Install OpenLDAP Server and Administer with phpLDAPadmin in Debian/Ubuntu

LDAP stands for Lightweight Directory Access Protocol which can be used in numerous ways such as for authentication, shared directory (for mail clients), address book, etc. The LDAP protocol can be used to establish and store any kind of information. The OpenLDAP server gives you the possibility to access the information which is stored in a tree structure.

In this article we will show you how to install and configure an OpenLDAP server and how to administer it with phpLDAPadmin on Debian, Ubuntu and Linux Mint systems.

Installation Of OpenLDAP Server In Linux

By default the OpenLDAP server is in repositories under the package “slapd“. You can easily install it with the help of package manager tool called apt-get. But before installing the OpenLDAP server, make sure your system is up-to-date.

During installation, it will ask you to enter a password for the admin entry in your LDAP directory. Enter a strong password and confirm it by selecting OK.

 
$ sudo apt-get update 
$ sudo apt-get install slapd ldap-utils
Set OpenLDAP Admin Password

Set OpenLDAP Admin Password

Configure OpenLDAP Server

In order to configure the OpenLDAP server you need to edit the ldap.conf file, which is stored under the /etc directory. To edit the ldap.conf file you need a text editor like vim, nano etc. Run the following command to open the ldap configuration file for editing.

$ sudo nano /etc/ldap/ldap.conf

The output of the above command is shown in the below section.

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

# TLS certificates (needed for GnuTLS)
TLS_CACERT      /etc/ssl/certs/ca-certificates.crt

Uncomment the BASE and URI lines, so you can edit them with your own domain name and IP address. Since this is a testing installation and configuration I will use tecmint123.com as my domain name.

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE   dc=tecmint123,dc=com
URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

# TLS certificates (needed for GnuTLS)
TLS_CACERT      /etc/ssl/certs/ca-certificates.crt

Save the file and run the following command to reconfigure the LDAP package.

$ sudo dpkg-reconfigure slapd
Configure Ldap Server

Configure Ldap Server

To construct the base DN of the LDAP directory you need a DNS domain name.

Set DNS Name for Ldap

Set DNS Name for Ldap

Enter your DNS domain name and hit Enter to confirm it. Then the ldap will ask to enter the name of the organization to use in the base DN of your LDAP directory. Enter the name of your company or organisation and hit Enter again.

Set Organisation Name for Ldap

Set Organisation Name for Ldap

After the organisation or company name is added, the package configuration will ask to enter the password for the admin entry in your LDAP
directory. You need to enter the password for the admin which you created in the previous steps.

Enter Ldap Administrative Password

Enter Ldap Administrative Password

After you have confirmed the administrator’s password, you have to select the database. There are two databases to select from, the BDB and HDB database. They both support the same configuration options, use similar storage formats, but since the HDB database adds support for sub-tree renames it is the recommended one.

Configure Ldap Database

Configure Ldap Database

You can select the database you think will work better for you. After you have decided which database you will use, hit Enter to confirm the selection. Then you will be prompted with another question. Select Yes to remove the database when slapd is purged.

Purge Ldap Database

Purge Ldap Database

Select again Yes and press Enter.

Move Old Ldap Database

Move Old Ldap Database

Select No and the LDAP server will start running.

Allow Ldap2 Protocol

Allow Ldap2 Protocol

[sudo] password for ravisaive: 
 * Stopping OpenLDAP slapd                                                                                       [ OK ] 
  Moving old database directory to /var/backups:
  - directory unknown... done.
  Creating initial configuration... done.
  Creating LDAP directory... done.
 * Starting OpenLDAP slapd                                                                                       [ OK ] 
Processing triggers for libc-bin ...

To test the LDAP server, the ldapsearch -x command is used.

ldapsearch -x

It produces the following output.

# extended LDIF
#
# LDAPv3
# base <dc=tecmint123,dc=com> (default) with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# tecmint123.com
dn: dc=tecmint123,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: tecmint
dc: tecmint123

# admin, tecmint123.com
dn: cn=admin,dc=tecmint123,dc=com
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2

LDAP Administration with phpLDAPadmin

phpLDAPadmin is a GUI administration tool for LDAP server administration. This GUI tool will help us to interact with your LDAP server through a web interface. It is available in the default repositories, it can be installed with the apt-get command.

But before installing phpLDAPadmin, you must have Apache web server and PHP installed and running. If not, install it using following command.

$ sudo apt-get install apache2 php5 php5-mysql

Next install the “phpldapadmin” package as shown below.

$ sudo apt-get install phpldapadmin

The same way we configured the ldap.conf file, we need to configure the phpldapadmin web interface configuration files before using it. Run the following command to open the phpldapadmin config.php file.

$ sudo nano /etc/phpldapadmin/config.php

All you need to do is to replace the domain names with your own values. The configuration part needed for this case is under the “Define your LDAP servers” section.

$servers = new Datastore();
$servers->newServer('ldap_pla'); 
$servers->setValue('server','name','Tecmint LDAP Server');
$servers->setValue('server','host','127.0.0.1'); 
$servers->setValue('server','base',array('dc=tecmint123,dc=com'));
$servers->setValue('login','bind_id','cn=admin,dc=tecmint123,dc=com');

After you have finished editing the config.php configuration file, open a tab in your web browser and tpye the “http://ip_address_here/phpldapadminURL. Enter your ldap login credentials and click login.

Reference Links

  1. OpenLDAP Homepage
  2. phpLDAPadmin Homepage
Best Affordable Linux and WordPress Services For Your Business
Outsource Your Linux and WordPress Project and Get it Promptly Completed Remotely and Delivered Online.

