diff options
Diffstat (limited to 'docs/htmldocs/Samba-LDAP-HOWTO.html')
| -rw-r--r-- | docs/htmldocs/Samba-LDAP-HOWTO.html | 148 |
1 files changed, 121 insertions, 27 deletions
diff --git a/docs/htmldocs/Samba-LDAP-HOWTO.html b/docs/htmldocs/Samba-LDAP-HOWTO.html index 9c223c0084f..7fbfbf5247b 100644 --- a/docs/htmldocs/Samba-LDAP-HOWTO.html +++ b/docs/htmldocs/Samba-LDAP-HOWTO.html @@ -64,7 +64,7 @@ TARGET="_top" >O'Reilly Publishing</A > is working on a guide to LDAP for System Administrators which has a planned release date of -early summer, 2002.</P +late 2002.</P ><P >Two additional Samba resources which may prove to be helpful are</P ><P @@ -86,7 +86,11 @@ HREF="http://samba.idealx.org/" TARGET="_top" >IDEALX</A > that are - geared to manage users and group in such a Samba-LDAP Domain Controller configuration. + geared to manage users and group in such a Samba-LDAP Domain Controller configuration. These scripts can + be found in the Samba 2.2.5 release in the <TT +CLASS="FILENAME" +>examples/LDAP/smbldap-tools/</TT +> directory. </P ></LI ></UL @@ -96,7 +100,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN23" +NAME="AEN24" >Introduction</A ></H1 ><P @@ -124,7 +128,7 @@ in the thousands).</P >The first is that all lookups must be performed sequentially. Given that there are approximately two lookups per domain logon (one for a normal session connection such as when mapping a network drive or printer), this -is a performance bottleneck for lareg sites. What is needed is an indexed approach +is a performance bottleneck for large sites. What is needed is an indexed approach such as is used in databases.</P ></LI ><LI @@ -150,7 +154,10 @@ Identified (RID).</P ></UL ><P >As a result of these defeciencies, a more robust means of storing user attributes -used by smbd was developed. The API which defines access to user accounts +used by <B +CLASS="COMMAND" +>smbd</B +> was developed. The API which defines access to user accounts is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support for a samdb backend (e.g. <TT @@ -172,7 +179,10 @@ CLASS="PARAMETER" >--with-ldapsam</I ></TT > autoconf -option, smbd (and associated tools) will store and lookup user accounts in +option, <B +CLASS="COMMAND" +>smbd</B +> (and associated tools) will store and lookup user accounts in an LDAP directory. In reality, this is very easy to understand. If you are comfortable with using an smbpasswd file, simply replace "smbpasswd" with "LDAP directory" in all the documentation.</P @@ -213,7 +223,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN52" +NAME="AEN55" >Supported LDAP Servers</A ></H1 ><P @@ -238,7 +248,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN57" +NAME="AEN60" >Schema and Relationship to the RFC 2307 posixAccount</A ></H1 ><P @@ -252,7 +262,7 @@ in 2.2.2). The sambaAccount objectclass is given here:</P ><P ><PRE CLASS="PROGRAMLISTING" ->objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL +>objectclass ( 1.3.1.5.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILARY DESC 'Samba Account' MUST ( uid $ rid ) MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $ @@ -261,7 +271,10 @@ CLASS="PROGRAMLISTING" description $ userWorkstations $ primaryGroupID $ domain ))</PRE ></P ><P ->The samba.schema file has been formatted for OpenLDAP 2.0. The OID's are +>The <TT +CLASS="FILENAME" +>samba.schema</TT +> file has been formatted for OpenLDAP 2.0 & 2.1. The OID's are owned by the Samba Team and as such is legal to be openly published. If you translate the schema to be used with Netscape DS, please submit the modified schema file as a patch to <A @@ -270,22 +283,47 @@ TARGET="_top" >jerry@samba.org</A ></P ><P +>Since the original release, schema files for</P +><P +></P +><UL +><LI +><P +>IBM's SecureWay Server</P +></LI +><LI +><P +>Netscape Directory Server version 4.x and 5.x</P +></LI +></UL +><P +>have been submitted and included in the Samba source distribution. I cannot +personally comment on the integration of these commercial directory servers since +I have not had the oppotinuity to work with them.