Slashdot Mirror
LDAP Tools - Where are they?
fixe asks: "I have spent the last few months up to my eyeballs in LDAP. While I am still hopeful of what LDAP can bring to the table I am admittedly disappointed in the tools, support and documentation surrounding the standard. I have been successful at creating and populating an LDAP directory and even authenticating against it, however I cannot find decent replacements for useradd, userdel, usermod, passwd, etc. Nor have I found any decent LDAP editors or browsers (preferably console or web-based). I am hoping that the Slashdot crowd might be able to shed some light on the subject. Are there any LDAP veterans out there who can reccommend any tools? What is the best way to maintain system account synchronization with an LDAP directory? Or perhaps, is there a more attractive alternative to LDAP?"
There also doesn't appear to be much corporate interest - Microsoft has moved its mindshare strategies to web services, leaving the only big backer of LDAP being Novell - not really a key industry player at this point.
The OSS community doesn't yet have anything that comes close to AD's functionality or security. It also integrates well with Exchange.
At the Rochester Institute of Technology (www.rit.edu) where I am a current student we have a very nice LDAP directory. It contains info on all the people here. I use it all the time when people give me their e-mail addresses in order to find their phone numbers. It's extremely handy. I don't know how they set it up or what they use, but it has a web interface.
The GeekNights podcast is going strong. Listen!
I know I'll get flamed like hell for writing this, but I suggest that you check out Microsoft's LDAP tools. I'm not sure about their interoperability with slapd etc, but they play along amazingly with Microsoft LDAP server.
Also, check out gq , which is a pretty nice GTK+ based LDAP client. It's still very barebone, but it's better than the commandline tools for a lot of tasks.
I had to roll most of my own admin scripts. There is a great java based browser/editor though.
http://www-unix.mcs.anl.gov/~gawor/ldap/
It is the best thing out there as far as I can tell.
Rick
Novell's NDS works very well. Heck, even CNN (scroll to bottom of page) uses it!
There also doesn't appear to be much corporate interest - Microsoft has moved its mindshare strategies to web services, leaving the only big backer of LDAP being Novell - not really a key industry player at this point.
Slap me with a strongly worded post if I am incorrect, but isn't Active Directory an LDAP implementation?
This application is nice.. They don't have much if any of a community behind it though.
http://ispman.sourceforge.net/
A vaporware?
LinPlanet
Unfortunatly, the best LDAP browser/editor I've found so far is neither web- nor console-based, but is a Windows program. LDAPBrowser 2.0, from the nice folks at Softerra, has been invaluable in helping me figure out how to make a bunch of openldap-based client programs talk to an MS Active Directory LDAP server. It's free-as-in-beer, and they have a number of other cool ldap toys available as well.
You would think that wrapping a gtk+ interface around ldapsearch would be a straightforward and no-brainer proposition, but you would apparently be wrong.
News for Nerds. Stuff that Matters? Like hell.
I'm in the process of helping deploy active directory. MS Windows comes with some LDAP tools that aren't too bad. I'm still in the learning stage so I can't frame a good opinion, but first impressions are OK. But like everything Windows if you want to get into the guts of the OS you'll have to dig around for the info. MS prefers you use their MMC based admin tools which don't give you much control.
Yeah, it's called Active Directory. It's well documented and it's easy as hell to use. This isn't meant to be flaim bait - it's just the way it is. I havne't found too many good LDAP tools either. Working with Active Directory, however, is a breeze. Just my $0.02
Have a Happy.
The java one that comes with iPlanet's server is okay, but not great. I never really found one that worked all that well. I did spend a week or so writing one for myself in PHP, but it was pretty specific to the situation and isn't useful to anybody else. I pretty much came to the conclusion that it was best to roll your own as it really didn't take that much time, and then you got to customize it exactly how you wanted to.
-jay
-jay
Go looking for the IBM SecureWay Directory Management Tool (DMT). It's a Java LDAP client that lets you edit the directory manually.
M$ is betting quite a bit on LDAP with AD, touting it as the number one reason for enterprises to move off of NT to 2000 server platforms. Unfortunately upgrading is such a complicated operation very few larger organizations are moving to it as fast as M$ would like. They have integrated all sorts of things into the standard directory service and it can be very confusing trying to figure out exactly what it is.
FWIW, Novell's NDS has been the only enterprise-class directory service since the mid-90's and AD is a play into this arena.
Of course, this is all moot since this is Slashdot and of course you aren't interested in technology from the Dark Empire (tm).
Left shift 1 for e-mail...
Daimler Chrysler is using Novell/LDAP. Sounds like big industry to me...
Nothing to see here. Move along.
There are a few LDAP administrator projects listed on Freshmeat:
http://freshmeat.net/projects/sldapa/
http://freshmeat.net/projects/directoryadmin/
Is what we are using.
To get it:
Go to google, search for "ldap browser" and click "I'm feeling lucky".
Enjoy.
Of course, the standard commandline classics (ldapsearch, ldapmodify, etc.) that come with any of the major vendors stuff (Netscape's SDK, Novell's eDirectory).
Also, I REALLY like the java LDAP Browser for GUI use (available from http://www.iit.edu/~gawojar/ldap)
As far as account creation tools, there's some nice trends among the big user provisioning corporate grade systems (i.e. Access360) to manage accounts in LDAP.
I'd stay away from Active Directory since it doesn't follow all of the standards. eDirectory's only big annoyance is that it's LDAP is actually a mapping on top of their old stuff, so sometimes that adds complexity. But for a long time they had the only multi-mastered replication setup. iPlanent now has that and MS/AD kinda does (but they have crappy granularity on their objects in case of collisions).
I like lots of people. That doesn't mean I go carting them around the galaxy with me. --Dr. Who
YEs, goto Novell for the best directory, and the best LDAP software available.
You can use Novell's eGuide as a good user admin utility VIA ldap. I've never tried it with a generic LDAP directory, but it should work well.
IMHO, if you're going to do anything that requires a large directory, look at NDS. You'll get your basic LDAP services and a lot more, including replication.
Move up to a Novell Netware 6 server, and get load balancing / automatic failover with it!
Ever play a video file off your server, then down the server, and have the video pick up where it left off?
It just fucking rocks.
"I can't give you a brain, so I'll give you a diploma" - The Great Oz (blatently stolen sig)
Have you looked at libnss-ldap? Install that, set up your /etc/nsswitch.conf file to refer to ldap in addition to your other resources, and all well-behaved programs (re: that use the NSS routines in glibc instead of attempting to modify /etc/whatever directly) should update the LDAP records.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
Why not just whip up a few quick and dirty perl scripts to take care of simple things like adding and removing users?
I dont know about commercial LDAP offers, but openldap led me to the conclusion to NOT use ldap anywhere. I still have it installed in three locations and am actively working in porting it to mysql or unix flatfiles, because it's so unreliable. nss library from padl.com for some reason doesnt always closes its connections, so you hit 1024 file descriptors limit within a week or so. yes, you can compile with -DFD_SETSIZE, but this only gives you more time until restart is needed. Second, replication never worked reliably, so trying to avoid fd problem with more replicas only casued more pain and sleepless nights rebuilding and reindexing databases (125k user entries, it takes 7 hours on 4way xeon). And if only the slapd itself would work! It stops responding every now and then, for no reason. OK, i can catch these with a trivial script ... but recently, i got more and more examples where connection is accepted, but result never comes ... so ldapsearch just sits there without answer, huh. I've also seen examples where some slapd threads would occupy one or more cpu in the box, slowing things down noticeably.
So, whatever you do, AVOID OpenLDAP.
I use GQ for browsing around in an LDAP. It is a great start on a fully functional LDAP client tool, but still, many options still need to be implemented.
-- Knowing too much can get you killed, but knowing who knows too much can make you rich.
Anyone care to tell us what LDAP is and who uses it? Or at least what does the acronym stand for?
I like Jarek Gawor's Java based editor:
http://www.iit.edu/~gawojar/ldap/index.html
Directory Administrator is a GUI (GTK+) frontend for user administration within a LDAP directory. It still requires some knowledge about a LDAP hierarchy, but it helps a lot.
My advice is to create two user hierarchies: one for administrative non-human accounts (e. g. root, mail, www) and one for real users. Same thing for groups. This way you can manage your real-user accounts with some kind of GUI frontend and even re-use the objects in an addressbook like Evolution Contacts without risking a security hole.
I am with a admin group trying to integrate a couple hundred UNIX and Windows machines into a single login using an Active Directory server, which provides us with Kerberos authentication, and an LDAP directory. (This was mandated to us "from above") The kerberos authentication of course was easy, however there is hardly ANY information about actually using LDAP in a production environment.. we are trying to use the active directory LDAP server to provide the POSIX gecos and home directory information for the UNIX clients... however the default Active Directory schema does not include RFC2307
/etc/passwd. This is possible in Linux and Solaris using the nss_ldap module which lets you add an "ldap" entry to your network switch file, and use ldap instead of /etc/passwd. It seems the best solution is Kerberos for authentication and LDAP for everything else, which Active Directory can provide, in a mixed-OS environment even.. but has anyone been able to successfully run nss_ldap against an AD LDAP server? (without using services for UNIX or other kludges)
LDAP seems to be an integration nirvanna.. but without proper documentation I am afraid it will never see broader use..
