On Deploying OpenLDAP

One of the things I noted about the dis­cus­sions sur­round­ing “Web 2.0″ was the idea that blogs were the next weapon in guerilla mar­ket­ing, fol­low­ing the fail­ure of var­i­ous astro­turf cam­paigns to gar­ner any actual sup­port due to ease with which they were exposed. The idea is that what­ever the fail­ings of free cul­ture, it is gen­er­ally an hon­est dis­cus­sion, so peo­ple trust it, so it obvi­ously must be cor­rupted with under­cover adver­tis­ing and the crass profit motive.

Following this trend, a kindly PR per­son at Apress sent me a copy of the book, Deploying OpenLDAP, by Tom Jackiewicz, with the ver­bal agree­ment that I post a pub­lic review of it.

Like a fool, I said sure, and so am obliged to post the fol­low­ing review…

Firstly, here’s what Deploying OpenLDAP isn’t use­ful for:

  1. Getting a mixed Win/Mac/Linux envi­ron­ment to use OpenLDAP for authentication.
  2. Helping you inte­grate OpenLDAP with Samba for a domain controller.
  3. Using OpenLDAP to main­tain your DNS data.
  4. Using OpenLDAP to main­tain your DHCP data.
  5. Figuring out how you’re going to lay out your DIT — includ­ing the RFC way vs. the Apple way vs. the ActiveDirectory way.

All of these things are actual legit­i­mate ques­tions related to the actual deploy­ment of OpenLDAP, but they are also top­ics the book doesn’t really cover at all, which is a shame.

Here’s what it is use­ful for:

  1. Understanding exactly what LDAP is.
  2. A tuto­r­ial on down­load­ing and installing slapd.
  3. Reading man pages in paper­back form.
  4. A quick-n-dirty intro­duc­tion to the libldap API — ori­ented towards writ­ing a Perl script to inter­face with some ugly legacy system.

In other words, it was mostly a set of infor­ma­tion that you should be able to fig­ure out for your­self by read­ing the exist­ing man pages, HOWTOs, and online doc­u­men­ta­tion — par­tic­u­larly if you’re tasked with set­ting up any­thing as involved as an LDAP directory.

#4 was about all it was use­ful for to me per­son­ally, and even that would’ve been redun­dant if I hadn’t got­ten bored of read­ing about Perl APIs when all I wanted was a sam­ple DIT or some pol­icy that I could use as a model to fol­low when deploy­ing a Samba/OpenLDAP PDC. When I had to reshuf­fle part of the DIT I wrote a lit­tle C app to do it remem­ber­ing parts of that chap­ter, but that was about it.

In other words, it suf­fers from the same prob­lem as a lot of other broad LDAP doc­u­men­ta­tion: it’s too vague to actu­ally be use­ful because “deploy­ing OpenLDAP” is too broad a con­cept to be ade­quately explained in one 300 page book.

4 Responses

  1. Ryan says:
    2005-12-10 at 6:57 pm

    Have you come across anthing good that documents:

    > 1. Getting a mixed Win/Mac/Linux envi­ron­ment to use OpenLDAP for authen­ti­ca­tion.
    > 2. Helping you inte­grate OpenLDAP with Samba for a domain controller.

    be it OpenLDAP or Netscape DS (Sun/Fedora/Red Hat)?

  2. iain says:
    2005-12-10 at 9:04 pm

    so,the funny thing about that web2 pr doc­u­ment was that it just reminded me of the late 90s rush to have a com­mu­nity around your website…all web­sites had to have some unre­latd games,a forum,some down­load­able back­ground images,and if you were really with it you set up a chat page with a java irc applet on it and free email…

    it didnt really work thankfully

  3. James Cape says:
    2005-12-10 at 10:42 pm

    Ryan:

    MacOS X can be con­fig­ured to auth users using the “Directory Access” util­ity (it’s pretty slick, and sup­ports the RFC way, the Apple way, and the ActiveDirectory way), and set­ting up Samba to use OpenLDAP as a SAM back­end for NT domain authen­ti­ca­tion was pretty sim­ple – just a mat­ter of using their schemas intel­li­gently and keep­ing your users under a par­tic­u­lar DN. We didn’t bother with the OS 9 boxen because they were being phased out anways. Linux requires libnss-ldap, of course (which is pretty well-documented, IMO). One thing that ended up bit­ing us in the ass was putting the “ldap” entry in nsswitch.conf first on the list — it ends up mak­ing INIT go out-to-lunch in a biz­zare way, which forced us to boot the PDC (not some­thing that can be offline for a few days while you debug it) off of a LiveCD and run the ser­vices when we restarted it for a new ker­nel until some­one else found the same prob­lem and lazy­web caught up with the issue.

    Most use­ful was the offi­cial Samba3 HOWTO, and the Samba-OpenLDAP HOWTO. Of course, had I to do it over again, I’d just have setup OpenLDAP as a fake OS X server, so as my boss slowly con­verted the office to wor­ship­ing at his church, he could’ve used the vari­ety OS X admin tools he touted. If you don’t have to migrate an exist­ing domain, that’s a bonus too.

    iain:

    One hopes, but it still reminds me of HR peo­ple com­ing to Netscape and assum­ing that the thing that made the pro­gram­mers at Netscape will­ingly put in 80 hour weeks while on salary was the free pizza and Mt. Dew and winking-and-nodding at goof­ing off (as opposed to, e.g., every­one being com­pe­tent at their job and rec­og­niz­ing that the work actu­ally meant some­thing in the fuzzy-kitty, big-picture sense), so if only every com­pany pro­vided free pizza and Mt. Dew and let employ­ees occa­sion­ally goof off, every­one would want to put in 80 hour weeks while on salary.

    Really I’m just pissed at spam­mers, par­tic­u­larly those extrem­ists who call it “mar­ket­ing” and are busily pro­mot­ing the idea of alto­gether replac­ing con­tent with advertising.

Leave a Reply

*