[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

gosa as ldap frontend

Hi all,

the last days I've spent on testing how gosa might be used as ldap
frontend for debian-edu. Currently, there is no working Version in
Squeeze, but hopefully this changes before the freeze (
http://bugs.debian.org/573220 ).

After some minor configuration fixes (see below), gosa can be
configured and started. Many plugins never needed for skolelinux can
be removed/commented in the config file and finally the basics remain:
Users, Groups and system/machines. I testet a bit adding users and
groups and found that with templates (which we could provide in ldap),
things get not too complicated. Adding machines to allow dhcp-offers
works as well, of course there are no predefined names or IP-ranges.

What's missing are netgroups (
https://oss.gonicus.de/pipermail/gosa/2010-April/004497.html )
and some other lwat features especially targeted for skolelinux. To
add machines to netgroups as well, I hacked the system-plugin, see
patch below. With this (draft) patch applied, it is possible to check
the netgroups a machine is associated with (see attached screenshot).
(The patch is probably really ugly, it's the first time I used php.
For example, it does not remove the netgroup entries if a machine is
deleted completely...).   

Concerning security, things seem to have improved. There is now a
command which encrypts the password and I guess only the hash is left
in the configuration file, see gosa's README.Debian for details. 

To sum up: I guess, if someone is familiar with php programming and
able to invest a couple of days, it would probably be possible to adopt
gosa to our needs and perhaps even prepare our own plugins. (
https://oss.gonicus.de/labs/gosa/wiki/DocumentationInstallingGOsaWritingPlugins )  
Maybe, lwat can be kind of plugged in :).

So if anyone interested, feel free to move on! I probably forgot some
details, just ask if you want to give it a try yourself and things do
not work as explained below.



Details for the brave:

Download the packages at gonicus or add this line to sources.list: 
deb http://oss.gonicus.de/pub/gosa/debian-lenny/ ./ 

I used these packages (perhaps some more):

ii  gosa                            2.6.9-1lenny1
ii  gosa-plugin-dhcp                2.6.9-1lenny1
ii  gosa-plugin-dhcp-schema         2.6.9-1lenny1
ii  gosa-plugin-ldapmanager         2.6.9-1lenny1
ii  gosa-plugin-systems             2.6.9-1lenny1
ii  gosa-schema                     2.6.9-1lenny1

Now some (gosa-) schema-files have to be included in
slapd-lenny_debian-edu.conf, mine looks like:
# $Id: slapd-skolelinux.conf,v 1.7 2003/06/27 14:47:20 pere Exp $

# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/courier.schema
include         /etc/ldap/schema/automount.schema
include         /etc/ldap/schema/inetorgperson.schema
#include                /etc/ldap/schema/gosa/samba.schema
include         /etc/ldap/schema/dhcp.schema
include         /etc/ldap/schema/dnsdomain2.schema

include         /etc/ldap/schema/gosa/samba3.schema
include         /etc/ldap/schema/gosa/trust.schema
include         /etc/ldap/schema/gosa/gosystem.schema
include         /etc/ldap/schema/gosa/gofon.schema
include         /etc/ldap/schema/gosa/goto.schema
include         /etc/ldap/schema/gosa/gosa-samba3.schema
include         /etc/ldap/schema/gosa/gofax.schema
include         /etc/ldap/schema/gosa/goserver.schema
include         /etc/ldap/schema/gosa/goto-mime.schema
include         /etc/ldap/schema/gosa/hdb.schema

include         /etc/ldap/schema/lis_new.schema

# Where the pid file is put. The init.d script
# will not stop the server if you change this.

Remove dateOfBirth from lis.schema it's already defined some where in
the gosa stuff:

--- schema/lis.schema   2009-08-30 14:16:59.000000000 +0200
+++ schema/lis_new.schema       2010-04-16 19:35:37.000000000 +0200
@@ -22,14 +22,6 @@
        EQUALITY  caseIgnoreIA5Match )

-# LiS.1.2  dateOfBirth
-attributetype ( NAME 'dateOfBirth'
-       DESC     'Date of birth, accurate to the day'
-       SYNTAX
-       EQUALITY  generalizedTimeMatch
-       SINGLE-VALUE )
 # LiS.1.3  kinship

Now start the configuration tool. There are many options I do not know
(and did not care) much about, but you must finish the dialogs/checks
without errors. We could provide an adopted ldap tree and an
out-of-the-box configuration for skolelinux. 

