smedev:make_everything_dynamic_with_ldap

Différences

Ci-dessous, les différences entre deux révisions de la page.

Lien vers cette vue comparative

Les deux révisions précédentes Révision précédente
Prochaine révision 		Révision précédente
smedev:make_everything_dynamic_with_ldap [29/03/2013 08:43]
dani [Automatically create the home dir on first connection] 		smedev:make_everything_dynamic_with_ldap [01/08/2013 09:14] (Version actuelle)
dani [Disable user/group managements]
Ligne 6: Ligne 6:
  
 ===== The goal ===== ===== The goal =====
-The goal I have is to have more things in LDAP, ultimately, adding users and groups shouldn't require anything but adding the user or the group in LDAP. No templates to expand, no service to restart. This means for example, all the mail stuff (qpsmtpd, qmail) should read LDAP to get the required info, no more flat files, no more static configuration.+The goal is to have more things in LDAP, ultimately, adding users and groups shouldn't require anything but adding the user or the group in LDAP. No templates to expand, no service to restart. This means for example, all the mail stuff (qpsmtpd, qmail) should read LDAP to get the required info, no more flat files, no more static configuration.
  
 ===== In which way this can be useful ===== ===== In which way this can be useful =====
Ligne 22: Ligne 22:
 ==== Modify a few things in LDAP ==== ==== Modify a few things in LDAP ====
 Here's a list of a few things which can be enhanced in LDAP Here's a list of a few things which can be enhanced in LDAP
 +
 +=== Replace cpu ===
 +LDAP users and groups are managed with [[http://cpu.sourceforge.net|cpu]]. While this tool is working, it has some drawbacks:
 +  * this tool isn't maintained anymore (last version was released in 2004)
 +  * it only supports rfc2307 (see next chapter: switch to rfc2307bis)
 +  * it won't let you add local users to LDAP groups (see http://bugs.contribs.org/show_bug.cgi?id=6458)
 +  * it's written in C, so a bit hard to enhance
 +
 +I think it'd be better to switch to a perl based tool, like [[http://search.cpan.org/~ghenry/Samba-LDAP-0.05/|Samba::LDAP]]
  
 === Switch to rfc2307bis ? === === Switch to rfc2307bis ? ===
  
-The main difference between rfc2307 (currently used) and rfc2307bis is the way groups are handled. The biggest advantage of rfc2307bis is the possibility to enabled the memberOf overlay. The memberOf overlay (see http://www.openldap.org/doc/admin24/overlays.html) can maintain reverse membership attribute. With posixGroup (rfc2307), you can only query the member of a group, but not the list of groups a user is member of. With rfc2307bis and the memberOf overlay, it's possible. This makes it very easy to restrict access to some application to a list of groups. For example:+The main difference between rfc2307 (currently used) and rfc2307bis is the way groups are handled. The biggest advantage of rfc2307bis is the possibility to enabled the memberOf overlay. The memberOf overlay (see http://www.openldap.org/doc/admin24/overlays.html) can maintain reverse membership attribute. With posixGroup (rfc2307), you can only query the members of a group, but not the list of groups a user is member of. With rfc2307bis and the memberOf overlay, it's possible. This makes it very easy to restrict access to some application to a list of groups. For example:
  
-(&(objectClass=inetOrgPerson)(memberOf=cn=admin,ou=Groups,dc=domain,dc=tld))+(&(objectClass=inetOrgPerson)(memberOf=cn=admins,ou=Groups,dc=domain,dc=tld))
  
-This filter would only matches members of the admins group.+This filter would only match members of the **admins** group. 
 + 
 +The problem here is that switching to rfc2307bis requires a modification of the structural objectClass of group objects (from posixGroup to groupOfNames), and this is not possible online, we have to dump the database to an LDIF file, make the modifications and re-import it back. Another advantage of rfc2307bis is that it can be compatible with rfc2307: groups can have members defined as member (full DN of the user) and memberUid (just the uid of the user), so we don't really need to care about breaking anything as long as we maintain both attribute.
  
