Understanding Directory Services and LDAP

Directory services are specialized databases engineered for hierarchical data storage and high-volume read operations. Unlike traditional relational databases that prioritize complex transactions and frequent writes, directory systems optimize for fast lookups, authentication workflows, and centralized identity management. Updates in a directory are atomic: either the entire operation succeeds, or it fails completely.

LDAP (Lightweight Directory Access Protocol) is the standard application protocol for accessing and maintaining distributed directory information services over TCP/IP. Its a streamlined derivative of the X.500 standard and serves as the foundation for many enterprise identity solutions, including Active Directory.

Core Terminology and Data Model

LDAP organizes data using a strict naming convention and tree structure. Familiarity with these abbreviations is essential for configuration and querying:

• dc (Domain Component): Represents segments of a domain name. Example: dc=corp,dc=io maps to corp.io.
• ou (Organizational Unit): Logical containers used to group entries, such as ou=engineering or ou=systems.
• cn (Common Name): A human-readable label for an object, typically a full name or service identifier.
• uid (User ID): The unique login identifier for a person or system account.
• dn (Distinguished Name): The absolute, unique path to an entry in the directory tree. Example: uid=jdoe,ou=staff,dc=corp,dc=io.
• rdn (Relative Distinguished Name): The leftmost component of a DN that uniquely identifies an entry within its immediate parent.
• objectClass: A schema definition that dictates which attributes are mandatory or optional for a given entry.

Architecture and Operational Characteristics

OpenLDAP operates on a client-server model where the server (slapd) maintains the Directory Information Tree (DIT) and clients perform queries or modifications. Key architectural traits include:

• Read-Optimized Storage: Data is structured for rapid retrieval. Write operations are significantly slower and lack transactional rollback capabilities.
• Hierarchical Organization: Entries are stored in a tree format rather than tabular rows, eliminating the need for SQL joins.
• Replication and Distribution: Supports provider-consumer synchronization, referral routing, and load-balanced query distribution across multiple nodes.
• LDIF Format: All data imports, exports, and schema modifications use the LDAP Data Interchange Format, a plain-text standard where entries are separated by blank lines and attributes follow a key: value syntax.

Environment Preparation and Installation

The following procedures assume a RHEL/CentOS-based environment. Ensure system packages are updated, time synchronization is active, and firewall/SELinux policies are configured to allow LDAP traffic (TCP 389/636).

# Install core server, client utilities, and NSS/PAM integration modules
sudo yum install openldap openldap-servers openldap-clients nss-pam-ldapd -y

# Verify installation and check service status
rpm -qa | grep openldap
systemctl status slapd 2>/dev/null || service slapd status

Server Configuration and Initialization

OpenLDAP 2.4+ transitioned from a flat configuration file to an online configuration (OLC) system stored in /etc/openldap/slapd.d/. However, many administrators still generate the OLC structure from a traditional slapd.conf template for clarity.

Generating Administrator Credentials

# Create a hashed password for the directory superuser
slappasswd -s "C0mpl3xDirP@ss!" | sed 's/{SSHA}/rootpw\t{SSHA}/' >> /etc/openldap/slapd.conf

Defining the Directory Suffix and Backend

Edit /etc/openldap/slapd.conf to establish the base DN, administrative bind DN, and storage engine. Remove default placeholder blocks and insert the following:

database        hdb
suffix          "dc=infra,dc=lab"
rootdn          "cn=directory-admin,dc=infra,dc=lab"
rootpw          {SSHA}vK8xL2mP9zQwR4tY7uI0oA3sD5fG6hJ8kL9mN0pQ

# Performance and logging tuning
loglevel        256
cachesize       2000
checkpoint      4096 15

Parameter Breakdown:

• database hdb: Specifies the Hierarchical Berkeley DB backend (alternative: mdb for modern deployments).
• suffix: The base search context for the directory.
• rootdn: The privileged account bypassing ACLs for management tasks.
• checkpoint: Flushes memory buffers to disk after 4096 operations or 15 minutes, whichever occurs first.

