Unfortunately, the guides on the web don't seem to work out of the box.
Fortunately, this way I have a chance to understand something about LDAP, ldif and the machinery.
I am following
https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html
Samba 3.5.7
slap 2.4.21
ldap-tools
clean the system and populate the ldap db
#sudo apt-get purge slapd
#sudo apt-get install slapd
#sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif
#sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif
#sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif
next create a backend (dc=linux,dc=local) as backend.linux.local.ldif
(here I have integrated the guide with http://ubuntuforums.org/archive/index.php/t-1313472.html)
# Load dynamic backend modules
dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib/ldap
olcModuleload: {0}back_hdb
# Database settings
dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcSuffix: dc=linux,dc=local
olcDbDirectory: /var/lib/ldap
olcRootDN: cn=admin,dc=linux,dc=local
olcRootPW: setyourpasswordhere
olcDbConfig: {0}set_cachesize 0 2097152 0
olcDbConfig: {1}set_lk_max_objects 1500
olcDbConfig: {2}set_lk_max_locks 1500
olcDbConfig: {3}set_lk_max_lockers 1500
olcLastMod: TRUE
olcDbCheckpoint: 512 30
olcDbIndex: uid pres,eq
olcDbIndex: cn,sn,mail pres,eq,approx,sub
olcDbIndex: objectClass eq
olcAccess: to attrs=userPassword by dn="cn=admin,dc=linux,dc=local" write by anonymous auth by self write by * none
olcAccess: to attrs=shadowLastChange by self write by * read
olcAccess: to dn.base="" by * read
olcAccess: to * by dn="cn=admin,dc=linux,dc=local" write by * read
then add the file to ldap
#ldapadd -Y EXTERNAL -H ldapi:/// -f backend.linux.local.ldif
Now it's the time to populate the frontend
Here's the file content
# Create top-level object in domain
dn: dc=linux,dc=local
objectClass: top
objectClass: dcObject
objectclass: organization
o: Enaip Arco
description: LDAP Enaip
# Admin user.
dn: cn=admin,dc=linux,dc=local
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword: your password here
dn: ou=people,dc=linux,dc=local
objectClass: organizationalUnit
ou: people
dn: ou=groups,dc=linux,dc=local
objectClass: organizationalUnit
ou: groups
dn: uid=marco,ou=people,dc=linux,dc=local
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: marco
sn: C
givenName: Marco
cn: marco c
displayName: Marco C
uidNumber: 1000
gidNumber: 10000
userPassword: marco1.0marco
gecos: Marco C
loginShell: /bin/bash
homeDirectory: /home/marco
shadowExpire: -1
shadowFlag: 0
shadowWarning: 7
shadowMin: 8
shadowMax: 999999
shadowLastChange: 10877
mail: marcoc@linux.local
postalCode: 38066
l: Arco
o: Example
mobile: +33 (0)6 xx xx xx xx
homePhone: +33 (0)5 xx xx xx xx
title: System Administrator
postalAddress:
initials: MC
dn: cn=studenti,ou=groups,dc=linux,dc=local
objectClass: posixGroup
cn: studenti
gidNumber: 10001
dn: cn=docenti,ou=groups,dc=linux,dc=local
objectClass: posixGroup
cn: docenti
gidnumber: 10002
dn: cn=tecnici,ou=groups,dc=linux,dc=local
objectClass: posixGroup
cn: tecnici
gidNumber: 10000
Please note that the command to add it it's now different:
ldapadd -x -D cn=admin,dc=linux,dc=local -W -f frontend.linux.local.ldif
Now if you have not got any errors, the following command should work
ldapsearch -xLLL -b "dc=linux,dc=local" uid=marco sn givenName cn
Accomplished these steps, I then went to guide https://help.ubuntu.com/10.04/serverguide/C/samba-ldap.html
I had to modify the guide.
First, the following command
#slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "cn={12}samba,cn=schema,cn=config" > /tmp/cn=samba.ldif
had to be as follows
slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "cn={13}samba,cn=schema,cn=config" > /tmp/cn=samba.ldif
((note the number) which I discovered after much pain looking in the subdirs in /tmp/ldif_output/cn=config/cn=schema
Second, as said here
http://ubuntuforums.org/archive/index.php/t-1501799.html
the /tmp/cn=samba.ldif file should be modified in the tail (removing last lines, from
structuralObjectClass: olcSchemaConfig
Also, the attempt to add the samba.ldif schema using the suggested
#ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\=samba.ldiffailed.
You should use
#sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/cn\=samba.ldif
Now I am greeted with a
"adding new entry cn={13}samba,cn=schema,cn=config"
without errors.
About the "invalid credentials" here pretend that the password should be hashed.
(a workaround: put these lines
dn: cn=config
changetype: modify
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootDN
olcRootDN: cn=admin,cn=config
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {MD5}your password here
dn: olcDatabase={0}config,cn=config
changetype: modify
delete: olcAccess
in a file and then add it to ldap
I also found that the proposed samba_indexes.ldif
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: uidNumber eq
olcDbIndex: gidNumber eq
olcDbIndex: loginShell eq
olcDbIndex: uid eq,pres,sub
olcDbIndex: memberUid eq,pres,sub
olcDbIndex: uniqueMember eq,pres
olcDbIndex: sambaSID eq
olcDbIndex: sambaPrimaryGroupSID eq
olcDbIndex: sambaGroupType eq
olcDbIndex: sambaSIDList eq
olcDbIndex: sambaDomainName eq
olcDbIndex: default sub
was incorrect, but the workaround for me was not, as there is pretended, to comment out uidNumber, but the line with
olcDbIndex: uid eq,pres,sub
Next step is to use smbldap-tools
#sudo gzip -d /usr/share/doc/smbldap-tools/configure.pl.gz
#sudo perl /usr/share/doc/smbldap-tools/configure.pl
Fine, but configure.pl pose many questions, not at all trivial
here there is a debian-base guide to understand what you're doing (in italian)
...to be continued
