OpenLDAP - Revision history

Onny: Reformat

2025-03-26T20:03:17Z

Reformat

← Older revision		Revision as of 20:03, 26 March 2025
Line 1:		Line 1:
	[https://www.openldap.org OpenLDAP] is a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP).		[https://www.openldap.org OpenLDAP] is a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP).

	===~~Setting up a simple server~~===		===Setup===
	<syntaxhighlight lang="nix">		A minimal local testing server can be run with following configuration<syntaxhighlight lang="nix">
	services.openldap = {		services.openldap = {
	enable = true;		enable = true;

	/* enable plain connections only */		/* enable plain connections only */
	urlList = [ "ldap:///" ];		urlList = [ "ldap:///" ];

			settings = {
			attrs = {
			olcLogLevel = "conns config";
			};

	~~settings~~ = {		children = {
	~~attrs~~ = {		"cn=schema".includes = [
	~~olcLogLevel =~~ "~~conns config~~";		"${pkgs.openldap}/etc/schema/core.ldif"
	};		"${pkgs.openldap}/etc/schema/cosine.ldif"
			"${pkgs.openldap}/etc/schema/inetorgperson.ldif"
			];

	~~children~~ = {		"olcDatabase={1}mdb".attrs = {
	~~"cn=schema~~".~~includes~~ = [		objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
	"${~~pkgs.openldap}/etc/schema/core.ldif"~~
	"~~${pkgs.openldap}/etc/schema/cosine.ldif~~"
	"~~${pkgs.openldap}/etc/schema/inetorgperson.ldif~~"
	];

	"olcDatabase={1}mdb"~~.attrs = {~~		olcDatabase = "{1}mdb";
	~~objectClass~~ = ~~[ "olcDatabaseConfig"~~ "~~olcMdbConfig~~" ];		olcDbDirectory = "/var/lib/openldap/data";

	~~olcDatabase~~ = "~~{1}mdb";~~		olcSuffix = "dc=example,dc=com";
	~~olcDbDirectory~~ = ~~"/var/lib/openldap/data~~";

	~~olcSuffix~~ = "dc=example,dc=com";		/* your admin account, do not use writeText on a production system */
			olcRootDN = "cn=admin,dc=example,dc=com";
			olcRootPW.path = pkgs.writeText "olcRootPW" "pass";

	/* ~~your admin account, do not use writeText on a production system~~ */		olcAccess = [
	~~olcRootDN~~ = ~~"cn=admin,dc=example,dc=com";~~		/* custom access rules for userPassword attributes */
	~~olcRootPW.path = pkgs.writeText "olcRootPW" "pass";~~		''{0}to attrs=userPassword
			by self write
			by anonymous auth
			by * none''

	~~olcAccess = [~~		/* allow read on anything else */
	~~/* custom access rules for userPassword attributes */~~		''{1}to *
	~~''{0}to attrs=userPassword~~		by * read''
	~~by self write~~		];
	~~by anonymous auth~~
	~~by * none''~~

	/* allow read on anything else */
	''{1}to *
	by * read''
	];
	};
	};		};
	};		};
	};		};
			};
	</syntaxhighlight>		</syntaxhighlight>

Onny at 19:58, 26 March 2025

2025-03-26T19:58:19Z

← Older revision		Revision as of 19:58, 26 March 2025
Line 1:		Line 1:
	OpenLDAP is a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP).		[https://www.openldap.org OpenLDAP] is a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP).

	===Setting up a simple server===		===Setting up a simple server===

Klinger: Beginning sentence and Category:Server

2024-04-19T20:29:03Z

Beginning sentence and Category:Server

← Older revision		Revision as of 20:29, 19 April 2024
Line 1:		Line 1:
			OpenLDAP is a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP).

	===Setting up a simple server===		===Setting up a simple server===
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
Line 265:		Line 267:
	Also, using the configuration directory means you cannot use the <code>extra…</code> options from the example above.		Also, using the configuration directory means you cannot use the <code>extra…</code> options from the example above.
	To switch to the configuration directory (also known as OLC), just set <code>configDir</code> to a directory that already contains such OLC configuration.		To switch to the configuration directory (also known as OLC), just set <code>configDir</code> to a directory that already contains such OLC configuration.

