• Your company domain is awesome.com
• Your LDAP server sits at ldap.awesome.com

pkg install openldap26-server

Please keep in mind that the version might change in the future, i.e. openldap27-server. You can run pkg search openldap to find the latest version.

We start by modifying /usr/local/etc/openldap/ldap.conf, and use the following inside.

BASE    dc=awesome,dc=com
URI     ldap://ldap.awesome.com

Next, we edit /usr/local/etc/openldap/slapd.conf and we modify/set the following:

• Append the following after core.schema

include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/nis.schema

• Uncomment moduleload back_ldap
• Set a root password for the config database

rootpw VerySecretAutoGeneratePassword

• Set the suffix and rootdn at mdb database

suffix          "dc=awesome,dc=com"
rootdn          "cn=admin,dc=awesome,dc=com"

• Set the root password for the mdb database using slappasswd utility

rootpw          {SSHA}TheOutputOfSlapPasswd

Finally, we edit /usr/local/etc/openldap/slapd.ldif and modify the following inside

• Set olcSuffix and olcRootDN

olcSuffix: dc=awesome,dc=com
olcRootDN: cn=admin,dc=awesome,dc=com

• Set olcRootPW

olcRootPW: {SSHA}TheOutputOfSlapPasswd

LDAPScripts is a collection of scripts to manage posix accounts in an OpenLDAP directory

pkg install ldapscripts

We edit the following file /usr/local/etc/ldapscripts/ldapscripts.conf and modify the following:

• Set the SERVER

SERVER="ldap://ldap.awesome.com"

• Set the Suffixes

SUFFIX="dc=awesome,dc=com"

• Set BINDDN

BINDDN="cn=admin,dc=awesome,dc=com"

• (Personal Preference) Start the UID from 10000, GID from 15000, MID from 20000

GIDSTART="15000" # Group ID                                                    
UIDSTART="10000" # User ID                                                     
MIDSTART="20000" # Machine ID

• Set the home directory and default shell. If you're planning on using NFSHome, then make sure that you modify UHOMES as needed

• Fix PASSWORDGEN, as some FreeBSD versions don't run properly without env

PASSWORDGEN="cat /dev/urandom | env LC_ALL=C tr -dc 'a-zA-Z0-9' | head -c18"

• Set the correct path of iconv and charset

ICONVBIN="/usr/bin/iconv"
ICONVCHAR="ISO-8859-15"

Done!

We can finally initialize the LDAP directory with Unix data by running

ldapinit

Say we want to have a group named admins for administrators. A user named john, that should be member of administrators.

ldapaddgroup admins
ldapaddgroup john 10000
ldapadduser  john john
ldapaddusertogroup john admins

And we can check by using ldapid

# ldapid john
uid=10000(john) gid=10000(john) groups=10000(john),15000(admins)

* Add SSL/TLS Encryption