1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

30 Commits

Author SHA1 Message Date
Andrew Bartlett
ce01e36d8c s4-openldap-backend Don't set 'dbnosync' on cn=config
This isn't valid in current OpenLDAP versions.

Andrew Bartlett
2010-10-18 11:13:04 +00:00
Andrew Bartlett
bd08249d68 s4:provision Remove moduleload for 'hdb' (wrong name).
The backends are not normally modules anyway
2010-04-22 19:55:06 +10:00
Andrew Bartlett
e11f92ba73 s4:provision Make OpenLDAP backend more robust
With the extra moduleload lines (which succeed if it's already
staticly linked), we now work with OpenLDAP overlays as modules.

Andrew Bartlett
2010-04-22 18:37:19 +10:00
Andrew Bartlett
466fbe278a s4:provison Pass nosync in for the OpenLDAP cn=config too 2010-04-22 18:37:19 +10:00
Andrew Bartlett
cbb818222a s4:OpenLDAP-backend Use the new rdnval module in OpenLDAP
This is rather than rdn_name, which tries to do the job on the client
side.  We need to leave this module in the stack for Fedora DS (and of
course the LDB backend).

Andrew Bartlett
2010-04-22 18:37:18 +10:00
Andrew Bartlett
f87811f6b3 s4:provision Rework provision-backend into provision
This removes a *lot* of duplicated code and the cause of much
administrator frustration.  We now handle starting and stopping the
slapd (at least for the provision), and ensure that there is only one
'right' way to configure the OpenLDAP and Fedora DS backend

We now run OpenLDAP in 'cn=config' mode for online configuration.

To test what was the provision-backend code, a new --ldap-dryrun-mode
option has been added to provision.  It quits the provision just
before it would start the LDAP binaries

Andrew Bartlett
2009-08-17 09:50:58 +10:00
Andrew Bartlett
f0decfe5c2 s4:provision Assume the OpenLDAP backend can find it's own modules 2009-08-12 10:01:48 +10:00
Oliver Liebel
28bcdf5266 s4:provision Rework and further automate setup of OpenLDAP backend
heres the summary of all changes/extensions:

- Andrew Bartlett's patch to generate indext
- Howard Chu's idea to use nosync on the DB included, but made optional

- slaptest-path is not needed any more (slapd -Ttest is used instead)
and is therefore removed. slapd-path is now recommended when
openldap-backend is chosen.
its also used for olc-conversion

- slapd-detection is now always done by ldapsearch (ldb module),
looking anonymous for objectClass: OpenLDAProotDSE via our ldapi_uri.

- if ldapsearch was not successfull, (no slapd listening on our socket)
slapd is
started via special generated slapdcommand_prov  (ldapi_uri only)

- slapd-"provision-process" startup is done via pythons subprocess.

- the slapd-provision-pid is stored under paths.ldapdir/slapd_provision_pid.

- after provision-backend is finished:
--- slapd.pid is compared with our stored slapd_provision_pid.
if the are unique, slapd.pid will be read out, and the
slapd "provison"-process will be shut down.
--- proper slapd-shutdown is verified again with ldb-search -> ldapi_uri
-> rootDSE.
--- if the pids are different or one of the pid-files is missing, slapd
will not be shut down,
instead an error message is displayed to locate slapd manually
--- extended help-messages (relevant to slapd) are always displayed,
e.g. the commandline with which slapd has to be started when everythings
finished
(slapd-commandline is stored under paths.ldapdir/slapd_command_file.txt))

- upgraded the content of the mini-howto (howto-ol-backend-s4.txt)
2009-08-12 10:01:48 +10:00
Oliver Liebel
31f2cddcf5 Added mmr and olc to the OpenLDAP backend provisioning-scripts
These extensions add mmr (multi-master-replication) and olc
(openldap-online-configuration) capabilities to the
provisioning-scripts (provision-backend and provision.py), for use
with the openldap-backend (only versions >=2.4.15!).

Changes / additions made to the provision-backend  -script:
added new command-line-options:
--ol-mmr-urls=<list of whitespace separated ldap-urls> for use with mmr
(can be combined with --ol-olc=yes),
--ol-olc=[yes/no] (activate automatic conversion from static slapd.conf
to olc),
--ol-slaptest=<path to slaptest binary> (needed in conjunction with
--ol-olc=yes)

Changes / additions made to the provision.py -script: added
extensions, that will automatically generate the chosen mmr and/or olc
setup for the openldap backend, according to the to chosen parameters
set in the provision-backend script

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-02-24 21:34:44 +11:00
Andrew Bartlett
ebe1e923c8 s4:provision: use extended_dn_out_ldb or extended_dn_out_dereference depending on the backend
This just changes the existing stratagy of loading different modules
for the OpenLDAP backend to also include extended_dn_out_*

When we provision the OpenLDAP backend, we make sure to include the
'deref' overlay (which must be made available by the OpenLDAP build)

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2008-12-17 12:29:28 +11:00
Oliver Liebel
b76f383eef Use DIGEST-MD5 authentication for OpenLDAP replication
This avoids passing rootdn passwords or replicated data in cleartext
across the network.

Signed-of-by: Andrew Bartlett <abartlet@samba.org>
(This used to be commit 67373c143a)
2008-09-08 14:39:54 +10:00
Andrew Bartlett
7ef21658fb Fix up new OpenLDAP MMR code.
This changes the MMR password from hard-coded value of 'linux',
adds tests and fixes the Fedora DS backend.

Currently the MMR password matches the admin password, but we can
change this to be another random value if required.

Also require the port to be specified on the command line, so we don't
hard-code a port of 9000.

