First, install the OpenLDAP server daemon slapd and ldap-utils, a package containing LDAP management utilities:

sudo apt-get install slapd ldap-utils

The installation process will prompt you for the LDAP directory admin password and confirmation.

After installing slapd the directory can be configured using dpkg-reconfigure:

sudo dpkg-reconfigure slapd

You will then be taken through a menu based configuration dialog allowing you to configure various slapd options. For the most part the defaults work well, but if your root node differs from the server's FQDN be sure to enter the correct name.

The directory has been created during installation and reconfiguration, and now it is time to populate it. It will be populated with a "classical" scheme that will be compatible with address book applications and with Unix Posix accounts. Posix accounts will allow authentication to various applications, such as web applications, email Mail Transfer Agent (MTA) applications, etc.

LDAP directories can be populated with LDIF (LDAP Directory Interchange Format) files. Copy the following example LDIF file, naming it example.com.ldif, somewhere on your system:

dn: ou=people,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: uid=john,ou=people,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: john sn: Doe givenName: John cn: John Doe displayName: John Doe uidNumber: 1000 gidNumber: 10000 userPassword: password gecos: John Doe loginShell: /bin/bash homeDirectory: /home/john shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 8 shadowMax: 999999 shadowLastChange: 10877 mail: john.doe@example.com postalCode: 31000 l: Toulouse o: Example mobile: +33 (0)6 xx xx xx xx homePhone: +33 (0)5 xx xx xx xx title: System Administrator postalAddress: initials: JD dn: cn=example,ou=groups,dc=example,dc=com objectClass: posixGroup cn: example gidNumber: 10000

In this example the directory structure, a user, and a group have been setup. In other examples you might see the objectClass: top added in every entry, but that is the default behaviour so you do not have to add it explicitly.

Now, to add your entries to the LDAP directory:

We can check that the content has been correctly added with the tools from the ldap-utils package. In order to execute a search of the LDAP directory:

ldapsearch -xLLL -b "dc=example,dc=com" uid=john sn givenName cn dn: uid=john,ou=people,dc=example,dc=com cn: John Doe sn: Doe givenName: John

Just a quick explanation:

Authentication requires access to the password field, that should be not accessible by default. Another issue is that during password change using passwd, shadowLastChange needs to be accessible by authenticated users. The following code, from /etc/ldap/slapd.conf, shows the default ACL setting that permits the admin user and authenticated users access to shadowLastChange:

access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write by * none

LDAP service often quickly becomes a highly critical service in an information system: multiple systems depend on LDAP for authentication, authorization, mail, etc. It is a good idea to setup a redundant system.

Replication is achieved using the Syncrepl engine. Syncrepl allows the directory to be synced using either a push or pull based system. In a push based configuration a “primary” server will push directory updates to “secondary” servers, while a pull based approach allows replication servers to sync on a time based interval.

The following is an example of push configuration. First you need to setup the slapd provider by uncommenting the following line in /etc/ldap/slapd.conf:

rootdn "cn=admin,dc=example,dc=com"

Below the rootdn line add:

moduleload syncprov.la overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100

Now restart slapd:

sudo /etc/init.d/slapd restart

On separate OpenLDAP server configure the slapd consumer by again uncommenting the rootdn line in /etc/ldap/slapd.conf:

rootdn "cn=admin,dc=example,dc=com"

Then add the following below the rootdn entry:

syncrepl rid=123 provider=ldap://ldap01.example.com:389 type=refreshAndPersist searchbase="dc=example,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="uid=john,ou=people,dc=example,dc=com" credentials=password

Now restart the consumer slapd daemon:

sudo /etc/init.d/slapd restart

If all goes well you should be able to execute the ldapsearch example from above on the server with the replicated directory.

ldapsearch -xLLL -b "dc=example,dc=com" uid=john sn givenName cn

The slapd daemon will send log information to /var/log/syslog by default. So if all does not go well check there for errors and other troubleshooting information.