---

ldapdir.sgml

Go to the documentation of this file.

<!doctype linuxdoc system>
<article>
<title>LDAP Directories
<author>Setup directories
<p><url url="index.html" name="Index">
<p>
Descriptions of the dialogs used for directory operation.

<sect>Directory select dialog
<p>
Here you must select a database to work on. You may also create a new one.
</sect>

<sect>Directory config dialog
<p>
Here you must set the prefered configuration for the database. Some options must always be set, but many are not needed. Example on a minimal setup:

<itemize>
<item>Type: ldbm
<item>Base: dc=your,dc=domain
<item>Root: cn=manager,dc=your,dc=domain
<item>Pass: your secret
<item>Directory: /var/ldap/your.domain
</itemize>


More to come, for refererence for now you have to read the LDAP server/directory guide, which is located here:
<p>
<url url="http://www.umich.edu/~dirsvcs/ldap/doc/guides/slapd/5.html#RTFToC20" name="SLAPD and SLURPD Administrator's Guide - Configuration file">

</sect>

<sect>Directory import LDIF dialog
<p>
This will import a LDIF formatted file to a new database. It will work from the Communicator addressbook export function. Usage:
<p>
<itemize>
<item>First, select a name for your directory, like "contacts"
<item>Open the addressbook you will export in Communicator.
<item>From the filemenu, select Export, and select "ldif" format as filetype (in linux there is no choice).
<item>Name it contacts.db.conf.ldif and export it.
<item>Move it to the /tmp directory.
<item>Now start ldapconf, and goto the directory select menu.
<item>Select the Add button.
<item>In the input box, call it "contacts".
<item>Configure it:
<item>Type: ldbm
<item>Name: contacts.
<item>Base: dc=contacts.
<item>Root: cn=manager,dc=contacts.
<item>Pass: some secret.
<item>Directory: /var/ldap/contacts (This must be created manually!)
<item>Remember to enable the database! (with checkbox)
<item>Exit the dialog with the OK button.
<item>Select Import
<item>All filenames should be correct. The check buttons ON.
<item>Import.
<item>Restart the ldap server (from the controlpanel).
<item>To test it, set a client to use "dc=contacts" as base. 
<item>Hopefully you may search on names, emails or *.
</itemize>
</sect>

<sect>Directory export LDIF dialog
<p>
This is for backup, or export to other systems, or for regenerating (export and import for cleanup and new indexes).
<p>
When selected the ldbmcat command will be run and produce a ldif formated file.
<p>
Use numbers if the file will be imported into openldap again.
<p>
Read more in "man ldbmcat".

</sect>

<sect>Directory migrate dialog
<p>
This does not work now. Do not use.
</sect>

<sect>Userinfo (userconf co-manager)
<p>It is now possible to save extra userinformation in LDAP from the normal linuxconf userconf dialog.
<p>It is enabled by default, but you have to set up a directory and configure it first.
<p>The userconf directory is currently hardcoded to use the "userinfo" directory, form and bind profile.
<p>To configure it:
<itemize>
<item>Add the userinfo directory from the directory select dialog.
<item>Configure it as default. Remember to enable it!
<item>Init the directory with the "Create" command from the directory menu.
<item>Restart server.
<item>Now setup the "userinfo" form in the directory form config dialog. 
<item>And set up the correct binding from the bind profile confiurator.
<item>Now it works like this:
<item>When managing a local user in the usercong dialog, you have a extra tab called "LDAP".
<item>In this tab all the fields defined in the form editor will show up.
<item>Enter the information you want.
<item>When you accept the user settings, the extra information will be saved in the ldap directory.
<item>To test it, config a client for use agaist this directory, and search for a name (or *).
<item>Current limitations:
<item>No support for userpassword, users may not update their own info (yet).
<item>No support for existing users. LDAP will only be used for new users. This will be fixed.
<item>No access control. All info in this directory is available to read for anyone.
</itemize>   
</sect>

<sect>ACL settings
<p>
Some examples on common ACL (access control settings) for directories.
<p>
Currently ACL settings must be entered manually into the directory config files.
<p>
<itemize>
<item>Protecting user passwords.Should always be used if password is stored in LDAP (the default is read access to all!).
<verb>
access to attr="userpassword"
          by self write
          by * compare
</verb>
<item>Give the user access to update own data.
<verb>
access to * by self write
</verb>
<item>
</itemize>
</sect>

</article>

---