OpenLDAP Software 2.4 Administrator's Guide

1 OpenLDAP Software Administrator's GuideTable of ContentsTable of of this this Introduction to OpenLDAP Directory What is a directory service?.. What is LDAP?.. When should I use LDAP?.. When should I not use LDAP?.. How does LDAP work?.. What about What is the difference between LDAPv2 and LDAPv3?.. LDAP vs What is slapd and what can it do?..112. A Quick-Start The Big Picture - Configuration Local Directory Local Directory Service with Replicated Directory Distributed Local Directory Building and Installing OpenLDAP Obtaining and Extracting the Prerequisite Transport Layer Simple Authentication and Security Kerberos Authentication Database TCP Running Building the Testing the Installing the Configuring Configuration Configuration cn= cn= cn= Software Administrator's GuideiTable of Contents5. Configuring Backend-specific Database-specific BDB and HDB Database Configuration Converting old style (5) file to cn=config The slapd Configuration Configuration File Configuration File Global General Backend General Database BDB and HDB Database Configuration File Running Command-Line Starting Stopping Access Access Control via Static What to control access Who to grant access The access to Access Control Access Control Access Control via Dynamic What to control access Who to grant access The access to Access Control Access Control Access Control Access Control Common Basic Matching Anonymous and Authenticated Controlling rootdn Managing access with Granting access to a subset of Allowing a user write to all entries below Allowing entry Tips for using regular expressions in Access Granting and Denying access based on security strength factors (ssf)

2 When things aren't working as Sets - Granting rights based on Software Administrator's GuideiiTable of Contents8. Access Groups of Group ACLs without DN Following Soft and Hard Global Per-Database Specify who the limits apply Specify time Specifying size Size limits and Paged Example Limit Simple Global Global Hard and Soft Giving specific users larger Limiting who can do paged Further Database Creation and Maintenance Creating a database over Creating a database Theslapadd Theslapindex Theslapcat The LDIF text entry Berkeley DB back-bdb/back-hdb Further back-ldap Further back-ldif Further back-mdb Further Software Administrator's GuideiiiTable of Contents11. back-meta Further back-monitor Further back-null Further back-passwd Further back-perl/back-shell Further back-relay Further back-sql Further Access Access Logging Further Audit Audit Logging Further Chaining Handling Chaining Read-Back of Chained Further Constraint Further Dynamic Directory Software Administrator's GuideivTable of Contents12.

3 Dynamic Directory Service Further Dynamic Dynamic Group Dynamic Dynamic List Further Reverse Group Membership Member Of Further The Proxy Cache Proxy Cache Further Password Password Policy Further Referential Referential Integrity Further Return Return Code Further Rewrite/Remap Further Sync Sync Provider Further Translucent Translucent Proxy Further Attribute Attribute Uniqueness Further Value Software Administrator's GuidevTable of Contents12. Value Sorting Further Overlay Example Schema Distributed Schema Extending Object Naming Local schema Attribute Type Object Class OID Security Network Selective IP TCP Data Integrity and Confidentiality Security Strength Authentication "simple" SASL Password SSHA password storage CRYPT password storage MD5 password storage SMD5 password storage SHA password storage SASL password storage Pass-Through Configuring slapd to use an authentication Configuring Testing pass-through Using SASL Security SASL Mapping Authentication Software Administrator's GuideviTable of Contents15.

4 Using Direct Search-based SASL Proxy Uses of Proxy SASL Authorization Proxy Authorization Using TLS Server Client TLS Server Client Constructing a Distributed Directory Subordinate Knowledge Superior Knowledge The ManageDsaIT Replication LDAP Sync Deployment Delta-syncrepl N-Way Multi-Master MirrorMode Syncrepl Proxy Configuring the different replication N-Way Syncrepl Directory Berkeley DB Monitor configuration via cn=config(5).. Monitor configuration via (5).. Accessing Monitoring Monitor Software Administrator's GuideviiTable of Contents20. Performance Network Directory Layout Expected Understanding how a search What to Presence What log level to What to watch out Improving Berkeley DB slapd(8) Entry Cache (cachesize).. IDL Cache (idlcachesize).. slapd(8) User or Software errors?.

5 OpenLDAP 3rd party Software How to contact the OpenLDAP How to present your Debugging slapd(8).. Commercial Changes Since Previous New Guide New Features and Enhancements in Software Administrator's GuideviiiTable of ContentsA. Changes Since Previous Better cn=config Better cn=schema More sophisticated Syncrepl N-Way Multimaster Replicating slapd Configuration (syncrepl and cn=config).. Push-Mode More extensive TLS configuration Performance New New features in existing New features in New features in New clients, tools and tool New build Obsolete Features Removed From Upgrading from cn=config olc* ACLs: searches require privileges on the search Common errors encountered when using OpenLDAP Common causes of LDAP ldap_*: Can't contact LDAP ldap_*: No such ldap_*: Can't chase ldap_*: server is unwilling to ldap_*: Insufficient ldap_*: Invalid DN ldap_*: Referral hop limit ldap_*: operations ldap_*: other ldap_add/modify: Invalid ldap_add/modify: Object class ldap_add: No such ldap add: invalid structural object class ldap_add: no structuralObjectClass operational ldap_add/modify/rename: Naming ldap_add/delete/modify/rename: no global superior ldap_bind: Insufficient ldap_bind: Invalid ldap_bind: Protocol ldap_modify.

