I recently setup centralized authentication system using OpenLDAP. Now I need to extend the users that are defined in the database to include a new object class that contains some security related data about them. How can I modify the existing entries to add this new object class? I'm pretty new to LDAP so don't bite my head off if I managed to ask a stupid question :P Thanks!
You can run
ldapmodify to modify one or more entries, you just need to feed to the program the credentials and a file containing all the changes you want to do
As an example (taken straight from openldap manual), if your file contains this it'll add/modify all those fields
dn: uid=john.doe,ou=People,dc=example,dc=com changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson uid: john.doe givenName: John sn: Doe cn: John Doe mail: firstname.lastname@example.org userPassword: password
Here is an example LDIF file to add the objectClass posixAccount to an existing entry
uid=testuser,ou=people,dc=example,dc=com of e.g. objectClass inetOrgPerson:
dn: uid=testuser,ou=people,dc=example,dc=com changetype: modify add: objectClass objectClass: posixAccount - add: homeDirectory homeDirectory: /home/testuser - add: uidNumber uidNumber: 1000 - add: gidNumber gidNumber: 1000
- are important to separate the add blocks. One has to make sure that all necessary attributes (for posixAccount
gidNumber) are added in the same file.
The LDIF file can be added e.g. with
ldapmodify -x -D 'cn=root,dc=example,dc=com' -W -f filename.ldif
OpenLdap Schema and ObjectClass are easy to extend. Look inside bundled schema if there is the object of your needs (located, on a debian filesystem is /etc/ldap/schema)
After you can modify your ldap entities and attached to them new objectClass (and, by extension, new attribute types).
If you want to build your own attribute type and/or your own objectClass you need to request an OID object number (OID Registration).
Then follow this schema :
objectIdentifier YOUR_OID <IANA NUMBER> objectIdentifier YOUR_OBJECTCLASS YOUR_OID:1 objectIdentifier YOUR_ATTRIBUTETYPE YOUR_OID:2
Then define your attribute type:
attributetype( YOUR_ATTRIBUTETYPE:1 NAME "your attribute name" DESC "quick description" EQUALITY typoofequality SYNTAX valid syntax
And your object class:
objectclass(YOUR_OBJECTCLASSS:1 NAME "your objectclass name" DESC "quick description" SUP top #or another objectclass inheritence MUST (list of must attributes, separated by "$") MAY (list of may attributes, separated by "$") )
The number following the YOUR_ATTRIBUTETYPE/YOUR_OBJECTCLASS must be unique (ie : one number for each attribute)
For reference, have a look at Open LDAP Schema Specification