Thread: Fully functional LDAPS client deployment on Ubuntu Server 9.1

i spent many hours , use of plethora of somewhat-contradictory tutorials , webpages achieve functional ldap-integrated login using ldap on ssl (ldaps://) on ubuntu server 9.1. i've gotten right, i'd share benefit of future hapless ldap-setter-uppers me looking ldaps functional.

not going cover setting openldap, tutorials can found many other places, , have found them in agreement , functional. tutorial assumes have functional ldap server configured ssl , listening on port 636.

*log soon-to-be ldap client. need install nss-ldap
sudo apt-get install libnss-ldap

after usual prompts how additional disk space used, enter pseudo-gui setup screen.
please enter uri of ldap server use
ldaps://<your server name or ip>/
please enter distinguished name of ldap search base.
dc=yourserver,dc=example,dc=com
ldap version use
should 3
make local root database admin:
have configured no. need know own information privileged ldap user if wish use yes. necessary if use linux user commands modify ldap entries.
ldap database require login?
no.
explanation of various crypt options
local crypt use when changing passwords:
select exop

if make mistakes during process, or need change anything, possible make changes via various .conf files, can use sudo dpkg-reconfigure ldap-auth-config screen prompts again.

(i have automated process using debconf-utils seed files. can expound on if people interested. purpose, have scripted process configure ldaps authentication on hundreds of servers.)

need configure 3 configuration files now: /etc/nsswitch.conf, /etc/ldap.conf, /etc/ldap/ldap.conf

sudo vi /etc/nsswitch.conf (or of course preferred text editor)
want change following lines:

passwd: compat
group: compat
shadow: compat

to
passwd: files ldap
group: files ldap
shadow: files ldap

save these changes. (i found compat ldap rather files ldap successful.)

check /etc/ldap.conf preferred text editor, , ensure contains following lines:

base dc=yourserver,dc=example,dc=com
uri ldaps://<your server name or ip>/

, ensure there no line not commented out starts "host"
these settings should have been set correctly prompts @ time of installing libnss-ldap

need copy certificate openldap server client. make sure copy certificate referenced in openldap configuration (slapd.conf) "tlscacertificatefile yourcert.pem". copied /etc/ldap/certs, can put anywhere long know on client machine.

now, use favorite text editor open /etc/ldap/ldap.conf , edit have following lines:

base dc=yourserver,dc=example,dc=com
uri ldaps://<your server name or ip>/
tls_cacert /etc/ldap/certs/yourcert.pem
tls_reqcert never

other tutorials have found suggest allowing rls_reqcert, broke ldaps setup , led lot of headaches looking problem.

save, , should have functional ldaps installation. type

getent passwd

, should see listing of ldap users.

if make ldap user sudoer client, can use
adduser ldapusername admin

Forum The Ubuntu Forum Community Other Discussion and Support Tutorials Outdated Tutorials & Tips Fully functional LDAPS client deployment on Ubuntu Server 9.1

Ubuntu