This is just a test. It is AOC specific. The eventual goal is to provide a unified usernamespace accross NRAO sites in the UNIX environment. LDAP may be able to do this with the referral ObjectClass.
To find the base dn of your ldap database
ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
To dump the entire directory nisMapName=auto_users
ldapsearch -x -b 'dc=aoc,dc=nrao,dc=edu' -z 0 '(objectclass=*)'
To lookup a specific user (use -C to chase referrals)
ldapsearch -x -b 'ou=People,dc=aoc,dc=nrao,dc=edu' -z 0 '(uid=krowe)'
ldap is apparently case-insensitive. rpc is Rpc is rPC
if you don't want people to see the encrypted passwd add the following to /etc/openldap/slapd.conf
access to dn=".*,dc=aoc,dc=nrao,dc=edu" attr=userPassword
by self write
by * auth
access to dn=".*,dc=aoc,dc=nrao,dc=edu"
by * read
by using ldap instead of NIS we loose netgroups. This will break things like /etc/exports.
The current method of just running the Makefile periodicly has problems. The process wipes the database and rebuilds it from flat files. During this time, some information is unavailable. For example, I cannot finger users while the passwd database is being rebuilt. A better solution is necessary. I would still like to use ldapmodrdn to build a tmp database and then switch in one swell (hopefully atomic) foop.
The make process is also very slow, taking upwards of 27 minutes for a full rebuild.
Here are all the changes that need to be made to a Red Hat 9 client in order to bind to our test ldap server.
I exported, as root, /var/yp/etc from zia (our NIS master) to the ldap server (a linux box) read-only and mounted it as /nis_master.
redhat9 comes with the PADL scripts, in /usr/share/openlda/migration, to convert NIS files into ldif files for stuffing into ldap. I have tweaked these scripts to require the correct migrate_common.ph and a couple needed actual fixing. Place these scripts in /opt/services/ldap/bin.
Place this Makefile in /opt/services/ldap, and use it to populate the ldap directory.
Place this aoc.nrao.edu.ldif file in /opt/services/ldap/etc and edit it as appropriate. If you change the name, be sure to change the LDIF variable in the Makefile.
chkconfig --level 35 ldap on
/etc/init.d/ldap start