Documentation for a newer release is available. View Latest

디렉토리 서버

OpenLDAP

LDAP (Lightweight Directory Access Protocol) is a set of open protocols used to access centrally stored information over a network. It is based on the X.500 standard for directory sharing, but is less complex and resource-intensive. For this reason, LDAP is sometimes referred to as "X.500 Lite".

Like X.500, LDAP organizes information in a hierarchical manner using directories. These directories can store a variety of information such as names, addresses, or phone numbers, and can even be used in a manner similar to the Network Information Service (NIS), enabling anyone to access their account from any machine on the LDAP enabled network.

LDAP is commonly used for centrally managed users and groups, user authentication, or system configuration. It can also serve as a virtual phone directory, allowing users to easily access contact information for other users. Additionally, it can refer a user to other LDAP servers throughout the world, and thus provide an ad-hoc global repository of information. However, it is most frequently used within individual organizations such as universities, government departments, and private companies.

This section covers the installation and configuration of OpenLDAP 2.4, an open source implementation of the LDAPv2 and LDAPv3 protocols.

LDAP 안내

Using a client-server architecture, LDAP provides a reliable means to create a central information directory accessible from the network. When a client attempts to modify information within this directory, the server verifies the user has permission to make the change, and then adds or updates the entry as requested. To ensure the communication is secure, the Transport Layer Security (TLS) cryptographic protocol can be used to prevent an attacker from intercepting the transmission.

모질라 NSS 사용

The OpenLDAP suite in Fedora 31 no longer uses OpenSSL. Instead, it uses the Mozilla implementation of Network Security Services (NSS). OpenLDAP continues to work with existing certificates, keys, and other TLS configuration. For more information on how to configure it to use Mozilla certificate and key database, see How do I use TLS/SSL with Mozilla NSS.

The LDAP server supports several database systems, which gives administrators the flexibility to choose the best suited solution for the type of information they are planning to serve. Because of a well-defined client Application Programming Interface (API), the number of applications able to communicate with an LDAP server is numerous, and increasing in both quantity and quality.

LDAP 전문용어

다음은 이 장안에서 사용되어지는 LDAP-관련 용어 목록입니다:

항목: LDAP 디렉토리 내에서 단일 단위. 각 항목은 독특한 _고유 이름 _ (* DN *)으로 식별됩니다.
] 속성: Information directly associated with an entry. For example, if an organization is represented as an LDAP entry, attributes associated with this organization might include an address, a fax number, etc. Similarly, people can be represented as entries with common attributes such as personal telephone number or email address.

An attribute can either have a single value, or an unordered space-separated list of values. While certain attributes are optional, others are required. Required attributes are specified using the objectClass definition, and can be found in schema files located in the /etc/openldap/slapd.d/cn=config/cn=schema/ directory.
The assertion of an attribute and its corresponding value is also referred to as a Relative Distinguished Name (RDN). Unlike distinguished names that are unique globally, a relative distinguished name is only unique per entry.
LDIF: The LDAP Data Interchange Format (LDIF) is a plain text representation of an LDAP entry. It takes the following form:

id dn: 고유_이름
attribute_type: 속성_값…
attribute_type: 속성_값…
…

+
  The optional _id_ is a number determined by the application that is used
  to edit the entry. Each entry can contain as many _attribute_type_ and
  _attribute_value_ pairs as needed, as long as they are all defined in a
  corresponding schema file. A blank line indicates the end of an entry.

OpenLDAP 특징

OpenLDAP 제품군은 다음 중요한 특징의 수를 제공합니다:

LDAPv3 Support — Many of the changes in the protocol since LDAP version 2 are designed to make LDAP more secure. Among other improvements, this includes the support for Simple Authentication and Security Layer (SASL), Transport Layer Security (TLS), and Secure Sockets Layer (SSL) protocols.
LDAP Over IPC — The use of inter-process communication (IPC) enhances security by eliminating the need to communicate over a network.
IPv6 Support — OpenLDAP is compliant with Internet Protocol version 6 (IPv6), the next generation of the Internet Protocol.
LDIFv1 Support — OpenLDAP is fully compliant with LDIF version 1.
Updated C API — The current C API improves the way programmers can connect to and use LDAP directory servers.
Enhanced Standalone LDAP Server — This includes an updated access control system, thread pooling, better tools, and much more.

