diff options
Diffstat (limited to 'docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml')
| -rw-r--r-- | docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml | 89 |
1 files changed, 68 insertions, 21 deletions
diff --git a/docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml b/docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml index a66df0c7676..6b153af6feb 100644 --- a/docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml +++ b/docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml @@ -15,7 +15,7 @@ </author> - <pubdate> (13 Jan 2002) </pubdate> + <pubdate> (16 Jun 2002) </pubdate> </chapterinfo> <title>Storing Samba's User/Machine Account information in an LDAP Directory</title> @@ -39,7 +39,7 @@ on LDAP architectures and Directories, please refer to the following sites. <para> Note that <ulink url="http://www.ora.com/">O'Reilly Publishing</ulink> is working on a guide to LDAP for System Administrators which has a planned release date of -early summer, 2002. +late 2002. </para> <para> @@ -51,7 +51,8 @@ Two additional Samba resources which may prove to be helpful are maintained by Ignacio Coupeau.</para></listitem> <listitem><para>The NT migration scripts from <ulink url="http://samba.idealx.org/">IDEALX</ulink> that are - geared to manage users and group in such a Samba-LDAP Domain Controller configuration. + geared to manage users and group in such a Samba-LDAP Domain Controller configuration. These scripts can + be found in the Samba 2.2.5 release in the <filename>examples/LDAP/smbldap-tools/</filename> directory. </para></listitem> </itemizedlist> @@ -75,7 +76,7 @@ in the thousands). The first is that all lookups must be performed sequentially. Given that there are approximately two lookups per domain logon (one for a normal session connection such as when mapping a network drive or printer), this -is a performance bottleneck for lareg sites. What is needed is an indexed approach +is a performance bottleneck for large sites. What is needed is an indexed approach such as is used in databases. </para></listitem> @@ -96,7 +97,7 @@ Identified (RID). <para> As a result of these defeciencies, a more robust means of storing user attributes -used by smbd was developed. The API which defines access to user accounts +used by <command>smbd</command> was developed. The API which defines access to user accounts is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support for a samdb backend (e.g. <parameter>--with-ldapsam</parameter> or @@ -105,7 +106,7 @@ for a samdb backend (e.g. <parameter>--with-ldapsam</parameter> or <para> When compiling Samba to include the <parameter>--with-ldapsam</parameter> autoconf -option, smbd (and associated tools) will store and lookup user accounts in +option, <command>smbd</command> (and associated tools) will store and lookup user accounts in an LDAP directory. In reality, this is very easy to understand. If you are comfortable with using an smbpasswd file, simply replace "smbpasswd" with "LDAP directory" in all the documentation. @@ -162,7 +163,7 @@ in 2.2.2). The sambaAccount objectclass is given here: </para> <para><programlisting> -objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL +objectclass ( 1.3.1.5.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILARY DESC 'Samba Account' MUST ( uid $ rid ) MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $ @@ -172,29 +173,45 @@ objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL </programlisting></para> <para> -The samba.schema file has been formatted for OpenLDAP 2.0. The OID's are +The <filename>samba.schema</filename> file has been formatted for OpenLDAP 2.0 & 2.1. The OID's are owned by the Samba Team and as such is legal to be openly published. If you translate the schema to be used with Netscape DS, please -submit the modified schema file as a patch to <ulink -url="jerry@samba.org">jerry@samba.org</ulink> +submit the modified schema file as a patch to <ulink url="jerry@samba.org">jerry@samba.org</ulink> +</para> + +<para> +Since the original release, schema files for +</para> + +<itemizedlist> + <listitem><para>IBM's SecureWay Server</para></listitem> + <listitem><para>Netscape Directory Server version 4.x and 5.x</para></listitem> +</itemizedlist> + +<para> +have been submitted and included in the Samba source distribution. I cannot +personally comment on the integration of these commercial directory servers since +I have not had the oppotinuity to work with them. </para> <para> Just as the smbpasswd file is mean to store information which supplements a user's <filename>/etc/passwd</filename> entry, so is the sambaAccount object -meant to supplement the UNIX user account information. A sambaAccount is a -<constant>STRUCTURAL</constant> objectclass so it can be stored individually -in the directory. However, there are several fields (e.g. uid) which overlap -with the posixAccount objectclass outlined in RFC2307. This is by design. +meant to supplement the UNIX user account information. A sambaAccount is now an +<constant>AUXILARY</constant> objectclass so it can be stored alongside +a posixAccount or person objectclass in the directory. Note that there are +several fields (e.g. uid) which overlap with the posixAccount objectclass +outlined in RFC2307. This is by design. The move from a STRUCTURAL objectclass +to an AUXILIARY one was compliance with the LDAP data model which states that +an entry can contain only one STRUCTURAL objectclass per entry. This is now +enforced by the OpenLDAP 2.1 server. </para> -<!--olem: we should perhaps have a note about shadowAccounts too as many -systems use them, isn'it ? --> <para> In order to store all user account information (UNIX and Samba) in the directory, it is necessary to use the sambaAccount and posixAccount objectclasses in -combination. However, smbd will still obtain the user's UNIX account +combination. However, <command>smbd</command> will still obtain the user's UNIX account information via the standard C library calls (e.g. getpwnam(), et. al.). This means that the Samba server must also have the LDAP NSS library installed and functioning correctly. This division of information makes it possible to @@ -254,9 +271,9 @@ like in the following example, to speed up searches made on sambaAccount objectc ## required by OpenLDAP 2.0 index objectclass eq -## support pb_getsampwnam() +## support pbb_getsampwnam() index uid pres,eq -## support pdb_getsambapwrid() +## support pdb_getsampwrid() index rid eq ## uncomment these if you are storing posixAccount and @@ -326,14 +343,44 @@ use with an LDAP directory could appear as ldap suffix = "ou=people,dc=samba,dc=org" # generally the default ldap search filter is ok - # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))" + # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))" </programlisting></para> </sect2> + + +<sect2> +<title>Importing <filename>smbpasswd</filename> entries</title> + +<para> +Import existing user entries from an <filename>smbpasswd</filename> can be trivially done using +a Perl script named <filename>import_smbpasswd.pl</filename> included in the +<filename>examples/LDAP/</filename> directory of the Samba source distribution. There are +two main requirements of this script: +</para> + +<itemizedlist> + <listitem><para>All users to be imported to the directory must have a valid uid on the + local system. This can be a problem if using a machinej different from the Samba server + to import the file.</para></listitem> + + <listitem><para>The local system must have a working installation of the Net::LDAP perl + module which can be obtained from with <ulink url="http://search.cpan.org/">http://search.cpan.org/</ulink> + by searching for <filename>perl-ldap</filename> or directly from <ulink + url="http://perl-ldap.sf.net/">http://perl-ldap.sf.net/</ulink>. + </para></listitem> +</itemizedlist> + +<para> +Please refer to the documentation in the same directory as the script for more details. +</para> + +</sect2> </sect1> + <sect1> <title>Accounts and Groups management</title> @@ -582,7 +629,7 @@ ntPassword: 878D8014606CDA29677A44EFA1353FC7 <para> Please mail all comments regarding this HOWTO to <ulink url="mailto:jerry@samba.org">jerry@samba.org</ulink>. This documents was -last updated to reflect the Samba 2.2.3 release. +last updated to reflect the Samba 2.2.5 release. </para> |