Probably the most frustrating part is if you go on google and look for help, you see people mentioning that this works, but never any specifics. I assume you are just using pam_ldap to grab a password crypt from an LDAP server (which is a secure as giving everyone read permissions on your shadow file).
I think the best solution is to use an LDAP server to host all the user information that is normally in
I implemented LDAP at a dot-bomb company I worked for in late 2000, and had NO PROBLEM finding tools. I was using a nice Gtk user manager, and had my mail server (and all the mail clients) looking up users in the LDAP server. All the tools I used I found on Freshmeat. Maybe try searching the web?
As a student I'm doing some research on LDAP usability and -programming.
If you want an all-in-one solution (Server & Gui to populate server), try the iPlanet Directory Server which is kind of free to use (downloadable at netscape.com) and has a really nice interface.
Another nice (non-free) thing is an LDAP-API for Visual Basic from SnarkSoft which allows you to quickly write applications using data from your LDAP server. I know this isn't really a LDAP-solution, but it allows you to easily develop LDAP applications.
http://www.iit.edu/~gawojar/ldap/
Your questions appear perrenially on the openldap mailing lists. You might want to look in the archives:
http://www.openldap.org/lists/
Personally I've used LDAPExplorer, a php based
viewer/editor. It works OK, but is not without its flaws. (Supports php 4.06 only, no longer maintained, sessions are intermittent) Since its GPL'd one could have some fun improving it.
Use it wisely
Google's your friend.
Infuriate left and right
eDirectory (formerly NDS) by Novell...is fully LDAP compliant, and comes with a whole bunch of tools and stuff of that nature. And it even runs on Linux / Solaris / AIX / Tru64 / Netware and NT! It's not 'open source', but it can be free as in beer for developers. So far, it's been remarkably stable and easy to use on Linux.
The LDAP tools in MacOS X Server are quite excellent, I know some people who set it up just to provide LDAP and Kerberos for a whole network of users. Check it out.
checkout:
directory_administrator which is a GNOME LDAP user admin tool (slick enough for use by a frontline helpdesk).
there are other LDAP GUI's, KDE has one. search freshmeat.
gq a general purpose LDAP GUI tool. quite slick, comes with RH7.x.
Also, note that with RH7, the 'passwd' tool uses pam and will hence automatically work with LDAP authentication. (presuming your LDAP server is configured correctly for write access).
finally, you'll probaby want to develop your own scripts with template LDIF's for things like useradd, or find someone who's already done so. (i noticed there's a post on this thread providing a link to exactly that.) Note that for scripting, PADL's migration scripts are very informative. These are included with the OpenLDAP distribution.
I use Friend/Foe + mod-point modifiers as a karma/reputation system.
So everyone hates LDAP and the tools suck, except for Microsoft's. I have a related question:
What successful strategies have you employed for maintaining large user databases/directories in a heterogenous environment?
1. NIS/YP plus ActiveDirectory/NT Domain plus RACF/TopSecret plus ?????, along with a bunch of scripts to maintain synchronization?
2. Something else?
Premature optimization is the root of all evil
They're really neat! You ought to give them a try!
Yah know, I JUST got LDAP working last night and am in precisely your position. :-) I'm planning on crafting up the tools I need in Perl either to manipulate openldap a little bit more nicely or to just connect to the server and do the work directly. :-) Hope this helps!
Perl is cool like that.
Sam
When one is going to bandy about acronyms, its is a courtasy to use the full length term once.
example:
"when arriving at the hospital, the victin was DOA(Dead On Arrival). since he was DOA, we did the...."
The university that I attend has deployed LDAP for use by it's some 25,000 students, faculty, volunteers, and anyone else associated with the school. As far as I can tell the university has written their own custom perl scripts for interfacing to the directory via a web browser. I have to say it works pretty damn nicely. I'm not sure what it says that they wrote their own scripts, but I suspect it was due to a lack of existing software to get the job done. I hope LDAP doesn't fall to the way side, because it's done very well for this campus.
I posted to
(to the tune of "Row Row Row Your Boat"
Roll, roll, roll your own, script the night away,
Thought it had some Unix tools, but now you have to pay
I'm going through the very same thing on a Sun platform...I can assure you that it sucks. I recommend writing your own. I saw some people mention UIs, but that's no good if you want to automate things.
(BTW, if you're using a proxy account to authenticate, can you allow groups of users to access some systems and not others, or does the use of the proxy preclude all that?) Anyone who knows, feel free to email me and answer a violent argument here....the manual I've got says nothing useful concerning it ;) )
There's no sig like this sig anywhere near this sig, so this must be the sig.
If you can't find LDAP tools, you havn't been looking hard enough. Here (http://www.dbaseiv.net/code/cpu.phtml) is a tool for doing unix style user management with an LDAP directory. Here (http://www-unix-mcs.anl.gov/~gawor/ldap/index.htm l) is a fully functional, really awesome ldap browser that I have used extensively. These are just a tiny sample of all the software for directly working with an LDAP directory. Check the OpenLDAP and IETF lists for more tools, OpenLDAP comes with quite a few as well. :)
If you have paid careful attention, you will notice that LDAP support has crept into hundreds and hundreds (of not thousands) of applications over the last year. The API's for doing LDAP programming yourself are also extremely well developed imho. You have options for C, PERL, C++, Python and a slew of other programming languages. Search Freshmeat or Sourceforge for LDAP and see what you come up with, I think you'll be surprised.
I don't think LDAP is dead, I think it's one of those protocols like TCP that just sneaks up on you with it's usefulness
It's an LDAP client for Linux. It's a nice little program for verifing your configuration. I'm not sure about editing though.
-- Hofstadter's Law: It always takes longer than you expect, even when you take into account Hofstadter's Law.
It is an open-standard protocol for accessing information services.
more can be found here.
--
I am employed by a major aerospace company, and have been using LDAP for several years for web based authentication. This has permitted us the option of "piggy-backing" any other web servers into this authentication scheme. The tools I have used have all been written by myself in Perl, using the Net::LDAP module. I believe there is at least one other module available to use, either available from CPAN. I believe Graham Barr is the author of this module. Using this approach, you should be able to build your own custom webpages for selective browsing of LDAP shares, and management.
If you're seeking some bonafide support options, you might confer with openldap.org, or better yet iPlanet's Directory Server. The latter would cost some money, but it is an option.
TSIA.
/. is filtering out the quotes in the link.
o wn load.novell.com/download.jsp?cat=NDS&pid=646&targe t=sdExpLic.jsp"
The fact is there's a niche between small business (Microsoft products) and Fortune 100 (*Nix) where Novell's products reside quite comfortably.
And eDirectory is a full-featured LDAP implementation in its own right. Not to mention the free version for Linux! (Registration required).
Hey, whad'ya know, I see that
Here it is again in plain text for your cut'n'pasting pleasure:
https://download.novell.com/ICSLogin/?"http://d
Use Console One. It lets you manage your LDAP directory and a whole lot more. Imagine managing users, resources, printers, servers, EVEN files, all from a single Java based tool.
.NET without the bugs and security risks. And, the best part, is it has been shipping for quite a while now, unlike certain other vaporware products.
That's right you can do all this and a whole lot more, using Novell Netware. Even if you don't use Netware, eDirectory (included in Netware or sold separately) allows a lot of these functions from within the Java based Console One. It runs on almost any platform, available today. It even has additional modules that allow things like single signon and more. That's right, all the advantages of
Even if it isn't free, for enterprise use, it is down right cheap!
I've been working with LDAP for the past four years as a manager, consultant, administrator, project manager and architect in various situations and for various companies and clients. My experience has been with Netscape/iPlanet, OpenLDAP and Active Directory. I've worked on very small and very large projects. LDAP has the potential to bring amazing efficiency gains to an enterprise or Internet-based organization (ISP or ASP), but it also is fairly immature.
Let me rephrase that: the protocol is mature and useful, and the servers by and large are mature and useful, but the support tools stink, as a general rule. Since it sounds like you are mostly concerned with user administration, I will stick to just that, and let other people mention tools they've found useful.
If you are using Solaris, AIX or Macintosh, using LDAP for accounts is pretty trivial, since the OS supports it directly - you'll need to have the POSIX user schema loaded, and point the OS's naming service to LDAP instead of its local database. Win2K/XP kind of force you to use Active Directory, so you are also taken care of there. In all of these cases, accounts other than the system superuser will be in LDAP, and so therefore synchronization is not a problem.
useradd, userdel, usermod and passwd are all replaced by ldapmodify, or you can use the tools included with some servers (the iPlanet console being a good example of how to do this right). Right now, there doesn't seem to be any substitute for thoroughly learning ldapsearch and ldapmodify, Perl and Net::LDAP. You can use ldapsearch and ldapmodify for quick actions (adding, modifying or deleting a single user, or changing a password) and Perl and Net::LDAP for more complex operations (or for putting together a CGI for common functions like changing a user's password).
I find I end up writing built-to-purpose Perl tools just about everywhere I go. In some cases, this is because of differences in admin policy at different sites, or differences in schema. In others, the issue is more contractual (whomever is paying me gets ownership of the code I write, so I have to rewrite from a clean sheet at the next site).
