Using LDAP to Accomplish everyday administration tasks

Hicham Mourad

Solutions Lead, World Wide Support

Novell, Inc.

hmourad@novell.com

Stuart Smith

Solutions Lead, World Wide Support

Novell, Inc.

sasmith@novell.com

Trevor Roskewich

Solutions Lead, World Wide Support

Novell, Inc

troskewich@novell.com

Agenda

What is LDAP?

Using LDAP to perform searches

LDAP tools and examples

Useful LDAP commands

LDIF overview

Every day administration tasks with demonstrations

Questions & Answers

1

2

3

4

5

6

7

What is LDAP?

LDAP is an Internet standard protocol for accessing directory information. LDAP stands for Lightweight Directory Access Protocol.

RFCs 2251-2256 and 2829-2830 comprise the "core" of the LDAPv3 standard.

RFCs can be found at http://www.ietf.org/rfc

1

LDAP naming model

It is used to name LDAP entries

The format is:

cn=johndoe,ou=users,ou=provo,o=novell

The DN (distinguished name) is determined by walking the tree

The RDN (relative distinguished name) must be unique in the subtree

LDAP functional model

3 session operations

bind

unbind

abandon

2 interrogation operations

search

compare

4 update operations

modify, add, delete, moddn (Rename / Move)

LDAP is made up of 9 operations

2

3

4

2

Using LDAP to perform searches

Search Request Elements

Host / Port*

User DN / Password*

Search Base

Search Scope

Alias Dereferencing

Size limit

Time limit

Attributes Only

Search Filter

Attributes to Return

*Used in the LDAP Bind Operation

Using LDAP to perform searches (cont.)

Host / Port (default = localhost @ port 389)

The LDAP server / port you want to search.

User DN / Password (default = anonymous)

The username to be used to authenticate against the LDAP server.

Search Base

The search starting point. Provide the DN of the base object.

Search Scope (default = subtree)

Base = search for a single object or entry

One = search the base DN immediate children only

Sub = search the entire subtree

Alias De-referencing (default = never)

Whether to dereference alias objects or not. Either the alias can be returned, or the alias can be dereferenced to return the entry that the alias points to.

Never | always | search | find

Size Limit (default = all)

The number or entries to return.

Using LDAP to perform searches (cont.)

Time Limit (default = unlimited)

How long should the query run? (default = forever)

Attributes only (default = NO)

Retrieve attribute names only without values

Search Filter

Items to be returned based on search filter.

RFC-2254 compliant LDAP search filter

Using LDAP to perform searches (cont.)

Attributes to Return

Attributes to be returned by the search

Attributes are white space separated list which may include:

cn sn mail

no attributes

all user attributes

Attribute names

1.1

*

Using LDAP to perform searches (cont.)

3

LDAP tools part of the developers kit. These tools can be run at the command line. Can be downloaded at:

http://developer.novell.com/ndk/

ldapsearch.exe

ldapmodify.exe

A LDAP browser. Many can be found on the Internet. (demonstrate)

Import Convert Export utility (iManager / ConsoleOne® snapin). Can be run at the command line ,through the iManager interface, and through ConsoleOne GUI.

ldapdelete.exe

ldapmodrdn.exe

LDAP tools

Search Request Elements

Host/Port

User DN/Password used to bind

Base DN / Scope

Search Filter (RFC 2254 compliant)

Attribute list to retrieve

Example

ldapsearch -h hostname –p 389 -D cn=admin,o=novell -w password -b ou=provo,ou=users,o=novell –s sub (objectclass=user) cn sn title

4

Ldapsearch syntax

To read an entry

Set the base DN to the desired DN and filter to (objectclass=*)

To view an entry without any attributes

Use 1.1 as attribute list or specify “dn” as the attribute list

To view all the entries in a subtree

Set the filter to (objectclass=*)

Verbose mode

Useful for finding number of entries returned (-v)

Search tips

Modify Request Elements

Host/Port

User DN/Password used to bind

Change Operation File

Example

ldapmodify -h hostname -p 390 -D cn=admin,o=novell –w password -f changefilename

Ldapmodify syntax

Delete Request Elements

Host/Port

User DN/Password for bind

DN of object to be deleted

Example

ldapdelete -h hostname -D cn=admin,o=novell –w password cn=johndoe,ou=provo,ou=users,o=novell

