DefaultLDAPDITForUserGroupMgmt
Size: 2440
Comment:
|
← Revision 18 as of 2008-08-06 16:15:55 ⇥
Size: 4258
Comment: converted to 1.6 markup
|
Deletions are marked like this. | Additions are marked like this. |
Line 1: | Line 1: |
## page was renamed from EasyLDAPServerHardy | |
Line 5: | Line 6: |
* '''Launchpad Entry''': UbuntuSpec:identity-management | * '''Launchpad Entry''': UbuntuSpec:ldap-defaultdit-usergrp-mgmt |
Line 10: | Line 11: |
The spec describes a basic LDAP directory service for Ubuntu. | The spec describes a default LDAP DIT to manage Users and Groups using an Ubuntu Server. |
Line 16: | Line 17: |
Installing the default openldap package requires a lot of manual steps to get a complete directory infrastructure up and running. Setting up the directory structure requires knowledge about schemas and ldap trees. | Installing the default openldap package requires a lot of manual steps to get a complete directory infrastructure up and running. Setting up the directory structure requires knowledge about schemas and ldap trees. Let's provide a default DIT to handle the common use case of managing User and Groups with an LDAP infrastructure using Ubuntu Server as the LDAP server. |
Line 22: | Line 23: |
* Andrew installs an ldap server on ubuntu. After answering basic questions during the installation of the package, he can manage users and groups with the standard system utils (adduser, addgroup) and setup other clients in his network to authenticate against his new ldap directory. | * Andrew installs an ldap server on ubuntu. After answering basic questions during the installation of the package, he has a default LDAP infrastructure ready to manage Users and Groups. He can setup others systems in his network to authenticate against his new ldap directory. |
Line 26: | Line 27: |
User and Group management tools are not covered by this specification. |
|
Line 27: | Line 30: |
=== Installation === A new task in tasksel will be provided. It will install all the relevant packages (server and administration tools). Configuration and integration of the different services will also be provided by the task. Installation of the needed schema should be done with the new configuration api available in openldap 2.4. Editing the slapd configuration shouldn't be needed. === Directory server === |
|
Line 38: | Line 33: |
=== Schemas available by default === * Unix account information: * inetorgperson.schema * nis.schema |
|
Line 39: | Line 39: |
* dn: dc=example,dc=com * dn: cn=accounts * dn: cn=users * dn: cn=groups |
* dc=example,dc=com * ou=People * uid=username * ou=Groups * cn=groupname |
Line 44: | Line 45: |
=== User/group management tools === | === Windows networking support === |
Line 46: | Line 47: |
samba can use ldap as backend to store user and machine account information. It uses a samba.schema file available in the samba package. | |
Line 47: | Line 49: |
==== DIT Layout ==== The following changes are needed: * New container for Computer accounts: * dc=example, dc=com * ou=Computers * New sambaDomain object for domain information: * dc=example, dc=com * ou=Services * ou=WindowsDomains * sambaDomainName=ExampleDomain (sambaDomain objectClass) * Additional objectClasses for User accounts: * sambaSamAccount * Additional objectClasses for Groups: * sambaGroupMapping === Kerberos support === MIT can use ldap as a backend for their kdb. It uses a kerberos.schema file available in the MIT package. ==== DIT Layout ==== The following changes are needed: * New krbContainer container for all the realms in a tree: * dc=example, dc=com: * ou=Services * ou=KerberosRealms * New krbRealmContainer entries to hold realm specific data: * dc=example, dc=com: * ou=Services * ou=KerberosRealms * cn=ExampleRealm (krbRealmContainer objectClass) |
|
Line 50: | Line 84: |
=== Installation === The user will be prompted for the base dn, the administrator password. The task will then populate a default DIT in the ldap server. The administration tools will be configured to use the local ldap server by default. === Directory server === |
|
Line 57: | Line 86: |
Users will be defined with the following classes: * inetOrgPerson * posixAccount |
A new package, ubuntu-default-dit, will create the DIT structure outlined above. It will use the cn=config infrastructure to install additional schemas and then create a new db backend to hold the new tree. Editing the slapd configuration shouldn't be needed. |
Line 61: | Line 89: |
Groups will be defined with the following classes: * posixGroup === Migration === == Test/Demo Plan == |
The sambak5pwd overlay will be loaded by default to keep unix, samba and kerberos authentication information synchronised. However the overlay is designed to support Heimdal. Changes may need to be done to support MIT KDB. |
Line 72: | Line 93: |
* Should we try to provide optional support in the DIT for Windows Networking and Kerberos via different packages (eg ubuntu-samba-dit, ubuntu-kerberos-dit) ? * How should Samba Idmapping be handled ? == Resources == * [[http://www.freeipa.org|FreeIPA]]: * [[http://www.freeipa.com/page/UsingRhdsWithIpa#DIT_Requirements|DIT Requirements]] * [[http://mds.mandriva.org/|Mandriva Directory Server]] * [[http://wiki.mandriva.com/en/Projects/OpenLDAP_DIT|Mandriva Openldap DIT]] * [[http://images.apple.com/server/macosx/docs/Open_Directory_Admin_v10.5_2nd_Ed.pdf|Mac OS X Server 10.5 Open Directory ]] Details Apple's DIT, e.g. uid=username,cn=users |
Please check the status of this specification in Launchpad before editing it. If it is Approved, contact the Assignee or another knowledgeable person before making changes.