OpenLDAP 서버 설정

Fedora에서 LDAP 서버를 설정하려는 전형적인 단계는 다음과 같습니다:

OpenLDAP 제품군을 설치합니다. 필요한 꾸러미에서 더 많은 정보를 위해 OpenLDAP 제품군 설치하기을 참고하세요.
OpenLDAP 서버 구성하기에서 설명된 것 같은 구성을 사용자 정의합니다.
OpenLDAP 서버에서 동작하기에서 설명된 slapd 서비스를 시작합니다.
ldapadd 유틸리티를 사용하고 항목을 LDAP 디렉토리로 추가합니다.
slapd 서비스는 정보를 올바르게 접근하는 것을 확인하려는 ldapsearch 유틸리티를 사용합니다.

OpenLDAP 제품군 설치

OpenLDAP 라이브러리의 제품군과 도구는 다음 꾸러미에 의해 제공됩니다:

Table 1. OpenLDAP 꾸러미 목록
Package	Description
openldap	A package containing the libraries necessary to run the OpenLDAP server and client applications.
openldap-clients	A package containing the command line utilities for viewing and modifying directories on an LDAP server.
openldap-servers	A package containing both the services and utilities to configure and run an LDAP server. This includes the Standalone LDAP Daemon, `slapd`.
openldap-servers-sql	A package containing the SQL support module.

추가적으로, 다음 꾸러미는 LDAP 서버와 함께 공통으로 사용됩니다:

Table 2. 일반적으로 설치된 추가 LDAP 꾸러미의 목록
Package	Description
nss-pam-ldapd	A package containing `nslcd`, a local LDAP name service that allows a user to perform local LDAP queries.
mod_ldap	A package containing the `mod_authnz_ldap` and `mod_ldap` modules. The `mod_authnz_ldap` module is the LDAP authorization module for the Apache HTTP Server. This module can authenticate users' credentials against an LDAP directory, and can enforce access control based on the user name, full DN, group membership, an arbitrary attribute, or a complete filter string. The `mod_ldap` module contained in the same package provides a configurable shared memory cache, to avoid repeated directory access across many HTTP requests, and also support for SSL/TLS.

이들 꾸러미를 설치하려면, 다음 형식에서 dnf 명령을 사용하세요:

dnf install package…

예제로, 기본적인 LDAP 서버 설치를 수행하려면, `root`으로 쉘 입력창에서 다음을 입력하세요:

~]# dnf install openldap openldap-clients openldap-servers

Note that you must have superuser privileges (that is, you must be logged in as root) to run this command. For more information on how to install new packages in Fedora, see Installing Packages.

OpenLDAP 서버 유틸리티의 개요

To perform administrative tasks, the openldap-servers package installs the following utilities along with the slapd service:

Table 3. OpenLDAP 서버 유틸리티의 목록
Command	Description
slapacl	Allows you to check the access to a list of attributes.
slapadd	Allows you to add entries from an LDIF file to an LDAP directory.
slapauth	Allows you to check a list of IDs for authentication and authorization permissions.
slapcat	Allows you to pull entries from an LDAP directory in the default format and save them in an LDIF file.
slapdn	Allows you to check a list of Distinguished Names (DNs) based on available schema syntax.
slapindex	Allows you to re-index the `slapd` directory based on the current content. Run this utility whenever you change indexing options in the configuration file.
slappasswd	Allows you to create an encrypted user password to be used with the ldapmodify utility, or in the `slapd` configuration file.
slapschema	Allows you to check the compliance of a database with the corresponding schema.
slaptest	Allows you to check the LDAP server configuration.

For a detailed description of these utilities and their usage, see the corresponding manual pages as referred to in Installed Documentation.

파일이 올바른 소유자인지 확인하세요

Although only root can run slapadd, the slapd service runs as the ldap user. Because of this, the directory server is unable to modify any files created by slapadd. To correct this issue, after running the slapadd utility, type the following at a shell prompt:

chown -R ldap:ldap /var/lib/ldap

이들 유틸리티를 사용하기 전에 slapd를 멈춥니다

To preserve the data integrity, stop the slapd service before using slapadd, slapcat, or slapindex. You can do so by typing the following at a shell prompt as root:

~]# systemctl stop slapd.service

For more information on how to start, stop, restart, and check the current status of the slapd service, see Running an OpenLDAP Server.