Access Control and Logging

Replace default restrictive ACLs with a baseline policy that allows authenticated users to modify their own entries, anonymous users to bind, and everyone to read public attributes:

access to *
    by self write
    by anonymous auth
    by * read

Configure system logging to capture directory events:

echo "local4.*    /var/log/slapd.log" >> /etc/rsyslog.conf
systemctl restart rsyslog

Database Directory and Schema Validation

# Prepare the data directory and apply default DB tuning
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -R ldap:ldap /var/lib/ldap
chmod 700 /var/lib/ldap

# Validate configuration syntax
slaptest -u

Migrating to OLC and Starting the Service

Clear the existing OLC directory and regenerate it from the flat file to prevent version conflicts:

rm -rf /etc/openldap/slapd.d/*
slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
chown -R ldap:ldap /etc/openldap/slapd.d/

# Enable and start the daemon
systemctl enable slapd
systemctl start slapd

Verify connectivity and empty state:

ldapsearch -x -LLL -H ldap://localhost -D "cn=directory-admin,dc=infra,dc=lab" -W -b "dc=infra,dc=lab" "(objectClass=*)"

A response of No such object (32) or an empty result set confirms successful initialization with no populated entries.

Web-Based Administration with LDAP Account Manager

For graphical management, deploy LDAP Account Manager (LAM) alongside a standard LAMP stack:

sudo yum install httpd php php-ldap php-gd -y
cd /var/www/html
tar -xzf ldap-account-manager-5.4.tar.gz
mv ldap-account-manager-5.4 lam
cd lam/config

# Duplicate sample configurations
cp config.cfg_sample config.cfg
cp lam.conf_sample lam.conf

# Update domain and admin references
sed -i 's/cn=Manager/cn=directory-admin/g' lam.conf
sed -i 's/dc=my-domain/dc=infra,dc=lab/g' lam.conf

# Apply web server ownership and restart Apache
chown -R apache:apache /var/www/html/lam
systemctl restart httpd

Access the interface via http://<server-ip>/lam. Default profile passwords are defined in config.cfg and lam.conf (typically lam initially). Use the dashboard to create organizational units, POSIX groups, and user accounts.

Data Management: Backup, Import, and Deletion

Directory data should be exported regularly using server-side tools to capture internal metadata like UUIDs and timestamps.

Exporting Directory Data

# Full backup including operational attributes
slapcat -l /var/backups/openldap/directory_full.ldif

# Alternative: Client-side export (excludes some internal metadata)
ldapsearch -x -LLL -D "cn=directory-admin,dc=infra,dc=lab" -W -b "dc=infra,dc=lab" > /var/backups/openldap/client_export.ldif

Importing and Modifying Entries

Use ldapadd to inject LDIF data. Ensure target DNs do not already exist to avoid conflicts:

ldapadd -x -D "cn=directory-admin,dc=infra,dc=lab" -W -f /var/backups/openldap/directory_full.ldif

Removing Entries

# Delete a single user account
ldapdelete -x -D "cn=directory-admin,dc=infra,dc=lab" -W "uid=legacy_user,ou=staff,dc=infra,dc=lab"

# Recursively remove an organizational unit and all children
ldapdelete -r -x -D "cn=directory-admin,dc=infra,dc=lab" -W "ou=deprecated,dc=infra,dc=lab"

Configuration Notes and Common Pitfalls

• Domain Suffix Alignment: The suffix directive must match your network's DNS or /etc/hosts configuration. Mismatches between the server's hostname resolution and the base DN frequently cause bind failures or service startup errors.
• Backend Module Loading: Directives like moduleload back_hdb or back_mdb are only required when dynamically loading storage engines. For standard deployments using compiled-in backends, these can be safely commented out.
• Relational Database Backends: While OpenLDAP's data model originates from RDBMS concepts, substituting Berkeley DB/MDB with PostgreSQL or MySQL is possible via back-sql. This is generally discouraged unless specific enterprise integration requirements exist, as native backends deliver superior read performance and lower latency.
• Flat File vs. OLC Configuration: Versions 2.3 and earlier rely exclusively on slapd.conf. Version 2.4+ defaults to the cn=config DIT. Attempting to run 2.4 with only a flat file without generating the slapd.d structure results in Invalid credentials (49) errors during client binds. Always regenerate OLC after flat-file modifications.
• Schema and ObjectClass Validation: LDIF imports strictly adhere to loaded schema files (core.schema, cosine.schema, nis.schema, etc.). Attributes cannot be arbitrarily assigned; they must be permitted by the entry's objectClass. Validation failures during ldapadd almost always stem from missing schema includes or incorrect attribute mapping.
• Case Sensitivity in UID Matching: Modern OpenLDAP hardcodes the uid attribute matching rule to caseIgnoreMatch within the binary, making it case-insensitive by default. Altering this behavior via schema files triggers duplicate attribute errors. If case-sensitive authentication is mandatory, define a custom attribute (e.g., loginId) in a private schema, apply caseExactMatch, and configure applications to bind against the custom attribute instead of uid.