Launchpad Entry: ldap-defaultdit-usergrp-mgmt
Packages affected:
Summary
The spec describes a default LDAP DIT to manage Users and Groups using an Ubuntu Server.
Release Note
Rationale
Installing the default openldap package requires a lot of manual steps to get a complete directory infrastructure up and running. Setting up the directory structure requires knowledge about schemas and ldap trees. Let's provide a default DIT to handle the common use case of managing User and Groups with an LDAP infrastructure using Ubuntu Server as the LDAP server.
Use Cases
- Andrew installs an ldap server on ubuntu. After answering basic questions during the installation of the package, he has a default LDAP infrastructure ready to manage Users and Groups. He can setup others systems in his network to authenticate against his new ldap directory.
Assumptions
User and Group management tools are not covered by this specification.
Design
A default layout suitable for user and group management in a unix environment will be provided:
Schemas available by default
- Unix account information:
- inetorgperson.schema
- nis.schema
DIT layout
- dc=example,dc=com
- ou=People
- uid=username
- ou=Groups
- cn=groupname
- ou=People
Windows networking support
samba can use ldap as backend to store user and machine account information. It uses a samba.schema file available in the samba package.
DIT Layout
The following changes are needed:
- New container for Computer accounts:
- dc=example, dc=com
- ou=Computers
- dc=example, dc=com
- New sambaDomain object for domain information:
- dc=example, dc=com
- ou=Services
sambaDomainName=ExampleDomain (sambaDomain objectClass)
- ou=Services
- dc=example, dc=com
- Additional objectClasses for User accounts:
- sambaSamAccount
- Additional objectClasses for Groups:
- sambaGroupMapping
Kerberos support
MIT can use ldap as a backend for their kdb. It uses a kerberos.schema file available in the MIT package.
DIT Layout
The following changes are needed:
- New krbContainer container for all the realms in a tree:
- dc=example, dc=com:
- ou=Services
- dc=example, dc=com:
- New krbRealmContainer entries to hold realm specific data:
- dc=example, dc=com:
- ou=Services
cn=ExampleRealm (krbRealmContainer objectClass)
- ou=Services
- dc=example, dc=com:
Implementation
Openldap 2.4 will be used as the ldap server.
A new package, ubuntu-default-dit, will create the DIT structure outlined above. It will use the cn=config infrastructure to install additional schemas and then create a new db backend to hold the new tree. Editing the slapd configuration shouldn't be needed.
The sambak5pwd overlay will be loaded by default to keep unix, samba and kerberos authentication information synchronised. However the overlay is designed to support Heimdal. Changes may need to be done to support MIT KDB.
Outstanding Issues
- Should we try to provide optional support in the DIT for Windows Networking and Kerberos via different packages (eg ubuntu-samba-dit, ubuntu-kerberos-dit) ?
- How should Samba Idmapping be handled ?
Resources
Mac OS X Server 10.5 Open Directory
- Details Apple's DIT, e.g. uid=username,cn=users
BoF agenda and discussion
DefaultLDAPDITForUserGroupMgmt (last edited 2008-08-06 16:15:55 by localhost)