The good news is, it is fairly quick and painless to write replacements for useradd, usermod, userdel and passwd which can be run from the command line or as a CGI, and you only have to write them once for your site, if you write them well in the first place.
-jeff
-- Two men say they're Jesus. One of them must be wrong. - Dire Straits
I understand that LDAP is supposed to be used for
:]
all kinds of great contact / location / description information, but how is it used in reality? It is used as a really difficult to use properties file. Judging the way most people use LDAP that I've seen, they would have been better off with a sql database. At least with SQL the queries are readable. (o=, c=, wtf= is a pain).
The way I feel about it is that the LDAP 'problem' does exist and is solvable, but the right protocol/implementation does not yet exist. Until something much more friendly and useful comes along, I am firmly off the LDAP bandwagon.
So if you're looking for a good tool to solve your LDAP problems, I suggest Oracle, PostgreSQL or MySQL.
I'm an e-commerce consultant, and I've been surprised in the last 2 years or so the vast number of LDAP-based installations I've seen in all sorts of e-business.
Though not heavily deployed in the enterprise, ESPECIALLY *nix, basically due to the very issues you mention (few admin tools, high complexity), it is heavily used on the web and in Microsoft-centric environments. Active Directory almost follows the LDAPv3 protocols (two non-standard areas are both related to schema implementation. The variations are well documented and do not drastically effect applications)
My admin tool of choice? Sad to say, it is the AD administrator. Second admin tool of choice? Microsoft Site Server 3.0, Commerce Edition's Membership Directory Manager MMC snap-in. Both are Microsoft Management Console snap-ins, but if you can get around that they work alright. The MSS3CE version is even fully LDAPv3 compliant, so you can use it with other directories, too. It also comes with a web interface you can use.
As far as non-MS tools? Haven't seen a one worth it's salt, though a couple of my co-workers recommend talking to the NetIQ folks if that's your bend...
I am disrespectful to dirt! Can you see that I am serious?!
Unfortunately the ldap tools out there are pretty poor. I've been working with LDAP for about 6 years and my tool of choice is Perl with perl-ldap. It's the perfect fit for advanced operations. All of our software is written using this platform.
Technically it's great - but from a realistic point of view, I would forget about it. It's obvious that Microsoft has NDS targeted for termination. And nobody seems interested in stopping them. No sense in investing in what's obviously going to be dead technology. Unfortunately.
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
These sort of directories usually have an opt-out option. Back when I was at VT I opted out of their LDAP. BTW, it's got people's school and home address at VT... fucking scary.
Microsoft can target all they want, but Novell is finally getting into gear and fighting back. A recent Microsoft FUD fest (they mailed out bald-faced lies regarding Novell's future products to a number of people) resulted in a lawsuit by Novell. Novell won it, Microsoft has been forced to issue a retraction and pay a big chunck of change.
Novell has even done some marketing. Granted, it's still Novell marketing, and can't compare to the experience, budget, or sleaziness of Microsoft marketing, but it is better than nothing.
Not to mention that they do have a clearly superiour product. Microsoft can target it all they want, but as along as their competition can do things that Microsoft can't, even the Microsoft marketing machine can't roll them over.
Has anyone gotten libnss-ldap (and/or libpam-ldap) to use SSL on Woody? I spent several days trying different things to get it to use either straight SSL on 636 or STARTTLS, but to no avail. I know that I need to recompile it, but even though other ssl-ized things compile fine, neither of those libraries work. They work fine without, but when I add any ssl config directives they just hang.
I've given up for now on trying to get it to work and am using pam_krb5 for authentication, but I'd rather use pam->ldap->kerberos for simplicity on the client side.
A host is a host from coast to coast...
Unless it's down, or slow, or fails to POST!
Same thing with my school, you can opt out of everthing exepct your name and e-mail. What's the use then!? And after you opt out, you have to fill extra forms when registering for classes, cause the fucking ldap was tied to the school registration system.
Weird, as this came in just yesterday on kde-pim:
;-)
Carillon Information Security Inc. would like to announce the release of
KDirAdm version 0.1
K DIRectory ADMinistrator is a tool for use by Directory Administrators to
manage their LDAP based directory. Using the K Desktop Environment (KDE) and
OpenLDAP toolsets, this application currently has all of the basic
functionality required to browse, add, and delete directory entries. As this
is an initial BETA release, the capability to modify existing entries, as
well as the ability to handle binary directory objects is currently missing.
This is planned for the next release, along with improved password entry
handling and possibly LDAP over SSL support.
KDirAdm is open source software released under the GNU Public License. As
such we encourage anyone to help us in the development of this software.
Specific jobs that need doing at the moment are improving the documentation,
the artwork, and of course, any LDAP wizards that want to help out will be
greatly appreciated.
The homepage for KDirAdm is at:
http://www.carillonis.com/kdiradm
where both source and Debian packages may be obtained.
Comments, suggestions, wishlist items and patches may be sent to
ppatterson@carillonis.com
So, it's "pre-beta" but has that ever stopped a true free software geek before?
In my ass.
ConsoleOne is a graphical, cross platform GUI tool that allows you to do pretty much every thing. Add, Delete, Create, Modify, Search, Extend the schema, etc.
There's also the ICE (Import, Convert, Export) tool which allows you to import, convert and export data from LDIF or other LDAP servers. ICE is available in a GUI and command line version.
eDirectory is also managable through a browser, and if you use their DirXML product you can basically take any data from any system and expose it through LDAP.
Novell's eDirectory is redistributable for developers. If you do development work, check all their goodies at their development site. You'll find LDAP class libraries, tools etc.
The evaluation copy of eDirectory can be found here and includes the tools mentioned.
University directories, such as those located at Colorado State and CU Boulder, are extremely well organized. The vCard option at CSU is very nice and I know that both of these directories can be plugged in to your favorite mail client and serve as an address book. Are there any University sysadmins reading this who can post more info?
"I either want less corruption, or more chance
to participate in it." -- Ashleigh Brilliant
Keep your eyes on www.geminisecurity.com for a few weeks. I've got a Windoze based LDAP viewer/editor that I think is pretty darn good under development. The viewer will be free, the editor will be pay. If this had only been posted a little while later!!
Check out our infosecurity industry blog: http://securitymusings.com/
What are you trying to do with an LDAP directory?
If your main goal is to centrally manage a network, I think you will find LDAP still a little undercooked.
I did a lot of research on LDAP thinking it was going to make directory management of a Linux network easier. It offers better security than NIS, and can scale a little better, but I don't think it can manage netgroups yet, which is a big deal if you use NFS a lot. For now, I think NIS is the best open source solution for Linux. NIS+ server code for Linux doesn't exist yet, but the client code does, although I haven't tested it.
As you found out, building the directory only solves one part of the management problem. You also have to have the client piece integrated for authentication (PAM) and in the C library for applications to use it for lookups. Again, I'd stick with NIS for now.
I've finished the process of migrating a fairly large ISP/Telco (1.5M users) to LDAP a couple of months ago. I've been at it for over a year, and
from my own experience I can tell you that:
1 - The best available tools are definitely the command-line that come with most servers.
2 - OpenLDAP sucks big time in large scale environments. It's replication is anything but reliable
3 - GQ is a very, very nice browser for LDAP. But I wouldn't use it for administration.
4 - You can assemble a whole range of ISP services (mail, ftp, http, whatever) based on an LDAP tree. Even if you can't find a _insert favorite daemon here_ supporting LDAP, you can always use...
5 - PAM/NSS LDAP. It just rocks. If you configure it properly, anything using PAM/NSS will use/update your tree accordingly. This includes unix tools like "passwd", "useradd", or "finger", or services like QPopper and OpenSSH.
6 - The best way to automate some processes is to create our own tools. Net::LDAP is very easy to use, and does anything you can think of (in terms of LDAP ops)
--
Failure is a human trait. Luckily, I'm not human
RIT has a mildly nice system... here. Basically, you can look people up on campus by e-mail address. Individual users can change their own listing. I know little about the actual implementation though.
--You will rephrase your request for me to go to hell. Goto statements are not acceptable programming constructs
Object Identifiers
- [OIDs Registry]
Schema Browsers- [Softerra
LDAP Browser]
- [Java LDAP browser/editor]
Language Libraries- [LDAP client API for
Python]
Exchange SchemaFor those of you who, like me, got forced into adminning an already running LDAP, please sympathize with this comment and don't spout "Use a *nix LDAP implementation." We're using MS Site Server with a SQL Server database. It's not elegant, nor is it particularly straightforward, but after getting past the (steep) learning curve, I've gotten pretty handy with our LDAP system.
Our biggest problem was migration...ie, we have 'this' tree, we want 'that' tree in the next release. 'That' tree has a 50% different organization with groups/users added/removed, so what we ended up doing was writing a big ol' VB script that migrated between the two. I hate VB, but being a script (read: Perl) person it's nice to have a non-GUI interface to do automated migrations with. VB contains all the necessary objects with which to create/modify LDAP structures.