OpenLDAP 클라이언트유틸리티의 개요

The openldap-clients package installs the following utilities which can be used to add, modify, and delete entries in an LDAP directory:

Table 4. OpenLDAP 클라이언트 유틸리티의 목록
Command	Description
ldapadd	Allows you to add entries to an LDAP directory, either from a file, or from standard input. It is a symbolic link to ldapmodify -a.
ldapcompare	Allows you to compare given attribute with an LDAP directory entry.
ldapdelete	Allows you to delete entries from an LDAP directory.
ldapexop	Allows you to perform extended LDAP operations.
ldapmodify	Allows you to modify entries in an LDAP directory, either from a file, or from standard input.
ldapmodrdn	Allows you to modify the RDN value of an LDAP directory entry.
ldappasswd	Allows you to set or change the password for an LDAP user.
ldapsearch	Allows you to search LDAP directory entries.
ldapurl	Allows you to compose or decompose LDAP URLs.
ldapwhoami	Allows you to perform a `whoami` operation on an LDAP server.

With the exception of ldapsearch, each of these utilities is more easily used by referencing a file containing the changes to be made rather than typing a command for each entry to be changed within an LDAP directory. The format of such a file is outlined in the man page for each utility.

일반 LDAP 클라이언트 응용프로그램의 개요

Although there are various graphical LDAP clients capable of creating and modifying directories on the server, none of them is included in Fedora. Popular applications that can access directories in a read-only mode include Mozilla Thunderbird, Evolution, or Ekiga.

OpenLDAP 서버 구성하기

By default, the OpenLDAP configuration is stored in the /etc/openldap/ directory. The following table highlights the most important directories and files within this directory:

Table 5. OpenLDAP 구성 파일과 디렉토리의 목록
Path	Description
`/etc/openldap/ldap.conf`	The configuration file for client applications that use the OpenLDAP libraries. This includes ldapadd, ldapsearch, Evolution, etc.
`/etc/openldap/slapd.d/`	The directory containing the `slapd` configuration.

Note that OpenLDAP no longer reads its configuration from the /etc/openldap/slapd.conf file. Instead, it uses a configuration database located in the /etc/openldap/slapd.d/ directory. If you have an existing slapd.conf file from a previous installation, you can convert it to the new format by running the following command as root:

~]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/

The slapd configuration consists of LDIF entries organized in a hierarchical directory structure, and the recommended way to edit these entries is to use the server utilities described in Overview of OpenLDAP Server Utilities.

직접 LDIF 파일을 편집하지 않습니다

An error in an LDIF file can render the slapd service unable to start. Because of this, it is strongly advised that you avoid editing the LDIF files within the /etc/openldap/slapd.d/ directly.

전역 구성 변경하기

Global configuration options for the LDAP server are stored in the /etc/openldap/slapd.d/cn=config.ldif file. The following directives are commonly used:

olcAllows: The olcAllows directive allows you to specify which features to enable. It takes the following form:

olcAllows: feature…

It accepts a space-separated list of features as described in Available olcAllows options. The default option is bind_v2.

Table 6. 사용 가능한 olcAllows 선택
Option	Description
`bind_v2`	Enables the acceptance of LDAP version 2 bind requests.
`bind_anon_cred`	Enables an anonymous bind when the Distinguished Name (DN) is empty.
`bind_anon_dn`	Enables an anonymous bind when the Distinguished Name (DN) is not empty.
`update_anon`	Enables processing of anonymous update operations.
`proxy_authz_anon`	Enables processing of anonymous proxy authorization control.

Example 1. olcAllows 지시문 사용하기

olcAllows: bind_v2 update_anon

olcConnMaxPending: The olcConnMaxPending directive allows you to specify the maximum number of pending requests for an anonymous session. It takes the following form:

olcConnMaxPending: 번호

기본 선택은 [option]`100`입니다.

Example 2. olcConnMaxPending 지시문 사용하기

olcConnMaxPending: 100

olcConnMaxPendingAuth: The olcConnMaxPendingAuth directive allows you to specify the maximum number of pending requests for an authenticated session. It takes the following form:

olcConnMaxPendingAuth: 번호

기본 선택은 [option]`1000`입니다.

