Title: P1247676909AFpeu
1(No Transcript)
2LDAP Services for NDS v3
Newman Miller
NSCL Software Engineer Global Marketing Services
3LDAP Services for NDS v3
LDAP Discussion Topics
- Section 1 Understanding LDAP v3
- Section 2 Setting up LDAP v3
- Section 3 Configuring LDAP v3
- Section 4 Troubleshooting LDAP v3
- Section 5 Additional LDAP Information
4Additional LDAP Training Coming Soon
Novell Security Services
- Understanding LDAP and NDS Catalog Services for
faster query responses. - Searching an LDAP Catalog
- Advanced LDAP debugging
- Examining Debug Screen and Log options
5Additional LDAP Training Coming Soon
Novell Security Services
- Understanding Novell Public Key Infrastructure
Services (PKI) - Understanding Secure Socket Layer Protocol (SSL)
- Understanding Novell Secure Authentication
Services (SAS)
6Additional LDAP Training Coming Soon
Novell Security Services
- Understanding Novell International Cryptographic
Infrastructure (NICI). - Understanding NICI Foundation keys
- Managing Public Key Certificates
7Additional LDAP Training Coming Soon
Novell Security Services
- Configuring Entrusts (PKI) v3.0c for NetWare 5
- Manages Digital Certificates via NDS
8LDAP Services for NDS v3
LDAP Discussion Topics
- Section 1 Understanding LDAP v3
- Section 2 Setting up LDAP v3
- Section 3 Configuring LDAP v3
- Section 4 Troubleshooting LDAP v3
- Section 5 Additional LDAP Information
9Understanding LDAP v3
What is LDAP?
- X.500 was the standard directory access protocol
It was a heavy directory. - NDS, Banyan Vines, and others are X.500 heavy.
- NDS is a X.500 directory and is considered a
protocol Novell Directory Access Protocol or
NDAP
10Understanding LDAP v3
What is LDAP?
- Lightweight Directory Access Protocol
- Originally developed at University of Michigan.
- LDAP is a simplified way of accessing X.500
directories like NDS. - LDAP is the common denominator for accessing
different X.500 directories.
11Understanding LDAP v3
What is LDAP?
- The (Internet Engineering Task Force) or IETF
wanted to define a Lightweight Directory Access
Protocol for the Internet. LDAP is that
protocol. - The IETF created RFC 1777
- The LDAP Specification.
- http//info.internet.isi.edu80/in-notes/rfc/files
12Understanding LDAP v3
Why is LDAP so important?
- Designed for accessing X.500 directories
- Replaces bulky DAP
- Smaller
- Less overhead
- Faster
13Understanding LDAP v3
Why is LDAP so important?
- LDAP is used by Netscape, Microsoft, and many
other 3rd party applications builders to access
directory information.
14Understanding LDAP v3
Why is LDAP so important?
- LDAP allows developers to write to one standard
protocol. - Fast and Easy access to network information such
as - users, groups, devices, services, etc.
- Easy to use interfaces in 3rd party Browsers.
15Understanding LDAP v3
Why is LDAP so important?
- LDAP will eventually unify ALL directories and
their information through a single access point,
the Browser, or other LDAP Clients or Servers.
16Understanding LDAP v3
Novell and LDAP !
- Is NDS RFC 1777 or LDAP compliant?
- Yes, using LDAP Services for NDS v3
- What version of LDAP does Novell use?
- NetWare 4.x supports LDAP v1, RFC 1777
- NetWare 5 comes with LDAP v3, RFC 2251
- http//www.cis.ohio-state.edu/htbin/rfc/rfc2251.ht
ml
17Understanding LDAP v3
Novell and LDAP !
- NDS will become the LDAP server of choice because
of - Ease of Administration through NWADMIN GUI.
- 3rd party snap-ins to NWADMIN
18Understanding LDAP v3
Novell and LDAP !
- NDS will become the LDAP server of choice because
of - Largest install base over 40 million NDS users.