Apply the attached patch at /usr/share/gosa/plugins/admin. Remember:
Probably I forgot something.
Happy hacking!
diff -ru systems_orig//class_termDNS.inc systems/class_termDNS.inc
--- systems_orig//class_termDNS.inc	2010-04-22 20:26:50.000000000 +0200
+++ systems/class_termDNS.inc	2010-04-22 20:37:02.000000000 +0200
@@ -461,10 +461,28 @@
       $smarty->assign("staticAddress","<font class=\"must\">*</font>");
       $smarty->assign("autonetACL",$this->acl_is_writeable("macAddress") && $this->acl_is_writeable("ipHostNumber")?"rw":"");
-      $display.= $smarty->fetch(get_template_path('network.tpl', TRUE));
+    $ldap = $this->config->get_ldap_link();
+    $ldap->cd($this->config->current['BASE']); 
+    $filter="(&(objectClass=nisNetGroup)(!(memberNisNetGroup=*)))"; 
+    $ldap->search($filter,array("cn","nisNetgroupTriple"));
+    $selected= array();
+    $netgroups= array();
+    while($attrs = $ldap->fetch()){
+      if (isset($attrs['nisNetgroupTriple']) && (in_array('('.$this->cn.',-,-)', $attrs['nisNetgroupTriple']))){
+	$netgroups[] = $attrs['cn'][0]; 
+	$selected[] = $attrs['cn'][0];
+      }else{
+	$netgroups[] = $attrs['cn'][0];
+      }
+    }
+//    print_a($netgroups);
+//    @DEBUG (DEBUG_TRACE, __LINE__, __FUNCTION__, __FILE__, $memberOf, "Hallo");
+    $smarty->assign('netgroups', $netgroups);
+    $smarty->assign('selected', $selected);
+    $display.= $smarty->fetch(get_template_path('network.tpl', TRUE));
@@ -859,6 +877,48 @@
+//    print_a($_POST);
+    print_a($_POST['checkbox']);
+    $ldap->cd($this->config->current['BASE']); 
+//	$ldap->modify($this->attrs);
+    $filter="(&(objectClass=nisNetGroup)(!(memberNisNetGroup=*)))"; 
+    $ldap->search($filter,array('dn','cn','nisNetgroupTriple'));
+    // loop over netgroups:
+    while($attrs = $ldap->fetch()){
+      unset($attrs['nisNetgroupTriple']['count']);
+      $ldap->cd($attrs['dn']);
+      $new = array();
+      // machine is a member but should not be one:
+      if (isset($attrs['nisNetgroupTriple']) && 
+	in_array('('.$this->cn.',-,-)', $attrs['nisNetgroupTriple']) && 
+	!in_array($attrs['cn'][0], $_POST['checkbox'])){
+	@DEBUG (DEBUG_TRACE, __LINE__, __FUNCTION__, __FILE__, $attrs['cn'][0], "remove ".$this->cn." from");
+	$new= array();
+	$tmp = array('('.$this->cn.',-,-)');
+	$new['nisNetgroupTriple'] = array_values(array_diff($attrs['nisNetgroupTriple'], $tmp));
+      }
+      // machine is not a member but should be one:
+      elseif ((!isset($attrs['nisNetgroupTriple']) || 
+		!in_array('('.$this->cn.',-,-)', $attrs['nisNetgroupTriple'])) &&
+		in_array($attrs['cn'][0], $_POST['checkbox'])){
+	@DEBUG (DEBUG_TRACE, __LINE__, __FUNCTION__, __FILE__, $attrs['cn'][0], "add ".$this->cn." to");
+	if (isset($attrs['nisNetgroupTriple'])){
+	  $tmp = $attrs['nisNetgroupTriple'];
+	  $tmp[] = '('.$this->cn.',-,-)';
+	  $new['nisNetgroupTriple'] = array_values(array_unique(array_merge($tmp)));
+	  $ldap->modify($new);
+	}else{
+	  $new = array('nisNetgroupTriple'=>'('.$this->cn.',-,-)', 'objectClass'=>'nisNetgroup');
+	}
+      }
+      $ldap->modify($new);
+      print_a($new);
+      if(!$ldap->success()){
+	msg_dialog::display(_("LDAP error"), msgPool::ldaperror($ldap->get_error(), $attrs['dn'], LDAP_MOD, get_class()));
+      }
+    }
     $this->dialog = FALSE; 
diff -ru systems_orig//network.tpl systems/network.tpl
--- systems_orig//network.tpl	2010-04-22 20:26:50.000000000 +0200
+++ systems/network.tpl	2010-04-22 20:27:36.000000000 +0200
@@ -182,6 +182,10 @@
+<p class="seperator">&nbsp;</p>
+{html_checkboxes name='checkbox' selected=$selected values=$netgroups output=$netgroups separator="<br />" style="vertical-align:middle"}
 <input type="hidden" name="network_tpl_posted" value="1">
Only in systems: services
Only in systems: systemSelect

Attachment: Preview1.png
Description: PNG image

Reply to: