Differences

This shows you the differences between two versions of the page.

--- tutorial:ldap:installopenldap [2016-04-03 22:32]
weichbr [Enforce Authorization]
+++ tutorial:ldap:installopenldap [2019-08-14 19:43] (current)
weichbr
@@ Line 5: / Line 5: @@
 ===== Requirements =====
   * Debian 8 installation
+----
+===== Notes =====
+  * ''%%ldapsearch%%'' parameters:
+    * ''%%-W%%'' prompt for password
+    * ''%%-x%%'' use simple auth
+    * ''%%-Z%%'' try to use STARTTLS
+    * ''%%-ZZ%%'' force use of STARTTLS
+    * ''%%-D%%'' bind with the given name
+    * ''%%-b%%'' search base
+  * ''%%ldaps://%%'' on port 636 is deprecated with LDAPv3. Use ''%%ldap://%%'' on port 389 with STARTTLS instead.
 ----
@@ Line 53: / Line 65: @@
   * Create ''%%base.ldif%%'' with the following content:
   * <code>
-dn: ou=people,dc=internal,dc=weichbrodt,dc=me
+dn: ou=people,dc=my,dc=domain,dc=tld
 objectClass: organizationalUnit
 ou: people
-dn: ou=groups,dc=internal,dc=weichbrodt,dc=me
+dn: ou=groups,dc=my,dc=domain,dc=tld
 objectClass: organizationalUnit
 ou: groups
@@ Line 65: / Line 77: @@
 ----
 ===== Enforce Authorization =====
   * We do not want our directory to be world readable, so we need to setup some ACLs
@@ Line 93: / Line 106: @@
 olcDbMaxSize: 1073741824
 </code>
+  * Take a look at the lines starting with ''%%olcAccess%%''
+  * We want users to be able to change their own password as well as authenticate. Noone else should be able to read the password hash. The admin accounts can modify everyones passwords and can read all hashes.
+  * Also we want users to authenticate before reading the directory. Anonymous access should be disallowed.
+  * We need to modify ''%%olcAccess: {0}%%'' for the passwords and ''%%olcAccess: {2}%%'' for general access.
+  * Create the ''%%access.ldif%%'' file:
+  * <code>
+dn: olcDatabase={1}mdb,cn=config
+changetype: modify
+delete: olcAccess
+olcAccess: {0}
+-
+add: olcAccess
+olcAccess: {0}to attrs=userPassword,shadowLastChange
+  by dn="cn=admin,dc=my,dc=domain,dc=tld" write
+  by self write
+  by anonymous auth
+  by * none
+-
+delete: olcAccess
+olcAccess: {2}
+-
+add: olcAccess
+olcAccess: {2}to *
+  by dn="cn=admin,dc=my,dc=domain,dc=tld" manage
+  by self write
+  by anonymous auth
+  by users read
+</code>
+  * Apply it:
+  * <code>ldapmodify -Y EXTERNAL -H ldapi:/// -f access.ldif</code>
+  * Users now need to authenticate to read the directory, like this:
+  * <code>ldapsearch -x -D "cn=admin,dc=my,dc=domain,dc=tld" -W</code>
 ----
 ===== Enabling TLS =====
   * Make sure you have the following files:
@@ Line 142: / Line 189: @@
 olcSecurity: tls=1
 </code>
+  * Users now need to use STARTTLS (e.g. with ''%%-Z%%'' in ''%%ldapsearch%%''):
+  * <code>ldapsearch -x -Z -D "cn=admin,dc=my,dc=domain,dc=tld" -W</code>
+----
+===== Add an admin group ====
+  * We do not want to give every admin the admin account credentials
+  * We need an admin group which all admins are a member of
+  * We can give this group manage permissions
+  * I assume you already have created a ''%%admins%%'' posixGroup in the ''%%groups%%'' ou
+  * Take a look at the ldif to enforce authorization and change it to this:
+  * <code>
+dn: olcDatabase={1}mdb,cn=config
+changetype: modify
+delete: olcAccess
+olcAccess: {3}
+-
+add: olcAccess
+olcAccess: {3}to *
+  by dn="cn=admin,dc=my,dc=domain,dc=tld" manage
+  by set="user/uid & [cn=admins,ou=groups,dc=my,dc=domain,dc=tld]/memberUid" manage
+  by self write
+  by anonymous auth
+  by users read
+-
+</code>
+  * Apply it like above