Hello :)

Hopefully I'm not completly wrong on this ml, as its not only ldap related, but also samba related.

I work at a Chair of a german university.

University uses a central LDAP-system for all students, employees, scientists, scientific guests, etc., providing an unique UID for all these peoples, plus many more information.

My idea was: setting-up a local OpenLDAP-proxy, so that people of our Chair get access to ressources (eg. via samba) using their unique UID and password, but without setting-up an AD.

Many system here are owned by the Chair or University, but lots of students are using their own laptop, so using a AD (and adding them) is not very handy for them ... so, something like a stand-alone samba-server with authentification versus ldap.

Is there a chance to get this running? There is no chance to add the schema on a proxy?

What I did so far:

- I can establish a connection to the central LDAP-system using /etc/pam_ldap.conf

uri ldaps://ldap.DOMAIN.de

host ldap.DOMAIN.de

base ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de

ldap_version 3

binddn cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de

bindpw PASSWORD

pam_password crypt

ssl start_tls

ssl on

- I configured /etc/libnss-ldap.conf, and a 'getent passwd' shows all local users plus the members

uri ldaps://ldap.DOMAIN.de

host ldap.DOMAIN.de

base ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de

ldap_version 3

binddn cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de

bindpw PASSWORD

- I also configured /etc/ldap/slapd.conf for proxy usage (I think I did ...), but I learned 2 days ago I can't add any schemata on a proxy ...

# Schema includes

include /etc/ldap/schema/core.schema

include /etc/ldap/schema/cosine.schema

include /etc/ldap/schema/nis.schema

include /etc/ldap/schema/inetorgperson.schema

#

include /etc/ldap/schema/misc.schema

include /etc/ldap/schema/openldap.schema

#

#

# Module

modulepath /usr/lib/ldap

moduleload back_ldap.la

moduleload back_hdb.la

moduleload back_mdb

moduleload rwm

moduleload pcache.la

moduleload memberof.la

#

# Main settings

pidfile /var/run/slapd/slapd.pid

argsfile /var/run/slapd/slapd.args

conn_max_pending 1000

sockbuf_max_incoming 4194303

logfile /var/log/ldap/logfile.log

#loglevel stats conns filter

loglevel any

sizelimit unlimited

limits * size.pr=0 size.prtotal=none

tool-threads 1

#

readonly on

access to *

by * read

#

# Database defs (proxy to AD)

database ldap

chase-referrals no

rootdn ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de

suffix "dc=DOMAIN,dc=de"

uri ldap://localhost/

uri ldap://ldap.DOMAIN.de/

uri ldaps://ldap.DOMAIN.de/

acl-bind bindmethod=simple binddn="cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de" credentials="PASSWORD" starttls=yes

idassert-bind bindmethod=simple binddn="cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de" credentials="PASSWORD" starttls=yes

#cancel abandon

overlay pcache

#proxycache hdb 100000 3 1000 100

proxycache mdb 100000 3 1000 100

pcachePersist TRUE

proxyAttrset 0 mail uid gecos

proxyTemplate (sn=) 0 3600

proxyTemplate (&(sn=)(givenName=)) 0 3600

#cachesize 20

index objectClass eq

index cn,sn,uid,mail pres,eq,sub

pcacheAttrset 0 1.1

pcacheTemplate (&(|(objectClass=))) 0 3600

pcacheTemplate (objectClass=*) 0 3600

pcacheAttrset 1 displayname

pcacheTemplate (objectClass=*) 1 3600

pcacheAttrset 2 memberOf

pcacheTemplate (objectClass=*) 2 3600

conn-ttl 3600

#

directory /var/lib/ldap

Testing the config works:

root@ldap:~# /usr/sbin/slapd -Tt -f /etc/ldap/slapd.conf

config file testing succeeded

62398f56 mdb_opinfo_get: err Permission denied(13)

root@ldap:~#

(I have no idea which Permission is denied)

slapd can be started via

/usr/sbin/slapd -g openldap -u openldap -f /etc/ldap/slapd.conf

ldapsearch works fine using '-h localhost' or '-H ldap://ldap.DOMAIN.de', so I think the basic config is not bad at all ...

Thanks in advance!

Cheers, Torsten