- Solves weaknesses of LDAP v2 and v3
- Full server to server replication
- Backend authentication
- Backend security
- Advanced schema extensions
19Understanding LDAP v3
Major Changes since Release of v1
- SSL (Secure Socket Layer) support.
- UTF8 support for International Character Set.
- Catalog Services Integration for fast lookup
- Dynamic Reconfiguration of LDAP NLM
- RFC Spec 2251 added for LDAP v3
20Understanding LDAP v3
Major Changes since Release of v1
- Dclient interface
- LDAP uses the Dclient interface to NDS. This
allows for multiple parallel connections, rather
than serializing requests one after another as
with the previous version. - Higher performance and faster NDS access, through
concurrent connections.
21Understanding LDAP v3
Major Changes since Release of v1
- LDAP Configuration stored in NDS
- LDAP now stores its configuration data in NDS
rather than in a separate configuration file.
This was SYS\ETC\NLDAP.CFG with the previous
version. - Configuration can be updated at any time with
NWADMIN32
22Understanding LDAP v3
Additional LDAP information
- University of Michigan
- http//www.umich.edu/dirsvcs/ldap/ldap.html
- Critical Angle Inc.
- http//www.critical-angle.com/ldapworld/index.html
23Understanding LDAP v3
How does LDAP work?
- LDAP Services for NDS v3 provides access to NDS
data for LDAP requests. - When an LDAP request comes in, the LDAP Services
picks it up and makes the appropriate NDS request
and then returns that information to the LDAP
requestor
24Understanding LDAP v3
How does LDAP work?
25Understanding LDAP v3
How does LDAP work?
- LDAP works over TCP and UDP
- TCP port number 389
- RFC 1777
- Defines operations of LDAP, like Bind, Unbind,
Search, Modify, Add, Delete, Compare, and
Abandon. - RFC 1798
- Defines operations of LDAP for Connectionless or
CLDAP for Search and Abandon ONLY. Examples of
this would be a browser or email lookup.
26Understanding LDAP v3
How does LDAP work?
- RFC 1777 or LDAP v2
- Defines a Bind authentication as only Clear
Text for user-id and password. - RFC2251 or LDAP v3
- Defines a Bind authentication as above, but
also with support for SSL and SASL based
authentication.
27Understanding LDAP v3
LDAP Services for NDS v3 allows
- You to define the directory information you want
to make accessible. - You to grant the rights to the LDAP clients that
you want to have access.
28Understanding LDAP v3
LDAP Services for NDS v3 allows
- Look up information about a specific person such
as - Phone number home or business
- e-mail address
- mail stop or mailing address
- department or company name
- title
29Understanding LDAP v3
LDAP Services for NDS v3 allows
- Look up information for all people with
- a given name
- a last name
- a last name that begins with some character.
- Look up information about any NDS object or entry
30Understanding LDAP v3
Novells LDAP implementation
- Novells LDAP or NLDAP.NLM solution runs on top
of NDS and provides - Support simple Clear Text authentication
- Support SSL authentication, after SSL has been
configured on the server. - Support reading as well as writing into NDS.
- Writing can be disabled.
31Understanding LDAP v3
Novells LDAP implementation
- NLDAP.NLM is a standard LDAP implementation
- Supports all LDAP v2 and v3 Directory Clients.
- Netscape Communicator 4.x or later and Admin
Server - MAPI address books, like GroupWise and Outlook
Express - http//www.umich.edu/dirsvcs/ldap/ldclients.html
32LDAP Services for NDS v3
LDAP Discussion Topics
- Section 1 Understanding LDAP v3
- Section 2 Setting up LDAP v3
- Section 3 Configuring LDAP v3
- Section 4 Troubleshooting LDAP v3
- Section 5 Additional LDAP Information
33Setting Up LDAP v3
Installing LDAP Services for NDS v3
- LDAP Services can browse the tree, so only ONE
NetWare 5 server needs to be configured with LDAP
Services. - For faster LDAP response, install an additional
LDAP service per physical location.
34Setting Up LDAP v3
Installing LDAP Services for NDS v3
- If two LDAP Catalogs are needed, then an
additional LDAP server would need to be installed
because LDAP Services only uses one Catalog. - NOTE LDAP Catalogs use up a lot of hard disk
space.
