summaryrefslogtreecommitdiff
path: root/docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml
diff options
context:
space:
mode:
authorGerald Carter <jerry@samba.org>2002-09-25 15:10:57 +0000
committerGerald Carter <jerry@samba.org>2002-09-25 15:10:57 +0000
commit115a39775cb923d026dde58633b6ba6aef3a1943 (patch)
tree4e9f7bb19788459fb8a8f88d52c59f3885d29fc6 /docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml
parentec0b8aa70454cab4a918ab09e8ed52d60b4b3256 (diff)
downloadsamba-115a39775cb923d026dde58633b6ba6aef3a1943.tar.gz
samba-115a39775cb923d026dde58633b6ba6aef3a1943.tar.bz2
samba-115a39775cb923d026dde58633b6ba6aef3a1943.zip
sync'ing up for 3.0alpha20 release
(This used to be commit b5d03c7b55fb2f34fa4d0228abe4389020e5ed5f)
Diffstat (limited to 'docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml')
-rw-r--r--docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml89
1 files changed, 68 insertions, 21 deletions
diff --git a/docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml b/docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml
index a66df0c767..6b153af6fe 100644
--- a/docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml
+++ b/docs/docbook/projdoc/Samba-LDAP-HOWTO.sgml
@@ -15,7 +15,7 @@
</author>
- <pubdate> (13 Jan 2002) </pubdate>
+ <pubdate> (16 Jun 2002) </pubdate>
</chapterinfo>
<title>Storing Samba's User/Machine Account information in an LDAP Directory</title>
@@ -39,7 +39,7 @@ on LDAP architectures and Directories, please refer to the following sites.
<para>
Note that <ulink url="http://www.ora.com/">O'Reilly Publishing</ulink> is working on
a guide to LDAP for System Administrators which has a planned release date of
-early summer, 2002.
+late 2002.
</para>
<para>
@@ -51,7 +51,8 @@ Two additional Samba resources which may prove to be helpful are
maintained by Ignacio Coupeau.</para></listitem>
<listitem><para>The NT migration scripts from <ulink url="http://samba.idealx.org/">IDEALX</ulink> that are
- geared to manage users and group in such a Samba-LDAP Domain Controller configuration.
+ geared to manage users and group in such a Samba-LDAP Domain Controller configuration. These scripts can
+ be found in the Samba 2.2.5 release in the <filename>examples/LDAP/smbldap-tools/</filename> directory.
</para></listitem>
</itemizedlist>
@@ -75,7 +76,7 @@ in the thousands).
The first is that all lookups must be performed sequentially. Given that
there are approximately two lookups per domain logon (one for a normal
session connection such as when mapping a network drive or printer), this
-is a performance bottleneck for lareg sites. What is needed is an indexed approach
+is a performance bottleneck for large sites. What is needed is an indexed approach
such as is used in databases.
</para></listitem>
@@ -96,7 +97,7 @@ Identified (RID).
<para>
As a result of these defeciencies, a more robust means of storing user attributes
-used by smbd was developed. The API which defines access to user accounts
+used by <command>smbd</command> was developed. The API which defines access to user accounts
is commonly referred to as the samdb interface (previously this was called the passdb
API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support
for a samdb backend (e.g. <parameter>--with-ldapsam</parameter> or
@@ -105,7 +106,7 @@ for a samdb backend (e.g. <parameter>--with-ldapsam</parameter> or
<para>
When compiling Samba to include the <parameter>--with-ldapsam</parameter> autoconf
-option, smbd (and associated tools) will store and lookup user accounts in
+option, <command>smbd</command> (and associated tools) will store and lookup user accounts in
an LDAP directory. In reality, this is very easy to understand. If you are
comfortable with using an smbpasswd file, simply replace "smbpasswd" with
"LDAP directory" in all the documentation.
@@ -162,7 +163,7 @@ in 2.2.2). The sambaAccount objectclass is given here:
</para>
<para><programlisting>
-objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL
+objectclass ( 1.3.1.5.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILARY
DESC 'Samba Account'
MUST ( uid $ rid )
MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
@@ -172,29 +173,45 @@ objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL
</programlisting></para>
<para>
-The samba.schema file has been formatted for OpenLDAP 2.0. The OID's are
+The <filename>samba.schema</filename> file has been formatted for OpenLDAP 2.0 & 2.1. The OID's are
owned by the Samba Team and as such is legal to be openly published.