Example 3. olcConnMaxPendingAuth 지시문 사용하기

olcConnMaxPendingAuth: 1000

olcDisallows: The olcDisallows directive allows you to specify which features to disable. It takes the following form:

olcDisallows: feature…

It accepts a space-separated list of features as described in Available olcDisallows options. No features are disabled by default.

Table 7. 사용 가능한 olcDisallows 선택
Option	Description
`bind_anon`	Disables the acceptance of anonymous bind requests.
`bind_simple`	Disables the simple bind authentication mechanism.
`tls_2_anon`	Disables the enforcing of an anonymous session when the STARTTLS command is received.
`tls_authc`	Disallows the STARTTLS command when authenticated.

Example 4. olcAllows 지시문 사용

olcDisallows: bind_anon

olcIdleTimeout: The olcIdleTimeout directive allows you to specify how many seconds to wait before closing an idle connection. It takes the following form:

olcIdleTimeout: 번호

This option is disabled by default (that is, set to 0).

Example 5. Using the olcIdleTimeout directive

olcIdle 시간초과: 180

olcLogFile: The olcLogFile directive allows you to specify a file in which to write log messages. It takes the following form:

olcLogFile: file_name

The log messages are written to standard error by default.

Example 6. olcLogFile 지시문 사용하기

olcLogFile: /var/log/slapd.log

olcReferral: The olcReferral option allows you to specify a URL of a server to process the request in case the server is not able to handle it. It takes the following form:

olcReferral: URL

This option is disabled by default.

Example 7. Using the olcReferral directive

olcReferral: ldap://root.openldap.org

olcWriteTimeout: The olcWriteTimeout option allows you to specify how many seconds to wait before closing a connection with an outstanding write request. It takes the following form:

olcWriteTimeout

This option is disabled by default (that is, set to 0).

Example 8. olcWriteTimeout 지시문 사용하기

olcWriteTimeout: 180

데이타베이스-상세 구성 변경하기

By default, the OpenLDAP server uses Berkeley DB (BDB) as a database back end. The configuration for this database is stored in the /etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif file. The following directives are commonly used in a database-specific configuration:

olcReadOnly: The olcReadOnly directive allows you to use the database in a read-only mode. It takes the following form:

olcReadOnly: boolean

It accepts either TRUE (enable the read-only mode), or FALSE (enable modifications of the database). The default option is FALSE.

Example 9. Using the olcReadOnly directive

olcReadOnly: TRUE

olcRootDN: The olcRootDN directive allows you to specify the user that is unrestricted by access controls or administrative limit parameters set for operations on the LDAP directory. It takes the following form:

olcRootDN: distinguished_name

It accepts a Distinguished Name (DN). The default option is cn=Manager,dn=my-domain,dc=com.

Example 10. olcRootDN 지시문 사용하기

olcRootDN: cn=root,dn=example,dn=com

olcRootPW: The olcRootPW directive allows you to set a password for the user that is specified using the olcRootDN directive. It takes the following form:

olcRootPW: password

It accepts either a plain text string, or a hash. To generate a hash, type the following at a shell prompt:

~]$ slappaswd
신규 비밀번호:
신규 비밀번호를 재입력:
{SSHA}WczWsyPEnMchFf1GRTweq2q7XJcvmSxD

Example 11. olcRootPW 지시문 사용하기

olcRootPW: {SSHA}WczWsyPEnMchFf1GRTweq2q7XJcvmSxD

olcSuffix: The olcSuffix directive allows you to specify the domain for which to provide information. It takes the following form:

olcSuffix: domain_name

It accepts a fully qualified domain name (FQDN). The default option is dc=my-domain,dc=com.

Example 12. olcSuffix 지시문 사용하기

olcSuffix: dc=example,dc=com

스키마 확장

Since OpenLDAP 2.3, the /etc/openldap/slapd.d/ directory also contains LDAP definitions that were previously located in /etc/openldap/schema/. It is possible to extend the schema used by OpenLDAP to support additional attribute types and object classes using the default schema files as a guide. However, this task is beyond the scope of this chapter. For more information on this topic, see https://www.openldap.org/doc/admin/schema.html.

