Süsteemihaldus 2018/19 kevad

Installing LDAP client

The Lightweight Directory Access Protocol (LDAP; /ˈɛldæp/) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.[1] Directory services play an important role in developing intranet and Internet applications by allowing the sharing of information about users, systems, networks, services, and applications throughout the network.[2] As examples, directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate email directory. Similarly, a telephone directory is a list of subscribers with an address and a phone number. https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol

 BASE dc=est
 URI  ldap://ldap.est/
 TLS_CACERT /etc/ssl/certs/ldapCA.pem

... all previous queries should print the list of distinguished names (DN) defined in our directory, the first one is our directory tree root (dc=est):

dn: dc=est
dn: cn=ldapadm,dc=est
dn: ou=People,dc=est
dn: ou=Group,dc=est
...

The directory tree has 2 organizational units (OU): groups and people. You can modify ldap query to fetch only specific information by providing attribute filters (using attribute=value), additionally you can only query for a specific attributes by appending attribute names. Examples:

 $ ldapsearch -LLL -x ou=*

 $ ldapsearch -LLL -x ou=* ou

 $ ldapsearch -LLL -x -b 'ou=Group,dc=est' dn 

So far we did access the directory using no authentication, therefore LDAP restricted our queries to read-only. Also the secured account attributes like password hashes were hidden. Next let's try to authenticate and perform LDAP queries. In order to authenticate, we need to provide LDAP client the attribute to use to bind to when authenticating (-D option'), additionally we should force LDAP client to ask for password input (-W option). Otherwise password has to be provided from STDIN or through -w argument in plain text or through -y argument (password file). Examples:

 $ ldapsearch -LLL -x cn=<study-number> dn

 $ ldapsearch -LLL -x uid=<study-number>

 $ ldapsearch -LLL -ZZ -WD 'uid=<study-number>,ou=People,dc=est' uid=<study-number>

Please notice that in previous example tester asked LDAP to for TLS channel (-ZZ) when authenticating into LDAP. We advise all the authenticated access to LDAP to be done over secure channels like TLS.

In case you can authenticate and see your account data, you can actually change it, as the LDAP provides the read-write access to authenticated clients. Be aware you can only modify the attributes of your bound DN (-D option), since these are the bounds of your authorization. Examples:

 # Changing the password
 ldappasswd -ZZ -WASD 'uid=<study-number>,ou=People,dc=est'

Here (-ZZ) enforces TLS channel, (-D) specifies the DN to bind to for authentication, (-W) forces password prompt for authentication, (-A) double-checks the old password, (-S) double-checks the new password.

To make it easier, here is the .ldif file your user was made with:

dn: uid={uid},ou=People,dc=est
objectClass: top
objectClass: account
objectClass: extensibleObject
objectClass: posixAccount
objectClass: shadowAccount
cn: {uid}
uid: {uid}
uidNumber: {uidnum}
gidNumber: {uidnum}
homeDirectory: /home/{uid}
loginShell: /bin/bash
description: {gecos}
userPassword: {SSHA}CSCjtJuZc6qYoRZxyMOEzfuw6dW3hiYL
shadowLastChange: 17058
mail: unset
host: unset
shadowMin: 0
shadowMax: 99999
shadowWarning: 7

Configuring Apache to authenticate against the LDAP

There routine is quiet similar to the one of Apache .httpasswd file and Unix PAM back-ends of the HTTP authentication. Naturally we should declare a <Location ...> or <Directory ...> to limit the access to. This time we are not going to create an additional virtual host or specific document-root for LDAP auth. Instead we are going to use the LDAP status module (more info here as our <Location ...> target.

<Location "/ldap-status">
    SetHandler ldap-status

    AuthType Basic
    AuthName "LDAP Protected"
    AuthBasicProvider ldap
    AuthLDAPURL ldap://ldap.est/ou=People,dc=est?uid?one TLS
    Require valid-user

</Location>

LDAPTrustedGlobalCert CA_BASE64 /etc/ssl/certs/ldapCA.pem
LDAPTrustedGlobalCert CA_DER /etc/ssl/certs/ldapCA.der