</P +><P >Just as the smbpasswd file is mean to store information which supplements a user's <TT CLASS="FILENAME" >/etc/passwd</TT > entry, so is the sambaAccount object -meant to supplement the UNIX user account information. A sambaAccount is a +meant to supplement the UNIX user account information. A sambaAccount is now an <TT CLASS="CONSTANT" ->STRUCTURAL</TT -> objectclass so it can be stored individually -in the directory. However, there are several fields (e.g. uid) which overlap -with the posixAccount objectclass outlined in RFC2307. This is by design.</P +>AUXILARY</TT +> objectclass so it can be stored alongside +a posixAccount or person objectclass in the directory. Note that there are +several fields (e.g. uid) which overlap with the posixAccount objectclass +outlined in RFC2307. This is by design. The move from a STRUCTURAL objectclass +to an AUXILIARY one was compliance with the LDAP data model which states that +an entry can contain only one STRUCTURAL objectclass per entry. This is now +enforced by the OpenLDAP 2.1 server.</P ><P >In order to store all user account information (UNIX and Samba) in the directory, it is necessary to use the sambaAccount and posixAccount objectclasses in -combination. However, smbd will still obtain the user's UNIX account +combination. However, <B +CLASS="COMMAND" +>smbd</B +> will still obtain the user's UNIX account information via the standard C library calls (e.g. getpwnam(), et. al.). This means that the Samba server must also have the LDAP NSS library installed and functioning correctly. This division of information makes it possible to @@ -297,7 +335,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN69" +NAME="AEN81" >Configuring Samba with LDAP</A ></H1 ><DIV @@ -305,7 +343,7 @@ CLASS="SECT2" ><H2 CLASS="SECT2" ><A -NAME="AEN71" +NAME="AEN83" >OpenLDAP configuration</A ></H2 ><P @@ -369,9 +407,9 @@ CLASS="PROGRAMLISTING" ## required by OpenLDAP 2.0 index objectclass eq -## support pb_getsampwnam() +## support pbb_getsampwnam() index uid pres,eq -## support pdb_getsambapwrid() +## support pdb_getsampwrid() index rid eq ## uncomment these if you are storing posixAccount and @@ -387,7 +425,7 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN88" +NAME="AEN100" >Configuring Samba</A ></H2 ><P @@ -501,13 +539,69 @@ CLASS="REPLACEABLE" # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))"</PRE ></P ></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN128" +>Importing <TT +CLASS="FILENAME" +>smbpasswd</TT +> entries</A +></H2 +><P +>Import existing user entries from an <TT +CLASS="FILENAME" +>smbpasswd</TT +> can be trivially done using +a Perl script named <TT +CLASS="FILENAME" +>import_smbpasswd.pl</TT +> included in the +<TT +CLASS="FILENAME" +>examples/LDAP/</TT +> directory of the Samba source distribution. There are +two main requirements of this script:</P +><P +></P +><UL +><LI +><P +>All users to be imported to the directory must have a valid uid on the + local system. This can be a problem if using a machinej different from the Samba server + to import the file.</P +></LI +><LI +><P +>The local system must have a working installation of the Net::LDAP perl + module which can be obtained from with <A +HREF="http://search.cpan.org/" +TARGET="_top" +>http://search.cpan.org/</A +> + by searching for <TT +CLASS="FILENAME" +>perl-ldap</TT +> or directly from <A +HREF="http://perl-ldap.sf.net/" +TARGET="_top" +>http://perl-ldap.sf.net/</A +>. + </P +></LI +></UL +><P +>Please refer to the documentation in the same directory as the script for more details.</P +></DIV ></DIV ><DIV CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN116" +NAME="AEN144" >Accounts and Groups management</A ></H1 ><P @@ -532,7 +626,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN121" +NAME="AEN149" >Security and sambaAccount</A ></H1 ><P @@ -605,7 +699,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN141" +NAME="AEN169" >LDAP specials attributes for sambaAccounts</A ></H1 ><P @@ -816,7 +910,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN211" +NAME="AEN239" >Example LDIF Entries for a sambaAccount</A ></H1 ><P @@ -874,7 +968,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN219" +NAME="AEN247" >Comments</A ></H1 ><P @@ -883,7 +977,7 @@ HREF="mailto:jerry@samba.org" TARGET="_top" >jerry@samba.org</A >. This documents was -last updated to reflect the Samba 2.2.3 release. </P +last updated to reflect the Samba 2.2.5 release. </P ></DIV ></DIV ></BODY |