HTTP Basic authentication against OpenLDAP directory

This page describes, how configure HTTP Basic authentication against the stoney cloud OpenLDAP directory.

Service User LDIF

You'll need to create a service user. The following example adds a new service user called cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org:

# Copyright (C) 2015 stepping stone GmbH
#                    Switzerland
#                    http://www.stepping-stone.ch
#                    support@stepping-stone.ch
#
# Authors:
#  Michael Eichenberger <michael.eichenberger@stepping-stone.ch>
#  
# This file is part of the stoney cloud.
#
# stoney cloud is free software: you can redistribute it and/or
# modify it under the terms of the GNU Affero General Public 
# License as published  by the Free Software Foundation, version
# 3 of the License.
#
# stoney cloud is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public
# License  along with stoney cloud.
# If not, see <http://www.gnu.org/licenses/>.
#
################################################################################
# services-administration.ldif
################################################################################
# Description:
#  Loads some service users into the LDAP directory used for AuthLDAPBindDN
#  authentication.
################################################################################

#  slappasswd -s 'verysecret'
dn: cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org
objectclass: top
objectclass: organizationalPerson
objectclass: inetOrgPerson
cn: cloud
sn: cloud
userPassword: {SSHA}TWKAnGsKhO+e3uNjoooHhEMFN8E9/D4C

Load Service User LDIF

Load the newly created services-administration.ldif into the OpenLDAP directory:

/usr/bin/ldapadd -W -M -H "ldaps://ldapm.stoney-cloud.org" -x -D "cn=Manager,dc=stoney-cloud,dc=org" -f services-administration.ldif

Password: *********** # The "cn=Manager,dc=stoney-cloud,dc=org" users password.

adding new entry "cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org"

Modify the ACL's

The newly created cloud service user needs access to the people sub tree.

$EDITOR /etc/openldap/acl/slapd.acl.people.conf

# The cloud service user needs access to the people sub tree.
access to dn.base="ou=people,dc=stoney-cloud,dc=org"
  attrs=entry
  by dn.exact="cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org" read
  by dn.regex="uid=([0-9]+),ou=people,dc=stoney-cloud,dc=org" read
  by * break

access to dn.one="ou=people,dc=stoney-cloud,dc=org"
  attrs=entry,objectClass,mail,sstEmployeeOfUID,givenName,sn,sstIsActive,cn,sstBelongsToUID
  by dn.exact="cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org" read
  by * break

After modifying the ACLs, you'll need to restart the OpenLDAP directory server (slapd):

/etc/init.d/slapd restart

Test the ACLs

ldapsearch -H ldaps://ldapm.stoney-cloud.org \
  -b "ou=people,dc=stoney-cloud,dc=org" \
  -s one \
  -D "cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org" \
  -z 5 \
  -W -x -LLL \
  "(&(sstEmployeeOfUID=4000000)(mail=name.surname@example.com))" o sn givenName sstIsActive sstBelongsToUID

Enter LDAP Password: *********** # The "cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org" password.
dn: uid=1000000,ou=people,dc=stoney-cloud,dc=org
givenName: Name
sn: Surname
sstIsActive: TRUE
sstBelongsToUID: 1