blog/tags/ldap/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen: Entries Tagged ldap</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="ldap.rss" type="application/rss+xml">
   8  </head>
   9  <body>
  10
  11  <div class="title">
  12   <h1>
  13        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  14
  15   </h1>
  16
  17  </div>
  18
  19  <p>Entries tagged "ldap".</p>
  20
  21
  22
  23
  24 <div class="entry">
  25  <div class="title">
  26  <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">Time for new  LDAP schemas replacing RFC 2307?</a>
  27  </div>
  28  <div class="date">
  29   2009-03-29 20:30
  30  </div>
  31
  32  <div class="body">
  33
  34 <p>The state of standardized LDAP schemas on Linux is far from
  35 optimal.  There is RFC 2307 documenting one way to store NIS maps in
  36 LDAP, and a modified version of this normally called RFC 2307bis, with
  37 some modifications to be compatible with Active Directory.  The RFC
  38 specification handle the content of a lot of system databases, but do
  39 not handle DNS zones and DHCP configuration.</p>
  40
  41 <p>In <a href="http://www.skolelinux.org/">Debian Edu/Skolelinux</a>,
  42 we would like to store information about users, SMB clients/hosts,
  43 filegroups, netgroups (users and hosts), DHCP and DNS configuration,
  44 and LTSP configuration in LDAP.  These objects have a lot in common,
  45 but with the current LDAP schemas it is not possible to have one
  46 object per entity.  For example, one need to have at least three LDAP
  47 objects for a given computer, one with the SMB related stuff, one with
  48 DNS information and another with DHCP information.  The schemas
  49 provided for DNS and DHCP are impossible to combine into one LDAP
  50 object.  In addition, it is impossible to implement quick queries for
  51 netgroup membership, because of the way NIS triples are implemented.
  52 It just do not scale.  I believe it is time for a few RFC
  53 specifications to cleam up this mess.</p>
  54
  55 <p>I would like to have one LDAP object representing each computer in
  56 the network, and this object can then keep the SMB (ie host key), DHCP
  57 (mac address/name) and DNS (name/IP address) settings in one place.
  58 It need to be efficently stored to make sure it scale well.</p>
  59
  60 <p>I would also like to have a quick way to map from a user or
  61 computer and to the net group this user or computer is a member.</p>
  62
  63 <p>Active Directory have done a better job than unix heads like myself
  64 in this regard, and the unix side need to catch up.  Time to start a
  65 new IETF work group?</p>
  66
  67  </div>
  68  <div class="tags">
  69
  70
  71
  72   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
  73
  74  </div>
  75 </div>
  76 <div class="padding"></div>
  77
  78 <div class="entry">
  79  <div class="title">
  80  <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a>
  81  </div>
  82  <div class="date">
  83   2010-06-24 00:35
  84  </div>
  85
  86  <div class="body">
  87
  88 <p>A while back, I
  89 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
  90 about the fact</a> that it is not possible with the provided schemas
  91 for storing DNS and DHCP information in LDAP to combine the two sets
  92 of information into one LDAP object representing a computer.</p>
  93
  94 <p>In the mean time, I discovered that a simple fix would be to make
  95 the dhcpHost object class auxiliary, to allow it to be combined with
  96 the dNSDomain object class, and thus forming one object for one
  97 computer when storing both DHCP and DNS information in LDAP.</p>
  98
  99 <p>If I understand this correctly, it is not safe to do this change
 100 without also changing the assigned number for the object class, and I
 101 do not know enough about LDAP schema design to do that properly for
 102 Debian Edu.</p>
 103
 104 <p>Anyway, for future reference, this is how I believe we could change
 105 the
 106 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
 107 schema</a> to solve at least part of the problem with the LDAP schemas
 108 available today from IETF.</p>
 109
 110 <pre>
 111 --- dhcp.schema    (revision 65192)
 112 +++ dhcp.schema    (working copy)
 113 @@ -376,7 +376,7 @@
 114  objectclass ( 2.16.840.1.113719.1.203.6.6
 115         NAME 'dhcpHost'
 116         DESC 'This represents information about a particular client'
 117 -       SUP top
 118 +       SUP top AUXILIARY
 119         MUST cn
 120         MAY  (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
 121         X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
 122 </pre>
 123
 124 <p>I very much welcome clues on how to do this properly for Debian
 125 Edu/Squeeze.  We provide the DHCP schema in our debian-edu-config
 126 package, and should thus be free to rewrite it as we see fit.</p>
 127
 128 <p>If you want to help out with implementing this for Debian Edu,
 129 please contact us on debian-edu@lists.debian.org.</p>
 130
 131  </div>
 132  <div class="tags">
 133
 134
 135
 136   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 137
 138  </div>
 139 </div>
 140 <div class="padding"></div>
 141
 142  <p style="text-align: right;"><a href="ldap.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14"></a></p>
 143
 144
 145
 146
 147 <div id="sidebar">
 148
 149 <h2>Archive</h2>
 150 <ul>
 151
 152 <li>2010
 153 <ul>
 154
 155 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 156
 157 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 158
 159 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 160
 161 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 162
 163 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 164
 165 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (13)</a></li>
 166
 167 </ul></li>
 168
 169 <li>2009
 170 <ul>
 171
 172 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 173
 174 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 175
 176 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 177
 178 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 179
 180 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 181
 182 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 183
 184 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 185
 186 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 187
 188 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 189
 190 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 191
 192 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 193
 194 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 195
 196 </ul></li>
 197
 198 <li>2008
 199 <ul>
 200
 201 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 202
 203 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 204
 205 </ul></li>
 206
 207 </ul>
 208
 209
 210
 211 <h2>Tags</h2>
 212 <ul>
 213
 214  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 215
 216  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 217
 218  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 219
 220  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 221
 222  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (28)</a></li>
 223
 224  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (27)</a></li>
 225
 226  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (40)</a></li>
 227
 228  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 229
 230  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (7)</a></li>
 231
 232  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 233
 234  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (2)</a></li>
 235
 236  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 237
 238  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 239
 240  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 241
 242  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (69)</a></li>
 243
 244  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (78)</a></li>
 245
 246  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (13)</a></li>
 247
 248  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (13)</a></li>
 249
 250  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 251
 252  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 253
 254  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (9)</a></li>
 255
 256  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 257
 258  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
 259
 260  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 261
 262  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 263
 264  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 265
 266  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 267
 268 </ul>
 269
 270 </div>
 271 </body>
 272 </html>