The suite of OpenLDAP libraries and tools are included within the
following packages:
openldap — Contains the libraries
necessary to run the OpenLDAP server and client
applications.
openldap-clients — Contains command line
tools for viewing and modifying directories on an LDAP server.
openldap-servers — Contains the servers and
other utilities necessary to configure and run an LDAP server.
There are two servers contained in the
openldap-servers package: the Standalone
LDAP Daemon (/usr/sbin/slapd) and the
Standalone LDAP Update Replication Daemon
(/usr/sbin/slurpd).
The slapd daemon is the standalone LDAP server while
the slurpd daemon is used to synchronize changes from
one LDAP server to other LDAP servers on the network. The
slurpd daemon is only used when dealing with multiple
LDAP servers.
To perform administrative tasks, the
openldap-servers package installs the following
utilities into the /usr/sbin/ directory:
slapadd — Adds entries from an LDIF
file to an LDAP directory. For example, the command
/usr/sbin/slapadd -l
ldif-input reads in the LDIF
file, ldif-input,
containing the new entries.
 | Important |
|---|
| | Only the root user may use
/usr/sbin/slapadd. However, the directory
server runs as the ldap user. Therefore the
directory server is unable to modify any files created by
slapadd. To correct this issue, after using
slapadd, type the following command:
chown -R ldap /var/lib/ldap |
|
slapcat — Pulls entries from an LDAP
directory in the default format, Sleepycat Software's
Berkeley DB system, and saves them in an LDIF file. For
example, the command /usr/sbin/slapcat -l
ldif-output outputs an LDIF
file called
ldif-output
containing the entries from the LDAP directory.
slapindex — Re-indexes the
slapd directory based on the current
content. This tool should be run whenever indexing options within
/etc/openldap/slapd.conf are changed.
slappasswd — Generates an encrypted
user password value for use with ldapmodify or
the rootpw value in the
slapd configuration file,
/etc/openldap/slapd.conf. Execute the
/usr/sbin/slappasswd command to create the
password.
 | Warning |
|---|
| | You must stop slapd by issuing the
/sbin/service ldap stop command before using
slapadd, slapcat or
slapindex. Otherwise, the integrity of the LDAP
directory is at risk.
|
For more information on using these utilities, refer to their
respective man pages.
The openldap-clients package installs tools into
/usr/bin/ which are used to add, modify, and delete
entries in an LDAP directory. These tools include the following:
ldapadd — Adds entries to an LDAP
directory by accepting input via a file or standard input;
ldapadd is actually a hard link to
ldapmodify -a.
ldapdelete — Deletes entries from an
LDAP directory by accepting user input at a shell prompt
or via a file.
ldapmodify — Modifies entries in an LDAP
directory, accepting input via a file or standard input.
ldappasswd — Sets the password for an
LDAP user.
ldapsearch — Searches for entries in
an LDAP directory using a shell prompt.
With the exception of ldapsearch, each of these
utilities is more easily used by referencing a file containing the
changes to be made rather than typing a command for each entry to be
changed within an LDAP directory. The format of such a file is outlined
in the man page for each utility.
In addition to the OpenLDAP packages, Red Hat Enterprise Linux includes a package called
nss_ldap, which enhances LDAP's ability to
integrate into both Linux and other UNIX environments.
The nss_ldap package provides the following
modules:
The nss_ldap package provides the following
modules for Itanium or AMD64 architectures:
The
libnss_ldap-<glibc-version>.so
module allows applications to look up users, groups, hosts, and other
information using an LDAP directory via glibc's Nameservice
Switch (NSS) interface (replace
<glibc-version> with the version of
libnss_ldap in use). NSS allows applications to
authenticate using LDAP in conjunction with the NIS name service and
flat authentication files.
The pam_ldap module allows PAM-aware applications
to authenticate users using information stored in an LDAP
directory. PAM-aware applications include console login, POP and IMAP
mail servers, and Samba. By deploying an LDAP server on a network, all
of these applications can authenticate using the same user ID and
password combination, greatly simplifying administration.
For more about configuring PAM, refer to Chapter 16 Pluggable Authentication Modules (PAM)
and the PAM man pages.
Red Hat Enterprise Linux includes a package containing an LDAP module for the PHP
server-side scripting language.
The php-ldap package adds LDAP support to the
PHP4 HTML-embedded scripting language via the
/usr/lib/php4/ldap.so module. This module allows
PHP4 scripts to access information stored in an LDAP directory.
Red Hat Enterprise Linux ships with the mod_authz_ldap module for
the Apache HTTP Server. This module uses the short form of the distinguished name
for a subject and the issuer of the client SSL certificate to
determine the distinguished name of the user within an LDAP directory.
It is also capable of authorizing users based on attributes of that
user's LDAP directory entry, determining access to assets based on the
user and group privileges of the asset, and denying access for users
with expired passwords. The mod_ssl module is
required when using the mod_authz_ldap module.
| Important |
|---|
| | The mod_authz_ldap module does not
authenticate a user to an LDAP directory using an encrypted
password hash. This functionality is provided by the experimental
mod_auth_ldap module, which is not included
with Red Hat Enterprise Linux. Refer to the Apache Software Foundation website online
at https://www.apache.org/ for details
on the status of this module.
|
There are graphical LDAP clients available which support creating and
modifying directories, but they are not included
with Red Hat Enterprise Linux. One such application is LDAP
Browser/Editor — A Java-based tool available
online at https://www.iit.edu/~gawojar/ldap/.
Most other LDAP clients access directories as read-only, using them to
reference, but not alter, organization-wide information. Some examples
of such applications are Sendmail, Mozilla,
Gnome Meeting, and
Evolution.