6 Cannot modify object ldap_sasl_interactive_bind_s: .. ldap_sasl_interactive_bind_s: No such ldap_sasl_interactive_bind_s: No such Software Administrator's GuideixTable of ContentsC. Common errors encountered when using OpenLDAP ldap_sasl_interactive_bind_s: Unknown authentication ldap_sasl_interactive_bind_s: Local error (82).. ldap_search: Partial results and referral ldap_start_tls: Operations Other ber_get_next on fd X failed errno=34 (Numerical result out of range).. ber_get_next on fd X failed errno=11 (Resource temporarily unavailable).. daemon: socket() failed errno=97 (Address family not supported).. GSSAPI: gss_acquire_cred: Miscellaneous failure; Permission denied;.. access from unknown ldap_read: want=# error=Resource temporarily `make test' ldap_*: Internal (implementation specific) error (80) - additional info: entry index delete ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1).

7 223D. Recommended OpenLDAP Software Dependency Dependency Real World OpenLDAP Deployments and OpenLDAP Software Client ldapc++.. Statistic SLAPI Software Administrator's GuidexTable of ContentsG. Configuration File LDAP Result Non-Error Result Result success (0).. operationsError (1).. protocolError (2).. timeLimitExceeded (3).. sizeLimitExceeded (4).. compareFalse (5).. compareTrue (6).. authMethodNotSupported (7).. strongerAuthRequired (8).. referral (10).. adminLimitExceeded (11).. unavailableCriticalExtension (12).. confidentialityRequired (13).. saslBindInProgress (14).. noSuchAttribute (16).. undefinedAttributeType (17).. inappropriateMatching (18).. constraintViolation (19).. attributeOrValueExists (20).. invalidAttributeSyntax (21).. noSuchObject (32).. aliasProblem (33).. invalidDNSyntax (34).. aliasDereferencingProblem (36).. inappropriateAuthentication (48).

8 InvalidCredentials (49).. insufficientAccessRights (50).. busy (51).. unavailable (52).. unwillingToPerform (53).. loopDetect (54).. namingViolation (64).. objectClassViolation (65).. notAllowedOnNonLeaf (66).. notAllowedOnRDN (67).. entryAlreadyExists (68).. objectClassModsProhibited (69).. affectsMultipleDSAs (71).. other (80)..239 OpenLDAP Software Administrator's GuidexiTable of ContentsI. Related Related Generic configure OpenLDAP Software Copyright OpenLDAP Copyright Additional Copyright University of Michigan Copyright OpenLDAP Public Software Administrator's GuidexiiPrefaceCopyrightCopyright 1998-2012, The OpenLDAP Foundation, All Rights 1992-1996, Regents of the University of Michigan, All Rights document is considered a part of OpenLDAP Software . This document is subject to terms of conditionsset forth in OpenLDAP Software Copyright Notices and the OpenLDAP Public License. Complete copies ofthe notices and associated license can be found in Appendix K and L, of OpenLDAP Software and this document may be copyright by other parties and/or subject toadditional restrictions.

9 Individual source files should be consulted for additional copyright of this DocumentThis document provides a Guide for installing OpenLDAP Software ( )on UNIX (and UNIX-like) systems. The document is aimed at experienced system administrators with basicunderstanding of LDAP-based directory document is meant to be used in conjunction with other OpenLDAP information resources provided withthe Software package and on the project's site ( ) on the World Wide Web. The sitemakes available a number of ResourcesResourceURLD ocument Asked Tracking document is not a complete reference for OpenLDAP Software ; the manual pages are the definitivedocumentation. For best results, you should use the manual pages that were installed on your system withyour version of OpenLDAP Software so that you're looking at documentation that matches the code. While theOpenLDAP web site also provides the manual pages for convenience, you can not assume that they corresondto the particular version you're OpenLDAP Project is comprised of a team of volunteers.

10 This document would not be possible withouttheir contribution of time and OpenLDAP Project would also like to thank the University of Michigan LDAP Team for building thefoundation of LDAP Software and information to which OpenLDAP Software is built upon. This document isbased upon University of Michigan document: The SLAPD and SLURPD Administrators enhancements and corrections to this document should be submitted using the OpenLDAP IssueTracking System ( ).About this documentThis document was produced using the Simple Document Format (SDF) documentation system( ) developed by Ian Clatworthy. Tools for SDF areavailable from CPAN ( ). OpenLDAP Software Administrator's Guide21. Introduction to OpenLDAP Directory ServicesThis document describes how to build, configure, and operate OpenLDAP Software to provide directoryservices. This includes details on how to configure and run the Standalone LDAP Daemon, slapd(8). It isintended for new and experienced administrators alike.