Our project's back end is all java on Unix boxes, and since we needed to authenticate against the MS LDAP, we used the Java LDAP API distributed by Netscape. I've noticed a few glitches, one involving padding strings longer than 128 chars with garbage, but otherwise it's relatively fast and easy.
Lastly, for simple browsing/adminning, MS Site Server's tools are pretty handy. Again, not the best interface (and read MSKB article# Q235132!! We were bit in the ass for months until I found this out...) but it's a GUI and you can do everything you need to.
Not a glowing recommendation, but considering it's a MS product and I've got scripts automating everything, Site Server really isn't a horrible product choice for Windows.
--trb
Man, I didnt realize all my info was on some stupid directory till someone I didn't like found me. My university put my info on the LDAP without even asking me. Everthing is there, even (sex: Male/Female), Age, damn. Nationality, race... Stupid? You ask. They wont remove it. Says it would be there till 4 months after Graduation.
Jeez, I hate abuse of the term FUD, but that is the most blatant FUD I have seen in a while.
Novell might not be as big a player as they were in the past, but there are a lot of sites that are using Novell and are not planning on dropping support.
In the K-12 arena Netware has a very strong hold that is not likely to slip, despite MS's efforts at 'charity,' and most Netware admins I know do not see Active Directory as being anywhere near as well designed as NDS. Make your decisions based on technical merit, cost, or other actual crietria, but don't make them based on the notion that you may as well go with MS even if it is more expensive and lower quality because, "well, you know, MS is the only one that will be left in a few years" - that's a self fulfilling prophecy. With that attitude we may as well stop working on Linux, *BSDs, office applications, web servers, compilers, and well, software.
Hyperbole is the worst thing ever.
Microsoft has moved its mindshare strategies to web services, leaving the only big backer of LDAP
Yet, at the IETF meetings, the various LDAP efforts all have Microsoft employees on the committes. Novell is noticable by the absence of Novell people.
I keep hearing all of these announcements about LDAP-generic tools, but I don't think anybody is answering his questions. He's talking about USER-SPECIFIC tools, which is rather lacking. Granted, there are many different schemas for users, but it's more or less only a couple of standard schemas (that come with OpenLDAP).
There's not that many good user management tools for LDAP. I don't feel like typing it in on raw mode with GQ, when a lot of it is duplicate information (to make sure it gets caught with the different schema names).
Zodiac Survey
I've been trying the same, and have run into the same lack of tools for managing an LDAP server as an authentication backend. However, I've also noticed that using OpenLDAP v2 is a _whole lot_ slower than a NIS authentication system. This just isn't really acceptable. I've tried looking for a performance-tuning guide for OpenLDAP's slapd daemon, without success. Anyobdy know of any such guide, or have experience getting better performance out of slapd?
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
something like phpMyAdmin, but for LDAP.
phpMyLDAP / phpMyDirectory?
check it out at http://www.iit.edu/~gawojar/ldap/
FWIW, Novell also offers free downloads of LDAP libraries for C and Java although you might have to register for their Developer program.
Access from: developer.novell.com
http://pages.infinit.net/aaricia/ldif2html.c
I wrote this in hurry one morning...
Could be what you're looking for
Could be not.
So, you take a leaky public domain protocol.
Then you invest huge amounts of money in improving it.
Suddenly you're not supposed to recoup your investments and prevent your competitors from benefitting from your work?!
Tell me, have you ever visited the planet Earth?
As the host of open-it.org, are entire focus is solving this problem. Many people are actively working on integration with ActiveDirectory, and other tie ins, and people loosely associated with Open-IT are working in various projects that help resolve this (Samba-TNG supports ldap backends).
As for management, we now host Directory Administrator,a great GTK front end to user management, I have also created a simply useradd program for creating users in ldap (its called addluser).
We are currently working on a new release of Directory Administrator with a new backend which will allow CLI, GUI, and Web clients to be built on it. Further, if you love WebObjects, Apple just released 5.1, which has a JNDI adaptor, allowing quick Web Apps to be built against LDAP directory servers using Java.
Is the documentation not up to snuff at Open-IT, then help out! We have some basic howtos, and I package pam_ldap, nss_ldap, openldap, and other great things to get you going.
Back to work...
LDAP is a pain, but there are some nice features of LDAP that save time. If the requirement really is just a contact list or something simple with a fixed schema, then LDAP might be a choice. Some LDAP servers have built in matching so that a search for say "john d williams" will also return "john david williams". I don't remember which ones support it, but if the project requires building synonyms and abbreviation matching, LDAP can save time. It all depends on the intended use.
Well, I'll post a pointer to Ganymede, which is not specifically for LDAP, but which could probably be useful in a lot of environments.
Ganymede is at once simpler than LDAP, in that it doesn't support the kind of hierarchical objects that LDAP and x.500 support, and in that it doesn't actually speak LDAP, and more complex, in that it has a sophisticated transactions model and can handle complex concurrent operations while maintaining namespace and referential integrity.
Ganymede is useful if you want to have a smallish (less than 50,000 users, say) 'flat' directory, but for which you want to allow detailed permisison delegation and fine-grained concurrency. If you have a very large NIS domain and you want to allow scores of users and admins to be changing their passwords and account information concurrently, Ganymede will work wonders for you.
We actually use Ganymede for just about everything here, up to and including our DNS, although we don't have our DNS support code 'productized' yet. We do master our LDAP directory from Ganymede data, in order to support applications which can use an LDAP server for an address book (such as Outlook and Netscape Messenger). If you were to combine Ganymede with something like Thomas Reith's ldapdiff utility, you could combine Ganymede's sophisticated administration services with LDAP for distribution.
- jon
Ganymede, a GPL'ed metadirectory for UNIX
I ran up against the same problem, using LDAP for a dropin replacement for most authentication systems (PAM, etc) isn't very practical since there are almost NO tools available for management.
The problem is the lack of defined specifications for what objects in LDAP have what attributes. CompanyA might want certain things in a user object, CompanyB might want other elements there.
It's good and bad. The scalability and flexibility is that there are few specifications, the downside is that there are no tools because of this.
I ended up writing a web based admin application in perl which did add/delete/update. I can't post it since it's not mine to post. It's not hard to write however.
Net::LDAP, DBI:LDAP, and LDAP::API are all good perl modules for manipulating OO databases via LDAP. I used LDAP::API, since it was the only one available at the time.
LDAP is supposed to be a general directory that is, effectively, a database. In the IBM implementation the backend is a database (DB2). The directory information is stored in it. It is used in various ways as described in earlier replies
JNDI homepage
I'm finding the biggest stumbling block for LDAP is.... how to organized things! Are there any good resources for designing a LDAP database?
What the heck's wafting through the ether around here? Moderations are getting ludicrous. While you might not value this guy's opinion, he hardly linked to goatsex or anything. Some other posts in this thread also got modded Offtopic and Flamebait while being perfectly servicable posts.
-
there is a great tool that I use here at work for browsing. LDAPExplorer, you can download the trial at download.com. The company that made it also has a web solution, but it costs money.
I've used iPlanet (formerly Netscape) LDAP directory and tools for many years and they are damn hard to beat in my opinion.
First, yes I know that this is probably a troll. However, on the off chance that it isn't, I have these questions for the AC.
1) If the public protocol is leaky, why not develop their own, totally different & competing protocol?
2) If they did care about the public domain issues and improvement, why not submit their improvements to the standards body to have their "improvements" included?
3) Failing or separate from this, why not license out their "improvements" to other software vendors? They would still make money, right?
I think the truth is that while it is possible that MS may have made a few small improvements (doubtful, but possible), their real goal is to ensnare new customers and to dig existing ones even deeper. If you still disagree, I would appreciate hearing any lucid arguments.
Are you talking about the Sun JNDI browser.
I ran this recently and it has an LDAP through JNDI browsing capability.
I remember being able to search through global groups, for example, and other lists.
I had to download the JNDI 1.2.1 stuff, and all the various JNDI plugins (including the LDAP one).
I suspect it was not designed as a sysadmin tool, but one could be written with the JNDI API.
"We can't solve problems by using the same kind of thinking we used when we created them." -- Albert Einstein
Go to the CNN website and scroll down to the bottom of the page. Look over to the right. CNN uses eDirectory to track the stories you read, and then serve you custom content (and advertising) based on your apparent interests.
---------------------------------------------
SERENITY NOW!!!!!!!!!!!!!!!!
Here and Here
Softerra's LDAP Administrator is pretty good, and they have a freeware version called LDAP Browser. The LDAP Browser/Editor is nice also.
If you are using LDAP as your addressbook, ldap-abook is a nice interface to add/delete/modify entries. Most email clients are LDAP-aware these days and it's convenient to be able to share an address book between my personal and work email accounts.
I've had to roll my own to do system accounts, however. Make ldapmodify your new best friend, or write an interface of your own - there is a lot of support for Perl or PHP LDAP functions out there. Server-side, I've used OpenLDAP and iPlanet's Directory Server, and I prefer iPlanet. iPlanet has a free non-commercial license option, is significantly faster than OpenLDAP, and has hooks to synchronize with an NT or Active Directory domain so you could do all the user administration in Windows and they would propagate over to your LDAP server.
