Ubuntu Wiki

Please check the status of this specification in Launchpad before editing it. If it is Approved, contact the Assignee or another knowledgeable person before making changes.

• Launchpad Entry: ldap-authentication-client

• Packages affected: libpam-ldap, libnss-ldap

Summary

Currently, in Ubuntu and Debian the packages libpam-ldap and libnss-ldap create separate configuration files and secret files. A ldap-auth-config package will be created that owns /etc/ldap.conf and /etc/ldap.secret. libpam-ldap and libnss-ldap will depend on ldap-auth-config. An ldap-auth-client meta package will be created that depends on libpam-ldap, libnss-ldap. The ldap-auth-client meta source package will contain the ldap-auth-config package. The ldap-auth-config package will own the config files, and the debconf scripts that were previously in libnss-ldap and libpam-ldap.

An auth-client-config package has been created to allow any package to configure nssswitch.conf and /etc/pam.d/*.

The main purpose of this spec is to fix the specified packages to bring them inline with the upstream authors intentions, and give Ubuntu a better base for LDAP authentication configuration ui's.

Release Note

ldap-auth-client enables simplified installation and configuration of LDAP client systems.

Rationale

It is currently difficult to configure an Ubuntu client to use LDAP for authentication. It is a good idea to put all necessary packages and configuration under one meta package, to allow easier installation and configuration. The libpam-ldap and libnss-ldap packages, diverge from the original authors intentions, and the implementations of other Linux distributions. Furthermore, the Debian packages use different naming schemes for each package. This puts Ubuntu at a competitive disadvantage and is unnecessarily complicated for our users.

Use Cases

A medium size business has existing Linux/UNIX infrastructure that uses LDAP for authentication, and wants to use Ubuntu as a desktop client, to replace Redhat. The Sys admin wants to provide simple instructions for jr admins to add clients to the network.

Bob wants to use LDAP for NSS on a SMTP server, but want to authenticate locally.

Alice configured openldap as a client in Dapper or Feisty, and wants to upgrade to Gutsy.

Assumptions

libpam-ldap and libnss-ldap, which are linked to openldap2.1, will at least be minimally useful when used with an openldap2.3 server, or other ldap implementation.

There are no packages not identified in the spec that rely on the current libpam-ldap or libnss-ldap configuration files.

Design

Implementation

libpam-ldap

Remove the following files from the package:

debian/patches/00chfn.patch : This patch modifies the location/name ldap.conf in the chfn script.

debian/patches/00chsh.patch : This patch modifies the location/name ldap.conf in the chsh script.

Modify debian/rules to prevent the following files from being created:

/etc/pam_ldap.conf

/etc/pam_ldap.secret

Modify debian/libpam-ldap.postinst to remove configuration information, which will be handled instead by ldap-auth-config.

Add ldap-auth-config dependancy to debian/control.

libnss-ldap

Remove the following files from the package:

debian/patches/00debian_conf.patch : This patch modifies the location/name ldap.conf.

Modify debian/rules to prevent the following files from being created:

/etc/libnss-ldap.conf

/etc/libnss-ldap.secret

Modify debian/libnss-ldap.postinst to remove configuration information, which will be handled instead by ldap-auth-config.

Add ldap-auth-config dependancy to debian/control.

ldap-auth-client

Create a ldap-auth-client meta package that depends on libnss-ldap and libpam-ldap.

ldap-auth-config

Create a package that will install and configure /etc/ldap.conf and /etc/ldap.secret

auth-client-config

nssswitch.conf and /etc/pam.d/* will be managed by a new package called auth-client-config. Templates will be provided for different usecases, and the files will be configured accordingly. This package has already been created, is in universe and is undergoing community review for inclusion in main.

Currently, there is no functionality to migrate users from files to LDAP. That must be done by hand with tools that are already packaged. (migrationtools)

Configuration

All configuration will be done in ldap-client-config's postinst.

If /etc/libnss-ldap.conf or /etc/pam_ldap.conf exist, preserve the exist files and notify user that he must manually migrate the files.

If /etc/libnss-ldap.conf and /etc/pam_ldap.conf !exist the postinst in ldap-auth-config will prompt for data and create /etc/ldap.conf

Test/Demo Plan

Outstanding Issues

BoF agenda and discussion

CategorySpec