Ldapdelete syntax

Ldapmodrdn syntax

Modify RDN Request Elements

Host/Port

User DN/Password for bind

DN of object to be modified

New DN of object

Example

ldapmodrdn -h hostname -p 390 -D cn=admin,o=novell –w password cn=jdoe,o=novell cn=jdoe,ou=provo, ou=users, o=novell

ICE syntax

ICE Elements

Host/Port

User DN/Password for bind

Source Handler followed by Source options

Destination handler followed by Destination options

Example

ice -S LDAP -s hostname -d cn=admin,o=novell -w password -F “(objectclass=user)” -b o=novell -a mail -D LDIF -f results.ldif

ICE

ICE concepts

ICE was designed to import and export from/to different sources/destinations. This provides more flexibility than traditional tools that understand only LDIF files.

ICE knows how to use information from:

LDAP directories

LDIF files

Delimited text files

ICE can be used to migrate between LDAP directories, export a directory to a file or import to a directory from a file. The “file” in this case may be an LDIF file or some type of delimited text file. Furthermore ICE knows how to use the LBURP protocol which can make bulk loading a less time intensive task.

Sample commands

Sample commands that you may find useful with ldapsearch and Ice

Example1: Retrieve the list of Distinguished Names for all users under the container O=novell

ldapsearch –h hostname –b o=novell objectclass=user 1.1

Example2: Retrieve the list of Distinguished Names for all users and their e-mail addresses under the container O=novell

ice –S LDAP –s hostname –p 389 –w password –d “cn=admin,o=novell” –F”(objectclass=user)” –b o=novell –a mail –D LDIF –f output.ldif -v

Example3: Retrieve the list of Distinguished Names for users with processed Identity Manager (DirXML®) associations to a particular driver under the container O=Novell

ldapsearch -h hostname –b o=novell "dirxml-associations=cn=NDSToNDS-flat,cn=driver-set,ou=servers,o=novell#1#*" “dirxml-associations”

Example4: Import a set of users contained within an LDIF file into a LDAP directory.

ice –S LDIF –f import.ldif –v –D LDAP –s hostname –p 389 –d cn=admin,o=novell –w password -v

Sample commands (cont.)

5

Introduction to LDIF

LDIF (LDAP Data Interchange Format) – RFC 2849

The LDIF format is used to convey directory information (content records), or a description of a set of changes made to directory entries (change records).

An LDIF file consists of a series of records separated by line separators.

Records can be Change Records or Content Records.

Content Records

Are usually the result from an LDAP query.

Have a basic format of name-value pairs. (usually “attribute name”:“some value” i.e. CN: David)

Change Records

Contain a set of commands for a particular entry (such as add, delete, or modify)

Used when you want to modify entries within your directory.

NOTE: You can NOT mix Change Records and Content Records in the same LDIF file.

Introduction to LDIF
Content records vs. Change records

Version Specifier

This is required by the LDIF specification as the first line in the LDIF file.

Zero or more spaces are allowed after the colon.

Example:

version: 1

Example:

dn: cn=johndoe, ou=provo, ou=users, o=novell

Distinguished Name Specifier

The first line in the content record must be the distinguished name of the entry it is representing.

Introduction to LDIF
Content records

LDIF Content Records

Example:

cn: johndoe

LDIF Content Records

Line Delimiters

Line delimiters can be a newline or a carriage return/ newline pair.

The LDIF specification requires that every record be terminated with a record delimiter which is a blank line.

Attribute Value Specifiers

Attribute value specifiers are in the following form. attribute: value

Introduction to LDIF
Content records

Example:

description: ThereIsSoMuchDataInThisFieldThatI

CannotFitItOnOneLine.

LDIF Change Records

Line folding with LDIF files

There are times when the information required by a field does not fit on one line. To fold a line, insert a line separator at the end of the first line, followed by a space on the second line before the remaining data. The LDIF parser processes this sequence by concatenating the lines and discarding the leading space

Introduction to LDIF
Change records

Example

# Johns password “Password” Base64 encoded

Userpassword:: UGFzc3dvcmQ=

LDIF Change Records

Comment Specifier

Lines beginning with the pound (#) sign are treated as comments and are ignored when processing the file