Establishing a Secure Connection

OpenLDAP clients and servers can be secured using the Transport Layer Security (TLS) framework. TLS is a cryptographic protocol designed to provide communication security over the network. As noted above, OpenLDAP suite in Fedora uses Mozilla NSS as the TLS implementation.

To establish a secure connection using TLS, obtain the required certificates as described in How do I use TLS/SSL with Mozilla NSS. Then, a number of options must be configured on both the client and the server. At a minimum, a server must be configured with the Certificate Authority (CA) certificates and also its own server certificate and private key. The clients must be configured with the name of the file containing all the trusted CA certificates.

Typically, a server only needs to sign a single CA certificate. A client may want to connect to a variety of secure servers, therefore it is common to specify a list of several trusted CAs in its configuration.

서버 구성

This section lists global configuration directives for slapd that need to be specified in the /etc/openldap/slapd.d/cn=config.ldif file on an OpenLDAP server in order to establish TLS.

While the old style configuration uses a single file, normally installed as /usr/local/etc/openldap/slapd.conf, the new style uses a slapd backend database to store the configuration. The configuration database normally resides in the /usr/local/etc/openldap/slapd.d/ directory.

The following directives are also valid for establishing SSL. In addition to TLS directives, you need to enable a port dedicated to SSL on the server side – typically it is port 636. To do so, edit the /etc/sysconfig/slapd file and append the ldaps:/// string to the list of URLs specified with the SLAPD_URLS directive.

olcTLSCACertificateFile: The olcTLSCACertificateFile directive specifies the file encoded with Privacy-Enhanced Mail (PEM) schema that contains trusted CA certificates. The directive takes the following form:

olcTLSCACertificateFile: 경로

Replace path either with a path to the CA certificate file, or, if you use Mozilla NSS, with a certificate name.

olcTLSCACertificatePath: The olcTLSCACertificatePath directive specifies the path to a directory containing individual CA certificates in separate files. This directory must be specially managed with the OpenSSL c_rehash utility that generates symbolic links with the hashed names that point to the actual certificate files. In general, it is simpler to use the olcTLSCACertificateFile directive instead.

If Mozilla NSS is used, olcTLSCACertificatePath accepts a path to the Mozilla NSS database (as shown in Using olcTLSCACertificatePath with Mozilla NSS). In such a case, c_rehash is not needed.
The directive takes the following form:

olcTLSCACertificatePath: 경로

Replace path with a path to the directory containing the CA certificate files, or with a path to a Mozilla NSS database file.

Example 13. Using olcTLSCACertificatePath with Mozilla NSS

With Mozilla NSS, the olcTLSCACertificatePath directive specifies the path of the directory containing the NSS certificate and key database files. For example:

olcTLSCACertificatePath: sql:/home/nssdb/sharednssdb

The certutil command is used to add a CA certificate to these NSS database files:

certutil -d sql:/home/nssdb/sharednssdb -A -n "CA_certificate" -t CT,, -a -i certificate.pem

The above command adds a CA certificate stored in a PEM-formatted file named certificate.pem. The -d option specifies the database directory containing the certificate and key database files, the -n option sets a name for the certificate, -t CT,, means that the certificate is trusted to be used in TLS clients and servers. The -A option adds an existing certificate to a certificate database, the -a option allows the use of ASCII format for input or output, and the -i option passes the certificate.pem input file to the command.

olcTLSCertificateFile: The olcTLSCertificateFile directive specifies the file that contains the slapd server certificate. The directive takes the following form:

olcTLSCertificateFile: 경로

Replace path with a path to the slapd server certificate file, or, if you use Mozilla NSS, with a certificate name.

Example 14. Using olcTLSCertificateFile with Mozilla NSS

When using Mozilla NSS with certificate and key database files specified with the olcTLSCACertificatePath directive, olcTLSCertificateFile is used to specify the name of the certificate to use. First, execute the following command to view a list of certificates available in your NSS database file:

certutil -d sql:/home/nssdb/sharednssdb -L

Select a certificate from the list and pass its name to olcTLSCertificateFile. For example:

olcTLSCertificateFile slapd_cert

olcTLSCertificateKeyFile: The olcTLSCertificateKeyFile directive specifies the file that contains the private key that matches the certificate stored in the file specified with olcTLSCertificateFile. Note that the current implementation does not support encrypted private keys, and therefore the containing file must be sufficiently protected. The directive takes the following form:

olcTLSCertificateKeyFile: 경로

Replace path with a path to the private key file if you use PEM certificates. When using Mozilla NSS, path stands for the name of a file that contains the password for the key for the certificate specified with the olcTLSCertificateFile directive (see Using olcTLSCertificateKeyFile with Mozilla NSS).