-The problem here is that switching to rfc2307bis requires a modification of the structural objectClass of group objects (from posixGroup to groupOfNames), and this is not possible online, we have to dump the database to an LDIF file, make the modifications and re-import it back. Another advantage of rfc2307bis is that it can be compatible with rfc2307: groups can have members defined as member (full DN of the user) and memberUid (just the uid of the user). 
  
 === Add smbk5pwd === === Add smbk5pwd ===
-smbk5pwd is a overlay which makes sure Unix and samba passwords stay in sync (as long as you use LDAP exop to chane the password). This would ensure password are in sync even if you change it from the command line using the passwd command, or with any other software which allow password modification through LDAP (SOGo, LemonLDAP::NG etc...)+smbk5pwd is a overlay which makes sure Unix and samba passwords stay in sync (as long as you use LDAP exop to change the password). This would ensure password are in sync even if you change it from the command line using the passwd command, or with any other software which allow password modification through LDAP (SOGo, LemonLDAP::NG etc...)
  
 See this bug: http://bugs.contribs.org/show_bug.cgi?id=6451 See this bug: http://bugs.contribs.org/show_bug.cgi?id=6451
Ligne 41: Ligne 51:
 Pseudonyms and all the variants with the different virtual domains should be added in LDAP Pseudonyms and all the variants with the different virtual domains should be added in LDAP
  
-  * Add all the virtual domains / pseudonyms combinations should be added in LDAP either as mail or mailAlternateAddress+  * All the virtual domains / pseudonyms combinations should be added in LDAP either as mail or mailAlternateAddress
   * A new prop should be available to select the first/preferred mail from the available pseudonyms   * A new prop should be available to select the first/preferred mail from the available pseudonyms
   * Maybe we should add a prop to create domains only for apache, and not handle mails.   * Maybe we should add a prop to create domains only for apache, and not handle mails.
Ligne 48: Ligne 58:
 If we want everything to be dynamic, the home directory of users should be created on the fly on the first connection. This can be achieve with: If we want everything to be dynamic, the home directory of users should be created on the fly on the first connection. This can be achieve with:
   * pam_mkhomedir: the pam module will create the home directory the first time the user logs in   * pam_mkhomedir: the pam module will create the home directory the first time the user logs in
-  * root preexec: if the user try to access his personal folder through samba, we can also create it on the fly using a root preexec script defined in smb.conf+  * root preexec: if the user tries to access his personal folder through samba, we can also create it on the fly using a root preexec script defined in smb.conf
  
 ==== Switch to qmail-ldap (or another LDAP aware MTA, like postfix) ==== ==== Switch to qmail-ldap (or another LDAP aware MTA, like postfix) ====
 +
 +qmail-ldap (see http://www.lifewithqmail.org/ldap/) is a patch for qmail 1.03 to get all user information from LDAP.
 +
   * Add required schema to LDAP   * Add required schema to LDAP
-  * switch to qmail-ldap, or postfix, using an LDAP backend.+  * Add required objectClass/attributes to users and groups 
 +  * switch to qmail-ldap (or postfix) using an LDAP backend.
  
 ==== Modify qpsmtpd to use LDAP ==== ==== Modify qpsmtpd to use LDAP ====
Ligne 60: Ligne 74:
   * Read operations should first try to read LDAP directly   * Read operations should first try to read LDAP directly
   * Write/read fallback to standard flat file DB   * Write/read fallback to standard flat file DB
 +
 ==== Configure OpenLDAP as a proxy ==== ==== Configure OpenLDAP as a proxy ====
  
 ==== Disable user/group managements ==== ==== Disable user/group managements ====
-  * Make it possible to disable user and group management+  * Make it possible to disable user and group management. When a SME Server is using a remote LDAP server, we should prevent user/groups management
  • smedev/make_everything_dynamic_with_ldap.1364543006.txt.gz
  • Dernière modification: 29/03/2013 08:43
  • de dani