1 Samba4 OpenLDAP-Backend Quick-Howto
2 ====================================
4 oliver@itc.li - August 2009
7 This Mini-Howto describes in a very simplified way
8 how to setup Samba 4 (S4) (pre)Alpha 9 with the
9 OpenLDAP (OL) -Backend.
10 Use of OpenLDAP >= 2.4.17 is strongly recommended.
13 1.) Download and compile OpenLDAP.
15 The use of (older) Versions shipped with Distributions often
16 causes trouble, so dont use them. Configure-Example:
18 #> ./configure --enable-overlays=yes --with-tls=yes --with-cyrus-sasl=yes
19 #> make depend && make && make install
21 Note: openssl and cyrus-sasl libs should be installed
26 2.) Prepare S4 to use OL-Backend:
28 Run the provision-backend Python-Script first, then "final" provision
29 (these 2-step process will be merged in the future)
31 Simple provision-backend Example:
33 #> setup/provision-backend --realm=ldap.local.site \
34 --domain=LDAP --ldap-admin-pass="linux" \
35 --ldap-backend-type=openldap \
36 --server-role='domain controller' \
37 --ol-slapd="/usr/local/libexec"
39 After that, you should get a similar output:
42 Your openldap Backend for Samba4 is now configured, and is ready to be started
43 Server Role: domain controller
45 DNS Domain: ldap.local.site
46 Base DN: DC=ldap,DC=local,DC=site
47 LDAP admin user: samba-admin
48 LDAP admin password: linux
50 (1, 'connection to remote LDAP server dropped?')
51 Ok. - No other slapd-Instance listening on: ldapi://%2Fusr%2Flocal%2Fsamba%2Fprivate%2Fldap%2Fldapi. Starting al provision.
52 Started slapd for final provisioning with PID: 21728
54 Now run final provision with: --ldap-backend=ldapi --ldap-backend-type=openldap --password=linux --username=sa=ldap.local.site --domain=LDAP --server-role='domain controller'
58 Since this (pre)Alpha, you dont have to run slapd manually
59 any more. slapd will be started automatically, when
60 provision-backend is done, listening on the
61 ldapi://-Socket. System should be ready
62 for final provision now:
67 Use the Parameters displayed above to run final provision.
68 (you can add --adminpass=<yourpass> to the parameters,
69 otherwise a random password will be generated for
70 cn=Administrator,cn=users,<Your Base-DN>):
72 #> setup/provision --ldap-backend=ldapi \
73 --ldap-backend-type=openldap --password=linux \
74 --username=samba-admin --realm=ldap.local.site \
75 --domain=LDAP --server-role='domain controller'\
78 At the End of the final provision you should get
79 the following output (only partial here). Read it carefully:
83 A Kerberos configuration suitable for Samba 4 has been generated at /usr/local/samba/private/krb5.conf
84 LDAP Debug-Output:[Message({'dn': Dn(''), 'objectClass': MessageElement(['top','OpenLDAProotDSE'])})]
85 slapd-PID-File found. PID is :21728
87 File from provision-backend with stored PID found. PID is :21728
89 slapd-Process used for provisioning with PID: 21728
90 will now be shut down.
91 slapd-Process used for final provision was properly shut down.
92 Use later the following commandline to start slapd, then Samba:
93 /usr/local/libexec/slapd -f /usr/local/samba/private/ldap/slapd.conf -h ldapi://%2Fusr%2Flocal%2Fsamba%2Fprivate%2Fldap%2Fldapi
95 This slapd-Commandline is also stored under: /usr/local/samba/private/ldap/slapd_command_file.txt
96 Please install the phpLDAPadmin configuration located at /usr/local/samba/private/phpldapadmin-config.php into /etc/phpldapadmin/config.php
97 Once the above files are installed, your Samba4 server will be ready to use
98 Server Role: domain controller
101 DNS Domain: ldap.local.site
102 DOMAIN SID: S-1-5-21-429312062-2328781357-2130201529
103 Admin password: linux
107 Our slapd in "provision-mode" wiil be shut down automatically
108 after final provision ends.
113 After you completed the other necessary steps (krb and named-specific),
114 start first OL with the commandline displayed in the output under (3),
115 (remember: the slapd-Commandline is also stored in the file ../slapd_command_file.txt)
120 5.) Special Setup-Types:
122 a) OpenLDAP-Online Configuration (olc):
123 Use the provision-backend Parameter
127 In that case, the olc will be setup automatically
128 under ../private/slapd.d/.
129 olc is accessible via "cn=samba-admin,cn=samba" and Base-DN "cn=config"
130 olc is intended primarily for use in conjunction with MMR
132 Attention: You have to start OL with the commandline
133 displayed in the output under (3), but you have to set a
134 listening port of slapd manually:
136 (e.g. -h ldap://ldapmaster.ldap.local.site:9000)
138 Attention: You _should_not_ edit the olc-Sections
139 "config" and "ldif", as these are vital to the olc itself.
142 b) MultiMaster-Configuration (MMR):
143 At this time (S4 (pre)Alpha9) the only possible Replication setup.
144 Use the provision-backend Parameter:
146 --ol-mmr-urls=<list of whitespace separated ldap-urls (and Ports <> 389!).
149 --ol-mmr-urls="ldap://ldapmaster1.ldap.local.site:9000 \
150 ldap://ldapmaster2.ldap.local.site:9000"
152 Attention: You have to start OL with the commandline
153 displayed in the output under (3), but you have to set a
154 listening port of slapd manually
155 (e.g. -h ldap://ldapmaster1.ldap.local.site:9000)
157 The Ports must be different from 389, as these are occupied by S4.