CIS114-6: Linux LDAP Infrastructure Deployment - Portfolio Report

This portfolio documents the implementation and configuration of an LDAP infrastructure on a Linux server, focusing on using OpenLDAP on Ubuntu 18.04. It covers the installation of OpenLDAP and phpLDAPadmin, a web interface for managing LDAP data, including configuring the base DN and setting up authentication. The report details the creation of organizational units, groups (Admin, ICT, Management), and users, assigning users to specific groups. It further explains the process of configuring phpLDAPadmin to utilize the domain and setting up an administrator account, and the importance of securing the LDAP server. The document references the Lightweight Directory Access Protocol's background, its role in directory services, and its application in managing users and groups within a network environment. This portfolio provides a practical guide to deploying LDAP for centralized authentication and directory management.

Name of the Student
Name of the University
Author Note
LDAP ImPLEMENTATION

3
Table of Contents
Introduction......................................................................................................................................2
OpenLDAP:.....................................................................................................................................2
Background......................................................................................................................................3
Installation.......................................................................................................................................4
Administration: root.....................................................................................................................4
Get: OpenLDAP...........................................................................................................................4
Gedit : LDAP...............................................................................................................................6
Server: Configure.........................................................................................................................7
LDAP: search...............................................................................................................................7
Get: Phpldapadmin.......................................................................................................................9
Edit: Text Editor.........................................................................................................................11
Logging: phpLDAPadmin Web Interface.....................................................................................12
Authentication: LDAP...............................................................................................................13
Create: Organizational Unit.......................................................................................................14
Validate: Server.............................................................................................................................17
Conclusion.....................................................................................................................................17
References......................................................................................................................................19

3
Introduction
Lightweight Directory Access Protocol (LDAP) is a standard protocol intended to oversee and
access progressive directory data over a system. It very well may be utilized to store any sort of
data, however it is frequently utilized as a concentrated confirmation framework or for corporate
email and telephone catalogs.
In this report, it is also examine how to introduce and arrange the OpenLDAP server on Ubuntu
18.04. We will at that point introduce phpLDAPadmin, a web interface for review and
controlling LDAP data. We will verify the web interface and the LDAP administration with SSL
certificates from Let's Encrypt, a supplier of free and computerized certificates.
OpenLDAP:
 libraries implementing the LDAP protocol, and utilities, tools, and sample clients.
 slapd – stand-alone LDAP daemon (server)
This report looks at how to install OpenLDAP and how to configure it in Ubuntu / Debian server.
The server is tested in Ubuntu latest version, Here is the testing system’s details:
 Hostname : ldap.com
 IP Address : 192.168.109.132/24
 Operating System : Ubuntu 18.10 64 bit server
The LDAP or Lightweight Directory Access Protocol is a protocol for questioning and changing
a “X.500”-based directory administration over TCP/IP. The current LDAP rendition is LDAPv3,
as characterized in RFC4510, and the usage in Ubuntu is OpenLDAP."
So the LDAP protocol accesses LDAP catalogs. Here are some key ideas and terms:
 A LDAP directory is a tree of information passages that is various leveled in nature and is
known as the Directory Information Tree (DIT).

