Infrastructure:LDAP - Revision history

Greg: Document resetting a user's password

2020-10-06T09:29:03Z

Document resetting a user's password

Greg: /* Add the account */

2020-10-06T09:22:48Z

Add the account

Greg: /* Listing accounts */

2020-10-06T09:22:38Z

Listing accounts

Greg: Fix the suffix for the search command

2020-09-16T09:30:42Z

Fix the suffix for the search command

Raucao at 06:08, 16 September 2020

2020-09-16T06:08:01Z

Greg: Add an example admin user

2020-03-03T12:09:59Z

Add an example admin user

Greg at 10:43, 27 February 2020

2020-02-27T10:43:45Z

Greg: Update the directory structure after the changes in https://gitea.kosmos.org/kosmos/chef/issues/140

2020-02-27T10:42:47Z

Update the directory structure after the changes in https://gitea.kosmos.org/kosmos/chef/issues/140

Show changes

Raucao: /* Directory structure */

2020-02-20T14:19:30Z

Directory structure

Greg at 17:21, 19 February 2020

2020-02-19T17:21:52Z

← Older revision		Revision as of 09:29, 6 October 2020
Line 182:		Line 182:

	adding new entry "cn=alice,ou=kosmos.org,cn=users,dc=kosmos,dc=org"		adding new entry "cn=alice,ou=kosmos.org,cn=users,dc=kosmos,dc=org"
		+
		+	=== Reset a user's password ===
		+
		+	This can also be used to replace any field, for example the user's email (''mail'')
		+
		+	$ ldapmodify -x -W -D 'cn=Directory Manager' -H "ldaps://ldap.kosmos.org" << EOF
		+	dn: cn=alice,ou=kosmos.org,cn=users,dc=kosmos,dc=org
		+	changetype: modify
		+	replace: userPassword
		+	userPassword: {SSHA512}tJo0ttExKmR8UMbvygtvA23cJ0XD3I6zPxd4B+l9225XynaY8kACoUNSmr4SPjOxPWRqEb4mEIJ5sN8MTOvnpTZmNGRlNDViNGY5YzQwYjM4ZmY3NDBkYjJkZjVkMWE4MjVmYTIxMjk4NmZlYWY1Yjk0MjUyOGNiZDYyZWRhNWE=
		+	EOF
		+
		+	modifying entry "cn=alice,ou=kosmos.org,cn=users,dc=kosmos,dc=org"

@@ Line 168: / Line 168: @@
 ==== Add the account ====
-  ldapadd -x -W -D 'cn=Directory Manager' -H "ldaps://ldap.kosmos.org" << EOF
+  $ ldapadd -x -W -D 'cn=Directory Manager' -H "ldaps://ldap.kosmos.org" << EOF
   dn: cn=alice,ou=kosmos.org,cn=users,dc=kosmos,dc=org
   objectClass: top

@@ Line 155: / Line 155: @@
 === Listing accounts ===
-  ldapsearch -x -W -D 'cn=Directory Manager' -b "ou=kosmos.org,cn=users,dc=kosmos,dc=org" -H "ldaps://ldap.kosmos.org"
+  $ ldapsearch -x -W -D 'cn=Directory Manager' -b "ou=kosmos.org,cn=users,dc=kosmos,dc=org" -H "ldaps://ldap.kosmos.org"
 === Adding an account ===

@@ Line 155: / Line 155: @@
 === Listing accounts ===
-  ldapsearch -x -W -D 'cn=Directory Manager' -b "ou=users,dc=kosmos,dc=org" -H "ldaps://ldap.kosmos.org"
+  ldapsearch -x -W -D 'cn=Directory Manager' -b "ou=kosmos.org,cn=users,dc=kosmos,dc=org" -H "ldaps://ldap.kosmos.org"
 === Adding an account ===

