LDAP Configuration

These instructions refer to OpenLDAP. If you use another LDAP server, you are on your own.

The LDAP Schema

The version of Aiakos currently shipping contains a sample dataset that we are using for a beta deployment. This may not be, and in fact probably isn't, what you want to use. You will need to decide what information you wish to collect on each user, and then you'll need to put together the appropriate registration forms. See the UI section of the documentation for more information.

OpenLDAP Configuration

1. Edit the slapd.conf file and add a path to the aiakos schema file in the include section. For example:

           include /etc/ldap/schema/aiakos.schema
           

2. Add appropriate indexing statements to the slapd.conf file. You must add these before adding entries, or the ldap datafiles go all wrong. For example:

           index   cn,sn,uid   pres,eq,sub
           index   objectClass eq
           index   ou          eq
           index   dc          eq
           index   mail        pres,eq,sub
           

3. Add appropriate access control directives to your configuration. This can be confusing if you are not familiar with it. For a vanilla OpenLDAP setup, replace the access statements with:

           access to attribute=userPassword dn.subtree="ou=aiakos,dc=example,dc=com"
               by dn="" write
               by dn="cn=.*,ou=aiakos,dc=example,dc=com" write
               by anonymous auth
               by self write
               by * none
   
           # allow the aiakos manager to modify aiakos entries
           access to dn.subtree="ou=aiakos,dc=example,dc=com"
               by dn="cn=.*,ou=aiakos,dc=example,dc=com" write
           

   Replacing dc=example,dc=com with the root of your LDAP tree. NOTE: you may need to put the first stanza, BEFORE your existing userPassword access stanza. This is because they are checked in order, and this one is more specific!

The Schema

This is in the ldap subdirectory. Copy this to /etc/ldap/schema. You will need to change this to reflect your own requirements for data storage.

Initial LDAP Objects

You need to create a few objects in the LDAP root to enable aiakos to function. This includes the root of all aiakos objects, and the overall aiakos administrator, used by the server tool.

Take the aiakos.ldif file from the ldap subdirectory, and edit it to reflect your own LDAP root. You can probably just do:

sed -e's/dc=example,dc=com/dc=yourroot,dc=com/g' < aiakos.ldif

To generate your import file. Then change the password of the manager user. Instructions are included in the file.