Andrew Bartlett
(This used to be commit 08257c6d6c)
2008-08-19 14:10:14 +10:00
Oliver Liebel
805dd85291 Generate Multi-Master Replication configuration for OpenLDAP
This patches provision-backend and the related scripts to generate the
correct configuration blobs for N-way multi-master replication using
OpenLDAP.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
(This used to be commit 6ed0b3f247)
2008-08-19 12:03:04 +10:00
Andrew Bartlett
706140a1dc Make invalid 'member' detection work again.
This defines a rootdn globally, and due to OpenLDAP bugs, gives it
manage access to the whole database.  This makes the memberOf module
able to validate the links again, now we have database ACLs.

Andrew Bartlett
(This used to be commit 9fe3e9f09f)
2008-07-21 09:36:24 +10:00
Andrew Bartlett
3408a2d18f Make a seperate template for the refint configuration too
(This used to be commit d2a527acc5)
2008-07-18 18:58:56 +10:00
Andrew Bartlett
cfc2063f23 Put the memberof template into a seperate setup/ file.
Set a memberof-dn in a fruitless attempt to fix the ACL problem I'm
having with OpenLDAP

Andrew Bartlett
(This used to be commit 6d6e03834a)
2008-07-18 18:44:07 +10:00
Andrew Bartlett
831bd55fb0 Lock down the LDAP backend - only samba may read or write
(This used to be commit a3912801fb)
2008-07-15 22:07:45 +10:00
Andrew Bartlett
a6b842f963 Connect to the LDAP backend with SASL credentials.
This reworks our LDAP backend code to move from anonymous access to a
shared-secret SASL-protected connection.  (SASL selects NTLM or
DIGEST-MD5 on my system).

To get this working, we must pre-populate the LDAP backend with a DN
to store ths SASL secret on, and we use back-ldif for this.

This gives us a reasonable basis to deploy a replicated OpenLDAP
backend solution.

Andrew Bartlett
(This used to be commit cd0745253c)
2008-07-15 15:15:12 +10:00
Andrew Bartlett
a5e3c5e236 Avoid the use of extensibleObject in ldap mapping backend.
Instead of extensibleObject, we use the new (more correct) ad2oLschema
tool, and a new objectClass called 'samba4Top', which we add and
remove in the same way we did extensibleObject.

Andrew Bartlett
(This used to be commit 5ab20aa8b4)
2008-07-10 17:54:43 +10:00
Andrew Bartlett
d7299d82c3 Rework memberof handling in slapd.conf (used for OpenLDAP backend)
Instead of using an include file, put the generated configurationd
directly into slapd.conf.

Andrew Bartlett
(This used to be commit 95ac786136)
2008-03-15 19:03:04 +11:00
Andrew Bartlett
958b0e8ad1 Use syncrepl on all OpenLDAP databases (creates contextCSN attribute)
This module needs to be loaded on each database, not just the main
partition.  We use it to create the usn for the entries.

Andrew Bartlett
(This used to be commit ffb12aad8a)
2008-01-18 13:28:52 +11:00
Andrew Bartlett
108fd49c41 r26636: Remove useless 'backend' parameter, and make the memberof overlay use global.
Andrew Bartlett
(This used to be commit 3b6f461e9a)
2007-12-31 22:06:01 -06:00
Andrew Bartlett
8ff2de3f29 r26610: Write out a memberof.conf, to run the memberof plugin on all linked
attributes, as found in the schema.

Index 'cn', as otherwise exact match searches on this attribute always
fail (need to figure out what is so special about cn in OpenLDAP).

Andrew Bartlett
(This used to be commit 5a4a2d10bc)
2007-12-26 22:21:01 -06:00
Andrew Bartlett
03f178a728 r26424: Patch and hits from Howard Chu <hyc@symas.com> for our automated setup
of OpenLDAP.

This makes it consistant with the Fedora DS setup, and doesn't mix
both hdb and bdb.

Andrew Bartlett
(This used to be commit 1ffada95d2)
2007-12-21 05:49:51 +01:00
Andrew Bartlett
8edcbc8474 r26305: Update template files and testsuite to try and work with current
openldap, and fully support different LDAP server locations.

Andrew Bartlett
(This used to be commit a00bb94253)
2007-12-21 05:48:19 +01:00
Andrew Bartlett
b6678a276c r25450: Make it easier to test with a particular version of OpenLDAP, by
setting OPENLDAP_PATH, move to using hdb as the backend (allows
subtree renames), and re-enable the --quiet option.

Andrew Bartlett
(This used to be commit a186a0fa68)
2007-10-10 15:07:37 -05:00
Andrew Bartlett
90b49dc520 r23717: We need to remove the _ in LDAP_MANAGERPASS for the
--ldap-manager-pass= option to work.

Andrew Bartlett
(This used to be commit fbcb1ec141)
2007-10-10 14:59:07 -05:00
Andrew Bartlett
97172e1120 r23716: Clarify LDAP Manager DN and fix slapd startup syntax.
Andrew Bartlett
(This used to be commit 17dad5d8c3)
2007-10-10 14:59:06 -05:00
Andrew Bartlett
86a4886e39 r23189: Work towards a totally scripted setup of LDAP backends, so others can
easily try this out.

I also intend to use this for the selftest, but I'm chasing issues
with the OpenlDAP (but not Fedora DS) backend.

Andrew Bartlett
(This used to be commit 0f457b1d2e)
2007-10-10 14:53:02 -05:00
Andrew Bartlett
5fb459e4fa r23177: Add in a new provision-backend script. This helps set up the OpenLDAP or Fedora DS backend.
This required a new mkdir() call in ejs.

We can now provision just the schema for ad2oLschema to operate on
(with provision_schema(), without performing the whole provision, just
to wipe it again (adjustments to 'make test' to come soon).

Andrew Bartlett
(This used to be commit 01d54d13dc)
2007-10-10 14:53:00 -05:00