3
 The section's DN isn't a quality. It isn't viewed as a component of the passage itself.
 Every section has a special identifier: its Distinguished Name (DN or dn). This, thus,
comprises of a Relative Distinguished Name (RDN) trailed by the parent section's DN.
 Qualities and objectclasses are characterized in outlines (an objectclass is really
considered as a unique sort of property).
 A passage comprises of a lot of properties.
 A property has a sort (a name/depiction) and at least one qualities.
 Each quality must be characterized in at any rate one objectClass.
Background
LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL was at first made by Steve Kille of Isode
Limited Tim Howes of the University of Michigan, and Wengyik Yeong of Performance
Systems International, in the aerly 1990s. It depends on the X.500 standard, yet is
straightforward and effectively adjusts to address custom issues whose particulars are
characterized in the Requests for Comments (RFCs).
LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL is likewise cross-stage and principles
based. In this way, the network components are not worried about the server kind facilitating the
directory. The LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL servers are anything but
difficult to introduce, keep up and upgrade (Shrivastavaand Rizvi 2014). The LIGHTWEIGHT
DIRECTORY ACCESS PROTOCOL server procedure questions and updates the
LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL data directory. LIGHTWEIGHT
DIRECTORY ACCESS PROTOCOL servers are fit for reproducing information either through
push or draw techniques. The innovation identified with replication is effectively designed and
implicit. LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL grants verified agent read and
change expert dependent on necessities utilizing Microsoft Access control records. The client
application layer does not undergo any security checks. All this is carried out together through
the LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL directory (Wu, Huanand Yu 2014).

3
LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL,fails to describe how projects are
cleared on the customer server end, however it defines the language utilized by clients’ projects
to communicate with servers. LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL servers
go from little servers for workgroups to huge hierarchical and open servers.
LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL directory servers holds information
progressively. Among its strategies is to segment the directory utilizing LIGHTWEIGHT
DIRECTORY ACCESS PROTOCOL referrals, which empower clients to allude
LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL solicitations to an alternate server. The
focal idea of LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL is the data model, which
manages the sort of data put away in registries and the organizing of data. The data model spins
around a passage, which is a gathering of properties with sort and worth. Passages are sorted out
in a tree-like arrangement identified as the directory data tree. The sections are created around
genuine ideas, association, individuals and items (Hsuet al. 2014). Characteristic sorts are related
with language structure characterizing permitted data. A solitary property can encase numerous
qualities inside it. The recognized names in LIGHTWEIGHT DIRECTORY ACCESS
PROTOCOL are perused from base to top. The left section is known as the relative separated
name and the correct fragment is the base recognized name.
Numerous sellers of server items and directory customers support LIGHTWEIGHT
DIRECTORY ACCESS PROTOCOL . Organizations with LIGHTWEIGHT DIRECTORY
ACCESS PROTOCOL aims incorporate IBM, AT&T, Sun and Novell. Eudora and Netscape
communicator additionally support LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL .
Government organizations and huge colleges additionally use LIGHTWEIGHT DIRECTORY
ACCESS PROTOCOL servers for putting away and sorting out data.
|For any system,a catalog is applied to show users where each component is located. For TCP/IP
protocols (counting the Internet), the Domain Name Service (DNS) is the index context applied
to distinguish the identity of an area to a specific system address (a one of a kind zone on the
system). In certain instances,users may not recognize the area name. LIGHTWEIGHT
DIRECTORY ACCESS PROTOCOL enables users to look for an individual without realizing
where they're found.

3
 A LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL catalog is sorted out in a
direct "tree" chain of command made up of the associated levels:
 People (which includes users, documents, and shared components, such as, printers,)
 The root catalog (the beginning spot or the wellspring of the tree), which branches out to
 Nations, every one of which branches out to
 Associations, which branch out to Hierarchical units (divisions, offices, etc), which
branches out to (incorporates a passage for)
A LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL index can be spread among several
servers. All servers can contain an imitated different of the all out index that is matched often. A
LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL server is known as a Directory System
Agent (DSA). A LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL server that obtains a
solicitation from a client adopts responsibility for the solicitation, transferring it to other DSAs as
important, yet ensuring a unique composed reaction for the user.
Installation
Administration: root

3
Get: OpenLDAP
Install the OpenLDAP server daemon and the conventional LDAP the executive’s utilities. These
are found in bundles slapd and ldap-utils individually. The establishment of slapd will make a
working design. Specifically, it will make a database example that you can use to store your
information. In any case, the postfix (or base DN) of this occurrence will be resolved from the
area name of the host. On the off chance that you need something other than what's expected,
you can transform it directly after the establishment when despite everything you don't have any
valuable information.
One begins with introducing the LDAP server and several related utilities. Fortunately, the
bundles we need are largely accessible in Ubuntu's default archives.

