Gentoo Infrastructure LDAP guideLDAP stands for Lightweight Directory Access Protocol, a lightweight client-server protocol for accessing directory services. LDAP directory service is based on a client-server model. One or more servers contain the data making up the LDAP directory tree. An LDAP client connects to an LDAP server and requests information. The server responds with the data or points the client to another source. (typically another LDAP server). Just like a database, an entry in LDAP consists of fields of data or 'Attributes'. This collection of attributes is called a 'Schema'. This guide will explain which attributes are available, who can change them and give role based examples for modifying the Gentoo LDAP Schema. When a developer accesses a resource, like dev.gentoo.org (woodpecker.gentoo.org), the resource acts as an LDAP client and queries the LDAP server (ldap1, ldap2, ldap3, ldap4) to see if that user is in the database and authorized for access. LDAP is used by Gentoo to secure the infrastructure. Gentoo resources are spread across the globe and LDAP gives us a central location to manage them. There are four levels of access: anonymous, user, recruiter and infra that are used to control what can be changed in the LDAP database. These are controlled via special values in the gentooAccess attribute. You must connect or bind to the LDAP database either anonymously, or a known user. Binding anonymously will always grant only the anonymous level, while binding as a known user will grant you the level based on your user and potentially where you are connecting from. The anonymous level is used for simple read only informational queries. All developers and staff can bind to LDAP as anonymous. If you don't specify a mode when you bind, anonymous is assumed. The user level is used to add or change information in your own LDAP record. Things like your latitude and longitude, ssh public key and so on. All users can access the user level, by binding as themselves with the mode specified, and providing their password. The recruiter level enables recruiters to add new users, and perform some administrative changes to users. The infra level enables the infrastructure team full power over LDAP, and is additionally protected by only being available from ldap1.gentoo.org (toucan.gentoo.org).
Currently we have four LDAP servers available. The master server and three slave servers. The master LDAP server is reachable at ldap1.gentoo.org. The slave servers are ldap2.gentoo.org, ldap3.gentoo.org, ldap4.gentoo.org and they connect every 60 seconds to the master to replicate changes from the master. Every update operation must be done on ldap1.gentoo.org, if an update (which means writing some entry) is performed on the slave a referral to the master is issued. This is transparently handled and all attempts to update against the slave will be redirected to the master. Connections are validated via TLS + password. The password is your dev one and is the same for all LDAP-aware boxes. We use a custom script, perl_ldap that uses Net::LDAP, for accessing and modifying the database, it allows only a predefined set of actions but it should cover 95% of the cases. In the following chapters we explain how to use it.
The following attributes are included in the Gentoo Schema. Note the 'Access Level' needed to write each attribute. Anonymous reading is allowed unless otherwise noted. Required fields are emphasised.
The following attributes were in use at some point in the past, but have been retired: gentooHerd, gentooAltMail, gentooForumsUID.
LDAP management with perl_ldap These are the main concepts of the perl_ldap script used for user administration. Invoking perl_ldap without arguments shows a nice help. Your own dev.gentoo.org password is asked when binding. The script is the infra supported method for managing entries, nothing prevents you from using any LDAP browser you like for modifying your attributes. If you like to use something else, ask infra for connection details but keep in mind that we won't support and/or troubleshoot other browsers issues. The following are the most common options.
Gentoo Developers and Staff members (recruiters and infra please refer to the following sections) can update their LDAP record directly. Here are examples of the most commonly changed attributes. The most common error is using a actual username in place of the -b MODE argument, which takes user as the parameter.
Recruiters can change their own attributes or those of another user. You must bind as recruiters to change any attributes including your own. The following examples show how to change attributes for other users. To change your own attributes use the examples from the "users" section above but bind as a recruiter. When dealing with users that belong to a sub-OU the -o OU option must be used, this will be clarified in the examples. The command -o OU must be used if the target user belongs to a sub-OU. The following examples will show you how to change attributes for users, recruiters and infra. All write operations performed by infra against another user must be performed on dev.gentoo.org (woodpecker.gentoo.org). Some attributes, like sshPublickey, and mail, allow multi-values. To append an additional value to the exiting ones use -C. You may not use -M with multi-valued attributes.
Infra can change their own attributes or those of another user. You must bind as user to change any attributes, including your own. To change your own attributes use the examples from the "users" section above from any LDAP-aware machine. To change another users record, you must be using perl_ldap from ldap1.gentoo.org (dunlin.gentoo.org). The attribute gentooAccess controls which boxes a user can login to. Only infra and a few selected recruiters are allowed to create and modify this multi-value attribute. The FQDN must be used (ex. roadrunner.gentoo.org). Some special values also exist: infra.group, infra-ldapadmin.group, infra-cvsadmin.group, infra-system.group, recruiters.group.
If you have issues, questions or encounter errors please contact the Gentoo Infrastructure Team. The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. |
|
