SAC:Setup LDAP Authentication - Revision history

Warmerdam at 05:19, 28 September 2011

2011-09-28T05:19:28Z

Warmerdam: Replaced content with "Instructions for setting up LDAP login on OSL hosted VMs. This should be done as part of the SAC:Standard System Setup process. Category:Infrastructure"

2011-09-28T04:32:21Z

Replaced content with "Instructions for setting up LDAP login on OSL hosted VMs. This should be done as part of the SAC:Standard System Setup process. Category:Infrastructure"

Warmerdam: add notes on how to edit the ldap shell access group.

2009-06-04T16:13:06Z

add notes on how to edit the ldap shell access group.

Wiki-Hobu: /* Setting up FC4 to use LDAP for login authentication */

2009-03-30T15:15:42Z

Setting up FC4 to use LDAP for login authentication

Neteler: /* Pointers to good LDAP information */

2007-08-27T10:58:05Z

Pointers to good LDAP information

Warmerdam: added sudo info.

2006-10-11T17:29:00Z

added sudo info.

Warmerdam at 16:48, 20 July 2006

2006-07-20T16:48:35Z

Warmerdam: Added notes on mkhomedir stuff.

2006-07-20T16:32:24Z

Added notes on mkhomedir stuff.

Warmerdam: shell group fix.

2006-07-19T20:13:36Z

shell group fix.

Warmerdam: /* Setting up FC4 to use LDAP for login authentication */ remove yum stuff.

2006-07-19T16:53:55Z

Setting up FC4 to use LDAP for login authentication: remove yum stuff.

← Older revision		Revision as of 05:19, 28 September 2011
Line 1:		Line 1:
	Instructions for setting up LDAP login on [[OSL]] hosted VMs. This should be done as part of the [[SAC:Standard System Setup]] process.		Instructions for setting up LDAP login on [[OSL]] hosted VMs. This should be done as part of the [[SAC:Standard System Setup]] process.
−
−

	[[Category:Infrastructure]]		[[Category:Infrastructure]]

← Older revision		Revision as of 04:32, 28 September 2011
Line 1:		Line 1:
−	~~= Setting~~ up ~~FC4 to use~~ LDAP ~~for~~ login ~~authentication =~~	+	Instructions for setting up LDAP login on [[OSL]] hosted VMs. This should be done as part of the [[SAC:Standard System Setup]] process.

−	~~Run:~~

−	~~sudo authconfig~~
−
−	~~Enabled LDAP on first screen like this:~~
−
−	~~│ User Information Authentication │~~
−	~~│ [ ] Cache Information [*] Use MD5 Passwords │~~
−	~~│ [ ] Use Hesiod [*] Use Shadow Passwords │~~
−	~~│ [] Use LDAP [] Use LDAP Authentication │~~
−	~~│ [ ] Use NIS [ ] Use Kerberos │~~
−	~~│ [ ] Use Winbind [ ] Use SMB Authentication │~~
−	~~│ [ ] Use Winbind Authentication │~~
−	~~│ [ ] Local authorization is sufficient │~~
−
−	~~Enter LDAP Settings like this:~~
−
−	~~│ [x] Use TLS │~~
−	~~│ Server: ldap.osgeo.org__________________________ │~~
−	~~│ Base DN: ou=People,dc=osgeo,dc=org_______________ │~~
−
−	~~authconfig sets a number of PAM-related items for us, but it does a poor job of setting up the LDAP configuration. We are going to edit /etc/ldap.conf and change it to look like this:~~
−
−	~~BASE dc=osgeo, dc=org~~
−	~~URI ldaps://ldap.osgeo.org~~
−	~~pam_groupdn cn=telascience,ou=Shell,dc=osgeo,dc=org~~
−	~~nss_base_passwd ou=People,dc=osgeo,dc=org~~
−	~~nss_base_shadow ou=People,dc=osgeo,dc=org~~
−	~~nss_base_group ou=Group,dc=osgeo,dc=org~~
−	~~ldap_version 3~~
−	~~TLS_CHECKPEER yes~~
−	~~TLS_REQCERT demand~~
−	~~TLS_CACERTDIR /etc/openldap/cacerts~~
−	~~pam_password md5~~
−
−	~~After editing /etc/ldap.conf, we need to link /etc/openldap/ldap.conf to use that one, instead of its own.~~
−
−	~~mv /etc/openldap/ldap.conf /etc/openldap/ldap.conf.original~~
−	~~ln -s /etc/ldap.conf /etc/openldap/ldap.conf~~
−
−	~~Next, you need to scp the DigiCertCA.crt from one of the existing blades to the machine you are enabling:~~
−
−	~~scp /etc/openldap/cacerts/DigiCertCA.crt hobu@mynewblade:/home/hobu~~
−
−	~~Once there, mv it into the same location:~~
−
−	~~sudo mv DigiCertCA.crt /etc/openldap/cacerts~~
−
−	~~Once this is setup people can be added to the OSGeo LDAP Shell group by adding them at the following url for those already in the group:~~
−
−	~~https://www.osgeo.org/cgi-bin/auth/ldap_shell.py~~
−
−	~~Sudo access must be added locally per server.~~
−
−	~~= Setting up SVN server to use LDAP authentication =~~
−
−	~~= Setting up Bugzilla to use LDAP Authentication =~~
−
−	~~Details at http://www.bugzilla.org/docs/tip/html/extraconfig.html#bzldap~~
−
−	It seems that the LDAP entries require an email attribute that bugzilla can use for sending email, but generally speaking this seems like a well supported option for bugzilla. I do wonder if there is an option for users not in LDAP to create accounts in bugzilla for the purpose of submitting bugs. I think this is desirable or even necessary!
−
−	~~= sudo =~~
−
−	~~http://www.courtesan.com/sudo/readme_ldap.html~~
−
−	~~= Pointers to good LDAP information =~~
−
−	* http://ldots.org/ldap - moderately helpful.