Example

Base64 encoding

Attribute values can be represented / encoded in Base64

Must use Base64 encoding to represent binary values

# This is a comment line in a LDIF file

Introduction to LDIF
Change records

version: 1

dn: cn=johndoe, ou=provo, ou=users, o=novell

changetype: modify

add: jpegphoto

jpegphoto:< file:///users/photos/johndoe.jpg

LDIF Change Records

URLs in attribute value specifiers

Used often with large attribute values

Used to reference the file that contains the data

The format is: file://URL

Example

Introduction to LDIF
Change records

Changetype Specifier

The existence of a changetype specifier indicates that the record is a change record

Changetype specifiers can be ONE of the following:

LDIF Change Records

changetype: add

changetype: delete

changetype: modify

changetype: moddn

Introduction to LDIF
Change records

version: 1

dn: cn=johndoe, ou=provo, ou=users, o=novell

changetype: add

sn: Doe

givenName: John

objectClass: inetOrgPerson

telephoneNumber: 555 555-5555

mail: jdoe@novell.com

userPassword: Password

LDIF Change Records

The Add Changetype

Used to add new entries to a Directory

An add change record requires values for all of the mandatory attributes of the entry’s base class

The objectClass attribute must be set to the base class and may also be set to the super classes of the base class

An LDIF file with multiple add change records must first add the container entries and then the leaf entries that will reside in the container (unless Forward Referencing is enabled)

Introduction to LDIF
Change records

version: 1

dn: cn=johndoe, ou=provo, ou=users, o=novell

changetype: delete

dn: ou=provo, ou=users, o=novell

changetype: delete

dn: ou=users, o=novell

changetype: delete

LDIF Change Records

The Delete Changetype

Used to delete entries from a Directory

A delete change record requires two items:

The distinguished name of the entry to delete

The delete changetype

Container entries cannot be deleted unless they are empty

The following example deletes multiple objects

Introduction to LDIF
Change records

add

Indicates that the values that follow should be added to the attribute.

LDIF Change Records

The Modify Changetype

Used to modify entries in a Directory

A modify change record uses one or more of the following keywords

replace

Indicates that the values that follow should replace the existing attribute values. Beware of the following conditions:

If no values follow, all values of the attribute are deleted

If the attribute has no values, the operation succeeds

If the attribute has any values, all values are deleted and replaced with the specified values

delete

Indicates that the values that follow should be deleted from the attribute. Beware of the following conditions:

If no values follow, all values of the attribute are deleted

If the attribute has no values, the operation fails

Introduction to LDIF
Change records

version: 1

dn: cn=johndoe, ou=provo, ou=users, o=novell

changetype: modify

add: mail

mail: jdoe@novell.com

LDIF Change Records

The Modify changetype with the add keyword

The following example adds a value of jdoe@novell.com to the mail attribute. If the attribute is multi-valued, it adds the value. If the specified value already exists in the attribute, the operation fails.

Introduction to LDIF
Change records

The Modify changetype with the delete keyword

Deleting an attribute value.

LDIF Change Records

version: 1

dn: cn=johndoe, ou=provo, ou=users, o=novell

changetype: modify

delete: mail

mail: jdoe@novell.com

The following example deletes the jdoe@novell.com value from the mail attribute. If the attribute does not contain the specified value, the operation fails. However, if the purpose was to ensure that the specified value did not exist in the attribute, the operation succeeds in achieving this result.

Introduction to LDIF
Change records

The following example deletes all values of the mail attribute. If the attribute does not exist, the operation fails. However, if the purpose was to ensure that the attribute has no values, the operation succeeds in achieving this result.

version: 1

dn: cn=johndoe, ou=provo, ou=users, o=novell

changetype: modify

delete: mail

The Modify changetype with the delete keyword

Deleting an attribute value.

LDIF Change Records

Introduction to LDIF
Change records

version: 1

dn: cn=johndoe, ou=provo, ou=users, o=novell

changetype: modify

replace: mail

mail: jdoe@novell.com

The following example replaces the existing mail value with the specified value, jdoe@novell.com. If the attribute is multi-valued, all values are removed and the specified value is added. If the attribute doesn’t exist, it is added with the specified value.

The Modify changetype with the replace keyword

Replacing a value.

LDIF Change Records

Introduction to LDIF
Change records

The following example adds a telephone number, deletes the fax telephone number attribute, and replaces the mail attribute. A line containing only a hyphen (-) character is used to mark the end of an attribute entry.

version: 1

dn: cn=johndoe, ou=provo, ou=users, o=novell

changetype: modify

add: telephonenumber

telephonenumber: 555 555-5555

-

delete: facsimileTelephoneNumber

-

replace: mail

mail: jdoe@novell.com

LDIF Change Records

The Modify changetype to specify Multiple Modifications in a single LDIF record

Introduction to LDIF
Change records

The Moddn Changetype

You can use an LDIF change record to rename an entry, move it, or do both in one operation

Modifying the DN uses two keywords

Moving an entry requires a third keyword

newrdn

Indicates that this line contains the new RDN for the entry.

