Multiple Directory Administrative Users

Most of LDAP directory servers configure a single well known directory administrative account (cn=Directory Manager [,dc=example,dc=com]) which has full access to everything. While there is a need to have one special user to bootstrap the server, we are too often seeing that special account being used by all applications that have specific administrative needs : the provisioning application, the email management application, …

OpenDJ has different mechanisms to define multiple administrative accounts, but today, I’m going to focus on the “Root DNs” i.e. defining multiple Directory Managers.
The default administrative account is “cn=Directory Manager”, and is stored in the configuration under the “cn=Root DNs,cn=config” container entry.
Adding another administrative account is as simple as adding another entry under that container, with one specific objectClass : ds-cfg-root-dn-user.

Create a file newAdmin.ldif

dn: cn=Second Admin,cn=Root DNs,cn=config
cn: Second Admin
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: inetOrgPerson
objectclass: ds-cfg-root-dn-user
sn: Second Admin
ds-cfg-alternate-bind-dn: cn=Admin2,dc=example,dc=com
ds-pwp-password-policy-dn: cn=Root Password Policy,cn=Password Policies,cn=config
userPassword: password42
ldapmodify -a -D cn=Directory Manager -j /var/tmp/dmpassfile -f  newAdmin.ldif
Processing ADD request for cn=Second Admin,cn=Root DNs,cn=config
ADD operation successful for DN cn=Second Admin,cn=Root DNs,cn=config

If you prefer, you can choose not to set the password in the LDIF file, but set it in a secure way afterwards :

$ bin/ldappasswordmodify -p 1389 -D “cn=directory manager” -j /var/tmp/dmpassfile -a “”cn=Admin2,dc=example,dc=com” -N /var/tmp/newpw
The LDAP password modify operation was successful

Where /var/tmp/dmpassfile contains the password for “cn=directory manager” and /var/tmp/newpw the new password for Admin2.
Did you notice the “ds-cfg-alternate-bind-dn” attribute in the definition of the new administrative account ? This enables to authenticate to the directory server with the DN value specified in this attribute, while the entry still has a DN and is located under the “cn=config” suffix.

More Here

Courtesy:http://ludopoitou.wordpress.com/2011/01/10/multiple-directory-administrative-users/

More about → Multiple Directory Administrative Users

Lightweight Directory Access Protocol PHP

Introduction

Installing/Configuring

• Requirements
• Installation
• Runtime Configuration
• Resource Types

Predefined Constants

Using the PHP LDAP calls

Examples

• LDAP search example

LDAP Functions

• ldap_8859_to_t61 — Translate 8859 characters to t61 characters
• ldap_add — Add entries to LDAP directory
• ldap_bind — Bind to LDAP directory
• ldap_close — Alias of ldap_unbind
• ldap_compare — Compare value of attribute found in entry specified with DN
• ldap_connect — Connect to an LDAP server
• ldap_count_entries — Count the number of entries in a search
• ldap_delete — Delete an entry from a directory
• ldap_dn2ufn — Convert DN to User Friendly Naming format
• ldap_err2str — Convert LDAP error number into string error message
• ldap_errno — Return the LDAP error number of the last LDAP command
• ldap_error — Return the LDAP error message of the last LDAP command
• ldap_explode_dn — Splits DN into its component parts
• ldap_first_attribute — Return first attribute
• ldap_first_entry — Return first result id
• ldap_first_reference — Return first reference
• ldap_free_result — Free result memory
• ldap_get_attributes — Get attributes from a search result entry
• ldap_get_dn — Get the DN of a result entry
• ldap_get_entries — Get all result entries
• ldap_get_option — Get the current value for given option
• ldap_get_values_len — Get all binary values from a result entry
• ldap_get_values — Get all values from a result entry
• ldap_list — Single-level search
• ldap_mod_add — Add attribute values to current attributes
• ldap_mod_del — Delete attribute values from current attributes
• ldap_mod_replace — Replace attribute values with new ones
• ldap_modify — Modify an LDAP entry
• ldap_next_attribute — Get the next attribute in result
• ldap_next_entry — Get next result entry
• ldap_next_reference — Get next reference
• ldap_parse_reference — Extract information from reference entry
• ldap_parse_result — Extract information from result
• ldap_read — Read an entry

More Here

Courtesy:http://php.net/manual/en/book.ldap.php

More about → Lightweight Directory Access Protocol PHP