35Setting Up LDAP v3
Installing LDAP Services for NDS v3
- When installing LDAP Services the only thing that
must be decided is if you want LDAP Catalog
services installed. - This is NOT needed for every LDAP server, because
multiple LDAP servers can use a single LDAP
Catalog.
36Setting Up LDAP v3
Installing LDAP Services for NDS v3
- LDAP Services for NDS v3 is automatically
installed during the NetWare 5 installation, if
it is selected on the Java GUI graphical console
screen. - If NetWare 5 was installed, but LDAP Services
wasnt selected, it can be installed at a later
time.
37Setting Up LDAP v3
Installing LDAP Services for NDS v3
- The following files are installed from the
NetWare 5 CD. - e\products\nldap\inst
- ldapnds.nlm - installation NLM only
- e\products\nldap\sys\public\win32\nls\english
- ldap4nds.cnt
- ldap4nds.hlp
- ldapres.dll
38Setting Up LDAP v3
Installing LDAP Services for NDS v3
- The following files are installed from the
NetWare 5 CD. - e\products\nldap\sys\public\win32\snapins
- ldapsnap.dll
- e\sys\system\schema
- ldap.sch
- ldapupdt.sch
39Setting Up LDAP v3
Installing LDAP Services for NDS v3
- The following files are installed from the
NetWare 5 CD. - e\products\nldap\sys\system
- NLDAP.NLM - 8/21/98 - The LDAP Server NLM
- e\products\nldap\sys\system\nls\4
- nldap.msg
40Setting Up LDAP v3
Installing LDAP Services for NDS v3
- The following files are installed from the
NetWare 5 CD. - e\sys\etc
- testroot.der
- Test SSL Certificate for Netscape Communicator
- In Netscape select open page and point to this
file either on the CD or on the LDAP servers
SYS\ETC\testroot.der - Note Creating a Key Material Object in
NWADMIN32 will allow a real Certificate to be
signed. - Note The LDAP server object must point to that
Key Material Object. - See future training or Appnote for further
details.
41Setting Up LDAP v3
Re-installing LDAP Services for NDS v3
- Re-installing or installing after NetWare 5 has
already been installed, is done from the NetWare
5 GUI screen. - If the NetWare 5 GUI isnt running, simply do
load startx.ncf at the console.
42Setting Up LDAP v3
Re-installing LDAP Services for NDS v3
- On the NetWare 5 server that you are installing
LDAP Services - Mount the NetWare 5 CDROM
- The volume name should be NETWARE5
- Load nwconfig
- Select Directory Options
- Select Upgrade mounted volumes into the
directory - You will have to authenticate as admin to do
this. - After it completes, then exit out of nwconfig.
43Setting Up LDAP v3
Re-installing LDAP Services for NDS v3
- On the NetWare 5 server, go to the graphical GUI
console, or X console screen. - On the bottom of this screen, click on novell
- Select Install
- Select New Product button
44Setting Up LDAP v3
Re-installing LDAP Services for NDS v3
- For servers with the netware5 cdrom mounted on
that server - Change Source Path from A to one of the
following methods - files///NETWARE5 and select ok
- Select Browse and locate that mounted volume on
the server.
45Setting Up LDAP v3
Re-installing LDAP Services for NDS v3
- To install from some other server being used to
mount the netware5 cdrom - Change Source Path from A to one of the
following methods - netware//Trees/treename/netware5ndsvolumename.org
anization and select ok - Select Browse
- Select Novell Network
- Select your tree
46Setting Up LDAP v3
Re-installing LDAP Services for NDS v3
- Continued
- Authenticate to your tree
- NOTE Use admin.novell, not .admin.novell
without the leading period. - The Help Example is wrong.
- Open your tree
- Open your organization
- Highlight the NetWare5 volume name.
- Select ok
47Setting Up LDAP v3
Installing LDAP Services for NDS v3
- Now the Installation Services will start up.
It looks just like what you saw during the
NetWare 5 installation. - Select LDAP Services and any others
- Select Next
- Continue on until you can Select Finish
- LDAP Services is now installed or reinstalled.
