OpenLDAPの最新動向 - 日本LDAPユーザ会 [日本 ...

1 2007/4/231 openldap LDAP 2007/4/23- 2 - LDAP Agenda openldap openldap Configuration Backend Password Policy Access Log Referential Integrity openldap 2007/4/23- 3 - LDAP openldap 1998 Umich LDAP LDAP LDAP LDAP LDAP LDAP LDAP LDAP LDAP v3 SASL SSL/TLS 2007/4/23- 4 - LDAP openldap Foundation Core Team 3 Engineering Team 13 LDAP IETF RFC 2007/4/23- 5 - LDAP openldap openldap Configuration Backend Password Policy Access log Referential Integrity2007/4/23- 6 - LDAP openldap openldap # tar zxvf # cd # ./configure --enable-overlays# make# make depend# make install2007/4/23- 7 - LDAP Configuration Backend openldap LDAP 2007/4/23- 8 - LDAP Configuration Backend LDIF DB database configrootdn cn=configrootpw secret# mkdir /usr/local/etc/ # slaptest f /usr/local/etc/ F /usr/local/etc/ 9 - LDAP Configuration Backend LDAP modify LDAP LDAP ldapmodify cn= : 100000 LDIF dn: cn=configchangetype: modifyadd: olcSizeLimitolcSizeLimit: 100000 LDIF2007/4/23- 10 - LDAP Password Policy 2007/4/23- 11 - LDAP Password Policy (1) LDAP dn: cn=Policy,dc=test,dc=comobjectClass.

2 DeviceobjectClass: pwdPolicycn: PolicypwdAttribute: userPasswordpwdMinLength: 6 # pwdInHistory: 3 # pwdMaxAge: 2592000 # pwdMinAge: 604800 # pwdLockout: TRUE # pwdMaxFailure: 3 # 2007/4/23- 12 - LDAP Password Policy (2) overlay ppolicy# ppolicy_default cn=Policy,dc=test,dc=comuid=user01cn=Pol icyuid=user02 pwdPolicySubentry: uid=user02,.. 2007/4/23- 13 - LDAP Password Policy LDAP -e ppolicy LDAP bind API C $ ldapsearch x D uid=user01,ou=People,dc=example,dc=com w xxx b e ppolicy2007/4/23- 14 - LDAP Access Log writes: add delete modify modrdn reads: compare search session.

3 Abandon bind unbind LDAP 2007/4/23- 15 - LDAP Access Log database bdbsuffix cn=logrootdn cn=Manager,cn=logrootpw secretdirectory /usr/local/var/ openldap -logindex reqStart eqoverlay accessloglogdb cn=log # DB suffixlogops wirtes # # logold (objectClass=Person) 2007/4/23- 16 - LDAP Access Log $ ldapsearch x b cn=log add modify reqMod reqOld LDAP reqresult DNreqDN DNreqAutzID add modify delete reqType reqFind reqStart2007/4/23- 17 - LDAP Access Log Access Log ldapadd ldapmodify ldapdelete 10000 600B Access Log % Access Log ldapdeleteldapmodifyldapaddAccess Log 2007/4/23- 18 - LDAP Referential Integrity (1) DN cn: UsersobjectClass: :uid=user01,ou=People,dc=.

4 Member:uid=user02,ou=People,dc=..uid=use r02 ou=Peopleuid=user012007/4/23- 19 - LDAP Referential Integrity (2)cn=UsersobjectClass: :uid=user01,ou=People,dc=..member:uid=us er02,ou=People,dc=..uid=user01cn=Usersob jectClass: :uid=user02,ou=People,dc=..uid=user02uid =user02uid=user01 ou=Peopleou=People2007/4/23- 20 - LDAP Referntial Integrity overlay refint# refint refint_attributes member owner seeAlso2007/4/23- 21 - LDAP openldap openldap LDAP LDAP LDAP Dynamic Directory Services(RFC2589) LDAP Don t use Copy Control