Example 15. Using olcTLSCertificateKeyFile with Mozilla NSS

When using Mozilla NSS, this directive specifies the name of a file that contains the password for the key for the certificate specified with olcTLSCertificateFile:

olcTLSCertificateKeyFile: slapd_cert_key

The modutil command can be used to turn off password protection or to change the password for NSS database files. For example:

modutil -dbdir sql:/home/nssdb/sharednssdb -changepw

클라이언트 구성

Specify the following directives in the /etc/openldap/ldap.conf configuration file on the client system. Most of these directives are parallel to the server configuration options. Directives in/etc/openldap/ldap.conf are configured on a system-wide basis, however, individual users may override them in their ~/.ldaprc files.

The same directives can be used to establish an SSL connection. The ldaps:// string must be used instead of ldap:// in OpenLDAP commands such as ldapsearch. This forces commands to use the default port for SSL, port 636, configured on the server.

TLS_CACERT: The TLS_CACERT directive specifies a file containing certificates for all of the Certificate Authorities the client will recognize. This is equivalent to the olcTLSCACertificateFile directive on a server. TLS_CACERT should always be specified before TLS_CACERTDIR in /etc/openldap/ldap.conf. The directive takes the following form:

TLS_CACERT path

Replace path with a path to the CA certificate file.

TLS_CACERTDIR: The TLS_CACERTDIR directive specifies the path to a directory that contains Certificate Authority certificates in separate files. As with olcTLSCACertificatePath on a server, the specified directory must be managed with the OpenSSL c_rehash utility. Path to Mozilla NSS database file is also accepted, c_rehash is not needed in such case. The directive takes the following form:

TLS_CACERTDIR directory

Replace directory with a path to the directory containing CA certificate files. With Mozilla NSS, directory stands for a path to the certificate or key database file.

TLS_CERT: The TLS_CERT specifies the file that contains a client certificate. This directive can only be specified in a user’s ~/.ldaprc file. With Mozilla NSS, this directive specifies the name of the certificate to be chosen from the database specified with the aforementioned TLS_CACERTDIR directive. The directive takes the following form:

TLS_CERT path

Replace path with a path to the client certificate file, or with a name of a certificate from the NSS database.

TLS_키: The TLS_KEY specifies the file that contains the private key that matches the certificate stored in the file specified with the TLS_CERT directive. As with olcTLSCertificateFile on a server, encrypted key files are not supported, so the file itself must be carefully protected. This option is only configurable in a user’s ~/.ldaprc file.

When using Mozilla NSS, TLS_KEY specifies the name of a file that contains the password for the private key that protects the certificate specified with the TLS_CERT directive. Similarly to the olcTLSCertificateKeyFile directive on a server (see Using olcTLSCertificateKeyFile with Mozilla NSS), you can use the modutil command to manage this password.
The TLS_KEY directive takes the following form:

TLS_키 path

Replace path with a path to the client certificate file or with a name of the password file in the NSS database.

Setting Up Replication

Replication is the process of copying updates from one LDAP server (provider) to one or more other servers or clients (consumers). A provider replicates directory updates to consumers, the received updates can be further propagated by the consumer to other servers, so a consumer can also act simultaneously as a provider. Also, a consumer does not have to be an LDAP server, it may be just an LDAP client. In OpenLDAP, you can use several replication modes, most notable are mirror and sync. For more information on OpenLDAP replication modes, see the OpenLDAP Software Administrator’s Guide installed with openldap-servers package (see Installed Documentation).

