kdb+ and OpenLDAP - User Authentication
In this video I show you how to install and configure an #openldap server and then connect to it using the #kdb #ldap API. I also show how you can add users and groups to the LDAP database and authenticate users. Tutorial also includes steps in how to enable startTLS for a secure connection with the LDAP server
Support the channel - donation addresses:
Ethereum (ERC-20) 0xC71782F6e3CF95eb6d113816023A6141e411fA43
Bitcoin bc1qcg70h076jw3rwyammxj5qs2wldktezp9nvgfke
Resources:
OpenLDAP Quick start: https://www.openldap.org/doc/admin24/...
Kx Systems ldap library: https://github.com/KxSystems/ldap
kdb+ LDAP reference page: https://code.kx.com/q/interfaces/ldap...
LDAP Account Manager: https://computingforgeeks.com/install...
Past Video on TLS/SSL: • Video
Who was Frederick Valentich? • 11-08-22 George Simpson, The Frederick Val...
Chapters:
0:00 Introduction
0:14 OpenLDAP Overview
01:59 Online resources/repositories
04:04 Install kdb+ ldap library
05:48 Install OpenLDAP from source
09:13 How to shut down slapd daemon
09:30 Config setup - Edit ldap.conf file
11:29 Creating a password with slappasswd
12:00 Config setup - Edit slapd.ldif
13:03 Import the configuration database
13:45 Config setup: Adding admin and pw to cn=config
14:20 Start the slapd daemon process
15:50 ldapsearch to confirm password
16:26 Importing schemas
18:10 Confirming schemas were loaded
18:47 Install LDAP Account Manager
19:43 Setup LDAP Account Manager in Browser
23:30 Confirm users/groups are present using ldapsearch again
24:38 kdb+ .ldap.init
26:00 kdb+ .ldap.err2string
26:29 kdb+ .ldap.search
33:37 kdb+ .ldap.bind
38:00 Enable startTLS on slapd - setTLSCerts.ldif
39:10 Applying setTLSCerts.ldif
39:43 Testing startTLS using ldapwhoami (Setting TLS_CACERT)
41:30 Force Clients to always connect with startTLS, forceTLS.ldif
43:20 kdb+ .ldap.startTLS
45:23 LDAP Account Manager - Enable TLS
46:30 .z.pw callback
Commands:
1) Import the configuration database
/usr/local/sbin/slapadd -n 0 -F /usr/local/etc/slapd.d -l /usr/local/etc/openldap/slapd.ldif
2) Start slapd daemon
sudo /usr/local/libexec/slapd -F /usr/local/etc/slapd.d
3) ldapsearch
ldapsearch -D "cn=Manager,dc=lucidkdb,cn=com" -W
4) Importing schemas
/usr/local/bin/ldapadd -x -D "cn=admin,cn=config" -f /usr/local/etc/openldap/schema/cosine.ldif -W
/usr/local/bin/ldapadd -x -D "cn=admin,cn=config" -f /usr/local/etc/openldap/schema/nis.ldif -W
/usr/local/bin/ldapadd -x -D "cn=admin,cn=config" -f /usr/local/etc/openldap/schema/inetorgperson.ldif
/usr/local/bin/ldapadd -x -D "cn=admin,cn=config" -f /usr/local/etc/openldap/schema/msuser.ldif
5) Confirming schemas were loaded
ldapsearch -LLL -W -D "cn=admin,cn=config" -b cn=config ObjectClass=olcSchemaConfig dn
6) setTLSCerts.ldif
create new
dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /home/userone/tlsCerts/ca.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /home/userone/tlsCerts/server.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /home/userone/tlsCerts/server.key
7) Applying setTLSCerts.ldif
ldapmodify -W -D "cn=admin,cn=config" -f setTLSCerts.ldif
8) ldapwhoami
ldapwhoami -H ldap://localhost:389 -x -ZZ [Add -ZZ to turn on startTLS]
9) Create forceTLS.ldif
create new
dn: cn=config
changetype: modify
add: olcSecurity
olcSecurity: tls=1