	[[Category:Infrastructure]]		[[Category:Infrastructure]]

← Older revision		Revision as of 16:13, 4 June 2009
Line 48:		Line 48:

	sudo mv DigiCertCA.crt /etc/openldap/cacerts		sudo mv DigiCertCA.crt /etc/openldap/cacerts
		+
		+	Once this is setup people can be added to the OSGeo LDAP Shell group by adding them at the following url for those already in the group:
		+
		+	https://www.osgeo.org/cgi-bin/auth/ldap_shell.py
		+
		+	Sudo access must be added locally per server.

	= Setting up SVN server to use LDAP authentication =		= Setting up SVN server to use LDAP authentication =

@@ Line 18: / Line 18: @@
 Enter LDAP Settings like this:
-       │          [ ] Use TLS                              │
+       │          [x] Use TLS                              │
-       │  Server: ldap.telascience.org____________________ │
+       │  Server: ldap.osgeo.org__________________________ │
-       │ Base DN: dc=telascience,dc=org___________________ │
+       │ Base DN: ou=People,dc=osgeo,dc=org_______________ │
-Edit /etc/ldap.conf and change pam_groupdn line to read:
+authconfig sets a number of PAM-related items for us, but it does a poor job of setting up the LDAP configuration.  We are going to edit /etc/ldap.conf and change it to look like this:
-   pam_groupdn cn=Shell,ou=Groups,dc=telascience,dc=org
+  BASE dc=osgeo, dc=org
-(or possibly cn=Admin for medium security systems)
+After editing /etc/ldap.conf, we need to link /etc/openldap/ldap.conf to use that one, instead of its own.
 = Setting up SVN server to use LDAP authentication =

← Older revision		Revision as of 10:58, 27 August 2007
Line 43:		Line 43:

	* http://ldots.org/ldap - moderately helpful.		* http://ldots.org/ldap - moderately helpful.
		+
		+	[[Category:Infrastructure]]

@@ Line 35: / Line 35: @@
 It seems that the LDAP entries require an email attribute that bugzilla can use for sending email, but generally speaking this seems like a well supported option for bugzilla.  I do wonder if there is an option for users not in LDAP to create accounts in bugzilla for the purpose of submitting bugs.  I think this is desirable or even necessary!
 = Pointers to good LDAP information =
 * http://ldots.org/ldap - moderately helpful.

← Older revision		Revision as of 16:48, 20 July 2006
Line 27:		Line 27:

	(or possibly cn=Admin for medium security systems)		(or possibly cn=Admin for medium security systems)
−
−	~~Add the following line to /etc/pam.d/login and /etc/pam.d/sshd:~~
−
−	~~session required pam_mkhomedir.so skel=/etc/skel umask=0022~~

	= Setting up SVN server to use LDAP authentication =		= Setting up SVN server to use LDAP authentication =

← Older revision		Revision as of 16:32, 20 July 2006
Line 27:		Line 27:

	(or possibly cn=Admin for medium security systems)		(or possibly cn=Admin for medium security systems)
		+
		+	Add the following line to /etc/pam.d/login and /etc/pam.d/sshd:
		+
		+	session required pam_mkhomedir.so skel=/etc/skel umask=0022

	= Setting up SVN server to use LDAP authentication =		= Setting up SVN server to use LDAP authentication =