Download LDAP System Administration

[ Team LiB ]
## core.schema is required for all servers.
include /usr/local/etc/openldap/schema/core.schema
## Included from Chapter 6
include /usr/local/etc/openldap/schema/cosine.schema
include /usr/local/etc/openldap/schema/nis.schema
## Included from Chapter 7
include /usr/local/etc/openldap/schema/inetorgperson.schema
## Dependencies for samba.schema: cosine.schema and inetorgperson.schema needed to
## support --with-ldapsam in Samba
include /usr/local/etc/openldap/schema/samba.schema
##
Support for
FreeRadius depends on samba.schema for LM/NT password attributes.
•
Table of Contents
include /usr/local/etc/openldap/schema/RADIUS-LDAPv3.schema
•
Index
•
Reviews
The mapping between LDAP attributes and RADIUS attributes is stored in a text file named ldap.attrmap by
•
Reader Reviews
default. Conventionally,
this file is stored in the raddb/ directory, but both the name and location are configurable
•
Errata
via the rlm_ldap
module's dictionary_mapping parameter. Because we will be using the default schema file, the
corresponding
attribute
dictionary is sufficient. If you decide to use a custom schema, you may have to modify the
LDAP System
Administration
dictionary
as well.
By
Gerald Carter
Your next hurdle is decide where to store the radiusprofile entries in the directory. Your first choice might be
Publisher
: O'Reilly
to store them with the other user account information below the peopleou. The problem is that you cannot add
Pub
Date
: March 2003
theradiusprofile
object to your existing users' accounts. You can either change the radiusprofile definition
ISBN
: 1-56592-491-6
to an auxiliary
object or choose to store objects of this type somewhere else. Following the trend of using provided
Pages
: 308
schemas whenever
possible, we will create a new organizational unit to hold FreeRadius users and establish a link
between the posixAccount and the radiusprofile objects.
First, create a new ou=radius entry below the servicesou (created in Chapter 7 for Sendmail):
If you want to be a master of your domain, LDAP System Administration will help you get up and running quickly
dn: ou=radius,ou=services,dc=plainjoe,dc=org
regardless of which LDAP version you use. After reading this book, even with no previous LDAP experience, you'll
objectclass: organizationalUnit
be able to integrate a directory server into essential network services such as mail, DNS, HTTP, and SMB/CIFS.
ou: radius
[ Team LiB ]
Next, create a profile for the user kristi. The difficulty with this is choosing the RDN for the entry. You have already
chosen the uid attribute as the unique naming convention for entries below ou=people. However, the
radiusprofile object includes only the cn attribute. The informational RFC 2377 defines an auxiliary uidObject
class for situations such as this one. This allows you to include the uid attribute as the RDN for new entries
regardless of the structural object class and still maintain your internal naming conventions. You could just use an
extensibleObject, but the uidObject is a cleaner approach. Here is the resulting RADIUS user entry:
dn: uid=kristi,ou=radius,ou=services,dc=plainjoe,dc=org
objectclass: radiusprofile
objectclass: uidObject
uid: kristi
cn: Kristi Carter
radiusAuthType: LDAP
Finally, link the posixAccount entry for kristi to her RADIUS information by storing the DN of the
radiusprofile object in uid=kristi,ou=people,dc=plainjoe,dc=org. This time we will use the
extensibleObject to add the extra attribute. To make the new attributes easier to see, most of the existing
optional attributes have been omitted from this LDIF excerpt. Added attributes are shown in bold.
## Existing optional attributes have been omitted from the display.
dn: uid=kristi,ou=people,dc=plainjoe,dc=org
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: sambaAccount
objectclass: extensibleObject
cn: Kristi Carter
cn: Kristi W. Carter