3
Gedit : LDAP

3
Server: Configure
LDAP: search
Diagram. ldapsearch is an order line apparatus that opens an association with a LDAP server, ties
to it, and plays out an inquiry utilizing a channel. The outcomes are then shown in the LDIF. ...
The ldapsearch apparatus is additionally furnished with Sun™ ONE Directory Server in the
DirectoryServer_base/shared/receptacle directory.Overview. ldapsearch is a direction line
apparatus that opens an association with a LDAP server, ties to it, and plays out a hunt utilizing a
channel. The outcomes are then shown in the LDIF. ... The ldapsearch device is additionally

3
furnished with Sun™ ONE Directory Server in the DirectoryServer_base/shared/receptacle
index.

3
Get: Phpldapadmin
In spite of the fact that it is truly conceivable to direct LDAP through the order line, most clients
will think that its simpler to utilize a web interface. We will introduce php LDAP admin, a
software application which gives this usefulness.
The Ubuntu storehouses have a php LDAP admin bundle. You can introduce it with adept get:
This will introduce the software, empower important Apache setups, and reboot Apache.

3
The web server is presently designed to run the software, however we have to roll out various
extra improvements. We have to design php LDAP admin to utilize space, and to not
automatically fill the LDAP login data. Start by opening the primary design record with root
benefits in the texteditor tool:

3
Edit: Text Editor
Look for the line beginning with $servers->setValue('server','name'. In nano can scan for a string
by composing CTRL-W, at that point the string, at that point ENTER. Your cursor will be set on
the right line. This is a showcase name for the LDAP server, that the web interface utilizes for
messages and headers regarding the server.
Next, descend to the $servers->setValue('server','base' line. This setting discloses to
phpLDAPadmin what the base of the LDAP order is. It depends on the worth we composed in
when resetting the slapd bundle. In our model we chose example.com and we have to make an
interpretation of this into LDAP grammar by putting every area segment (everything not a spot)
into a “dc= ldap”:

3
For the next part, you will need to reflect the same value you gave when asked for the DNS
domain name when we reconfigured “slapd”.Such will have to convert it into a format that
LDAP understands by separating each domain component. Domain components are anything
that is separated by a dot.These components are then given as values to the “dc” attribute.
For instance, if your DNS domain name entry was “imaginary.lalala.com”, LDAP would need to
see “dc=ldap,dc=lalala,dc=com.
Logging: phpLDAPadmin Web Interface
Having made the essential arrangement changes to phpLDAPadmin, we would now be able to
start to utilize it. Explore to the application in your internet browser. Make certain to substitute
your space for the featured territory underneath: http://192.168.109.132/phpldapadmin.

3
The phpLDAPadmin landing page will load. Click on the login link in the left-hand menu on the
page. A login form will be presented:
Authentication: LDAP
The Login DN is the username that you will utilize. It contains the record identity as a cn=
segment, as well as the space identity you chose for the server split into dc= areas as depicted in
past advances. The default administrator account that was installed during introduction is
identified administrator, so for our model we would type in the accompanying:

3
cn=admin,dc=ldap,dc=com
In the wake of joining the suitable string for user space, one needs to type in the administrator
secret word created while setting up, at that point click the Authenticate catch.
Now, you are signed into the phpLDAPadmin interface. You can include clients, authoritative
units, gatherings, and connections.
LDAP is adaptable by that way such can structure the information and directory chains of
importance. You can make whatever sort of structure you'd like and furthermore make rules for
how they associate.
Since this procedure is the equivalent on Ubuntu 16.04 as it was on past renditions, you can
pursue the means spread out in the Add Organizational Units, Groups, and Users area of the
LDAP establishment article for Ubuntu 18.04. Those means will function admirably on this
establishment of phpLDAPadmin, so track with to get some work on working with the interface
and figuring out how to structure your information.
Since we've signed in and acclimated ourselves with the web interface, how about we pause for a
minute to give greater security to our LDAP server.We will make three unique gatherings that
could be utilized to sort out clients into various "access" bunches dependent on the benefits they
require.
Such will make an "administrator" gathering, an "irc" gathering, and a "client" gathering. We
could then enable individuals from various gatherings to verify on the off chance that we set up
customer LDAP validation. We need to make the gatherings inside the "gatherings" authoritative
unit. Snap on the "gatherings" classification we made. In the primary sheet, click on the "Make a
kid passage" inside the gatherings classification.
Create: Organizational Unit

3

3
Enter the user details such as common name, GID number, last name, Login shell, user password
and user id etc., as shown in the below screen shot and click Create object. For example. here
the user called “ldap”.
Fill in the majority of the sections with data that bodes well for your client.

3
Something to remember is that the "Normal Name" should be one of a kind for every passage in
a classification. So you might need to utilize a username group rather than the default
"FirstName LastName" that is auto-populated. Snap "Make Object" at the base and affirm on the
accompanying page. To make extra clients, we will exploit the capacity to duplicate sections.
Snap on the client you just made in the left-hand board. In the primary sheet, click "Duplicate or
move this passage": LDAP duplicate client section.
Validate: Server
As seen in the above output, the new objects, namely ‘sales’, ‘sales-group’, and ‘ldap’ have
been successfully created under the main LDAP domain. Similarly, you can create as many as
objects as necessary .Installing and configuring OpenLDAP in Ubuntu and derivatives is really
easy and straight forward. Even a novice users can easily setup a working LDAP server. Now
OpenLDAP Server is ready to use.
Conclusion
In this report exercised that introduced and designed the OpenLDAP slapd server, and the LDAP
web interface phpLDAPadmin. It is likewise set up encryption on the two servers, and refreshed
certbot to consequently deal with slapd's Let's Encrypt declaration reestablishment process.

3
The framework that we have set up is very adaptable and such will have the option to structure
your very own authoritative composition and oversee gatherings of assets as your needs request.
For additional data on overseeing LDAP, including more direction line instruments and
strategists detailed. How To Manage and Use LDAP Servers with OpenLDAP Utilities. For
additional top to bottom data about verifying a LDAP server, including how to drive all
customers to utilize secure associations.

3
References
Hsu, C.T., Luo, G.H. and Yuan, S.M., 2014. Personalized cloud storage system: a combination
of LDAP distributed file system. In Genetic and Evolutionary Computing (pp. 399-408).
Springer, Cham.
Wu, Z.Y., Huang, W.P. and Yu, L., 2014. Design and Implementation of unified Identity
Authentication System Based on LDAP in Digital Campus. In Advanced Materials Research
(Vol. 912, pp. 1213-1217). Trans Tech Publications.
Shrivastava, A. and Rizvi, M.A., 2014, August. External authentication approach for virtual
private network using LDAP. In 2014 First International Conference on Networks & Soft
Computing (ICNSC2014) (pp. 50-54). IEEE.
Thakur, M.A. and Gaikwad, R., 2015, January. User identity & lifecycle management using
LDAP directory server on distributed network. In 2015 International Conference on Pervasive
Computing (ICPC) (pp. 1-3). IEEE.
Patil, R. and Zawar, M., 2017, May. Improving replication results through directory server data
replication. In 2017 International Conference on Trends in Electronics and Informatics (ICEI)
(pp. 677-681). IEEE.
Andjarwirawan, J., Palit, H.N. and Salim, J.C., 2017, September. Linux PAM to LDAP
Authentication Migration. In 2017 International Conference on Soft Computing, Intelligent
System and Information Technology (ICSIIT) (pp. 155-159). IEEE.