LDIF Change Records

Keyword Description

deleteoldrdn

Indicates whether the old RDN value should be deleted:

0=save, 1=delete

When the old value is saved, it becomes an additional attribute value but is no longer part of the entry’s distinguished name

newsuperior

Indicates that this line contains the DN of the new container for the entry.

RDN

DN

DEL

Introduction to LDIF
Change records

The following example shows how to rename an entry and retain the old value

version: 1

dn: cn=johndoe, ou=provo, ou=users, o=novell

changetype: moddn

newrdn: cn= jimmydoe

deleteoldrdn: 0

The Moddn Changetype

Renaming an Entry

LDIF Change Records

Introduction to LDIF
Change records

version: 1

dn: cn=johndoe, ou=provo, ou=users, o=novell

changetype: moddn

newrdn: cn=johndoe

deleteoldrdn: 1

newsuperior: ou=toronto, ou=users, o=novell

LDIF Change Records

The Moddn Changetype

Moving an Entry

The following example shows how to move an entry from the provo container to the toronto container

Introduction to LDIF
Change records

version: 1

dn: cn=johndoe, ou=provo, ou=users, o=novell

changetype: moddn

newrdn: cn=jimmydoe

deleteoldrdn: 0

newsuperior: ou=toronto, ou=users, o=novell

LDIF Change Records

The Moddn Changetype

Renaming and Moving an Entry

The following example shows how to rename and move an entry in the same operation

Introduction to LDIF
Change records

When adding eDirectory Users to eDirectory Groups using standard eDirectory tools (iManager, ConsoleOne) you only need to modify one of the objects. The tools will handle updating the other.

Introduction to LDIF
GROUPS/USERS—Adding Users to groups with LDIF files

For more information see TID 10058526

Example on following slide

NOTE: You may need to modify the LDAP group object to map

Group Membership	to groupMembership

When adding eDirectory Users to eDirectory Groups using LDIF files you need to modify both objects.

version: 1

dn: cn=mygroup,o=novell

changetype: modify

add: member

member: cn=johndoe,ou=users,o=novell

-

add: equivalentToMe

equivalentToMe: cn=johndoe,ou=users,o=novell

dn: cn=johndoe,ou=users,o=novell

changetype: modify

add: groupMembership

groupMembership: cn=mygroup,o=novell

Example:

Introduction to LDIF
GROUPS/USERS—Adding Users to groups with LDIF files

Live Demonstration

6

Write an LDIF file that will create an Organization object called ABC, and two subordinate Organization Unit objects called NEWYORK, and CHICAGO.

Use ICE or LDAPMODIFY to import this file into the tree.

Everyday Administration Tasks
Live Demonstration

Write an LDIF file that will create 50 users in the NEWYORK.ABC container, and 50 users in the CHICAGO.ABC container. Be sure to populate the description attribute with two values of “description 1” and “description 2”

Use ICE or LDAPMODIFY to import this file into the tree.

Everyday Administration Tasks
Live Demonstration

Write a single LDIF file that will remove the value of “description 2” from the description attribute from all users in the NEWYORK.ABC container, and this same LDIF file will also DELETE all users in the CHICAGO.ABC container.

Use ICE or LDAPMODIFY to import this file into the tree.

Everyday Administration Tasks
Live Demonstration

Write a single LDIF file that will add all the users in the NEWYORK.ABC container to a group called MKTG-NY. Remember you will have to modify the group object as well as each user object.

Use ICE or LDAPMODIFY to import this file into the tree.

Everyday Administration Tasks
Live Demonstration

Generate an LDAP query that will return all users in the ABC organization AND have a Facsimile Telephone Number.

Use ICE or LDAPSEARCH to EXPORT this information

Everyday Administration Tasks
Live Demonstration

Agenda

What is LDAP?

Using LDAP to perform searches

LDAP tools and examples

Useful LDAP commands

LDIF overview

Every day administration tasks with demonstrations

Questions & Answers

1

2

3

4

5

6

7

Questions and Answers

2003-12-08T12:43:39