To enable a chosen replication mode, use one of the following directives in /etc/openldap/slapd.d/ on both provider and consumers.

olcMirrorMode: The olcMirrorMode directive enables the mirror replication mode. It takes the following form:

olcMirrorMode on

This option needs to be specified both on provider and consumers. Also a serverID must be specified along with syncrepl options. Find a detailed example in the 18.3.4. MirrorMode section of the OpenLDAP Software Administrator’s Guide (see Installed Documentation).

olcSyncrepl: The olcSyncrepl directive enables the sync replication mode. It takes the following form:

olcSyncrepl on

The sync replication mode requires a specific configuration on both the provider and the consumers. This configuration is thoroughly described in the 18.3.1. Syncrepl section of the OpenLDAP Software Administrator’s Guide (see Installed Documentation).

Loading Modules and Backends

You can enhance the slapd service with dynamically loaded modules. Support for these modules must be enabled with the --enable-modules option when configuring slapd. Modules are stored in files with the .la extension:

module_name.la\

Backends store or retrieve data in response to LDAP requests. Backends may be compiled statically into slapd, or when module support is enabled, they may be dynamically loaded. In the latter case, the following naming convention is applied:

back_backend_name.la

To load a module or a backend, use the following directive in /etc/openldap/slapd.d/:

olcModuleLoad: The olcModuleLoad directive specifies a dynamically loadable module to load. It takes the following form:

olcModuleLoad: module

Here, module stands either for a file containing the module, or a backend, that will be loaded.

SELinux Policy for Applications Using LDAP

SELinux is an implementation of a mandatory access control mechanism in the Linux kernel. By default, SELinux prevents applications from accessing an OpenLDAP server. To enable authentication through LDAP, which is required by several applications, the allow_ypbind SELinux Boolean needs to be enabled. Certain applications also demand an enabled authlogin_nsswitch_use_ldap Boolean in this scenario. Execute the following commands to enable the aforementioned Booleans:

~]# setsebool -P allow_ypbind=1

~]# setsebool -P authlogin_nsswitch_use_ldap=1

The -P option makes this setting persistent across system reboots. See the Red Hat Enterprise Linux 7 SELinux User’s and Administrator’s Guide for more detailed information about SELinux.

OpenLDAP 서버 실행하기

This section describes how to start, stop, restart, and check the current status of the Standalone LDAP Daemon. For more information on how to manage system services in general, see Services and Daemons.

서비스 시작하기

To start the slapd service in the current session, type the following at a shell prompt as root:

~]# systemctl start slapd.service

부트 시에 자동으로 시작하는 서비스를 구성하려면, `root`으로 다음 명령을 사용하세요:

~]# systemctl enable slapd.service

Fedora에서 서비스를 구성하는 방법에 대한 더 많은 정보를 위해 서비스 및 데몬을 참고하세요.

서비스 중지

To stop the running slapd service in the current session, type the following at a shell prompt as root:

~]# systemctl stop slapd.service

부팅 할 때에 자동으로 시작하는 서비스를 막으려면, `root`으로 다음을 입력하세요:

~]# systemctl disable slapd.service
rm '/etc/systemd/system/multi-user.target.wants/slapd.service'

Fedora에서 서비스를 구성하는 방법에 대한 더 많은 정보를 위해 서비스 및 데몬을 참고하세요.

서비스 재시작하기

To restart the running slapd service, type the following at a shell prompt as root:

~]# systemctl restart slapd.service

This stops the service and immediately starts it again. Use this command to reload the configuration.

서비스 상태 확인하기

slapd 서비스가 동작 중인지 확인하려면, 쉘 입력기에서 다음과 같이 입력하세요:

~]$ systemctl is-active slapd.service
active

Configuring a System to Authenticate Using OpenLDAP

In order to configure a system to authenticate using OpenLDAP, make sure that the appropriate packages are installed on both LDAP server and client machines. For information on how to set up the server, follow the instructions in Installing the OpenLDAP Suite and Configuring an OpenLDAP Server. On a client, type the following at a shell prompt as root:

~]# dnf install openldap openldap-clients nss-pam-ldapd

Migrating Old Authentication Information to LDAP Format

The migrationtools package provides a set of shell and Perl scripts to help you migrate authentication information into an LDAP format. To install this package, type the following at a shell prompt as root:

~]# dnf install migrationtools

This will install the scripts to the /usr/share/migrationtools/ directory. Once installed, edit the /usr/share/migrationtools/migrate_common.ph file and change the following lines to reflect the correct domain, for example:

# Default DNS domain
$DEFAULT_MAIL_DOMAIN = "example.com";

# Default base
$DEFAULT_BASE = "dc=example,dc=com";

Alternatively, you can specify the environment variables directly on the command line. For example, to run the migrate_all_online.sh script with the default base set to dc=example,dc=com, type:

~]# export DEFAULT_BASE="dc=example,dc=com" \
/usr/share/migrationtools/migrate_all_online.sh

To decide which script to run in order to migrate the user database, see Commonly used LDAP migration scripts.