Other fun things you can do with LDAP are:
Handle Unix authentication through pam_ldap
Hook into NIS with the NIS/LDAP gateway
Authenticate through apache with mod_auth_ldap or auth_ldap or Netegrity
Centralize your smtp routing data in LDAP for sendmail
Good luck.
Also, you might check out iDSRK from iPlanet. It's a set of performance testing tools, a tool for generating bulk loads, etc. Quite useful in some circumstances.
-jeff
-- Two men say they're Jesus. One of them must be wrong. - Dire Straits
Links: Webmin & Freshmeat page for LDAP module (LDAP module site is in French but easy to grok);
http://freshmeat.net/projects/ldap_module
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
I've found this one to be more than sufficient. Runs on Java.
http://www.iit.edu/~gawojar/ldap
http://www.mcs.anl.gov/~gawor/ldap
Mike
iPlanet's Directory Server Resource Kits has a ton of cool tools, including an ldap tcl scripting shell, a kerenel/tcp tuner, perldap, all the standard utlities, performance testing and load generation tools, ldif modification scripts, core analysis tools, db analysis tools for iPlanet, iPlanet log analysers, and some security tools. Its free....
. ht ml
http://www.iplanet.com/downloads/developer/5089
WebObjects includes a JNDI/LDAP adaptor, so you can treat it like any other database. Using this, you can quickly whip up whatever tools (web or otherwise) you need.
I don't get it, why the Linux logo? WTF does LDAP have to do with Linux specifically?
The poster from what I've seen didn't even mention running Linux.
Plenty of good apis for ldap.
The C api is straight forward, and tcl has a nice
interface to ldap as well. That in conjunction with TK gives you 90% of the tools you need to write
some inhouse apps.
If the public protocol is leaky, why not develop their own, totally different & competing protocol?
If a theory in Physics if found incomplete, why not develop a completely different alternative theory? Because some of the earlier work is OK! It just needs some fixes.
why not submit their improvements to the standards body to have their "improvements" included?
Unless you can patent the improvements you've made, where's the profit in that?
why not license out their "improvements" to other software vendors?
Would "gaining a business advantage first" do for a reason? Patent the improvements, refuse the license until you've gained a dominant market share and then release the innovation to the others. That's how business is done.
If you work for an Oracle shop, you can use Oracle Internet Directory LDAP, which is based on Oracle's Application Server product. Details here.
really ... i'll do that right away.
A quick plug for a useful LDAP-related tool I wrote: it's an LDAP to DSML (version 1.0) gateway, which allows you to read DSML (which is an XML-based language) out of, and write it to, any LDAP-enabled directory server.
:-)
It's not graphical, though
Find it here.
Gerv
the ldap database is accessed with a hacked version of the old web500 gateway shit (i know because I've had to modify the code myself a few times, to fix some bugs we've found). The difference is we use access control lists, and limit information spread to one of the following choices:
- nobody
- On campus IP's
- Everybody
.This seems satisfy just about everyone. And, of course, there's always the "dont release any information about me to anyone, ever" form any student could fill out, but nearly nobody does (it's kinda stupid to go to a school known for getting students published, and then request that the school never release information, right?)
Uhhh, what corporations are you talking about? Every large corporation I've worked in uses one. The corporation I work in now (I won't tell you the name but we sell film in a distinctive-looking box) is heavily into LDAP, and with good reason. It's a perfect standards compliant place to store and retrieve directory information, store authentication information, etc.
Look - LDAP is not for everyone or every application. It has its place. Aside from the original intent (X.500) being email/phone book look up LDAP (directory servers) is a fantastic tool for user provisioning and identity management. To answer the question of LDAP tools, where are they? some of the best are the command line tools available on Solaris from the install. You can also download and install iplanet to get the binaries, ldapsearch, ldapmodify, ldapdelete. (Just don't use that directory if you don't want to. The binaries will work against any LDAPv3 compliant server.) Oracle also makes a good directory server, Oracle Internet Directory (also available for free download in both UNIX and intel versions). This server utilizes ldapadd (which is simply ldapmodify -a). It also includes ldapbind for testing a bind, good tool.
If you aren't techy enough,
Cold Fusion and other application servers have excellent built-in functions to call, update, add, delete, etc., an LDAP directory.
Check out the LDAP module at CPAN. 'Course, if you don't already know Perl it will take you an hour or so to learn it, but I think you will find it to be the most flexible and powerful LDAP tool available.
include $sig;
1;
I'll go so far as to say that is one of the most retarded statements I have ever seen on a somewhat intelligent board. EVERY SINGLE FUCKING SOFTWARE COMPANY IS HEAVILY INVESTED IN LDAP. That goes for Microsoft (Active Directory), Sun (iPlanet LDAP is now the backend for all Solaris services), Red Hat (PAM/LDAP, nss, etc.), Novell (NDS), IBM (Websphere and the whole Lotus/Domino stuff is natively LDAP), Java (JNDI services), AOL / ASPs (all customer accounts are in LDAP), Yahoo, etc. etc.
You should really know at least SOMETHING the fuck about what you are talking about before puking out any more words.
----- Refactoring is the reason why man does not mistake himself for a god.
.... is knowledge.
Try this book - Sometimes referred to as the LDAP Bible
Actually, it takes some tweaking.
There is a poorly documented (gee, surprise surprise) option to add indexes (at least for the ldbm backend). Try putting
index cn,gn,sn,uid,objectclass,o,ou pres,eq,sub
in your database definition in SlapD. Note that you will need to rebuild the DB after that. I suggest exporting it to ldif (via 'ldbmcat -n > file.ldif' with slapd offline), delete the db, then reimport (via 'ldif2ldbm -i file.ldif') and restart slapd. You will notice a *SERIOUS* speed increase during search and a *SERIOUS* speed loss during the initial import. Unless you're doing tonnes of updates, you shouldn't have any speed issues with updating it, though.
I think Mauve has the most RAM. --PHB (Dilbert Comic)
Databases and LDAP are different technological approaches to different problems. Relational databases store flat relational information really well, but if you need heirarchical storage, then LDAP is probably a better way to go. That's why it is often used in enterprises rather than database engines to represent users and tiered attributes such as entitlements to different systems, etc. You are right that no perfect solution exists yet, but a lot of companies had great experiences with Novell's NDS (which is heirarchical and based on x.500 and is also what LDAP is based on) and they are moving towards LDAP as the core technology. This way, they can get their Netware, unix, mainframe and web apps to use the same data source for all their authentication and entitlements needs.
Novell have made a great tool for their eDirectory (formerly known as NDS) called ConsoleOne. This is java-based. eDirectory runs on Linux, Netware, Win NT/2000, Solaris, AIX, True64 and is very very fast.
This trolls all Windows users and sarcasm-impaired Linux users. It is brilliant. I thank you from the depths of my anonymous heart.
I am working in a set of tools to replace (and work with) adduser, deluser, moduser, addgroup, delgroup, modgroup and so far.
Unfortunally I had other priorities and the development is slow.
If you cannot find anyother replacements and still interested, let me know.
My e-mail address is raul_nospam_please@dias.com.br
BTW, the reason I started with it was because I couldn't find either descent tools to work with
PAM_LDAP too.
LDAP and SQL are considerably different beasts for different purposes. What you propose is basically to say that screwdrivers make decent pry bars, so why ever buy a pry bar?
o n+ sql&selm=36AD06E4.F7362E47%40netscape.com&rnum=9
Here is some information comparing LDAP and SQL from the OpenLDAP FAQ:
http://www.openldap.org/faq/data/cache/378.html
And here is some from an old usenet post. It's specifically talking about why Netscape's LDAP server uses it's own database instead of a RDBMS, but it has lots of good information about how directory services and RDBMS's differ and why one does not make a good substitute for the other.
http://groups.google.com/groups?q=ldap+comparis
But how would nimda or september 11th effect the load on your LDAP server? I'm not denying openldap's capabilities because I've only used it in development situations so I know jack, but I just don't see the correlation.
This sig has been temporarily disconnected or is no longer in service
I don't see why this was marked flamebait. Its quite a reasonable comment - There are plenty and increasing numbers of people moaning "this is crap there are no tools", and fewer people who do something about it.
People are very quick to anounce there is a hole in the dam but very few who walk up to the dam and plug the hole.
No flame intended - its an observation.
.
"Things that you own end up owning you" - Tyler Durden (via Diogenes of Sinope).
If you're looking for a configurable tool to browse an LDAP directory, Novell's eGuide does it via a web browser and is free. It lets you choose how it looks and what it does to some extent. Hope it helps.
LDAP is a protocol, not a service.
The LDAP protocol is used to access the DIRECTORY of your choice. There are NO LDAP SERVERS!
Light Weight Directory Access Protocol
Many directories support LDAP, but you have to be running a directory service before you can use LDAP to get at the data in the directory.
Novell's eDirectory is a great directory service, but there are other good one out there too. MS's active directory supports LDAP V3 with a couple of minor glitches.
There are lots of LDAP based tools out there. I believe there are even TCL add-ons for LDAP.
I completely agree that it CAN be used for a great benefit, but in my experience it rarely is.
