blog/tags/ldap/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen: Entries Tagged ldap</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="ldap.rss" type="application/rss+xml">
   8  </head>
   9  <body>
  10
  11  <div class="title">
  12   <h1>
  13        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  14
  15   </h1>
  16
  17  </div>
  18
  19  <p>Entries tagged "ldap".</p>
  20
  21
  22
  23
  24 <div class="entry">
  25  <div class="title">
  26  <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">Time for new  LDAP schemas replacing RFC 2307?</a>
  27  </div>
  28  <div class="date">
  29   2009-03-29 20:30
  30  </div>
  31
  32  <div class="body">
  33
  34 <p>The state of standardized LDAP schemas on Linux is far from
  35 optimal.  There is RFC 2307 documenting one way to store NIS maps in
  36 LDAP, and a modified version of this normally called RFC 2307bis, with
  37 some modifications to be compatible with Active Directory.  The RFC
  38 specification handle the content of a lot of system databases, but do
  39 not handle DNS zones and DHCP configuration.</p>
  40
  41 <p>In <a href="http://www.skolelinux.org/">Debian Edu/Skolelinux</a>,
  42 we would like to store information about users, SMB clients/hosts,
  43 filegroups, netgroups (users and hosts), DHCP and DNS configuration,
  44 and LTSP configuration in LDAP.  These objects have a lot in common,
  45 but with the current LDAP schemas it is not possible to have one
  46 object per entity.  For example, one need to have at least three LDAP
  47 objects for a given computer, one with the SMB related stuff, one with
  48 DNS information and another with DHCP information.  The schemas
  49 provided for DNS and DHCP are impossible to combine into one LDAP
  50 object.  In addition, it is impossible to implement quick queries for
  51 netgroup membership, because of the way NIS triples are implemented.
  52 It just do not scale.  I believe it is time for a few RFC
  53 specifications to cleam up this mess.</p>
  54
  55 <p>I would like to have one LDAP object representing each computer in
  56 the network, and this object can then keep the SMB (ie host key), DHCP
  57 (mac address/name) and DNS (name/IP address) settings in one place.
  58 It need to be efficently stored to make sure it scale well.</p>
  59
  60 <p>I would also like to have a quick way to map from a user or
  61 computer and to the net group this user or computer is a member.</p>
  62
  63 <p>Active Directory have done a better job than unix heads like myself
  64 in this regard, and the unix side need to catch up.  Time to start a
  65 new IETF work group?</p>
  66
  67  </div>
  68  <div class="tags">
  69
  70
  71
  72   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
  73
  74  </div>
  75 </div>
  76 <div class="padding"></div>
  77
  78 <div class="entry">
  79  <div class="title">
  80  <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a>
  81  </div>
  82  <div class="date">
  83   2010-06-24 00:35
  84  </div>
  85
  86  <div class="body">
  87
  88 <p>A while back, I
  89 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
  90 about the fact</a> that it is not possible with the provided schemas
  91 for storing DNS and DHCP information in LDAP to combine the two sets
  92 of information into one LDAP object representing a computer.</p>
  93
  94 <p>In the mean time, I discovered that a simple fix would be to make
  95 the dhcpHost object class auxiliary, to allow it to be combined with
  96 the dNSDomain object class, and thus forming one object for one
  97 computer when storing both DHCP and DNS information in LDAP.</p>
  98
  99 <p>If I understand this correctly, it is not safe to do this change
 100 without also changing the assigned number for the object class, and I
 101 do not know enough about LDAP schema design to do that properly for
 102 Debian Edu.</p>
 103
 104 <p>Anyway, for future reference, this is how I believe we could change
 105 the
 106 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
 107 schema</a> to solve at least part of the problem with the LDAP schemas
 108 available today from IETF.</p>
 109
 110 <pre>
 111 --- dhcp.schema    (revision 65192)
 112 +++ dhcp.schema    (working copy)
 113 @@ -376,7 +376,7 @@
 114  objectclass ( 2.16.840.1.113719.1.203.6.6
 115         NAME 'dhcpHost'
 116         DESC 'This represents information about a particular client'
 117 -       SUP top
 118 +       SUP top AUXILIARY
 119         MUST cn
 120         MAY  (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
 121         X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
 122 </pre>
 123
 124 <p>I very much welcome clues on how to do this properly for Debian
 125 Edu/Squeeze.  We provide the DHCP schema in our debian-edu-config
 126 package, and should thus be free to rewrite it as we see fit.</p>
 127
 128 <p>If you want to help out with implementing this for Debian Edu,
 129 please contact us on debian-edu@lists.debian.org.</p>
 130
 131  </div>
 132  <div class="tags">
 133
 134
 135
 136   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 137
 138  </div>
 139 </div>
 140 <div class="padding"></div>
 141
 142 <div class="entry">
 143  <div class="title">
 144  <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a>