Table 8. Commonly used LDAP migration scripts
Existing Name Service	Is LDAP Running?	Script to Use
`/etc` flat files	yes	`migrate_all_online.sh`
`/etc` flat files	no	`migrate_all_offline.sh`
NetInfo	yes	`migrate_all_netinfo_online.sh`
NetInfo	no	`migrate_all_netinfo_offline.sh`
NIS (YP)	yes	`migrate_all_nis_online.sh`
NIS (YP)	no	`migrate_all_nis_offline.sh`

For more information on how to use these scripts, see the README and the migration-tools.txt files in the /usr/share/doc/migrationtools/ directory.

추가 자원

The following resources offer additional information on the Lightweight Directory Access Protocol. Before configuring LDAP on your system, it is highly recommended that you review these resources, especially the OpenLDAP Software Administrator’s Guide.

설치된 문서

The following documentation is installed with the openldap-servers package:

/usr/share/doc/openldap-servers/guide.html — A copy of the OpenLDAP Software Administrator’s Guide.
/usr/share/doc/openldap-servers/README.schema — A README file containing the description of installed schema files.

Additionally, there is also a number of manual pages that are installed with the openldap, openldap-servers, and openldap-clients packages:

Client Applications

ldapadd(1) — The manual page for the ldapadd command describes how to add entries to an LDAP directory.
ldapdelete(1) — The manual page for the ldapdelete command describes how to delete entries within an LDAP directory.
ldapmodify(1) — The manual page for the ldapmodify command describes how to modify entries within an LDAP directory.
ldapsearch(1) — The manual page for the ldapsearch command describes how to search for entries within an LDAP directory.
ldappasswd(1) — The manual page for the ldappasswd command describes how to set or change the password of an LDAP user.
ldapcompare(1) — Describes how to use the ldapcompare tool.
ldapwhoami(1) — Describes how to use the ldapwhoami tool.
ldapmodrdn(1) — Describes how to modify the RDNs of entries.

서버 응용프로그램

slapd(8C) — Describes command line options for the LDAP server.

Administrative Applications

slapadd(8C) — Describes command line options used to add entries to a slapd database.
slapcat(8C) — Describes command line options used to generate an LDIF file from a slapd database.
slapindex(8C) — Describes command line options used to regenerate an index based upon the contents of a slapd database.
slappasswd(8C) — Describes command line options used to generate user passwords for LDAP directories.

구성 파일

ldap.conf(5) — The manual page for the ldap.conf file describes the format and options available within the configuration file for LDAP clients.
slapd-config(5) — Describes the format and options available within the /etc/openldap/slapd.d configuration directory.

온라인 문서

https://www.openldap.org/doc/admin24/: The current version of the OpenLDAP Software Administrator’s Guide.
https://www.kingsmountain.com/ldapRoadmap.shtml: Jeff Hodges' LDAP Roadmap & FAQ containing links to several useful resources and emerging news concerning the LDAP protocol.
http://www.ldapman.org/articles/: A collection of articles that offer a good introduction to LDAP, including methods to design a directory tree and customizing directory structures.
https://www.padl.com/: A website of developers of several useful LDAP tools.

OpenLDAP by Example by John Terpstra and Benjamin Coles; Prentice Hall.: A collection of practical exercises in the OpenLDAP deployment.
Implementing LDAP by Mark Wilcox; Wrox Press, Inc.: A book covering LDAP from both the system administrator’s and software developer’s perspective.
Understanding and Deploying LDAP Directory Services by Tim Howes et al.; Macmillan Technical Publishing.: A book covering LDAP design principles, as well as its deployment in a production environment.

Want to help? Learn how to contribute to Fedora Docs ›