48Setting Up LDAP v3
Installing LDAP Services for NDS v3
- NOTE
- When installing this way, if it is installing
from another servers CDROM, then sometimes the
connection gets lost or dropped, especially on a
busy network. - Simply select RETRY on the error screen and it
will continue.
49Setting Up LDAP v3
Updating LDAP with NW5 Support Packs
- NOTE The following is a must do !
- After LDAP Services for NDS v3 has been
installed, or reinstalled, then the NetWare 5
Support Pack 1 or later must be installed, or
reinstalled to update LDAP Services.
50Setting Up LDAP v3
Updating LDAP with NW5 Support Packs
- The following files are updated by the Beta 4 of
the NetWare 5 Support Pack 1. - b4nw5sp1\sys\system\schema
- ldap.sch
- ldapupdt.sch
- b4nw5sp1\products\nldap\pubic\win32\nls\english
- ldap4nds.cnt
- ldap4nds.hlp
- ldapres.dll
51Setting Up LDAP v3
Updating LDAP with NW5 Support Packs
- The following files are updated by the Beta 4 of
the NetWare 5 Support Pack 1. - b4nw5sp1\products\nldap\public\win32\snapins
- ldapsnap.dll
- b4nw5sp1\products\nldap\system
- ldapnds.nlm
- NLDAP.NLM - 12/01/98 - Updated LDAP Server NLM
- nldapi.nlm
52Setting Up LDAP v3
Updating LDAP with NW5 Support Packs
- The following files are updated by the Beta 4 of
the NetWare 5 Support Pack 1. - b4nw5sp1\products\nldap\system\nls\4
- nldapi.hlp
- nldapi.msg
53Setting Up LDAP v3
Installing NW5 Support Packs
- The following describes how to install the
NetWare 5 Support Pack 1. - Download the NW5 Support Pack.
- Extract the NW5 Support Pack.
- Open up the folder that it created.
- Run Ccnwlite.exe
54Setting Up LDAP v3
Installing NW5 Support Packs
- Continued
- Select the NetWare 5 server running LDAP to be
updated.
55Setting Up LDAP v3
Installing NW5 Support Packs
- Continued
- Select the location of the NW5 Support Pack on
the LDAP server.
56Setting Up LDAP v3
Installing NW5 Support Packs
- Continued
- Make sure the information is correct and then
select Next.
57Setting Up LDAP v3
Installing NW5 Support Packs
- Continued
- It identifies that it is going to update LDAP,
which requires authentication at the server
console. - Select yes to install and update.
58Setting Up LDAP v3
Installing NW5 Support Packs
- Continued
- It shows all information about the update
process. - Select Finish to the install / update to start.
59Setting Up LDAP v3
Installing NW5 Support Packs
- Continued
- The Patch Status window shows the number of
servers select to be updated and shows that same
number as completed. - NOTE It also show in the Status windows that
NLM loaded that requires user input. This
means you must go to the server console and
authenticate.
60LDAP Services for NDS v3
LDAP Discussion Topics
- Section 1 Understanding LDAP v3
- Section 2 Setting up LDAP v3
- Section 3 Configuring LDAP v3
- Section 4 Troubleshooting LDAP v3
- Section 5 Additional LDAP Information
61Configuring LDAP v3
Configuring LDAP Services for NDS v3
- LDAP is configured with NWADMIN32
- There are three possible LDAP objects
- LDAP Server object
- LDAP Group object
- sometimes LDAP Catalog object
62Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The LDAP Server object manages
- Time-Outs
- Limits
- SSL Configuration
- Debug Output Information
- to Screen
- to Log file
63Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The LDAP Server object manages
64Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The LDAP Group object manages
- LDAP to NDS schema mappings
- Referral and Proxy user options
- Enable or disable allow clear text passwords
- NOTE This MUST be enabled to allow non-SSL
authenticated connections. - It is NOT enabled by default.
65Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The LDAP Group object manages
66Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The LDAP Group object manages
- LDAP Attribute Map
67Configuring LDAP v3
Configuring LDAP Services for NDS v3
68Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The LDAP Group object manages
- LDAP Class Map
69Configuring LDAP v3
Configuring LDAP Services for NDS v3
70Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The LDAP Catalog object manages
- A flatfile database that contains a snapshot of
information from the Directory database. - A catalog can contain information from an entire
Directory tree or a portion of the tree. - It is stored as an NDS object and provides rapid
access to selected directory data.
71Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The LDAP Catalog object manages
72Configuring LDAP v3
Configuring LDAP Services for NDS v3
- LDAP Services for NDS v3 now has Dynamic
Reconfiguration - In LDAP Services v1, the NLDAP.NLM had to be
unloaded and reloaded when ever changes were made
to the Server or Group objects. - In LDAP Services v3, all configuration
information is stored in NDS and it will
Automatically reconfigure itself when changes are
made and saved in NWADMIN32.
73Configuring LDAP v3
Configuring LDAP Services for NDS v3
- As mentioned previously, all LDAP Services v3
information is stored in NDS. - This means there is no SYS\ETC\NLDAP.CFG file as
was used with the previous version of LDAP.
74Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The single biggest problem with LDAP Ensuring
Adequate Rights - For LDAP to return data to an unauthenticated
client - Netscape Communicator or Microsoft Internet
Explorer - CONTAINER LEVEL Public must have appropriate
NDS rights. - Browse object rights and Compare property rights
- In order for LDAP entries to be listed at the
browser - Read property rights
- Must be granted in order for property values to
be displayed.
75Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The single biggest problem with LDAP Ensuring
Adequate Rights - For LDAP to return data to an unauthenticated
client - Netscape Communicator or Microsoft Internet
Explorer - ROOT LEVEL Public must have appropriate NDS
rights. - If the entire tree is to be accessible from LDAP,
then these rights should be granted at Root. - Browse object rights and Compare property rights
- In order for LDAP entries to be listed at the
browser - Read property rights
- Must be granted in order for property values to
be displayed.
76Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The single biggest problem with LDAP Ensuring
Adequate Rights - Administrators should
- Selectively grant property rights only to those
properties and portions of the NDS tree which
they want to be publicly accessible. - Also consider the security advantages offered by
the "proxy user. - LDAP Catalog Services
- Public must have the Read right and Browse
right to the Catalog object - For browsers to access data without
authentication.
77Configuring LDAP v3
Configuring LDAP Services for NDS v3
- The single biggest problem with LDAP Ensuring
Adequate Rights - Applications which authenticate with a
distinguished name via LDAP - Must have appropriate rights granted to the
authenticating DN.
78LDAP Services for NDS v3
LDAP Discussion Topics
- Section 1 Understanding LDAP v3
- Section 2 Setting up LDAP v3
- Section 3 Configuring LDAP v3
- Section 4 Troubleshooting LDAP v3
- Section 5 Additional LDAP Information
79Troubleshooting LDAP v3
Troubleshooting LDAP Services for NDS v3
- The READ_ME.TXT file on the root of the NETWARE 5
CDROM discusses the following issues - NDS Catalog Services
- Adequate NDS Rights
- Updating a Slave Catalog
80Troubleshooting LDAP v3
Troubleshooting LDAP Services for NDS v3
- READ_ME.TXT discusses the following issues
- LDAP Services
- Adequate NDS Rights
- Removing NDS from a Server
- Using underscore characters in an objects
distinguished name. - Wont return name properly
81Troubleshooting LDAP v3
Troubleshooting LDAP Services for NDS v3
- READ_ME.TXT discusses the following issues
- LDAP Services
- Using LDAP Services with Netscape Messaging
Server. - Gives all necessary configuration information.
- Using LDAP Services with Netscape Collabra
Server. - Gives all necessary configuration information.
82Troubleshooting LDAP v3
Troubleshooting LDAP Services for NDS v3
- READ_ME.TXT discusses the following issues
- LDAP Services
- Search Time Limit Field is really Milliseconds,
not seconds. - The default value is 3600 milliseconds.
- PKI Services
- Installation, Administration, and Configuration.