 145  </div>
 146  <div class="date">
 147   2010-06-28 00:30
 148  </div>
 149
 150  <div class="body">
 151
 152 <p>The last few days I have been looking into the status of the LDAP
 153 directory in Debian Edu, and in the process I started to miss a GUI
 154 tool to browse the LDAP tree.  The only one I was able to find in
 155 Debian/Squeeze and Lenny is
 156 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
 157 be a great tool to get a overview of the current LDAP directory
 158 populated by default in Skolelinux.  Thanks to it, I have been able to
 159 find empty and obsolete subtrees, misplaced objects and duplicate
 160 objects.  It will be installed by default in Debian/Squeeze.  If you
 161 are working with LDAP, give it a go. :)</p>
 162
 163 <p>I did notice one problem with it I have not had time to report to
 164 the BTS yet.  There is no .desktop file in the package, so the tool do
 165 not show up in the Gnome and KDE menus, but only deep down in in the
 166 Debian submenu in KDE.  I hope that can be fixed before Squeeze is
 167 released.</p>
 168
 169 <p>I have not yet been able to get it to modify the tree yet.  I would
 170 like to move objects and remove subtrees directly in the GUI, but have
 171 not found a way to do that with LUMA yet.  So in the mean time, I use
 172 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
 173
 174 <p>If you have tips on other GUI tools for LDAP that might be useful
 175 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 176
 177  </div>
 178  <div class="tags">
 179
 180
 181
 182   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 183
 184  </div>
 185 </div>
 186 <div class="padding"></div>
 187
 188  <p style="text-align: right;"><a href="ldap.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14"></a></p>
 189
 190
 191
 192
 193 <div id="sidebar">
 194
 195 <h2>Archive</h2>
 196 <ul>
 197
 198 <li>2010
 199 <ul>
 200
 201 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 202
 203 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 204
 205 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 206
 207 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 208
 209 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 210
 211 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 212
 213 </ul></li>
 214
 215 <li>2009
 216 <ul>
 217
 218 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 219
 220 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 221
 222 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 223
 224 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 225
 226 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 227
 228 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 229
 230 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 231
 232 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 233
 234 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 235
 236 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 237
 238 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 239
 240 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 241
 242 </ul></li>
 243
 244 <li>2008
 245 <ul>
 246
 247 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 248
 249 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 250
 251 </ul></li>
 252
 253 </ul>
 254
 255
 256
 257 <h2>Tags</h2>
 258 <ul>
 259
 260  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 261
 262  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 263
 264  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 265
 266  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 267
 268  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (29)</a></li>
 269
 270  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (28)</a></li>
 271
 272  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (41)</a></li>
 273
 274  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 275
 276  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (7)</a></li>
 277
 278  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 279
 280  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (3)</a></li>
 281
 282  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 283
 284  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 285
 286  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 287
 288  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (69)</a></li>
 289
 290  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (79)</a></li>
 291
 292  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (13)</a></li>
 293
 294  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (13)</a></li>
 295
 296  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 297
 298  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 299
 300  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (9)</a></li>
 301
 302  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 303
 304  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
 305
 306  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 307
 308  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 309
 310  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 311
 312  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 313
 314 </ul>
 315
 316 </div>
 317 </body>
 318 </html>