration file that is attached to this page:
     129 * Download the protoype configuration file from this link (it can go anywhere, e.g. admin user's home directory):
    129130{{{
    130131  wget http://wimax.orbit-lab.org/raw-attachment/wiki/WiMAX/dSite/e0LDAP/GENIinit.ldif
    131132}}}
    132  * Modify it with your favorite editor
    133  * Import it into LDAP:
     133 * Modify it with your favorite text editor according to the rules described prior.
     134 * Finally import it into LDAP:
    134135{{{
    135136   ldapadd -vvv -x -D cn=admin,dc=geni,dc=net -H ldap:/// -W -f GENIinit.ldif