← Older revision		Revision as of 06:08, 16 September 2020
Line 146:		Line 146:
	userPassword: secret		userPassword: secret
	</pre>		</pre>
		+
		+	== Admin commands ==
		+
		+	The ''ldapsearch'' and ''ldapadd'' command-line tool are provided by different packages depending on your OS. For example ''ldap-utils'' on Ubuntu, ''openldap-clients'' on Fedora, ''openldap'' on Arch Linux. It is already provided in a default macOS installation.
		+
		+	This can also be done using the LDAP client library of your choice.
		+
		+	=== Listing accounts ===
		+
		+	ldapsearch -x -W -D 'cn=Directory Manager' -b "ou=users,dc=kosmos,dc=org" -H "ldaps://ldap.kosmos.org"
		+
		+	=== Adding an account ===
		+
		+	==== Generate a hashed password ====
		+
		+	This example is using Ruby, but anything that can generate a salted SHA512 hash will also work.
		+
		+	$ ruby -r base64 -r digest -r securerandom -e 'salt = SecureRandom.hex(32); password = "random_password"; puts "{SSHA512}" + Base64.strict_encode64(Digest::SHA512.digest(password+salt) + salt)'
		+	{SSHA512}WsELiZM9MlUM004LF3jpV5OuV+qTsGoRR1RzffdtUuPpzOl57I7WmKL+S46/KR8HUtYPRh1ttmsNvGUX/agxLjBkZGI0MTczNWNiZjkxMDI0NGEzZTE2ZDBlNGJkMDQ5N2ZhMjVjMjQ1NzFlZmJlNmZmODhmNjE5OGM1YWM3Zjc=
		+
		+	==== Add the account ====
		+
		+	ldapadd -x -W -D 'cn=Directory Manager' -H "ldaps://ldap.kosmos.org" << EOF
		+	dn: cn=alice,ou=kosmos.org,cn=users,dc=kosmos,dc=org
		+	objectClass: top
		+	objectClass: account
		+	objectClass: person
		+	objectClass: extensibleObject
		+	cn: alice
		+	sn: alice
		+	uid: alice
		+	mail: alice@example.com
		+	userPassword: {SSHA512}WsELiZM9MlUM004LF3jpV5OuV+qTsGoRR1RzffdtUuPpzOl57I7WmKL+S46/KR8HUtYPRh1ttmsNvGUX/agxLjBkZGI0MTczNWNiZjkxMDI0NGEzZTE2ZDBlNGJkMDQ5N2ZhMjVjMjQ1NzFlZmJlNmZmODhmNjE5OGM1YWM3Zjc=
		+	EOF
		+
		+	adding new entry "cn=alice,ou=kosmos.org,cn=users,dc=kosmos,dc=org"

@@ Line 109: / Line 109: @@
 xmpp: enabled
 userPassword: secret
 # account.pro, users, kosmos.org

@@ Line 24: / Line 24: @@
              |                        |                                |           |
   ----------------------- ------------------------       ------------------------- -------------------------
-  | cn=example_user     | | cn=example_user      |       | uid=xmpp              | | cn=wiki               |
+  | cn=example_user     | | cn=example_user      |       | uid=xmpp              | | uid=wiki              |
   | (account,person,    | | (account,person,     |       | (account,             | | (account,             |
   | extensibleObject)   | | extensibleObject)    |       | simpleSecurityObject) | | simpleSecurityObject) |

@@ Line 19: / Line 19: @@
                                  |         |
               ------------------------ ------------------------
-              |     ou=kosmos.org    | |     ou=account.pro   |
+              |     ou=kosmos.org    | |  ou=customdomain.com |
               | (organizationalUnit) | | (organizationalUnit) |
               ------------------------ ------------------------

@@ Line 112: / Line 112: @@
 # xmpp role, used to filter users that have access to XMPP
-dn: cn=xmpp_role,ou=5apps.com,cn=users,dc=kosmos,dc=org
+dn: cn=xmpp_role,ou=account.pro,cn=users,dc=kosmos,dc=org
 objectclass: top
 objectclass: LDAPsubentry
@@ Line 120: / Line 120: @@
 cn: xmpp_role
 nsRoleFilter: (&(objectclass=person)(xmpp=enabled))
-Description: filtered role for xmpp on 5apps.com
+Description: filtered role for xmpp on account.pro
 # example user for account.pro