Differences

This shows you the differences between two versions of the page.

--- other:ldap [2021/04/03 21:20]
nanodano
+++ other:ldap [2021/04/03 22:04] (current)
nanodano [web2ldap]
@@ Line 88: / Line 88: @@
 </code>
-TODO: Setup certbot auto renew, with a post hook to restart slapd
+If you want to setup certbot to auto-renew certificates, add it into your crontab.
+<code>
+crontab -e  # As root
+# And add the following line to renew at 4:24am on 3rd day of month
+4 3 * *  certbot renew --post-hook "systemctl restart slapd"
+</code>
 At this point you can use StartTLS on the ldap:// port.
@@ Line 155: / Line 162: @@
 ==== Apache Directory Studio ====
-[[https://directory.apache.org/studio/|Apache Directory Studio]], a desktop application for interacting with any LDAP server.
+[[https://directory.apache.org/studio/|Apache Directory Studio]], a desktop application for interacting with any LDAP server. It didn't work with Java 14 and I needed OpenJDK 11 as of March 2021. Download OpenJDK from [[https://adoptopenjdk.net]].
+To add a new server connection, go to ''New LDAP Browser | LDAP Connection''.
+Use Simple Authentication, NOTE: When setting up the connection, and it asks about ''Edit Options'', you might choose ''Always use REPLACE'' otherwise you might get errors when trying to modify certain values with an error like "noSuchAttribute".
+To add a user, right click on the top level object and add New Entry (Create from Scratch).
+Give it two object classes: ''organizationalRole'' and ''simpleSecurityObject''.
+Give it RDN of ''cn'' and then it will ask for a password.
 ==== JXplorer ====
+[[http://jxplorer.org|JXplorer]] is a GUI application for interacting with LDAP servers, though it's not the best. It does not seem to support StartTLS, only plain-text and LDAPS. I have not used it a ton, but I found it to be kind of weak and Apache Directory Studio seems much more featured.
 ==== web2ldap ====
-Libraries
+[[https://www.web2ldap.de|web2ldap]] is a web application for managing LDAP servers.
+To install it in Debian,
+<code bash>
+sudo apt install python3-venv rustc python3-dev libsasl2-dev libldap2-dev libssl-dev
+python3 -m pip install web2ldap
+</code>
+To run, it, simply invoke the script provided by the pip package:
+<code bash>
+web2ldap
+</code>
+Then connect to it in a browser, using the address it outputs. For example. [[http://localhost:1760/web2ldap]]
+Click connect to a server, then click on 'Bind' and do Simple bind, bind as `admin` and then choose identification search, e.g. ''dc=devdungeon,dc=com'' and login.
+When you CLICK into an OU or group, your whole context changes. When you click "new Entry", it will add that entry in the location based on your breadcrumbs at the top. Be careful it's not nesting it under something unexpected.
+To move a user, go to Tree, view user, and click Rename on right side. Change superior DN to include the new OU info.
 ==== Python Library ====
@@ Line 214: / Line 254: @@
 ==== Java Library ====
-https://directory.apache.org/api/
+There is a Java library provided by the Apache Directory project: [[https://directory.apache.org/api/]]. You can use this to interact with LDAP servers in Java.
@@ Line 224: / Line 264: @@
 <code bash>
-# Pass a file
+# Pass a file with `-f`. Use `-Y EXTERNAL` for server configs.
 ldapmodify -H ldapi:/// -Y EXTERNAL -f change.ldif
-# Or bind using an admin account
+# Or bind using an admin account with `-W -D <dn>`
 ldapmodify -H ldapi:/// -f change.ldif -D cn=admin,dc=devdungeon,dc=com -W
@@ Line 263: / Line 303: @@
 objectClass: top
 objectClass: simpleSecurityObject
-userPassword:: e2NTSEF9UUlUdmFHQmRIR29RVTBFakl2UGdUL3VNc2ZjRmg2STJaeW4zQOE9PQ=
+# Salted SHA password provided by `slappasswd`
- =
+userPassword: {SSHA}s123K9t/R9Y79Sb1VZINlXVzjjD31TJp
 </code>
-If you need a hashed password to provide to the ''userPassword'' value, you can use ''slappasswd'':
-<code bash>
-slappasswd
-</code>
 ==== Delete an OU ====
@@ Line 287: / Line 324: @@
 </code>
+==== Update TLS certificates ====
+When updating the certificates, you are modifying ''cn=config'' and not a regular organizational unit.
+<code ldif update_certs.ldif>
+# If using `ldapmodify`, use auth option of `-Y EXTERNAL`
+# instead of `-W -D cn=admin,dc=devdungeon,dc=com`
+# since it affects the server config directly
+dn: cn=config
+changetype: modify
+replace: olcTLSCertificateFile
+olcTLSCertificateFile: /etc/letsencrypt/live/ldap.devdungeon.com/cert.pem
+-
+replace: olcTLSCertificateKeyFile
+olcTLSCertificateKeyFile: /etc/letsencrypt/live/ldap.devdungeon.com/privkey.pem
+</code>

DevDungeon Wiki

User Tools

Site Tools

Differences

Page Tools