To setup a basic LDAP server with Unix user management, we will need the following

  * %%OpenLDAP%% as an LDAP Server
  * [[https://www.freshports.org/net/ldapscripts/|ldapscripts]] to manage Unix users in LDAP

==== Assumptions ====

  * Your company domain is ''%%awesome.com%%''
  * Your LDAP server sits at ''%%ldap.awesome.com%%''

===== Installing LDAP =====

<code>
pkg install openldap26-server
</code>

Please keep in mind that the version may change in the future, e.g. ''%%openldap27-server%%''. You can run ''%%pkg search openldap%%'' to find the latest version.

===== Configuring LDAP =====

Start by modifying ''%%/usr/local/etc/openldap/ldap.conf%%'', and use the following inside:

<code>
BASE    dc=awesome,dc=com
URI     ldap://ldap.awesome.com
</code>

Next, edit ''%%/usr/local/etc/openldap/slapd.conf%%'' and modify/set the following:

  * Append the following after ''%%core.schema%%'':

<code>
include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/nis.schema
</code>

  * Uncomment ''%%moduleload      back_ldap%%''
  * Set a root password for the ''%%config%%'' database:

<code>
rootpw VerySecretAutoGeneratedPassword
</code>

  * Set the ''%%suffix%%'' and ''%%rootdn%%'' for the ''%%mdb%%'' database:

<code>
suffix          "dc=awesome,dc=com"
rootdn          "cn=admin,dc=awesome,dc=com"
</code>

  * Set the root password for the ''%%mdb%%'' database using ''%%slappasswd%%'' utility:

<code>
rootpw          {SSHA}TheOutputOfSlapPasswd
</code>

Finally, edit ''%%/usr/local/etc/openldap/slapd.ldif%%'' and modify the following inside:

  * Set ''%%olcSuffix%%'' and ''%%olcRootDN%%'':

<code>
olcSuffix: dc=awesome,dc=com
olcRootDN: cn=admin,dc=awesome,dc=com
</code>

  * Set ''%%olcRootPW%%'':

<code>
olcRootPW: {SSHA}TheOutputOfSlapPasswd
</code>

===== Installing LDAPScripts =====

LDAPScripts is a collection of scripts to manage POSIX accounts in an %%OpenLDAP%% directory.

<code>
pkg install ldapscripts
</code>

===== Configuring LDAPScripts =====

Edit file ''%%/usr/local/etc/ldapscripts/ldapscripts.conf%%'' and modify the following:

  * Set ''%%SERVER%%'':

<code>
SERVER="ldap://ldap.awesome.com"
</code>

  * Set ''%%SUFFIX%%'':

<code>
SUFFIX="dc=awesome,dc=com"
</code>

  * Set ''%%BINDDN%%'':

<code>
BINDDN="cn=admin,dc=awesome,dc=com"
</code>

  * (Personal Preference) Start the UID from 10000, GID from 15000, MID from 20000:

<code>
GIDSTART="15000" # Group ID                                                    
UIDSTART="10000" # User ID                                                     
MIDSTART="20000" # Machine ID
</code>

  * Set the home directory and default shell. If you're planning on using [[/NFSHome|NFSHome]], then make sure that you modify ''%%UHOMES%%'' as needed.

  * Fix ''%%PASSWORDGEN%%'', as some %%FreeBSD%% versions don't run properly without ''%%env%%'':

<code>
PASSWORDGEN="cat /dev/urandom | env LC_ALL=C tr -dc 'a-zA-Z0-9' | head -c18"
</code>

  * Set the correct path of ''%%iconv%%'' and charset:

<code>
ICONVBIN="/usr/bin/iconv"
ICONVCHAR="ISO-8859-15"
</code>

Done!

We can finally initialize the LDAP directory with Unix data by running

<code>
ldapinit
</code>

<callout type="info">
**pingable?**

Make sure that ''%%ldap.awesome.com%%'' is reachable via ICMP. You can check by running ''%%ping -t4 ldap.awesome.com%%''. If you haven't configured [[/DNS|DNS]] yet, you may want to modify ''%%/etc/hosts%%''.

</callout>

===== Using LDAPScripts =====

Say we want to have a group named ''%%admins%%'' for administrators and a user named ''%%john%%'', that should be a member of administrators.

<code>
ldapaddgroup admins
ldapaddgroup john 10000
ldapadduser  john john
ldapaddusertogroup john admins
</code>

And we can check by using ''%%ldapid%%'':

<code>
# ldapid john
uid=10000(john) gid=10000(john) groups=10000(john),15000(admins)
</code>

===== Next Steps =====

Next, you might want to:
  * Configure LDAP client using [[/SSSD|SSSD]]
  * Use [[/AutoFS|AutoFS]] with [[/NFS]] shares and [[/SSSD|SSSD]] for authentication

----

===== TODO =====

* Add SSL/TLS Encryption.