== Configure LDAP == We will asume that the FQDN based DN base is '''dc=geni,dc=net''' [[TOC(WiMAX/dSite*)]] === Setting up LDAP server === '''These need to be fixed - we are copying all the neccessary files and should not need anything here''' 2. Edit /etc/ldap.conf 1. Check that you have a proper URI (round line 30): {{{ uri ldap://console.geni.net/ }}} 2. Uncommend line for host attribute: {{{ pam_check_host_attr yes }}} 3. Add these two schemas to your ldap by copying to schema directory (/etc/ldap/slapd.d/cn=config/cn=schema) {{{ cd /etc/ldap/slapd.d/cn\=config/cn\=schema wget http://wimax.orbit-lab.org/mmm/cn={4}openssh-lpk-opnldap.ldif wget http://www.orbit-lab.org/mmm/cn={5}ldapns.ldif }}} 4. Import initial group and user {{{ cd /etc/ldap wget http://www.orbit-lab.org/mmm/cn={5}ldapns.ldif ldapadd -vvv -x -D cn=admin,dc=geni,dc=net -H ldap:/// -W -f init.ldif }}} 5. Fix the configuration for LDAP for phpldapadmin: {{{ edit /etc/phpldapadmin/config.php and change dc=example,dc=com to dc=geni,dc=net $servers->setValue('server','base',array('dc=geni,dc=net')); $servers->setValue('login','bind_id','cn=admin,dc=geni,dc=net'); }}} 6. Point the Firefox web browser to http:///phpldapadmin. Set password for group admin user (add attribute -> Password -> set password -> update object) 7. Make sure you can access the service with admin credentials: {{{ ldapsearch -x -b "dc=geni,dc=net" "objectClass=organizationalRole" ldapsearch -x -b "dc=geni,dc=net" "objectClass=organizationalUnit" ldapsearch -x -b "dc=geni,dc=net" "objectclass=organizationalUnit" ldapsearch -x -b "dc=geni,dc=net" "objectClass=posixGroup" ldapsearch -x localhost -D "cn=admin,dc=geni,dc=net" -W -b "dc=geni,dc=net" uid=* }}} === Configure the client === 1. Edit the /etc/ldap.conf file to configure the ldap client. {{{ base dc=geni,dc=net uri ldap://ldap.geni.net/ ldap_version 3 binddn rootbinddn cn=admin,dc=geni,dc=net pam_password md5 nss_initgroups_ignoreusers backup,bin,daemon,games,gnats,irc,libuuid,libvirt- qemu,list,lp,mail,man,messagebus,news,ntp,postfix,proxy,root,sshd,statd,sync,sys,syslog,usbmux,uucp,www-data }}} 2. The /etc/nsswitch.conf file should have the follow non comment lines: {{{ passwd: files ldap compat group: files ldap compat shadow: files compat hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis }}} 3. Copy or create the /etc/ldap.secret file. It should contain the ldap password in clear text. 4. Finally add the follow line to the /etc/sudoers file (note this is done with the visudo command). {{{ %admin ALL=(ALL) ALL %sysadmin ALL=NOPASSWD: ALL }}} This has to be done manually.