I see a similar but less epidemic problem in the mis-use of XML. At least three projects I've come into with XML being used to store 100% flat properties. With no hierarchy, and only one project searching only one database, there is no point in using LDAP except that people seem to think they're supposed to.
Certainly a protocol is not responsible for people mis-using it, but LDAP seems to lend itself to this mis-use through a lack of real clarity for beginners about what it is for and a lack of simplicity in its interface for building good examples.
I used to think that there were no good LDAP tools either. I then discovered GQ. I know that you said you prefer web or console, but this little X/GTK beauty is perfect for LDAP administration. I used it all of the time to add users, modify users, and to delete users.
Wherever you go, there I am...
The modules work fine for searing, adding, modifing, etc. I just can't seem to find versions that work with the 2.X.X series of LDAP!
http://www.arlut.utexas.edu/gash2/
We are in the building phase at my company and this looks like a really powerful tool in the right hands, you will have to build your own schema, but for good flexibility you will want to. It supports any executable file as the backend, so you can write a perl script that updates the password on the LDAP server when it is changed, etc. Check it out
Coming from a Netware world into a NT one is literally painful. I'm used to showing up late, and leaving early with long lunches in between. Not worrying that my servers need to be rebooted once a week because they don't work with the Tape Library driver. Netware needs to market their product. Any comparison between NT and Netware would show NT as the pathetic waste of bits that it is. They finally ARE trying to market it, check out www.whytheylie.com And be sure to watch the video clips.
If you're looking for a single sign-on solution, this is the way to go. You don't have to do much of anything and best of all, it's free.
I have been down that path myself and have come to conclusion that LDAP sounds great when you sit around talking about it. It's the best thing in the world and would be so cool, right? Then you actually try and implement and LDAP solution and realize that LDAP isn't as cool as you thought it would be.
There is limited good documentation. There are a limited number of tools available and it's just hard to get going.
LDAP works well if you work somewhere that has the resources to devote to the LDAP implementation and maintenance. Trying to it all be yourself, just isn't a reality (unless you are an LDAP guru which I am not).
I am not saying LDAP is bad, there just aren't any turnkey solutions out there.
LoRider
I administer OpenLDAP, NDS, and ADS directories and have found the best GUI tool to be:
http://www.iit.edu/~gawojar/ldap/
I moved a 700 workstation environment from NIS+ to OpenLDAP, and it worked just fine with around a 500 user daily load (IMAP, Samba, shell, Mac, Web auth, etc.). Consolidating the multiple MAC/UNIX/Windows user databases was a good thing. We had around 10000 total accounts. Simple read only replication never caused us a problem, other than the initial replica install, where the master was on Sparc and the slave was Intel, so an endian switch was needed, (using gdbm). The master ldap server was an old SUN ultra 5 workstation with 64MB of RAM.
I found reading the manual and using ldapmodify to be quite helpful. A little Perl didn't hurt either. In general, systems administration appeard to solve most problems we encountered. Haven't yet found a magic program able to replace a good UNIX systems administrator.
Someone mentioned the lack of NIS netgroups, I didn't miss them. Subtrees are configurable for ldap clients, and on the server side the PAM access module works quite nicely.
Read, experiment, test, implement, troubleshoot, enjoy.
> OpenLDAP works great when configuredc orrectly, even under heavy load.
I can only say WOW. Now if it really works for you, would you be so kind to write it down and post it somewhere on the web for the others to see? I'd say i'm not the only one who feels the lack of such documents.
Hi, I exactly did the same stuff lately. With some friends, we're running a server that hosts some domains. Because I wanted to learn about LDAP, I thought that it would be a nice thing to put all the userinfo into an openldap tree and even authenticate to it.
The same problem I encountered: There are some ldap-browsers, but no big implementations.
Maybe our setup is a bit too specific, so I had to write my own tools (long live perl). Our setup consists of accounts, these accounts can contain multiple posixaccounts, domains, virtusers and vhosts.
I looked at some webbased apps for ISP management, but they always have a domain on the toplevel.
I managed to make a tool, but found out that the slapd from debian doesn't have TLS support, so security still is an issue for me, because users have to be able to modify parts of the tree.
But IMHO, I find ldap pretty funky, well suited for a lot of stuff and above all really scalable.
That is pretty simplistic.
/etc/passwd.
/etc/passwd and don't come with LDAP plug ins for all the apps. Windows, by comparison, forces you to use their directory service, so everyone starts out being able to use a centralized directory server.
LDAP stores contact info, but it's main purpose is to authenticate users. It's a network-wide replacement for
LDAP APIs are used to create plug-ins for different servers so that they can also be used to authenticate against the LDAP database.
The database differs from a relational SQL-style db, in that each user/record can be extended (have columns added) without modifying the entire database. In OO, I think this would be a composite object.
LDAP is the opposite of useless. It's vital. The problem, for Unix, is that LDAP exists, but the tools suck, and the default installs of unix still use
And yes, there is a Linux version.
Tim Massey
Linux IT Consulting and Domino Development in Michigan
LAST (http://www.sysadminsith.org/software/last/) is a very nice tool and has been working out great for sub-delegating administration of our LDAP server.
Unlike any of the other web-based tools I have seen, LAST doesn't assume (too much) about the layout of your LDAP server. There has only been one thing I had to change in source for this to work perfectly with our layout.
It allows you to build templates for different entry types/objectClasses (posixAccount, qmailUser, whatever). You can control access to these templates, verify the data being written, etc.
There isn't an online demo, the documentation only covers the bare basics.. pretty much comes down to you have to know a little bit about what you are doing to use this tool (but if you don't know what are you doing trying to setup tools to administrator an LDAP server?).
Kenny
Mail me if you actually want more info or a demo (kenny@muspellsheim.net)
The reference LDAP implementations use a database tuned for read-mostly access, which makes sense in context. A traditional RDBMS would not perform as well.
The ease in extending the schema 'on the fly' is also a major plus over traditional DB environments.
The protocol is fine, the implementations make sense, and the overwhelming cross-environment support makes it a winner for implementing authorization & authentication solutions.
NeXT's NetInfo, now available in the BSD flavour called Darwin (hence also in Mac OS X), is an abstract Directory Services architecture which encompasses most anything, including NIS, LDAP and Unix flatfiles.
UI tools - browsers, query tools, whatnot - exist for most everyting, and XML import and export (as well as bridging imports and export to a slew of formats, including classic flatfiles) are a no-brainer.
Its `a graphical browser for LDAP directories and schemas. Using GQ, an administrator can search through a directory and modify objects stored
in that directory'
It comes as Red Hat's standard LDAP admin tool. Get it here. Its not as good be, but neither is directory administrator the last time I looked.
Novell has a JDBC driver for LDAP. It maps SQL statements to LDAP(At least those it can. Those it can't map directly to LDAP it does it's own joining of the data). Its a free download available at developer.novell.com/ndk/ldapjdbc.htm Its also 'works with LDAP 2000' certified. (From the OpenGroup) This means it should work with any LDAP compliant directory. Its useful if you have normal reporting tools that use JDBC drivers. For example StarOffice can import data from JDBC drivers with a nice GUI - This way you don't have to know about the LDAP syntaxes or anything about LDAP except that its a Data Base. They also have an ODBC driver that only works with eDirectory(NDS). Hope that helps.
I use OpenLDAP 2.0.14 for Linux. To edit/browse the LDAP directory I use LDAP Explorer 1.16, although the newest version is 1.17. It's web based and done in PHP 4.x:
http://igloo.its.unimelb.edu.au/LDAPExplorer/
The opinions in this comment are subject to GPL, you can copy, modify and redistribute freely (as in speech).
http://www.ldapzone.com
http://developer.novell.com
http://www.openldap.org
Just thought I'd list them!
Mj
There is an Indian company which provides
attractive tools for managing LDAP servers.
They provide tools like PS Enlist which
will let you use SQL to manage your LDAP
directory. They also have a tool called
Ensure which will let you sync data with
a database.
Their URL is http://www.persistentdata.com
Got a brochure from Novell the other day. Lots of ad-speak with possible reasons why Microsoft is spreading certain untruths about Novell's products.
However, fold the card ala the back page of a Mad magazine and the messsage gets condensed to just three words:
"Their Products Suck"
If you don't want to repeat the past, stop living in it.
I've used the DMT tool, and found it lacking. At least in v3.2.1. It has serious issues when you attempt to modify the schema. I've only used it with the SecureWay directory, and because the schema storage methods tend to differ between vendors, it may not even work with yours.
Blar.
With NDS Novell provides a great directory and great tools to manage it. ConsoleOne, the main administratotive tool, is now almost entirely written in Java so it runs across many platforms and NetWare 6 provides very nice, very functional browser based management of the directory. Novell Account Management provides entry-level account management of Windows systems (NT domain emulation) and Unix (NIS / PAM). And using DirXML, NDS can be synchronized with pretty much any other data store.
Hello? LDAP is not a directory. LDAP is a directory access protocol. GEEZ.
A directory requires a DB, but a DB cannot be a directory.
Come on...get your facts straight. There is no such thing as a LDAP directory and a RDBMS will not solve your directory problem.