If you translate the schema to be used with Netscape DS, please
-submit the modified schema file as a patch to <ulink
-url="jerry@samba.org">jerry@samba.org</ulink>
+submit the modified schema file as a patch to <ulink url="jerry@samba.org">jerry@samba.org</ulink>
+</para>
+
+<para>
+Since the original release, schema files for
+</para>
+
+<itemizedlist>
+ <listitem><para>IBM's SecureWay Server</para></listitem>
+ <listitem><para>Netscape Directory Server version 4.x and 5.x</para></listitem>
+</itemizedlist>
+
+<para>
+have been submitted and included in the Samba source distribution. I cannot
+personally comment on the integration of these commercial directory servers since
+I have not had the oppotinuity to work with them.
</para>
<para>
Just as the smbpasswd file is mean to store information which supplements a
user's <filename>/etc/passwd</filename> entry, so is the sambaAccount object
-meant to supplement the UNIX user account information. A sambaAccount is a
-<constant>STRUCTURAL</constant> objectclass so it can be stored individually
-in the directory. However, there are several fields (e.g. uid) which overlap
-with the posixAccount objectclass outlined in RFC2307. This is by design.
+meant to supplement the UNIX user account information. A sambaAccount is now an
+<constant>AUXILARY</constant> objectclass so it can be stored alongside
+a posixAccount or person objectclass in the directory. Note that there are
+several fields (e.g. uid) which overlap with the posixAccount objectclass
+outlined in RFC2307. This is by design. The move from a STRUCTURAL objectclass
+to an AUXILIARY one was compliance with the LDAP data model which states that
+an entry can contain only one STRUCTURAL objectclass per entry. This is now
+enforced by the OpenLDAP 2.1 server.
</para>
-<!--olem: we should perhaps have a note about shadowAccounts too as many
-systems use them, isn'it ? -->
<para>
In order to store all user account information (UNIX and Samba) in the directory,
it is necessary to use the sambaAccount and posixAccount objectclasses in
-combination. However, smbd will still obtain the user's UNIX account
+combination. However, <command>smbd</command> will still obtain the user's UNIX account
information via the standard C library calls (e.g. getpwnam(), et. al.).
This means that the Samba server must also have the LDAP NSS library installed
and functioning correctly. This division of information makes it possible to
@@ -254,9 +271,9 @@ like in the following example, to speed up searches made on sambaAccount objectc
## required by OpenLDAP 2.0
index objectclass eq
-## support pb_getsampwnam()
+## support pbb_getsampwnam()
index uid pres,eq
-## support pdb_getsambapwrid()
+## support pdb_getsampwrid()
index rid eq
## uncomment these if you are storing posixAccount and
@@ -326,14 +343,44 @@ use with an LDAP directory could appear as
ldap suffix = "ou=people,dc=samba,dc=org"
# generally the default ldap search filter is ok
- # ldap filter = "(&amp;(uid=%u)(objectclass=sambaAccount))"
+ # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))"
</programlisting></para>
</sect2>
+
+
+<sect2>
+<title>Importing <filename>smbpasswd</filename> entries</title>
+
+<para>
+Import existing user entries from an <filename>smbpasswd</filename> can be trivially done using
+a Perl script named <filename>import_smbpasswd.pl</filename> included in the
+<filename>examples/LDAP/</filename> directory of the Samba source distribution. There are
+two main requirements of this script:
+</para>
+
+<itemizedlist>
+ <listitem><para>All users to be imported to the directory must have a valid uid on the
+ local system. This can be a problem if using a machinej different from the Samba server
+ to import the file.</para></listitem>
+
+ <listitem><para>The local system must have a working installation of the Net::LDAP perl
+ module which can be obtained from with <ulink url="http://search.cpan.org/">http://search.cpan.org/</ulink>
+ by searching for <filename>perl-ldap</filename> or directly from <ulink
+ url="http://perl-ldap.sf.net/">http://perl-ldap.sf.net/</ulink>.
+ </para></listitem>
+</itemizedlist>
+
+<para>
+Please refer to the documentation in the same directory as the script for more details.
+</para>
+
+</sect2>
</sect1>
+
<sect1>
<title>Accounts and Groups management</title>
@@ -582,7 +629,7 @@ ntPassword: 878D8014606CDA29677A44EFA1353FC7
<para>
Please mail all comments regarding this HOWTO to <ulink
url="mailto:jerry@samba.org">jerry@samba.org</ulink>. This documents was
-last updated to reflect the Samba 2.2.3 release.
+last updated to reflect the Samba 2.2.5 release.
</para>