If You Appreciate What We Do Here On TecMint, You Should Consider:

  1. Stay Connected to: Twitter | Facebook | Google Plus
  2. Subscribe to our email updates: Sign Up Now
  3. Get your own self-hosted blog with a Free Domain at ($3.45/month).
  4. Become a Supporter - Make a contribution via PayPal
  5. Support us by purchasing our premium books in PDF format.
  6. Support us by taking our online Linux courses

We are thankful for your never ending support.

Ravi Saive

I am Ravi Saive, creator of TecMint. A Computer Geek and Linux Guru who loves to share tricks and tips on Internet. Most Of My Servers runs on Open Source Platform called Linux. Follow Me: Twitter, Facebook and Google+

Your name can also be listed here. Got a tip? Submit it here to become an TecMint author.

RedHat RHCE and RHCSA Certification Book
Linux Foundation LFCS and LFCE Certification Preparation Guide

You may also like...

28 Responses

  1. tousif says:

    I have configured ldap server on ubuntu 14.04, client also able to joining, but my intention was hide some built-in application and restrict 3rd party software’s but I am unable to do so, can you help me out from this please. it urgent.

    • Ravi Saive says:

      @Tousif,

      Use LDAP ACL for restricting applications to user specific. For more information read OPenLDAP documentation.

  2. sanjeevi says:

    Hi Ravi,

    We would like to install LDAP on Centos 7 and it should integration with windows 2012 R2 Active Directory OU’s please suggest to me how to configure it

  3. TDG says:

    Hi,
    could you please help me with I want a shell script that will lock a machine after certain idle time in the openLdap server.

    Thank you

  4. manoj says:

    Hi Ravi Saive,
    above ldap configuration is very good . but can you confirm how to login ldap user on ubuntu machine with GUI mode

  5. David Lee says:

    I struggled with this piece. So to help future readers here is the fix that I had to apply to get the LDAP entries Sheldon, Leonard, Howard, and Rajesh to add.

    Here is my Linux information…
    Operating System Linux Mint 16 Cinnamon 64-bit
    Cinnamon Version 2.0.14
    Linux Kernal 3.11.0-12-generic

    Here is the error message that I received when trying to add LDAP entries for the first time.
    adding new entry “cn=Sheldon Cooper,ou=People,dc=homestead,dc=localdomain”
    ldap_add: No such object (32)
    matched DN: dc=homestead,dc=localdomain
    (repeated three more times)

    The fix is to add the missing and needed DN level for the “People”…
    dn: ou=People,dc=homestead,dc=localdomain
    objectClass: top
    objectClass: organizationalUnit
    ou: People

    Save the above four lines, and put them into another separate LDIF file. Like the below example.
    / $ ldapadd -x -W -D “cn=admin,dc=homestead,dc=localdomain” -f ~/Add_DN_Level.ldif
    Enter LDAP Password:
    adding new entry “ou=People,dc=homestead,dc=localdomain”

    With the DN level added the four People can now be added to LDAP.

  6. Dave Dhakal says:

    LDAP installation & Configuration on CentOS 6.5
    [[email protected] ~]# yum -y install openldap-servers.x86_64 0:2.4.23-34.el6_5.1
    [[email protected] ~]# yum -y install openldap-clients.x86_64 0:2.4.23-34.el6_5.1
    [[email protected] ~]# yum -y install portreserve.x86_64 0:0.0.4-9.el6
    Packages Installed: openldap-clients.x86_64 0:2.4.23-34.el6_5.1
    openldap-servers.x86_64 0:2.4.23-34.el6_5.1
    Dependency Installed: portreserve.x86_64 0:0.0.4-9.el6
    [[email protected] ~]# yum -y update
    Updated: cpio.x86_64 0:2.10-12.el6_5
    [[email protected] ~]# slappasswd -s 123dhakal

    [[email protected] ~]# cd /etc/openldap/slapd.d/cn\=config/
    [[email protected] cn=config]# ll

    [[email protected] cn=config]# vi olcDatabase={1}monitor.ldif

    [[email protected] cn=config]# vi olcDatabase={2}bdb.ldif

    [[email protected] ~]# cp /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf
    [[email protected] ~]# vi /etc/openldap/slapd.conf

    [[email protected] ~]# chkconfig slapd on

    [[email protected] run]# vi vastika.ldif

    [[email protected] run]# ldapadd -x -D “cn=Dhakal,dc=vastika,dc=com” -W -f vastika.ldif

    [[email protected] run]# ldapsearch -x -LLL -b dc=vastika,dc=com

    [[email protected] run]#

    Complete!

  7. Lars Fischer says:

    Would be a nice tutorial if it actually would work. No luck with Linux Mint.

  8. Amitesh says:

    Hi Ravi,

    I have installed openldap with phpldapadmin as you instructed on my ubuntu 12.0.4 box. But I can not login via phpldapadmin page. I can login there only as anonymous user.Could you please help me out?

    • teglas says:

      Hi Amitesh!

      I had the same problem with Linux Mint 17.
      So the key is, when you configure the /etc/ldap/ldap.conf file you need to modify the URI row as well:
      URI ldap://127.0.0.1:389

      The phpldapadmin config file (/etc/phpldapadmin/config.php) needs to be fixed as well.
      The base DNS should be the same as you entered after executed this command: “sudo dpkg-reconfigure slapd”.
      Actually what you typed in at the second picture, that DNS needs to be typed into the phpldapadmin config file too.
      eg.: $servers->setValue(‘server’,’base’,array(‘dc=test,dc=tecmint,dc=com’))

      Restart the apache at the end:
      sudo service apache2 restart

      Good luck!

Got something to say? Join the discussion.

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.