Services:Accounts - Revision history

Raucao at 06:08, 16 September 2020

2020-09-16T06:08:13Z

Greg: Document LDAP admin commands

2020-09-15T10:28:25Z

Document LDAP admin commands

Raucao: /* Unified accounts for Kosmos services */

2020-09-13T12:01:55Z

Unified accounts for Kosmos services

Raucao: /* Changing your password */

2020-03-04T13:50:37Z

Changing your password

Raucao at 13:46, 4 March 2020

2020-03-04T13:46:25Z

Raucao: /* Unified accounts for Kosmos services */

2020-03-04T13:45:03Z

Unified accounts for Kosmos services

Raucao: /* Changing your password */

2020-03-04T13:42:29Z

Changing your password

Raucao: /* Unified accounts for Kosmos services */

2020-03-04T13:41:58Z

Unified accounts for Kosmos services

Greg: Update the instructions for the new LDAP directory structure, add XMPP to the list of services using unified credentials

2020-02-20T13:23:00Z

Update the instructions for the new LDAP directory structure, add XMPP to the list of services using unified credentials

Greg: Add information about the LDAP server and link to the tracking issue

2020-01-29T17:34:27Z

Add information about the LDAP server and link to the tracking issue

← Older revision		Revision as of 06:08, 16 September 2020
Line 4:		Line 4:

	The LDAP server is running on ldap.kosmos.org<ref>[[Infrastructure#barnard.kosmos.org\|Infrastructure]]</ref>.		The LDAP server is running on ldap.kosmos.org<ref>[[Infrastructure#barnard.kosmos.org\|Infrastructure]]</ref>.
−
−	~~== Admin commands ==~~
−
−	The ''ldapsearch'' and ''ldapadd'' command-line tool are provided by different packages depending on your OS. For example ''ldap-utils'' on Ubuntu, ''openldap-clients'' on Fedora, ''openldap'' on Arch Linux. It is already provided in a default macOS installation.
−
−	~~This can also be done using the LDAP client library of your choice.~~
−
−	~~=== Listing accounts ===~~
−
−	~~ldapsearch -x -W -D 'cn=Directory Manager' -b "ou=users,dc=kosmos,dc=org" -H "ldaps://ldap.kosmos.org"~~
−
−	~~=== Adding an account ===~~
−
−	~~==== Generate a hashed password ====~~
−
−	~~This example is using Ruby, but anything that can generate a salted SHA512 hash will also work.~~
−
−	~~$ ruby -r base64 -r digest -r securerandom -e 'salt = SecureRandom.hex(32); password = "random_password"; puts "{SSHA512}" + Base64.strict_encode64(Digest::SHA512.digest(password+salt) + salt)'~~
−	~~{SSHA512}WsELiZM9MlUM004LF3jpV5OuV+qTsGoRR1RzffdtUuPpzOl57I7WmKL+S46/KR8HUtYPRh1ttmsNvGUX/agxLjBkZGI0MTczNWNiZjkxMDI0NGEzZTE2ZDBlNGJkMDQ5N2ZhMjVjMjQ1NzFlZmJlNmZmODhmNjE5OGM1YWM3Zjc=~~
−
−	~~==== Add the account ====~~
−
−	~~ldapadd -x -W -D 'cn=Directory Manager' -H "ldaps://ldap.kosmos.org" << EOF~~
−	~~dn: cn=alice,ou=kosmos.org,cn=users,dc=kosmos,dc=org~~
−	~~objectClass: top~~
−	~~objectClass: account~~
−	~~objectClass: person~~
−	~~objectClass: extensibleObject~~
−	~~cn: alice~~
−	~~sn: alice~~
−	~~uid: alice~~
−	~~mail: alice@example.com~~
−	~~userPassword: {SSHA512}WsELiZM9MlUM004LF3jpV5OuV+qTsGoRR1RzffdtUuPpzOl57I7WmKL+S46/KR8HUtYPRh1ttmsNvGUX/agxLjBkZGI0MTczNWNiZjkxMDI0NGEzZTE2ZDBlNGJkMDQ5N2ZhMjVjMjQ1NzFlZmJlNmZmODhmNjE5OGM1YWM3Zjc=~~
−	~~EOF~~
−
−	~~adding new entry "cn=alice,ou=kosmos.org,cn=users,dc=kosmos,dc=org"~~

	== Changing your password ==		== Changing your password ==

← Older revision		Revision as of 10:28, 15 September 2020
Line 4:		Line 4:

	The LDAP server is running on ldap.kosmos.org<ref>[[Infrastructure#barnard.kosmos.org\|Infrastructure]]</ref>.		The LDAP server is running on ldap.kosmos.org<ref>[[Infrastructure#barnard.kosmos.org\|Infrastructure]]</ref>.
		+
		+	== Admin commands ==
		+
		+	The ''ldapsearch'' and ''ldapadd'' command-line tool are provided by different packages depending on your OS. For example ''ldap-utils'' on Ubuntu, ''openldap-clients'' on Fedora, ''openldap'' on Arch Linux. It is already provided in a default macOS installation.
		+
		+	This can also be done using the LDAP client library of your choice.
		+
		+	=== Listing accounts ===
		+
		+	ldapsearch -x -W -D 'cn=Directory Manager' -b "ou=users,dc=kosmos,dc=org" -H "ldaps://ldap.kosmos.org"
		+
		+	=== Adding an account ===
		+
		+	==== Generate a hashed password ====
		+
		+	This example is using Ruby, but anything that can generate a salted SHA512 hash will also work.
		+
		+	$ ruby -r base64 -r digest -r securerandom -e 'salt = SecureRandom.hex(32); password = "random_password"; puts "{SSHA512}" + Base64.strict_encode64(Digest::SHA512.digest(password+salt) + salt)'
		+	{SSHA512}WsELiZM9MlUM004LF3jpV5OuV+qTsGoRR1RzffdtUuPpzOl57I7WmKL+S46/KR8HUtYPRh1ttmsNvGUX/agxLjBkZGI0MTczNWNiZjkxMDI0NGEzZTE2ZDBlNGJkMDQ5N2ZhMjVjMjQ1NzFlZmJlNmZmODhmNjE5OGM1YWM3Zjc=
		+
		+	==== Add the account ====
		+
		+	ldapadd -x -W -D 'cn=Directory Manager' -H "ldaps://ldap.kosmos.org" << EOF
		+	dn: cn=alice,ou=kosmos.org,cn=users,dc=kosmos,dc=org
		+	objectClass: top
		+	objectClass: account
		+	objectClass: person
		+	objectClass: extensibleObject
		+	cn: alice
		+	sn: alice
		+	uid: alice
		+	mail: alice@example.com
		+	userPassword: {SSHA512}WsELiZM9MlUM004LF3jpV5OuV+qTsGoRR1RzffdtUuPpzOl57I7WmKL+S46/KR8HUtYPRh1ttmsNvGUX/agxLjBkZGI0MTczNWNiZjkxMDI0NGEzZTE2ZDBlNGJkMDQ5N2ZhMjVjMjQ1NzFlZmJlNmZmODhmNjE5OGM1YWM3Zjc=
		+	EOF
		+
		+	adding new entry "cn=alice,ou=kosmos.org,cn=users,dc=kosmos,dc=org"

	== Changing your password ==		== Changing your password ==

← Older revision		Revision as of 12:01, 13 September 2020
Line 4:		Line 4:

	The LDAP server is running on ldap.kosmos.org<ref>[[Infrastructure#barnard.kosmos.org\|Infrastructure]]</ref>.		The LDAP server is running on ldap.kosmos.org<ref>[[Infrastructure#barnard.kosmos.org\|Infrastructure]]</ref>.
−
−	~~You can follow the status of the switch to LDAP for the other Kosmos services [https://gitea.kosmos.org/kosmos/chef/issues/126 in this tracking issue].~~

	== Changing your password ==		== Changing your password ==

@@ Line 9: / Line 9: @@
 == Changing your password ==
-Changing your password will be made possible in the upcoming [https://gitea.kosmos.org/kosmos/akkounts-web/issues/5 Kosmos Accounts Web UI], but for now some command-line knowledge is required to change your password.
+Changing your password will be made possible in the upcoming [https://gitea.kosmos.org/kosmos/akkounts-web/issues/5 Kosmos Accounts Web UI]. But for now, you have these two options:
 The ''ldappasswd'' command-line tool is provided by different packages depending on your OS. For example ''ldap-utils'' on Ubuntu, ''openldap-clients'' on Fedora, ''openldap'' on Arch Linux. It is already provided in a default macOS installation.