83Troubleshooting LDAP v3
Troubleshooting LDAP Services for NDS v3
- Re-install LDAP as described earlier to solve
following issues - If the LDAP or Security objects become corrupt in
NDS - Public Symbols errors are seen loading LDAP or
SAS Services.
84Troubleshooting LDAP v3
Troubleshooting LDAP Services for NDS v3
- Can LDAP Services SYNC NDS?
- NO, at this moment, it can do look ups and
modifications to NDS only. - NDS works as it always has with SYNC and
Replication behind the scenes of LDAP queries.
85Troubleshooting LDAP v3
Troubleshooting LDAP Services for NDS v3
- Can NDS export information through LDAP?
- Yes, in a look up only mode through a LDAP
Client query. - LDAP Services isnt an NDS directory exporter to
other LDAP servers. This would require a SYNC
ability and this type of functionality is NOT in
the LDAP Specs.
86Troubleshooting LDAP v3
Troubleshooting LDAP Services for NDS v3
- Can User Passwords be SYNCd between NDS through
LDAP, and other LDAP servers? - This is the same problem as mentioned previously.
This is NOT a function of TODAYs LDAP Specs.
87Troubleshooting LDAP v3
Troubleshooting LDAP Services for NDS v3
- For common issues see the following
- LDAP Technical Documents
- http//support.novell.com/products/ldaps10
- LDAP FAQ
- http//www.critical-angle.com/ldapworld/ldapfaq.ht
ml
88Troubleshooting LDAP v3
Troubleshooting LDAP Services for NDS v3
- For common issues see the following
- LDAP Technical Documents
- http//support.novell.com/products/ldaps10
- Network Address in NDS Preventing User Login
2913235 - Clearing Lost Connections 2908961
- Understanding Licensed not-logged-in
Connection 2916785 - LDAP Services Installation Problems 2923586
- Setting up Group Authentication 2935661
- Could not create user via LDAP 2927596
- How to integrate LDAP with NDS? 2934960
- LDAP setup for Netscape Admin user creation
2930407
89Troubleshooting LDAP v3
Troubleshooting LDAP Services for NDS v3
- For common issues see the following
- LDAP Technical Documents
- http//support.novell.com/products/ldaps10
- Network Address in NDS Preventing User Login
2913235 - How to get Netscape to talk to LDAP? 2920151
- What LDAP clients work with LDAP for NDS?
2920150 - LDAP search doesn't return expected results
2926612
90LDAP Services for NDS v3
LDAP Discussion Topics
- Section 1 Understanding LDAP v3
- Section 2 Setting up LDAP v3
- Section 3 Configuring LDAP v3
- Section 4 Troubleshooting LDAP v3
- Section 5 Additional LDAP Information
91Understanding LDAP v3
Additional LDAP information
- LDAP for NDS v3 manuals
- http//www.novell.com/documentation/lg/nw5/docui/i
ndex.html - http//www.inet-1.com/heather/novell/ldap.htm
- Novell APPNOTE on LDAP
- http//developer.novell.com/research/appnotes/1998
/december/02/
92Understanding LDAP v3
Additional LDAP information
- Novell Technical Documents
- http//support.novell.com/products/ldaps10/
- FAQ for LDAP
- http//www.critical-angle.com/ldapworld/ldapfaq.ht
ml - Novell Product Information
- http//www.novell.com/products/nds/ldap.html
93Understanding LDAP v3
Additional LDAP information
- University of Michigan
- http//www.umich.edu/dirsvcs/ldap/ldap.html
- Critical Angle Inc.
- http//www.critical-angle.com/ldapworld/index.html
94What is coming?
Enhancements to LDAP for NDS
- Quick adoption of new RFCs
- Query performance enhancements.
- Data migration
- Directory synchronization via LDAP or Directory
to Directory Sync.
953rd Party Products..
WEB Based Server Management
- WebConsole for NetWare by Hitecsoft
- Product Info
- http//www.hitecsoft.com/html/webconsole.htm
- Trial Download Page
- http//www.hitecsoft.com/html/download.htm
96