From 94ec116fcac722857634c38f894dcd339fb57bee Mon Sep 17 00:00:00 2001 From: Howard Chu Date: Wed, 29 Apr 2009 02:31:20 +0000 Subject: [PATCH] Rewritten --- contrib/slapd-modules/nssov/slapo-nssov.5 | 321 ++++++++++++++-------- 1 file changed, 213 insertions(+), 108 deletions(-) diff --git a/contrib/slapd-modules/nssov/slapo-nssov.5 b/contrib/slapd-modules/nssov/slapo-nssov.5 index 71ba5e26cf..416320d138 100644 --- a/contrib/slapd-modules/nssov/slapo-nssov.5 +++ b/contrib/slapd-modules/nssov/slapo-nssov.5 @@ -3,7 +3,7 @@ .\" Copying restrictions apply. See the COPYRIGHT file. .\" $OpenLDAP$ .SH NAME -slapo-nssov \- NSS lookup requests through a local Unix Domain socket +slapo-nssov \- NSS and PAM requests through a local Unix Domain socket .SH SYNOPSIS ETCDIR/slapd.conf .SH DESCRIPTION @@ -11,25 +11,38 @@ The .B nssov overlay to .BR slapd (8) -allows NSS lookup requests through a local Unix Domain socket. +services NSS and PAM requests through a local Unix Domain socket. It uses the same IPC protocol as Arthur de Jong's nss-ldapd, and -a complete copy of the nss-ldapd source is included here. It also -handles PAM requests. +a complete copy of the nss-ldapd source is included along with the +nssov source code. .LP -The main objective here was to eliminate the libldap dependencies/clashes that -the current pam_ldap/nss_ldap solutions all suffer from. A secondary objective -was to allow for the possibility of more sophisticated caching than nscd -provides. (E.g., run slapd back-ldap + pcache on each node.) Of course, you -can also completey eliminate cache staleness considerations by running a -regular database with syncrepl. +Using a separate IPC protocol for NSS and PAM requests eliminates the +libldap dependencies/clashes that the current pam_ldap/nss_ldap solutions +all suffer from. Both the original nss-ldapd and this nssov solution +are free from these library issues. .LP -And of course, another major objective was to allow all security policy to be +Unlike nss-ldapd, since this overlay executes inside slapd it allows for +the possibility of sophisticated caching, without any of the weaknesses of +nscd and other related caching solutions. E.g., a remote LDAP database can +be accessed using back-ldap with proxy caching (see +.BR slapd-ldap (5) +and +.BR slapo-pcache (5) +) to leverage back-ldap's +connection pooling as well as pcache's persistent caching, to provide +high performance and a measure of support for disconnected operation. +Alternatively, cache considerations can be completely eliminated by running +a regular database with syncrepl to maintain synchronization with a remote +LDAP database. +.LP +Another major benefit of nssov is that it allows all security policy to be administered centrally via LDAP, instead of having fragile rules scattered across multiple flat files. As such, there is no client-side configuration at -all for the pam/nss stub libraries. (They talk to the server via a Unix domain -socket whose path is hardcoded to /var/run/nslcd/). As a side benefit, this -can finally eliminate the perpetual confusion over /etc/ldap.conf vs -/etc/openldap/ldap.conf. +all for the NSS/PAM stub libraries. (The stubs talk to the server via a Unix +domain socket whose path is hardcoded to /var/run/nslcd/). As a side benefit, +this can finally eliminate the perpetual confusion between OpenLDAP's +ldap.conf file in ETCDIR/ldap.conf and the similarly named files typically +used by pam_ldap and nss_ldap. .LP User authentication is performed by internal simple Binds. User authorization leverages the slapd ACL engine, which offers much more power and flexibility @@ -43,37 +56,31 @@ overlay. See the .B nss-ldapd/README for more information on the schema and which features are supported. .LP -To use the overlay add: -.LP -.RS -.nf - include nis.schema - - moduleload nssov.so - ... - - database hdb - ... - overlay nssov -.fi -.RE -.LP -to your slapd configuration file. (The nis.schema file contains -the original [RFC2307] schema. Some modifications will be needed to -use [RFC2307bis].) +You will also need to include the nis.schema in your slapd configuration +for RFC2307 support. If you wish to use RFC2307bis you will need a slightly +different schema. You will also need the ldapns.schema for PAM authorization +management. .LP -The overlay may be configured with -.B Service Search Descriptors (SSDs) -for each NSS service that will be used. SSDs are configured using -.LP -.RS -.nf - nssov-ssd -.fi -.RE -.LP -where the may be one of -.LP +You must select +.B ldap +in the appropriate services in +.I /etc/nsswitch.conf +in order for these NSS features to take effect. Likewise, you must +enable +.B pam_ldap +for the authenticate, account, session, and password services in +.I /etc/pam.conf +or +.I /etc/pam.d +for these PAM features to take effect. + +.TP +.B overlay nssov +This directive adds the nssov overlay to the current backend. +.TP +.B nssov-ssd +This directive configures a Service Search Descriptor (SSD) for each NSS +service that will be used. The may be one of .RS .nf alias @@ -89,15 +96,11 @@ where the may be one of shadow .fi .RE -.LP and the must be of the form -.LP .RS -.nf - ldap:///[][??[][?]] -.fi +.TP +.B ldap:///[][??[][?]] .RE -.LP The .B will default to the first suffix of the current database. @@ -106,22 +109,154 @@ The defaults to "subtree". The default .B depends on which service is being used. -.LP +.TP +.B nssov-map If the local database is actually a proxy to a foreign LDAP server, some -mapping of schema may be needed. Some simple attribute substitutions may -be performed using -.LP -.RS -.nf - nssov-map -.fi -.RE -.LP -See the +mapping of schema may be needed. This directive allows some simple attribute +substitutions to be performed. See the .B nss-ldapd/README for the original attribute names used in this code. +.TP +.B nssov-pam