@@ Line 7: / Line 7: @@
 You can follow the status of the switch to LDAP for the other Kosmos services [https://gitea.kosmos.org/kosmos/chef/issues/126 in this tracking issue].
-=== Changing your password ===
+== Changing your password ==
 Changing your password will be made possible in the upcoming [https://gitea.kosmos.org/kosmos/akkounts-web/issues/5 Kosmos Accounts Web UI], but for now some command-line knowledge is required to change your password.

@@ Line 3: / Line 3: @@
 '''''This is work in progress!''''' For now, unified accounts are only enabled on this wiki and [[Services:XMPP|XMPP]]. We have decided to use LDAP<ref>[https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol Lightweight Directory Access Protocol]</ref> to let users have the same credentials (username and password) across Kosmos services.
-The LDAP server is running on ldap.kosmos.org (on barnard, see [[Infrastructure#barnard.kosmos.org|Infrastructure]])
+The LDAP server is running on ldap.kosmos.org<ref>[[Infrastructure#barnard.kosmos.org|Infrastructure]]</ref>.
-You can [https://gitea.kosmos.org/kosmos/chef/issues/126 follow the status] of the switch to LDAP for the other Kosmos services
+You can follow the status of the switch to LDAP for the other Kosmos services [https://gitea.kosmos.org/kosmos/chef/issues/126 in this tracking issue].
 === Changing your password ===

@@ Line 13: / Line 13: @@
 The ''ldappasswd'' command-line tool is provided by different packages depending on your OS. For example ''ldap-utils'' on Ubuntu, ''openldap-clients'' on Fedora, ''openldap'' on Arch Linux. It is already provided in a default macOS installation.
-The following command will set your new password, if you type your current password (replace '''yourusername''' with your username)
+The following command will set your new password, if you type your current password (replace '''yourusername''' with your username):
   ldappasswd -x -D cn=''''yourusername'''',ou=kosmos.org,cn=users,dc=kosmos,dc=org -W -S -H "ldaps://ldap.kosmos.org"
@@ Line 25: / Line 25: @@
 "New password" is the password that will be set on your LDAP account. "LDAP password" is your current password
-If you need any help do not hesitate to ask for help in our [[Main_Page#Chat|chatroom]]
+If you need any help do not hesitate to ask for help in our [[Main_Page#Chat|chatroom]].
 == References ==
 <references />

@@ Line 1: / Line 1: @@
 == Unified accounts for Kosmos services ==
-'''''This is work in progress!''''' For now, unified accounts are only enabled on this wiki. We have decided to use LDAP<ref>[https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol Lightweight Directory Access Protocol]</ref> to let users have the same credentials (username and password) across Kosmos services.
+'''''This is work in progress!''''' For now, unified accounts are only enabled on this wiki and [[Services:XMPP|XMPP]]. We have decided to use LDAP<ref>[https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol Lightweight Directory Access Protocol]</ref> to let users have the same credentials (username and password) across Kosmos services.
 The LDAP server is running on ldap.kosmos.org (on barnard, see [[Infrastructure#barnard.kosmos.org|Infrastructure]])
@@ Line 15: / Line 15: @@
 The following command will set your new password, if you type your current password (replace '''yourusername''' with your username)
-  ldappasswd -x -D cn=''''yourusername'''',ou=users,dc=kosmos,dc=org -W -S -H "ldaps://ldap.kosmos.org"
+  ldappasswd -x -D cn=''''yourusername'''',ou=kosmos.org,cn=users,dc=kosmos,dc=org -W -S -H "ldaps://ldap.kosmos.org"
 It will ask you the following passwords:

← Older revision		Revision as of 17:34, 29 January 2020
Line 2:		Line 2:

	'''''This is work in progress!''''' For now, unified accounts are only enabled on this wiki. We have decided to use LDAP<ref>[https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol Lightweight Directory Access Protocol]</ref> to let users have the same credentials (username and password) across Kosmos services.		'''''This is work in progress!''''' For now, unified accounts are only enabled on this wiki. We have decided to use LDAP<ref>[https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol Lightweight Directory Access Protocol]</ref> to let users have the same credentials (username and password) across Kosmos services.
		+
		+	The LDAP server is running on ldap.kosmos.org (on barnard, see [[Infrastructure#barnard.kosmos.org\|Infrastructure]])
		+
		+	You can [https://gitea.kosmos.org/kosmos/chef/issues/126 follow the status] of the switch to LDAP for the other Kosmos services

	=== Changing your password ===		=== Changing your password ===