I tried OpenLDAP but Jesus that was very involved.
OpenLDAP is easy :) Once you understand LDAP concepts.
Check this and read through the tasks/ directory (particularly openldap.yml and populate.yml. It sets up everything needed for an LDAP authentication service (if you don't use ansible you can still read what the tasks do and you should get a pretty good understanding of what's needed, if not let me know).
In short you need:
slapd(the OpenLDAP server)- set up a base LDAP directory structure (OUs/Organizational Units, I only use 3 OUs:
system,usersandgroups) - an admin user in the LDAP directory (mine is
admindirectly at the base of the LDAP directory) - (optional but recommended) a so-called
binduser in the LDAP directory (unvprivileged account that can only list/read users/groups) (mine isbindunder thesystemOU) - (optional) groups to map users to their roles (e.g. only users in
access_jellyfinare allowed to login to jellyfin) - actual user accounts, member of one or more groups if needed
When you login to an application/service configured to use the LDAP authentication backend, it connects to the LDAP directory using the bind user credentials, and checks that the user exists (depending on how you configured the application either by name, uid, email...) , that the password you provided matches the hash stored in the LDAP directory, optionally that the user is part of the required groups. Then it allows or denies access.
There's not much else to it:
- you can also do without the
bindaccount but I wouldn't recommend it (either configure your applications to use theadminuser in which case they have admin access to the LDAP directory... not good. Or allow anonymous read-only access to the LDAP directory - also not ideal). slapdstores its configuration (admin user/password, log level...) inside the LDAP directory itself as attributes of a special entity (cn=config), so to access or modify it you have to use LDIF files and theldapadd/ldapmodifycommands, or use a convenient wrapper like the ansible modules tools used above.- once this is set up, you can forget LDIF files and use a web interface to manage contents of the LDAP directory.
- OUs and groups are different and do not serve the same purpose, OUs are just hierarchical levels (like folders) inside your LDAP tree. groups can contain multiple users/users can have multiple groups so they're like "labels" without a notion of hierarchy. You can do without OUs and stash everything at the top level of the directory, but it's messy.
- users (or other entities) have several attributes (common name, firstname, lastname, email, uid, password, description... it can contain anything really, it's just a directory service)
- LDAP is hierarchical by nature, so user with Common Name (CN)
jane.doein OUusersin the directory for domainexample.orghas the Distinguished Name (DC)cn=jane.doe,ou=users,dc=example,dc=org. Think of it like/path/to/file. - to look for a particular object you use filters which are just a search syntax to match specific entities (object classes) (users are
inetOrgPersons, groups areposixGroups...) and attributes (uid,cn,email,phonenumber...). Usually applications that support LDAP come with predefined filters to look for users in specific groups, etc.