LDAP has become a very important tool at our facility. We have a mixed Windows 2000 and *NIX environment with AD and OpenLDAP directories. Our sister corporation has one of the fastest clustered Alpha systems in the world and they used it to map the Human Genome. Our business unit was created to embark on an even greater technological and medical endeavour. The regular user community is comfortable with Windows so we give them that. However, we rely only on *NIX for anything mission critical or requiring stable computing power. We have installed OpenLDAP to take care of everything outside of Windows. The following OSs authenticate (or will) from OpenLDAP: Slackware, Redhat, TRU64, Solaris, AIX, Nortel, etc. This gives us a single user/password for the users of any of those systems. In addition, I have coded over the following software to authenticate against LDAP: IRMA 0.8 http://irma.incubus.de/ IRM 1.3.3 http://irm.schoenefeld.org/ Document Manager http://www.rot13.org/~dpavlin/docman.html The following software already takes advantage of of LDAP: Horde/IMP 2.0/3.0 http://www.horde.org QMAIL http://www.qmail.org Rolodap A very good LDAP useradd, passwd change, etc. Java tool: Java LDAP Browser V 2.8.2 http://www.iit.edu/~gawojar/ldap http://www.mcs.anl.gov/~gawor/ldap You can also use IRMA for user/group management. We initially started with IRM, but we are moving over to IRMA since it is very clean code and easy to extend. We use Netscape Communicator 4.79 Roaming profiles so that users that move between Windows and *NIX can have their bookmarks, address book, etc. readily available. Don't use the mull.schema because it has a couple of errors. I will be posting the correct schema at http://www.igranite.com in a couple of weeks (the domain doesn't point anywhere at the moment) as well as more LDAP info. You may search IMP mailing lists for the latest schema I posted. A project we would like to see started is LDAP Gina. I have no programming experience in Windows, so it would be great to have a community knowledgeable in both *NIX and Windows create an LDAP Gina. I found a NIS gina which could possibly be extended to LDAP? As many corporate orgs are probably finding out, the GNU, GPL, and Linux community are producing high caliber software and solutions for corporate use. Linux is fast becoming the center of desktop use, already solidly beating back an attempt by Windows to break into the corporate *NIX environment. Having lost the server fight, no wonder why a MS memo ordered a clobbering of Linux. Could you have ever changed the code like we did using commercial software / OSs? And we will be uploading our changes to the respective authors to make the software that much better.
LDAP is supposed to help make it so you can access everything on your network (or company resources/services) without the need for a zillion accounts and passwords.
But guess what. I work for the company that makes the most popular enterprise-level ldap server and we still have several dozen different login names, different passwords and even multiple address/user-information resources (ie, not just a quick ldap lookup to get information on joe blow's phone number from office 14).
So LDAP is worth fuck if you dont' actually USE IT FOR SOMETHING.
Please...LDAP is a ACCESS PROTOCOL. How can it be used for contact/location/description information????????
Plllleeeeaasssssseeeee. DBs are not designed for READING information fast, DBs are meant for storing information.
LDAP is meant to ACCESS that STORED information.
I've been involved in several LDAP projects around my company. Authenticating Linux boxen, home grown apps and Checkpoint firewalls.
The best LDAP tool I've found so far is.. NWAdmin (or ConsoleOne). Does everything I need, easy to navigate, etc.
Oh, only one problem with it: it requires a win32 box. And having a Netware 4.x or higher box around is also a requirement
(OR NDS for Linux, which I hear Console One works with!).
As an added benefit, the Netware box can run RADIUS server, filling all your LDAP/NDS/RADIUS needs in one!
actually, i'm quite amazed that this topic came up because a centralized directory mechanism can make administration _MUCH_ easier. i'm actually very suprised that most unixes (including linux) don't do anything better than NIS(+).
LDAP became the mechanism by which I manage my own network with greater ease: i use LDAP with NSS for user management (and allow users thereby to manage themselves). i use LDAP for DNS (of course :), i use LDAP to manage certificates, and employee information, and i also use LDAP to keep track of customers (for billing).
i've had to write a lot of my own shit to make it work (billing, and DNS - but now the DNS is gpl'd so youall can be happy with it), but alot of it DOES already exist. using NSS and PAM, you can manage users with ldap, and with vpopmail/qmailpatches you can run mail over ldap.
as for useradd/userdel/etc -- you simply don't need them. you can write a very simple shell script to ldapadd new users and delete and modify them (as i have done).
as for browsers: i happen to like GQ. but tbh, i don't do much browsing (i like robots). there's a java one floating around that works very much like Microsoft's LDAP browser (but free).
anyway, i'll spit my plug again:
LDAPDNS: FREE (GPL) LDAP-BASED DNS FOR EASIER ADMINISTRATION: ldapdns IS WHAT YOU NEED. USE IT BLAH BLAH BLAH
but really: ldap works great. it takes some balls to pull the switch (maybe someone will make it easier), but it is well worth it in the long run.
try Calendra.
I've been to their 1-day tech course in Paris, France, and I must say I'm very impressed. Never been much of a believer in RAD tools, a hardline coder.. But this one shakes my beliefs bigtime.
LDAP is a large part of my job, I've written dozens of scripts for handling various LDAP chores. And whatever you do I strongly recommend that as much as possible for any scripting, use something like Net::LDAP instead of using or wraping shell scripts around any of the OpenLDAP utils. Maybe it's just a project maturity thing or something, but the OpenLDAP people seem to have an infuriating habit of changing the behaviour/output of ldapsearch which means you will end up having to tweak or rewrite every script that uses it if you ever upgrade. That said the OpenLDAP utils are quite handy to have around, no matter which implementation you're running as your actual LDAP servers.
Also if you're running iPlanet/Netscape's directory server grab their resource kit, the ilash util which can do a lot of things, has a really nice feature in that you can drop an entry into vi and edit it. ud or whatever it's called in the OpenLDAP utils can sort of do that, but only for certain hardcoded attributes, and not the ones you're likely to need either.
LDAP has become a very important tool at our facility. We have a mixed Windows 2000 and *NIX environment with AD and OpenLDAP directories. Our sister corporation has one of the fastest clustered Alpha systems in the world and they used it to map the Human Genome. Our business unit was created to embark on an even greater technological and medical endeavour. The regular user community is comfortable with Windows so we give them that. However, we rely only on *NIX for anything mission critical or requiring stable computing power. We have installed OpenLDAP to take care of everything outside of Windows. The following OSs authenticate (or will) from OpenLDAP: Slackware, Redhat, TRU64, Solaris, AIX, Nortel, etc. This gives us a single user/password for the users of any of those systems. In addition, I have coded over the following software to authenticate against LDAP:
IRMA 0.8 http://irma.incubus.de/
IRM 1.3.3 http://irm.schoenefeld.org/
Document Manager http://www.rot13.org/~dpavlin/docman.html
The following software already takes advantage of of LDAP:
Horde/IMP 2.0/3.0 http://www.horde.org
QMAIL http://www.qmail.org
Rolodap
A very good LDAP useradd, passwd change, etc. Java tool:
Java LDAP Browser V 2.8.2 http://www.iit.edu/~gawojar/ldap
http://www.mcs.anl.gov/~gawor/ldap
You can also use IRMA for user/group management. We initially started with IRM, but we are moving over to IRMA since it is very clean code and easy to extend.
We use Netscape Communicator 4.79 Roaming profiles so that users that move between Windows and *NIX can have their bookmarks, address book, etc. readily available. Don't use the mull.schema because it has a couple of errors. I will be posting the correct schema at http://www.igranite.com in a couple of weeks (the domain doesn't point anywhere at the moment) as well as more LDAP info. You may search IMP mailing lists for the latest schema I posted.
A project we would like to see started is LDAP Gina. I have no programming experience in Windows, so it would be great to have a community knowledgeable in both *NIX and Windows create an LDAP Gina. I found a NIS gina which could possibly be extended to LDAP?
As many corporate orgs are probably finding out, the GNU, GPL, and Linux community are producing high caliber software and solutions for corporate use. Linux is fast becoming the center of desktop use, already solidly beating back an attempt by Windows to break into the corporate *NIX environment. Having lost the server fight, no wonder why a MS memo ordered a clobbering of Linux.
Could you have ever changed the code like we did using commercial software / OSs? And we will be uploading our changes to the respective authors to make the software that much better.
check
Um, excuse me. Perhaps I'm pulling a brain fart here, but just what IS LDAP? I know Slashdot is "news for nerds," but every nerd has to be introduced to a technology at some point, so please remember to expand your technology acronyms in a post.
Use Kerberos for authentication. There are PAM modules out there, and it is also supported in Windows 2000 (sort of).
You also need to distribute a passwd file. We store ours in AFS and distribute it using scripts run by cron. Since doesn't contain any password, users do not really need to touch it, but we generate the global passwd file from data in a database anyway. You might want to put stuff like e-mail forwarding information in that database as well, propagate it to the mail server using some simple scripts, and let your users access the database somehow. (Perhaps through a Kerberos authenticating gateway.)
KISS
I found this thing sometime and it rocked. Great set of VBscripts for AD stuff http://www.people.virginia.edu/~pjh5u/code/adsi_ap p.txt
DO NOT DISTURB THE SE
Oh great, another article written to sound like LDAP hasn't got past the experimental dabbling stage.