			[[Category:Server]]

imported>RatCornu: Add part on overlays usage

2023-12-30T21:19:59Z

Add part on overlays usage

← Older revision		Revision as of 21:19, 30 December 2023
Line 135:		Line 135:


			=== Overlays ===

			It is also possible to add OpenLDAP overlays to your NixOS configuration. For example, you can directly add the very useful "memberof" and "ppolicy" overlays such like this :

			<syntaxhighlight lang="nix">
			services.openldap = {
			enable = true;

			/* enable plain and secure connections */
			urlList = [ "ldap:///" "ldaps:///" ];

			settings = {
			attrs = {
			olcLogLevel = "conns config";

			/* settings for acme ssl */
			olcTLSCACertificateFile = "/var/lib/acme/${your-host-name}/full.pem";
			olcTLSCertificateFile = "/var/lib/acme/${your-host-name}/cert.pem";
			olcTLSCertificateKeyFile = "/var/lib/acme/${your-host-name}/key.pem";
			olcTLSCipherSuite = "HIGH:MEDIUM:+3DES:+RC4:+aNULL";
			olcTLSCRLCheck = "none";
			olcTLSVerifyClient = "never";
			olcTLSProtocolMin = "3.1";
			};

			children = {
			"cn=schema".includes = [
			"${pkgs.openldap}/etc/schema/core.ldif"
			"${pkgs.openldap}/etc/schema/cosine.ldif"
			"${pkgs.openldap}/etc/schema/inetorgperson.ldif"
			];

			"olcDatabase={1}mdb" = {
			attrs = {
			objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];

			olcDatabase = "{1}mdb";
			olcDbDirectory = "/var/lib/openldap/data";

			olcSuffix = "dc=example,dc=com";

			/* your admin account, do not use writeText on a production system */
			olcRootDN = "cn=admin,dc=example,dc=com";
			olcRootPW.path = pkgs.writeText "olcRootPW" "pass";

			olcAccess = [
			/* custom access rules for userPassword attributes */
			''{0}to attrs=userPassword
			by self write
			by anonymous auth
			by * none''

			/* allow read on anything else */
			''{1}to *
			by * read''
			];
			};

			children = {
			"olcOverlay={2}ppolicy".attrs = {
			objectClass = [ "olcOverlayConfig" "olcPPolicyConfig" "top" ];
			olcOverlay = "{2}ppolicy";
			olcPPolicyHashCleartext = "TRUE";
			};

			"olcOverlay={3}memberof".attrs = {
			objectClass = [ "olcOverlayConfig" "olcMemberOf" "top" ];
			olcOverlay = "{3}memberof";
			olcMemberOfRefInt = "TRUE";
			olcMemberOfDangling = "ignore";
			olcMemberOfGroupOC = "groupOfNames";
			olcMemberOfMemberAD = "member";
			olcMemberOfMemberOfAD = "memberOf";
			};

			"olcOverlay={4}refint".attrs = {
			objectClass = [ "olcOverlayConfig" "olcRefintConfig" "top" ];
			olcOverlay = "{4}refint";
			olcRefintAttribute = "memberof member manager owner";
			};
			};
			};
			};
			};
			};
			</syntaxhighlight>

			You can see the list of schemas and overlays that can be directly used without any further work in <code>$[pkgs.openldap}/etc/schema</code>.

	===Setting up a server (officially deprecated)===		===Setting up a server (officially deprecated)===

imported>Rti: add non deprecated openldap setups with and without ssl support

2023-01-17T20:53:02Z

add non deprecated openldap setups with and without ssl support

Show changes

imported>Das j: Init of this page

2019-10-27T12:39:23Z

Init of this page

New page

===Setting up a server===

Use with the configuration file (officially deprecated):

<syntaxhighlight lang="nix">
{
services.openldap = {
enable = true;
dataDir = "/var/lib/openldap";
urlList = [ "ldap:///" "ldapi:///" ]; # Add ldaps to this list to listen with SSL (requires configured certificates)
suffix = "dc=nixos,dc=org";
rootdn = "cn=admin,dc=nixos,dc=org";
rootpw = "water"; # Or use rootpwFile
# See https://www.openldap.org/doc/admin24/slapdconfig.html
extraDatabaseConfig = ''
access to dn.base="dc=nixos,dc=org" by * read
# Add your own ACLs here…
# Drop everything that wasn't handled by previous ACLs:
access to * by * none

index objectClass eq
index uid eq
index mail sub
# Accelerates replication if you use it
index entryCSN eq
index entryUUID eq
'';
# Setting this causes OpenLDAP to drop the entire database on startup and write the contents of
# of this LDIF string into the database. This ensures that only nix-managed content is found in the
# database. Note that if a lot of entries are created in conjunction with a lot of indexes, this might hurt
# startup performance.
# Also, you can set `readonly on` in `extraDatabaseConfig` to ensure nobody writes data that will be
# lost.
declarativeContents = "…";
};
}
</syntaxhighlight>

To use the not-deprecated configuration directory, the recommended way is to create a simple configuration file and convert it using <code>slaptest</code>. This however is out of scope for this page.
Also, using the configuration directory means you cannot use the <code>extra…</code> options from the example above.
To switch to the configuration directory (also known as OLC), just set <code>configDir</code> to a directory that already contains such OLC configuration.