LDAP has had support in Netscape 4 and Mozilla for quite a while. Here's a fairly old HOWTO I wrote: How to set up LDAP in Mozilla 0.9.2.
Hi ! Simply use PAM_LDAP (http://www.padl.com/pam_ldap.html) to ensure that all existing Linux commands are automagically LDAP compliant (eg. useradd, etc). Actually, I have used LDAP a lot and even patched qmail to use LDAP for user lookups. And I don't agree with you that there are not enough LDAP tools around. Cheers
Visit http://www.persistentdata.com/ for the
best tools available for database and directory
integration.
-Shridhar.
There are plenty of sites with info about what LDAP is. Do a search on yahoo.com, dmoz.org, or google.com and you'll find plenty of sites. Basically, it is a standard, high-level network protocol (like http, ftp or ssh), that allows you to access directory servers. A directory server is basically a database that is organized hierarchicaly(sp?) and is optimized for a lot of reads and very few writes. They are useful, for example, for running address book servers (Outlook or Netscape, and presumably other email clients) can use an LDAP server for looking up email addresses given a nickname, or a full name of a person, or even a partial name that is unique.
Another purpose that they are sometimes used for is to implement network authentication services, similar to the way Novell or Win2K server allow you to log into any workstation on your company's/organization's network using a network account. Your login account, instead of being created on individual workstations, is created in the LDAP directory and when you go to login to a workstation, the workstation requests authentication from the directory server.
I'm sure there are other uses for LDAP directory servers as well, but these are the two most common. Cheers.
I recall reading something about openldap that lets you migrade your /etc/[passwd,groups,hosts,services,protocols,...] into ldap from flat text files. I believe it also supports name lookups ala DNS.
Is it possible ldap will be the future of Linux/UNIX? or perhaps even the internet?
Simple: woody's libs aren't compiled against openssl. See the bug reports:
g =8 0591&repeatmerged=yes
http://bugs.debian.org/cgi-bin/bugreport.cgi?bu
iPlanet LDAP server ships with awesome GUIs to administer and browse LDAP servers. You might want to try to download eval version and run only the GUIs, not the server daemons.
Classic bonehead things I did to make openldap installations and directories less-than optimal:
:-)
1. I didn't stay up on patches, so I was running versions with known performance bugs. I should have kept up.
2. I did lousy, MySQL-101-db-like, structures (flat as all get out), which made the tree and replication features somewhere between pointless and painful. I should have fanned the tree out to different servers, increasing the ways I could spread the load. I also went too far the other way, and made high-quality, relational, db structures, which made my entry count absloutely absurd. I should have tuned my design under load.
3. I tried storing large objects in a record (say, 10-100K gifs) in each record and then wondered why it too so long to move 500 of those records.... over a 56K line. I should have used pointers or references to external blobs.
4. In speed critical applications, I did non-filtering lookups (the SQL equivalent of "select * from..."), so I was slogging though millions of bits I didn't need. I should have specified the data I needed, when I needed it.
5. I indexed all sorts of things that didn't need indexing, basically wasting tons of CPU for lookups that wouldn't be needed. I should have only indexed fields that were being frequently used, for the way they were being used.
6. I tried to stored transactional information, stuff that changed every few seconds or minutes, in an LDAP implementation that wasn't designed for "row or column" transactions. I should have used the right tool for that job, such as an atomic-transaction database.
7. When I compiled, I didn't use a fast backend, I accepted a slower gdb default. I should have used a tuned, compiled, backend.
8. I ran off of slow disks. I should never have tried to use IDE for a high-speed database.
9. I didn't tune LDAP to cache as much in RAM as possible. I should have tuned the slapd.conf entries.
10. I didn't deploy ldap servers at critical points, and instead, tried to use a few big ones. A tree of smaller servers would have worked faster.
11. I wrote scripts that did _really_ dumb things, like try to read and then edit every record in a live OpenLDAP *dbm database on the fly. I should have broken it into smaller work units,and treat the protocol on its merits.
12. Rather than pull a fast, clean, backup daily (which requires a restart), I was just running it until it died. I should have pulled regular backups, and the restart helps to close any niggling descriptors left open.
There's lots of ways to screw up any program.... I've killed apache with oversized log files and open fds, I've brought postgresql to it's knees by neglecting maintenance, I've brought MySQL to a dead stop because of file sizes (ugh.) and table design.... the list goes on and on.
That doesn't mean that apache, or http, sucks, or that SQL is useless, it means that tools have to be used properly, and learning the limitations of your tools is a painful step in learning how to use them.
HTH,
-Bop
It manges your LDAP for you, creates accounts accross all your enterprises resources, you'll find the product here
with this API you can write your own app, which handles delete, add, etc.
Works for me, servlet which acts as an addressbook 150K+ people, throughout an web-app.
pretty fast too.
sincerelly
carpe diem baby
This is definately the best available, from what I've seen. And is it definately too bad that it is a windows-only program.
Debian has one called "gq."
SORRY! what have you been smokeing
LDAP is a descendant of X.500 it Freakin well is a
directory - you can of course use it to provide autentication.
Oh and I used to support X.500 and X.400 sevices in the Uk
Having been involved in numerous corporate scale Directory deployments as a consultant, I think I can safely say you're underestimating LDAP, or rather, have a too narrow view of what it's for. Of course, Directory Datastores are a concept of a datamodel, and LDAP is both a protocol by which to access the data, and a way of representing it. The inherent flexibility of datamodelling in LDAP is precisely why you won't find the equivalent of 'useradd' as a generic tool. LDAP is not a replacement for /etc/passwd, it _can_ be. But what if the user in question also has associated with them an x.509 certificate, a maildir, an out-of-office-autoreply msg, .. well you get the point. Besides, it doesn't have to be a user you're representing in the Directory. Might as well be a machine, a network, or a customer, or a collection of urls (think roaming bookmarks)
So, in your specific situation; you roll your own. Get ldap client library wrappers for your favourite script language (Perl and PHP have excellent modules available, even if PHP's is a bit 'strange' on multidimensional arrays when dealing with multiple results/multiple values to an attribute), add twenty-or-so lines of business logic, some nice HTML tags, and Bob's your uncle :)
Don't be intimidated, you'll get two steps closer to enlightenment in the process.
I started a project a while back to write a web based schema builder. Initially it was for my project (ispman) and I wanted to write the tool simply to get my hands dirty with schema stuff (i learn like that).
Its avaialable for demo at
http://ispman.sf.net/schema/editor
Its incomplete (should work as proof of concept). So if anyone interested to work on it let me know.
Do the ERP, HR and CRM applications of the world (the usual suspects of SAP, Peoplesoft, Siebel, etc )used LDAP for user login profiles. (one password for these application, once place where the access profile is defined and maintained )
Also do the HR and CRM integrate with LDAP to allow data (on employees and customers ) to be in sync so that a)Employee has a new office phone number and/or title and this is changed once and reflected in both the HR profile and the LDAP white pages, and b) customer (who logs on web site) phones into call centre with issues and new information, which is reflected in their web profile.
The last time I looked into this the answer was no and no. That was 2 years ago. Has this improved any?
LDAP has great potential for custom work because it reduces the work of hand building another crappy login / authorization / authentication piece. But until the ERP, HR and CRM are integrated into the picture its a pimple on the ass of an whale.
How else, where else is it being used? What are AOL, Ebay, Amazon, GE, Yahoo (some said that their using eDirectory?) doing?
If you're well off, take a look at NetPoint from Oblix (http://www.oblix.com/).
It's much more than a LDAP tool, marketed more as e-biz infrastructure tool. The main feature is identity management but it also contains group management and generic management of LDAP/X.500 objects.
We're deploying it now and it will contain all our 40.000 internal users and a lot of our customers/partners. We're using iPlanet Directory servers and will use iDS as a metadirectory for all other directories (AD, NDS) that people might like to use (mgmt. decision). Hopefully LDAP will give us a single administrative point for userid/password for all our applications, including Web access, Unix logon, NT logon etc.
We see more and more systems beeing LDAP enabled, from application access down to VPN servers. We even have HP scanners where you use LDAP as the source for email addresses when scanning and mailing documents.
LDAP is here to stay !
Wow, what a searing and incisive rebuttal!
Whatever happened to
"I know you are, but what am I?"
What in hell is a/an LDAP?
O.k., coming in a little late to this discussion after making sure it was o.k. with my corporate masters :-).
The Java ldap browser I wrote is available for free download from Computer Associates. It comes with a Windows Install Version and a Solaris Tar file. (Being java you can probably persuade it to run under linux, but I've had trouble with Swing and linux, so no promises. If you can get it going, it runs about 4 times as fast as under windows though ... :-)
Quick Feature List... and kudos to my company CA for making it available for free download (normally it's packaged with our 'eTrust Directory' X500/ldap directory, which is pretty darn neat, but is *not* a free download :-)!
Unfortunately this is not (yet) an open source product, but if anyone uses it, finds it helpful, and writes to me, I'll have a better chance of persuading people here to make it so...
Wer mit Ungeheuern kämpft, mag zusehn, dass er nicht dabei zum Ungeheuer wird.